Sender MultiSend

Every scenario DeepQA drove in the browser, in plan order, with the 34 screenshots it captured along the way. A passing scenario is evidence too.

1. S1

   Single Token Batch Execution

   6 steps, 3 screenshots

   high✓ pass

   

   

   

   • Navigated to the App dashboard showing the recipient entry table, connected wallet balances (2.79004 USDC), and empty Summary panel.
   • Entered recipient 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 with 1 USDC; Summary panel shows 1 USDC Total, 1 Recipient, Protocol Fee of 0.001 USDC, and enables the Execute Batch button.
   • Clicked Execute Batch; the app transitioned to an 'In progress' pending state with 'Waiting for approval…' step for token [redacted]
   • Navigated to /app with wallet connected.
   • Entered a valid recipient address (0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045), 1 as Amount, and USDC as Token.
   • Summary panel correctly displayed total 1 USDC, 1 recipient, and a 0.001 USDC protocol fee with estimated gas.
   • Clicked Execute Batch, successfully triggering the batch transaction process in a pending state displaying 'Waiting for approval…'.
2. S2

   Multi-Recipient Fee and Total Math

   5 steps, 2 screenshots

   high✓ pass

   

   

   • Configured two recipient rows with 1 USDC and 2 USDC; observed Summary panel displaying USDC Total of 3 and Protocol Fee of 0.002 USDC for 2 recipients.
   • Navigated to https://arcsender.xyz/app.
   • Entered valid address '0x71C836056B347eF89B206a5b8D95c27D2f01B514' with amount '1' into the first recipient row.
   • Added a second recipient row with address '0x2222222222222222222222222222222222222222' and amount '2'.
   • Verified the Summary panel accurately displays a total transfer amount of 3 USDC (1 + 2) and a protocol fee of exactly 0.002 USDC (0.001 USDC per recipient for 2 recipients).
3. S3

   Valid CSV Paste Import

   5 steps, 4 screenshots

   high✓ pass

   

   

   

   

   • Navigated to /app and observed initial dashboard with Paste CSV button available.
   • Entered '0x1111111111111111111111111111111111111111,5,USDC' into the Paste CSV textbox.
   • Clicked 'Import Recipients', modal closed, toast 'Imported 1 recipients' appeared, and recipient row was populated with 0x1111111111111111111111111111111111111111, amount 5, USDC token.
   • Navigated to https://arcsender.xyz/app.
   • Opened the Paste CSV modal.
   • Entered valid CSV row '0x1111111111111111111111111111111111111111,5,USDC'.
   • Clicked 'Import Recipients' button to submit the modal.
   • Observed the modal closed and a new recipient row appeared with address 0x1111111111111111111111111111111111111111, amount 5, and USDC token [redacted], with the summary updating appropriately.
4. S4

   Insufficient Balance Validation

   4 steps, 2 screenshots

   high✓ pass

   

   

   • Navigated to /app dashboard showing recipient table and summary panel.
   • Entered recipient address and amount 999999999999; summary displayed 'Insufficient' warning with 'Balance: 0 USDC' and Execute Batch button is disabled.
   • When a recipient address and an amount exceeding the available balance (999999999999) are entered, the Summary panel displays an 'Insufficient' badge alongside the token [redacted] ('Balance: 0 USDC') and the 'Execute Batch' button is disabled.
5. S5

   Invalid Wallet Address Format

   4 steps, 2 screenshots

   high✕ fail

   

   

   • Navigated to /app dashboard showing recipient table and disabled Execute Batch button.
   • Entered 'not-an-address' into the Wallet Address field and '1' into the Amount field; the row status shows 'Ready' without any invalid address error.
   • Navigated to /app where the recipient table initialized with empty address and amount fields.
   • Entered 'not-an-address' in the Wallet Address input and '1' in the Amount input.
   • Observed that the row status displayed 'Ready' instead of displaying an invalid address error, and updated the summary to 1 recipient.
6. S6

