QA report: external/arcrun.xyz at hosted
The application is blocked from key onboarding flows due to an indefinite dashboard loading state after wallet connection.
Testing exercised 12 scenarios covering wallet integration, agent claiming, profile customization, marketplace listing validations, and campaign management. Of the 12 scenarios, 8 passed, 2 failed, and 2 were blocked. The audit confirmed 2 issues and withdrew 1 finding after re-verifying a rate-limiting response that had been misattributed to data persistence.
The primary operational blocker occurs when connecting a wallet, which leaves the dashboard stuck in an indefinite loading state and prevents users from claiming initial agents or viewing inventory. Additionally, the agent rename workflow allows empty string submissions without validation, locking the user into a 30-day rename cooldown period with a blank name.
Coverage was restricted in two areas due to blocked paths: agent claiming could not be completed because of the dashboard hang, and rental listing could not be evaluated because the marketplace form lacked a rental listing option. Addressing the dashboard loading failure is required before core user onboarding can proceed.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 8 |
| Failed | 2 |
| Blocked | 2 |
| Findings raised | 3 |
| Issues after the audit | 2 |
| Withdrawn by the audit | 1 |
| Critical / high / medium / low | 0 / 1 / 1 / 0 |
Target: https://arcrun.xyz · Testing level: deep_feature · Stack: unknown
Issues
High severity
F1 · Dashboard hangs indefinitely in loading state after connecting wallet
Severity: high · Type: functional · Verdict: confirmed · Scenario: S2
The evidence shows the dashboard hangs in an indefinite 'loading…' state after connecting a wallet, corroborated by the 401 Unauthorized console error blocking the render. The live replay was inconclusive: The replay ran out of tool calls before it reached the reported state. The page reported 1 console error during the scenario.
Expected: The dashboard loads user account details, agent list, and agent claim options.
Actual: The dashboard remains stuck displaying 'loading…' indefinitely, blocking access to claiming agents or viewing inventory.
Steps to reproduce:
- Navigate to https://arcrun.xyz/dashboard
- Click SIGN IN
- Select CONNECT A WALLET and choose the connected wallet provider
- Observe the dashboard content area
Evidence: screenshots/S2-2.png, screenshots/S2-4.png, screenshots/S2-7.png
Medium severity
F2 · Agent rename form accepts empty string without required name validation error
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S7
The observation confirms that submitting an empty string triggered a network save request instead of being caught by client-side validation, leading to a 429 error. The page reported 1 console error during the scenario.
Expected: The application should prevent submission and display a validation error indicating that an agent name is required.
Actual: The application submitted the empty string without validation, briefly showed 'SAVING…', and updated the UI with 'you can rename an agent once every 30 days — next change after 2026-10-17' without displaying any validation error indicating that a name is required.
Steps to reproduce:
- Navigate to /operators/0xb412e2b09ea8b59b1cf1c8f29aa4c56fe9ab62a6
- Clear all text from the 'name agent #76' input field
- Click the 'SAVE' button
Evidence: screenshots/S7-8.png
Withdrawn findings
The Critic re-examined these claims and found the evidence did not support them. They are kept here rather than deleted.
- Agent name customization does not persist after page reload (S9, medium): The 429 Too Many Requests console error indicates the server rejected the rename attempt due to the 30-day cooldown; the name reverted on reload because it was never successfully saved, not due to a persistence defect. The page reported 1 console error during the scenario.
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Page Load and Console Integrity | high | pass | none |
| S2 Claim Initial Agent | high | blocked (Dashboard remained stuck on 'loading…' indefinitely after connecting the wallet, preventing the CLAIM AGENT button from appearing.) | F1 |
| S3 Rename Agent Profile | high | pass | none |
| S4 List Agent for Sale | high | pass | none |
| S5 List Agent for Rental | high | blocked (The expected 'Listing type (Sale / Rental)' option does not exist in the marketplace publishing form, which only supports X402 and Escrow service payment models.) | none |
| S6 Host a Campaign Contest | high | pass | none |
| S7 Rename Agent - Empty String Validation | medium | fail | F2 |
| S8 Rename Agent - Overlong Name Validation | medium | pass | none |
| S9 Agent Customization Persistence | medium | fail | none |
| S10 Market Listing - Missing Price Validation | medium | pass | none |
| S11 Market Listing - Invalid Price Validation | medium | pass | none |
| S12 Market Listing - Missing Agent Validation | medium | pass | none |
The audit
The Critic reviewed 3 findings and re-verified 2 of them live in the browser, replaying the reported steps on a fresh page.
- Finding F3 was fundamentally a misinterpretation of an unhandled 429 rate limit error as a data persistence failure.
- Scenario S8 erroneously passed because the Tester assumed the new name was saved simply because the input field retained its value, ignoring the 429 rejection.
- A possible defect in S8 ("Agent name input does not revert after rate-limited save rejection") was not promoted: the live replay came back inconclusive.
What to fix first
- Fix the dashboard hang on wallet connection so users can access inventory and claim agents (F1).
- Add validation to reject empty string submissions on the agent rename form before initiating the rename cooldown (F2).
Coverage and caveats
In scope: Agent claiming and workspace inventory initialization; Agent operator profile customization and naming; Agon marketplace listing and form validation; Campaign contest creation and funding.
Not covered: Social OAuth connectors (excluded because they navigate off-origin); Cross-chain wallet top up (excluded because the test wallet is already funded with native Arc USDC); Syndicate allegiance switching (out of scope for this specific agent-centric deep dive).
- The test wallet is already injected, connects automatically, and holds sufficient Arc testnet USDC.
- USDC on Arc testnet functions as native gas, meaning transactions execute without separate ETH/gas tokens.
- Form submission buttons on market and campaign forms are implicitly available based on standard form patterns.
- S2 could not be executed: Dashboard remained stuck on 'loading…' indefinitely after connecting the wallet, preventing the CLAIM AGENT button from appearing..
- S5 could not be executed: The expected 'Listing type (Sale / Rental)' option does not exist in the marketplace publishing form, which only supports X402 and Escrow service payment models..
By the numbers
| Metric | Value |
|---|
| Scenarios | 8 passed, 2 failed, 2 blocked of 12 (49 planned steps) |
| Browser actions | 261 (38 clicks, 45 inputs, 56 navigations, 122 snapshots) |
| Screenshots | 31 (4 explore, 26 scenario, 1 critic), 26 captioned |
| Coverage | 24 pages, 3 forms, 4 flows, 3 console errors |
| Audit | 3 findings, 2 re-verified live, 2 confirmed, 0 promoted, 1 withdrawn |
| Model calls | 228 |
| Tokens | 1,719,049 input, 13,504 output, 24,188 thinking |
| Time | 17 min |
| Wallet | 3 transactions, 3 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 41 | 332,001 | 4,337 | 1,125 | 184 |
| plan | 1 | 5,620 | 2,208 | 4,371 | 50 |
| test | 168 | 1,297,076 | 5,849 | 10,396 | 643 |
| critique | 17 | 82,609 | 816 | 7,719 | 125 |
| report | 1 | 1,743 | 294 | 577 | 10 |