QA report: external/lunya.io at hosted
The contact form cannot be submitted due to a submit button stuck in a permanent disabled state.
Testing exercised 12 scenarios covering contact inquiries, token launching, swap and bridge interfaces, liquidity pool management, bonding curve controls, and analytics tab navigation. Five scenarios passed, six failed initial verification, and one was blocked.
The primary functional failure is the contact inquiry form, where the submit button remains indefinitely disabled displaying 'Checking…', preventing users from submitting messages. A secondary low-severity issue causes a background fetch request to fail due to a CORS policy preflight error. Five other candidate findings concerning wallet modal interactions and asset downloads were withdrawn during the audit.
New pool creation flows could not be tested because the interface lacked listed tokens on the tested chain. Resolving the contact form submission block is necessary before user outreach and support channels can function reliably.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 5 |
| Failed | 6 |
| Blocked | 1 |
| Findings raised | 6 |
| Issues after the audit | 2 |
| Withdrawn by the audit | 5 |
| Critical / high / medium / low | 0 / 1 / 0 / 1 |
Target: https://lunya.io · Testing level: deep_feature · Stack: unknown
Issues
High severity
F1 · Contact form submit button is permanently disabled with 'Checking…' state
Severity: high · Type: functional · Verdict: confirmed · Scenario: S1
I navigated to the contact page, selected 'Feedback', and filled in a valid email address and message. The submit button remained disabled, displaying the 'Checking…' text indefinitely, preventing form submission. The page reported 4 console errors during the scenario.
Expected: The submit button should become enabled once required fields are completed, allowing the user to submit the inquiry.
Actual: The submit button is disabled and displays 'Checking…' indefinitely, preventing the inquiry from being submitted.
Steps to reproduce:
- Navigate to https://www.lunya.io/contact
- Select a topic from the 'What is it about' dropdown
- Enter a valid email address in the 'Your email' field
- Enter a message in the 'Message' field
- Attempt to click the submit button
Evidence: screenshots/S1-4.png, screenshots/S1-10.png, screenshots/S1-12.png
Low severity
F7 · CORS policy error on background fetch
Severity: low · Type: functional · Verdict: promoted · Scenario: S6
Surfaced by the audit of S6, which the Tester passed, and reproduced live: When clicking the 'Brand kit' link (ref=e32, url=/brand) in the footer on the main page, nothing happens because a background client-side navigation fetch is attempted and fails due to a CORS policy error on the external Vercel Blob redirect. The UI fails silently. The page reported 4 console errors during the scenario.
Expected: No CORS policy errors should be logged during background requests.
Actual: A CORS policy error is logged due to a blocked preflight request.
Steps to reproduce:
- Navigate to the application
- Observe the browser console
Evidence: screenshots/critic-M1-1.png
Withdrawn findings
The Critic re-examined these claims and found the evidence did not support them. They are kept here rather than deleted.
- Connect wallet action button on swap form fails to open wallet connection modal (S2, high): The claim that the modal fails to open directly contradicts Scenario S7, which shows the exact same button successfully opening the modal, indicating a driver click failure rather than an application defect. The live replay was inconclusive: The replay ran out of tool calls before it reached the reported state. The page reported 4 console errors during the scenario.
- Launch token form prompts for wallet connection without validating missing required fields (S3, medium): The action button is explicitly labeled 'Connect wallet', so opening the wallet connection modal is the correct behavior; form validation should not precede wallet connection. The page reported 2 console errors during the scenario.
- Bridge form prompts for wallet connection without validating or accepting a recipient address (S4, medium): The primary action button functions as a 'Connect wallet' prompt for unauthenticated users, meaning it correctly opens the wallet modal instead of validating form fields first. The page reported 4 console errors during the scenario.
- No CORS error logged during brand kit assets download at /brand (S5, low): The absence of a CORS error during a successful file download is expected behavior and does not constitute a defect. The page reported 4 console errors during the scenario.
