Why does the following function not need a require statment?

function transferFrom(address from, address to, uint256 value) public returns (bool) {
    _allowed[from][msg.sender] = _allowed[from][msg.sender].sub(value);
    _transfer(from, to, value);
    return true;

This function is a part of the ERC20 standard from the OpenZeppelin library.

I would have thought that this function would first need to check the allowance of the msg.sender via a require statement that resembles the following:

require(_allowed[from][msg.sender] <= value);

Why is this require statement unnecessary?

  • 1
    Presumably, the sub() function (from the SafeMath library, I would guess?) reverts if the subtraction underflows.
    – user19510
    Commented Nov 27, 2018 at 3:18

1 Answer 1


_allowed[from][msg.sender] is an array which maintains the list of allowance provided to spender. Subtract function of SafeMath library here checks:

require(b <= a);

Which ensures that in this line


value is less than or equal to the provided allowance otherwise it will throw. In case of unallowed allowance, this require will only pass when value is 0 which doesn't affect anything except costing the gas to caller.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.