Assuming a bad job for auditing purposes is not anywhere near the same thing as making a direct assertion that the protocol is 'riddled with holes'