Summary

The constant used for interacting with the Steaking contract employs a precision factor of 1e3, as defined in utils/constants.js. This precision level restricts accuracy to three decimal places, which can result in a loss of precision when handling ETH amounts and potentially lead to inaccuracies in point calculations.

Vulnerability Details

The server currently multiplies the staked ETH amount by 1e3 to convert it into points. However, ETH transactions can involve amounts with up to 18 decimal places. By only retaining three decimal places, the system introduces a rounding error.

The precision loss can accumulate over multiple transactions, leading to discrepancies in the user's point balance. This could result in users receiving fewer points than they are entitled to, which could undermine trust in the system and lead to financial inaccuracies, especially in scenarios involving high transaction volumes or small fractional ETH amounts.

Recommendations

Increase the precision factor to 1e18 to align with the precision of ETH transactions, which allows for accurate tracking of even the smallest fractional amounts. This change will mitigate the risk of precision loss and ensure that user balances are accurately calculated and stored.