Based on `SECURITY_AUDIT_VAULT_CONTRACT-V1.0.0.md` (finding F-05). **Severity:** High ## Summary Use `checked_add` for `total_redeemed + token_balance` (line 198). ## Acceptance criteria - [ ] Use `checked_add` and propagate `ContractError::ArithmeticOverflow` on overflow - [ ] Tests pass - [ ] Scout no longer reports overflow at line 198