When I look at projects lately, I always start by checking GitHub—not pretending to be a professional, but just trying to find a few “signals”: is the code being updated continuously, are there really people chasing down bugs in the issues, and do PR discussions have real back-and-forth rather than some one-and-done dumping the repo as a storefront. And as for the audit reports, I only focus on a few points: whether the auditors dare to write about the “scope that wasn’t covered,” whether key risks have been taken on by the project team and fixed, and what I fear most is seeing a bunch of conclusions all labeled “low”—which only makes me feel even more uneasy after reading.

The multi-signature upgrade is more straightforward: who the signers are, whether they’re decentralized, whether the threshold can keep out single points of reckless decision-making... To put it plainly, I’d rather move slower, because I don’t want to wake up one day and find the contract has been “hotfixed.” Recently, there’s been a big fuss about privacy coins/mixing compliance, but I actually care more about whether the project clearly spells out its boundaries—don’t shout “privacy is freedom” while dumping all the risks onto users. It’s pretty exhausting. For now, let’s do this steadily.