CyberRota Analysis
AI-GeneratedThe `vtoken-minting` and `slpx` pallets in Bifrost are vulnerable due to improper authorization in channel commission attribution, allowing a signed account to mint tokens using any registered `channel_id` without proper verification. This can lead to inflated mint volumes for a channel, resulting in disproportionate commission payments during settlement. Organizations utilizing Bifrost should prioritize addressing this vulnerability to prevent potential financial exploitation and ensure accurate commission distribution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement.