I've been lurking in the group for a long time, but I can't help but chime in: if a newbie wants to see whether a project is "reliable," don't just focus on those few screenshots of the audit report. An audit can only say "at that time, that version of the code probably didn't have obvious pitfalls," but whether the contract can be upgraded, and who holds the upgrade keys, is what someone like me with a testing mentality cares about most.

I only look at three things on GitHub: whether updates suddenly stop and then suddenly resume heavily, whether there's a bunch of copy-pasting without explanation, and whether key changes have been reviewed by someone. Then I check the multi-signature for upgrades: how many keys, what the threshold is, who the signers are (at least not all anonymous new accounts), and preferably with a delay before execution. Otherwise, if it passes audit today and then upgrades tomorrow, it could change face… Anyway, I accept the risk of hitting a mine.

By the way, recently everyone has been complaining that validators eat MEV and that the ordering is unfair. Hearing that makes me want to first see "who can change the rules." To put it simply: no matter how beautiful the code is written, if the permissions are all in the hands of a few, retail investors can only pray. That's all for now.