The third time a friend asked, "Is this project reliable?", I now look at three things first: whether GitHub is still active (not that kind of fake diligence where they update the README a bunch of times a week), whether the audit report is understandable and whether high-risk issues have really been fixed, and finally, who holds the upgrade permissions—multiple signers, what the threshold is, whether there's a time lock, at least not allowing one person to arbitrarily change the contract.

Recently, the testnet incentives and point-earning waves have heated up again, and everyone is guessing whether the mainnet will issue tokens. To be honest, even if the airdrop expectations are tempting, don’t take the "might be issued" as "trustworthy." My own rules are still the same: avoid projects with opaque permissions, reduce positions where upgrades can change logic with a single click, and if I do participate, I consider it a lesson learned… that’s all for now.