The LPP proposer may not be reimbursed their gas costs by the bonds at `MAX_GAME_DEPTH` because `step()` does not check if the LPP proposer is the one that called it
Audit: 2024-07-optimism-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2024-07-optimism/blob/main/packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol#L311


# Vulnerability details

Part of the reason bonds exist is to refund honest challengers for the gas costs incurred from countering malicious claims. We can observe in the Optimism [specs](https://specs.optimism.io/fault-proof/stage-one/bond-incentives.html) how bond prices are chosen:

> FPM bonds are priced in the amount of gas that they are intended to cover. Bonds start at the very first depth of the game at a baseline of 400_000 gas. The 400_000 value is chosen as a deterrence amount that is approximately double the cost to respond at the top level. Bonds scale up to a value of 300_000_000 gas, a value chosen to cover approximately double the cost of a max-size Large Preimage Proposal.

As per to Optimism specs, we can see that at `MAX_GAME_DEPTH` the bond price is specifically chosen to reimburse the winning party for the high gas costs of proposing an LPP if necessary, as the proposer must call `addLeavesLPP()` many times. The intention is that the honest party creates an LPP and subsequently calls `step()` to receive the bond of the `MAX_GAME_DEPTH` claim they are countering.

However, the `step()` function is actually permissionless: it does not check if the user who proposes an LPP or loads data into the preimage oracle is the caller of `step()` when it accesses such data, and it always grants the bond to the caller.

This means that an attacker can call `step()` (and `squeezeLPP()` before that if necessary, as soon as the challenge period has passed) before the proposer to receive the bond, stealing their reimbursement for the high gas costs of proposing the LPP.
```solidity 
File: FaultDisputeGame.sol
234:     function step(
235:         uint256 _claimIndex,
236:         bool _isAttack,
237:         bytes calldata _stateData,
238:         bytes calldata _proof
239:     )
240:         public
241:         virtual
242:     {
			 ...
309:         // Set the parent claim as countered. We do not need to append a new claim to the game;
310:         // instead, we can just set the existing parent as countered.
311:         parent.counteredBy = msg.sender;
312:     }
```

## Impact
Honest LPP proposers may not be reimbursed for the high gas costs of proposing an LPP, defeating the intended purpose of bonds and leading to misaligned incentives.

## Proof of Concept

1. Alice (honest proposer) and Bob (attacker) are engaged in a fault dispute game at `MAX_GAME_DEPTH`. Alice needs to counter Bob's false claim.
2. Alice initializes and submits an LPP on the `PreimageOracle`, incurring significant gas costs in the process.
3. As soon as the challenge period ends, Bob calls `squeezeLPP()` to finalize the LPP.
4. Immediately after, Bob calls `step()` on the FaultDisputeGame contract, providing the necessary proof that uses Alice's LPP data.
5. The `step()` function succeeds, countering the false claim. However, i