Summary:

There is a potential issue with the association of ERC20 tokens and their original NFTs when creating a new ERC20 token for an NFT from the same collection.

Vulnerability Details:

When a new ERC20 token is created for an NFT from the same collection, it uses a new ERC20 contract address as the second key in the nftToErc20Info mapping. This can cause issues in tracking which ERC20 corresponds to which NFT, as the nftToErc20Info mapping will be overwritten for NFTs from the same collection. Although the balances mapping will track balances for both ERC20 tokens, the loss of proper association between ERC20 tokens and their original NFTs due to the nftToErc20Info mapping issue can lead to inconsistencies.

Impact:

The impact of this issue is that the contract may not be able to properly associate ERC20 tokens with their original NFTs, which can lead to confusion and unexpected behavior when interacting with the contract.

Tools Used:

Solidity, Foundry

Recommendations:

To avoid this issue, ensure that the nftToErc20Info mapping is properly maintained and updated when creating new ERC20 tokens for NFTs from the same collection. This can be achieved by using a more sophisticated data structure for storing the association between NFTs and ERC20 tokens, such as a mapping with a composite key (e.g., mapping(address => mapping(uint256 => ERC20Info))). This will allow for proper tracking of ERC20 tokens and their original NFTs, even when multiple ERC20 tokens are created for NFTs from the same collection.

Test proof: