Everything known about Bitcoin comes from people directly reading the source code. That's all that was originally released next to the paper. Everything since then has been based on careful review of the source code and writing additional documentation from that understanding.
Edit: the documentation (that your reply is referring to) exists now because people spent the time reading the source code. This documentation didn't exist originally.
The part that seems odd to me is that with all these developers, students, researchers, and curious users nobody documented it according to the paper. Which as stated by another user doesn't seem to be the case.
Documentation produced that way is actually consistent with the statement you first quoted. I think what is happening here is that the researchers, being properly careful, verified what the software does, rather than trust to descriptions by others.
If there had been a formal specification, I imagine they would have both analyzed the specification for vulnerabilities, and checked the code for correct implementation.
Everything known about Bitcoin comes from people directly reading the source code. That's all that was originally released next to the paper. Everything since then has been based on careful review of the source code and writing additional documentation from that understanding.
Edit: the documentation (that your reply is referring to) exists now because people spent the time reading the source code. This documentation didn't exist originally.