Recently I’ve been looking at projects “proving their innocence,” and I usually start with GitHub: it’s not about how many stars they have, but about the commit frequency, whether the changes are concentrated in one person, and whether there are people actively asking about bugs in the issue and—surprisingly—whether anyone actually replies. Then I look at the audit reports: the focus isn’t on “passed/failed,” but on how the high-risk items will be fixed and whether there are follow-up review records. If something gets deployed before the fixes are completed, I’ll just put a question mark.

When upgrading a multi-signature setup, don’t just look at the words “multi-signature.” It’s more important who the signer accounts are, what the threshold is, and whether there is a timelock (the time you get to make an exit). Recently, social mining and fan tokens have been heating up again—people say attention is mining. Either way, the first thing I’ll ask is: who exactly owns the contract and the upgrade permissions? Don’t end up “mining” your own trust.