You can't say that a C daemon interacting with a network has no attack surface, especially as the thing runs as root.

It promiscuously makes outgoing TCP connections to an unauthenticated P2P network, so given enough time you'll eventually interact with an attacker if there is one.