Recently, there's been a lot of noise about re-pledging, shared security, and yield stacking "matryoshka" schemes. I might as well assume they'll have issues eventually. If you're a beginner trying to see if a project is reliable, don't just focus on KOL screenshots; first check three things: GitHub, audits, and upgrade multi-signatures.

GitHub isn't about the number of stars; mainly look at whether updates are continuous, if issues are responded to, and whether key changes are explained; if there are a bunch of commits popping up in one or two days, I get more cautious. Don't just look for the words "audited" in audit reports; check if the scope, timeframe, and known risks are clearly stated. Many pitfalls are "known but not fixed." Upgrading multi-signatures is even more important: who can modify the contract, how many people can make decisions, and whether there are delay/pause switches—basically, whether they can instantly change your position to air.

I no longer believe the phrase "audit passed = safe." Matryoshka yield schemes sound attractive, but if the control rights and upgrade permissions aren't clearly explained, don't blame me for being blunt: set your stop-loss level before entering.