`transfer_from` decreases allowance too soon

[drozdziak1]

trafficstars

In transfer_from the allowance subtraction happens before _transfer gets the chance to check that from has sufficient token funds. As a result the following erroneous scenario is possible:

• Alice allows Bob to spend more tokens than she has
• Bob attempts to transfer_from more tokens than Alice can afford
• The execution does fail, but the error is returned only after the allowance is already decreased

At this point the transfer is prevented, but global state is modified in an unintended way.

Solution

A. Move the _transfer call before the subtraction B. Add a redundant from token balance check before the subtraction