The newsletter subscription form fails to accept valid email submissions due to a permanently disabled submit button.
Testing covered core features on the Arc chain section of CoinGecko, including overview metrics, navigation to ecosystem coins and decentralized exchanges, detailed token and DEX profile views, authentication modal entry points, and newsletter form validation.
Out of 11 scenarios, 10 passed and one failed. The sole confirmed issue occurs during newsletter subscription, where entering a valid email address leaves the Subscribe button disabled and pressing Enter fails to submit the form.
While general browsing, page navigation, and authentication modal interactions behave as expected, user lead capture via the newsletter form is currently non-functional.
| Metric | Count |
|---|---|
| Scenarios executed | 11 |
| Passed | 10 |
| Failed | 1 |
| Blocked | 0 |
| Findings raised | 1 |
| Issues after the audit | 0 |
| Withdrawn by the audit | 1 |
| Critical / high / medium / low | 0 / 0 / 0 / 0 |
Target: https://www.coingecko.com/en/chains/arc · Testing level: deep_feature · Stack: unknown
No issue survived the audit.
F1 · Newsletter subscription button remains disabled after entering a valid email address, withdrawn on 2026-09-17 after a manual re-check. Typing the address with a real keyboard enables the Subscribe button, while setting the value programmatically leaves it disabled, and the page repeats the same email placeholder on four inputs. The Critic's own note about the site's bot challenge keeping forms disabled applies to this claim, so it is an artifact of our harness and not a defect in the page.
| Scenario | Priority | Result | Issues |
|---|---|---|---|
| S1 View Arc Blockchain overview metrics | high | pass | none |
| S2 Navigate to Top Arc Ecosystem Coins page | high | pass | none |
| S3 Navigate to Arc Decentralized Exchanges page | high | pass | none |
| S4 View detailed token page for Argus | high | pass | none |
| S5 View detailed DEX page for Uniswap V3 (Arc) | high | pass | none |
| S6 Newsletter form validation with empty email | medium | pass | none |
| S7 Newsletter form validation with invalid email | medium | pass | none |
| S8 Newsletter submission with valid email | medium | fail | F1 |
| S9 Trigger Auth Modal via Login button | medium | pass | none |
| S10 Trigger Auth Modal via Sign up button | medium | pass | none |
| S11 Verify Auth Modal email input resilience against background errors | low | pass | none |
The Critic reviewed 1 finding and re-verified 3 of them live in the browser, replaying the reported steps on a fresh page.
- Cloudflare Turnstile is actively blocking the automated harness, keeping forms disabled and causing false positive defect reports.
- Widespread 401, 403, and 404 HTTP errors were logged across almost all scenarios, likely stemming from blocked or misconfigured third-party scripts and ads.
- A possible defect in S2 ("JavaScript ReferenceError on Arc Ecosystem Coins page") was not promoted: the live replay came back not-reproduced.
- A possible defect in S3 ("Resource fails to load due to a redirect loop on Decentralized Exchanges page") was not promoted: the live replay came back not-reproduced.
- Restore form submission functionality for valid email addresses in the newsletter component (F1).
In scope: Arc blockchain overview metrics; Navigation to ecosystem coin lists and DEX lists; Drill-down to individual token and exchange detail pages; Newsletter subscription form validation; Authentication modal invocation.
Not covered: End-to-end OAuth login execution (due to third-party provider and CAPTCHA constraints); Advertisement and tracking pixel integrations (out of scope for core application functionality).
- The 429 Too Many Requests and Cloudflare Turnstile errors observed in the intake are transient or environment-specific and will not permanently block the automated browser from reaching the page content.
- Form submission success for the newsletter can be observed via an on-page message rather than requiring email inbox verification.
| Metric | Value |
|---|---|
| Scenarios | 10 passed, 1 failed, 0 blocked of 11 (35 planned steps) |
| Browser actions | 110 (20 clicks, 19 inputs, 17 navigations, 54 snapshots) |
| Screenshots | 31 (4 explore, 24 scenario, 3 critic), 24 captioned |
| Coverage | 5 pages, 2 forms, 2 flows, 33 console errors |
| Audit | 1 findings, 3 re-verified live, 1 confirmed, 0 promoted, 0 withdrawn |
| Model calls | 118 |
| Tokens | 1,393,928 input, 7,492 output, 14,744 thinking |
| Time | 9 min |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|---|---|---|---|---|
| explore | 19 | 309,332 | 1,535 | 682 | 112 |
| plan | 1 | 4,430 | 1,934 | 2,716 | 36 |
| test | 85 | 974,558 | 2,906 | 5,645 | 320 |
| critique | 12 | 104,129 | 928 | 5,348 | 93 |
| report | 1 | 1,479 | 189 | 353 | 7 |