Right now, when I look at whether a project is “trustworthy or not,” there are basically three things: whether GitHub has been actively moving recently (not that kind of one-time massive commit meant to cover up), whether the audit report actually says it in plain human language—what the vulnerabilities are and how they’re fixed—and finally, whether permissions are being upgraded properly: who the multi-sig signers are, what the threshold is, and whether there’s any delay. Basically, no matter how pretty the code is, if the upgrade keys are held by only two people, my heart just sinks.

I only noticed this last week after going through the third audit report: many reports are written very long, but the key line is “risk acceptance.” Don’t let a beginner be fooled by the number of pages.

Recently there’s been a lot of noise over NFT royalties, but it’s the same deal: having the rules written on-chain is one thing—the real thing that determines whether creators’ money is truly steady is who holds the execution power and who can change the rules. In any case, I’d rather move a bit slower and not chase those exaggerated APYs, so I can sleep easy.