The LPP challenge period can cause malicious and freeloader claims to be uncounterable and can also cause freeloader claims to be abused to entrap honest challengers
Audit: 2024-07-optimism-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2024-07-optimism/blob/main/packages/contracts-bedrock/src/dispute/FaultDisputeGame.sol#L371-L382


# Vulnerability details

In some cases, the honest challenger must pass an LPP in order to counter a `MAX_GAME_DEPTH` claim through `step()`. For instance, "in the event that the preimage is too large to be submitted through calldata in a single block, challengers must resort to the streaming option" as described in the Optimism [specs](https://specs.optimism.io/fault-proof/stage-one/fault-dispute-game.html?highlight=large%20preimage%20proposal#preimageoracle-interaction).

However, an issue arises because to pass an LPP, the honest challenger must wait for `CHALLENGE_PERIOD` seconds in order to pass the LPP to be able to `step()` against a malicious `MAX_GAME_DEPTH` claim. The honest challenger will have a minimum of one `CLOCK_EXTENSION` (3 hours on mainnet) period on their chess clock, which cannot cover the `CHALLENGE_PERIOD` for an LPP (1 day on mainnet).

There are essentially 3 impacts that this can cause:

### Impact 1: A malicious `MAX_GAME_DEPTH` claim can be uncounterable if honest challenger does not have time left

If the honest challenger has less than 1 day left in their chess clock when reaching the malicious claim at `MAX_GAME_DEPTH`, they cannot possibly pass an LPP in time. This will cause the malicious claim to be uncountered while the honest challenger's claim will be countered leading to an incorrect game result.

### Impact 2: Uncounterable freeloader claims can be made by forcing an honest challenger to inherit a clock smaller than `CHALLENGE_PERIOD`

The `CLOCK_EXTENSION` is a feature meant for honest challengers to counter a freeloader claim, a freeloader claim is described as follows:

Consider an attacker claim denoted by A in the subtree below. Suppose that this claim is valid, then the correct move for the honest party is to defend the claim. The honest party's claim is denoted by claim H.
```
   A  
 /   \
F     H
```
To prevent themselves from losing the bond, suppose the attacker then attacks claim A with the claim F. Due to the leftmost priority, they would receive the bond if their freeloader claim F remains uncountered. This is possible if the attacker's chess clock has very little time left because the honest party needs to use the attacker's chess clock to counter the freeloader claim. 

To resolve this, Optimism uses clock extensions, where if a chess clock has less than `CLOCK_EXTENSION` seconds left, it is extended to `CLOCK_EXTENSION` seconds.

If the honest challenger must pass an LPP to counter the freeloader claim at `MAX_GAME_DEPTH` via `step()` it will not have enough time to do so, resulting in the freeloader claim stealing the bond from the honest party's claim.

### Impact 3: Freeloader claims can now be used to bait honest challengers to respond and then entrap them, winning all the bonds they used to counter the freeloader claim

Combining the points r