[0xEA]

Your message length is sent in plain text and unauthenticated. Does this present a problem?

[tptacek]

Probably not, because messages are authenticated cryptographically, and the lengths are validated before being passed to libsodium. You can't truncate an authenticated message.