QA report: external/testnet.flowx.finance at hosted
Token swap route calculation fails on testnet, disabling core trading functionality alongside a broken portfolio navigation link.
Testing covered wallet connection, token swap routing and pair switching, input validations, order strategy forms, and landing page navigation. Core swap execution failed because the route calculation could not discover pools or calculate receive amounts, leaving the swap action disabled. Additionally, the portfolio management card on the landing page directs users to a misspelled route that returns a 404 error.
A significant portion of the test suite was constrained by test wallet funding. Scenarios validating gas reservations, percentage shortcuts, limit order placement, and TWAP order submissions were blocked due to zero token balances on the testnet account. Environment restrictions also prevented third-party RPC and Birdeye WebSocket connections from functioning fully.
The inability to calculate swap routes compromises the platform's primary exchange feature. Resolving the routing failures and repairing broken navigation links are necessary steps before the testnet deployment can support end-to-end trading workflows.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 6 |
| Failed | 2 |
| Blocked | 4 |
| Findings raised | 2 |
| Issues after the audit | 2 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 1 / 1 / 0 |
Target: https://testnet.flowx.finance/ · Testing level: deep_feature · Stack: unknown
Issues
High severity
F1 · Token swap route calculation fails to find pools or enable swap action on testnet
Severity: high · Type: functional · Verdict: confirmed · Scenario: S2
The evidence supports the finding: the application's own routing API (flowx-dev.flowx.finance) blocks requests from the testnet frontend with a NotSameOrigin (CORP) policy error, preventing the swap route from being calculated. The live replay was inconclusive: The replay ran out of tool calls before it reached the reported state. The page reported 7 console errors during the scenario.
Expected: The application calculates the exchange route and enables the 'Swap Now' button or initiates the transaction signature.
Actual: The receive amount remains 0, the 'Swap Now' button remains disabled, and the swap route is not calculated.
Steps to reproduce:
- Navigate to https://testnet.flowx.finance/swap
- Switch or select SUI as the pay token
- Enter a valid amount such as 1 in the pay input
- Observe the receive amount and the 'Swap Now' action button
Evidence: screenshots/S2-2.png
Medium severity
F2 · Landing page Portfolio Management feature card links to non-existent /porfolio route leading to 404 Page Not Found
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S11
The evidence confirms the defect: the 'Portfolio Management' link contains a typo ('/porfolio') which navigates the user to a valid 404 error page. The page reported 6 console errors during the scenario.
Expected: The application should load a functional Portfolio dashboard.
Actual: The application navigates to https://testnet.flowx.finance/porfolio and displays a 'Page not found' error screen ('This URL does not exist or has been deleted!').
Steps to reproduce:
- Navigate to https://testnet.flowx.finance/
- Locate the 'FlowX Features' section on the landing page
- Click the 'Portfolio Management' feature card link pointing to '/porfolio'
Evidence: screenshots/S11-1.png, screenshots/S11-3.png
Environment limitations
These failures came from the test environment, not from the application: a credential the sandbox does not hold, a demo nobody may write to, a resource it cannot reach. They are not counted as issues. They record what this run could not exercise.
- S1 could not exercise this: Third-party Sui testnet fullnode RPC request blocked by CORS. The third-party Sui testnet RPC drops the request due to missing CORS headers. The audit recorded the test environment as the cause, so it is not counted as an issue.
- S9 could not exercise this: Third-party Birdeye WebSocket connection fails with 403 Forbidden. The third-party WebSocket connection is rejected with a 403 Forbidden status. The audit recorded the test environment as the cause, so it is not counted as an issue.
