Its possible to call the method createCollateralToken multiple times with the same _qTokenAddress, if you call createCollateralToken with empty _qTokenAddress it will bypass the require(idToInfo[id].qTokenAddress == address(0)), and it will be possible to call again the createCollateralToken with different values. It will produce a mismatch with the reality and collateralTokenIds.
It is mandatory to add a require to verify that the _qTokenAddress is not empty.
