Pieces Protocol

Description:
The TokenDivider::divideNft function generates a new ERC20 token by creating a new instance of the ERC20ToGenerateNftFraccion contract, and passing two strings as the _name and _symbol parameters. These strings are defined as the concatenation of two strings, the name and symbol of the NFT, respectively with two strings literals. The concatenation is performed through the abi.encodePacked function, which is a deprecated method which could lead to hash collisions.

More on hash collision here:
https://docs.soliditylang.org/en/v0.8.13/abi-spec.html#non-standard-packed-mode

Tools Used:
Aderyn, manual review

Recommended Mitigation:
It is recommended to use the string.concat function instead. This function has been introduced since Solidity 0.8.12, improves code readibility, and is supported by the official documentation.

"Solidity does not have string manipulation functions, but there are third-party string libraries. You can also compare two strings by their keccak256-hash using keccak256(abi.encodePacked(s1)) == keccak256(abi.encodePacked(s2)) and concatenate two strings using string.concat(s1, s2)."

https://docs.soliditylang.org/en/v0.8.12/types.html#bytes-and-string-as-arrays