The vulnerability in Bifrost's vtoken-minting and slpx pallets arises from missing authorization checks when attributing channel commissions. Specifically, a signed user can supply any registered channel_id during token minting without validation that the caller is authorized for that channel. This improper authorization (CWE-862) permits manipulation of the recorded mint volume for a channel, leading to inflated protocol commission payments favoring that channel during commission settlement.

An attacker with a signed account can inflate the mint volume attributed to a channel by supplying arbitrary channel_ids without proper authorization checks. This results in disproportionate commission payments being distributed to the manipulated channel, potentially causing financial loss or unfair distribution of protocol commissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to token minting functions to trusted parties and monitor for unusual commission distributions if possible.