Summary

The protocol is being developed by assuming that 1 Zeth = 1 Eth which is very dangerous.

Vulnerability Details

In the function depositEth() we can see the comment written that the developer is assuming that // Assumes 1 ETH = 1 ZETH. It is very dangerous to assume that something is exactly equal to something else like in this case it is 1 ETH = 1 ZETH

Although in the docs this issue is mentioned and the devs tried very hard approach to face this issue but still it is not fully prevented, what if zeth depegs and user calls the function depositEth. In this function user is sending eth assuming that the value of zeth == eth

Impact

System could face alot of trouble and loss of believing that 1 zeth = 1 eth.

Tools Used

Manual Review

Recommendations

Do not assume that 1 eth = 1 zeth