Many people ask me how a beginner should read "credibility." I usually look at three things first: whether GitHub has had continuous commits recently (not just a one-time code dump), whether the audit report clearly states permission boundaries and fixed issues, and finally, who is responsible for the upgrade multi-signature, what the threshold is, and whether a single person can make decisions to change the logic.

Later, I found that the easiest way to go wrong isn't even missing an audit, but rather "appearing very decentralized" while the upgrade keys are held too loosely...
By the way, recently with social mining/fan tokens, that set of "attention as mining," I just see it as noise. Attention can indeed be monetized, but if the contract permissions don't change, the risk won't decrease just because of popularity.