openzeppelin's implementation of and ERC-20 token is as follows:
function transferFrom(address from, address to, uint256 value) public returns (bool) {
_transfer(from, to, value);
_approve(from, msg.sender, _allowed[from][msg.sender].sub(value));
return true;
}
There is no allowance check in this function, maybe it's in _transfer?
function _transfer(address from, address to, uint256 value) internal {
require(to != address(0));
_balances[from] = _balances[from].sub(value);
_balances[to] = _balances[to].add(value);
emit Transfer(from, to, value);
}
No allowance check here either? hmmm maybe it's in _approve? But that would be a bit strange...
function _approve(address owner, address spender, uint256 value) internal {
require(spender != address(0));
require(owner != address(0));
_allowed[owner][spender] = value;
emit Approval(owner, spender, value);
}
still no allowance check. I have to be losing my mind here because there's no way open zeppelin would allow such a glaring and severe vulnerability through right?