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Connect Wallet to DEX | high | pass | none |
| S2 Execute Standard Token Swap | high | fail | F1 |
| S3 SUI Max Shortcut Gas Reservation | high | blocked (Connected wallet SUI balance is 0 or not recognized by the dApp on testnet, preventing verification of the MAX shortcut gas reservation.) | none |
| S4 Place Limit Order | high | blocked (The test wallet balance on Sui testnet is 0 for the selected token [redacted], disabling the Place Limit Order submission button due to insufficient balance.) | none |
| S5 Create TWAP Strategy Order | high | blocked (The test wallet balance shows 0 SUI on testnet TWAP interface, disabling the submit button and preventing order creation.) | none |
| S6 Calculate Swap Percentage Shortcuts | medium | blocked (The connected testnet wallet has a 0 token [redacted] for all assets on FlowX testnet, preventing verification of the 50% shortcut calculation against a non-zero balance.) | none |
| S7 Validate Zero Amount Swap | medium | pass | none |
| S8 Switch Token Trading Pair | medium | pass | none |
| S9 Validate Missing Limit Order Rate | medium | pass | none |
| S10 Validate Missing TWAP Parts | medium | pass | none |
| S11 Landing Page Portfolio Link Integrity | low | fail | F2 |
| S12 Swap Page Network Resilience | low | pass | none |
The audit
The Critic reviewed 2 findings and ran 2 live replays in the browser, each on a fresh page.
- Scenario S12 claimed to verify responsive UI updates and route adjustments and passed, but its console logs contain the exact same routing API failure (NotSameOrigin) that correctly caused scenario S2 to fail.
- A possible defect in S1 ("Backend GraphQL API returns 500 Internal Server Error on load") was not promoted: the live replay came back not-reproduced.
What to fix first
- Resolve the routing API failure to calculate token swap routes and enable the swap action (F1).
- Update the landing page portfolio card link from the misspelled /porfolio URL to the correct route to eliminate the 404 error (F2).
Coverage and caveats
In scope: DEX Swap execution and configuration; Limit Order creation flow and validation; TWAP Order strategy creation and validation; Wallet connection state on the Trading interfaces; Percentage shortcuts and gas reservation mechanics.
Not covered: Liquidity provisioning (Positions): Out of scope to focus depth purely on the core Trading interface.; Farming as a Service (FaaS): Secondary feature area omitted to maximize trading coverage.; Staking: Non-trading yield feature, intentionally omitted.; Referral program: Excluded to prioritize execution logic.; Launchpax and Events: Non-trading feature areas omitted..
- The pre-injected test wallet auto-connects when the application prompts for a connection.
- The wallet holds sufficient testnet SUI to perform swaps and pay gas fees.
- Features outside of Swap, Limit, and TWAP are deliberately skipped to satisfy the deep_feature requirement within the scenario cap.
- S3 could not be executed: Connected wallet SUI balance is 0 or not recognized by the dApp on testnet, preventing verification of the MAX shortcut gas reservation..
- S4 could not be executed: The test wallet balance on Sui testnet is 0 for the selected token [redacted], disabling the Place Limit Order submission button due to insufficient balance..
- S5 could not be executed: The test wallet balance shows 0 SUI on testnet TWAP interface, disabling the submit button and preventing order creation..
- S6 could not be executed: The connected testnet wallet has a 0 token [redacted] for all assets on FlowX testnet, preventing verification of the 50% shortcut calculation against a non-zero balance..
By the numbers
| Metric | Value |
|---|
| Scenarios | 6 passed, 2 failed, 4 blocked of 12 (39 planned steps) |
| Browser actions | 298 (60 clicks, 26 inputs, 55 navigations, 157 snapshots) |
| Screenshots | 27 (4 explore, 21 scenario, 2 critic), 21 captioned |
| Coverage | 18 pages, 5 forms, 5 flows, 9 console errors |
| Audit | 2 findings, 2 re-verified live, 2 confirmed, 0 promoted, 0 withdrawn |
| Model calls | 215 |
| Tokens | 1,709,702 input, 11,356 output, 25,053 thinking |
| Time | 13 min |
| Wallet | 0 transactions, 0 signatures, 0 refusals on chain sui:testnet |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 40 | 328,485 | 3,317 | 1,350 | 156 |
| plan | 1 | 5,752 | 2,081 | 6,016 | 56 |
| test | 161 | 1,305,152 | 4,626 | 10,215 | 429 |
| critique | 12 | 68,391 | 1,041 | 6,953 | 89 |
| report | 1 | 1,922 | 291 | 519 | 40 |
