Securence of ERC20 transferFrom

Please explain, what prevents such kind of attack ?

Imagine Alice calls approve(Contract.address, amount) to invoke Contract’ method() which withdraws from her address. Then imagine Bob has accidentally found it out, and he wants to prevent Alice invokes method(). So he waits until Alice’ approve transaction is mined, then calls transferFrom(Alice.address, Contract.address, amount) and pushes it faster then Alice pushes method(). In the end, Contract receives money, but method cannot be invoked because allowance now is zero. And so money is lost for Alice.

[Skyge]

@roleengineer I have asked the same question yesterday, I think someone made a mistake in a pr, at least at the original version, it will check

require(_value <= allowed[_from][msg.sender]);

at first.

[Skyge]

By the way, For support questions (rather than Feature Requests or Bug Reports), as @abcoathup 's suggestion that you can ask in the : OpenZeppelin Community Forum that way the entire community can help answer your question.