   NFT Batch Manual Configuration

   4 steps, 3 screenshots

   medium✓ pass

   

   

   

   • Navigated to /app dashboard showing Token and NFT tabs.
   • Switched to NFT tab, displaying NFT Recipients table, NFT Launchpad, NFT Holdings, and NFT Summary.
   • Entered contract address, token ID, and recipient address; summary updated to show Total NFTs: 1, ERC-721: 1 token, Contracts: 1, Recipients: 1, and Execute NFT Batch button became enabled.
   • Navigated to https://arcsender.xyz/app and switched to the NFT tab.
   • Entered contract address (0x1234567890123456789012345678901234567890), token ID (1), and recipient address (0xabcdefabcdefabcdefabcdefabcdefabcdefabcd) in the NFT Recipient row.
   • Observed the recipient row status marked as 'Ready'.
   • NFT Summary dynamically updated to show Total NFTs: 1, ERC-721: 1 token, Contracts: 1, Recipients: 1.
   • The 'Execute NFT Batch' button became enabled upon valid input configuration.
7. S7

   Invalid CSV Paste Format

   4 steps, 4 screenshots

   medium✓ pass

   

   

   

   

   • Navigated to /app dashboard showing recipient table and CSV options.
   • Opened the Paste CSV Data modal.
   • Entered 'bad_address,not_a_number,USDC' into the CSV Data field.
   • Submitting invalid CSV data showed 'No valid rows found in pasted CSV' validation message and prevented execution or row import.
   • Navigated to https://arcsender.xyz/app and opened the 'Paste CSV' modal.
   • Entered invalid CSV data 'bad_address,not_a_number,USDC' into the CSV input field.
   • Clicked 'Import Recipients' and observed the validation error toast/status 'No valid rows found in pasted CSV'.
   • Verified that no invalid recipient rows were added to the recipient table and the 'Execute Batch' button remained disabled.
8. S8

   NFT Missing Required Fields

   4 steps, 3 screenshots

   medium✓ pass

   

   

   

   • Navigated to /app dashboard showing Token and NFT tabs.
   • Switched to NFT tab displaying NFT Recipients table and Execute NFT Batch button.
   • Entered contract address with empty Token ID and Recipient Address; Execute NFT Batch button remains disabled and batch summary requires valid recipients.
   • Navigated to /app and opened the NFT tab.
   • Entered Contract Address 0x1234567890123456789012345678901234567890 while leaving Token ID and Recipient Address blank.
   • Observed that the Execute NFT Batch button remains disabled and the summary indicates recipients must be added.
9. S9

   Zero Token Amount Rejection

   4 steps, 3 screenshots

   medium✕ fail

   

   

   

   • Entered valid wallet address 0x71C84107b34571779E6390637174E6619a583A09 and amount 0; the row status remained Ready, summary showed 0 USDC, and Execute Batch button became enabled.
   • Navigated to /app on ArcSender.
   • Entered valid wallet address 0x71C84107b34571779E6390637174E6619a583A09 and amount 0.
   • Row status was displayed as 'Ready' and 'Execute Batch' button was enabled instead of disabled.
   • Clicking 'Execute Batch' triggered an error toast and marked the row invalid, but Execute Batch remained enabled.
10. S10

    History Tab Graceful Degradation

    3 steps, 2 screenshots

    low✓ pass

    

    

    • Navigated to /app/history; the page shows 'Loading history from Blockscout…' and the Refresh button is initially disabled.
    • Clicked the Refresh button; the page handled the failed Blockscout fetch gracefully, showing 'Failed to fetch' without crashing or turning into a blank screen.
    • Navigated to /app/history, which initially rendered the loading state and header controls without issue.
    • When the API request to Blockscout failed due to network/CORS error, the UI gracefully rendered the error message 'Failed to fetch'.
    • Clicking the Refresh button re-attempted the request and maintained UI responsiveness without any white-screen crash or freeze.
11. S11

    Unsupported Network Switch Denial

    3 steps, 3 screenshots

    low✓ pass

    

