Right now, when I look at whether a project is “trustworthy or not,” I actually don’t look at K-line charts first. I take a quick look at GitHub first. It’s not that I’m trying to pretend I understand the code—I just see whether anyone has been active lately, whether they made changes, and whether security issues were raised in the Issues and then ignored… A repository that’s “as quiet as if the lights are off” makes me feel a little uneasy.

Auditing reports are the same. In plain terms, it’s whether they’re willing to write down their shortcomings, whether they’ve fixed them, and when they fixed them—don’t come in right away with all that “no major risks found” rainbow praise. And as for upgrading multi-signatures, it sounds very professional, but I only watch three things: how many people sign, whether it’s one group signing for themselves, and whether the contract can be changed with a single click. Recently, there’s a mainstream public chain that’s going to upgrade or maintain, and people in the group are all guessing whether the ecosystem will “move.” I think checking these “underlying details” is more likely to calm my nerves than guessing about the migration… Anyway, as someone like me who’s basically a beginner, the only way I can self-protect is like this.