A few days ago, I wanted to try a new protocol, so I browsed GitHub for a while. The commit history was quite active, but my security obsession made me first check "who is merging code" and whether one or two core maintainers have been absent for a long time... When reading audit reports, I don't just look at the cover page listing a few big firms; honestly, I focus on the conclusion page: what scope is covered, whether there are high-risk issues that haven't been fixed, and whether the fixes are "confirmed" or just "claimed to be fixed" by the developers. Upgrading multi-signature is even more critical; I look at the number of signatures and the threshold, and ideally, I can also see if the signers are decentralized and whether there are temporary replacements. I once encountered a situation where the project group was urging quickly, and macro discussions were about rate cut expectations, with the dollar and risk assets moving together. I was itching to act... But then I saw that the multi-signature upgrade had just been completed, and the member list hadn't been made public yet. Forget it, if I don't understand it, I won't act first. Missed opportunities are fine; at least I won't wake up in the middle of the night crying.