When the `claim` function is called with the `MERKLE` verification type, it may not properly update the minted tokens count and may not revert as expected.
Audit: 2024-08-phi-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2024-08-phi/blob/8c0985f7a10b231f916a51af5d506dd6b0c54120/src/PhiFactory.sol#L283
https://github.com/code-423n4/2024-08-phi/blob/8c0985f7a10b231f916a51af5d506dd6b0c54120/src/PhiFactory.sol#L264-L295
https://github.com/code-423n4/2024-08-phi/blob/8c0985f7a10b231f916a51af5d506dd6b0c54120/src/PhiFactory.sol#L269-L283


# Vulnerability details

Improper handling of the `MERKLE` verification type in the claim function will cause an inconsistency in the minting process for the `PhiFactory` contract as an attacker will claim tokens without proper verification.

**Root Cause**

In [PhiFactory.sol:claim](https://github.com/code-423n4/2024-08-phi/blob/8c0985f7a10b231f916a51af5d506dd6b0c54120/src/PhiFactory.sol#L264-L295), the [merkleClaim](https://github.com/code-423n4/2024-08-phi/blob/8c0985f7a10b231f916a51af5d506dd6b0c54120/src/PhiFactory.sol#L352-L380) function is called using [this.merkleClaim{ value: mintFee }(...)](https://github.com/code-423n4/2024-08-phi/blob/8c0985f7a10b231f916a51af5d506dd6b0c54120/src/PhiFactory.sol#L283), which means it is called as an external function. However, the `merkleClaim function is defined as an external function itself, which can lead to unexpected behavior.
```solidity
if (art.verificationType.eq("MERKLE")) {
    (
        ,
        address minter_,
        bytes32[] memory proof,
        address ref_,
        uint256 quantity_,
        bytes32 leafPart_,
        string memory imageURI_
    ) = abi.decode(encodedata_, (uint256, address, bytes32[], address, uint256, bytes32, string));

    bytes memory claimData = abi.encode(minter_, ref_, artId);
    MintArgs memory mintArgs = MintArgs({ tokenId: tokenId, quantity: quantity_, imageURI: imageURI_ });
    uint256 mintFee = getArtMintFee(artId, quantity_);
    this.merkleClaim{ value: mintFee }(proof, claimData, mintArgs, leafPart_);
}
```
## Impact
When the `claim` function is called with the `MERKLE` verification type, it may not properly update the minted tokens count and may not revert as expected. This can result in inconsistencies in the minting process and potentially allow users to claim tokens without proper verification.

The `PhiFactory` contract suffers from an inconsistency in the minting process. The attacker can claim tokens without proper verification, bypassing the intended checks and updates.

## Proof of Concept
[PhiFactory.sol#L268-L283](https://github.com/code-423n4/2024-08-phi/blob/8c0985f7a10b231f916a51af5d506dd6b0c54120/src/PhiFactory.sol#L269-L283)
```solidity
if (art.verificationType.eq("MERKLE")) {
    (
        ,
        address minter_,
        bytes32[] memory proof,
        address ref_,
        uint256 quantity_,
        bytes32 leafPart_,
        string memory imageURI_
    ) = abi.decode(encodedata_, (uint256, address, bytes32[], address, uint256, bytes32, string));

    bytes memory claimData = abi.encode(minter_, ref_, artId);
    MintArgs memory mintArgs = MintArgs({ tokenId: tokenId, qu