Elligentt

Core asset transfer and batch payment flows fail to execute or accept valid recipient addresses, blocking essential transaction workflows on Arc Testnet.

Testing evaluated nine deep-feature scenarios covering single asset transfers, batch payments, balance calculation logic, input validation, and newsletter subscriptions on Arc Testnet. Three scenarios passed and six failed. The audit confirmed six active issues and withdrew one finding.

Critical transaction pathways are currently broken. The single asset transfer flow becomes unresponsive without executing transactions, batch payment forms reject valid 0x addresses and block signing, and the balance calculation fails to reserve gas fees when selecting maximum balance. Secondary features also suffer from silent failures during split bill calculations and missing confirmation feedback upon newsletter submission.

A high-severity security issue is present regarding Content Security Policy and CORS configurations blocking RPC connections. With primary financial workflows non-functional, the application is not in a releasable state until transaction dispatch and address validation are corrected.

Target: https://elligentt.xyz · Testing level: deep_feature · Stack: unknown

Severity: critical · Type: functional · Verdict: confirmed · Scenario: S1

I filled the recipient address and amount on the Send page and clicked 'Send Asset'. The transaction was not executed and there was no visual feedback or transaction prompt, leaving the form on 'Ready to send' status, confirming the reported defect. The page reported 7 console errors during the scenario.

Expected: The transaction submits and displays a confirmation, receipt, or transaction prompt.

Actual: The transaction does not execute, the form remains on 'Ready to send' without transaction receipt or submission feedback, and the UI becomes unresponsive to clicks.

Steps to reproduce:

1. Navigate to https://elligentt.xyz/send
2. Click the USDC Asset Selector button
3. Enter a valid recipient address (e.g. 0x742d35Cc6634C0532925a3b844Bc454e4438f44e)
4. Enter an amount (e.g. 0.5)
5. Click the 'Send Asset' button

Evidence: screenshots/S1-1.png, screenshots/S1-7.png

Severity: high · Type: functional · Verdict: confirmed · Scenario: S2

The observation confirms that valid EVM addresses are incorrectly marked as 'Invalid', preventing the batch submission process from advancing. The live replay was inconclusive: The replay ran out of tool calls before it reached the reported state. The page reported 11 console errors during the scenario.

Expected: The entered recipient addresses should validate as valid addresses and the transaction review/signing flow should proceed.

Actual: Both recipient addresses are marked as 'Invalid' in the table and 'Review & Sign' does not prompt the wallet or advance the batch payment process.

Steps to reproduce:

1. Navigate to https://elligentt.xyz/batch
2. In the Split Bill section, set Total amount (USDC) to 100 and Number of people to 2
3. Click 'Split & Fill Table'
4. Enter valid Ethereum/EVM format recipient addresses into the generated row address input fields
5. Click 'Review & Sign'

Evidence: screenshots/S2-2.png, screenshots/S2-5.png, screenshots/S2-11.png

Severity: high · Type: functional · Verdict: confirmed · Scenario: S3

I navigated to the Send Assets page and clicked the USDC Asset Selector button, then the MAX button. The amount field was populated with '5.0000' USDC, representing the full wallet balance. The estimated fee text below indicated a 0.0100 USDC fee, leading to a total required amount of 5.01 USDC which exceeds the 5.00 USDC balance, confirming no reserve was made for fees or gas. The page reported 11 console errors during the scenario.

Expected: The amount field should populate with a value less than the total USDC balance to explicitly reserve sufficient USDC for transaction gas and fees on Arc Testnet.

Actual: Clicking 'MAX' button sets the amount field to '5.0000' (the exact total wallet balance), without reserving gas or protocol fees, resulting in a total required amount of 5.01 USDC plus gas which exceeds the available balance.

