But your question about an audit is still a good one! Tarsnap has bug bounties, but the top hit for “spiped security audit” led to a sort of amusing flame war on HN [1].
It's also considerably simpler than wireguard, which reduces the potential for vulnerabilities; and operates on a per-connection basis, which means you can do things like establishing a secure connection to another host but have a socket endpoint which can only be accessed by certain users.
I would absolutely love to get some deliberate code review from experts. I know tedu has looked at some of the code -- he sent me some minor corrections -- and I would certainly count him as an expert, but I don't know if his review was systematic or if he just glanced at a handful of files.