Add TimelockController (#2354)

Co-authored-by: Francisco Giordano <frangio.1@gmail.com>

contracts/access/README.adoc

@@ -5,8 +5,85 @@ NOTE: This document is better viewed at https://docs.openzeppelin.com/contracts/
 
 Contract modules for authorization and access control mechanisms.
 
-== Contracts
+== Authorization
 
 {{Ownable}}
-
 {{AccessControl}}
+
+== Timelock
+
+{{TimelockController}}
+
+==== Terminology
+
+* *Operation:* A transaction (or a set of transactions) that is the subject of the timelock. It has to be scheduled by a proposer and executed by an executor. The timelock enforces a minimum delay between the proposition and the execution (see xref:access-control.adoc#operation_lifecycle[operation lifecycle]). If the operation contains multiple transactions (batch mode), they are executed atomically. Operations are identified by the hash of their content.
+* *Operation status:*
+** *Unset:* An operation that is not part of the timelock mechanism.
+** *Pending:* An operation that has been scheduled, before the timer expires.
+** *Ready:* An operation that has been scheduled, after the timer expires.
+** *Done:* An operation that has been executed.
+* *Predecessor*: An (optional) dependency between operations. An operation can depend on another operation (its predecessor), forcing the execution order of these two operations.
+* *Role*:
+** *Proposer:* An address (smart contract or EOA) that is in charge of scheduling (and cancelling) operations.
+** *Executor:* An address (smart contract or EOA) that is in charge of executing operations.
+
+==== Operation structure
+
+Operation executed by the xref:api:access.adoc#TimelockController[`TimelockControler`] can contain one or multiple subsequent calls. Depending on whether you need to multiple calls to be executed atomically, you can either use simple or batched operations.
+
+Both operations contain:
+
+* *Target*, the address of the smart contract that the timelock should operate on.
+* *Value*, in wei, that should be sent with the transaction. Most of the time this will be 0. Ether can be deposited before-end or passed along when executing the transaction.
+* *Data*, containing the encoded function selector and parameters of the call. This can be produced using a number of tools. For example, a maintenance operation granting role `ROLE` to `ACCOUNT` can be encode using web3js as follows:
+
+```javascript
+const data = timelock.contract.methods.grantRole(ROLE, ACCOUNT).encodeABI()
+```
+
+* *Predecessor*, that specifies a dependency between operations. This dependency is optional. Use `bytes32(0)` if the operation does not have any dependency.
+* *Salt*, used to disambiguate two otherwise identical operations. This can be any random value.
+
+In the case of batched operations, `target`, `value` and `data` are specified as arrays, which must be of the same length.
+
+==== Operation lifecycle
+
+Timelocked operations are identified by a unique id (their hash) and follow a specific lifecycle:
+
+`Unset` -> `Pending` -> `Pending` + `Ready` -> `Done`
+
+* By calling xref:api:access.adoc#TimelockController-schedule-address-uint256-bytes-bytes32-bytes32-uint256-[`schedule`] (or xref:api:access.adoc#TimelockController-scheduleBatch-address---uint256---bytes---bytes32-bytes32-uint256-[`scheduleBatch`]), a proposer moves the operation from the `Unset` to the `Pending` state. This starts a timer that must be longer than the minimum delay. The timer expires at a timestamp accessible through the xref:api:access.adoc#TimelockController-getTimestamp-bytes32-[`getTimestamp`] method.
+* Once the timer expires, the operation automatically gets the `Ready` state. At this point, it can be executed.
+* By calling xref:api:access.adoc#TimelockController-TimelockController-execute-address-uint256-bytes-bytes32-bytes32-[`execute`] (or xref:api:access.adoc#TimelockController-executeBatch-address---uint256---bytes---bytes32-bytes32-[`executeBatch`]), an executor triggers the operation's underlying transactions and moves it to the `Done` state. If the operation has a predecessor, it has to be in the `Done` state for this transition to succeed.
+* xref:api:access.adoc#TimelockController-TimelockController-cancel-bytes32-[`cancel`] allows proposers to cancel any `Pending` operation. This resets the operation to the `Unset` state. It is thus possible for a proposer to re-schedule an operation that has been cancelled. In this case, the timer restarts when the operation is re-scheduled.
+
+Operations status can be queried using the functions:
+
+* xref:api:access.adoc#TimelockController-isOperationPending-bytes32-[`isOperationPending(bytes32)`]
+* xref:api:access.adoc#TimelockController-isOperationReady-bytes32-[`isOperationReady(bytes32)`]
+* xref:api:access.adoc#TimelockController-isOperationDone-bytes32-[`isOperationDone(bytes32)`]
+
+==== Roles
+
+===== Admin
+
+The admins are in charge of managing proposers and executors. For the timelock to be self-governed, this role should only be given to the timelock itself. Upon deployment, both the timelock and the deployer have this role. After further configuration and testing, the deployer can renounce this role such that all further maintenance operations have to go through the timelock process.
+
+This role is identified by the *TIMELOCK_ADMIN_ROLE* value: `0x5f58e3a2316349923ce3780f8d587db2d72378aed66a8261c916544fa6846ca5`
+
+===== Proposer
+
+The proposers are in charge of scheduling (and cancelling) operations. This is a critical role, that should be given to governing entities. This could be an EOA, a multisig, or a DAO.
+
+WARNING: *Proposer fight:* Having multiple proposers, while providing redundancy in case one becomes unavailable, can be dangerous. As proposer have their say on all operations, they could cancel operations they disagree with, including operations to remove them for the proposers.
+
+This role is identified by the *PROPOSER_ROLE* value: `0xb09aa5aeb3702cfd50b6b62bc4532604938f21248a27a1d5ca736082b6819cc1`
+
+===== Executor
+
+The executors are in charge of executing the operations scheduled by the proposers once the timelock expires. Logic dictates that multisig or DAO that are proposers should also be executors in order to guarantee operations that have been scheduled will eventually be executed. However, having additional executor can reduce the cost (the executing transaction does not require validation by the multisig or DAO that proposed it), while ensuring whoever is in charge of execution cannot trigger actions that have not been scheduled by the proposers.
+
+This role is identified by the *EXECUTOR_ROLE* value: `0xd8aa0f3194971a2a116679f7c2090f6939c8d4e01a2a8d7e41d55e5351469e63`
+
+
+WARNING: A live contract without at least one proposer and one executor is locked. Make sure these roles are filled by reliable entities before the deployer renounces its administrative rights in favour of the timelock contract itself. See the {AccessControl} documentation to learn more about role management.

