CVE-2026-86840: Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion
The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channelid when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs a signed account and a registered channel_id. The described flaw does not require the caller to be authorized to mint on behalf of that channel.
What is the practical impact of successful exploitation?
An attacker can attribute token minting activity to an arbitrary registered channel, inflating that channel's recorded mint volume. During commission settlement, this can cause protocol commission payments to be disproportionately distributed to the affected channel.
Which components should be reviewed for exposure?
Review deployments using Bifrost's vtoken-minting pallet and slpx pallet. The issue concerns minting paths that accept a channel_id and do not verify that the signed caller is authorized for that channel.