Tax-Free Fraud: Exposing the ZhongHua Scam

The report analyzes a deliberate rug pull of the ZhongHua ERC20 token: attackers deployed a token, added liquidity, then used a privileged attack contract exempted from balance checks to transfer 9.99 trillion tokens (far exceeding the declared supply) into the attack contract and swap them for ~5.884 ETH, with additional sales totaling 15.52 ETH profit. The root cause was a contract design/backdoor that bypassed sender balance verification for a tax-exempt address, allowing token creation out of thin air and successful draining of the liquidity pool.