Last night, I was reviewing project materials and got a bit scared… I almost prepared to enter a position because everyone in the “group says it’s reliable,” but then I opened GitHub and saw that the core contract hasn’t been touched in half a year, and the recent commits are still just changes to the README; there is an audit report, but the conclusion page looks pretty good, and the few medium- and high-risk items mentioned in the details are actually marked as “accept risk / to be addressed later.” More importantly, regarding upgrade permissions: who holds the multi-signature, what is the threshold, is there a timelock (that gives you buffer time), if these aren’t clearly specified, I now treat them as red flags. To put it simply, if a newbie wants to see “credibility,” don’t just look at a “verified audit,” but also check the update history, permission structure, and whether the audit has kept up with the version. Recently, during the extreme fee rate wave, everyone argued whether to reverse or continue squeezing the bubble, but I actually want to first clarify these basic questions of “who can modify the code”… that’s all for now, taking it slow is fine.