Steps to reproduce:

1. Navigate to https://elligentt.xyz/send
2. Click the 'USDC' Asset Selector button
3. Click the 'MAX' button next to the amount field
4. Observe the populated value in the Amount field

Evidence: screenshots/S3-6.png

Severity: high · Type: security · Verdict: promoted · Scenario: S7

Security-class issue (high) confirmed by the audit. Reproduction detail and evidence are withheld from the public projection until the maintainers ship a fix.

Severity: medium · Type: functional · Verdict: confirmed · Scenario: S5

The observation explicitly notes that submitting '0' people fails silently without any validation message or user feedback. The page reported 11 console errors during the scenario.

Expected: The application should display a validation error message informing the user that the number of people must be greater than 0.

Actual: No validation message or user feedback is displayed; the action fails silently and generates 0 rows without explaining why.

Steps to reproduce:

1. Navigate to https://elligentt.xyz/batch
2. Type '100' into the 'Total amount (USDC)' field under Split Bill
3. Type '0' into the 'Number of people' field
4. Click the 'Split & Fill Table' button

Evidence: screenshots/S5-7.png, screenshots/S5-13.png

Severity: medium · Type: ux · Verdict: confirmed · Scenario: S9

The observation confirms the form clears the input upon submission without providing any success confirmation or feedback to the user. The page reported 11 console errors during the scenario.

Expected: The application should display a success message acknowledging the newsletter subscription alongside clearing the input.

Actual: Clicking Subscribe clears the email input field but displays no visible success confirmation message or toast notification to inform the user of the successful subscription.

Steps to reproduce:

1. Navigate to https://elligentt.xyz/send
2. Locate the Stay Updated newsletter form in the footer
3. Enter a valid email address (e.g., a test address) into the email input field
4. Click the Subscribe button

Evidence: screenshots/S9-5.png, screenshots/S9-7.png, screenshots/S9-12.png

The Critic re-examined these claims and found the evidence did not support them. They are kept here rather than deleted.

• Templates page lacks network filter combobox and Export CSV button (S8, low): The defect is based on what the Tester's test plan expected to find on the page, not a flaw in the application's actual design or functionality. The page reported 11 console errors during the scenario.

The Critic reviewed 6 findings and re-verified 4 of them live in the browser, replaying the reported steps on a fresh page.

• Scenario S7 passed by claiming there were no CSP or CORS errors, directly contradicting its own console logs which are full of severe CSP and CORS blocks.
• The 'quickSend is not defined' and 'Cannot use import statement outside a module' JavaScript errors appear in every single scenario, indicating a fundamental breakage in the application's frontend scripts.

1. Resolve the Send Asset button failure so single transfers execute and return transaction feedback (F1).
2. Correct batch recipient validation to accept valid 0x addresses and allow batch signing to proceed (F2).
3. Update the MAX balance calculation to reserve required gas and protocol fees from the total balance (F3).
4. Adjust Content Security Policy and CORS headers to ensure required RPC endpoints are reachable (F7).
5. Add explicit validation feedback when the Split Bill participant count is set to zero or invalid values (F4).
6. Display a visible success confirmation message when a user subscribes to the newsletter (F6).

In scope: Single asset transfers via /send; MAX balance gas reservation logic for native USDC; Split Bill calculation and batch execution on /batch; Form validations for primary transaction inputs; Graceful handling of cross-chain wallet rejections; Page load integrity and Content Security Policy (CSP) errors.

Not covered: Invoices, Schedule, Queue, Bridge, Pool, AI Wallet, and XC Dashboard (Excluded to focus the deep feature on the core send/batch payment execution flows); Successful cross-chain transactions (Excluded because the injected test wallet strictly refuses chains other than Arc Testnet).

• The test wallet is already injected, automatically connects, and is provisioned with USDC on Arc Testnet.
• USDC acts as the native gas token on Arc Testnet, meaning transaction fees are deducted from the USDC balance.
• Since the wallet strictly refuses non-Arc chains, cross-chain actions are expected to fail at the wallet level and the UI should handle this rejection gracefully.