# Users will be able to purchase fewer NFTs than the project had anticipated

Namespace.fuse passed fontClass 0 instead of tileData.fontClass to characterToUnicodeBytes, collapsing all font classes to identical names and blocking mints.

- Payout: Contest reward
- Severity: high
- Program: Canto Identity Subprotocols
- Credited: volodya
- Disclosed: 2023-05-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-canto-identity-findings/issues/117
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-canto-identity%3AH-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** Namespace.sol fuse() NFT namespace minting contract
**Root cause:** fuse() calls Utils.characterToUnicodeBytes(0, tileData.characterIndex, characterModifier) with a hardcoded fontClass of 0 instead of tileData.fontClass, so names from different font classes with the same characterIndex produce identical strings.
**Steps:**
1. Mint NOTE and buy trays; approve Namespace contract.
2. Call `ns.fuse([CharacterData(trayId1, 4, 0)])` where tile has fontClass=8, characterIndex=1.
3. Call `ns.fuse([CharacterData(trayId2, 3, 0)])` where tile has fontClass=4, characterIndex=1.
4. Second call reverts with `NameAlreadyRegistered(1)` because both names resolve to the same string.
**How found:** Manual code review of fuse() noticed the literal 0 passed as fontClass to characterToUnicodeBytes, then confirmed with a forge test that two different font classes with the same characterIndex collide on nameToToken.
**Exploitation:** Not an attack; a functional bug. Any user attempting to mint a namespace whose characterIndex matches an already-registered name in another font class is blocked, so only emoji-class variations are purchasable.
**Insight:** When a helper takes a fontClass/encoding parameter, grep for call sites passing literal 0 or constants instead of the struct field; name-uniqueness checks keyed on the encoded string make such copy-paste bugs revert mints.