One way to interpret this is that there is, indeed, a mistake.

A more charitable interpretation is that there are two unstated assumptions:

1. The attacker is performing a Finney-like attack - that is, he has already pre-mined a block before even attempting the transaction. So while z=0 means the honest network has 1 block, so does the attacker.

2. The attacker wins propagation races. So if there is a leaf attacker block with the double-spending transaction, and a leaf honest block with the original transaction, the attacker's transaction will be accepted.

Together, these give a 100% chance of success for the attacker if there is only 1 confirmation.

In my own paper on the subject, I have explicitly stated the assumption that the attacker already has one block (while removing a different simplifying assumption).

One way to interpret this is that there is, indeed, a mistake.

A more charitable interpretation is that there are two unstated assumptions:

1. The attacker is performing a Finney-like attack - that is, he has already pre-mined a block before even attempting the transaction. So while z=0 means the honest network has 1 block, so does the attacker.

2. The attacker wins propagation races. So if there is a leaf attacker block with the double-spending transaction, and a same-height leaf honest block with the original transaction, the attacker's transaction will be accepted.

Together, these give a 100% chance of success for the attacker if there is only 1 confirmation.

In my own paper on the subject, I have explicitly stated the assumption that the attacker already has one block (while removing a different simplifying assumption).