QA report: external/gigawork.xyz at hosted
Ready-made workflow executions fail immediately upon launch, alongside unhandled vault deposit errors and console authorization failures.
Testing covered wallet connection, vault deposit flows, custom workforce configurations, deliverables viewing, and terminal commands across twelve scenarios. Ten scenarios passed, while two failed due to workflow execution failures and insufficient input validation during deposits.
The primary functional failure occurs when attempting to launch ready-made workflows, which immediately transition to a failed state upon confirmation. In addition, the vault deposit form lacks client-side balance validation when users enter amounts exceeding their available funds, causing an unhandled RPC gas estimation revert error. Custom workforce launches also trigger an unexpected 403 forbidden error in the browser console.
Core functions such as standard vault deposits with valid amounts, empty prompt handling, deposit input format checks, and history terminal command executions completed successfully without errors.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 10 |
| Failed | 2 |
| Blocked | 0 |
| Findings raised | 2 |
| Issues after the audit | 3 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 1 / 1 / 1 |
Target: https://gigawork.xyz/ · Testing level: deep_feature · Stack: unknown
Issues
High severity
F1 · Ready-made workflow execution immediately fails after launch confirmation
Severity: high · Type: functional · Verdict: confirmed · Scenario: S5
The scenario evidence explicitly states that the workflow immediately failed with a 'SYS Workflow failed' log upon launch confirmation. The live replay was inconclusive: The replay ran out of tool calls before it reached the reported state.
Expected: The workflow executes its planned steps, hires agents, and settles or progresses through execution.
Actual: The workflow transitions directly to a failed state with status 'failed' and execution telemetry log 'Workflow failed' immediately upon creation.
Steps to reproduce:
- Navigate to https://gigawork.xyz/
- Click on any Ready-made workflow card button (e.g. 'DeFi Yield APY Hunter & Portfolio Optimizer' or 'Web Research Brief')
- In the Launch Confirmation modal, verify populated prompt and escrow estimates, then click 'Confirm & run'
- Observe the resulting workflow execution page
Evidence: screenshots/S5-3.png, screenshots/S5-8.png, screenshots/S5-13.png
Medium severity
F2 · Deposit submission does not validate amount against wallet balance before triggering transaction
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S7
The tester recorded that depositing an amount significantly above the balance triggered a wallet interaction and a raw RPC revert error instead of being caught by client-side validation.
Expected: The application should validate the deposit amount against the connected wallet USDC balance, display an insufficient funds validation error, and block transaction submission.
Actual: The application attempted to estimate gas and submit the transaction via the wallet without client-side balance validation, resulting in a raw RPC revert error displayed to the user: 'Execution reverted with reason: ERC20: transfer amount exceeds balance. Estimate Gas Arguments: from: ...'.
Steps to reproduce:
- Navigate to https://gigawork.xyz/billing
- Enter '999999' into the Deposit USDC amount input
- Click the Deposit button
Evidence: screenshots/S7-6.png, screenshots/S7-8.png, screenshots/S7-10.png
Low severity
F3 · Forbidden 403 console error logged during custom workforce launch
Severity: low · Type: functional · Verdict: promoted · Scenario: S3
Surfaced by the audit of S3, which the Tester passed, and reproduced live: I navigated to the home page, entered a custom prompt, clicked 'Launch workforce', and confirmed the launch. While I cannot view the browser console to confirm the exact 403 HTTP status code, the application navigated to a workflow page where the execution log showed an immediate 'Workflow failed' error, confirming that the launch fails to complete successfully as reported. The page reported 1 console error during the scenario.
Expected: The workforce launch completes without any forbidden network request errors.
Actual: A 403 error is logged in the console during the workforce launch.
Steps to reproduce:
- Navigate to https://gigawork.xyz/ with a connected testnet wallet.
- Enter a prompt and click 'Launch workforce'.
- Confirm the launch and identity requirement.
- Check the browser console.
Evidence: screenshots/critic-M2-1.png
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Connect wallet on target testnet | high | pass | none |
| S2 Deposit valid amount into vault | high | pass | none |
| S3 Launch custom workforce with valid prompt | high | pass | F3 |
| S4 View execution deliverables via history terminal | high | pass | none |
| S5 Launch ready-made workflow | medium | fail | F1 |
| S6 Vault deposit MAX shortcut gas reservation | medium | pass | none |
| S7 Vault deposit exceeding balance validation | medium | fail | F2 |
| S8 Vault deposit invalid inputs validation | medium | pass | none |
| S9 Custom workforce empty prompt validation | medium | pass | none |
| S10 Deploy terminal help command | medium | pass | none |
| S11 Terminal graceful handling of invalid commands | medium | pass | none |
| S12 Verify application load without fatal 401 errors | low | pass | none |
The audit
The Critic reviewed 2 findings and re-verified 3 of them live in the browser, replaying the reported steps on a fresh page.
- Scenarios S1 and S3 were incorrectly passed despite recording 401 and 403 HTTP console errors.
- Scenario S12 explicitly checks for application loads without fatal 401 errors, which suggests the 401 recorded in S1 was an overlooked non-blocking defect.
- A possible defect in S1 ("Unauthorized 401 console error logged during wallet connection") was not promoted: the live replay came back not-reproduced.
What to fix first
- Resolve the execution failure that causes ready-made workflows to transition directly into a failed state upon launch (F1).
- Add client-side wallet balance validation to vault deposit submissions to prevent raw RPC gas estimation revert errors (F2).
- Investigate and eliminate the 403 forbidden console error emitted during custom workforce launches (F3).
Coverage and caveats
In scope: Wallet connection and testnet enforcement; Vault deposit lifecycle and MAX balance gas reservation; Workforce launch flows (custom and ready-made); Terminal UI interactions for /deploy and /history; Form and CLI input validations.
Not covered: Mint identity functionality (excluded due to scenario cap limits and lack of documented flow in the AppMap); /stats page realtime validation (excluded to focus testing depth on the interactive billing and terminal features).
- Assumes the DeepQA wallet connects on Arc Testnet automatically when requested.
- Assumes the /history terminal will have at least one past run to interact with (or one will be generated by the launch scenario).
- Assumes terminal outputs are visible as text elements in the DOM.
By the numbers
| Metric | Value |
|---|
| Scenarios | 10 passed, 2 failed, 0 blocked of 12 (41 planned steps) |
| Browser actions | 200 (32 clicks, 28 inputs, 28 navigations, 112 snapshots) |
| Screenshots | 43 (4 explore, 36 scenario, 3 critic), 36 captioned |
| Coverage | 5 pages, 4 forms, 6 flows, 1 console errors |
| Audit | 2 findings, 3 re-verified live, 2 confirmed, 1 promoted, 0 withdrawn |
| Model calls | 208 |
| Tokens | 3,006,978 input, 10,291 output, 23,021 thinking |
| Time | 14 min |
| Wallet | 4 transactions, 3 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 24 | 386,761 | 2,116 | 1,213 | 84 |
| plan | 1 | 3,977 | 2,025 | 4,406 | 49 |
| test | 159 | 2,249,681 | 4,827 | 10,240 | 574 |
| critique | 23 | 364,878 | 1,041 | 6,690 | 118 |
| report | 1 | 1,681 | 282 | 472 | 10 |
