What is a timelock in crypto?

A timelock in crypto is a rule that keeps something from happening until a chosen moment. That moment can be a date, a block height or an amount of time after another event. Timelocks appear in two main places: smart contracts that delay governance changes on networks like Ethereum, and scripts that control when bitcoin can be spent.

What is a timelock smart contract?

A timelock smart contract sits between a decision and its execution. OpenZeppelin's documentation describes a Timelock Controller as a contract that enforces a delay between approving a privileged action and running it. Instead of a developer key owning the protocol's admin functions directly, the timelock becomes the owner, so every privileged call has to wait.

Each operation moves through stages. It is scheduled, waits while the timer runs, becomes ready once the minimum delay passes, and is then executed. Authorized cancellers can stop it before it runs. Changing the minimum delay itself must also go through the timelock.

What is a timelock controller in governance?

In a DAO, token holders vote on proposals, and the timelock carries them out. OpenZeppelin's governance guide says the Governor contract queues a passed proposal in the timelock, which executes it after the delay. For that reason, the timelock should hold the protocol's funds, ownership and access roles. OpenZeppelin warns that giving extra accounts the proposer or canceller role is risky, because they could bypass governance or block valid proposals.

Real protocols follow this pattern. Uniswap's docs say a passed proposal must sit in its timelock for at least two days before execution. Compound's docs describe queuing a successful proposal, with an example waiting period of two days, after which any address can execute it. Our guide to governance tokens covers the voting side.

Why do DeFi protocols use timelocks?

The main reason is a safety window. OpenZeppelin says a timelock lets users exit the system if they disagree with a decision before it is executed. Anyone can watch the queue, see a pending upgrade or fee change, and withdraw funds if they do not like it. Developers and security teams also get time to spot a malicious or broken proposal and cancel it.

A timelock is only as strong as its settings. A very short delay, or an admin key that can skip the queue, gives users little real protection. Checking who holds those roles is part of judging whether a protocol is as decentralized as it claims.

How do Bitcoin timelocks work?

Bitcoin builds timelocks into its transaction rules and Bitcoin Script. There are a few types:

• nLockTime is a field that stops a transaction from being mined until a given block height or time. BIP 65 notes that on its own it cannot prove a coin is unspendable before then, because another signed transaction could exist.
• CheckLockTimeVerify (CLTV), defined in BIP 65, puts an absolute lock inside the output's script, so the coins cannot move until the set height or time. Its listed uses include escrow, refunds, payment channels and freezing funds.
• CheckSequenceVerify (CSV), defined in BIP 112 together with BIP 68, adds a relative lock. Coins can be spent only once the output reaches a minimum age after confirmation.

BIP 112 explains that the Lightning Network relies on these relative delays. They give a channel partner a window to claim funds if the other side broadcasts an old channel state. More on that design is in what the Lightning Network is.