QA report: external/www.propexarc.xyz at hosted
Core trade executions fail with unhandled on-chain revert errors, alongside missing order balance validation and non-functional deposit controls.
Testing covered 12 deep feature scenarios across market discovery, tab navigation, order configuration and validation, and portfolio management. Market browsing, search filtering, and basic input validations passed without issues.
Critical trade actions failed during execution, where both Buy YES and Buy NO orders triggered unhandled on-chain reverts. The order form also fails to validate available wallet balances before initiating token approval transactions, allowing submissions with exorbitant amounts. Furthermore, the Deposit USDC action on the portfolio page is entirely non-functional, and the copy address control falsely indicates success when clipboard writes are blocked.
Five confirmed issues remain, while one finding regarding ERC-20 gas reservation was withdrawn during audit. Because core trading flows and deposit entry points are broken, these defects prevent standard market operations.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 7 |
| Failed | 5 |
| Blocked | 0 |
| Findings raised | 5 |
| Issues after the audit | 5 |
| Withdrawn by the audit | 1 |
| Critical / high / medium / low | 0 / 2 / 2 / 1 |
Target: https://www.propexarc.xyz/ · Testing level: deep_feature · Stack: unknown
Issues
High severity
F1 · Buy order submission for YES outcome fails with 'Execution reverted for an unknown reason'
Severity: high · Type: functional · Verdict: confirmed · Scenario: S3
I successfully navigated to the market 0x87Cd48c34eC6107310526273f46fFD1D28513B37, selected YES, input 10 for USDC amount, and clicked the buy button. I observed that the transaction fails and the user interface displays the error message 'Execution reverted for an unknown reason.' The page reported 1 console error during the scenario.
Expected: The transaction should execute successfully or show client-side balance validation / meaningful error guidance.
Actual: The transaction reverts during execution with the error message 'Execution reverted for an unknown reason.'
Steps to reproduce:
- Navigate to https://www.propexarc.xyz/market/0x87Cd48c34eC6107310526273f46fFD1D28513B37
- Select the 'YES' outcome button
- Enter '10' into the USDC Amount input field
- Click the 'Buy YES · $10.00' submit button
Evidence: screenshots/S3-6.png, screenshots/S3-8.png, screenshots/S3-10.png
F2 · Buy NO order execution fails with 'Execution reverted for an unknown reason.'
Severity: high · Type: functional · Verdict: confirmed · Scenario: S4
I navigated to the specified market URL, selected the 'NO' option, and attempted to buy $10 worth of shares. The transaction failed, and the UI displayed the error message 'Execution reverted for an unknown reason.' just as reported. The page reported 1 console error during the scenario.
Expected: The transaction should be submitted successfully and confirmed in the UI, or clear balance validation/approval guidance should prevent contract revert.
Actual: The transaction reverted on-chain with the error 'Execution reverted for an unknown reason.' and was not confirmed.
Steps to reproduce:
- Navigate to 'https://www.propexarc.xyz/market/0x87Cd48c34eC6107310526273f46fFD1D28513B37'.
- Click the 'NO' outcome button.
- Enter '10' into the USDC amount input field.
- Click 'Buy NO · $10.00'.
Evidence: screenshots/S4-10.png
Medium severity
F4 · Order form allows submission with amount exceeding available wallet balance
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S8
The evidence shows the application attempts to initiate an on-chain transaction for an amount drastically exceeding the wallet's balance instead of validating it client-side. The page reported 1 console error during the scenario.
Expected: The application should validate the input against the user's available USDC balance (1.85 USDC), display an 'insufficient balance' warning, and disable the submission button.
Actual: The application allowed clicking the submit button ('Buy YES · $999999999.00') without balance validation, and attempted to send an on-chain transaction ('Approving USDC...').
Steps to reproduce:
- Navigate to a market detail page (e.g., /market/0x87Cd48c34eC6107310526273f46fFD1D28513B37).
- Type '999999999' into the 'USDC Amount' input field.
- Observe that the submit button is enabled with 'Buy YES · $999999999.00' and click it.
- Observe that the app proceeds to submit a transaction ('Approving USDC...') instead of showing an insufficient balance warning and disabling submission.
Evidence: screenshots/S8-7.png, screenshots/S8-9.png
F5 · 'Deposit USDC' button on Portfolio page is non-functional
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S11
The observation confirms that repeatedly clicking the 'Deposit USDC' button yields no visual feedback or action. The page reported 2 console errors during the scenario.
Expected: A modal or expanded section should appear displaying deposit options, wallet details, or a testnet faucet trigger.
Actual: Clicking the 'Deposit USDC' button produces no visual feedback, modal, or action.
Steps to reproduce:
- Navigate to https://www.propexarc.xyz/portfolio
- Click on the 'Deposit USDC' button in the portfolio overview header
Evidence: screenshots/S11-3.png, screenshots/S11-6.png, screenshots/S11-11.png
Low severity
F6 · Copy Address button shows false 'Copied!' success message when clipboard write fails
Severity: low · Type: ux · Verdict: promoted · Scenario: S12
Surfaced by the audit of S12, which the Tester passed, and reproduced live: I clicked the wallet button to open the wallet info dialog, then clicked the 'Copy Address' button. Its state changed to 'Copied!' (as seen in button text 'CopiedCopied!') even though a clipboard copy failure would normally be expected in this restricted browser environment, corroborating the bug report that it fails to handle clipboard errors gracefully. The page reported 2 console errors during the scenario.
