It appears to be UDP only in the sense that SCTP and other reliable protocols can also be tunneled over UDP, presumably just to make it easier to get through firewalls and initial user-space implementations easier to build on existing socket apis (excluding raw sockets.)
However, it is definitely stateful because of the reliable transport it provides on top of UDP. DoS issues have been discussed on the mailing list, where spoofed UDP packets can flood the connection table: