# The return value of the _sendForReceiver function is not set, causing the receiver to receive more fees

NFTXSimpleFeeDistributor._sendForReceiver returns no value for EOA receivers, defaulting to false, so distribute() re-credits leftover fees and overpays that receiver.

- Payout: Audit contest
- Severity: high
- Program: NFTX
- Found by: cccz
- Disclosed: 2022-03-24
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-nftx-findings/issues/67
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-nftx%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** NFTXSimpleFeeDistributor.distribute / _sendForReceiver (Solidity)
**Root cause:** The else branch of _sendForReceiver transfers tokens to a non-contract receiver but has no return statement, so the function implicitly returns false. distribute() interprets false as a failed send and carries the amount forward as leftover.
**Steps:**
1. Configure a feeReceiver with isContract=false (an EOA) in NFTXSimpleFeeDistributor.
2. Call `distribute(vaultId)` with a nonzero vault token balance.
3. Observe `_sendForReceiver` executes `safeTransfer` to the EOA but returns false.
4. distribute() sets `leftover = amountToSend`, adding it to the next receiver's amountToSend, overpaying subsequent receivers.
**How found:** Code reading of distribute()'s leftover accounting against _sendForReceiver's return paths; noticed the non-contract branch lacks a return, so the implicit false is misread as failure.
**Exploitation:** Any distribution round where an EOA receiver is present causes the transferred amount to be counted as leftover and re-added to the next receiver's payout, draining extra vault tokens to receivers beyond their allocPoint share.
**Insight:** When a helper's bool return gates accounting (leftover rollover), audit every branch for an explicit return; Solidity's implicit false on a value-returning function silently flips control flow.