TrustGate

Every scenario DeepQA drove in the browser, in plan order, with the 30 screenshots it captured along the way. A passing scenario is evidence too.

1. S1

   Verify navigation fails gracefully for broken dropdown links

   3 steps, 3 screenshots

   high✓ pass

   

   

   

   • Navigating to /widget returns a 404 Not Found error page with heading '404' and 'This page could not be found.' gracefully without crashing.
   • Navigated to /widget and verified that the application displays a 404 Not Found page ('404: This page could not be found.') rather than hanging, crashing, or rendering a blank page.
2. S2

   Validate empty address on Oracle Wallet Query

   3 steps, 2 screenshots

   high✓ pass

   

   

   • Navigated to Oracle page at /oracle where the playground input is empty and the Query Trust Score button is disabled.
   • The 'Query Trust Score' button is disabled when the address field is empty, rejecting/preventing empty form submission without querying the contract.
   • Navigated to the Oracle page at /oracle.
   • Confirmed that the wallet address input field is initially empty and the 'Query Trust Score (0.001 USDC)' button is disabled.
   • Attempted submission with empty/whitespace input; the submission button remains disabled and prevents querying the contract without an address.
3. S3

   Attempt Oracle Query with valid address expecting chain mismatch

   3 steps, 3 screenshots

   high✓ pass

   

   

   

   • Navigated to the Oracle page at /oracle.
   • Oracle query triggered chain mismatch error displaying 'The current chain of the wallet (id: 5042002) does not match the target chain for the transaction (id: 5042 – undefined)'.
   • Navigated to /oracle and entered valid Arc wallet address 0x872fe9703ffe018991d4c6a41ffba740e5c9c791.
   • Clicked 'Query Trust Score (0.001 USDC)' button which initiated quote request.
   • UI surfaced explicit chain mismatch error: 'The current chain of the wallet (id: 5042002) does not match the target chain for the transaction (id: 5042 – undefined). Current Chain ID: 5042002 Expected Chain ID: 5042 – undefined Request Argument'.
4. S4

   Audit a preset token via Token Shield

   3 steps, 2 screenshots

   high✕ fail

   

   

   • Navigated to Token [redacted] at /token-shield.
   • Entered USDC token [redacted] 0x3600000000000000000000000000000000000000 into Token [redacted] input.
   • Navigated to Token [redacted] at /token-shield and loaded the preset USDC contract address 0x3600000000000000000000000000000000000000.
   • Clicked 'Check Token (0.001 USDC)' button to audit the preset token.
   • Instead of rendering the token [redacted] score, deployer credibility, and behavioral flags directly for preset tokens, the Token [redacted] prompted 'Requesting payment quote...' requiring onchain payment.
5. S5

   Validate invalid contract address on Token Shield

   3 steps, 2 screenshots

   high✓ pass

   

   

   • Navigated to the Token [redacted] page at /token-shield.
   • Entered an invalid string 'invalid-token-address' into the 'Token [redacted] address 0x...' input field.
   • Observed that the form validates the input format and disables the 'Check Token (0.001 USDC)' button for invalid or non-hex/invalid-length addresses, preventing invalid contract address submissions from hanging or crashing the application.
   • Entered a valid formatted 40-character hex address ('0x0000000000000000000000000000000000000000'), which correctly enabled the submit button.
6. S6

   Validate empty amount on Dashboard Deposit

   4 steps, 2 screenshots

   medium✓ pass

   

   

   • Navigated to /dashboard and viewed the Depositor tab with Deposit USDC form.
   • When the Amount USDC input is empty or 0, the Deposit button is disabled and prevents submission, triggering no transaction.
   • The Deposit USDC form requires an amount; when left empty or 0, the Deposit button remains disabled and cannot be submitted, preventing empty or 0 USDC deposit transactions.
7. S7

   Attempt Dashboard Deposit expecting chain mismatch

   4 steps, 3 screenshots

   medium✓ pass

   

   

   

   • Navigated to /dashboard where the connected wallet 0x28C2••••39AF is displayed with Depositor, Agents, and Claims tabs.
   • Entered 10 in the Deposit USDC amount field, enabling the Deposit button.
   • Navigated to the Dashboard page at /dashboard.
   • The Depositor tab was active by default showing Wallet USDC and Deposited in TrustGate balances.
   • Entered a valid numeric amount (10) into the Deposit USDC input field.
   • Clicked the Deposit button; the button entered the 'Approving...' state during the transaction attempt.
   • The transaction was rejected/handled promptly without stalling indefinitely, resetting the button state back to 'Deposit'.
8. S8

   Validate invalid Agent Address on Set Allowance

   4 steps, 3 screenshots

   medium✕ fail

   

   

   

   • Navigated to the Dashboard view with Depositor tab active.
   • Entered invalid agent address 'not-an-address' and valid allowance '10', enabling the Set Allowance button without validation error.
   • Navigated to the Dashboard page at /dashboard where Depositor view is displayed by default.
   • Entered invalid agent address 'not-an-address' into the Agent Address input field.
   • Entered numeric value '10' into the Allowance (USDC) input field.
   • The Set Allowance button was enabled despite the invalid/malformed agent address string.
   • Submitting the Set Agent Allowance form with an invalid address did not trigger client-side address format validation or flag the address as invalid.
9. S9

   Validate empty amount on Dashboard Withdraw

   4 steps, 2 screenshots

   medium✓ pass

   

   

