BlockSec: The fallback() function of NUM tokens was exploited and lost about $15,000

BlockSec tweeted that Numbers Protocol attackers created a fake anyToken that uses NUM as the base token. The attacker then transfers any NUM tokens approved to it by calling Multichain's anySwapOutUnderlyingWithPermit(). NUM.permit() was successfully called due to the fallback function. The attackers exchanged all the stolen NUM tokens for about 13 Ethereum. In addition, this attack was carried out by a robot in a front-running transaction attack, and 10 Ethereum was used to bribe validators to confirm transactions in advance.