Is Zoth Protocol Safe?
Risk Grade: C- (54/100)
Zoth Protocol is rated as elevated risk — multiple novel mechanisms and notable interaction risks.
Elevated risk — proven $8.4M admin key exploit on current-architecture contracts, 92% TVL collapse with no recovery, and custom RWA oracle risk make Zoth a high-risk protocol with significant unresolved security questions.
Zoth Protocol is an RWA stablecoin and yield vault platform that issues ZeUSD (a CDP stablecoin backed by U.S. Treasuries and tokenized RWA assets) and zVaults (KYC-gated yield vaults managed by institutional strategy providers including BlackOpal and Superstate). The protocol suffered two exploits within 21 days in March 2025 — a $285K logic flaw and a critical $8.4M admin key compromise that drained USD0++ tokens from an upgradeable proxy vault — causing TVL to collapse approximately 92% from a peak of $29.3M to $2.2M with no recovery. Its C- grade reflects the confirmed major exploit on current-codebase contracts (maximum track record penalty), a critical upgradeable proxy admin key risk, custom RWA oracle dependency, and significant regulatory concentration from KYC-gated access and regulated custodian dependencies. The ZOTH governance token has not yet launched.
TVL
$2M
Mechanisms
5
Interactions
5
Value Grade
D-
Key Risks for Zoth Protocol Users
The protocol suffered an $8.4M hack in March 2025 via compromised deployer private key that enabled malicious proxy contract upgrade — the exact same attack vector (upgradeable proxy with unprotected admin key) remains the primary risk surface. Verify whether admin keys have been migrated to multisig + timelock since the exploit.
ZeUSD backing includes USD0++ (Usual Protocol), which has a 4-year lock mechanism and has experienced secondary market discounts. If any RWA collateral type depegs or is frozen, ZeUSD's backing falls below 1:1 and KYC-gated access prevents standard peg recovery via market arbitrage.
All vault and ZeUSD access requires KYC whitelisting. During stress events, non-whitelisted secondary market holders cannot redeem at par — amplifying any depeg or redemption crisis.
TVL has not recovered from the March 2025 hack (down 92% from peak, 15+ months after incident). Low TVL creates thin exit liquidity and operational sustainability risk for ongoing development.
The ZOTH governance token has not yet launched, making tokenomics unverifiable. Fee distribution, vesting schedules, and investor allocations from $21.5M in fundraising are not publicly documented.
Top Risk Factors
- •The protocol suffered two exploits within 21 days in March 2025, losing approximately $8.4M total — including an $8.4M admin private key compromise that drained USD0++ tokens from the USD0PPSubVaultUpgradeable proxy contract. The deployer wallet's key was stolen, enabling the attacker to upgrade the proxy and drain assets. Upgradeable proxy contracts with non-timelock admin keys remain the primary attack surface in the current architecture.
- •The protocol prices heterogeneous RWA collateral types (USYC, USD0++, TBILL, wSTBT, Wrapped $M) using a custom oracle system (KYC Manager + Oracle + Registry infrastructure). Custom RWA price oracles are not independently verified by Chainlink or industry-standard feeds, making manipulation or stale pricing a structural risk for ZeUSD's collateral valuation.
- •ZeUSD, the protocol's stablecoin, depends on regulated custodians and asset issuers for all underlying RWA backing. Regulatory action against any partner (USYC issuer Hashnote, Usual Protocol for USD0++, etc.) or ZeUSD itself could result in asset freezing — the asset issuers locked down 73% of remaining TVL after the March 2025 hack, demonstrating this centralized control.
- •TVL declined approximately 92% from the pre-hack peak of $29.3M to $2.2M, with no meaningful recovery over 15+ months. The protocol is operationally active (ongoing development, FINTRAC MSB registration, new product lines) but commercially fading — exit liquidity for remaining vault positions is limited.
