Pieces Protocol

Description

Inside:

the newly generated ERC20 token:

1. Omits the tokenId in both the name and symbol, making it unclear which specific NFT within the collection is fractioned.

2. Uses abi.encodePacked for string concatenation, which can lead to potential collision issues and ambiguous outputs in certain scenarios.

Although this does not directly threaten contract security, it decreases clarity for users and marketplaces that might handle multiple fractionalized NFTs from the same collection. Overlapping or similar names/symbols can cause confusion and hamper identification of the exact fractional tokens.

Impact

• User Confusion: If multiple tokens from the same collection are fractionalized, each new ERC20 will have effectively the same name/symbol. It becomes difficult for users and marketplaces to distinguish one fractional token from another.

• String Collision Risks: While rare in practice, using abi.encodePacked to concatenate multiple arguments can cause edge-case collisions if certain data is combined. This is a minor concern in this context but worth noting for best practices.

The issue primarily affects token identification and user experience rather than contract security.

Recommendation

1. Include tokenId in ERC20 Name/Symbol
   For example:

   string memory name = string(

   abi.encodePacked(ERC721(nftAddress).name(), "_", Strings.toString(tokenId), "_Fraccion")

   );

   string memory symbol = string(

   abi.encodePacked("F", ERC721(nftAddress).symbol(), "_", Strings.toString(tokenId))

   );

   This ensures each fractional token is clearly tied to a specific NFT within the collection.

2. Use bytes.concat

   • consider:

     string memory tokenName =

     string(bytes.concat(bytes(ERC721(nftAddress).name()), "_", bytes(Strings.toString(tokenId)), "_Fraccion"));

     string memory tokenSymbol =

     string(bytes.concat(bytes("F"), bytes(ERC721(nftAddress).symbol()), "_", bytes(Strings.toString(tokenId))));

     ​

     ERC20ToGenerateNftFraccion erc20Contract = new ERC20ToGenerateNftFraccion(tokenName, tokenSymbol);

   • Or use abi.encode if you plan to pass data through hashing or avoid packed encoding collisions.

By updating the function to incorporate the tokenId and a more collision-resistant concatenation approach, you’ll improve the readability, uniqueness, and maintainability of generated fraction tokens.