   • Navigated to Dashboard page at /dashboard showing Depositor tab with Deposit, Withdraw, and Set Agent Allowance forms.
   • Verified that the Withdraw button is disabled when the Amount USDC field is empty or cleared, preventing withdrawal transactions with an empty amount.
   • Navigated to Dashboard (/dashboard) and inspected the Withdraw USDC section.
   • When the Amount USDC input is empty, the Withdraw submit button remains disabled and pressing Enter does not trigger any transaction.
   • Entering an amount enables the button, and clearing it immediately disables the button again, preventing empty withdrawal submissions.
10. S10

    Run Trust Gating check and issue attestation

    4 steps, 2 screenshots

    medium⊘ blocked

    

    

    • Navigated through the application; checked dashboard and available routes.
    • Explored dashboard tabs and verified routes; direct navigation across origins/routes is blocked by browser origin restrictions and gating route is not present in navigation.
    • Navigated to home, oracle, and dashboard pages successfully.
    • Attempted to navigate to /gating via navigate API but was blocked by origin restriction.
    • Looked for Trust Gating check / attestation links in the UI header, footer, and dashboard, but no direct /gating navigation link was accessible.
11. S11

    Validate missing rule selection on Gating check

    4 steps, 3 screenshots

    medium✓ pass

    

    

    

    • Navigated to /gating and observed the Protocol Gating pilot check form.
    • Navigated to /gating to access the Protocol Gating check form.
    • Entered a valid wallet address 0x872fE970364dD23cE6466A8A484b397Ac311C791 into the 0x wallet address field.
    • Left the ladder rule buttons (Example lending ladder, Example governance ladder) unselected.
    • Clicked 'Run gating check + issue attestation'.
    • The application handled the request gracefully without crashing or throwing unhandled exceptions, displaying guidance 'Example ladder presets are demo-only. On mainnet supply your own ladder.bands.'.
12. S12

    Control autonomous nanopayment simulation

    4 steps, 3 screenshots

    low✓ pass

    

    

    

    • Navigated to /demo page showing initial Nanopayment Stream simulation in IDLE state with 0 transactions.
    • Started simulation: stream status changed to LIVE, dynamic payment transactions stream in, cumulative volume and margin metrics update continuously.
    • Clicked Pause button; simulation halted cleanly with metrics frozen at 93 transactions, $232.43 saved, and 2,952 USDC volume.
    • Navigated to the /demo page where the Nanopayment Stream simulation was initially IDLE.
    • Clicked Start: Stream status transitioned to LIVE, live agent transactions streamed into the feed, throughput reported 4.5 tps avg, and cumulative metrics (total transactions, volume, savings, margin) updated dynamically.
    • Clicked Pause: Stream status transitioned to IDLE, button changed back to Start, and transaction count / volume metrics halted immediately without further increments.

Findings that survived the Critic's audit. Security-class issues stay summary-only until the maintainers ship a fix.

highconfirmed ✓functionalF1 · S4

Token Shield requires 0.001 USDC payment quote and does not return risk metrics for preset tokens

Navigated to `/token-shield?address=0x3600000000000000000000000000000000000000` and clicked the 'Check Token (0.001 USDC)' button. The button changed to a disabled state reading 'Requesting payment quote...' and no analysis results were displayed, confirming the reported behavior. The page reported 5 console errors during the scenario.

Expected

The token risk score, deployer credibility, and behavioral flags should be rendered on the page for preset tokens.

Actual

The button transitions to 'Requesting payment quote...' and halts waiting for payment flow without displaying the token analysis results.

Repro · 2 steps

1. Navigate to /token-shield with preset token address (e.g. /token-shield?address=0x3600000000000000000000000000000000000000).
2. Click the 'Check Token (0.001 USDC)' button.

S4-5.pngS4-11.png

mediumconfirmed ✓functionalF2 · S8

Set Agent Allowance form lacks client-side validation for malformed agent addresses

The observations clearly establish that the Set Allowance button remains enabled and fails to trigger any client-side format validation when a malformed address string is entered. The page reported 2 console errors during the scenario.

Expected

The form should validate that the Agent Address is a valid Ethereum/Arc address (0x prefixed 40-character hex string), disable the submit button or display an inline validation error, and prevent submission.

Actual

The Set Allowance button is enabled with malformed address input, and no validation error or address format check is displayed to prevent submission.

Repro · 4 steps

1. Navigate to /dashboard
2. Under 'Set Agent Allowance', enter an invalid address string (e.g., 'not-an-address' or '0x1234') into the 'Agent Address' field
3. Enter a valid numeric allowance (e.g., '10') into the 'Allowance (USDC)' field
4. Click the 'Set Allowance' button

S8-4.pngS8-9.pngS8-11.png

lowpromoted ↑functionalF3 · S11

Form submitted without rule selection results in 400 Bad Request

Surfaced by the audit of S11, which the Tester passed, and reproduced live: When clicking 'Run gating check + issue attestation' without a ladder selected on /gating, the button changes to a disabled 'Working…' state, indicating a network request is being sent. The request then fails and an error message regarding missing ladder bands is displayed, confirming that client-side validation is missing and the invalid request is indeed submitted to the backend. The page reported 3 console errors during the scenario.

Expected

The application should perform client-side validation to ensure a rule is selected and prevent network submission if missing.

Actual

The client attempts to submit the invalid request to the backend, resulting in a 400 Bad Request error.

Repro · 4 steps

1. Navigate to /gating.
2. Enter a valid wallet address.
3. Leave the ladder rule buttons unselected.
4. Click 'Run gating check + issue attestation'.

critic-M2-1.png