QA report: external/marketplace.apexisdefi.com at hosted
The marketplace fails to handle purchase offers and permits invalid listing data due to missing form validations.
Testing evaluated twelve scenarios covering NFT listing creation, marketplace fee calculations, form constraints, and detail page interactions. Two end-to-end transaction flows, including ERC721 listing creation and executing purchases, could not be tested because no Web3 wallet provider was available in the automated test environment.
The primary failure occurs on the NFT detail page, where the 'Make offer' button is completely unresponsive and produces no interactive dialog or form for prospective buyers. Furthermore, the listing form fails to enforce basic input validation, permitting arbitrary non-address strings for smart contracts and accepting zero or negative quantities for ERC1155 listings while keeping the submit action enabled.
These defects prevent essential buyer interactions and allow malformed listing transactions to proceed to the wallet prompt stage. The application is not ready for deployment until the offer action is restored and input validation rules are enforced across the listing creation interface.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 7 |
| Failed | 3 |
| Blocked | 2 |
| Findings raised | 3 |
| Issues after the audit | 3 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 1 / 2 / 0 |
Target: https://marketplace.apexisdefi.com/ · Testing level: deep_feature · Stack: unknown
Issues
High severity
F3 · 'Make offer' button on NFT detail page is completely unresponsive
Severity: high · Type: functional · Verdict: confirmed · Scenario: S10
I navigated to the NFT details page at https://marketplace.apexisdefi.com/nft/0x8579882cfC7bb7087bdBb6722C985B89d94b553f/30. Clicking the 'Make offer' button did not trigger any action, such as opening a modal or showing an input form; the page remained unchanged. The page reported 5 console errors during the scenario.
Expected: Clicking 'Make offer' should open a modal or form allowing the user to enter and submit an offer price (or prompt for wallet connection if required).
Actual: Clicking the 'Make offer' button produces no action, modal, or input form.
Steps to reproduce:
- Navigate to https://marketplace.apexisdefi.com/nft/0x8579882cfC7bb7087bdBb6722C985B89d94b553f/30
- Click the 'Make offer' button under the 'Make an offer' section
Evidence: screenshots/S10-2.png, screenshots/S10-4.png, screenshots/S10-8.png
Medium severity
F1 · Listing form accepts invalid NFT contract address without format validation
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S6
The observations in S6 explicitly state that the form accepted 'invalid-address' and enabled the submit button, confirming the absence of format validation. The page reported 3 console errors during the scenario.
Expected: The application should validate the NFT contract address format (e.g. 42-character EVM address starting with 0x), reject invalid input, and display an invalid address format error.
Actual: The create listing form accepts 'invalid-address' as a valid contract address, renders it in the live preview card, calculates fees, and enables the listing button without displaying any address format validation error.
Steps to reproduce:
- Navigate to https://marketplace.apexisdefi.com/create
- Type 'invalid-address' into the 'NFT contract address' field
- Type '1' into the 'Token ID' field
- Type '10' into the 'Price (USDC)' field
- Observe that the form accepts the input and enables 'Connect wallet to list' with no validation errors
Evidence: screenshots/S6-9.png, screenshots/S6-11.png
F2 · ERC1155 listing form accepts 0 and negative values for Amount field without validation
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S9
The S9 observations confirm that the Amount field accepted 0 without error and left the submission button enabled, matching the claim. The page reported 3 console errors during the scenario.
Expected: The application should reject amount <= 0 and flag the Amount field as invalid.
Actual: The Amount field accepts 0 (and negative values) without validation errors and the listing button remains enabled.
