The rider billed 50 km. The trip was 2 km. Nothing crashed.
DETAIL · CLAIMED DISTANCE · MULTIVENDOR MARKETPLACE · DELIVERY
General notes
- 01The delivery fee was priced on the distance the rider's app reported. A number in a request body, treated as a measurement.
- 02Fix: the server computes distance itself, with the haversine formula over coordinates it already stores. The app's number is ignored.
- 03Average recorded distance fell about 40% overnight. That gap was the fraud, made visible.
As posted
One rider found the most profitable bug on the marketplace I architected. He never wrote a line of code.
The delivery fee was priced on distance. The distance came from the rider's app. It was a number in a request body, and the server treated it like a measurement.
He was reporting 50 kilometres on 2-kilometre deliveries. Nothing crashed. No alert fired. The books just drifted, one order at a time.
The fix was not clever. The server already stored the pickup and drop-off coordinates. It started computing the distance itself, with the haversine formula, and ignoring the number the app sent.
Average recorded distance fell about 40% overnight. That gap was the fraud, made visible.
The lesson has outlived the bug. In a two-sided marketplace, anything the client can claim, the client will lie about. Not because riders are bad people. Because the incentive is sitting right there in the payload.
Whoever benefits from a number must not be the one who supplies it.
Sheet 003. Non-conformance report 001.