Integration testing, fuzzing, time boxed audits, public audit competitions, and of course stateful fuzzing with ToB. The ability to bombard billions of different permutations at the contracts to try to break the protocol is virtually impossible otherwise.
2/3