In FFX mode the format of the ciphertext is same as plaintext. How does it ensure data integrity and authentication? Is there any bit flip attack in FFX mode? Is it malleable?
FFX is not malleable. It's a strong tweakable pseudo-random permutation, where the "strong" here indicates that both encryption and decryption look like random permutations from the attacker's perspective. In particular, there's no relationship between the plaintexts of closely related ciphertexts (aside from the trivial observation that different ciphertexts give different plaintexts).
FFX can provide integrity protection in very limited circumstances. If most plaintexts aren't valid, then you can detect tampering by ensuring that the plaintext is valid upon decryption. (This is not true for encryption in general --- it's another feature of algorithms with strong tweakable pseudo-random permutation security.) For example, if the plaintext contains a checksum, as with a credit card number, then validating the checksum provides some degree of integrity. However, in most cases this isn't a very strong check; a single-digit checksum will allow one in ten forgery attempts to succeed. (See "Encode-then-encipher encryption" by Bellare and Rogaway as well as the RAE definition in "Robust Authenticated Encryption: AEZ and the Problem it Solves" by Hoang, Krovetz, and Rogaway.)