Issue 322 flash loan vault reentrancy

[auracule007]

Summary #322

This PR strengthens the flash loan vault’s reentrancy protection during the borrower callback window.

Previously, the vault used a FlashLoanActive flag to prevent nested calls to flash_loan, but other mutable vault entrypoints did not check that flag. During a flash loan callback, a malicious receiver could attempt to reenter vault mutation paths such as deposits, withdrawals, fee updates, or pause controls.

This change centralizes the active flash-loan check and applies it across all mutable vault operations.

Changes

• Added check_no_flash_loan_active helper to return Error::Reentrancy whenever a flash loan is active.
• Reused the helper in flash_loan for the existing nested-loan protection.
• Added the same reentrancy guard to:
  • deposit
  • withdraw
  • set_fee
  • set_paused
  • emergency_pause
• Added regression coverage to verify mutable vault methods reject while FlashLoanActive is set.
• Confirmed vault accounting remains unchanged after rejected mutation attempts.

Security Impact

This closes callback-window reentrancy paths beyond nested flash loans. While a flash loan receiver callback is executing, the vault now rejects all state-changing vault operations that could affect balances, accounting, fee configuration, or pause state.

Testing

Rust checks passed:

• cargo fmt --all -- --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked

Note: frontend lint could not be completed locally because npm ci fails on Windows during a dependency postinstall that assumes Unix shell behavior (yarn setup || true). No web files were changed.

Closes #322

[drips-wave]

@auracule007 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[auracule007]

@EDOHWARES Please review this PR and check workflow