MEDIUM severity: `Tranche::redeem` calls `super.withdraw` instead of `super.redeem` causing users to receive fewer assets. **Description:** The `Tranche::redeem` function contains a bug where it calls `super.withdraw(shares, receiver, owner)` instead of `super.redeem(shares, receiver, owner)`. This causes the function to incorrectly treat the shares parameter as an assets parameter, leading to wrong...

Vulnerable code:
function redeem(uint256 shares, address receiver, address owner) public override returns (uint256) {
        cdo.updateAccounting();
        uint256 assets = super.withdraw(shares, receiver, owner);
        return assets;
    }

function test_RedeemBug() public {

    alice = makeAddr("alice");
    USDe.mint(alice, 10000 ether);

    vm.startPrank(alice);
    USDe.approve(address(jrtVault), type(uint256).max);


    uint256 initialDeposit = 1000 ether;
    uint256 sharesReceived = jrtVault.deposit(initialDeposit, alice);

    vm.stopPrank();

    // Simulate yield by adding USDe directly to sUSDe contract
    // This increases the asset-to-share ratio in sUSDe, creating yield
    USDe.mint(address(sUSDe), 200 ether); // 20% yield

    vm.startPrank(alice);

    console2.log("After yield simulation");
    console2.log("------------------------");
    console2.log("Alice shares balance:", jrtVault.balanceOf(alice));
    console2.log("Vault totalAssets:", jrtVault.totalAssets());
    console2.log("Alice convertToAssets:", jrtVault.convertToAssets(jrtVault.balanceOf(alice)));

    // Calculate exchange rate
    uint256 totalSupplyShares = jrtVault.totalSupply();
    uint256 totalAssetsVault = jrtVault.totalAssets();
    console2.log("Exchange rate (assets per share * 1e18):", totalSupplyShares > 0 ? totalAssetsVault * 1e18 / totalSupplyShares : 1e18);

    uint256 sharesToRedeem = 100 ether;
    uint256 expectedAssets = jrtVault.previewRedeem(sharesToRedeem);
    uint256 sharesBeforeRedeem = jrtVault.balanceOf(alice);

    console2.log("Before redeem");
    console2.log("------------------------");
    console2.log("Shares to redeem:", sharesToRedeem);
    console2.log("Expected assets from previewRedeem:", expectedAssets);
    console2.log("Alice shares before:", sharesBeforeRedeem);

    // Call redeem - this calls super.withdraw instead of super.redeem
    uint256 actualAssetsReturned = jrtVault.redeem(sharesToRedeem, alice, alice);
    uint256 sharesAfterRedeem = jrtVault.balanceOf(alice);
    uint256 sharesBurned = sharesBeforeRedeem - sharesAfterRedeem;

    console2.log("After redeem");
    console2.log("------------------------");
    console2.log("Actual assets returned:", actualAssetsReturned);
    console2.log("Alice shares after:", sharesAfterRedeem);
    console2.log("Shares actually burned:", sharesBurned);

    // For comparison: what would happen if we called withdraw with same numerical value
    uint256 assetsToWithdraw = sharesToRedeem; // Same number as shares
    uint256 expectedSharesForWithdraw = jrtVault.previewWithdraw(assetsToWithdraw);

    console2.log("Comparison: withdraw behavior");
    console2.log("------------------------");
    console2.log("If we called withdraw(", assetsToWithdraw, "):");
    console2.log("Expected shares burned by withdraw:", expectedSharesForWithdraw);
    console2.log("Expected assets returned by withdraw:", assetsToWithdraw);

    console2.log("------------------------");
    console2.log("Expected assets from proper redeem:", expectedAssets);
    console2.log("Actual assets returned:", actualAssetsReturned);
    console2.log("Difference:", expectedAssets > actualAssetsReturned ? expectedAssets - actualAssetsReturned : 0);

    assertTrue(expectedAssets != actualAssetsReturned, "redeem returned wrong asset amount");

    vm.stopPrank();
}

function redeem(uint256 shares, address receiver, address owner) public override returns (uint256) {
    cdo.updateAccounting();
-   uint256 assets = super.withdraw(shares, receiver, owner);
+   uint256 assets = super.redeem(shares, receiver, owner);
    return assets;
}