Libsodium Audit Results

Fuzzing will catch C related bugs - it won't generally detect crypto implementation bugs, which this appears to have focussed on.

There's a lot of people who can write a fuzzer in their spare time and I'd be surprised if libsodium had never been a target. Comprehensive crypto audits on the other hand, are a different story.

Edit: It does state dynamic analysis was performed for classes of C bugs