Finding Severities
This page answers what each severity level means and exactly how findings turn into a code score.
Severity Levels
| Severity | What it means | Penalty |
|---|---|---|
critical | An issue that can be exploited to take, freeze or destroy funds or control of the contract. Treat as blocking | 30 |
high | A serious flaw with a realistic path to loss or to loss of control, usually needing specific conditions to trigger | 15 |
medium | A real defect with meaningful impact, typically bounded or requiring privileged access | 5 |
low | A minor defect or a deviation from good practice with limited impact | 1 |
info / informational | An observation, a note or a hardening suggestion. No impact claimed | 0 |
A finding that arrives with any other severity label is normalized to info and therefore carries no penalty. Spectra never invents a penalty for a severity it does not recognise.
How Findings Become a Code Score
Findings are grouped by the contract they were raised against. Each group is scored on its own:
group score = 100 - (sum of the penalties of that group's findings), floored at 0The headline code score is then chosen from those groups:
| Situation | How the code score is chosen |
|---|---|
| One or more groups match the project's registered core contracts | The minimum across those core groups |
| No group matches a registered core contract | The unweighted mean across all groups |
| No finding carries any usable location | A single flat 100 - penalties pass over the whole findings list. This is a last-resort fallback and only runs on an analysis that positively completed |
Why Minimum, Not Average
A large audit can span dozens of contracts, most of them quiet libraries and proxies. Averaging lets one genuinely risky core contract be washed out by many clean peripheral ones, which publishes a passing score for a project that is not passing.
Taking the minimum across the core contracts means your riskiest core contract sets the floor, and clean peripheral contracts cannot lift it. Core contracts are the ones you registered on your listing, identified by address, plus the token contract by name.
A finding that could not be attributed to any contract is assigned to the group already carrying the heaviest penalty load, so an unattributed critical is not diluted by a quiet contract.
The Code Score Fails Closed
If the code analysis did not positively complete, no code score is published. It is set to absent, never to 100.
This applies both when the analysis explicitly reports a failure and when it returns zero findings without a completed status. A clean-looking result and a result that never ran are indistinguishable from the outside, so the second one is never allowed to look like the first.
An absent code score is then skipped by the Security Score calculation, and the remaining dimensions are renormalized. It does not contribute a zero. See Audit Score Reference.
What Severity Does Not Mean
- Severity is Spectra's assessment of technical impact. It is not a statement about intent, and a critical finding is not an accusation.
- Zero findings is not proof that no vulnerability exists. It means none were surfaced by this analysis, on the source that was available, at the time it ran.
- Findings are raised by AI security analysis alongside community review, not by human or professional security auditors.
A high score does not guarantee safety. Results come from AI security analysis with community review, and the product is in beta. Always do your own research.