QA report: external/app.onmi.fun at hosted
Token creation accepts invalid social link formats, while key transactional features remained untestable without a Web3 wallet.
Testing covered token creation form validation, network switching, token discovery, the creator dashboard, and chart controls on the Arc Testnet. Out of twelve scenarios, six were blocked because core transactional actions—such as token deployment, buying, selling, gas calculations, commenting, and swapping—require an active Web3 wallet provider not present in the automated headless environment.
A single medium-severity functional issue was confirmed during token creation form validation. The Website, X, and Telegram fields accept arbitrary plain text without checking for valid URL formats, rendering invalid strings directly as link destinations in the token preview.
The remaining five accessible scenarios passed, including required field enforcement on creation, chain error handling, search filters, and chart timeframe toggles. However, full release confidence requires testing on-chain transactions with an active wallet environment.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 5 |
| Failed | 1 |
| Blocked | 6 |
| Findings raised | 1 |
| Issues after the audit | 1 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 0 / 1 / 0 |
Target: https://app.onmi.fun/?chain=ARC_TESTNET · Testing level: deep_feature · Stack: unknown
Issues
Medium severity
F1 · Social link fields on token creation form lack URL format validation
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S7
The tester's observation explicitly confirms that the invalid strings were accepted by the form and rendered directly into the preview link attributes without any validation errors. The page reported 2 console errors during the scenario.
Expected: The application should validate social link inputs for proper URL formatting (e.g. valid https:// URLs) and display validation errors for invalid links, preventing form submission.
Actual: The create-token form accepts arbitrary plain text ('invalid_link') in the Website, X, and Telegram URL fields without URL formatting validation errors, and renders them directly as href='invalid_link' in the preview.
Steps to reproduce:
- Navigate to /create-token?chain=ARC_TESTNET
- Enter Coin Name ('Test Coin') and Symbol ('TEST')
- Click 'Add social links (Optional)'
- Enter 'invalid_link' in the Website, X, and Telegram URL input fields
- Click 'Create coin'
Evidence: screenshots/S7-9.png, screenshots/S7-11.png
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Create and launch a new token on Arc | high | blocked (Token [redacted] requires an active Web3 wallet connection to sign and broadcast the smart contract deployment transaction, which cannot be completed in the headless browser environment without an injected Web3 wallet provider.) | none |
| S2 Buy a token against the bonding curve | high | blocked (Executing a token [redacted] against the bonding curve requires an active Web3 wallet connection to sign and broadcast on-chain transactions, which is unavailable in the automated headless test environment.) | none |
| S3 Sell an existing token balance | high | blocked (Trading and selling token [redacted] requires an active Web3 wallet connection, which is not available in the headless browser environment.) | none |
| S4 Verify MAX shortcut correctly reserves USDC gas | high | blocked (Cannot verify USDC gas reservation on ARC Testnet without a connected Web3 wallet containing a USDC balance.) | none |
| S5 Graceful failure on unsupported chain switch | high | pass | none |
| S6 Validate required fields on Token Creation | medium | pass | none |
| S7 Validate URL formatting for social links | medium | fail | F1 |
| S8 Post a comment in the token discussion thread | medium | blocked (Posting a comment requires connecting an active Web3 wallet, which is not available in the headless browser environment.) | none |
| S9 Filter and search live tokens on the Discover page | medium | pass | none |
| S10 Access the Creator dashboard | medium | pass | none |
| S11 Execute a swap with a custom recipient address | low | blocked (Submitting and confirming the on-chain swap transaction requires an external connected Web3 wallet with testnet funds, which is unavailable in this headless environment.) | none |
| S12 Toggle chart timeframes | low | pass | none |
The audit
The Critic reviewed 1 finding and re-verified 3 of them live in the browser, replaying the reported steps on a fresh page.
- Over half of the test scenarios (7 out of 12) were blocked due to the lack of an injected Web3 wallet, rendering the core transactional paths untestable in this environment.
- Console logs consistently show failed WebSocket connections and missing route parameters associated with the Robinhood chain, even when tests explicitly targeted the ARC Testnet.
- A possible defect in S12 ("Missing route parameter causes Next.js href interpolation failure") was not promoted: the live replay came back inconclusive.
- A possible defect in S12 ("Silent failure when fetching chart candle data across timeframes") was not promoted: the live replay came back inconclusive.
- A possible defect in S9 ("Token [redacted] JSON fails to download on Discover page") was not promoted: the live replay came back inconclusive.
What to fix first
- Implement URL format validation for Website, X, and Telegram fields on the token creation form to prevent malformed link submissions (F1).
Coverage and caveats
In scope: Token creation on Arc Testnet; Token trading and bonding curve interaction; Wallet native gas reservation on MAX shortcuts; Cross-chain network switch rejection handling; Discover and Creator dashboards; Swap with send-to-address functionality.
Not covered: Campaigns and Passport quests (out of primary deep feature focus); Analytics page validation (read-only multichain metrics); Uniswap V3 specific routing (focusing on OnmiSwap and Bonding Curve); Ranking leaderboard (requires extensive multi-user trade history).
- The injected test wallet automatically connects on Arc Testnet when requested.
- The wallet has sufficient test USDC to cover token deployment and trades.
- The MAX button logic correctly calculates gas from the USDC balance.
- Sell scenarios assume the wallet holds a balance of the target token.
- The application supports appending ?chain=ARC_TESTNET to routes as per intake.
- S1 could not be executed: Token [redacted] requires an active Web3 wallet connection to sign and broadcast the smart contract deployment transaction, which cannot be completed in the headless browser environment without an injected Web3 wallet provider..
- S2 could not be executed: Executing a token [redacted] against the bonding curve requires an active Web3 wallet connection to sign and broadcast on-chain transactions, which is unavailable in the automated headless test environment..
- S3 could not be executed: Trading and selling token [redacted] requires an active Web3 wallet connection, which is not available in the headless browser environment..
- S4 could not be executed: Cannot verify USDC gas reservation on ARC Testnet without a connected Web3 wallet containing a USDC balance..
- S8 could not be executed: Posting a comment requires connecting an active Web3 wallet, which is not available in the headless browser environment..
- S11 could not be executed: Submitting and confirming the on-chain swap transaction requires an external connected Web3 wallet with testnet funds, which is unavailable in this headless environment..
By the numbers
| Metric | Value |
|---|
| Scenarios | 5 passed, 1 failed, 6 blocked of 12 (46 planned steps) |
| Browser actions | 275 (77 clicks, 18 inputs, 42 navigations, 138 snapshots) |
| Screenshots | 40 (4 explore, 35 scenario, 1 critic), 35 captioned |
| Coverage | 11 pages, 3 forms, 4 flows, 8 console errors |
| Audit | 1 findings, 3 re-verified live, 1 confirmed, 0 promoted, 0 withdrawn |
| Model calls | 222 |
| Tokens | 1,463,558 input, 12,393 output, 28,414 thinking |
| Time | 27 min |
| Wallet | 0 transactions, 0 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 32 | 206,889 | 3,156 | 1,816 | 263 |
| plan | 1 | 5,483 | 2,410 | 5,254 | 57 |
| test | 163 | 1,114,883 | 5,292 | 10,513 | 1019 |
| critique | 25 | 134,522 | 1,286 | 10,330 | 251 |
| report | 1 | 1,781 | 249 | 501 | 7 |
