Security
Reviews
The code has been audited only by AI models (Anthropic's Claude). No human security firm, cryptographer or SQIsign author has reviewed it before launch. That covers the Rust implementation, the vendored SQIsign and RandomX C code, and the boundary between them. Mainnet is the code's first exposure to outside attackers.
Outside reviews will be listed here as they are published, each labelled with who performed it. None has been performed yet.
SQIsign standardisation status
SQIsign is not a NIST standard. It is one of nine candidates NIST advanced to Round 3 of its additional digital-signature process in May 2026. That round is expected to last about two years, a draft standard could not appear before about 2028, and SQIsign may be dropped. "Level I" and "Level V" refer to the security categories the parameters target, not to any NIST approval. This section is updated at each NIST milestone.
If later cryptanalysis weakens SQIsign, or NIST drops it, Spek's only remedy is a migration to another signature scheme through a hard fork, and every operator chooses for themselves whether to adopt it. The reasons for choosing SQIsign, and what a Level I break would and would not allow, are on the Cryptography page.
Threat model
Each threat, the mechanism that addresses it, and what remains. This is section 15 of the white paper, verbatim; the open problems are in section 17, also on the Limitations page.
| Threat | Mechanism | Residual |
|---|---|---|
| Score grinding | Score inputs (key, commitment, reveal) all fixed before the beacon; seed binds only parent seed + key + reveal; no producer-malleable bytes | Withholding at a beacon height: 0.3–0.6% of an attacker's own wins over all epochs, no compounding |
| Stake shifting into a pre-chosen key | Stake counts only below a cutoff a full epoch before the beacon height | Closed |
| Commitment copying / reveal replay | Key bound into the score preimage and every commitment leaf | Closed |
| Predicted winners (targeted DoS, bribery) | Scores unknown until each header is published | None for live slots |
| Sybil (post-seed) | One output ≥ 80% of reward per draw, aged 24–36 h | Attack share = capital share; concentration risk is economic, not protocol |
| Sybil (seed phase) | RandomX ticket per stake address per 3-day round, recorded on chain before it counts; Spek-variant VM | Launch seats: the search opens at a Bitcoin block, so every searcher starts together and no record exists before it; the organiser could leave a listed entry out of the sealed list, which the public listings and the witnessed seal digest expose. No party has an informed abort: the launch beacons depend on a Bitcoin block mined after the seal |
| Private-branch rewrite | Fixed draws; pins bound running nodes; checkpoints bound fresh nodes | A private branch chooses its own beacons: break-even attacker share 0.45–0.47 within the pin; about 0.42 for a fresh node without checkpoints |
| Bought or dormant keys signing old branches | Restoration pins and compiled checkpoints | Unbonded stake cannot bound this; such keys add to an attacker's share at no cost to the seller |
| Clock steering | Authenticated Roughtime quorum, operator diversity, RAW-clock projection, 5 s step bound, mining hold | A quorate colluding cohort can walk the clock 5 s per sync; pool composition is the security parameter (§17) |
| Equivocation | One entry per key per attempt; different content → slot negated, proof gossiped | None beyond forfeited slot |
| Header / body flood | Claimed-score pre-filter, structural gates before signature; per-peer verify caps; pull-only bodies; rate limits; escalating IP bans | Griefing bounded; winning power unaffected by flood rate |
| Stake-address dust | One counted output per draw, value-ordered index | Each extra step costs a full stake unit |
| Validation-cost amplification | Per-input signature budget debited before verify; Level V witness bytes weighted by ρ; positive-only cache; rank-1-only full validation | Adversarial leaf ≈ 1.27× honest signature density |
| Deep reorg / long range | Depth-4 comparison, bounded rollback, untruncated chainwork, restoration pins, checkpoint barrier | Partitions longer than the pin lag need operator recovery |
| Fake-chain mining halt | Mining never suppressed by download | None |
| Eclipse during sync | 8-peer minimum (1 with hard-coded seed), diversity caps, no relaxing flag | Small deployments depend on seed reachability for deep-fork resolution |
| Fund burn | Output-form whitelist; canonical keys and addresses | Leaf authors remain responsible for witness-injective scripts |
| Witness malleability | Identities exclude witness bytes: txids and block hashes do not cover signatures, the merkle root commits to the exact witnesses; canonical wire, minimal numbers, clean stack, minimal-if, one signature rule | SQIsign signatures themselves stay malleable (no strong unforgeability, by design): a mempool copy may differ from the one mined, which costs a re-verify, never an identity |
| Harvest-now quantum attack | Keys hidden behind hashes until spent; Level V for long-lived custody | Stake keys are public in headers; the payout rule keeps one stake unit per key |
| Quantum or classical break of SQIsign | SQIsign everywhere; independent slot secrets; reserved version selectors | Depends on SQIsign holding (a NIST Round 3 candidate, not a NIST standard; implementation audited only by AI models); a Level I break allows equivocation negations and history rewrites down to the pin, not live-slot theft; migration is a scheduled hard fork |
Bug bounty
The bug bounty terms (scope, severity levels, how rewards are paid and the disclosure channel with its key) are published on this page before genesis. Until then no bounty is offered.
Release signing keys
Spek releases are signed by several independent builders, and the build is reproducible. The builder keys, their fingerprints and the steps to verify a download are published here with the first release.