Solidity: order of lines with addition and subtraction operations

Question

After looking at many different custom token contracts I noticed that the standard of transferFrom() function is as follows:

  function transferFrom(address _from, address _to, uint256 _value) public returns (bool) {
    // some code...

    balances[_from] = balances[_from] -= _value;
    balances[_to] = balances[_to] += _value;
    allowed[_from][msg.sender] = allowed[_from][msg.sender] -= _value;

    // some code...
  }

Would this function be vulnerable to any kind of attack if these lines:

balances[_from] = balances[_from] -= _value;
balances[_to] = balances[_to] += _value;

were in opposite order:

  balances[_to] = balances[_to] += _value;
  balances[_from] = balances[_from] -= _value;

or there is no case in which a malicious user could hack this code?

Answer 1

AFAIK, Interchanging these 2 lines will not cause any vulnerability. But the question is why you want to do so? Ideally, we first subtract balance from sender then add it to the receiver.

This could harm only in cases if the first line executes and the second doesn't. But I guess this should never happen. Even if the gas supplied with the transaction is finished after the first line, the complete transaction will be rolled back. So you can go with interchanging these lines.

Answer 2

I second that interchanging the two lines will not cause any vulnerability, however if you send any form of value before updating the 'balances' mapping, then you might be vulnerable to reentrancy attacks. Just make sure you implement the two lines before sending any type of value regardless of order(even though it would be best practices to subtract and then addition afterwards logically)