MEDIUM severity: The `SocketGateway` contract, responsible for managing routes and controller addresses, allows the a. The `SocketGateway` contract, responsible for managing routes and controller addresses, allows the address with the `Owner` role to add new routes and controllers that can execute arbitrary code upon delegation. This code can be executed without any storage constraints, as it is executed via `delega...

Vulnerable code:
```\ncelerStorageWrapper.setAddressForTransferId(\n    transferId,\n    msg.sender\n);\n```\n```\ncontract CelerStorageWrapper {\n    /**\n     * @title CelerStorageWrapper\n     * @notice handle storageMappings used while bridging ERC20 and native on CelerBridge\n     * @dev all functions which mutate the storage are restricted to Owner of SocketGateway\n     * @author Socket dot tech.\n     */\n```\n```\nfunction setAddressForTransferId(\n    transferId: string,\n    address: string\n): void {\n    // Check if the transferId is valid\n    if (!transferId) {\n        throw new Error('Invalid transferId');\n    }\n\n    // Check if the address is valid\n    if (!address) {\n        throw new Error('Invalid address');\n    }\n\n    // Set the address for the transferId\n    // This is a placeholder for the actual implementation\n    // It should be replaced with the actual logic to set the address\n    // for the transferId\n    // For example, it could be a database query or a call to an API\n    // The actual implementation will depend on the specific requirements\n    // of the application\n    // For now, it's just a placeholder\n    // This is a placeholder for the actual implementation\n    // It should be replaced with the actual logic to set the address\n    // for the transferId\n    // For example, it could be a database query or a call to an API\n    // The actual implementation will depend on the specific requirements\n    // of the application\n    // For now, it's just a placeholder\n    // This is a placeholder for the actual implementation\n    // It should be replaced with the actual logic to set the address\n    // for the transferId\n    // For example, it could be a database query or a call to an API\n    // The actual implementation will depend on the specific requirements\n    // of the application\n    // For now, it's just a placeholder\n    // This is a placeholder for the actual implementation\n    // It should be replaced with the actual logic to set the address\n    // for the transferId\n    // For example, it could be a database query or a call to an API\n    // The actual implementation will depend on the specific requirements\n    // of the application\n    // For now, it's just a placeholder\n    // This is a placeholder for the actual implementation\n    // It should be replaced with the actual logic to set the address\n    // for the transferId\n    // For example, it could be a database query or a call to an API\n    // The actual implementation will depend on the specific requirements\n    // of the application\n    // For now, it's just a placeholder\n    // This is a placeholder for the actual implementation\n    // It should be replaced with the actual logic to set the address\n    // for\n```\n```\nfunction deleteTransferId(bytes32 transferId) external {\n    // Check if the transferId exists\n    if (transferId!= 0x0) {\n        // Get the transfer data\n        TransferData storage transferData = transferDataMap[transferId];\n        \n        // Check if the transfer data exists\n        if (transferData.transferStatus == TransferStatus.Pending) {\n            // Update the transfer status to "Deleted"\n            transferData.transferStatus = TransferStatus.Deleted;\n        } else {\n            // If the transfer data does not exist or is not pending, do nothing\n        }\n    }\n}\n```