Galaxy Fox token's setMerkleRoot function was publicly accessible without access control, allowing attackers to manipulate the merkle root and falsely claim 108 ETH from the contract's funds.

According to the monitoring of the SlowMist Security Alert system, the Web3 game project Galaxy Fox has been attacked, resulting in a loss of approximately $300,000.