> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.getfoundry.sh/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

## Encode Packed Collision

**Severity**: `High`
**ID**: `encode-packed-collision`

### What it does

Flags calls to `abi.encodePacked()` where two or more arguments have dynamic types:

* `string`
* `bytes` (dynamic)
* dynamic arrays (`T[]`)

### Why is this bad?

Hash collisions allow an attacker to craft inputs that hash to an identifier they do not own. Common vulnerable patterns include:

* Merkle leaf construction: an attacker submits two adjacent leaves concatenated to match a sibling pair
* Signature payloads: two different messages that produce the same signature hash
* Access-control keys: two different (user, resource) pairs that map to the same key

Unambiguous encodings that repeat the same dynamic value or add length prefixes may still
be reported.

### Example

```solidity
function getKey(string memory a, string memory b) public pure returns (bytes32) {
    return keccak256(abi.encodePacked(a, b)); // "a"+"bc" == "ab"+"c"
}
```

Use instead:

Use `abi.encode()` instead — it includes length prefixes that prevent collisions:

```solidity
function getKey(string memory a, string memory b) public pure returns (bytes32) {
    return keccak256(abi.encode(a, b));
}
```