No confirmed application defects were identified, though on-chain kiosk creation could not be completed due to test environment network restrictions.
Testing exercised core interface functionality across ten scenarios, including header and hero wallet connections, network switching, search validation, and navigation between kiosk views.
Nine scenarios passed without error. One scenario attempting to create a kiosk failed when communicating with Sui RPC nodes; the audit withdrew the single critical finding raised for this failure after confirming it stemmed from sandbox CORS restrictions blocking RPC requests rather than a defect in the application.
While UI controls, wallet states, and error handling for invalid inputs performed as expected, end-to-end on-chain transaction execution remains an unexercised gap due to the environment RPC limitations.
| Metric | Count |
|---|---|
| Scenarios executed | 10 |
| Passed | 9 |
| Failed | 1 |
| Blocked | 0 |
| Findings raised | 1 |
| Issues after the audit | 0 |
| Withdrawn by the audit | 1 |
| Critical / high / medium / low | 0 / 0 / 0 / 0 |
Target: https://sui-kiosk.vercel.app/ · Testing level: deep_feature · Stack: unknown
No issues survived the audit.
These failures came from the test environment, not from the application: a credential the sandbox does not hold, a demo nobody may write to, a resource it cannot reach. They are not counted as issues. They record what this run could not exercise.
- Creating a new Kiosk fails with 'Failed to fetch' error (S3, critical): The 'Failed to fetch' error is caused by a CORS policy block on the third-party Sui testnet RPC node, which is an environment limitation, and the wallet record shows the kiosk creation transaction was actually initiated and signed. The audit recorded the test environment as the cause, so this is a limit of the run rather than a defect of the application. The page reported 2 console errors during the scenario.
- S2 could not exercise this: Requests to Sui RPC nodes are blocked by CORS policy. Requests to the Sui fullnode RPCs are blocked by CORS policy, leading to failed fetches. The audit recorded the test environment as the cause, so it is not counted as an issue.
| Scenario | Priority | Result | Issues |
|---|---|---|---|
| S1 Connect wallet via header | high | pass | none |
| S2 Switch network to Testnet | high | pass | none |
| S3 Create a new Kiosk | high | fail | none |
| S4 Search for non-existent Kiosk ID | high | pass | none |
| S5 Direct navigation to invalid Kiosk | high | pass | none |
| S6 Disconnect wallet | medium | pass | none |
| S7 Search input empty validation | medium | pass | none |
| S8 Navigate back from Kiosk viewer | medium | pass | none |
| S9 Connect wallet via hero section | low | pass | none |
| S10 Switch network to unsupported Mainnet | low | pass | none |
The Critic reviewed 1 finding and ran 0 live replays in the browser, each on a fresh page.
- The tester claimed S2 updated cleanly without CORS issues, but the console errors clearly show CORS blocks for both testnet and devnet RPCs.
- RPC requests to Sui public nodes are consistently blocked by CORS across all scenarios, which is an environment limitation that prevented signed transactions from executing.
In scope: Wallet connection and disconnection flows; Network selection and context updates; Kiosk creation initiation; Kiosk ID search functionality and error handling; Kiosk viewer navigation and empty states.
Not covered: Viewing populated kiosk details (depends on external chain state not guaranteed in a test environment); Transactions on networks other than testnet (injected test wallet only supports sui:testnet).
- The injected test wallet automatically handles and approves connection and transaction requests when prompted by the application.
- The CORS errors observed in the AppMap for fullnode RPC endpoints may cause functional failures; scenarios are designed to expect success and will legitimately fail if the RPC remains broken.
| Metric | Value |
|---|---|
| Scenarios | 9 passed, 1 failed, 0 blocked of 10 (33 planned steps) |
| Browser actions | 153 (34 clicks, 12 inputs, 17 navigations, 90 snapshots) |
| Screenshots | 32 (3 explore, 29 scenario, 0 critic), 28 captioned |
| Coverage | 2 pages, 1 forms, 4 flows, 3 console errors |
| Audit | 1 findings, 0 re-verified live, 0 confirmed, 0 promoted, 1 withdrawn |
| Model calls | 146 |
| Tokens | 647,516 input, 7,972 output, 14,625 thinking |
| Time | 10 min |
| Wallet | 3 transactions, 0 signatures, 0 refusals on chain sui:testnet |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|---|---|---|---|---|
| explore | 32 | 141,575 | 1,847 | 1,578 | 115 |
| plan | 1 | 3,836 | 1,945 | 2,106 | 31 |
| test | 111 | 493,774 | 3,584 | 6,679 | 375 |
| critique | 1 | 6,827 | 419 | 3,546 | 81 |
| report | 1 | 1,504 | 177 | 716 | 7 |