There's no specific law against selling exploits. The problem is the subsequent crime - and if someone wants to pay you a lot of money for a 0-day in Google, it's hard to come up with an explanation other than that they're about to commit a crime.

So, if you knew or should have known, then feigning ignorance won't save you and you won't ba having a good time.