Alert Source Discuss
🚧 Stagnant Standards Track: Core


Authors Vitalik Buterin (@vbuterin)
Created 2020-09-04
Discussion Link

Simple Summary

Add a SET_INDESTRUCTIBLE (0xA8) opcode that prevents the contract from calling SELFDESTRUCT (0xFF).



The intended use case would be for contracts to make their first byte of code be the SET_INDESTRUCTIBLE opcode if they wish to serve as libraries that guarantee to users that their code will exist unmodified forever. This is useful in account abstraction as well as other contexts.

Unlike EIPs that disable the SELFDESTRUCT opcode entirely, this EIP does not modify behavior of any existing contracts.


Add a transaction-wide global variable globals.indestructible: Set[Address] (i.e. a variable that operates the same way as the selfdestructs set), initialized to the empty set.

Add a SET_INDESTRUCTIBLE opcode at 0xA8, with gas cost G_base, that adds the current callee to the globals.indestructible set. If in the current execution context the callee is in globals.indestructible, the SELFDESTRUCT opcode throws an exception.


Alternative proposals to this include:

  • Simply banning SELFDESTRUCT outright. This would be ideal, but has larger backwards compatibility issues.
  • Using a local variable instead of a global variable. This is problematic because it would be broken by DELEGATECALL.

Backwards Compatibility


Security Considerations

This breaks forward compatibility with some forms of state rent, which would simply delete contracts that get too old without paying some maintenance fee. However, this is not the case with all state size control schemes; for example this is not an issue if we use ReGenesis.

If SELFDESTRUCT is ever removed in the future, this EIP would simply become a no-op.

Copyright and related rights waived via CC0.


Please cite this document as:

Vitalik Buterin (@vbuterin), "EIP-2937: SET_INDESTRUCTIBLE opcode [DRAFT]," Ethereum Improvement Proposals, no. 2937, September 2020. [Online serial]. Available: