`createNFTDropCollectionWithPaymentAddress()` doesn't granting the `creator` to receive royalties and mint payments

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-foundation/blob/main/contracts/NFTCollectionFactory.sol#L342

Vulnerability details

Impact

createNFTDropCollectionWithPaymentAddress() doesn't ensure to receive royalties and mint payments to the address payable paymentAddress

Proof of Concept

The documentation side Create a new drop collection contract with a custom payment address and in createNFTDropCollectionWithPaymentAddress() in the line 342 where setting the value to the paymentAddress in the case (paymentAddress != msg.sender) == false the paymentAddress will set to payable(0) So the creator will not be able to receive royalties and mint payments

Recommended Mitigation Steps

Change this line paymentAddress != msg.sender ? paymentAddress : payable(0) to this one paymentAddress != msg.sender ? paymentAddress : msg.sender

[HardlyDifficult]

Invalid.

Royalties are paid out to the address returned by getTokenCreatorPaymentAddress. For the NFTDropCollection, that will return the owner if a different paymentAddress was not provided.

So we are effectively accomplishing what was suggested here, but without requiring an additional storage slot be populated when the data is redundant -- saving some gas when the collection is created.

[HickupHH3]

Agreed. Same result, different implementation whereby the current one is more gas efficient.