CVE-2026-86840 PUBLISHED

Bifrost Unauthorized Channel Commission Attribution Allows Commission Diversion

Assigner: certcc
Reserved: 08.09.2026 Published: 08.09.2026 Updated: 08.09.2026

The vtoken-minting and slpx pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered channel_id when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.

Product Status

Vendor Bitfrost.io
Product Bifrost
Versions
  • affected from 0 to 2022.02 (incl.)

References

Problem Types

  • CWE-862 Missing Authorization
  • CWE-639 Authorization Bypass Through User-Controlled Key