QA report: external/suiscan.xyz at hosted
Global search fails to route to a valid account by its full address.
A deep feature evaluation executed 12 scenarios across the Sui explorer on testnet, testing wallet connection, Send SUI form validation and submission workflows, account profiles, transaction detail views, analytics filters, and global search functionality. Out of the 12 scenarios, 10 passed, 1 failed, and 1 was blocked.
The primary failure occurred during search navigation (F1): the global search bar shows 'No results' for a full, correctly entered 66-character Sui address and pressing Enter does not route to the target account view. A hand check in a real browser after the run confirmed the input field itself has no character limit and holds the entire 66-character address, so this is a search index or parser failure, not an input truncation. Additionally, testing search routing to transaction details was blocked due to interaction constraints with the search modal overlay in the headless environment. One initial finding regarding analytics 404 links was withdrawn during audit due to lack of supporting evidence.
While wallet interactions, transaction detail rendering, and form validation flows operated reliably, the search routing issue directly impacts core navigation for users querying full account addresses.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 10 |
| Failed | 1 |
| Blocked | 1 |
| Findings raised | 2 |
| Issues after the audit | 1 |
| Withdrawn by the audit | 1 |
| Critical / high / medium / low | 0 / 1 / 0 / 0 |
Target: https://suiscan.xyz/testnet/home · Testing level: deep_feature · Stack: unknown
Issues
High severity
F1 · Global search fails to route to a valid account by full address
Severity: high · Type: functional · Verdict: confirmed · Scenario: S8
I opened the search bar by pressing '/' and pasted a valid 66-character Sui address (0xfe186a6963d5b4132fcd190d0e256d652557ce2579c1e93f931038d9a0f00bbd). The input field displayed 'No results'. Pressing Enter did not trigger navigation to an account view. The page reported 4 console errors during the scenario. A hand check after the run, done in a real Chrome tab against both a fresh address and Suiscan's own well-used master account address, confirmed the input has no character limit (maxLength: -1 in the DOM) and holds the complete 66-character value, so the earlier report of the address being truncated to 60 characters was a misread of the input box scrolling to show its tail, not a real limit. Both full, un-truncated addresses still returned 'No results.'
Expected: The search bar accepts the full 66-character address and navigates to the account profile / portfolio view.
Actual: The input keeps the full 66-character address, returns 'No results', and pressing Enter does not navigate to the account view.
Steps to reproduce:
- Navigate to https://suiscan.xyz/testnet/home.
- Open the search bar by pressing '/' or clicking 'Search anything on Sui'.
- Enter a valid 66-character Sui address (e.g. 0xfe186a6963d5b4132fcd190d0e256d652557ce2579c1e93f931038d9a0f00bbd) and submit search.
Evidence: screenshots/S8-1.png
Withdrawn findings
The Critic re-examined these claims and found the evidence did not support them. They are kept here rather than deleted.
- Analytics dashboard sub-category links point to invalid URLs with unencoded spaces causing 404 errors (S12, medium): Scenario S12's observations only describe switching timeframes (30D, 7D, 24H) and verifying metric updates, with no mention of clicking sub-category links or encountering a 404 error to support this finding. The page reported 2 console errors during the scenario.
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Connect test wallet to explorer | high | pass | none |
| S2 Send SUI form requires recipient and amount | high | pass | none |
| S3 Send SUI form rejects invalid recipient address | high | pass | none |
| S4 Send SUI form validates insufficient funds | high | pass | none |
| S5 Send SUI form valid submission advances to confirmation | high | pass | none |
| S6 Send SUI form rejects zero amount | medium | pass | none |
| S7 Send SUI form rejects negative amount | medium | pass | none |
| S8 Global search routes to account profile | medium | fail | F1 |
| S9 Global search routes to transaction details | medium | blocked (The search bar on the page is structured as a non-input container whose modal overlay controls were not directly accessible for text input in the headless driver context within the turn budget.) | none |
| S10 Account profile renders assets and transaction history | medium | pass | none |
| S11 Transaction detail view renders breakdown | medium | pass | none |
| S12 Analytics timeframe filter updates metrics | low | pass | none |
The audit
The Critic reviewed 2 findings and ran 3 live replays in the browser, each on a fresh page.
- A contradiction between scenarios S8 and S9 regarding the driver's ability to interact with the search input requires reverification for F1.
- Finding F2 was withdrawn entirely because the scenario record lacked any evidence for the reported actions and outcome.
- A possible defect in S1 was called an environment limitation, and nothing that scenario recorded names an environment cause, so it was audited as a candidate.
- A possible defect in S1 ("Background API request returns 404 error across multiple pages") was not promoted: the live replay came back not-reproduced.
- A possible defect in S1 ("Unhandled wallet disconnect error in console during initial connection") was not promoted: the live replay came back not-reproduced.
What to fix first
- Fix the global search index or parser so a full, valid Sui account address resolves and routes to the account view (F1).
Coverage and caveats
In scope: Wallet connection flow; Send SUI form validation and progression; Global search functionality for accounts and transactions; Account profile and transaction detail inspection.
Not covered: Actual transaction broadcasting to the blockchain; Network switching to Mainnet or Devnet.
- The test wallet is pre-injected and automatically approves connection requests.
- The connected test account has a non-zero test SUI balance to test the Send flow.
- We cannot fully sign and execute the transaction since testing stops at the UI confirmation boundary.
- S9 could not be executed: The search bar on the page is structured as a non-input container whose modal overlay controls were not directly accessible for text input in the headless driver context within the turn budget..
By the numbers
| Metric | Value |
|---|
| Scenarios | 10 passed, 1 failed, 1 blocked of 12 (45 planned steps) |
| Browser actions | 286 (64 clicks, 39 inputs, 38 navigations, 145 snapshots) |
| Screenshots | 42 (4 explore, 35 scenario, 3 critic), 35 captioned |
| Coverage | 17 pages, 1 forms, 4 flows, 7 console errors |
| Audit | 2 findings, 3 re-verified live, 1 confirmed, 0 promoted, 1 withdrawn |
| Model calls | 231 |
| Tokens | 4,815,995 input, 13,458 output, 31,348 thinking |
| Time | 18 min |
| Wallet | 0 transactions, 0 signatures, 0 refusals on chain sui:testnet |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 34 | 816,143 | 2,966 | 1,624 | 172 |
| plan | 1 | 5,340 | 2,012 | 4,201 | 49 |
| test | 177 | 3,620,856 | 6,875 | 15,613 | 710 |
| critique | 18 | 371,866 | 1,341 | 9,558 | 157 |
| report | 1 | 1,790 | 264 | 352 | 5 |
