As a dust collector, what I fear most isn't making no money, but picking up a bunch of "seems very stable" projects that end up in complete chaos... So now I don't just blindly trust credibility. I only look at three things on GitHub: whether someone is truly maintaining it recently (not inactive for half a year), whether changes have explanations (not just a bunch of "update" to fool people), and whether the core code has suddenly been heavily modified without explanation. Don't treat audit reports as a get-out-of-jail-free card either; flip through a couple of pages to see what the scope says and whether there are unresolved high-risk issues still live. Upgrading multi-signature is even more critical: who are the signers, how many people, is there a timelock, at least not just one person holding a key that can change the protocol. Recently, bridges have been hacked again, and oracles have been acting up—everyone's just "waiting for confirmation," which basically means don't rush in; first see how they patch the holes and tighten permissions... Anyway, I prefer to pick slowly rather than pick a bomb.