    

    

    • Navigated to /app dashboard showing the Switch network button and wallet interface.
    • Opened the Switch network menu, which only presents the designated supported network (Arc) and prevents selection of unsupported chains.
    • Wallet menu confirms connection status strictly locked to Arc Testnet.
    • Navigated to /app and opened the network switcher.
    • Verified the switch network selector only exposes the designated Arc testnet, precluding selection or switching to unsupported networks.
    • Verified the wallet status confirms connection is locked to Arc Testnet.
12. S12

    Summary Reset on Row Clear

    5 steps, 3 screenshots

    low✓ pass

    

    

    

    • Entered valid address and amount 1; Summary updated to USDC Total 1 and Protocol Fee 0.001 USDC.
    • Cleared Wallet Address and Amount fields; Summary panel reset to empty state 'Add recipients to see a summary' and recipient count reset to 0.
    • Navigated to /app and observed empty recipient row with initial summary prompt 'Add recipients to see a summary'.
    • Entered a valid address and 1 USDC amount, which accurately updated the Summary to show 1 USDC total and 0.001 USDC protocol fee.
    • Cleared both the address and amount inputs, which correctly triggered live recalculation, resetting recipient count to 0, resetting the summary back to 'Add recipients to see a summary', and disabling the Execute Batch button.

Findings that survived the Critic's audit. Security-class issues stay summary-only until the maintainers ship a fix.

highconfirmed ✓functionalF1 · S5

Wallet address field accepts invalid address format without displaying validation error

I navigated to /app, entered 'not-an-address' into the Wallet Address field, and '1' into the Amount field. The application accepted the input without any invalid address error, displayed a 'Ready' status for the row, and added the entry to the batch summary with 1 recipient and a 1 USDC total. The page reported 1 console error during the scenario.

Expected

The row should validate the Ethereum/EVM address format and display an invalid address error.

Actual

The application accepted 'not-an-address' as a recipient without validation, displayed status 'Ready', and included the entry in the batch summary with 1 recipient and 1 USDC total.

Repro · 4 steps

1. Navigate to https://arcsender.xyz/app
2. Type 'not-an-address' into the Wallet Address input field in the recipient row
3. Type '1' into the Amount input field
4. Observe the row status and validation messaging

S5-7.png

highpromoted ↑functionalF3 · S10

History tab API request blocked by CORS policy

Surfaced by the audit of S10, which the Tester passed, and reproduced live: Navigated to /app/history and observed that the transaction history fails to load. The UI displays 'Failed to fetch', preventing history data from loading. The page reported 2 console errors during the scenario.

Expected

The application should successfully fetch and display the transaction history without CORS errors.

Actual

The API request is blocked by a CORS policy error, preventing history data from loading, which the tester improperly excused as 'graceful degradation'.

Repro · 2 steps

1. Navigate to /app/history
2. Observe the console errors and the UI state indicating 'Failed to fetch'

critic-M1-1.png

mediumconfirmed ✓functionalF2 · S9

Recipient row with zero token amount shows Ready status and enables Execute Batch button

The tester's notes confirm that entering '0' enables the Execute Batch button, and clicking it shows a validation error but leaves the button enabled, confirming a functional defect. The page reported 1 console error during the scenario.

Expected

The UI should immediately flag an amount of '0' as invalid (must be greater than 0) and keep the 'Execute Batch' button disabled.

Actual

Entering an amount of '0' results in the row status showing 'Ready' and the 'Execute Batch' button becoming enabled. Only after clicking 'Execute Batch' does the validation message 'Amount must be greater than 0' appear, but 'Execute Batch' remains enabled.

Repro · 4 steps

1. Navigate to https://arcsender.xyz/app
2. Enter a valid wallet address in the recipient row (e.g. 0x71C84107b34571779E6390637174E6619a583A09)
3. Type '0' in the Amount field
4. Observe the row status and Execute Batch button state

S9-7.pngS9-9.png