Hi.
I'm reviewing your protocols and they seems promising (currently at 'initiated by stellar part').
In your current design you are using payment to Alice as a refund transaction in case Bob does something wrong at his side. I think it would be better to use merge operation, as it will not leave unused account with unusable 40 XLM on network.
For transactions that sends XLM from Hold account to Bob it is better to leave it with payment as now, so in case Alice by mistake transfers too much to this Hold account she still can use the Merge transactions to get the rest back.
I think that with proper timelock on both stellar and eth transactions you could even get rid of Bob as a signer of Hold account.