如何验证一个项目？｜链上研究者 · Web3Origin 链上学习学院

如何验证一个项目？How to verify a project?

⏱ 8 分钟8 min

学习目标：学完你能用一套清单，把一个项目的宣传逐条对照链上事实，自己判断底子。Learning goal: after this lesson you'll be able to use a checklist to compare a project's claims against on-chain facts point by point, and judge its foundation yourself.

大白话In plain words验证项目不是听它吹得多好，而是拿一张清单，逐条去链上找证据——合约开不开源、权限集不集中、国库有没有真钱、审计是不是真的。Verifying a project isn't about how well it markets itself — it's taking a checklist and finding evidence on-chain item by item: is the contract open source, are the permissions concentrated, does the treasury hold real money, is the audit real.

验证一个项目，用这张核实清单逐条对照链上：To verify a project, use this checklist and compare against the chain item by item:

合约：是否开源？是否代理可升级？谁能升级？Contract: is it open source? Is it an upgradeable proxy? Who can upgrade it?
权限：能否增发、暂停、拉黑、改税率、动国库？这些权限在谁手里、是不是多签？Permissions: can it mint, pause, blacklist, change tax rates, or move the treasury? Who holds these permissions, and are they multisig?
国库/流动性：有多少真实外部资产？LP 是否锁定/销毁？谁能撤流动性？Treasury / liquidity: how much real external assets are there? Is the LP locked or burned? Who can pull the liquidity?
审计：审的是哪个合约、覆盖多少、有没有未修复项？别把「有审计」等同「零风险」。Audit: which contract was audited, how much was covered, are there unresolved findings? Don't equate "has an audit" with "zero risk".

心法一：把宣传和事实分开。项目方说的是「主张」，链上查到的才是「证据」。凡是拿不出链上出处的说法，先打问号。Principle one: separate marketing from facts. What the project says is a "claim"; what you find on-chain is the "evidence". Any statement without an on-chain source deserves a question mark first.

心法二：看权限而不是看承诺。「我们不会作恶」是承诺；「管理员在技术上能不能作恶」是权限。能不能，比会不会更重要。Principle two: look at permissions, not promises. "We won't do evil" is a promise; "can the admin technically do evil" is a permission. Whether it can matters more than whether it will.

工具组合：本站合约验证中心（开源/代理/权限/多签一览）+ 链上证据库（关键事件带交易哈希）+ 钱包体检（查项目方地址）。这三样能覆盖清单里的大部分项，剩下的去浏览器抠。Tool combo: this site's Contract Verify center (open source / proxy / permissions / multisig at a glance) + Evidence DB (key events with transaction hashes) + Wallet Checkup (check the project's addresses). These three cover most of the checklist; dig out the rest on the block explorer.

案例Example一个项目宣传「国库储备几十亿、已通过顶级审计、完全去中心化」。你逐条查：国库真实外部稳定币有多少？审计报告审的是哪个合约、有没有 Major 未修？管理员权限是不是真放弃了？三条查下来，宣传和事实的差距就出来了。A project claims "billions in treasury reserves, passed a top-tier audit, fully decentralized". You check each point: how much real external stablecoin is in the treasury? Which contract did the audit report cover, and are there unfixed Major findings? Were the admin permissions really renounced? After these three checks, the gap between marketing and facts shows itself.

配套工具（点开在主站打开）：Related tools (open on the main site):

📝 本节测验📝 Quiz

❓ 常见问题❓ FAQ

普通人怎么验证一个 DeFi 项目靠不靠谱？How can an ordinary person verify whether a DeFi project is trustworthy?

用一张核实清单逐条对照链上：合约是否开源/可升级、关键权限在谁手里、国库有多少真钱、LP 是否锁定、审计审了什么。把宣传当主张，把链上证据当依据。Use a checklist and compare against the chain item by item: is the contract open source / upgradeable, who holds the key permissions, how much real money is in the treasury, is the LP locked, what did the audit cover. Treat marketing as claims and on-chain evidence as the basis.

为什么说「看权限比看承诺重要」？Why is "look at permissions over promises" so important?

「我们不会作恶」是承诺，「管理员技术上能不能作恶」是权限。承诺可以随时改口，权限写在合约里、可核实。能不能，比会不会更重要。"We won't do evil" is a promise; "can the admin technically do evil" is a permission. A promise can be walked back anytime, but permissions are written in the contract and verifiable. Whether it can matters more than whether it will.