# Exfiltrating a victim's exact location (to within 5m)

Bumble's server-rounded distance API allowed trilateration via distance-flip boundary probing to pinpoint any user's location to ~5m.

- Payout: hidden
- Severity: high
- Program: Bumble
- Found by: robertheaton
- Disclosed: 2021-07-21
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1234406
- Library page: https://bugbountylibrary.com/r/h1%3A1234406
- Tags: area:mobile domain:api domain:mobile impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:high technique:recon technique:source-review vuln:info-disclosure

**Target:** Bumble API distance endpoint (eu1.badoo.com)
**Root cause:** Server rounds exact distance to integer miles before returning, but the rounding boundary is observable; probing where the returned distance flips reveals exact radius, enabling precise trilateration.
**Steps:**
1. Create victim and attacker accounts; capture both session IDs via Burp.
2. Set victim to a fixed target location via API.
3. Place attacker near victim's approximate area (from UI summary like 'Lambeth').
4. Step attacker in small increments; when returned distance changes, record midpoint as exactly the smaller distance from victim.
5. Refine with smaller steps near the flip to increase precision.
6. Repeat from 3 different starting positions.
7. Draw 3 circles (center=flip point, radius=distance); intersection gives victim location to ~5m.
**How found:** Noted Tinder's 2014 trilateration bug; hypothesized Bumble's server-side rounding uses floor(), so the rounding boundary is a precise distance oracle; probed flip points to recover exact radii.
**Exploitation:** Attacker uses API to move own account around victim's vicinity, observes integer-mile distance flips to derive exact radii at 3 points, then trilaterates to ~5m accuracy in ~10 seconds. Works on any user ID known (matches, past matches, encountered profiles); mass enumeration possible with multiple wide-filter accounts.
**Escalation:** Mass exfiltration: multiple accounts with wide filters cycle encounters to harvest user IDs, then trilaterate each location.
**Insight:** When a server rounds a sensitive value before returning it, the rounding boundary itself is an oracle: binary-search the flip point to recover the pre-rounding value to arbitrary precision, then trilaterate.