NyxFoundation/speca

What it solves

SPECA addresses the limitations of traditional code-driven security auditors that rely on known bug patterns. Instead of searching for common mistakes, it focuses on whether an implementation actually adheres to its intended design, allowing it to find novel vulnerabilities—including cryptographic invariant violations—that human auditors and pattern-based tools often miss.

How it works

SPECA uses an agentic pipeline to perform "specification-anchored" auditing. It derives explicit, typed security properties from natural-language specifications and then requires the implementation to "prove" these invariants through structured proof-attempt reasoning. The process involves several phases:

1. Spec Discovery: Extracting requirements from the specification.
2. Subgraph Extraction: Identifying relevant parts of the system.
3. Property Generation: Creating a vocabulary of security properties based on the spec.
4. Code Resolution: Mapping those properties to the actual code.
5. Review: Validating the findings through a gate review process.

Who it’s for

It is designed for security researchers, bug bounty hunters, and software auditors who need to verify that complex implementations (such as smart contracts or C/C++ projects) strictly follow their technical specifications.

Highlights

• High Detection Rate: Recovered all known vulnerabilities in the Sherlock Ethereum Fusaka audit contest and discovered novel bugs confirmed by developers.
• Strong Precision: Matches top published precision (88.9% with Sonnet 4.5) on the RepoAudit C/C++ benchmark.
• Interpretable Results: False positives are traceable to specific pipeline phases rather than being opaque model hallucinations.
• Extensible: New targets can be onboarded by providing configuration files (BUG_BOUNTY_SCOPE.json and TARGET_INFO.json) without needing to change the core code.