# Forget to check “Some manifolds contracts of ERC-2981 return (address(this), 0) when royalties are not defined” in 3rd priority - MarketFees.sol

MarketFees 3rd-priority royalty path omits the royaltyAmount>0 check, so Manifold-style (address(this), 0) returns route creator revenue to the market contract, freezing funds.

- Payout: Audit contest
- Severity: medium
- Program: Foundation
- Found by: KIntern_NA
- Disclosed: 2022-09-29
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-08-foundation#m-03
- Library page: http://bugbountylibrary.com/r/c4%3A2022-08-foundation%3AM-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** MarketFees.sol getFees() royalty resolution
**Root cause:** The 3rd-priority royaltyInfo branch (via royaltyRegistry.getRoyaltyLookupAddress override) accepts any returned receiver without checking royaltyAmount > 0, unlike the 1st-priority branch which ignores zero-amount returns.
**Steps:**
1. NFT contract has no ERC-2981 support, so internalGetImmutableRoyalties fails and getFees() falls to 3rd priority.
2. royaltyRegistry.getRoyaltyLookupAddress(nftContract) returns an override implementing getRoyalties and royaltyInfo.
3. Override's royaltyInfo returns `(address(this), 0)` (Manifold behavior when royalties undefined).
4. 3rd-priority branch sets recipients[0]=receiver and 100% split without checking royaltyAmount.
5. _distributeFunds() sends creator revenue to the market contract address, freezing funds.
**How found:** Compared the 1st-priority royaltyInfo branch (which guards royaltyAmount > 0 for Manifold contracts) against the 3rd-priority branch and noticed the same guard was missing.
**Exploitation:** Triggered by a sale on an NFT whose royalty override returns (address(this), 0); the market pays itself instead of a creator, locking the creator's share in the contract.
**Insight:** When a codebase special-cases a quirky external return value in one branch, audit every parallel branch resolving the same data for the same guard; royalty/registry fallback chains are prime spots for inconsistent zero-value handling.