Web3Memes Rug Pull

What the code allows:

1. The constructor gives the full supply to the deployer and whitelists the deployer and the token contract: _tokenBalances[_msgSender()] = _tokenTotalSupply; _isAddressWhitelisted[owner()] = true;.
2. Transfers between two non-whitelisted addresses need _isTradingOpen, which only the owner can change: function openTrading(bool value) public onlyOwner. require(_isTradingOpen); runs for every non-whitelisted transfer, so closing trading blocks both buys and sells for everyone outside the whitelist. With _isSwapEnabled set to true in the constructor (the contract has no function to change it), require(sender == uniswapV2Pair || recipient == uniswapV2Pair); also stops ordinary wallet-to-wallet transfers for non-whitelisted holders.
3. On sells (recipient == uniswapV2Pair) the contract checks require(!_isAddressBlacklisted[sender], "Blacklisted"); require(!_isAddressBlacklisted[_msgSender()], "Blacklisted");. The first line blocks a blacklisted holder. In a router sell the second line checks the router address, because the router is msg.sender of transferFrom, so blacklisting the router would block every router-based sell. Buys, where the pair is the sender, are not blacklist-checked.
4. modifyBlacklist and modifyWhitelist are guarded by onlyWhitelist, not onlyOwner, so any whitelisted address can blacklist or whitelist wallets without limit. The code evidence does not show that any address was blacklisted or that trading was closed.

What De.Fi's REKT database and PeckShield report:

5. De.Fi lists the deployer as adding liquidity and then removing it in a second transaction. PeckShield's alert of 2022-02-23 says Web3Memes was rugged and that an address it names deposited 625 BNB to Tornado Cash.