- Swap form primary button prompts for wallet connection instead of disabling or requiring an amount when Pay amount is empty (S7, low): Because the user's wallet is not connected, the primary button correctly acts as a 'Connect wallet' prompt and opens the connection modal rather than enforcing input validation. The page reported 3 console errors during the scenario.
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Submit valid contact inquiry | high | fail | F1 |
| S2 Swap form valid inputs trigger wallet connection | high | fail | none |
| S3 Launch Token form required fields validation | high | fail | none |
| S4 Bridge form recipient address validation | high | fail | none |
| S5 Observe CORS error on brand assets fetch | high | fail | none |
| S6 Contact form required fields validation | medium | pass | F7 |
| S7 Swap form empty input validation | medium | fail | none |
| S8 New Pool creation triggers wallet connection | medium | blocked (Cannot create a new pool because /liquidity/new displays 'Nothing has been listed on this chain yet, and a pool needs two tokens' with no token [redacted], pool type, fee tier controls, or pool creation form rendered.) | none |
| S9 Liquidity pool search filters empty state | medium | pass | none |
| S10 Bonding curve Buy/Sell mode toggle | medium | pass | none |
| S11 Analytics dashboard tab navigation | low | pass | none |
| S12 Disabled future features show tooltips | low | pass | none |
The audit
The Critic reviewed 6 findings and re-verified 4 of them live in the browser, replaying the reported steps on a fresh page.
- Scenarios S2 and S7 contradict each other on whether the 'Connect wallet' button successfully opens a modal.
- The Tester repeatedly raised defects (F3, F4, F6) for a 'Connect wallet' button failing to validate form inputs, misunderstanding that wallet connection precedes form submission.
- Finding F5 incorrectly flags the absence of a CORS error during a successful file download as a defect.
- A possible defect in S6 ("Malformed console error logging NaN") was not promoted: the live replay came back inconclusive.
What to fix first
- Resolve the state validation logic preventing the contact form submit button from leaving the 'Checking…' state (F1).
- Update the server CORS preflight headers to allow background fetch requests on form pages (F7).
Coverage and caveats
In scope: Contact form submission and validation; Web3 form input validation (Swap, Launch Token, Bridge) up to wallet connection; Data visualization tabs (Analytics) and list filtering (Liquidity); Page load integrity and CORS error observation.
Not covered: On-chain transaction execution (Swap, Bridge, Liquidity, Bonding Curve) because the Tester lacks a Web3 wallet..
- The automated Tester operates a standard browser without Web3 wallet extensions.
- End-to-end execution of Web3 flows cannot be completed; testing for these flows terminates at the 'Connect Wallet' modal.
- The Contact form relies on a standard Web2 backend and can be tested completely.
- The /brand URL is expected to trigger a CORS error based on the AppMap console logs when accessed via client-side routing.
- S8 could not be executed: Cannot create a new pool because /liquidity/new displays 'Nothing has been listed on this chain yet, and a pool needs two tokens' with no token [redacted], pool type, fee tier controls, or pool creation form rendered..
By the numbers
| Metric | Value |
|---|
| Scenarios | 5 passed, 6 failed, 1 blocked of 12 (40 planned steps) |
| Browser actions | 197 (41 clicks, 16 inputs, 39 navigations, 101 snapshots) |
| Screenshots | 32 (4 explore, 24 scenario, 4 critic), 24 captioned |
| Coverage | 11 pages, 6 forms, 6 flows, 13 console errors |
| Audit | 6 findings, 4 re-verified live, 1 confirmed, 1 promoted, 5 withdrawn |
| Model calls | 205 |
| Tokens | 1,478,984 input, 11,963 output, 22,041 thinking |
| Time | 17 min |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 22 | 168,846 | 2,789 | 1,398 | 100 |
| plan | 1 | 5,902 | 2,052 | 2,689 | 34 |
| test | 154 | 1,161,380 | 5,606 | 8,345 | 539 |
| critique | 27 | 140,755 | 1,262 | 8,950 | 337 |
| report | 1 | 2,101 | 254 | 659 | 8 |
