I used to misunderstand: a lively GitHub and a stack of audit reports meant the project was basically solid. Now my understanding is that this only counts as “there’s activity”—real credibility depends on how it upgrades, who the signers/participants are, who can move the funds, and whether they can stop the bleeding quickly when things go wrong.

When I review a project, I first focus on three things: whether the code is continuously maintained (not just someone dumping a repository and leaving it), whether the audit report clearly spells out the scope and the gaps it didn’t cover (many audits only cover part of it), and upgrade permissions—who the multi-sig signers are, how many people are required, and whether there’s a delay/notice period. Put simply, if the contract can be upgraded at any time, then even a thick audit report will be discounted by me.

Lately, AI Agents and automated trading have been hyped to the sky—I actually care even more about the on-chain interaction: too much permission being granted, signatures being mishandled, and contracts whose logic can be changed as soon as they’re upgraded. This is what truly bites behind the narrative. When the market gets hot, I disconnect for ten minutes; I lower my emotional score to 3 before coming back to read all this—anyway, don’t let the excitement carry you away.