Why does this function not need a require statement?

Question

Why does the following function not need a require statment?

function transferFrom(address from, address to, uint256 value) public returns (bool) {
    _allowed[from][msg.sender] = _allowed[from][msg.sender].sub(value);
    _transfer(from, to, value);
    return true;

This function is a part of the ERC20 standard from the OpenZeppelin library.

I would have thought that this function would first need to check the allowance of the msg.sender via a require statement that resembles the following:

require(_allowed[from][msg.sender] <= value);

Why is this require statement unnecessary?

Answer 1

_allowed[from][msg.sender] is an array which maintains the list of allowance provided to spender. Subtract function of SafeMath library here checks:

require(b <= a);

Which ensures that in this line

_allowed[from][msg.sender].sub(value); 

value is less than or equal to the provided allowance otherwise it will throw. In case of unallowed allowance, this require will only pass when value is 0 which doesn't affect anything except costing the gas to caller.