Timelocks and Execution
Safe upgrades.
Timelocks and Execution is a free Web3 & DApp Development Fundamentals lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Web3 & DApp Development Fundamentals learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Timelocks Exist
A timelock is a mandatory delay between when a proposal passes and when it executes.
It protects users by giving them time to react to changes they disagree with — for example, withdrawing funds before a risky upgrade.
The TimelockController
OpenZeppelin's TimelockController is a contract that schedules, delays, and then executes operations.
The Governor proposes and queues actions into the timelock, which actually owns the protocol's admin rights.
contract Timelock is TimelockController {
constructor(uint minDelay, address[] proposers, address[] executors)
TimelockController(minDelay, proposers, executors, msg.sender) {}
}Schedule, Wait, Execute
Operations flow through three steps:
- schedule — queue the action with a delay
- wait — the minDelay must elapse
- execute — run the action after the delay
timelock.schedule(target, value, data, predecessor, salt, delay);
// ... wait minDelay ...
timelock.execute(target, value, data, predecessor, salt);The minDelay Parameter
The minDelay sets how long every scheduled operation must wait. Common values range from 1 to 7 days.
Longer delays mean more safety but slower governance — a deliberate trade-off each DAO must tune.
Roles in the Timelock
The timelock uses access roles:
- PROPOSER — can schedule operations (the Governor)
- EXECUTOR — can run them after the delay
- ADMIN — manages roles (often renounced)
Timelock Owns the Protocol
For governance to be meaningful, the timelock contract should hold the protocol's admin and ownership rights — not any individual.
This ensures every privileged change must pass through the full govern-then-delay pipeline.
protocol.transferOwnership(
address(timelock)
);Defense Against Malicious Proposals
If an attacker sneaks a harmful proposal through voting, the timelock delay is the last line of defense.
The community can spot the queued action and exit or coordinate a response before it executes.
Predecessor and Salt
Each scheduled operation can specify a predecessor (an operation that must run first) and a salt to make its identifier unique.
These let DAOs order dependent operations and avoid hash collisions between similar actions.
Cancelling Operations
A scheduled operation can be cancelled before execution by an address with the canceller role.
This provides an emergency brake if a queued action is found to be dangerous during the delay window.
timelock.cancel(operationId);Upgrades Done Safely
Combining Governor + Timelock + a proxy pattern lets DAOs upgrade contracts safely: vote, queue, delay, then execute the upgrade.
Every step is transparent and reversible up until execution, balancing flexibility with security.
Putting It Together
The timelock enforces a delay between approval and execution, owns the protocol's privileges, and uses roles plus cancellation to keep upgrades safe.
It is the crucial buffer that makes on-chain governance trustworthy.
Quick Check
Test your timelock understanding.
Recap: Timelocks and Execution
You learned that:
- A timelock delays execution after a proposal passes
- TimelockController schedules, waits, then executes
- minDelay tunes the safety vs speed trade-off
- The timelock should own the protocol; roles control access
- Operations can be cancelled during the delay
Course complete! Next course: Layer 2 and Scaling.
Frequently asked questions
Is the “Timelocks and Execution” lesson free?
Yes — the full text of “Timelocks and Execution” is free to read here on the web, and the Web3 & DApp Development Fundamentals course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Web3 & DApp Development Fundamentals course, upgrade to CoddyKit PRO.
What will I learn in “Timelocks and Execution”?
Safe upgrades. You practise Web3 & DApp Development Fundamentals with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Web3 & DApp Development Fundamentals?
No prior experience is required. Web3 & DApp Development Fundamentals on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Timelocks and Execution” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Web3 & DApp Development Fundamentals lesson?
Yes. Every Web3 & DApp Development Fundamentals lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- What Is a DAO
- Governance Tokens
- Proposals and Voting
- Timelocks and Execution