How Zoth Protocol Compares to Peers
Zoth Protocol ranks #75 of 77 RWA protocols (bottom quartile — among the riskiest). At a risk score of 54/100, it's 16 points riskier than the sector average of 38/100.
Adjacent peers: Mountain Protocol (C-, 52/100) is ranked just safer, and RealT Tokens (C-, 56/100) is ranked just riskier.
See the full RWA sector leaderboard or the Zoth Protocol vs RealT Tokens comparison.
Common Questions about Zoth Protocol
Plain-English answers based on Zoth Protocol's scores across Hindenrank's 8 risk dimensions. The highest-scoring (riskiest) dimension is Track Record (15/15).
Has Zoth Protocol ever been hacked or exploited?
Zoth Protocol has a documented incident history that materially raised its risk grade — the track record dimension scored 15/15, near the high end of the scale. Past exploits, governance failures, or contract issues are baked into this rating. Anyone considering deposits should review the incident details before allocating capital.
How much money is at stake in Zoth Protocol?
Zoth Protocol currently holds under $2M in user deposits — small enough that liquidity events could affect exits. Smaller TVL means individual depositors carry a larger share of any loss event, and it can be harder to exit a position quickly during stress.
What's the worst-case scenario for Zoth Protocol?
Hindenrank has identified specific collapse scenarios for Zoth Protocol. The most prominent: "Admin Key Compromise Draining Remaining Vault Assets". The trigger condition is An attacker gains access to the proxy admin key controlling any remaining zVault upgradeable contract, enabling a malicious upgrade similar to the March 21, 2025 exploit that drained $8.4M. Reading through the full scenario list on the protocol page is the single best way to understand the actual failure modes — generic "smart contract risk" is rarely the thing that takes a protocol down.
Is Zoth Protocol regulated or insured?
Zoth Protocol faces material regulatory exposure (7/10 on this dimension). This may stem from counterparty concentration, jurisdiction risk, or specific products attracting enforcement attention. Users in regulated jurisdictions should consider whether they are comfortable with this profile before depositing. No DeFi protocol carries FDIC-style insurance — even with low regulatory risk, depositors are not protected in the way bank customers are.
What are the biggest red flags for Zoth Protocol?
Hindenrank's retail-focused risk audit flagged: The protocol suffered an $8.4M hack in March 2025 via compromised deployer private key that enabled malicious proxy contract upgrade — the exact same attack vector (upgradeable proxy with unprotected admin key) remains the primary risk surface. Verify whether admin keys have been migrated to multisig + timelock since the exploit. ZeUSD backing includes USD0++ (Usual Protocol), which has a 4-year lock mechanism and has experienced secondary market discounts. If any RWA collateral type depegs or is frozen, ZeUSD's backing falls below 1:1 and KYC-gated access prevents standard peg recovery via market arbitrage. All vault and ZeUSD access requires KYC whitelisting. During stress events, non-whitelisted secondary market holders cannot redeem at par — amplifying any depeg or redemption crisis. On the technical side, 1 critical-severity interaction risk has been identified.
Should beginners deposit into Zoth Protocol?
Zoth Protocol's C- grade puts it in the elevated-risk band. This is not a beginner-friendly protocol. Anyone depositing here should treat the position as speculative and avoid concentrating significant savings in it.
How does Zoth Protocol compare to safer RWA alternatives?
Zoth Protocol is one protocol in Hindenrank's RWA coverage. The safest RWA protocols on the leaderboard tend to share three traits: a long incident-free track record, conservative mechanism design, and high-quality public documentation. Compare Zoth Protocol against the full RWA ranking before committing capital.
For the full 8-dimension score breakdown, the radar chart, and dependency graph, see the Zoth Protocol risk report.
Read the Full Zoth Protocol Risk Report
This protocol has 2 collapse scenarios. 1 critical and 2 high-severity interaction risks identified. See the full mechanism classification, interaction matrix, and deep-dive recommendations.
View Full Report →Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.