CVE-2026-86840 Details

A vulnerability exists in the Bifrost protocol's `vtoken-minting` and `slpx` pallets, allowing for improper authorization in channel commission attribution. The issue arises because a signed account can submit an arbitrary registered `channel_id` when minting tokens, without any verification of authorization to mint on behalf of that channel. This flaw enables an attacker to artificially inflate a channel's reported mint volume, leading to an unequal distribution of protocol commission payments during settlement. The vulnerability affects Bifrost versions prior to the public disclosure of this issue.

To address this vulnerability, it is recommended to validate the `channel_id` against the Channels storage before recording the mint volume. Additionally, implementing a mapping of authorized callers to channels could prevent unauthorized minting on behalf of legitimate channels.