A Timelock is Only as Good as Whoever’s Watching It

Timelocks are a common security mechanism designed to mitigate the effects of a cyberattack in the Web3 space. Often, smart contracts will be configured so that privileged actions, such as a smart contract upgrade, will not execute for 48 hours after approval.

In theory, timelocks reduce a Web3 project's risk exposure by allowing malicious privileged actions to be blocked before execution. However, their utility depends on whether someone is actually monitoring these privileged actions and whether they respond in time.

What Makes for an Effective Timelock?

Blockchains are designed to be immutable, which means that malicious transactions can be irreversible on-chain. Timelocks are designed to prevent this by giving admins the potential to block malicious actions before they're executed.

Timelocks can be an effective security control if they include:

• Readable Content: Transactions are submitted on-chain as raw bytes and can differ from their official descriptions. Reviewers need access to a human-friendly version of what's actually being executed on-chain.
• Someone Watching: Timelocks just delay transactions to permit review. Someone needs to be watching, ideally being notified via alerts for high-risk actions.
• Way to Act: If a malicious action is detected, the reviewer needs some way to take action. Options include an exit, veto, cancel, or pause.
• Sufficient Time: A timelock needs to provide time for someone to take the appropriate action. For example, if the chosen action is to allow people to exit, then the exit window should be enough that the users have a reasonable amount of time to be notified of the action, decide to exit, and complete the exit.

Where Timelocks Fall Short

Timelocks are an important security measure in Web3, but they're not perfect. Some of the ways that they can fail include:

• No One Acts: Timelocks only work if someone uses the provided window to act. In April 2022, Beanstalk suffered an estimated $182 million hack after a malicious proposal executed after the 24-hour window elapsed. The attacker used flash loans to create a supermajority, then executed the proposal via an emergencyCommit.
• Approval/Execution Mismatch: In May 2023, Tornado Cash suffered a hack where voters approved a proposal that copied existing logic. After approval, the approved code was destroyed and replaced with a malicious version at the same address that was then executed. This method was largely prevented by the later 2024 Cancun upgrade to Ethereum.
• Built-In Bypasses: Some protocols have security councils that can bypass the delay process. This can be dangerous if the council is malicious or their keys are compromised.

Securing Web3 with Timelocks

Despite their limitations, timelocks are a valuable security control in Web3. Since blockchain transactions are often irreversible, blocking malicious actions is an essential defense.

For protocols, best practices for implementing timelocks include:

• Alert on every queued transaction
• Decode proposals into a human-friendly report
• Bind executed code to a code hash to prevent replacements
• Ensure that delays are longer than the time required to exit
• Limit emergency powers
• Give veto power to an independent reviewer to reduce the risk of compromised reviewers

Users of Web3 protocols should also be aware of the risks and of the limitations of timelocks. They should ask who is responsible for review, how delays compare to exit times, and what bypasses are in place.

Educational content, not legal, financial, investment, or professional security advice. Terms