An improper authorization vulnerability in the Bifrost protocol allows attackers to manipulate token minting records and improperly claim commission payments, posing a critical financial risk.

This vulnerability involves a missing authorization check in the vtoken-minting and slpx pallets, where an unauthenticated attacker can supply an arbitrary channel ID during minting operations. By bypassing this check, the attacker can inflate a specific channel's recorded volume to unfairly capture commission distributions.

The exploitation of this flaw leads to direct financial loss through the manipulation of protocol commission payments. With a CVSS score of 9.1, this vulnerability is considered critical because it permits the unauthorized diversion of assets and undermines the integrity of the protocol minting mechanism.

Immediate Action: Since a specific patch version is currently unknown, administrators must review the official Bitfrost.io security advisories and apply available updates or hotfixes as soon as they are published.

Proactive Monitoring: Monitor protocol logs for unusual minting activity, specifically looking for high-frequency minting events associated with suspicious or unauthorized channel IDs.

Compensating Controls: Implement strict circuit breakers or rate-limiting on minting functions if supported by the platform, and ensure that all administrative actions are subject to multi-signature requirements where possible.

Public Exploit Available: Yes — a published proof-of-concept exists in a GitHub Gist referenced by the CVE record.

Given the critical severity and the existence of a public proof-of-concept, this vulnerability poses a significant risk to the financial integrity of the Bifrost protocol. Stakeholders should prioritize the implementation of any forthcoming vendor patches and monitor network activity for signs of unauthorized minting manipulation until a permanent fix is verified and deployed.