governance timelock
A governance timelock is a mandatory waiting period inserted between the moment a proposal passes and the moment it actually executes. The vote succeeds, the action is queued, and then a clock — typically a day or several days — must run out before anyone can trigger execution. The whole purpose is to create a window: time during which the community can read exactly what is about to happen and, if it looks malicious or broken, react — by raising alarm, organizing opposition, or simply withdrawing their funds before the change lands.
Technically, the timelock is its own contract that holds the protocol's privileged powers (often it owns the admin rights to upgrade contracts and move the treasury). The governance system cannot act directly; it can only ask the timelock to queue a transaction, which records the call along with the earliest timestamp at which it may run. Until that delay elapses, execute() reverts. Because the queued transaction is public the entire time, anyone can inspect the precise calldata, decode it, and verify that what was approved in words matches what will actually run — closing the gap where a benign-sounding proposal hides a malicious call.
The timelock is a core defense against governance attacks and buggy upgrades, and it is the user's escape hatch: even a successful hostile takeover cannot instantly seize the treasury if a two-day delay stands between the vote and the transfer. The trade-off is responsiveness. A delay that protects users also prevents the protocol from reacting quickly to a real emergency, which is why many systems pair a timelock with a separate, faster-acting guardian or pause mechanism for genuine crises. Choosing the delay is a balance: long enough for users to exit, short enough that the protocol is not paralyzed.
// Compound-style Timelock owns the protocol's admin powers timelock.queueTransaction(target, value, signature, data, eta); // eta = now + delay (e.g. 2 days) // ... the queued call is public; anyone can decode and scrutinize it ... // only after block.timestamp >= eta: timelock.executeTransaction(target, value, signature, data, eta);
Governance can only queue; execution waits out the delay, giving users time to inspect and exit.
A timelock does not stop a bad proposal from passing — it stops a passed proposal from executing immediately. Its protection only works if someone is actually watching the queue during the delay; an unwatched timelock buys time that nobody uses.