QA report: external/glowaide.com at hosted
Glowaide exhibits high-severity functional failures in token transfers, missing AI backend configurations, and contract management issues.
Testing covered primary routing, wallet asset transfers, DeFi swap interactions, contract IDE workflows, contract imports, and the AI assistant across 12 scenarios. Six scenarios passed, four failed, and two were blocked before completion due to editor interactability limits and execution constraints.
Multiple high-severity defects affect core features. The Send Token modal fails to validate recipient addresses, advancing invalid inputs directly to confirmation, while the Max amount shortcut in the Send USDC modal is completely non-responsive. Additionally, the AI Chat assistant is non-functional due to a missing OpenRouter API key, and successfully imported contracts do not display in the default deployments list.
These failures compromise user safety during token transfers and render headline features like the AI assistant unusable. Crucial areas such as contract compilation, deployment, and end-to-end transaction broadcasting remain unverified due to blocked scenarios and require follow-up validation once UI and configuration fixes are applied.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 6 |
| Failed | 4 |
| Blocked | 2 |
| Findings raised | 4 |
| Issues after the audit | 4 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 3 / 1 / 0 |
Target: https://glowaide.com/ · Testing level: deep_feature · Stack: unknown
Issues
High severity
F1 · Max shortcut button in Send USDC modal is unresponsive and does not populate amount
Severity: high · Type: functional · Verdict: confirmed · Scenario: S3
I followed the steps, entered a recipient address, and clicked the 'Max' button. The Amount field remained '0.00' and the 'Review Transfer' button remained disabled. The page reported 1 console error during the scenario.
Expected: Clicking 'Max' populates the amount input with the maximum available USDC balance minus estimated gas fees.
Actual: Clicking 'Max' has no effect: the Amount field remains empty/0.00 and the 'Review Transfer' button remains disabled.
Steps to reproduce:
- Navigate to /wallet
- Click the 'Send' button under the portfolio balance card to open the Send USDC modal
- Enter a valid recipient address into the 'Recipient' field
- Click the 'Max' button next to the Amount field
Evidence: screenshots/S3-7.png, screenshots/S3-12.png
F2 · Send Token modal accepts invalid recipient address and advances to confirmation
Severity: high · Type: functional · Verdict: confirmed · Scenario: S7
The observation shows the application accepted 'invalid-address-string' in the address field and proceeded to the review screen without validation errors. The live replay was inconclusive: The replay ran out of tool calls before it reached the reported state. The page reported 1 console error during the scenario.
Expected: The form should validate that the recipient is a valid Ethereum/Arc address (0x format, 40 hex chars), prevent progression, and display an inline validation error.
Actual: The form enabled 'Review Transfer' and allowed proceeding to the 'Review Transfer' / 'Confirm & Send' step with the invalid address string without any error message.
Steps to reproduce:
- Navigate to /wallet
- Click the 'Send' button to open the token transfer modal
- Enter 'invalid-address-string' into the recipient address field
- Enter '1' into the amount field
- Click 'Review Transfer'
Evidence: screenshots/S7-5.png, screenshots/S7-7.png
F4 · AI Chat fails to respond due to missing OpenRouter API key configuration
Severity: high · Type: functional · Verdict: confirmed · Scenario: S12
I navigated to the chat page, entered a prompt asking how to write a simple ERC-20 token [redacted], and submitted it. The AI assistant replied with '❌ OpenRouter API key not set. Add OPENROUTER_API_KEY to Vercel env vars or set it in Admin → Settings.', matching the reported bug. The page reported 1 console error during the scenario.
Expected: The AI assistant responds with a relevant answer/code in the chat stream.
Actual: The AI assistant returns an error message: '❌ OpenRouter API key not set. Add OPENROUTER_API_KEY to Vercel env vars or set it in Admin → Settings.'
Steps to reproduce:
- Navigate to /chat
- Enter a prompt into the chat textarea (e.g., 'How do I write a simple ERC-20 token contract in Solidity?')
- Click the submit button or press Enter to send the prompt
Evidence: screenshots/S12-1.png, screenshots/S12-5.png, screenshots/S12-8.png
Medium severity
F3 · Imported contract does not appear in default 'My Contracts' deployments list when deployer address is not populated
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S9
The observation confirms that after receiving a success notification for adding the contract, it failed to render in the user's active view. The page reported 1 console error during the scenario.
Expected: The newly added contract appears in the user's viewable deployments list.
Actual: Notification 'Contract added to dashboard' appears, but the deployments list remains showing 'No contracts found'.
