QA report: external/www.arcanamarkets.xyz at hosted
The portfolio view hangs indefinitely when reading on-chain positions and maximum-balance trades fail due to unreserved gas fees.
Testing covered 12 scenarios evaluating wallet connection, market discovery and filtering, trade execution, portfolio tracking, and authentication flows. Out of 12 scenarios, 9 passed, 2 failed with confirmed defects, and 1 was blocked.
The primary failure occurs in the portfolio view, where the application remains stuck indefinitely attempting to read positions on-chain rather than displaying user holdings. Additionally, attempting to trade a full native USDC balance triggers an unhandled RPC error because the application does not reserve native funds required to cover gas fees.
Form validation for empty amounts was blocked from complete execution when markets intermittently failed to return from the contract. Addressing the portfolio data retrieval and gas calculation defects is necessary before users can reliably monitor their positions or execute full-balance trades.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 9 |
| Failed | 2 |
| Blocked | 1 |
| Findings raised | 2 |
| Issues after the audit | 2 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 1 / 1 / 0 |
Target: https://www.arcanamarkets.xyz · Testing level: deep_feature · Stack: unknown
Issues
High severity
F2 · Portfolio view remains indefinitely stuck in 'Reading your positions on-chain…' state
Severity: high · Type: functional · Verdict: confirmed · Scenario: S4
After logging into a wallet and clicking 'Portfolio' on the navigation bar, the page displays 'Reading your positions on-chain...' indefinitely. I took multiple snapshots and the view did not load any positions, confirming the reported behavior. The page reported 4 console errors during the scenario.
Expected: Portfolio loads the user's active/open positions with market details, outcome, payout, and status.
Actual: The view displays 'Reading your positions on-chain…' indefinitely and does not render open positions.
Steps to reproduce:
- Visit https://www.arcanamarkets.xyz/
- With a wallet connected, click 'Portfolio' in the top navigation bar
- Wait for portfolio positions to load
Evidence: screenshots/S4-1.png
Medium severity
F1 · Trading full native USDC balance fails with RPC error due to lack of gas reservation
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S3
The observations clearly state that attempting a trade with the full wallet balance results in an 'RPC Request failed' error because no native tokens were reserved for gas. The page reported 4 console errors during the scenario.
Expected: The order should automatically reserve sufficient native USDC for gas or warn/prevent placing an order for the full balance.
Actual: The app attempts to spend the exact balance, causing an on-chain RPC error ('RPC Request failed.') due to lack of gas funds.
Steps to reproduce:
- Connect wallet with native USDC balance (e.g. $3.98 USDC) on Arc Testnet.
- Navigate to any open prediction market (e.g. /market/28).
- Click the NO outcome button to open the trade modal.
- Enter the entire available wallet balance ($3.98) into the USDC amount field.
- Click 'PLACE NO ORDER ON ARC'.
Evidence: screenshots/S3-7.png, screenshots/S3-9.png
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Connect injected browser wallet | high | pass | none |
| S2 Execute a standard YES prediction trade | high | pass | none |
| S3 Execute a MAX NO prediction trade to verify gas reservation | high | fail | F1 |
| S4 Verify open positions in Portfolio view | high | fail | F2 |
| S5 Trade form validation with empty amount | medium | blocked (No open or resolved markets are available from the on-chain contract (marketCount is 0), so the market trade modal cannot be opened to test form validation.) | none |
| S6 Trade form validation with zero or negative amount | medium | pass | none |
| S7 Filter markets by category | medium | pass | none |
| S8 Search markets by keyword | medium | pass | none |
| S9 Verify Legacy v1 Contract Viewer | medium | pass | none |
| S10 Graceful handling of CORS errors in Activity view | low | pass | none |
| S11 Toggle View Resolved filter | low | pass | none |
| S12 Initiate email login flow | low | pass | none |
The audit
The Critic reviewed 2 findings and re-verified 3 of them live in the browser, replaying the reported steps on a fresh page.
- The tester passed numerous scenarios (like S1 and S10) while ignoring persistent CORS policy blocks and 429 rate limit errors that visibly degraded application data fetching.
- Market loading behavior was highly inconsistent across scenarios (S7 saw 12 markets, while S5 and S8 saw 0), which is likely a direct consequence of the unaddressed rate limiting and CORS defects.
- A possible defect in S12 ("Email login submission returns a 500 Internal Server Error") was not promoted: the live replay came back inconclusive.
- A possible defect in S1 ("Arcscan API requests are consistently blocked by CORS policy") was not promoted: the live replay came back inconclusive.
What to fix first
- Resolve the on-chain position querying failure that leaves the Portfolio view stuck in a loading state (F2).
- Deduct required transaction gas fees when executing max-balance trades to prevent RPC failures (F1).
Coverage and caveats
In scope: Wallet connection via injected Browser Wallet; Prediction market trade execution (YES/NO); Trade amount validation including MAX gas reservation; Portfolio position tracking; Market search and category filtering; Legacy contract v1 view and claim interface.
Not covered: Cross-chain wallet connection and switching; Full email login verification flow.
- The injected wallet is pre-configured and holds sufficient USDC on Arc testnet for trading.
- The 'MAX' quick amount button correctly calculates trade size minus gas fee.
- Cross-chain switching is expected to fail based on intake facts and is deliberately not tested.
- CORS errors observed for testnet.arcscan.app may degrade Leaderboard or Activity views; tests will verify these pages do not crash the app.
- Email login verification cannot be completed without external mailbox access, so only the initiation step is tested.
- S5 could not be executed: No open or resolved markets are available from the on-chain contract (marketCount is 0), so the market trade modal cannot be opened to test form validation..
By the numbers
| Metric | Value |
|---|
| Scenarios | 9 passed, 2 failed, 1 blocked of 12 (43 planned steps) |
| Browser actions | 237 (70 clicks, 7 inputs, 24 navigations, 136 snapshots) |
| Screenshots | 36 (4 explore, 30 scenario, 2 critic), 30 captioned |
| Coverage | 3 pages, 3 forms, 5 flows, 9 console errors |
| Audit | 2 findings, 3 re-verified live, 2 confirmed, 0 promoted, 0 withdrawn |
| Model calls | 203 |
| Tokens | 1,763,604 input, 10,266 output, 16,630 thinking |
| Time | 14 min |
| Wallet | 7 transactions, 0 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 31 | 332,315 | 2,142 | 1,172 | 76 |
| plan | 1 | 4,971 | 2,148 | 1,872 | 34 |
| test | 145 | 1,259,577 | 4,573 | 8,411 | 641 |
| critique | 25 | 165,078 | 1,141 | 4,599 | 104 |
| report | 1 | 1,663 | 262 | 576 | 7 |
