QA report: external/linkcash.app at hosted
Email one-time passcode authentication is broken, preventing users from logging in with email addresses.
Testing covered public landing and marketing components, navigation menus, and client-side form validation, alongside authentication gates protecting transactional routes like creation, requests, campaigns, sender dashboards, and wallet details across twelve scenarios.
The primary failure occurred during authentication: submitting a standard email address to receive a one-time passcode fails with an error message and does not transition to the verification screen, completely blocking email-based user sign-in.
Because authentication is currently non-functional for email logins, all downstream authenticated features could not be exercised beyond verifying that route protection gates appropriately restrict unauthenticated visitors.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 11 |
| Failed | 1 |
| Blocked | 0 |
| Findings raised | 1 |
| Issues after the audit | 1 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 1 / 0 / 0 |
Target: https://linkcash.app · Testing level: deep_feature · Stack: unknown
Issues
High severity
F1 · Email OTP submission rejects standard email domain and fails to transition to verification screen
Severity: high · Type: functional · Verdict: confirmed · Scenario: S6
Navigated to https://linkcash.app/create, typed 'tester@example.com' into the email input field, and clicked the 'Continue with email' button. The application displayed the error message "Couldn't send a code to this email provider right now. Try Gmail, or sign in with Google instead." rather than transitioning to the verification screen. The page reported 3 console errors during the scenario.
Expected: The application should dispatch an OTP verification code and transition to an OTP entry screen.
Actual: The application fails to proceed and displays 'Couldn't send a code to this email provider right now. Try Gmail, or sign in with Google instead.'
Steps to reproduce:
- Navigate to https://linkcash.app/create
- Type 'tester@example.com' into the 'your@email.com' input field
- Click the 'Continue with email' button
- Observe the application state
Evidence: screenshots/S6-2.png, screenshots/S6-13.png
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Landing page loads and displays onchain feed | high | pass | none |
| S2 Auth gate prompts for sign-in on /create | high | pass | none |
| S3 Auth gate prompts for sign-in on /request | high | pass | none |
| S4 Email sign-in form prevents empty submission | high | pass | none |
| S5 Email sign-in form rejects invalid email formats | high | pass | none |
| S6 Valid email submission initiates OTP dispatch | high | fail | F1 |
| S7 Verify 'How LinkCash works' modal functionality | medium | pass | none |
| S8 Navigation menu opens and displays app sections | medium | pass | none |
| S9 Auth gate restricts access to bulk creation | medium | pass | none |
| S10 Auth gate restricts access to new campaigns | medium | pass | none |
| S11 Auth gate restricts access to sender dashboard | medium | pass | none |
| S12 Auth gate restricts access to wallet details | medium | pass | none |
The audit
The Critic reviewed 1 finding and re-verified 3 of them live in the browser, replaying the reported steps on a fresh page.
- The failure of the OTP submission to progress even with a suggested Gmail account indicates a complete blockage of the authentication service rather than just a domain restriction.
- React hydration errors and Datadog configuration warnings appear consistently in the console across multiple scenarios.
- A possible defect in S8 ("React hydration mismatch error on load") was not promoted: the live replay came back not-reproduced.
- A possible defect in S1 ("Missing Datadog Application ID configuration logs an error") was not promoted: the live replay came back inconclusive.
What to fix first
- F1: Fix the email OTP dispatch service and domain handling so users can receive verification codes and complete authentication.
Coverage and caveats
In scope: Landing page functionality and information display; Navigation menu interaction; Authentication gates for protected routes; Email sign-in form validation and submission.
Not covered: Authenticated core workflows (creating gifts, campaigns, requests); Wallet gas reservation checks.
- The injected test wallet does not bypass the Email OTP or Google OAuth gates detected by the AppMap.
- Since Email OTP requires an external inbox and Google OAuth requires live credentials, we cannot automate past the authentication gate.
- Testing focuses on the deep functionality of the unauthenticated surface and auth gates.
By the numbers
| Metric | Value |
|---|
| Scenarios | 11 passed, 1 failed, 0 blocked of 12 (34 planned steps) |
| Browser actions | 141 (22 clicks, 9 inputs, 36 navigations, 74 snapshots) |
| Screenshots | 28 (4 explore, 22 scenario, 2 critic), 22 captioned |
| Coverage | 9 pages, 1 forms, 4 flows, 2 console errors |
| Audit | 1 findings, 3 re-verified live, 1 confirmed, 0 promoted, 0 withdrawn |
| Model calls | 137 |
| Tokens | 688,801 input, 7,679 output, 14,411 thinking |
| Time | 9 min |
| Wallet | 0 transactions, 0 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 29 | 170,085 | 1,766 | 1,610 | 97 |
| plan | 1 | 3,414 | 1,878 | 1,944 | 30 |
| test | 89 | 426,908 | 2,890 | 5,332 | 290 |
| critique | 17 | 86,889 | 949 | 5,326 | 92 |
| report | 1 | 1,505 | 196 | 199 | 4 |