Summary

Use of abi.encodePacked not recommended. abi.encodePacked can result in hash collisions when used with two dynamic arguments (string/bytes).

Vulnerability Details

From the solidity documentation:
https://docs.soliditylang.org/en/v0.8.17/abi-spec.html?highlight=collisions#non-standard-packed-mode

If you use keccak256(abi.encodePacked(a, b)) and both a and b are dynamic types, it is easy to craft collisions in the hash value by moving parts of a into b and vice-versa. More specifically, abi.encodePacked("a", "bc") == abi.encodePacked("ab", "c")

There is also discussion of removing abi.encodePacked from future versions of Solidity https://github.com/ethereum/solidity/issues/11593, so using abi.encode now will ensure compatibility in the future.

Impact

abi.encodePacked can result in hash collisions when used with two dynamic arguments

Tools Used

Manual Review

Recommendations

Use abi.encode instead