Lately, watching new L1/L2 projects release incentives to boost TVL, old users in the group complain "mining, selling, and dumping," but I tend to check three things first: GitHub, audit reports, and multi-signature upgrades. Honestly, it's not about pretending to understand, but about giving myself some basis for "can I sleep well at night."

On GitHub, I look to see if there is long-term maintenance: not just a burst of commits with no activity afterward; if there are responses and merge records in issues, at least it shows the team isn't completely neglectful. For audit reports, don't just focus on the words "audited"; look into how the issues found were fixed, whether there was a re-audit, the more bluntly the report describes the flaws, the more I tend to trust it.

The most critical part of multi-signature upgrades: who can modify the contract, how many keys are involved, and whether there is a timelock (giving you reaction time). If it can be changed anytime without delay, then no matter how high the TVL, I only dare to pass by. Anyway, when I evaluate projects now, whether they are lively or not comes second; first, I check if they have locked up their powers in a cage.