Steps to reproduce:
- Navigate to /deployments
- Click the 'Add Contract' button
- Enter contract address '0x1234567890123456789012345678901234567890', name 'My Test Contract', and ABI JSON array '[{"inputs":[],"name":"name","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"}]'
- Click 'Add Contract' to submit
Evidence: screenshots/S9-11.png
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Load primary routes and observe console errors | high | pass | none |
| S2 Send testnet asset via Wallet | high | blocked (Scenario tool call budget was exhausted before clicking the final 'Confirm & Send' confirmation button to observe the transaction result.) | none |
| S3 Send token using MAX shortcut to verify gas reservation | high | fail | F1 |
| S4 Swap native USDC on DeFi DEX | high | pass | none |
| S5 Load a starter project into the IDE | high | pass | none |
| S6 Compile and Deploy a contract to Arc testnet | high | blocked (Could not open MyToken.sol in the editor or trigger compilation & deployment due to non-interactive file tree items in the editor interface.) | none |
| S7 Validate Recipient Address on Send Token form | medium | fail | F2 |
| S8 Validate empty Pay Amount on DeFi Swap | medium | pass | none |
| S9 Import an existing deployed contract | medium | fail | F3 |
| S10 Validate required fields on Add Contract form | medium | pass | none |
| S11 Update and persist Editor preferences | low | pass | none |
| S12 Submit query to AI assistant | low | fail | F4 |
The audit
The Critic reviewed 4 findings and re-verified 4 of them live in the browser, replaying the reported steps on a fresh page.
- A 500 Internal Server Error is present in the console logs of every scenario, suggesting a recurring background request failure across the application.
- Scenarios S2 and S6 were marked as blocked due to tool budget exhaustion and UI interactability issues, meaning the end-to-end execution of their respective flows remains untested.
- A possible defect in S1 ("Application triggers a 500 Internal Server Error upon loading primary routes") was not promoted: the live replay came back inconclusive.
What to fix first
- Enforce strict recipient address validation on the Send Token modal to block invalid addresses before the confirmation step (F2).
- Fix the Max shortcut button on the Send USDC modal so it accurately populates the available balance and enables form submission (F1).
- Configure the required OpenRouter API key in the environment settings to restore AI Chat functionality (F4).
- Update the deployments list to display newly imported contracts even when the deployer address is not initially populated (F3).
Coverage and caveats
In scope: Web3 Wallet asset transfers; DeFi token swaps; Smart contract compilation and deployment; Importing deployed contracts; Editor preferences persistence.
Not covered: Explorer search functionality (omitted to focus on core Web3 transaction lifecycle within the cap); Launchpad token creation (omitted to stay within the scenario cap); Settings Profile form (focusing strictly on Editor Settings).
- The injected Web3 wallet exposes a 'MAX' shortcut on balance inputs as described by the intake facts.
- A valid recipient address and valid ABI JSON string are available for form submissions.
- The application relies on USDC for gas on Arc testnet, meaning MAX shortcuts should gracefully deduct gas requirements rather than attempting a full balance transfer that would fail.
- Network switch prompts cannot be natively dismissed by the script, so avoiding cross-chain triggers is necessary.
- S2 could not be executed: Scenario tool call budget was exhausted before clicking the final 'Confirm & Send' confirmation button to observe the transaction result..
- S6 could not be executed: Could not open MyToken.sol in the editor or trigger compilation & deployment due to non-interactive file tree items in the editor interface..
By the numbers
| Metric | Value |
|---|
| Scenarios | 6 passed, 4 failed, 2 blocked of 12 (54 planned steps) |
| Browser actions | 244 (57 clicks, 22 inputs, 38 navigations, 127 snapshots) |
| Screenshots | 40 (4 explore, 33 scenario, 3 critic), 33 captioned |
| Coverage | 9 pages, 6 forms, 6 flows, 7 console errors |
| Audit | 4 findings, 4 re-verified live, 4 confirmed, 0 promoted, 0 withdrawn |
| Model calls | 243 |
| Tokens | 1,281,624 input, 12,903 output, 20,778 thinking |
| Time | 13 min |
| Wallet | 0 transactions, 0 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 25 | 138,561 | 2,687 | 1,165 | 84 |
| plan | 1 | 4,948 | 2,286 | 5,010 | 58 |
| test | 187 | 1,023,781 | 6,342 | 8,400 | 514 |
| critique | 29 | 112,462 | 1,237 | 5,625 | 120 |
| report | 1 | 1,872 | 351 | 578 | 8 |