Search Apps Documentation Source Content File Folder Download Copy Actions Download State String Boolean Number Struct Map Slice Pointer Function Closure Reference Nil Package Type Interface Unknown

timelock_guardian source realm

Constants 1

const MinDelayFloor, MaxDelay, GracePeriod, MaxTargetsPerOwner, MaxPendingPerTarget, MaxTargetNameLen, MaxDataLen, MaxRenderActions, RenderIndexCap 

 1const (
 2	// MinDelayFloor is the smallest minimum delay a target may register.
 3	// A timelock with a 1-second delay protects nothing.
 4	MinDelayFloor = int64(60)
 5
 6	// MaxDelay bounds both registered minimum delays and per-action
 7	// delays. Also the overflow guard: MaxDelay seconds in nanoseconds
 8	// is far below int64 range, so ExecuteAfter arithmetic cannot wrap
 9	// into the past.
10	MaxDelay = int64(10 * 365 * 24 * 3600) // 10 years
11
12	// GracePeriod is how long an action stays executable once ready.
13	// After it, the action expires: something scheduled and forgotten
14	// cannot be sprung on a target years later.
15	GracePeriod = int64(30 * 24 * 3600) // 30 days
16
17	// Quotas are PER-OWNER only (re-audit round 3): any global cap is a
18	// shared resource a few sybil accounts can exhaust forever (10y
19	// delays defeat expiry sweeping), bricking every other tenant. With
20	// per-owner quotas an attacker only ever consumes their own budget;
21	// state growth is priced in gas and funded accounts.
22	MaxTargetsPerOwner  = 10
23	MaxPendingPerTarget = 20
24	MaxTargetNameLen    = 64
25	MaxDataLen          = 2000
26	MaxRenderActions    = 100
27	// RenderIndexCap bounds the render-ordering index (fix Y4): the
28	// index self-trims to this size, so reaping an entry from it is a
29	// bounded scan no matter how many actions the realm has ever seen.
30	// Records older than the window stay in state (GetAction/IsExecuted
31	// are map reads and permanent); they only leave the front page.
32	RenderIndexCap = 2 * MaxRenderActions
33)
source

Functions 15

func AcceptTargetOwnership

crossing Action 
1func AcceptTargetOwnership(cur realm, targetName string)
source

AcceptTargetOwnership completes a pending ownership offer; only the nominee can accept. The nominee's quota is checked HERE — consent time — so an offer can never overfill an account that did not agree to carry it.

func Cancel

crossing Action 
1func Cancel(cur realm, actionID string) string
source

Cancel removes a pending action. Only the target's CURRENT owner can cancel (re-audit: the scheduling creator's rights must not survive an ownership transfer). The record is reaped; history is the event.

func Execute

crossing Action 
1func Execute(cur realm, actionID string) string
source

Execute marks an action as executed. Anyone can call this — the timelock is the protection, not the executor's identity. The action must exist, be pending, its delay elapsed, and its grace window not yet expired.

func Expire

crossing Action 
1func Expire(cur realm, actionID string) string
source

Expire reaps a provably expired action. Permissionless (fix Y2): an expired action decides nothing — reaping it only writes down what the clock already decided — so anyone may free the quota slot it holds. This is the recovery valve that makes a wedged target impossible: before it, a phantom expired entry consumed quota and blocked SetGuardian until a global sweep happened to reach it; now its own target's owner — or anyone else — reaps it directly.

func GetAction

Action 
1func GetAction(actionID string) string
source

GetAction returns a formatted summary of a single pending or executed action. Cancelled/vetoed/expired actions are reaped — their history is in emitted events.

func GetPending

Action 
1func GetPending() string
source

GetPending returns the IDs of all pending, non-expired actions, grouped by target, insertion-ordered within a target. Only targets that actually hold live pendings are visited (round-2 fix Y-1), so the scan cannot be inflated by registrations alone.

func GetTarget

Action 
1func GetTarget(targetName string) string
source

GetTarget returns a formatted summary of a registered target.

func IsExecuted

Action 
1func IsExecuted(actionID string) bool
source

IsExecuted returns true if the action exists and was executed. This is the consumer-side check: combined with target registration it attests that the target's registered owner scheduled the action, it waited at least the registered minimum delay, no guardian vetoed it, and it was executed within its grace window. Executed records are permanent.

