Safe subtracts two uints and returns an error if the result is invalid.
Underflows when result is less than 0.
Safe subtracts two uints and returns an error if the result is invalid.
Underflows when result is less than 0.