I think what you are proposing is smart - though there are risks if you are distributing the app to the employees (do they need to be in the building to use the app, if not, can they set their attendance remotely (=BAD)).
I would suggest the following:
(a) Buy a fingerprint scanner, RFID scanner, or whatever your preferred method of distributing is.
(b) Write a small program that processes the swipe in and swipe outs from this device and uses the REST API to generate time logs based on the input data.
To explain (b):
Each user has an identifier (fingerprint ID, RFID identifier, etc). The program you write has a list of all the users. When the user swipes in, the program sends a REST API message to ERPNext to see if there are any open time logs for the user. If there are not, the system creates a new time log where the user/employee is set, as well as the start time, activity type, etc. If there is an active time log for the user, the system updates the time log with the end time and then submits it. The program can then find out the total hours worked in that shift and report it back to the user through the interface (if needed).
This should be a very simple program to write. You could even create a custom field for employees/users that keeps track of what their RFID identifier (or fingerprint “code”?) was so that the program doesn’t have to store that list internally.
What do you do if a user forgets to swipe in/out? You’d need to have some sort of scheduled task that makes sure that the user time logs can’t be open (from start time to current time) for more than 16 hours or something. If they do, there should be a message sent to HR so they can investigate. Otherwise the next time the employee tries to sign in the log would end and they’d have a 24 hr shift. If they forget to swipe in, you could have the same issue starting when they swipe out.
Finally, (and it’s just my personal opinion) I think I agree with @vrms that giving employees access to ERPNext is the ideal way to move forward, if you are going to be having them submit car mileage, gas receipts, etc. It seems like a lot of duplicating work to implement the same functionality as ERPNext already has. If it’s just signing in and out for attendance it can be cumbersome, but beyond that I don’t see any reason not to just use ERPNext.