Lately, it feels like it’s a whole airdrop season, and a lot of projects all have basically the same art style. Once the points open up, everyone just “works” and grinds like they’re on the clock. And even the anti-bot/anti–Sybil measures feel like something out of a spy thriller. But honestly, when I look at projects, what I fear most isn’t being rugged because of weak safeguards—it’s landmines hidden in the code.

I’m a total newbie. Words like GitHub, audit reports, and upgrading multisigs already make my head spin. Later, I slowly figured out a few ways to dig for clues: for GitHub, look at how frequently it gets updated—if it hasn’t been updated for a long time, or if the repo is basically all copied-and-pasted templates, then it’s basically not worth looking further. For audit reports, the focus is whether they’re publicly available—if they’re kept under wraps, or they only provide a screenshot, then I’m left with a big question mark. As for upgrading multisigs, put simply, it’s about whether the signer addresses are well-known institutions or core members of a team—if it’s a set of freshly created accounts, even if there are 5 signers, it’s basically the same as having no signatures at all.

Anyway, during the airdrop season, many projects rush to go live. Their audit reports may not be up to date yet, and their multisig setup may also be cobbled together temporarily. I’d rather wait a bit—I’m not in a rush to charge in. After all, once you lose money, no matter how good the points are, nothing can save you.

I’m going to get back to work—continue keeping an eye on those lending protocols in the lower-tier market. It feels kind of interesting.