Owner Can Add Arbitrary Code to Be Executed From the SocketGateway Contract
The Socket system is managed by the `SocketGateway` contract that maintains all routes and controller addresses within its state. There, the address with the `Owner` role of the `SocketGateway` contract can add new routes and controllers that would have a `delegatecall()` executed upon them from the `SocketGateway` so user transactions can go through the logic required for the bridge, swap, or any other solution integrated with Socket. These routes and controllers would then have arbitrary code that is entirely up to the `Owner`, though users are not required to go through any specific routes and can decide which routes to pick.\\nSince these routes are called via `delegatecall()`, they don't hold any storage variables that would be used in the Socket systems. However, as Socket aggregates more solutions, unexpected complexities may arise that could require storing and accessing variables through additional contracts. Those contracts would be access control protected to only have the `SocketGateway` contract have the privileges to modify its variables.\\nThis together with the `Owner` of the `SocketGateway` being able to add routes with arbitrary code creates an attack vector where a compromised address with `Owner` privileges may add a route that would contain code that exploits the special privileges assigned to the `SocketGateway` contract for their benefit.\\nFor example, the Celer bridge needs extra logic to account for its refund mechanism, so there is an additional `CelerStorageWrapper` contract that maintains a mapping between individual bridge transfer transactions and their associated msg.sender:\\n```\\ncelerStorageWrapper.setAddressForTransferId(transferId, msg.sender);\\n```\\n\\n```\\n/\\*\\*\\n \\* @title CelerStorageWrapper\\n \\* @notice handle storageMappings used while bridging ERC20 and native on CelerBridge\\n \\* @dev all functions ehich mutate the storage are restricted to Owner of SocketGateway\\n \\* @author Socket dot tech.\\n \\*/\\ncontract CelerStorageWrapper {\\n```\\n\\nConsequently, this contract has access-protected functions that may only be called by the SocketGateway to set and delete the transfer IDs:\\n```\\nfunction setAddressForTransferId(\\n```\\n\\n```\\nfunction deleteTransferId(bytes32 transferId) external {\\n```\\n\\nA compromised `Owner` of SocketGateway could then create a route that calls into the `CelerStorageWrapper` contract and updates the transfer IDs associated addresses to be under their control via `deleteTransferId()` and `setAddressForTransferId()` functions. This could create a significant drain of user funds, though, it depends on a compromised privileged `Owner` address.
Although it may indeed be unlikely, for aggregating solutions it is especially important to try and minimize compromised access issues. As future solutions require more complexity, consider architecting their integrations in such a way that they require as few administrative and SocketGateway-initiated transactions as possible. Through conversations with the Socket team, it appears that solutions such as timelocks on adding new routes are being considered as well, which would help catch the problem before it appears as well.
```\\ncelerStorageWrapper.setAddressForTransferId(transferId, msg.sender);\\n```\\n