As a participant in the SHA hash function contest who broke one of the 51 Round-1 SHA-3 proposals and who worked on security proofs for another SHA-3 proposal I can say with some authority that using the sponge construction and showing statistical properties of the transformation function is not sufficient to ensure security. Of the 51 Round-1 SHA-3 proposals all of them passed statistical tests and at least one round of
review by NIST yet 33/51 were broken.
A more general point is that you should never roll your own crypto and if you must then it should be submitted for peer review by cryptographers before using it in a security critical application.
I know this is a pretty standard way to carry a technical conversation in the crypto community, but this is a pure and unadulterated argument from authority. I don't think other fields of computer science get away with this bullshit (you can't invent anything new unless you get a blessing from "the community").