No defects were confirmed across the application, though half of the evaluated scenarios were blocked by environment and test setup constraints.
Testing evaluated 12 scenarios across token swaps, liquidity pool management, asset bridging, transfers, and analytics error handling. Six scenarios passed, confirming client-side input validations including insufficient balance checks, zero-amount guards, gas reservations on maximum swaps, and pool overdraft prevention. Zero defects were confirmed after audit.
Six scenarios were blocked from completing their validation paths. Insufficient testnet wallet balances and unavailable token swaps prevented the execution of swap, liquidity addition, and token transfer actions. Further scenarios were blocked by unexposed bridge controls in the accessibility tree and tool budget limits reached while setting up LP tokens or configuring custom slippage.
Four potential network and API issues investigated during the audit returned inconclusive results upon live re-verification and were not promoted to defects. Complete end-to-end execution of transaction workflows remains unverified due to the test environment limitations.
| Metric | Count |
|---|---|
| Scenarios executed | 12 |
| Passed | 6 |
| Failed | 0 |
| Blocked | 6 |
| Findings raised | 0 |
| Issues after the audit | 0 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 0 / 0 / 0 |
Target: https://lunex.finance · Testing level: deep_feature · Stack: unknown
No issues survived the audit.
| Scenario | Priority | Result | Issues |
|---|---|---|---|
| S1 Execute USDC to EURC swap | high | blocked (The default testnet wallet balance is 5.00 USDC, preventing the requested 10 USDC swap from being submitted due to insufficient balance.) | none |
| S2 Swap MAX shortcut reserves gas | high | pass | none |
| S3 Swap insufficient balance validation | high | pass | none |
| S4 Add single-sided USDC liquidity | high | blocked (Cannot add 10 USDC liquidity because the test wallet balance is only 5.00 USDC and swapping USDT to USDC is disabled due to pool maintenance.) | none |
| S5 Remove liquidity | high | blocked (Scenario required an active LP token [redacted] which was not initially present, and tool turn limit was reached while provisioning liquidity prior to the remove step.) | none |
| S6 Bridge rejects non-Arc source networks | high | blocked (The interactive form elements within the bridge tabpanel were not individually addressable or exposed as separate interactive controls in the accessibility tree.) | none |
| S7 Swap zero amount validation | medium | pass | none |
| S8 Pool add insufficient balance validation | medium | pass | none |
| S9 Pool remove overdraft validation | medium | pass | none |
| S10 Send stablecoins successfully | medium | blocked (The test wallet balance on the hosted testnet environment is only 2.99 USDC, preventing the transfer of 10 USDC due to insufficient balance validation.) | none |
| S11 Swap high slippage warning | low | blocked (Tool-call budget reached before entering custom slippage value into the slippage input field.) | none |
| S12 Analytics graceful failure on CORS logs | low | pass | none |
The Critic reviewed 0 findings and re-verified 4 of them live in the browser, replaying the reported steps on a fresh page.
- Over half of the scenarios were blocked because the test wallet lacked sufficient funds on the testnet and the faucet was inoperable, representing a significant failure in the testing environment setup.
- Console errors representing API blockages via CORS and HTTP 429 rate limits appeared continuously across all passed and blocked scenarios but were completely disregarded by the tester.
- A possible defect in S2 ("CORS policy blocks eth-sepolia Blast API request") was not promoted: the live replay came back inconclusive.
- A possible defect in S3 ("CORS policy blocks arcscan testnet API requests") was not promoted: the live replay came back inconclusive.
- A possible defect in S7 ("Server returns 429 Too Many Requests error during interaction") was not promoted: the live replay came back inconclusive.
- A possible defect in S8 ("Syntax error due to unexpected HTML response") was not promoted: the live replay came back inconclusive.
In scope: StableSwap exchange (Swap) constraints and operations; Liquidity provision (Pool Add/Remove); Cross-chain bridge network switch constraints; Direct stablecoin transfers (Send).
Not covered: Yield Vaults (excluded to focus deeply on core AMM Swap and Liquidity); AI Autopilot (excluded to maintain focus on the deep feature scope); Testnet Faucet (wallet is already funded with USDC based on intake); Documentation (static content, out of scope for transactional testing).
- Assuming a 'MAX' shortcut button exists near the amount inputs to test the explicitly requested gas reservation constraint.
- Assuming EURC and USDT starting balances are 0 and must be acquired via Swap if needed.
- Assuming the wallet's refusal to switch from Arc testnet is verifiable via an observable rejection message in the UI.
- S1 could not be executed: The default testnet wallet balance is 5.00 USDC, preventing the requested 10 USDC swap from being submitted due to insufficient balance..
- S4 could not be executed: Cannot add 10 USDC liquidity because the test wallet balance is only 5.00 USDC and swapping USDT to USDC is disabled due to pool maintenance..
- S5 could not be executed: Scenario required an active LP token [redacted] which was not initially present, and tool turn limit was reached while provisioning liquidity prior to the remove step..
- S6 could not be executed: The interactive form elements within the bridge tabpanel were not individually addressable or exposed as separate interactive controls in the accessibility tree..
- S10 could not be executed: The test wallet balance on the hosted testnet environment is only 2.99 USDC, preventing the transfer of 10 USDC due to insufficient balance validation..
- S11 could not be executed: Tool-call budget reached before entering custom slippage value into the slippage input field..
| Metric | Value |
|---|---|
| Scenarios | 6 passed, 0 failed, 6 blocked of 12 (48 planned steps) |
| Browser actions | 262 (33 clicks, 30 inputs, 64 navigations, 135 snapshots) |
| Screenshots | 30 (4 explore, 22 scenario, 4 critic), 22 captioned |
| Coverage | 14 pages, 9 forms, 7 flows, 28 console errors |
| Audit | 0 findings, 4 re-verified live, 0 confirmed, 0 promoted, 0 withdrawn |
| Model calls | 211 |
| Tokens | 1,104,885 input, 11,301 output, 28,877 thinking |
| Time | 21 min |
| Wallet | 4 transactions, 3 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|---|---|---|---|---|
| explore | 21 | 99,305 | 3,264 | 1,187 | 143 |
| plan | 1 | 9,634 | 2,027 | 5,486 | 58 |
| test | 157 | 834,030 | 4,326 | 12,182 | 850 |
| critique | 31 | 160,261 | 1,457 | 9,309 | 179 |
| report | 1 | 1,655 | 227 | 713 | 9 |