Fix #1, don't xfer negative amounts

Security is hard.