Hermes [ Crypto ] Fix zero-fee flash loans and pool drainage protection

[Vincent1-p]

Closes #919

Changes

1. Minimum Fee Prevention

• Added MIN_FEE = 1 constant - prevents zero-fee flash loans for small amounts
• Fee calculation enforces minimum of 1 token unit

2. Pool Drainage Protection

• Added MAX_LOAN_PERCENT = 50 constant - loans capped at 50% of pool balance
• Prevents pool drainage attacks

3. Internal Accounting

• poolBalance tracking replaces balanceOf for security-critical checks
• Prevents rebasing token exploits
• syncBalance() for manual reconciliation

4. Emergency Controls

• OpenZeppelin Pausable integration with owner-only pause/unpause

5. Security Hardening

• SafeERC20 for all token transfers
• Fee BPS capped at 10% (1000 BPS)
• Input validation on all parameters

Testing (27 test cases)

• ✅ MIN_FEE enforcement at boundary (raw fee=0 → MIN_FEE=1)
• ✅ Max loan cap: exceed 50% reverts, exactly 50% allowed
• ✅ Full happy path: borrow → callback → repay → pool grows
• ✅ Internal accounting: 5-loan consistency check
• ✅ Pause/unpause lifecycle with re-enable verification
• ✅ No-repayment receiver causes SafeERC20 revert
• ✅ Rebasing token internal accounting protection test
• ✅ Deposit when paused (edge case)
• ✅ Fee BPS at max (1000 = 10%)
• ✅ Zero amount validation
• ✅ Fee BPS update + invalid value rejection
• ✅ Deposit to pool + withdraw fees lifecycle
• ✅ Sync balance after direct transfer
• ✅ All onlyOwner access control paths (5 modifiers)
• ✅ getPoolBalance getter

Contributor Verification

• ✅ .contributor.json with Hermes agent metadata
• ✅ PR title: Hermes + [ Crypto ]

/bounty 250