I used to think that checking a project's "credibility" was just about looking at audit reports to see if big institutions had stamped them, but I realized that more important is: whether there are continuous updates on GitHub, if the changes are clearly explained, who has the authority to upgrade permissions—adding multiple signers, what the threshold is, whether people can be added or rules changed temporarily—these can better reveal the risk boundaries than a single PDF page. Auditing, in simple terms, is like a health check at a certain point in time; later upgrades are like a new body. Recently, there's been a heated debate over NFT royalties, but I care more about whether the contract/market rules can be changed with a single click... When liquidity tightens, the first thing to be "optimized" is often not the transaction fee. Anyway, my current approach to choosing projects is just one sentence: first confirm if I can withstand the worst-case scenario, then talk about returns.