QA report: external/settleone.vercel.app at hosted
The backend is offline, so sign-in, draft creation and evidence lookups all fail and the application's core functionality is unusable.
Testing covered 11 scenarios across wallet connection, session restoration and disconnection, input validation for budgets and agent lookups, and network handling on the Sepolia network. Ten scenarios passed and one failed.
The primary failure is that the backend host no longer serves the API (it answers Railway's fallback 404 for every path, which the browser reports as a CORS preflight failure), resulting in fetch errors during authentication and draft creation. While client-side form validations and wallet connection flows executed, the underlying API endpoints remain unreachable from the application origin. During the audit, one additional finding regarding unvalidated agent lookups was withdrawn.
Until the backend is redeployed, users cannot complete core workflows such as creating drafts or interacting with backend services.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 11 |
| Passed | 10 |
| Failed | 1 |
| Blocked | 0 |
| Findings raised | 1 |
| Issues after the audit | 1 |
| Withdrawn by the audit | 1 |
| Critical / high / medium / low | 1 / 0 / 0 / 0 |
Target: https://settleone.vercel.app · Testing level: deep_feature · Stack: unknown
Issues
Critical severity
F2 · Backend is offline: sign-in, draft creation and evidence lookups all fail
Severity: critical · Type: functional · Verdict: promoted · Scenario: S2
Surfaced by the audit of S2, which the Tester passed, and reproduced live: I clicked the 'Sign in and create draft' button on the homepage. Shortly after, the button became re-enabled and an alert displaying 'Failed to fetch' appeared, blocking the sign-in and draft creation process as reported. The page reported 3 console errors during the scenario.
Expected: The application should successfully communicate with the backend to authenticate and create the draft.
Actual: Every call to the backend host settleone-production.up.railway.app fails and the page shows 'Failed to fetch'. The browser logs it as a CORS preflight failure, but the host answers Railway's fallback 404 (x-railway-fallback: true) for every path, so the backend service is no longer deployed rather than misconfigured for CORS. Core workflows cannot complete.
Review note (2026-09-16): Human review on 2026-09-16 reframed F2: the backend host returns Railway's fallback 404 with x-railway-fallback: true for every path, so the root cause is an undeployed backend, and the CORS error is the browser's symptom. Severity kept at critical because the core workflows are unusable as hosted.
Steps to reproduce:
- Connect wallet.
- Enter a valid amount in the 'Approved budget' field.
- Click 'Sign in and create draft'.
Evidence: screenshots/critic-M1-1.png
Withdrawn findings
The Critic re-examined these claims and found the evidence did not support them. They are kept here rather than deleted.
- Empty Agent ids triggers unvalidated network fetch resulting in 'Failed to fetch' error (S10, medium): The observed 'Failed to fetch' alert is due to a systemic CORS misconfiguration blocking all API requests (as seen with valid inputs in S4), not a specific defect with empty input validation. The page reported 3 console errors during the scenario.
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Connect web3 wallet | high | pass | none |
| S2 Handle draft creation API failure gracefully | high | pass | F2 |
| S3 Handle Sepolia network switch rejection on resolver lookup | high | pass | none |
| S4 Handle vendor evidence fetch API failure gracefully | high | pass | none |
| S5 Reject draft creation with empty budget | medium | pass | none |
| S6 Reject draft creation with non-numeric budget | medium | pass | none |
| S7 Restore saved session | medium | pass | none |
| S8 Generate secondary wallet address | medium | pass | none |
| S9 Handle Sepolia network switch rejection on ENS grant | medium | pass | none |
| S10 Reject evidence fetch with empty Agent ids | medium | fail | none |
| S11 Disconnect wallet session | medium | pass | none |
The audit
The Critic reviewed 1 finding and re-verified 1 of them live in the browser, replaying the reported steps on a fresh page.
- The tester consistently rationalized application-breaking CORS errors as successful tests of 'graceful failure handling', missing that the application's primary features are completely non-functional.
What to fix first
- Redeploy the backend API so draft creation, authentication and evidence lookups reach a live service (F2).
Coverage and caveats
In scope: Wallet connection lifecycle on Arc testnet; Draft creation flow validation and error handling; ENS identity flow network switch rejection handling; Vendor evidence query validation and error handling.
Not covered: Successful draft creation API responses; Successful vendor evidence API responses; Successful Sepolia ENS transactions.
- Backend API endpoints (settlement, graph) are offline, so the only observable behavior on those flows is error handling.
- The test wallet strictly refuses network switches away from Arc testnet (chain 5042002), so Sepolia operations will predictably fail at the network switch prompt.
By the numbers
| Metric | Value |
|---|
| Scenarios | 10 passed, 1 failed, 0 blocked of 11 (21 planned steps) |
| Screenshots | 29 (2 explore, 26 scenario, 1 critic), 26 captioned |
| Coverage | 1 pages, 3 forms, 5 flows, 5 console errors |
| Audit | 1 findings, 1 re-verified live, 0 confirmed, 1 promoted, 1 withdrawn |
| Model calls | 117 |
| Tokens | 489,461 input, 7,148 output, 12,759 thinking |
| Time | 6 min |
| Wallet | 0 transactions, 0 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 19 | 98,501 | 1,707 | 958 | 51 |
| plan | 1 | 3,892 | 1,665 | 3,393 | 42 |
| test | 91 | 367,458 | 3,097 | 4,631 | 197 |
| critique | 5 | 18,139 | 466 | 3,428 | 41 |
| report | 1 | 1,471 | 213 | 349 | 5 |
