Basically will "require" do the job here? Can someone send the request from account with 0 causing underflow somehow or not? thanks!
Since the require will prevent msg.sender to withdraw any value greater than their balance, then I think yes, the require will do the job for you. It is highly unlikely that
0 - xyz will occur which will cause the underflow, where
xyz is any number greater than
0 -which we will assume as the balanceOf[msg.sender] value.
Now with regards to the overflow concern you are using the
.transfer method which is mostly viewed as safe and a fast way to send eth within a contract though I am not sure if it does prevent overflows from happening even if it is highly unlikely to happen. But if you want to be sure and check maybe you can do
require((msg.sender.balance + xyz) > msg.sender.balance)