Submitted by gpersoon, also found by cmichel and pauliax
If the function delegatedTransferERC20 is called from the owner  (e.g. msg.sender == _getOwner ) then
erc20Approvals[keccak256(abi.encodePacked(msg.sender, token))] doesnt have to set, so it can have the value of 0.
If you then subtract the amount, you will get an error and the code will revert:
A workaround would be to call approveTransferERC20 also for the owner.
Recommend also adding if(msg.sender != _getOwner()) before
xyz-ctrl (Visor) acknowledged:
ghoul-sol (Judge) commented:
ztcrypto (Visor) patched:
