A design flaw in `RedemptionFacet::disputeRedemption()` disincentivizes good disputers from doing their job, leading to the depeg of the `dUSD` stable asset
Audit: 2024-03-dittoeth-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2024-03-dittoeth/blob/91faf46078bb6fe8ce9f55bcb717e5d2d302d22e/contracts/facets/RedemptionFacet.sol#L224


# Vulnerability details

## Introduction

The redemption mechanism enables a redeemer to redeem their `ercEscrowed` for `ethCollateral` on target `shortRecords`. Ideally, the redeemer must submit a redemption proposal containing `shortRecords` with the lowest collateral ratio (CR), as redeeming `shortRecords` with high CRs can eventually lead to stability issues of the `dUSD` stable asset to depeg easier.

To protect `shortRecords` with high CRs from being redeemed, the redemption mechanism provides a dispute mechanism by way of the [`RedemptionFacet::disputeRedemption()`](https://github.com/code-423n4/2024-03-dittoeth/blob/91faf46078bb6fe8ce9f55bcb717e5d2d302d22e/contracts/facets/RedemptionFacet.sol#L224-L301), where a disputer can provide a single `shortRecord` with a CR lower than a `shortRecord` in the target proposal. If valid, all invalid `shortRecords` (with higher CRs) in the proposal are removed, the proposer (redeemer) gets a penalty, and the disputer is awarded based on the difference in incorrect debt (the proposer's applied penalty).

## Impact

For this reason, the `disputeRedemption()` is a core protector of the `dUSD` stable asset. However, I noticed the function was misdesigned, as all disputing parameters will be stored in plaintext.

**This way, an attacker or MEV bot can easily observe/monitor the dispute transaction in the mempool, then front-run a legitimate disputer and take free awards. As a result, the legitimate disputer will spend a gas fee without receiving any award.**

**Moreover, the design flaw in question can disincentivize good disputers from doing their job, making the `shortRecords` with high CRs redeemed and closed positions more easily. When the `shortRecords` with high CRs are redeemed and closed positions instead of the `shortRecords` with low CRs, the `Ditto` protocol can confront bad debts easier, eventually leading to the depeg of the `dUSD` stable asset.**

*With the scenario described above, this issue deserves a high severity rating. For the solution, please refer to the `Recommended Mitigation Steps` section below.*

## Proof of Concept

As you can see in the below snippet, the `disputeRedemption()` receives [disputing parameters](https://github.com/code-423n4/2024-03-dittoeth/blob/91faf46078bb6fe8ce9f55bcb717e5d2d302d22e/contracts/facets/RedemptionFacet.sol#L224) (i.e., `address asset`, `address redeemer`, `uint8 incorrectIndex`, `address disputeShorter`, `uint8 disputeShortId`) in the plaintext form.

Thus, an attacker or MEV bot can easily steal all disputing parameters while the transaction is pending in the mempool and submit their own transaction with a higher gas fee instead.

This issue will finally disincentivize good disputers from doing their job in protecting the stability of the `dUSD` asset.

```solidity
    //@audit -- An attacker or