Bugs found in Spot Wallet: Crypto & DeFi for Android
Spot Wallet: Crypto & DeFi is a mobile solution for buying, selling, swapping, and sending cryptos. The app also allows importing your wallet from Metamask, Phantom, Rainbow, and Coinbase.
The app supports WalletConnect, which means you can connect to other DeFi solutions, such as OpenSea or Uniswap. Spot Wallet also offers a reward program so one can earn free Bitcoin for referring friends. News, intelligent or custom price alerts, and real-time charts are included too.
QAwerk has a record in testing DeFi solutions, so we know where to look for bugs. We decided to challenge the Spot Wallet development team and see if we could find any issues with the app. Here are the results!
Device security (e.g. pattern) is not applied on launch if “Ask for PIN code at launch” is disabled
Severity:
Major
Precondition:
- The app is installed.
- The wallet is created/restored.
- The PIN code is set in the app.
- The device security (e.g. pattern) is set in device settings.
Steps to Reproduce:
- Open the app.
- Tap the “Profile” button top right.
- Tap the “Security” button.
- Enter the PIN.
- Scroll down to the “Authentication & PIN code” section.
- Enable the “Use device security (fingerprint, face, unlock, pattern)” toggle.
- Disable the “Ask for PIN at launch” toggle (if enabled).
- Close the app.
- Open the app.
Environment:
Samsung Galaxy S7, Android 8.0.0
Actual Result:
The app’s main screen opens.
Expected Result:
The app’s security screen (e.g. pattern) opens.
PIN code is not requested on launch if “Use device security (fingerprint, face, unlock, pattern)” is enabled
Severity:
Minor
Precondition:
- The app is installed.
- The wallet is created/restored.
- The PIN code is set in the app.
- The device security (e.g. pattern) is set in device settings.
Steps to Reproduce:
- Open the app.
- Tap the “Profile” button top right.
- Tap the “Security” button.
- Enter the PIN.
- Scroll down to the “Authentication & PIN code” section.
- Enable the “Use device security (fingerprint, face, unlock, pattern)” toggle.
- Enable the “Ask for PIN at launch” toggle (if enabled).
- Close the app.
- Open the app.
- Enter data for a security check (e.g. pattern).
Environment:
Samsung Galaxy S7, Android 8.0.0
Actual Result:
The app’s main screen opens.
Expected Result:
The PIN screen opens.
Receive token list - amounts for coins with large names flicker
Severity:
Trivial
Precondition:
- The app is installed.
- The wallet is created/restored.
Steps to Reproduce:
- Open the app.
- Tap the “Receive” button.
- Enter the string “token” to the search field.
Environment:
Samsung Galaxy S7, Android 8.0.0
Actual Result:
Coins with large names like “Bounce Finance Governance Token” & “Ampleforth Governance Token” are displayed with flickering amounts on the right.
Expected Result:
Amounts for coins with large names are shown correctly.
Receive token - address title is shifted left for coins with large names
Severity:
Trivial
Precondition:
- The app is installed.
- The wallet is created/restored.
Steps to Reproduce:
- Open the app.
- Tap the “Receive” button.
- Enter the string “token” to the search field.
- Tap “Bounce Finance Governance Token” or “Ampleforth Governance Token”.
Environment:
Samsung Galaxy S7, Android 8.0.0
Actual Result:
The address title is shifted to the left.
Expected Result:
The address title is centered.
Receive token list - fiat currency amount for Kishu Inu is not displayed
Severity:
Trivial
Precondition:
- The app is installed.
- The wallet is created/restored.
Steps to Reproduce:
- Open the app.
- Tap the “Receive” button.
- Scroll down to the “Kishu Inu” coin.
Environment:
Samsung Galaxy S7, Android 8.0.0
Actual Result:
The fiat currency amount for Kishu Inu is not displayed.
Expected Result:
The fiat currency amount for Kishu Inu is displayed.
Chart title “Bounce Finance Governance Token” doesn’t fit screen width
Severity:
Trivial
Precondition:
- The app is installed.
- The wallet is created/restored.
Steps to Reproduce:
- Open the app.
- Tap the “Manage” button in the “Wallet” section.
- Scroll down to the “Bounce Finance Governance Token” coin.
- Tap on the “Bounce Finance Governance Token” coin.
Environment:
Samsung Galaxy S7, Android 8.0.0
Actual Result:
Chart title “Bounce Finance Governance Token” does not fit the screen width.
Expected Result:
Chart title “Bounce Finance Governance Token” fits the screen width.
I performed functional and usability testing; overall, the app ran as expected. However, a PIN request and other device security controls didn't work under specific configurations. Tokens with long names may also cause UI bugs. I'd emphasize testing the app with varying security settings to prevent similar issues.
