The check that never fails

Click the line whose check is meaningless and lets an attacker underflow to a huge balance:

1// Solidity 0.7 — no built-in overflow checks2function transfer(address to, uint256 amt) public {3  require(balance[msg.sender] - amt >= 0);4  balance[msg.sender] -= amt;5  balance[to] += amt;6}