Welcome to the QuickWallet Testathon! Over the next 4 hours you will test a web application, find bugs, plan tests, and -hopefully- write some automation. This document contains all you need to get started.
Read it carefully before you start.
QuickWallet is a simple personal banking and wallet application. It allows users to:
- Register an account and log in
- Create multiple wallet accounts in different currencies (EUR, USD, GBP)
- Deposit, withdraw, and transfer funds between accounts
- Set daily and monthly spending limits per account
- View full transaction history
- Manage their profile
There is also an admin panel for system administrators with visibility into all users, accounts, and transactions.
Each team has its own dedicated container with an isolated database running on a shared server. Access your instance using the URL below, replacing the port with the one assigned to your team:
Once on your team's URL, the available interfaces are:
| Interface | Path |
|---|---|
| Web UI | / |
| Admin Panel | /admin |
| API Docs (Swagger) | /docs |
| API Docs (ReDoc) | /redoc |
| API Info | /api |
| User Login | /auth/login |
If you experience any connectivity issues, contact the organizing committee immediately.
If you have a VPN issue and cannot reach the shared server, you can run the application locally using the executable provided in this repository.
- Download
quickwallet.exefrom this repo - Place it in a folder of your choice
- Run it from PowerShell:
.\quickwallet.exe - The application will start and create a
quickwallet.dbfile in the same folder - Access it at
http://localhost:8000
This option is a fallback only. Always prefer the shared server instance during the testathon.
| Role | Username | Password |
|---|---|---|
| Admin | admin |
admin |
Regular user accounts must be registered through the application.
- Register at
/auth/registerwith username, email, full name, and password (min. 6 characters) - Login at
/auth/login - Passwords can be changed from the profile page
- Users can create multiple accounts
- Each account has a unique number in the format
QWxxxxxxxxxx(QW + 10 digits) - Supported currencies: EUR, USD, GBP
- An optional initial deposit can be provided on account creation
- Account balances are always displayed with 2 decimal places
- Deposit: Add funds to any of your accounts
- Withdraw: Remove funds (subject to daily and monthly limits)
- Transfer: Send funds to any account by its account number (cross-currency transfers are supported with automatic conversion)
- Each account has a daily limit (default: 1,000) and a monthly limit (default: 10,000)
- Limits apply to withdrawals and outgoing transfers
- Limits can be configured per account from the Profile page
- Spending counters can be reset from the Profile page
- Note: Daily spending limits should not exceed the monthly limit
- Full history of all transactions across all accounts is available at
/transactions/history - Every transaction is permanently recorded and always accessible
- Transfers between accounts of different currencies are automatically converted
- Exchange rates are fixed and managed by the admin
- Current rates are EUR-based (1 EUR = X currency)
- Accessible at
/admin— admin credentials required - Features: user management, account overview, transaction log, exchange rate management
- Admins can activate/deactivate users and accounts
The application exposes a full REST API. All endpoints are documented interactively at /docs (Swagger UI).
| Method | Endpoint | Description |
|---|---|---|
| POST | /auth/api/login | Login |
| POST | /auth/api/register | Register new user |
| Method | Endpoint | Description |
|---|---|---|
| GET | /accounts/api/list | List your accounts |
| POST | /accounts/api/create | Create a new account |
| GET | /accounts/api/{id} | Get account details |
| GET | /accounts/api/{id}/transactions | Get account transactions |
| Method | Endpoint | Description |
|---|---|---|
| POST | /transactions/api/deposit | Deposit funds |
| POST | /transactions/api/withdraw | Withdraw funds |
| POST | /transactions/api/transfer | Transfer funds |
| GET | /transactions/api/history | Get transaction history |
| Method | Endpoint | Description |
|---|---|---|
| POST | /profile/change-daily-limit | Update daily limit for an account |
| POST | /profile/change-monthly-limit | Update monthly limit for an account |
| POST | /profile/reset-daily-limit | Reset daily spending counter |
| POST | /profile/reset-monthly-limit | Reset monthly spending counter |
| Method | Endpoint | Description |
|---|---|---|
| GET | /admin/api/stats | System statistics |
| GET | /admin/api/users | List all users |
| GET | /admin/api/accounts | List all accounts |
| GET | /admin/api/transactions | List all transactions |
| GET | /admin/api/exchange-rates | Get current exchange rates |
| POST | /admin/api/exchange-rates | Update exchange rates |
Before diving into bug hunting, each team will produce a structured test plan for the QuickWallet application.
- Identify the key functional areas to test
- Define test cases (positive and negative)
- Prioritise by risk
- State what tools and approaches you would use
- Go to the Issues tab of this repository and click New Issue
- Select the Test Plan template
- Attach your test plan document (any format accepted — PDF, Word, Excel, etc.)
- Add the label matching your team (e.g.
team-1,team-2, etc.) - Submit before the phase ends
Your goal is to find as many bugs as possible and automate at least one test case.
Open a separate issue for each bug found:
- Go to the Issues tab of this repository and click New Issue
- Select the Bug Report template
- Fill in all required fields carefully — quality of reporting is scored
- Add the label matching your team (e.g.
team-1,team-2, etc.) - Submit the issue
A valid bug report must include:
- Title — short description of the bug
- Severity — Low / Medium / High (your assessment)
- Steps to Reproduce — clear, numbered steps that reliably reproduce the issue
- Expected Result — what should have happened
- Actual Result — what actually happened
- Evidence — screenshot, API response, or video where applicable
- Automate at least one test case
- Scripts must be runnable and produce clear pass/fail output
- Any language or framework is accepted (Python, JavaScript, Postman collections, etc.)
- AI assistance is allowed — but you must understand and be able to explain your code
- Commit your code to this repo and push to a branch named after your team (e.g.
team-1)
You are free to use any tool.
- Do not share bugs with other teams during the discovery phase
- Do not attempt to crash other teams' instances — each team runs their own copy of the exe
- All bugs must be reproducible — "I saw it once" is not sufficient without steps to reproduce
- Submit before time is called — late submissions will not be accepted
- Do not push anything to main branch.
- Start with the UI — click around, try unexpected inputs, check every form
- Read the documentation visible in the app itself (tooltips, notes, descriptions) — it may hint at expected behaviour
- The Swagger UI at
/docsis your friend — it lists every endpoint and lets you call them directly - Think about what a banking app should guarantee, then try to violate those guarantees
- Not all bugs are in the most obvious places — check history pages, admin panels, success messages
- For the harder bugs, think about concurrency, security, and what happens at the boundaries of the system
- Test both the UI and the API separately — they may behave differently
- Create multiple user accounts and test interactions between them
| Category | Criteria | Max Points |
|---|---|---|
| Bugs Found | Low Severity | 40 |
| Medium Severity | 50 | |
| High Severity | 60 | |
| Bug Reporting Quality | Clarity & Reproducibility | 50 |
| Test Strategy Plan | Structure & Coverage | 60 |
| Creativity & Prioritization | 10 | |
| Presentation | Presentation of testing approach | 50 |
| Automation Suite | Automation test | 30 |
| Bonus Points | Extra bug / Creativity / Out-of-box thinking | 50 |
| TOTAL | 400 |
- In case of a tie, the team with the earliest submission timestamp wins
If the application crashes or fails to start, ask an organiser for assistance. Do not attempt to debug or modify the executable yourself.
Good luck, and happy bug hunting!
QuickWallet Testathon — Confidential participant document. Do not distribute beyond registered participants.