Lately, when looking at projects' "credibility," I don't even bother reading the white paper first; I check GitHub and audit reports first... The results are often both funny and frustrating: GitHub is lively, commits rain down, but it's mostly just changing README files and adjusting formats; audit reports are there too, with conclusions written confidently, but details are full of "known risks/not in scope," basically saying don't take it too seriously.

Upgrading multi-signature setups is more like weather forecasting: who the signers are, whether they are independent, what the threshold is, whether there's a timelock (giving you reaction time)—these are much more useful than "we are decentralized." For beginners, I have just one sentence: can you see permission boundaries on-chain? Can you have time to revoke? If yes, then add some points.

By the way, the NFT royalty disputes also seem pretty similar: everyone talks about protecting creators, but in reality, they’re just calculating how to make liquidity and commissions more convenient... Anyway, I only position myself for the worst-case scenario, don’t expect human nature to suddenly become noble.