Contract analysis - owner spawned 1000 billion tokens ($20 bounty)

Question

I am currently writing a contract analysis tool (something similar to Token Sniffer) and there's one malicious contract that caught my attention. After the token's launch, contract owner somehow spawned 1 trillion tokens (even though max supply was 1 billion) and dumped them all at once effectivelly draining the entire liquidity pool (basically a rug pull). Contract was renounced and 100% of liquidity tokens were burned.

I'm analysing the contract's source code however I can't see any functions that would spawn 1000 billion tokens. Maybe there's someone here that is more experienced with Solidity and would notice something I don't see? I'd really appreciate your help.

From what I can see there is another owner in the contract, marketingAddress variable for reference. And that's the address that dumped all the coins, however like I said I can't find any function which would mint that amount of tokens.

Also, if you end up helping me and finding the malicious function I'll send you 0.012Ξ - around $20 :)

---

Contract in question: https://etherscan.io/address/0x9b7cadf33a421bee7316a41aae7549a6e41a1007#code

Token chart: https://dexspy.io/eth/token/0x9b7cadf33a421bee7316a41aae7549a6e41a1007

1 trillion token dump tx: https://etherscan.io/tx/0xd4b44461035ad6c66c877325378b3a9ee9af466b58e40fdcf8d7e0bb4017f671

Answer 1

This is the constructor of the token contract

constructor(address router_, address marketingAddress_) 
    ERC20("exit(0);", "exit(0);") 
    payable 
{
    uniswapV2Router = IRouter(router_);
    uniswapV2Pair = IFactory(uniswapV2Router.factory()).createPair(uniswapV2Router.WETH(), address(this));
    isUniswapV2Pair[uniswapV2Pair] = true;

    _approve(msg.sender, router_, type(uint256).max);

    marketingAddress = marketingAddress_;
    address _owner = marketingAddress;

    _isExcludedFromFees[msg.sender] = true;
    _isExcludedFromFees[marketingAddress] = true;
    _balances[_owner] = _totalSupply * _decimalFactor;
}

if you take a look at this line in the constructor

    address _owner = marketingAddress;

he is assigning the marketingAddress to _owner variable to misled people. and this in the last line he is giving the _owner that is actually the marketingAddress _totalSupply times _decimalFactor(10 ** _decimals)

    _balances[_owner] = _totalSupply * _decimalFactor;

this is the wallet that was able to sell and drain the liquidity. since he isn't issuing any Transfer log, it would be difficult to track in etherscan.

Thank you for using dexspy!