I now usually assume "just take a quick look" when checking the APY of yield aggregators. If I really want to allocate funds, I still need to go back to the contract and see who the counterparty is. To put it simply, APY is just a result display; the process might involve lending + incentives + token swaps, and there could be several layers of authorization in between. Any problem in any link isn't as simple as "yield withdrawal."

This morning, I checked a few large transactions in and out, with the same address moving back and forth between several pools. It looks like they're chasing incentives rather than long-term deposits. By the way, I can also understand why some people have recently complained about the lag in on-chain data tools and tagging systems—if the tags are half a beat behind or mislead you, and you keep reassuring yourself by looking at "institutional addresses," the counterparty might have already changed... Anyway, I just prefer to keep it simple: if I can read the source code and permissions, I look at it; if I can't understand it, I try a small position, then go eat after waking up.