I want to explain to everyone why
#Dogeus Maximus is a scam,
one of the most sophisticated and widespread in the meme world, called "Hidden Rug Pull" via Hidden Taxation.
The reason automatic audits (like those by TokenSniffer or similar) were "positive" is that the code, at a purely syntactic level, does not contain prohibited functions such as an infinite mint() or an explicit blacklist. The scam is logically hidden in the functioning of the limits and internal swap.
The developer sent the tokens within the token contract itself. In the constructor, the creator initially allocates 100% of the supply to itself (_balances[_msgSender()] = _tTotal;).
Immediately afterward, the owner runs the function to create the liquidity pool (usually called openTrading or similar, located in the truncated final part of the text).
To do this, the smart contract requires tokens to be deposited into the contract itself. The contract then uses Uniswap's addLiquidityETH function to take those tokens, pair them with the ETH entered by the creator, and generate the trading pool. Up until this point, everything seemed normal and transparent.
The trap lies in the combination of three elements in the code: the 23% Buy/Sell Tax, the Swap Threshold (_taxSwapThreshold), and the developer's wallet (_taxWallet).
Here are the exact functions that enabled the theft:
Draining via the _transfer and lockTheSwap functions
Every time a regular user bought or sold the token, the contract withheld 23% of the tax in the form of
$DOGEUS tokens, accumulating them in the contract balance.
Look at this line of code:
uint256 public _taxSwapThreshold = (_tTotal * 1) / 100; // This represents 1% of the supply (10 million tokens)
As unsuspecting investors bought the token, the contract quickly filled with
$DOGEUS. When 1% was reached, the internal sell function (the Swap) was automatically triggered.
2. Conversion into ETH sent directly to the developer
The contract automatically sold 1% of the tokens on the Uniswap pool for ETH using the swapExactTokensForETHSupportingFeeOnTransferTokens function.
Immediately afterward, the contract sent 100% of the generated ETH to this address, declared in the constructor: _taxWallet = payable(0x5ece2eeE00D6B1003729e477321b2Ee3e520ea66);
The result: The more people bought, convinced by the positive audit, the more the contract automatically sold tokens on the pool to withdraw investors' real ETH and send them to the developer's private wallet.
3. Secondary wallets ("Team Wallets" or "Sniper Bots")
The code contains this key line in the constructor:
_isExcludedFromFee[owner()] = true;
_isExcludedFromFee[address(this)] = true;
_isExcludedFromFee[_taxWallet] = true;
Addresses marked as _isExcludedFromFee pay no taxes (0%) and have no transaction limits. The creators of these scams often use "tax-exempt" contracts or secondary wallets to withdraw large blocks of tokens before liquidity is locked up, distributing them across dozens of wallets (cluster wallets) and then gradually reselling them on the open market without the analysis bots noticing.
The audits failed because they scan the code for known scam "signatures":
• They check for a mint() (new token creation) $\rightarrow$ Outcome: Negative (Secure).
• They check for a blacklist() (manual wallet blocking) $\rightarrow$ Outcome: Negative (Secure).
• They check for renounced ownership (renounceOwnership) $\rightarrow$ If the developer renounces ownership after setting the tax rate to 23%, the algorithm says "Relinquished Ownership = Safe."
However, the algorithm cannot predict the bad faith of mathematical logic: an initial tax of 23% that resets to zero only after 45 sales (_reduceSellTaxAt = 45) allows the creator to drain almost all of ETH's initial liquidity within the first few minutes of launch simply by exploiting the purchase volume generated by hype. he used the code exactly as he designed it.
I also realized this late out of laziness, as I didn't go check.