QA report: external/arcport.xyz at hosted
Session mode fails to initialize API calls in the Playground, accompanied by validation and error-handling defects in webhooks and channel lookups.
Testing covered 12 scenarios evaluating EOA and Circle Wallet V2 identity creation, wallet persistence resets, API playground modes, webhook creation, channel proof loading, and single-page navigation. Live execution of charge-mode API calls was blocked because the testnet wallet lacked the required USDC balance for settlement.
A significant functional failure occurred in the Playground, where session mode fails to initialize and does not execute API requests, providing no inline feedback. Additionally, input validation is incomplete: submitting an empty webhook destination URL fails silently without showing an error, and submitting an empty channel ID triggers an unnecessary API request that returns a 404 error.
While wallet provisioning, valid webhook setup, and session proof loading operate as expected, the playground session breakdown blocks primary evaluation workflows, and the silent validation failures degrade the onboarding and configuration experience.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 9 |
| Failed | 2 |
| Blocked | 1 |
| Findings raised | 2 |
| Issues after the audit | 3 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 1 / 1 / 1 |
Target: https://arcport.xyz/ · Testing level: deep_feature · Stack: unknown
Issues
High severity
F1 · Session mode fails to initialize and does not execute API requests in Playground
Severity: high · Type: functional · Verdict: confirmed · Scenario: S5
The evidence describes a silent failure where clicking the session initialization buttons produces no UI feedback, state update, or session response. The live replay was inconclusive: The replay ran out of tool calls before it reached the reported state.
Expected: Session initializes, updates session state, executes the signed API call offchain/onchain, and renders JSON response data.
Actual: Clicking session open buttons produces no session initialization, no API response is returned, and status remains 'No session yet' with no inline feedback.
Steps to reproduce:
- Navigate to https://arcport.xyz/
- Click the 'Playground' button in navigation
- Select an API from the API selector dropdown (e.g. joke-1)
- Click 'Session mode'
- Fill in Parameters (JSON) field with valid JSON test data
- Click 'Open 10-call session' or 'Open 10-call session onchain'
Evidence: screenshots/S5-1.png, screenshots/S5-3.png, screenshots/S5-10.png
Medium severity
F2 · Webhook creation fails silently with no validation error when URL is empty
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S9
The evidence confirms the application fails silently without providing a validation message when the required webhook destination URL is omitted.
Expected: A clear validation error should be displayed indicating that the webhook destination URL is required.
Actual: No validation message or error state is displayed to the user; clicking the button does nothing and fails silently.
Steps to reproduce:
- Navigate to https://arcport.xyz/
- Click on the 'Webhooks' navigation button
- Type a valid Arc address (e.g. '0xdad302Af4B9a03D27b75C05810F0631899985094') into the 'Arc address to watch' input
- Leave the 'Your webhook URL' field empty
- Click the 'Create webhook' button
Evidence: screenshots/S9-7.png
Low severity
F3 · Empty channel ID submission triggers API request returning 404
Severity: low · Type: functional · Verdict: promoted · Scenario: S12
Surfaced by the audit of S12, which the Tester passed, and reproduced live: Navigated to Proof Mode and clicked the 'Load proof' button while the channel ID textbox was empty. No client-side validation prevented the action, and the UI failed silently without providing validation feedback, which aligns with the report of it triggering an invalid background API request. The page reported 1 console error during the scenario.
Expected: The form should validate the input client-side and prevent submission without triggering a network request.
Actual: An API request was triggered, resulting in a 404 console error.
Steps to reproduce:
- Navigate to Proof Mode at https://arcport.xyz/
- Leave the channel id textbox empty
- Click the 'Load proof' button
Evidence: screenshots/critic-M2-1.png
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Create EOA wallet identity | high | pass | none |
| S2 Create Circle Wallet V2 identity | high | pass | none |
| S3 Reset local wallet persistence | high | pass | none |
| S4 Execute API call in Charge mode | high | blocked (Charge-mode API calls require onchain/Gateway USDC balance on Arc Testnet; the wallet has 0.000 USDC so live settlement cannot complete without external funding.) | none |
| S5 Execute API call in Session mode | high | fail | F1 |
| S6 Create onchain USDC webhook subscription | high | pass | none |
| S7 Playground requires API selection | medium | pass | none |
| S8 Webhook requires target address | medium | pass | none |
| S9 Webhook requires destination URL | medium | fail | F2 |
| S10 Load valid channel session proof | medium | pass | none |
| S11 Verify SPA navigation and balance refresh | medium | pass | none |
| S12 Proof loader requires channel ID | low | pass | F3 |
The audit
The Critic reviewed 2 findings and re-verified 3 of them live in the browser, replaying the reported steps on a fresh page.
- Scenario S12 claims no API request was triggered for an empty channel ID, but a 404 console error directly contradicts this.
- Scenario S7 logged 402 and 400 console errors despite the tester only observing the UI, indicating failing background requests or state leakage.
- A possible defect in S7 ("Playground view triggers unprompted 402 and 400 console errors") was not promoted: the live replay came back not-reproduced.
What to fix first
- Restore session initialization and API execution in the Playground, ensuring clear status feedback is displayed (F1).
- Display an inline validation error when a user attempts to create a webhook without providing a destination URL (F2).
- Prevent proof loader submissions with empty channel IDs from making failing API requests (F3).
Coverage and caveats
In scope: Operator wallet identity creation (EOA and Circle V2); API Playground with Charge and Session payment modes; Onchain USDC webhook registrations; Session proof verification and loading; Form validations for empty required states.
Not covered: Faucet or LI.FI funding (requires interacting with external unmapped systems).
- The injected test wallet will automatically connect and sign transactions required for the Playground and Webhooks without manual UI interaction.
- A valid '0x... channel id' will be generated by a Session mode call that can be used in the Proof Mode scenario, or the app accepts a mock ID for testing UI state.
- S4 could not be executed: Charge-mode API calls require onchain/Gateway USDC balance on Arc Testnet; the wallet has 0.000 USDC so live settlement cannot complete without external funding..
By the numbers
| Metric | Value |
|---|
| Scenarios | 9 passed, 2 failed, 1 blocked of 12 (55 planned steps) |
| Browser actions | 232 (71 clicks, 23 inputs, 19 navigations, 119 snapshots) |
| Screenshots | 42 (4 explore, 36 scenario, 2 critic), 36 captioned |
| Coverage | 1 pages, 3 forms, 3 flows, 0 console errors |
| Audit | 2 findings, 3 re-verified live, 2 confirmed, 1 promoted, 0 withdrawn |
| Model calls | 219 |
| Tokens | 1,104,464 input, 10,343 output, 23,738 thinking |
| Time | 13 min |
| Wallet | 0 transactions, 0 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 34 | 178,077 | 1,869 | 1,838 | 146 |
| plan | 1 | 3,375 | 2,100 | 3,236 | 41 |
| test | 161 | 834,749 | 5,040 | 10,121 | 443 |
| critique | 22 | 86,570 | 1,035 | 7,768 | 110 |
| report | 1 | 1,693 | 299 | 775 | 10 |
