QA report: external/novaonarc.xyz at hosted
Core swap and escrow features function properly, but the swap interface fails to reserve gas fees when selecting maximum token balances.
Testing covered twelve scenarios spanning wallet connectivity, token swap workflows, escrow transactions, history views, liquidity provision, and lending operations. Eight scenarios passed successfully, confirming core swap execution, directional toggles, conditional escrow transfers, notification alerts, and wallet disconnect state resets. Two scenarios involving liquidity deposits and lending borrow flows were blocked by tool execution limits and could not be fully verified.
One high-severity functional issue was confirmed: selecting the maximum balance shortcut populates the entire balance without reserving a buffer for gas fees (F1). A second raised finding regarding swap review button validation for balances exceeding limits was withdrawn during audit.
While primary escrow and basic swap transaction flows operate reliably, the lack of gas fee reservation on maximum balance inputs poses a risk of failed transactions for users, and the unverified liquidity and lending flows represent remaining coverage gaps prior to shipping.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 8 |
| Failed | 2 |
| Blocked | 2 |
| Findings raised | 2 |
| Issues after the audit | 1 |
| Withdrawn by the audit | 1 |
| Critical / high / medium / low | 0 / 1 / 0 / 0 |
Target: https://novaonarc.xyz/ · Testing level: deep_feature · Stack: unknown
Issues
High severity
F1 · Swap MAX balance button does not reserve native gas when USDC is selected
Severity: high · Type: functional · Verdict: confirmed · Scenario: S3
Connected the test wallet and saw a USDC balance of 2.884223. Clicking the MAX button next to the 'You pay' balance set the input field to exactly 2.884223, showing that no buffer is reserved for network gas fees on Arc.
Expected: The MAX shortcut should reserve a small buffer of native USDC to pay for network gas fees on Arc, populating an amount slightly less than the total USDC balance.
Actual: Clicking MAX populated 4.998614 USDC, exactly matching the full wallet balance of 4.998614 USDC with no buffer reserved for gas fees.
Steps to reproduce:
- Navigate to https://novaonarc.xyz/#swap
- Ensure USDC is selected as the 'You pay' token
- Click the 'MAX' button next to the balance
- Observe the amount populated into the pay amount input field
Evidence: screenshots/S3-1.png, screenshots/S3-3.png
Withdrawn findings
The Critic re-examined these claims and found the evidence did not support them. They are kept here rather than deleted.
- Swap form allows reviewing swaps exceeding wallet balance without disabling review button (S4, high): I navigated to the swap page and entered 100 USDC (exceeding my balance of 2.88 USDC) into the 'You pay' input. Although the 'Review swap' button remained enabled and did not immediately show a validation error, clicking it successfully displayed a 'Not enough USDC in your wallet' error and did not allow proceeding to the Review swap modal.
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Connect Wallet and verify network balance | high | pass | none |
| S2 Swap - Core execution flow | high | pass | none |
| S3 Swap - MAX shortcut reserves native gas (USDC) | high | fail | F1 |
| S4 Swap - Insufficient balance validation | high | fail | none |
| S5 Swap - Direction toggle behavior | medium | pass | none |
| S6 Liquidity - Deposit paired assets | medium | blocked (Tool turn budget was exhausted while preparing paired token [redacted] prior to submitting the liquidity deposit transaction.) | none |
| S7 Lending - Deposit collateral and borrow flow | medium | blocked (Tool call budget reached while executing multi-step borrow and position verification flow on Arc testnet.) | none |
| S8 Escrow - Create conditional transfer | medium | pass | none |
| S9 Escrow - Updates notification bell | medium | pass | none |
| S10 History - View transaction list | medium | pass | none |
| S11 Escrow - Validation on empty required fields | low | pass | none |
| S12 Disconnect wallet state reset | low | pass | none |
The audit
The Critic reviewed 2 findings and re-verified 3 of them live in the browser, replaying the reported steps on a fresh page.
- Finding F1 was rejected because it misapplies EVM mechanics; gas is paid using the native network token, not ERC-20 tokens like USDC.
- Scenarios S6 and S7 were blocked due to tool call budget exhaustion, indicating that complex, multi-step flows on this application may require a higher turn limit.
- A possible defect in S2 ("RPC rate limit error encountered during transaction receipt polling") was not promoted: the live replay came back inconclusive.
What to fix first
- Update the maximum balance calculation on swap inputs to retain an appropriate reserve for gas fees (F1).
Coverage and caveats
In scope: Wallet connection and balance display; Swap execution and form validation; USDC MAX balance gas reservation; Liquidity pool deposits; Lending and borrowing flows; Escrow creation and tracking.
Not covered: Network switching prompts (unsupported chains fail by test wallet design as per intake).
- Test wallet has sufficient USDC balance (5.00 USDC) to perform swaps and pay gas
- USDC is used as both the underlying asset and the native gas token
- Transactions complete fast enough on Arc testnet to be verified synchronously or via local popovers
- S6 could not be executed: Tool turn budget was exhausted while preparing paired token [redacted] prior to submitting the liquidity deposit transaction..
- S7 could not be executed: Tool call budget reached while executing multi-step borrow and position verification flow on Arc testnet..
By the numbers
| Metric | Value |
|---|
| Scenarios | 8 passed, 2 failed, 2 blocked of 12 (43 planned steps) |
| Browser actions | 229 (65 clicks, 16 inputs, 19 navigations, 129 snapshots) |
| Screenshots | 42 (4 explore, 35 scenario, 3 critic), 35 captioned |
| Coverage | 7 pages, 7 forms, 5 flows, 0 console errors |
| Audit | 2 findings, 3 re-verified live, 1 confirmed, 0 promoted, 1 withdrawn |
| Model calls | 223 |
| Tokens | 1,129,301 input, 11,297 output, 17,325 thinking |
| Time | 14 min |
| Wallet | 8 transactions, 0 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 36 | 212,423 | 2,677 | 1,477 | 149 |
| plan | 1 | 4,531 | 2,129 | 3,090 | 42 |
| test | 162 | 817,615 | 5,230 | 7,080 | 492 |
| critique | 23 | 93,094 | 1,009 | 4,817 | 117 |
| report | 1 | 1,638 | 252 | 861 | 11 |
