Address in french translation file

[AbdussamadA]

A bitcoin address was added to the french language translation instead of a translated string. This shows up under preferences on android and at least one user has mistakenly sent bitcoin to this address. This was reported on the forum: https://bitcointalk.org/index.php?topic=5574363.msg66403710#msg66403710

Instead of translating "Avoid spending from used addresses" a bitcoin address is displayed. This was added to the file locale/fr_FR/electrum.po in this commit: 974d671

[SomberNight]

ACK, thanks for the report. :/
Not sure yet how to prevent this going forwards.

[SomberNight]

Note that neither the QML (Android) GUI, nor the Qt (desktop) GUI allows selecting this specific string, meaning the victim manually retyped that address in order to pay to it.

Still, this kind of thing could happen to any translated string atm, and we need to come up with some generic mitigation. I opened a more general tracking issue for that, #47

[SomberNight]

I regenerated the locale, and this translation (the bitcoin address) is now removed, in da42e0f. (The diff is too large to display in the webUI - but subsequent diffs are expected to be MUCH smaller.)

[AbdussamadA]

Who was the person who made this translation? The original commit is by you @SomberNight so were you the translator? The person who sent the bitcoins is hoping he gets refunded.

[yohanncfr]

I am the person who sent the bitcoins to this address, because my friend gave it to me. He believed it was the main address of his account.

I am surprised that the translator who inserted this address into the code is not known.

I would like the amount to be sent back to the original sending address so that I can pay my friend, who now clearly understands which Bitcoin addresses belong to him in Electrum.

[SomberNight]

Who was the person who made this translation?

This account on crowdin: https://crowdin.com/profile/gapril3490
It looks to be a random throwaway account.

You can filter the crowdin project activity to his account to see for yourself.

See image

The original commit is by you @SomberNight so were you the translator?

All the large "update translations" commits are generated, by the update.py script, which simply pulls in the translated strings from crowdin.com. The translations are created by the community. See flow here.

[AbdussamadA]

Thanks @SomberNight

This account on crowdin: https://crowdin.com/profile/gapril3490 It looks to be a random throwaway account.

Now you know who to contact @yohanncfr

[SomberNight]

@yohanncfr said in #47 (comment) :

I see that you are trying to find a solution so that this can no longer happen.
That said, I can see that the bitcoins I sent to this malicious address bc1qgdl5a90ccznwteha436fn52nekdwuu9ld32n3c are still there, and if I understand correctly, you are not contacting the person who inserted this address, since it was just a translator who worked only once.
My friend who copied this address was misled because, as a beginner, he truly believed that this address was the main address of his wallet. Even if this does not happen often, it still happened once to my friend, so a solution must be found to prevent people from being able to add Bitcoin addresses to Electrum.
My friend lost $570. I still hope that maybe Electrum can return this amount to the original address — my address — so that I can reimburse my friend.
I have been using Electrum for years, but only on my PC, so I had never seen this address before.

[SomberNight]

I see that you are trying to find a solution so that this can no longer happen.

Yes. Typically that's the most that can be done for a non-custodial wallet.
We are taking this seriously. If you look at our recent git activity, two devs spent most of the past week looking at this.

if I understand correctly, you are not contacting the person who inserted this address, since it was just a translator who worked only once.

It is almost certainly pointless to try to contact that person. We don't even have their email address. All we (or you!) could do is message them on crowdin. But their account was registered 3 minutes before adding 4 translated strings into Electrum in French and was never seen again. Imagine seeing a reddit comment from a throwaway account and trying to contact the poster - and not just expecting a reply but actually for them to send you money. :(
Still, you could try.

That said, I can see that the bitcoins I sent to this malicious address bc1qgdl5a90ccznwteha436fn52nekdwuu9ld32n3c are still there
My friend lost $570. I still hope that maybe Electrum can return this amount to the original address — my address — so that I can reimburse my friend.

I am sorry this happened to you and your friend. Not just in a corpo-speak LLM way, but am actually sorry. It caused me mental pain to read the original report and made me feel like shit. That's why we have been looking into ways how to prevent this happening again.

We can't "return" that specific UTXO as we don't have control of it. Some random guy managed to sneak in that bitcoin address into the translations without anyone noticing in time. Only that guy could return the money. And that's even assuming they control the address they sneaked in that string (as opposed to e.g. trolling and copying an address from a block explorer - note that the address was already used when added).

I guess what you are asking for is the developers paying for this mistake out of pocket...