My odds are 80% obvious attacks and nitpicks, 20% something more fundamental. They mention CBC malleability, so maybe there's something in the cryptography, although I think we already knew that from the audit and it doesn't matter for our use case. We'll see