Auditable in the sense that the code is there to read, but the percentage of people able and willing to do so is quite low.

Accepting pull requests is also limited to a set of individuals.

> Auditable in the sense that the code is there to read

Which code? Just your client code, or the code that miners and brokers and exchanges run on their servers, too? If the claim is the latter, how do you know that the published source code actually corresponds to the executables they're running?