The scary thing for me in ditching the old code base has been those undocumented corner cases. You generally find them by saying "We don't need that" to some piece of code and later find out it was a bug fix 5 years ago. It always seems worse with stored procedures when moving databases.
If the only spec is the old code base, then you are probably doomed.
I haven't worked on a big project without version control, and I don't see it as a substitute for an actual specification. I have also not see complete explanations of patches be explained in detail enough to substitute for a spec.
If the only spec is the old code base, then you are probably doomed.