Phi: Lack of data validation when users are claiming their art allows malicious user to bypass signature/merkle hash to provide unapproved `ref_`, `artId_` and `imageURI`

The PhiFactory contract fails to cryptographically bind key parameters to the claim validation process, allowing users to inject arbitrary values during art claiming. Specifically, the referral address, art ID, and image URI are not included in the Merkle proo …