Fix/syn14

src/JBERC20.sol

@@ -14,6 +14,13 @@ import {IJBToken} from "./interfaces/IJBToken.sol";
 /// `JBController.deployERC20For(...)` or `JBController.setTokenFor(...)`, credits can be redeemed to claim tokens.
 /// @dev `JBController.deployERC20For(...)` deploys a `JBERC20` contract and sets it as the project's token.
 contract JBERC20 is ERC20Votes, ERC20Permit, Ownable, IJBToken {
+    //*********************************************************************//
+    // ---------------- public immutable stored properties --------------- //
+    //*********************************************************************//
+
+    /// @notice The project ID.
+    uint256 public immutable override projectId;
+
     //*********************************************************************//
     // --------------------- internal stored properties ------------------ //
     //*********************************************************************//
@@ -92,14 +99,25 @@ contract JBERC20 is ERC20Votes, ERC20Permit, Ownable, IJBToken {
     /// @notice Initializes the token.
     /// @param name_ The token's name.
     /// @param symbol_ The token's symbol.
+    /// @param projectId_ The project ID.
     /// @param owner The token contract's owner.
-    function initialize(string memory name_, string memory symbol_, address owner) public override {
+    function initialize(
+        string memory name_,
+        string memory symbol_,
+        uint256 projectId_,
+        address owner
+    )
+        public
+        override
+    {
         // Prevent re-initialization by reverting if a name is already set or if the provided name is empty.
         if (bytes(_name).length != 0 || bytes(name_).length == 0) revert();
 
         _name = name_;
         _symbol = symbol_;
 
+        projectId = projectId_;
+
         // Transfer ownership to the owner.
         _transferOwnership(owner);
     }

src/JBTokens.sol

@@ -26,6 +26,7 @@ contract JBTokens is JBControlled, IJBTokens {
     error JBTokens_InsufficientTokensToBurn(uint256 count, uint256 tokenBalance);
     error JBTokens_OverflowAlert(uint256 value, uint256 limit);
     error JBTokens_ProjectAlreadyHasToken(IJBToken token);
+    error JBTokens_TokenProjectIdMismatch(uint256 tokenProjectId, uint256 projectId);
     error JBTokens_RecipientZeroAddress();
     error JBTokens_TokenAlreadyBeingUsed(uint256 projectId);
     error JBTokens_TokenNotFound();
@@ -317,6 +318,9 @@ contract JBTokens is JBControlled, IJBTokens {
         // Can't set to the zero address.
         if (token == IJBToken(address(0))) revert JBTokens_EmptyToken();
 
+        // The token's project ID must match the project ID.
+        if (token.projectId() != projectId) revert JBTokens_TokenProjectIdMismatch(token.projectId(), projectId);
+
         // Can't set a token if the project is already associated with another token.
         if (tokenOf[projectId] != IJBToken(address(0))) revert JBTokens_ProjectAlreadyHasToken(tokenOf[projectId]);
 

src/interfaces/IJBToken.sol

@@ -4,6 +4,7 @@ pragma solidity ^0.8.0;
 interface IJBToken {
     function balanceOf(address account) external view returns (uint256);
     function decimals() external view returns (uint8);
+    function projectId() external view returns (uint256);
     function totalSupply() external view returns (uint256);
 
     function initialize(string memory name, string memory symbol, address owner) external;