CVE-2026-86840

Bifrost's vtoken-minting and slpx pallets contain a missing-authorization flaw (CWE-862/CWE-639): a signed account can supply any registered channel_id when minting without the runtime verifying that the caller is authorized to mint on behalf of that channel. The flaw is triggered by simply submitting a mint transaction referencing an arbitrary registered channel the attacker does not control. By doing so, an attacker can inflate that channel's recorded mint volume, causing protocol commission settlement to disproportionately route commission payments to the attacker-chosen channel. Affected parties are the Bifrost protocol (a Polkadot parachain), its registered minting channels/integrators, and anyone entitled to commission distributions; end-user tokens are not described as directly at risk in the available data. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only a 0.1% chance of exploitation within 30 days.

What to do: Apply Bifrost's patched runtime upgrade incorporating corrected vtoken-minting and slpx pallets as soon as the fix release is published (no fixed version numbers were included in this advisory data). Operators of registered channels should review their recorded mint volume for unexplained inflation and audit the next commission settlement for skewed distributions. End users of vToken minting or SLPx cross-chain staking need no direct action but should monitor official Bifrost communications for the patch and any settlement corrections.