ERC20Custody::whitelist allow any address to be whitelisted, the only verification that is made (inside Observer before calling ERC20Custody contract) is that its not address(0). But this open the room for operational mistake like whitelisting ZETA token itself. Doing so would cause potential problems, as now the user would be able to pass throught ERC20Custody to send ZETA, which is not expected, and could cause multiples sides effect.
I would recommend todo the following verification in the contract (or do it in the Observer)
