returnTokensToOwner() in NounsDAOForkEscrow.sol can revert unexpectedly due to improper subtraction

Lines of code Vulnerability details Impact returnTokensToOwner in NounsDAOForkEscrow.sol can revert unexpectedly because of the numTokensInEscrow -= tokenIds.length; math in its logic. tokenIds is an externally supplied argument and it can be larger than the storage variable numTokensInEscrow...