QA report: external/arcworld.io at hosted
On-chain USDC transfers fail during execution, and multiple interfaces lack client-side balance validation before dispatching transactions.
Testing covered wallet connectivity, token transfer tools, virtual card management, balance checking, and faucet flows across 12 scenarios. Eight scenarios passed and four failed. The audit confirmed three functional defects after withdrawing one initial finding regarding missing shortcut controls.
The primary breakdown occurs in the Transfer Toolbox, where standard USDC transfers fail during on-chain execution. Additionally, both the USDC transfer form and the virtual card withdrawal interface omit client-side balance validation, prompting unnecessary wallet approvals and failed RPC calls when users attempt to move more funds than available.
These failures directly impact core transaction capabilities and user feedback clarity. Additionally, coverage for virtual card transfers concluded while transactions were in a confirming state, leaving terminal on-chain settlement unverified in that flow.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 8 |
| Failed | 4 |
| Blocked | 0 |
| Findings raised | 4 |
| Issues after the audit | 3 |
| Withdrawn by the audit | 1 |
| Critical / high / medium / low | 0 / 1 / 2 / 0 |
Target: https://arcworld.io/ · Testing level: deep_feature · Stack: unknown
Issues
High severity
F1 · USDC transfer fails on-chain during Transfer Toolbox flow
Severity: high · Type: functional · Verdict: confirmed · Scenario: S2
The observations clearly record that the application transitioned to a 'transaction failed' state when provided with valid inputs, indicating a functional defect. The live replay was inconclusive: The replay ran out of tool calls before it reached the reported state.
Expected: The transfer transaction succeeds and a confirmation message/receipt is displayed.
Actual: The transaction fails with error status 'transaction failed'.
Steps to reproduce:
- Navigate to https://arcworld.io/tools
- Click the '04 Transfer' navigation tab
- Enter recipient address '0x70997970C51812dc3A010C7d01b50e0d17dc79C8'
- Enter '0.01' in AMOUNT (USDC)
- Click 'SEND USDC'
Evidence: screenshots/S2-8.png
Medium severity
F3 · Transfer USDC form lacks balance validation and submits excessive amounts to wallet
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S7
The evidence supports the claim that the application relies entirely on the external wallet for balance validation, resulting in a poor user experience when transactions inevitably fail.
Expected: The application should validate the user's USDC balance beforehand, disable submission, or display an insufficient funds validation error.
Actual: The application allows submission, initiates wallet approval and on-chain confirmation, and subsequently displays a generic 'transaction failed' error.
Steps to reproduce:
- Navigate to https://arcworld.io/tools.
- Click the '04 Transfer' button to view the Transfer USDC step.
- Enter a valid recipient address (e.g. 0x000000000000000000000000000000000000dEaD).
- Enter an amount vastly exceeding the connected wallet balance (e.g. 999999999).
- Click 'SEND USDC'.
Evidence: screenshots/S7-8.png, screenshots/S7-12.png
F4 · Virtual card withdrawal lacks UI balance validation and attempts invalid RPC transaction
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S9
The evidence shows the application fails to perform client-side checks for the virtual card balance, leading to an invalid RPC request and a generic error.
Expected: The application should perform client-side validation to block withdrawals exceeding the available card balance and display an 'insufficient card balance' validation message without triggering an RPC request.
Actual: The application does not validate whether the withdrawal amount exceeds the virtual card balance (0.00 USDC), initiates an RPC request ('Withdrawing…'), and subsequently fails with 'RPC Request failed.' instead of presenting an insufficient balance validation message.
Steps to reproduce:
- Navigate to https://arcworld.io/tools#card
- Ensure Virtual Card tab is active (with a balance of 0.00 USDC)
- Enter an amount exceeding the card balance (e.g. 10) in the 'Amount (USDC)' input
- Click the 'Withdraw' button
Evidence: screenshots/S9-7.png
Withdrawn findings
The Critic re-examined these claims and found the evidence did not support them. They are kept here rather than deleted.
- Transfer USDC form in Toolbox lacks MAX balance shortcut and automatic gas deduction (S3, medium): This defect is claimed from what the Tester believes the form ought to do rather than an actual malfunction. Furthermore, it technically misinterprets how ERC-20 tokens work by assuming native gas costs should be deducted from the USDC transfer amount.
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Wallet Connection and Network Verification | high | pass | none |
| S2 Transfer USDC with Valid Inputs | high | fail | F1 |
| S3 Transfer USDC MAX Shortcut Deducts Native Gas | high | fail | none |
| S4 Virtual Card - Load Balance | high | pass | none |
| S5 Virtual Card - Withdraw Balance | high | pass | none |
| S6 Virtual Card - Send Funds to Recipient | high | pass | none |
| S7 Transfer USDC with Insufficient Balance | medium | fail | F3 |
| S8 Balance Checker - Valid Query | medium | pass | none |
| S9 Virtual Card - Over-withdraw Prevention | medium | fail | F4 |
| S10 Faucet Visibility and Instruction | medium | pass | none |
| S11 Transfer USDC with Invalid Recipient | low | pass | none |
| S12 Balance Checker - Empty Address | low | pass | none |
The audit
The Critic reviewed 4 findings and re-verified 1 of them live in the browser, replaying the reported steps on a fresh page.
- Scenario S6 passes despite execution ending immediately after the transfer enters the confirming state, leaving the final on-chain success unverified.
What to fix first
- Investigate and resolve the on-chain transaction execution failure in the Transfer Toolbox flow (F1).
- Add client-side balance validation to the Transfer USDC form to prevent submitting transactions that exceed available funds (F3).
- Validate virtual card withdrawal inputs against available card balances before initiating RPC requests (F4).
Coverage and caveats
In scope: Arc Testnet Wallet Connection; RPC Network Status Validation; On-chain USDC Balance Checker; Testnet USDC Transfers and MAX Gas Reservation; Virtual Card Lifecycle (Load, Withdraw, Send).
Not covered: Arcade Games (/games); Educational content under Learn Arc (/explore); Documentation (/docs/); Arc Land mainnet application (app.arcworld.io).
- The test wallet connects automatically to Arc Testnet (Chain ID 5042002) holding sufficient test USDC.
- A valid 'MAX' shortcut or affordance exists on the Transfer form as implied by the intake.
- Testnet block times are fast enough that on-chain transactions confirm within normal test timeout bounds.
- The console error 'Cannot set properties of null' does not completely break the Tools interface.
By the numbers
| Metric | Value |
|---|
| Scenarios | 8 passed, 4 failed, 0 blocked of 12 (51 planned steps) |
| Browser actions | 208 (38 clicks, 20 inputs, 39 navigations, 111 snapshots) |
| Screenshots | 35 (4 explore, 31 scenario, 0 critic), 30 captioned |
| Coverage | 13 pages, 6 forms, 4 flows, 1 console errors |
| Audit | 4 findings, 1 re-verified live, 3 confirmed, 0 promoted, 1 withdrawn |
| Model calls | 194 |
| Tokens | 894,251 input, 11,328 output, 18,404 thinking |
| Time | 15 min |
| Wallet | 7 transactions, 0 signatures, 1 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 33 | 164,942 | 2,838 | 1,318 | 111 |
| plan | 1 | 4,616 | 2,296 | 4,203 | 42 |
| test | 150 | 693,470 | 5,404 | 7,585 | 461 |
| critique | 9 | 29,542 | 513 | 4,695 | 251 |
| report | 1 | 1,681 | 277 | 603 | 9 |
