I just took a look at the contract of a yield aggregator, and the APY on the page looked pretty attractive. But after clicking in, I found a bunch of "auto rebalancing" and "re-staking" features—basically, putting your money into someone else's strategy to run. Who holds the contract permissions, what pools are connected at the bottom layer, and who bears the risk of bad debt or de-pegging—if these aren't clearly specified, I’ll just walk away. Don’t tell me about "smart optimization."

Recently, AI agents and automated trading are also very popular. Many projects boast "fully automatic profit-making," but their security audits are just for show... Anyway, my current habit is: first check permissions and upgradeability, then see who the counterparties are, and only then look at the yields. If I can do it manually, I won't grant unlimited permissions; if I can split it up, I won't put everything in one shot. I write stop-loss notes in the comments to avoid coming back later to patch up the pitfalls. That’s it for now.