I almost invested in a new protocol before; the page looked pretty decent, and the group was also praising it as "audited." I fell into my old habit of checking GitHub: not just looking at star counts, but mainly seeing if the commits were continuous, whether the key code suddenly had a big overhaul, and if anyone raised security issues in the issues but was ignored. Then I looked at the audit report, and the focus wasn't on the conclusion that said "no major risks," but rather on which contracts it audited and whether it clearly explained upgradeable proxies and permissions. What really discouraged me was the multi-signature upgrade: who the signers are isn't public, the threshold is ridiculously low, and there's an "emergency upgrade" backdoor, which basically means rules can be changed at any time.

Recently, retail investors have been complaining about MEV and unfair ordering; I can understand that, since on-chain transactions are inherently prone to being "cut in line" by the faster players. Anyway, I didn't understand it at the time, so I didn't proceed, and sure enough, there was a security incident related to permissions later on... It's not that I'm particularly clever, just afraid of trouble.