Auditing big Web3 codebases isn’t about reading everything — it’s about mapping intent, tracing money flows, and thinking like an attacker.