I’m currently assessing the project “Trustworthy or Not.” I don’t look at the ads first—I check GitHub and the audit reports first. GitHub isn’t about how many stars you have; it’s about whether anyone has been working recently: commit frequency, whether there are a bunch of temporary branches, and whether key contract changes come with explanations. Also, don’t put blind faith in the logos on audit reports—focus on whether there are items marked as “Unfixed/Only Partially Fixed,” especially the parts related to permissions and upgrades.

And there are upgrade multi-signatures: how many people, whether they’re decentralized or concentrated in a few hands, and whether there’s a timelock (the kind that gives everyone time to react). In plain terms, it comes down to whether you can “change the rules with a one-click action in the middle of the night.”

Lately, hardware wallets have been out of stock, and phishing links have been popping up more often. The more I look, the more I feel that transparent permissions matter more than saving a few dollars in transaction fees… Tonight, I’m planning to double-check the multi-sig addresses and timelocks for the commonly used protocols. That’s it for now.