How is transferFrom secure?

Question

function transferFrom(address sender, address recipient, uint256 amount) public virtual override returns (bool) {
    _transfer(sender, recipient, amount);
    _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "ERC20: transfer amount exceeds allowance"));
    return true;
}

Transfer happens before approve. Or does the method fail and everything reverts back if anything in the method fails?

Answer 1

If a transaction is reverted at any point in the transaction, the whole transaction is reverted. In this case, .sub(amount) will revert if amount is larger than the allowance, so the token transfer will be reverted as well in that case.