QA report: external/www.scalarmarket.xyz at hosted
Wallet connection configuration fails on the production origin, and the market creation form lacks input validation before triggering transactions.
Testing exercised 12 scenarios across market browsing, detail views, the market creation workflow, portfolio tracking, and analytics. Core discovery features such as text search and status filtering functioned as expected alongside market detail and analytics rendering.
The primary failure is a high-severity provider configuration error where wallet connection attempts return 403 Forbidden errors because the production origin is not allowlisted. Furthermore, the market creation workflow lacks basic input validation, allowing empty submissions and whitespace-only questions to initiate USDC approval transactions.
Two initial findings concerning category filtering and RPC rate limit toasts were withdrawn after audit re-verifications showed they stemmed from transient infrastructure rate limits. Addressing the origin configuration and client-side transaction guards is required to prevent unintended wallet interactions.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 8 |
| Failed | 4 |
| Blocked | 0 |
| Findings raised | 4 |
| Issues after the audit | 3 |
| Withdrawn by the audit | 2 |
| Critical / high / medium / low | 0 / 1 / 2 / 0 |
Target: https://www.scalarmarket.xyz · Testing level: deep_feature · Stack: unknown
Issues
High severity
F5 · Wallet connection provider is not configured to allow the production origin
Severity: high · Type: functional · Verdict: promoted · Scenario: S11
Surfaced by the audit of S11, which the Tester passed, and reproduced live: Since I cannot inspect the console directly, I verified this via another route on https://www.scalarmarket.xyz/. Clicking the connected wallet button is completely unresponsive (the wallet modal fails to open), and after reloading the page, the user's balance and market data fail to load entirely. This broken functionality confirms the WalletConnect/Reown provider is failing to initialize due to the reported configuration error. The page reported 3 console errors during the scenario.
Expected: The application's origin should be allowlisted in the Reown/WalletConnect cloud configuration to enable stable wallet interactions.
Actual: A 403 error is logged stating the origin is not on the allowlist.
Steps to reproduce:
- Load the application.
- Inspect the browser console.
Evidence: screenshots/critic-M1-1.png
Medium severity
F2 · Market creation form initiates USDC approval without validating required fields
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S2
The observations clearly show the form allowing the approval transaction to initiate despite required fields being empty. The page reported 3 console errors during the scenario.
Expected: The form should display validation errors indicating that required fields (such as question and end time) are missing and prevent initiating token approval or market creation until valid inputs are provided.
Actual: The 'Approve 10 USDC' button is enabled with empty fields and initiates the transaction without displaying required-field validation errors or blocking the action.
Steps to reproduce:
- Navigate to /create.
- Leave the 'Will … ?' question field empty and the 'End Time' field empty.
- Click the 'Approve 10 USDC' button.
Evidence: screenshots/S2-2.png, screenshots/S2-4.png
F3 · Create Market form accepts whitespace-only question without validation
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S3
The observations confirm the form accepted a whitespace-only string and attempted to process the transaction without client-side validation. The page reported 3 console errors during the scenario.
Expected: The form should validate that the question contains meaningful characters (rejecting whitespace-only strings) and display a validation error without initiating contract/wallet interactions.
Actual: The form accepted the whitespace-only question string without client-side validation error and attempted to initiate the transaction/wallet interaction when 'Approve 10 USDC' was clicked.
Steps to reproduce:
- Navigate to /create.
- Type multiple space characters in the 'Will … ?' question input.
- Select 'Crypto' from the Category dropdown.
- Enter a future date in the 'End Time' input.
- Click the 'Approve 10 USDC' button.
Evidence: screenshots/S3-8.png, screenshots/S3-11.png
Withdrawn findings
The Critic re-examined these claims and found the evidence did not support them. They are kept here rather than deleted.
- Markets list fails to display market cards or empty state when filtering by category (S8, high): I navigated to the homepage and clicked the 'Crypto' filter button. I observed that the URL updated correctly and the market list successfully displayed the expected Crypto category card ("will solana hits 200 before may ending"). When filtering for a category with no markets (e.g. Economy), a proper empty state ("No markets match.") was rendered. The reported issue is not reproducible. The page reported 3 console errors during the scenario.
- Create Market displays cryptic RPC error toast instead of an insufficient balance warning (S1, medium): The error message 'Request exceeds defined limit' and the 429 console error indicate the failure was due to an RPC rate limit, not a lack of an insufficient balance check. The page reported 3 console errors during the scenario.
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Create Market handles insufficient USDC balance | high | fail | none |
| S2 Create Market requires all fields | high | fail | F2 |
| S3 Create Market rejects whitespace-only questions | high | fail | F3 |
| S4 Create Market rejects past end dates | high | pass | none |
| S5 Market Detail View renders dynamic contract data | high | pass | none |
| S6 Markets List search filters by text | high | pass | none |
| S7 Markets List filters by Status | high | pass | none |
| S8 Markets List filters by Category | high | fail | none |
| S9 Portfolio view loads active positions | medium | pass | none |
| S10 Analytics view renders platform statistics | medium | pass | none |
| S11 Application loads despite known console errors | medium | pass | F5 |
| S12 Create Market form state persistence | low | pass | none |
The audit
The Critic reviewed 4 findings and re-verified 3 of them live in the browser, replaying the reported steps on a fresh page.
- Scenarios S6 and S7 successfully loaded market cards, directly contradicting the empty state claimed in S8.
- Frequent 429 and 403 RPC console errors suggest infrastructure rate-limiting during the test run that likely caused the S1 and S8 false positives.
- A possible defect in S10 ("Analytics dashboard displays zero for all metrics despite active and resolved markets existing") was not promoted: the live replay came back inconclusive.
What to fix first
- Add the production domain to the wallet connection provider allowlist to resolve origin 403 errors (F5).
- Require all mandatory fields to be filled and valid before enabling the USDC approval action in the market creation form (F2).
- Validate the question input in the market creation form to reject whitespace-only strings (F3).
Coverage and caveats
In scope: Create Market flow and validation; Market list search and filtering; Market detail dynamic rendering; Portfolio and Analytics page loads.
Not covered: Successful market creation.
- The test wallet holds only 4.1 USDC, which is insufficient to cover the 10 USDC market creation fee, so a full successful creation cannot be tested.
- Network switching to unsupported chains cannot be tested from the UI since no network switcher element is mapped.
By the numbers
| Metric | Value |
|---|
| Scenarios | 8 passed, 4 failed, 0 blocked of 12 (42 planned steps) |
| Browser actions | 201 (26 clicks, 22 inputs, 44 navigations, 109 snapshots) |
| Screenshots | 38 (4 explore, 31 scenario, 3 critic), 31 captioned |
| Coverage | 6 pages, 1 forms, 4 flows, 3 console errors |
| Audit | 4 findings, 3 re-verified live, 2 confirmed, 1 promoted, 2 withdrawn |
| Model calls | 198 |
| Tokens | 994,393 input, 10,451 output, 20,113 thinking |
| Time | 12 min |
| Wallet | 0 transactions, 0 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 28 | 226,742 | 1,970 | 1,306 | 119 |
| plan | 1 | 3,763 | 1,977 | 3,039 | 40 |
| test | 144 | 665,603 | 4,998 | 8,189 | 396 |
| critique | 24 | 96,389 | 1,225 | 7,047 | 130 |
| report | 1 | 1,896 | 281 | 532 | 7 |