QA report: external/www.synarcdao.xyz at hosted
A repeat faucet claim hangs with no feedback, and proposal creation accepts negative funding amounts.
Testing covered 12 deep feature scenarios across the application, evaluating wallet connectivity, DAO creation wizards, AI assistant drafting, directory browsing, proposal forms, and testnet token faucet interactions. Of these, 9 scenarios passed, 2 failed, and 1 governance proposal creation flow was blocked before completion.
Claiming tokens from the faucet a second time with the same wallet gets stuck in a 'Sending Token...' state without completing or displaying error feedback (the first claim in this run succeeded, so this is the repeat-claim path). Additionally, the Fund Agent Operating Treasury proposal form permits negative numerical values, generating invalid proposal text that transfers negative funds.
While general UI navigation and form validations across the DAO creation wizards passed, full end-to-end proposal creation remains unverified after being blocked by prerequisite setup steps.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 9 |
| Failed | 2 |
| Blocked | 1 |
| Findings raised | 2 |
| Issues after the audit | 2 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 0 / 2 / 0 |
Target: https://www.synarcdao.xyz · Testing level: deep_feature · Stack: unknown
Issues
Medium severity
F2 · Repeat faucet claim hangs in 'Sending Token...' with no feedback
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S10
Review note (2026-09-16): Human review on 2026-09-16: the same wallet had already claimed 1000 sARC from the faucet earlier in this run (scenario S2, followed by a successful on-chain self-delegation), so the hang seen in S10 is the repeat-claim path, most likely a cooldown, rather than a broken faucet. The defect stands as a missing error state and feedback, and its severity is lowered from high to medium.
The observation clearly records the button becoming permanently disabled in a hanging state after clicking. The live replay was inconclusive: The replay ran out of tool calls before it reached the reported state.
Expected: The faucet dispenses sARC tokens, completes the transaction with a confirmation notification, and resets the button state.
Actual: The faucet button gets stuck indefinitely displaying 'Sending Token...' with no success confirmation, error handling, or balance update.
Steps to reproduce:
- Navigate to https://www.synarcdao.xyz/faucet
- Ensure wallet is connected
- Click 'Claim 1000 sARC Tokens'
- Observe the button state and transaction response
Evidence: screenshots/S10-2.png
F1 · Funding Amount input accepts negative values on Fund Agent Operating Treasury proposal form
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S9
The tester verified that the client-side form accepts negative numbers and inappropriately incorporates them into the generated proposal title and description.
Expected: The application should reject negative values in the Funding Amount field with a validation error, requiring a strictly positive numeric amount (e.g. min='0' or min='1').
Actual: The spinbutton input accepts '-500' and generates a proposal title and description transferring negative funds.
Steps to reproduce:
- Navigate to /proposals/create
- Click on the 'Fund Agent Operating Treasury' tab
- Type '-500' into the 'Funding Amount (USDC) *' field
- Observe the field accepting negative values and updating the proposal title and description with negative transfer amounts
Evidence: screenshots/S9-2.png
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Connect Wallet and Verify Arc Testnet Integration | high | pass | none |
| S2 Create Governance Proposal with Valid Data | high | blocked (Tool-call budget was exhausted while completing the necessary on-chain faucet claim and self-delegation prerequisites.) | none |
| S3 Launch Creator DAO Workspace Step Progression | high | pass | none |
| S4 Render Proposal Details Resiliently | high | pass | none |
| S5 Load Large Proposals List | high | pass | none |
| S6 Draft Proposal via AI Assistant | medium | pass | none |
| S7 Create Proposal Form Required Fields Validation | medium | pass | none |
| S8 Create DAO Wizard Required Fields Validation | medium | pass | none |
| S9 Target Funding Amount Input Sanitization | medium | fail | F1 |
| S10 Claim Testnet Tokens from Faucet | medium | fail | F2 |
| S11 Navigate to Creator DAOs Directory | low | pass | none |
| S12 Creator DAO Name Length Limits | low | pass | none |
The audit
The Critic reviewed 2 findings and re-verified 3 of them live in the browser, replaying the reported steps on a fresh page.
- The tester explicitly claimed in S5 that there were no 429 status codes or resource exhaustion, directly contradicting the console errors present for that scenario.
- Multiple passed scenarios (S1, S4, S5, S11) exhibited severe RPC failures and rate limiting in the background, which the tester either ignored or falsely claimed did not happen.
- A possible defect in S4 ("Fetching voters fails with Alchemy 400 Free tier limit error") was not promoted: the live replay came back inconclusive.
- A possible defect in S5 ("Loading proposals list triggers 429 Too Many Requests and resource exhaustion") was not promoted: the live replay came back not-reproduced.
What to fix first
- Give the faucet a clear error or cooldown message on repeat claims instead of an endless 'Sending Token...' state (F2).
- Add client-side validation to the treasury funding amount input to reject negative numbers (F1).
Coverage and caveats
In scope: Wallet connection via Privy to Arc testnet; Proposals creation, listing, and detail views; Creator DAO workspace wizard progression; AI Proposal Assistant integration; Form validations and data sanitization for proposals and DAOs.
Not covered: Treasury, Bridge, Analytics, and Settings views (not mapped in Explore stage); Non-Arc network interactions (wallet enforces Arc testnet only); Voting transaction execution (voting logic not fully mapped).
- The Privy wallet modal injection intercepts correctly via the DeepQA Test Wallet
- The /faucet page contains an identifiable claim button
- There are existing proposals available to test the detail view
- The application gracefully handles the expected network-switch failures as per intake
- S2 could not be executed: Tool-call budget was exhausted while completing the necessary on-chain faucet claim and self-delegation prerequisites..
By the numbers
| Metric | Value |
|---|
| Scenarios | 9 passed, 2 failed, 1 blocked of 12 (48 planned steps) |
| Screenshots | 37 (8 explore, 28 scenario, 1 critic), 28 captioned |
| Coverage | 8 pages, 2 forms, 3 flows, 8 console errors |
| Audit | 2 findings, 3 re-verified live, 2 confirmed, 0 promoted, 0 withdrawn |
| Model calls | 221 |
| Tokens | 1,345,390 input, 10,749 output, 18,005 thinking |
| Time | 12 min |
| Wallet | 1 transactions, 2 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 41 | 286,478 | 2,592 | 1,172 | 149 |
| plan | 1 | 4,001 | 2,025 | 2,521 | 35 |
| test | 158 | 926,430 | 4,844 | 8,003 | 422 |
| critique | 20 | 126,838 | 1,039 | 5,763 | 136 |
| report | 1 | 1,643 | 249 | 546 | 7 |
