Is Ubuntu based on Debian unstable or Debian testing?

Actually it depends. For LTS releases Ubuntu syncs with Debian Testing. For non-LTS releases, Ubuntu syncs with Debian Unstable.

Both.

In every Ubuntu release, there's an initial import from Debian unstable for many packages in main. After 9 weeks or so, that process is frozen and the versions are locked down.

However, there is still tracking done by the MOTU team for universe. Many packages come across from testing. (Many packages are also wholly original too.)

For both sets of packages, bug tracking is done on Launchpad and custom patches will be introduced or backported from the previous Ubuntu release.