Description

The backend server only listens to one specific event and does not track unstake events. As a result, when someone unstakes, it does not impact the points calculation.

Impact

A user can repeatedly stake and unstake to artificially inflate their awarded points.

Proof of Concepts

Backend sever only listen Stake events, therefore doesn't way to reduce the points balance if somebody unstake.

Recommended mitigation

Add listener for Unstake event and add logic to reduce the points balance.