func IsReady

Action 
1func IsReady(actionID string) bool
source

IsReady returns true if the action exists, is pending, its delay has elapsed, and it has not expired.

func RegisterTarget

crossing Action 
1func RegisterTarget(cur realm, name string, minDelay int64, guardian address)
source

RegisterTarget creates a named target. The caller becomes its owner — the only address that may schedule actions against it. minDelay is the enforced floor for every action's delay. guardian may be empty (no guardian) or an address empowered to veto pending actions.

func Render 

1func Render(path string) string
source

Render returns a markdown overview. Never panics. Cancelled, vetoed, and expired actions are reaped from state; their history is in events. The page shows the most recent actions only (the ordering index is bounded — fix Y4); older executed records stay queryable via GetAction/IsExecuted forever.

func Schedule

crossing Action 
1func Schedule(cur realm, targetName, data string, delay int64) string
source

Schedule creates a new timelocked action against a registered target. Only the target's owner may schedule. The delay must be at least the target's registered minimum and at most MaxDelay. Returns the action ID.

func SetGuardian

crossing Action 
1func SetGuardian(cur realm, targetName string, guardian address)
source

SetGuardian changes (or clears, with "") the target's guardian. Owner only, and REFUSED while the target has pending actions: the guardian's veto power exists precisely to check the owner during a delay window, so the owner must not be able to strip it mid-window.

KNOWN LIMIT (documented, round-3 audit): the owner can cancel all pending actions, change the guardian, and reschedule — the price is a full fresh MinDelay on every rescheduled action, and every step emits an event (cancellations + the guardian change below), so observers always get MinDelay of warning under the new guardian regime. Guardians protect open windows, not the owner's future.

func TransferTargetOwnership

crossing Action 
1func TransferTargetOwnership(cur realm, targetName string, newOwner address)
source

TransferTargetOwnership OFFERS a target to a new owner; the nominee must AcceptTargetOwnership to complete it (fix Y5: a one-step transfer let anyone fill a stranger's per-owner quota and dump pending obligations — with an attacker-chosen guardian — on an address that never asked). Owner only. Pass "" to clear a pending offer. Nothing changes hands until the nominee accepts.

func Veto

crossing Action 
1func Veto(cur realm, actionID string) string
source

Veto cancels a pending action as the target's guardian. This is the guardian's whole power: it can stop a scheduled action during the delay window, never create or execute one. The record is reaped; history is the event.

Types 2

type Action

struct 
 1type Action struct {
 2	ID           string
 3	Target       string
 4	Creator      address
 5	Data         string // encoded call data or description of the action
 6	ScheduledAt  time.Time
 7	ExecuteAfter time.Time
 8	ExpiresAt    time.Time // ExecuteAfter + GracePeriod; not executable after
 9	Executed     bool
10}
source

Action represents a scheduled operation that can only execute after its delay has elapsed, and only within its grace window.

State model (re-audit 2026-09-02): only PENDING and EXECUTED actions are stored. Executed records are permanent attestations consumers check via IsExecuted. Cancelled, vetoed, and expired actions are REAPED from state — their history lives in emitted events — so the live-action cap bounds live exposure and can never be consumed permanently by schedule/cancel cycling.

type TargetConfig

struct 
 1type TargetConfig struct {
 2	Name     string
 3	Owner    address
 4	Guardian address // empty = no guardian
 5	MinDelay int64   // seconds; every action for this target waits at least this
 6	// PendingOwner is the offered-but-not-accepted new owner (fix Y5:
 7	// ownership moves in two steps, so a stranger can never have a
 8	// target — and its quota slot and pending obligations — dumped on
 9	// them without consenting).
10	PendingOwner address
11}
source

TargetConfig binds a named target to the only address allowed to schedule actions against it, an enforced minimum delay, and an optional guardian who can veto pending actions. Without this binding a timelock attests nothing: anyone could schedule their own short-delay action against any name and "execute" it.

Imports 5

  • chain stdlib
  • chain/runtime/unsafe stdlib
  • strconv stdlib
  • strings stdlib
  • time stdlib

Source Files 2