QA report: external/xylonet.xyz at hosted
The application's core PayX, Swap, and Bridge interfaces are functional, but the Swap widget lacks a direction switch control to invert token pairs.
Testing covered 12 deep-feature scenarios across the PayX tipping and claiming flows, token Swap configurations and validations, Bridge form controls, and overall page resilience. Nine scenarios passed without issue.
A single medium-severity functional issue was confirmed (F3), where the Swap interface lacks a button to invert input and output tokens, forcing users to reselect both assets manually. Two initial findings concerning input validation prior to wallet connection in PayX were reviewed by the Critic and withdrawn as standard decentralized application behavior.
Testing focused on client-side interface validation, modal interactions, and routing flows; live on-chain transactions and signed wallet submissions were not exercised during this run.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 9 |
| Failed | 3 |
| Blocked | 0 |
| Findings raised | 3 |
| Issues after the audit | 1 |
| Withdrawn by the audit | 2 |
| Critical / high / medium / low | 0 / 0 / 1 / 0 |
Target: https://xylonet.xyz/ · Testing level: deep_feature · Stack: unknown
Issues
Medium severity
F3 · Missing token direction switch button in Swap UI
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S8
The lack of an invert button is a UX inconvenience rather than a functional failure, so this should be categorized as UX with a low severity. The page reported 1 console error during the scenario.
Expected: A direction switch button is available between or near the input and output token fields that swaps their positions when clicked.
Actual: No direction switch button exists in the widget UI, requiring the user to reselect both tokens manually to invert the pair.
Steps to reproduce:
- Navigate to https://www.xylonet.xyz/swap
- Inspect the Swap UI widget displaying 'From USDC Arc' and 'To EURC Arc'
- Attempt to locate and click a swap token direction / pair inversion button
Evidence: screenshots/S8-5.png
Withdrawn findings
The Critic re-examined these claims and found the evidence did not support them. They are kept here rather than deleted.
- PayX tip form prompts for wallet connection without validating missing recipient X handle (S1, medium): The 'Connect Wallet' button is intended to authenticate the user's wallet, a preliminary step that does not and should not require form fields to be valid.
- PayX Tip form lacks validation for missing or empty USDC amount before wallet connection/submission (S2, medium): Clicking 'Connect Wallet' initiates authentication rather than form submission; validation is typically enforced after a wallet is connected.
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 PayX Tip form validation for missing X handle | high | fail | none |
| S2 PayX Tip form validation for missing amount | high | fail | none |
| S3 PayX Tip form triggers wallet connection on valid input | high | pass | none |
| S4 PayX Claim initiates X OAuth redirect | high | pass | none |
| S5 Swap form validation for missing input amount | high | pass | none |
| S6 Bridge form validation for missing amount | high | pass | none |
| S7 Bridge form validation for missing recipient address | high | pass | none |
| S8 Swap UI token direction switch | medium | fail | F3 |
| S9 Swap UI output token selection modal | medium | pass | none |
| S10 Swap Settings configuration modal | medium | pass | none |
| S11 Bridge protocol routing toggle | medium | pass | none |
| S12 Global page load error resilience | low | pass | none |
The audit
The Critic reviewed 3 findings and re-verified 2 of them live in the browser, replaying the reported steps on a fresh page.
- The tester mistakenly treated the 'Connect Wallet' button as a form submission trigger in F1 and F2, failing to recognize standard dApp behavior where wallet connection precedes validation.
- Multiple passed scenarios contained unfiled console errors, including 401/403 errors in S4 and CORS/CORP issues in S9.
- A possible defect in S4 ("401 and 403 HTTP errors during PayX Claim OAuth flow") was not promoted: the live replay came back not-reproduced.
- A possible defect in S9 ("Resource blocked by NotSameOrigin policy in Swap UI") was not promoted: the live replay came back inconclusive.
What to fix first
- Add a token pair direction switch button to the Swap widget UI to allow quick inversion of selected assets (F3).
Coverage and caveats
In scope: PayX tip form input validation; PayX OAuth claim redirection; Swap form validation and UI state toggles; Bridge form validation and protocol toggles.
Not covered: On-chain transaction execution (requires Web3 wallet extension); X OAuth completion (requires external Twitter credentials and redirection back).
- The Tester does not have a Web3 provider like MetaMask installed.
- Form submission attempts will either show client-side validation errors or trigger a wallet connection modal.
- Buttons referenced in flows (like 'Connect wallet & tip') are present on the page even if not explicitly listed in the interactive elements array.
By the numbers
| Metric | Value |
|---|
| Scenarios | 9 passed, 3 failed, 0 blocked of 12 (38 planned steps) |
| Browser actions | 214 (48 clicks, 13 inputs, 40 navigations, 113 snapshots) |
| Screenshots | 32 (4 explore, 26 scenario, 2 critic), 26 captioned |
| Coverage | 19 pages, 3 forms, 5 flows, 1 console errors |
| Audit | 3 findings, 2 re-verified live, 1 confirmed, 0 promoted, 2 withdrawn |
| Model calls | 207 |
| Tokens | 1,176,056 input, 11,632 output, 19,862 thinking |
| Time | 15 min |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 29 | 226,688 | 3,844 | 1,886 | 124 |
| plan | 1 | 5,702 | 1,959 | 3,159 | 41 |
| test | 162 | 883,036 | 4,709 | 10,052 | 641 |
| critique | 14 | 58,910 | 894 | 4,210 | 69 |
| report | 1 | 1,720 | 226 | 555 | 8 |