As someone who’s always unlucky with perpetuals, I’ve recently stopped just looking at “APY so attractive” when checking projects… The practice of staking/sharing security and stacking yields has been criticized as a copycat, which I can understand. The more complex it gets, the more you have no idea who should take the blame when something goes wrong.

For beginners wanting to assess credibility, I currently focus on three things: First, check GitHub to see if it’s “alive,” whether there are ongoing commits, if issues are being seriously responded to, and not just a bunch of forks copying and pasting; second, glance at the audit report—don’t worry about understanding the code, at least look at who the auditing agency is, whether the scope covers the core contracts, and if any high-risk issues were left unpatched before deployment; third, upgrade to multi-signature—be especially cautious of admins with a single key, even with multi-sig, check the threshold and whether signers are decentralized, and it’s best to have a timelock to give everyone some reaction time.

The extra step I’m willing to take for security is pretty simple: I’d rather be a day or two late to get in, spending half an hour flipping through these pages… Anyway, it’s not shameful to be a bit slower if you’ve been liquidated before.