Recently, a bunch of new L1/L2 projects are launching incentives to pull TVL, and in the group, the older brothers are rushing and cursing "mining, selling," while I care more about: who really has the say in this project, and who takes the blame if something goes wrong.

Newbies want to see "credibility," but I think it's better not to focus on GitHub stars first. The key is to see: are the main contracts upgradeable? If so, who holds the upgrade authority? How many keys are needed, what are the thresholds, and are the signers the same group of people just using different aliases? Don't just look at the "passed" status in the audit report; flip to the risk grading page, especially for things like "centralized permissions," "reentrancy/callbacks," "emergency pause." Many of these are not vulnerabilities but "design choices," in other words, whether they can change the rules with a single click in the future.

My usual habit is: first trace the admin, proxy, timelock, multisig addresses, and see if they match on-chain; if they do, then consider interactions; if not, just forget it—earning a little less helps me sleep better.