No confirmed application defects were identified during testing, with all reported findings withdrawn due to test environment limitations.
A deep-feature test run was performed across 12 scenarios covering the Bluefin testnet swap interface, perpetual order controls, lend triggers, portfolio history, and liquidity pools. Out of 12 scenarios, 7 passed, 3 failed, and 2 were blocked.
Three initial findings regarding wallet connectivity, swap asset selector interactions, and liquidity pool data retrieval were raised. The audit subsequently withdrew all three findings as environment limitations stemming from backend CORS blocks in the test sandbox rather than defects in the application itself.
Because wallet connection could not be completed and network requests were blocked by test environment CORS policies, authenticated features such as perpetual order submissions and portfolio CSV exports could not be exercised.
| Metric | Count |
|---|---|
| Scenarios executed | 12 |
| Passed | 7 |
| Failed | 3 |
| Blocked | 2 |
| Findings raised | 3 |
| Issues after the audit | 0 |
| Withdrawn by the audit | 3 |
| Critical / high / medium / low | 0 / 0 / 0 / 0 |
Target: https://testnet.bluefin.io/ · Testing level: deep_feature · Stack: unknown
No issues survived the audit.
These failures came from the test environment, not from the application: a credential the sandbox does not hold, a demo nobody may write to, a resource it cannot reach. They are not counted as issues. They record what this run could not exercise.
- Injected test wallet fails to connect on Bluefin testnet swap page (S2, high): The failure to connect the test wallet occurs alongside pervasive CORS errors that blocked the backend API requests necessary for application initialization, making this an environment limitation. The audit recorded the test environment as the cause, so this is a limit of the run rather than a defect of the application. The page reported 14 console errors during the scenario.
- Swap asset selector buttons fail to open token selection menus (S7, high): The token [redacted] menus fail to open because the application could not load the token [redacted] due to CORS blocks on the backend APIs. The audit recorded the test environment as the cause, so this is a limit of the run rather than a defect of the application. The page reported 14 console errors during the scenario.
- Liquidity pools table fails to load pool data with Network Error on testnet (S9, high): The 'Network Error' toast and empty liquidity pool table are directly caused by CORS policy blocks on the pools API endpoint. The audit recorded the test environment as the cause, so this is a limit of the run rather than a defect of the application. The page reported 17 console errors during the scenario.
- S1 could not exercise this: Application broken by backend CORS blocks. Major backend requests fail with CORS policy errors, preventing the application from retrieving necessary configuration and rendering interactive data. The audit recorded the test environment as the cause, so it is not counted a…
| Scenario | Priority | Result | Issues |
|---|---|---|---|
| S1 API Configuration and CORS Integrity | high | pass | none |
| S2 Connect Test Wallet | high | fail | none |
| S3 Swap Form - Missing Amount Validation | high | pass | none |
| S4 Perpetuals Form - Missing Size Validation | high | blocked (Perpetuals order form inputs and submission controls require connecting an account, but wallet connection could not be established.) | none |
| S5 Perpetuals - Order Controls State Toggle | medium | pass | none |
| S6 Swap - Advanced Pro Chart Modal | medium | pass | none |
| S7 Swap - Asset Selectors | medium | fail | none |
| S8 Lend - Supply Action Trigger | medium | pass | none |
| S9 Liquidity Pools - Search Filtering | medium | fail | none |
| S10 Portfolio - History Navigation | medium | pass | none |
| S11 Portfolio History - CSV Export | low | blocked (Export CSV button is disabled without an active connected wallet session on the hosted exchange.) | none |
| S12 Liquidity Pools - Vaults Discovery | low | pass | none |
The Critic reviewed 3 findings and ran 0 live replays in the browser, each on a fresh page.
- The Tester explicitly claimed in S1 that no CORS errors were encountered, directly contradicting the console logs that are filled with CORS blocks across every scenario.
In scope: Token Swap interface and validation; Perpetuals trading order form and controls; Lending market asset actions; Liquidity pools filtering and search; Portfolio navigation and history export; Wallet connection flow; Cross-origin resource sharing (CORS) integrity.
Not covered: Third-party social sign-in and OAuth providers (avoided per AppMap notes); Actual transaction execution requiring network gas beyond test SUI allocation; Cross-chain network switches (test wallet only supports sui:testnet).
- The injected test wallet automatically approves connection requests without requiring manual popup interaction.
- The heavy CORS errors observed in the AppMap (testnet pointing to prod APIs) might degrade rendering of dynamic data, but UI controls should still be verifiable.
- Form submission can be triggered via standard enter key or primary action buttons associated with the form.
- S4 could not be executed: Perpetuals order form inputs and submission controls require connecting an account, but wallet connection could not be established..
- S11 could not be executed: Export CSV button is disabled without an active connected wallet session on the hosted exchange..
| Metric | Value |
|---|---|
| Scenarios | 7 passed, 3 failed, 2 blocked of 12 (29 planned steps) |
| Browser actions | 226 (57 clicks, 5 inputs, 32 navigations, 132 snapshots) |
| Screenshots | 31 (4 explore, 27 scenario, 0 critic), 27 captioned |
| Coverage | 8 pages, 3 forms, 5 flows, 28 console errors |
| Audit | 3 findings, 0 re-verified live, 0 confirmed, 0 promoted, 3 withdrawn |
| Model calls | 190 |
| Tokens | 1,142,241 input, 10,331 output, 17,972 thinking |
| Time | 10 min |
| Wallet | 0 transactions, 0 signatures, 0 refusals on chain sui:testnet |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|---|---|---|---|---|
| explore | 26 | 155,863 | 2,819 | 1,461 | 84 |
| plan | 1 | 7,181 | 1,948 | 2,973 | 35 |
| test | 161 | 957,327 | 4,846 | 10,039 | 429 |
| critique | 1 | 20,036 | 526 | 3,499 | 29 |
| report | 1 | 1,834 | 192 | 0 | 3 |