Unintended Reset of Portfolio with Empty newAssets Array
_setPortfolio accepts an empty newAssets array, silently resetting the portfolio to hold only WNATIVE and skipping asset-pool validation; behaviour is likely unintended even if not financially damaging.
Description
The _setPortfolio function in WEDXBasePortfolio might be called with an empty newAssets array, leading to the portfolio being reset to holding only the native token (WNATIVE). While this does not cause a significant imbalance, it might not be the intended behavior.
The internal _setPortfolio function can be called with an empty newAssets array from the public setPortfolio function in derived contracts (WEDXIndexPortfolio and WEDXProPortfolio). This causes:
- Skipping validation of asset pools.
- Resetting the tokenAddresses array to only [WNATIVE].
- Executing
_changeDistributionwith newDistribution.
This effectively resets the portfolio, which might not be intended behavior but does not cause a significant imbalance if newDistribution is correctly set.
Recommendation
Require Non-Empty newAssets Array:
function _setPortfolio(address[] memory newAssets, uint256[] memory newDistribution, uint256 fee)internal virtual returns (uint256) {require(newAssets.length > 0, "Assets array cannot be empty");...}
This ensures that the newAssets array is not empty, preventing accidental resets and maintaining the intended state of the portfolio.

