Recently, I saw that a certain mainstream public chain is about to upgrade/maintain again, and everyone in the group is guessing whether the ecosystem projects will move out. I instead went to check their GitHub, audit reports, and multi-signature upgrades—basically, to see if “this project usually does its homework seriously.”

I don’t look at the star count on GitHub; I look for whether updates are continuous, if issues are being responded to, and whether key changes are made all at once. Don’t just look at the cover logo in audit reports; the key points are: whether problems are clearly categorized, whether they’ve been fixed, and if there’s a re-audit. Otherwise, it’s like “only reading the conclusion of a health report,” which is a bit superficial. Multi-signature is more straightforward: how many keys, who they are, whether there’s a timelock (giving everyone time to react), and whether upgrades can change everything overnight.

My mom asked me a couple of days ago, “Why do you need to look at the code when you buy a token?” I could only reply half-heartedly: not because I’m afraid of losing money, but because I’m afraid people will run away and take the door lock with them… Anyway, I’d rather be slow than be taught a lesson by “emergency upgrades.”