Timelock Delay Recommendation Tool (Risk-Based)

WHAT IT DOES

This tool reads the on-chain configuration of any OpenZeppelin-compatible TimelockController contract and provides a data-driven recommendation for its minimum delay setting. It retrieves the current delay (in seconds), enumerates the proposers and executors via role-based membership checks (PROPOSER_ROLE, EXECUTOR_ROLE), identifies the admin (DEFAULT_ADMIN_ROLE) if set, and calculates a risk score based on these parameters. The output includes a plain-language recommendation, a risk meter (low/medium/high), and a detailed rationale explaining why the current delay may be too short, too long, or appropriately balanced. The tool also flags missing roles, single-proposer setups, and extremely short delays as high-risk items.

HOW TO USE

Connect your wallet via the BGWallet bridge — this provides the RPC endpoint for reading the chain; the tool never initiates transactions. Select the network where your timelock contract is deployed. Enter the contract address (e.g., an OpenZeppelin TimelockController instance or a compatible implementation). Click "Analyze & recommend". The tool fetches the current delay, queries role memberships for proposers and executors, and checks for an admin role. It then applies a heuristic formula that combines a delay score (based on how long the delay is) with a role score (based on the number and distribution of proposers and executors). The results card shows the raw configuration alongside a recommended course of action, such as increasing the delay, adding more proposers, or ensuring a secure admin setup.

ONE TECHNICAL SECTION

The tool uses a minimal ABI to call standard TimelockController functions: getMinDelay() returns the current delay in seconds; getRoleMemberCount() and getRoleMember() are used to enumerate addresses for the PROPOSER_ROLE and EXECUTOR_ROLE (using keccak256("PROPOSER_ROLE") and keccak256("EXECUTOR_ROLE") respectively); and DEFAULT_ADMIN_ROLE is checked for an admin address. All calls are sequential eth_call requests via the ethers.js Contract abstraction — no transactions are sent and no gas is consumed. The recommendation logic assigns a risk score from 0 (lowest) to 1 (highest) based on a weighted combination of the delay category (0 seconds = 1.0, very short = 0.9, short = 0.7, medium = 0.4, long = 0.2, very long = 0.3, extreme = 0.6) and the role configuration (no roles = 1.0, no proposers = 0.9, single proposer with no executor = 0.7, single proposer and single executor = 0.5, multiple proposers with no executor = 0.6, balanced = 0.2). The final score determines the risk level and generates specific, actionable recommendations.

WHAT IT CANNOT SEE

This tool cannot predict future governance attacks, such as compromised keys, collusion among proposers, or malicious proposals that are deliberately scheduled. It cannot assess the security of the proposer or executor addresses themselves — it does not know if they are hardware wallets, multi-sigs, or vulnerable EOAs. It cannot evaluate off-chain proposal processes, such as community voting, forum discussions, or multi-party coordination. It cannot detect time-based or conditional logic in the target contract that might override the min delay, nor can it see custom timelock implementations that deviate from the standard interface. It also does not analyze historical execution patterns, queued transaction volume, or gas costs associated with executing operations. The recommendation is purely statistical and heuristic; it is not a guarantee of safety or optimal configuration.

PLEASE NOTE

This tool works exclusively on EVM-compatible chains that support the OpenZeppelin TimelockController interface. Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP are not supported. The contract address must be a valid timelock deployment on the selected network. If the contract does not implement the expected functions, the analysis will fail. The tool is read-only and does not require any token approvals or transaction signing. Use it as a starting point for reviewing your timelock configuration, not as a substitute for professional security audits.