Revokable contract with RevokerRole

[litvinjuan]

I would like to start a short discussion about a possible new contract at the lifecycle namespace, next to the pausable one.

The Pausable contract allows developers to pause a contract's functions, and later, if desired, unpause it. This means that in case of emergency, or if a bug is detected, someone can call the pause method on the contract and quickly disable all functions with the appropriate modifier.

I would like to propose we add a Revokable contract, with its corresponding RevokerRole (exactly same design as the Pausable feature) that allows developers to permanently disable a contract if needed. This means, should a problem arise, they can simple revoke the contract and rest asured that in not way will that contract ever be unpaused.

In its workings, it consists of a Pausable contract without the unpause method.

I have already written the code for the feature described, and later realized I had not opened an issue, so I created the PR so we can view the changes while discussing the feature. You can find the PR here

A variation of this feature would be to consider the Pauser and Revoker roles as one, this is, a LifecicleController role, or rather some better name. This would mean that a signle contract can implement both Pausable and Revokable, for temporary and definitve disabling of the contract, but instead of having to manage two roles, one for each feaure, they could simply have a single role that is in charge of pausing, unpausing or revoking the contract.
This last part is rather controversial, but I think it's worth a short discussion about whether the role is supposed to enable pausing or managing the whole lifecycle.

[abcoathup]

Hi @litvinjuan,

Thanks for starting this discussion. We may want to move this to the community forum (https://forum.openzeppelin.com/), as it is easier for the entire community to see and hence participate.

Are you using Revokable contracts yourself or have you some examples of them being used? Are there specific circumstances where a contract is permanently paused?

Using Pausable it is possible to set a contract as permanently paused with no ability to unpause.
First an account with the PauserRole calls pause on the Pausable contract and then every account with the PauserRole calls renouncePauser until there are no accounts with the PauserRole.

Do you think there is a need for revokable functionality beyond what can be done already with Pausable?

[abcoathup]

Hi @litvinjuan,

As part of our work on reducing complexity, we'll move along with the initiative to revamp our Access Control solution, which will let us remove related contracts (ERC20Mintable, MinterRole, PauserRole, and so on) and have the users instead build permissioned systems on their own.

Related discussion will be carried out on the Redesigning Access Control forum post.

Originally posted by @nventuro in #2068 (comment)

I suggest joining the discussion on Redesigning Access Control in the Community Forum to discuss how a revoker could be implemented.

I have added an onhold label whilst access control is redesigned.

[litvinjuan]

I am currently using both Pausable and Revokable for different contexts. I feel like you could replicate revokability as you said, pausing and having all pausers renouncing. However, you still depend on all other pausers actually renouncing. In a trustless contract, who would renounce first? How can they ensure the others renounce as well?

[abcoathup]

Hi @litvinjuan,

Good point on trustless revoking.

I encourage you to join the discussion on Redesigning Access Control in the Community Forum to discuss how a revoker could be implemented.

[frangio]

This primitive could make sense in some contexts but we don't see a widespread enough need that would justify including it in OpenZeppelin Contracts.