Enabling smart contract cleanup before deletion by Hedera network

[mshakeg]

Background

Currently, when a smart contract deployed on the Hedera network is deleted due to for example failure to pay rent, the contract is removed from the network without giving the contract an opportunity to perform any cleanup actions. This can lead to situations where the contract leaves behind unwanted data or invalid state on contracts it may be coupled to, which may cause issues for contracts that may depend on the deleted contract. Specifically, a contract may want to perform any of the following common(i.e. typical on Ethereum) cleanup actions before being deleted:

1. Emit an event indicating that the contract is being deleted. Subgraphs and other interested parties may find this useful.
2. Transfer any remaining tokens or assets held by the contract to a designated account/s.
3. Trigger any finalization logic that was designed to be executed at the end of the contract's lifecycle, for example, a Child contract created by a Factory contract may want to invoke a Factory contract function indicating that the Child is about to be deleted.

Unlike Hedera, a contract on Ethereum may only ever be deleted by the contract itself by invoking the (recently deprecated)SELFDESTRUCT opcode. Thus any cleanup a contract may require can be executed before that opcode is invoked. A simple example of how this typically works is as follows:

contract Destructible {

  address payable immutable admin;

  constructor(address _admin) {
    admin = payable(_admin);
  }

  modifier onlyAdmin() {
    require(msg.sender == admin, "NOT_ADMIN");
    _;
  }

  // the contract can be selfdestroyed if the admin calls this function
  function destroy() onlyAdmin public {
    cleanup(); // invoke the cleanup function before "selfdestruct"
    selfdestruct(admin); // any remaining ether is transferred to the admin
  }

  function cleanup() internal {
    // execute any cleanup logic before "selfdestruct"
  }
}

Proposal

Before the Hedera network deletes a smart contract it should attempt to execute a transaction that calls a cleanup() function with a predefined gas limit(say 500_000) and with msg.sender equal to a predefined address that identifies that the transaction is being executed by the Hedera network. If this transaction fails due to:

1. the cleanup() function not being implemented by the contract or
2. due to the cleanup() function reverting or
3. due to insufficient gas(developers should obviously implement their cleanup() function to not exceed the predefined gas limit)

then the contract is deleted in any case.

A simple example of how this would work is as follows:

contract Deletable {

  // a predefined address that identifies msg.sender as the Hedera network
  address constant HEDERA_NETWORK = address(0);

  modifier onlyHedera() {
    require(msg.sender == HEDERA_NETWORK, "NOT_HEDERA_NETWORK");
    _;
  }

  function cleanup() onlyHedera public {
    // execute any cleanup before the Hedera network deletes the contract
  }
}

[mgarbs]

Thank you for sharing your proposal @mshakeg, we appreciate your inputs inside and outside the scope of this discussion. With respect to this proposal, if you want to guarantee that a contract can only be deleted internally with selfdestruct, when you create a contract without an adminKey you guarantee that.

Additionally, in the case of rent archiving/cold storing contract state, if a contract is being archived because it didn't pay rent, all its state and bytecode gets archived into cold storage which can be later retrievable for a fee. It won't be removed or need cleaning in that sense. Does that make sense?

[mshakeg]

@mgarbs thanks for the feedback, I'll try to address it below.

if you want to guarantee that a contract can only be deleted internally with selfdestruct, when you create a contract without an adminKey you guarantee that.

That's not really what I'm proposing, my understanding is that when a contract is deleted on Hedera either due to a ContractDeleteTransaction or due to the system deleting a contract due to expiration the selfdestruct opcode is never invoked, but instead some other flow is executed outside the EVM. This proposal is for the system(i.e. hedera) to attempt to call a cleanup() function before executing that contract deletion/archival flow for contracts deleted either via ContractDeleteTransaction or deleted by the system.

---

I don't see any mention of contract archival in the smart contract rent faqs. In any case even with archival since the contract is practically deleted(as it's not accessible to EOAs and other contracts from within the EVM) developers may still want to implement a cleanup() function before the contract is archived.

[mgarbs]

Thanks for your input @mshakeg. I appreciate the time you've taken here for your considered reply. You're correct that the current implementation doesn't invoke the selfdestruct opcode when a contract is deleted.

Considering your proposal of calling a cleanup() function before contract deletion, I see the potential benefits for developers who want to ensure that certain actions are taken before the contract is removed. This could be particularly useful for situations where data consistency and cleanup are essential.

Thinking on the archival piece, if we call cleanup() before the contract is archived, what happens when the fee is paid and the contract is brought back from cold storage? Will anything be affected? What would that look like? @Nana-EC what are your thoughts about this?