For a simple token, depending on your requirements, you may not need it to be pausable or even potentially even mintable.
Based on the SimpleToken example you could have something like the following where the total supply of tokens is minted to the deployer of the contract, with no functionality to mint additional tokens.
As always, you should do ...
As you are using OpenZeppelin contracts you should be quite safe from various exploits - unless you have such in your own code which utilizes OpenZeppelin. OpenZeppelin is well known, widely used and battle-tested.
As for your questions:
1) The code is secure as you are just using OpenZeppelin's functionality and not doing anything strange/fancy yourself. ...
Rob, I see that you have already resolved (which is great).
For future readers:
For OpenZeppelin Contracts you can check the documentation for more information, in this case the Cryptography section: https://docs.openzeppelin.com/contracts/2.x/utilities#cryptography
The tests for the contracts can be helpful to look at, in this case ECDSA.test.js:
The problem is that eth.sign returns a signature where v is 0 or 1 and ecrecover expect it to be 27 or 28.
A note in the documentation for web3 v0.20 is clear:
Note that if you are using ecrecover, v will be either "00" or "01".
As a result, in order to use this value, you will have to parse it to
an integer and then add 27. This will result in ...