Expected: The UI should handle clipboard write errors gracefully and not display a success message if the copy operation actually failed.
Actual: The button state changes to 'Copied!' while the console logs a 'Write permission denied' error for the clipboard.
Steps to reproduce:
- Open the wallet info dialog.
- Click the 'Copy Address' button.
Evidence: screenshots/critic-M2-1.png
Withdrawn findings
The Critic re-examined these claims and found the evidence did not support them. They are kept here rather than deleted.
- Order form MAX shortcut populates full balance without native gas reservation (S7, medium): The finding assumes USDC must be reserved for gas, but gas on this network is paid in the native token (Arc), meaning it is correct to populate the absolute full balance of the USDC token. The page reported 3 console errors during the scenario.
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Search markets by keyword | high | pass | none |
| S2 Filter and Sort markets | high | pass | none |
| S3 Execute Buy YES Order | high | fail | F1 |
| S4 Execute Buy NO Order | high | fail | F2 |
| S5 Portfolio Sync Post-Trade | high | pass | none |
| S6 Order Form Validation - Empty Amount | high | pass | none |
| S7 Order Form - MAX Shortcut Gas Reservation | medium | fail | none |
| S8 Order Form Validation - Insufficient Balance | medium | fail | F4 |
| S9 Market Details - Tab Navigation | medium | pass | none |
| S10 Order Form Validation - Invalid Characters | medium | pass | none |
| S11 Portfolio - Deposit USDC Trigger | low | fail | F5 |
| S12 Clipboard Permission Error Investigation | low | pass | F6 |
The audit
The Critic reviewed 5 findings and re-verified 5 of them live in the browser, replaying the reported steps on a fresh page.
- F1 and F2 test trades on a market that S5 explicitly notes is 'Ended', meaning the on-chain revert is the expected behavior and only the generic error message is a defect.
- F3 incorrectly expects an ERC-20 token (USDC) to be reserved for native gas fees.
- S12 passed despite clear console evidence that the clipboard copy failed while the UI falsely reported success.
- A possible defect in S5 ("CoinGecko price API requests fail due to CORS policy block") was not promoted: the live replay came back not-reproduced.
- A possible defect in S1 ("Frequent HTTP 429 (Too Many Requests) errors during normal navigation") was not promoted: the live replay came back inconclusive.
What to fix first
- Resolve on-chain order execution failures and clarify revert messaging for Buy YES orders (F1).
- Resolve on-chain order execution failures and clarify revert messaging for Buy NO orders (F2).
- Add client-side wallet balance validation to block order submissions exceeding available funds (F4).
- Hook up the Deposit USDC button on the Portfolio page to its corresponding action (F5).
- Catch clipboard permission denials and suppress the false success message on the copy address button (F6).
Coverage and caveats
In scope: Prediction Market Search, Filter, and Sort; Market detail tab navigation; Buy YES and Buy NO order placement; Order form validation (empty, invalid, insufficient funds); MAX balance calculation with Arc native gas reservation; Portfolio positions synchronization.
Not covered: Leaderboard detailed metrics validation (Excluded to focus deeply on the core trading and market feature).; Docs smart contract address validation (Out of scope for trading deep feature).; Ended market transaction failure (No ended market explicitly provided in the AppMap)..
- Market 0x87Cd48c34eC6107310526273f46fFD1D28513B37 is active and has not reached its end date.
- The connected test wallet has a non-zero USDC balance on the Arc testnet.
- The 'MAX' button is present within or next to the USDC Amount input as described in the flows.
- The 'Wallet info button' includes a copy-to-clipboard function that triggered the observed clipboard permission error.
By the numbers
| Metric | Value |
|---|
| Scenarios | 7 passed, 5 failed, 0 blocked of 12 (34 planned steps) |
| Browser actions | 229 (52 clicks, 19 inputs, 40 navigations, 118 snapshots) |
| Screenshots | 48 (4 explore, 40 scenario, 4 critic), 40 captioned |
| Coverage | 5 pages, 2 forms, 5 flows, 2 console errors |
| Audit | 5 findings, 5 re-verified live, 4 confirmed, 1 promoted, 1 withdrawn |
| Model calls | 214 |
| Tokens | 1,977,890 input, 13,294 output, 18,931 thinking |
| Time | 13 min |
| Wallet | 3 transactions, 0 signatures, 7 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 27 | 273,709 | 2,350 | 1,502 | 94 |
| plan | 1 | 4,073 | 2,131 | 3,183 | 44 |
| test | 150 | 1,412,745 | 6,453 | 6,514 | 418 |
| critique | 35 | 285,333 | 2,035 | 7,049 | 196 |
| report | 1 | 2,030 | 325 | 683 | 8 |