QA report: external/stacdefi.app at hosted
Token swap percentage shortcuts fail to update inputs and balance validation lacks user feedback, while full swap execution was blocked by faucet funding failures.
Deep feature testing evaluated twelve scenarios covering wallet connection, token swapping controls, bridge direction handling, transaction search and filtering, and liquidity placeholder views. Eight scenarios passed, two failed on input interaction and validation messaging, and two end-to-end swap execution scenarios were blocked because the faucet did not fund the test wallet.
On the swap interface, percentage shortcut buttons including 25%, 50%, and MAX fail to alter or populate the swap amount input field. Furthermore, when an entered amount exceeds the wallet balance, the interface disables the swap action without displaying an explicit insufficient balance warning or explanatory feedback.
Core browsing, transaction searching, and bridge toggling behaved properly, but actual on-chain swap completion and native gas reservation logic could not be verified during this run due to the zero-balance test environment.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 8 |
| Failed | 2 |
| Blocked | 2 |
| Findings raised | 2 |
| Issues after the audit | 2 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 0 / 2 / 0 |
Target: https://stacdefi.app/ · Testing level: deep_feature · Stack: unknown
Issues
Medium severity
F1 · Percentage shortcut buttons (25%, 50%, MAX) fail to update the swap amount input
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S4
The evidence supports the claim that clicking the percentage button fails to update the input to 0.00 when the balance is empty, leaving the previously entered value intact. The page reported 1 console error during the scenario.
Expected: The swap amount input should populate with 25% of the total balance (0.00).
Actual: Clicking the '25%' button has no effect on the input field; the existing input value remains unchanged.
Steps to reproduce:
- Navigate to https://stacdefi.app/swap with a connected wallet
- Enter an amount into the swap input textbox (e.g. 100)
- Click the '25%' button next to the token balance
Evidence: screenshots/S4-2.png, screenshots/S4-11.png
F2 · Missing 'Insufficient balance' warning when swap amount exceeds wallet balance
Severity: medium · Type: ux · Verdict: confirmed · Scenario: S6
The evidence confirms that no explicit insufficient balance text warning appears, although the button correctly disables. The reporter may choose to adjust the severity as a medium UX defect could overstate the impact. The page reported 1 console error during the scenario.
Expected: The interface should display an 'Insufficient balance' warning or update the button text to 'Insufficient balance' when the entered swap amount exceeds the wallet balance.
Actual: The Swap button is disabled, but no 'Insufficient balance' warning or message is displayed on the interface or button text.
Steps to reproduce:
- Navigate to https://stacdefi.app/swap
- Observe the wallet balance is 0.00 USDC
- Enter 1000 in the swap input field
- Check the page for an 'Insufficient balance' warning or message
Evidence: screenshots/S6-12.png
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Connect wallet and claim test tokens | high | pass | none |
| S2 Execute standard token swap | high | blocked (The connected wallet has 0.00 balance and the Faucet button does not fund the wallet in this environment, leaving the Swap button disabled due to insufficient balance.) | none |
| S3 Swap using MAX shortcut respects native gas reservation | high | blocked (The connected wallet balance is 0.00 and the faucet does not dispense tokens, preventing the MAX swap execution from being tested.) | none |
| S4 Swap using 25% shortcut calculates correctly | medium | fail | F1 |
| S5 Toggle and view Swap Details | medium | pass | none |
| S6 Validation of insufficient balance on Swap | medium | fail | F2 |
| S7 Validation of zero or empty amount on Swap | medium | pass | none |
| S8 Bridge direction switch handles network constraint gracefully | medium | pass | none |
| S9 Search transactions by token or hash | medium | pass | none |
| S10 Filter transactions by status | medium | pass | none |
| S11 Transaction search empty state | low | pass | none |
| S12 Liquidity placeholder page rendering | low | pass | none |
The audit
The Critic reviewed 2 findings and re-verified 3 of them live in the browser, replaying the reported steps on a fresh page.
- Scenarios S2 and S3 were correctly blocked due to the faucet failing to fund the wallet, which is explained by the unfiled CORS error on the RPC endpoint observed in S1.
- Scenario S10 contains a contradictory observation, claiming both that no dropdown menu opened and that the status filter dropdown opened showing options.
- A possible defect in S1 ("RPC endpoint fetch blocked by CORS policy") was not promoted: the live replay came back inconclusive.
- A possible defect in S5 ("Font stylesheet blocked by Content Security Policy") was not promoted: the live replay came back inconclusive.
- A possible defect in S9 ("Supabase WebSocket connection fails due to unresolvable domain") was not promoted: the live replay came back inconclusive.
What to fix first
- Restore functionality to the 25%, 50%, and MAX percentage shortcut buttons so they correctly calculate and update the swap amount input (F1).
- Display a visible 'Insufficient balance' warning message or button label when the requested swap amount exceeds the available wallet balance (F2).
Coverage and caveats
In scope: Wallet connection and Faucet usage; End-to-end token swapping; Gas reservation via MAX balance calculations; Bridge network change constraints; Transaction history search and filtering.
Not covered: Full cross-chain bridging execution to Arc (test wallet restricted to Arc testnet); Liquidity provision (feature not yet launched).
- The injected test wallet automatically approves connection requests on the Arc testnet
- The test wallet automatically rejects prompts to switch the network to Sepolia
- Console errors regarding Fontshare CSP, CORS, and Websocket do not block core navigation
- S2 could not be executed: The connected wallet has 0.00 balance and the Faucet button does not fund the wallet in this environment, leaving the Swap button disabled due to insufficient balance..
- S3 could not be executed: The connected wallet balance is 0.00 and the faucet does not dispense tokens, preventing the MAX swap execution from being tested..
By the numbers
| Metric | Value |
|---|
| Scenarios | 8 passed, 2 failed, 2 blocked of 12 (30 planned steps) |
| Browser actions | 225 (53 clicks, 14 inputs, 36 navigations, 122 snapshots) |
| Screenshots | 40 (4 explore, 33 scenario, 3 critic), 33 captioned |
| Coverage | 5 pages, 3 forms, 5 flows, 7 console errors |
| Audit | 2 findings, 3 re-verified live, 2 confirmed, 0 promoted, 0 withdrawn |
| Model calls | 212 |
| Tokens | 892,711 input, 10,183 output, 20,561 thinking |
| Time | 12 min |
| Wallet | 1 transactions, 1 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 32 | 162,070 | 2,185 | 1,508 | 124 |
| plan | 1 | 4,223 | 1,810 | 3,142 | 41 |
| test | 162 | 669,942 | 4,676 | 7,217 | 412 |
| critique | 16 | 54,775 | 1,223 | 8,046 | 161 |
| report | 1 | 1,701 | 289 | 648 | 8 |