Steps to reproduce:
- Navigate to https://marketplace.apexisdefi.com/create
- Click the Token standard ERC1155 toggle button
- Fill NFT contract address, Token ID, and Price per unit with valid values
- Set the 'Amount' field to 0
- Observe the form validation and submit button state
Evidence: screenshots/S9-2.png, screenshots/S9-4.png
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Successful ERC721 listing creation | high | blocked (No web3 wallet provider is injected or mockable in the headless test environment to complete the signature and escrow transaction.) | none |
| S2 Successful ERC1155 listing creation | high | pass | none |
| S3 Create Listing missing required fields | high | pass | none |
| S4 Marketplace fee and payout calculation | high | pass | none |
| S5 Execute 'Buy now' on existing NFT | high | blocked (No Web3 wallet extension is available in the test environment to connect a wallet and transition the 'Connect wallet to buy' button into an active 'Buy now' transaction prompt.) | none |
| S6 Invalid NFT contract address format | medium | fail | F1 |
| S7 Zero or negative price validation | medium | pass | none |
| S8 ERC721 Amount field constraint | medium | pass | none |
| S9 ERC1155 Zero Amount validation | medium | fail | F2 |
| S10 Execute 'Make offer' on existing NFT | medium | fail | F3 |
| S11 IPFS image CORS error handling | low | pass | none |
| S12 React hydration error check | low | pass | none |
The audit
The Critic reviewed 3 findings and re-verified 5 of them live in the browser, replaying the reported steps on a fresh page.
- The unresponsive 'Make offer' button reported in F3 is very likely a side effect of the React hydration crash (error #418) breaking the component's interactive state.
- Scenario S11 explicitly passed despite the tester logging both a CORS policy block for an IPFS resource and a React hydration error, rationalizing it as 'loading cleanly without breaking the UI'.
- Scenario S12 passed and claimed the page loaded 'without errors' despite multiple unhandled network and security policy errors present in the console.
- A possible defect in S11 ("React hydration mismatch error on NFT details page") was not promoted: the live replay came back not-reproduced.
- A possible defect in S11 ("IPFS image loading blocked by CORS policy") was not promoted: the live replay came back not-reproduced.
- A possible defect in S12 ("Resource loading blocked by NotSameOrigin policy") was not promoted: the live replay came back not-reproduced.
- A possible defect in S12 ("Resource fails to load with 403 Forbidden status") was not promoted: the live replay came back not-reproduced.
What to fix first
- Restore the interactive state and modal trigger for the 'Make offer' button on the NFT detail page (F3).
- Add format and checksum validation to the NFT contract address input in the listing form before enabling submission (F1).
- Enforce positive integer validation on the ERC1155 listing amount field to prevent zero or negative values (F2).
Coverage and caveats
In scope: Create Listing form validation and submission; ERC721 vs ERC1155 listing constraints; Marketplace fee calculation correctness; NFT purchase and offer actions; Console errors and image CORS issues.
Not covered: Dashboard and Profile management (focused strictly on the marketplace listing and trading feature); Sidebar placeholder links (known issue from intake notes); Community page leaderboards (out of feature scope).
- The test wallet automatically connects and handles transaction signatures on the Arc testnet without manual intervention.
- A valid test contract address is available during execution to successfully test the listing flow.
- The specific NFT at address 0x8579882cfC7bb7087bdBb6722C985B89d94b553f/30 is available for purchase testing.
- S1 could not be executed: No web3 wallet provider is injected or mockable in the headless test environment to complete the signature and escrow transaction..
- S5 could not be executed: No Web3 wallet extension is available in the test environment to connect a wallet and transition the 'Connect wallet to buy' button into an active 'Buy now' transaction prompt..
By the numbers
| Metric | Value |
|---|
| Scenarios | 7 passed, 3 failed, 2 blocked of 12 (43 planned steps) |
| Browser actions | 199 (30 clicks, 31 inputs, 44 navigations, 94 snapshots) |
| Screenshots | 37 (4 explore, 28 scenario, 5 critic), 28 captioned |
| Coverage | 8 pages, 1 forms, 3 flows, 7 console errors |
| Audit | 3 findings, 5 re-verified live, 3 confirmed, 0 promoted, 0 withdrawn |
| Model calls | 193 |
| Tokens | 1,164,718 input, 12,516 output, 30,380 thinking |
| Time | 22 min |
| Wallet | 0 transactions, 0 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 27 | 221,822 | 2,514 | 1,684 | 161 |
| plan | 1 | 4,364 | 2,341 | 4,346 | 52 |
| test | 143 | 835,658 | 5,178 | 8,388 | 621 |
| critique | 21 | 100,973 | 2,171 | 15,439 | 483 |
| report | 1 | 1,901 | 312 | 523 | 7 |