pub fn checked_sub(a: u64, b: u64) -> Result<u64, ProgramError>
Checked u64 subtraction: returns ArithmeticOverflow on underflow.
ArithmeticOverflow