To judge whether a project is legit or not, I’m not going to pay attention to how KOLs hype it right now—I’ll first check the GitHub repo and the audit reports. To put it simply, it’s not hard: if the GitHub hasn’t been maintained for a long time, or if it’s basically just one account constantly pushing code, I’ll have questions; and don’t just look at the cover logo on the audit report—focus on what was found, whether it’s been fixed, and whether there are any leftover risks, as well as whether the version number matches up.

Upgrading the multi-signature is even more important: how many people there are, what the threshold is, whether the signers are independent from each other, and whether you can change the rules with a single click. Lately everyone has been complaining about MEV and unfair ordering, but it’s actually the same logic—when power is concentrated, it’s easy for “I make the rules.” Tonight, I’ll go through the authorizations of a few older protocols first, and I’ll also write down the multi-signature addresses.