Testing AI onchain apps: a USDC payment app loop

You are looking at an AI-generated payment app that looks finished but may not be safe enough to review further. Circle's Arc Studio is an AI coding agent that turns a plain-English description into a full-stack blockchain application. Mainnet signing, funding, and transaction submission remain outside Arc Studio's actions during a user session. The pre-trust loop keeps the app in a testable state until the code is exported and checked.

Trace before you trust the contracts

Treat the output as untrusted until the trace, the deployment, and the exported code all agree. The loop separates generation from judgment: the agent produces code, the test loop forces the app to expose its behavior. Write down the expected flow before you click, then compare the trace before export.

• Prompt the agent for a payment app with one happy path and one failure path. Ask for an app to be built and tested. If the agent adds admin keys, fee logic, or token swaps, ask why before continuing. Stop when the prompt names the exact flow you will test, not a product pitch.
• During testing, Arc Studio's tracing view lets developers watch the RPC traffic, transactions, decoded events, and off-chain HTTP calls their app makes. Use it while the app runs. A clean run shows the expected calls in order, with no surprise wallet prompts and no unexplained backend fetches. A green UI is not a clean trace. The trace is ready when it can be read in order: request, transaction, event, response.
• Build testing covers nine networks: Ethereum, Base, Polygon, Arbitrum, Arc, Avalanche, Monad, OP Mainnet, and Unichain. Deploy the build to at least one network where the payment token lives and one where the protocol connections matter. The built-in composable connections are for Aave, Morpho, and Uniswap. Test the path that touches those protocols. The deployment passes when the same payment flow succeeds on the chosen networks without manual patching.
• Verify protocol behavior by comparing the trace to the expected state changes. Check that the payment amount, recipient, and settlement event match the prompt. Look for missing events, duplicate transactions, and calls that do not map to a user action. The verification passes when the protocol trace matches the UI behavior.
• Arc Studio lets you move the generated project into a private repository and launch it with your own credentials and infrastructure. Code produced by Arc Studio's AI may have bugs, vulnerabilities, or unfinished parts, so it needs review and testing. The export is ready when a human can read the codebase and see the same flow you traced earlier.
• Run a failure checklist against the code and the trace. Look for missing access controls, unhandled reverts, unbounded loops, and any path that lets a user move funds without authorization. Check the frontend for state that can desync from the chain, and check the backend for assumptions that only hold in a clean environment. Test what happens when a transaction is pending, when an event is missing, and when a user retries the same payment. The checklist is done when every failure can be explained from the trace.

Fail the app on purpose

Fail the app on purpose to see whether it can explain its own failure. A failure that cannot be traced to a request, transaction, event, or backend assumption is a review blocker.

Keep mainnet outside the session

If a workflow asks for a live key, a funded wallet, or a live submission as part of the test, stop. A safe loop fails without moving real value. The loop is done when the test environment can be reset and the codebase is ready for human review.

A reviewer should be able to inspect the code without assuming that a live wallet was involved. When a test path depends on live funds, the failure mode is harder to explain.