contracts/access/TimelockController.sol

@@ -0,0 +1,281 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity ^0.6.0;
+pragma experimental ABIEncoderV2;
+
+import "./../math/SafeMath.sol";
+import "./AccessControl.sol";
+
+/**
+ * @dev Contract module which acts as a timelocked controller. When set as the
+ * owner of an `Ownable` smart contract, it enforces a timelock on all
+ * `onlyOwner` maintenance operations. This gives time for users of the
+ * controlled contract to exit before a potentially dangerous maintenance
+ * operation is applied.
+ *
+ * By default, this contract is self administered, meaning administration tasks
+ * have to go through the timelock process. The proposer (resp executor) role
+ * is in charge of proposing (resp executing) operations. A common use case is
+ * to position this {TimelockController} as the owner of a smart contract, with
+ * a multisig or a DAO as the sole proposer.
+ */
+contract TimelockController is AccessControl {
+
+    bytes32 public constant TIMELOCK_ADMIN_ROLE = keccak256("TIMELOCK_ADMIN_ROLE");
+    bytes32 public constant PROPOSER_ROLE = keccak256("PROPOSER_ROLE");
+    bytes32 public constant EXECUTOR_ROLE = keccak256("EXECUTOR_ROLE");
+    uint256 internal constant _DONE_TIMESTAMP = uint256(1);
+
+    mapping(bytes32 => uint256) private _timestamps;
+    uint256 private _minDelay;
+
+    /**
+     * @dev Emitted when a call is scheduled as part of operation `id`.
+     */
+    event CallScheduled(bytes32 indexed id, uint256 indexed index, address target, uint256 value, bytes data, bytes32 predecessor, uint256 delay);
+
+    /**
+     * @dev Emitted when a call is performed as part of operation `id`.
+     */
+    event CallExecuted(bytes32 indexed id, uint256 indexed index, address target, uint256 value, bytes data);
+
+    /**
+     * @dev Emitted when operation `id` is cancelled.
+     */
+    event Cancelled(bytes32 indexed id);
+
+    /**
+     * @dev Emitted when the minimum delay for future operations is modified.
+     */
+    event MinDelayChange(uint256 oldDuration, uint256 newDuration);
+
+    /**
+     * @dev Initializes the contract with a given `minDelay`.
+     */
+    constructor(uint256 minDelay, address[] memory proposers, address[] memory executors) public {
+        _setRoleAdmin(TIMELOCK_ADMIN_ROLE, TIMELOCK_ADMIN_ROLE);
+        _setRoleAdmin(PROPOSER_ROLE, TIMELOCK_ADMIN_ROLE);
+        _setRoleAdmin(EXECUTOR_ROLE, TIMELOCK_ADMIN_ROLE);
+
+        // deployer + self administration
+        _setupRole(TIMELOCK_ADMIN_ROLE, _msgSender());
+        _setupRole(TIMELOCK_ADMIN_ROLE, address(this));
+
+        // register proposers
+        for (uint256 i = 0; i < proposers.length; ++i) {
+            _setupRole(PROPOSER_ROLE, proposers[i]);
+        }
+
+        // register executors
+        for (uint256 i = 0; i < executors.length; ++i) {
+            _setupRole(EXECUTOR_ROLE, executors[i]);
+        }
+
+        _minDelay = minDelay;
+        emit MinDelayChange(0, minDelay);
+    }
+
+    /**
+     * @dev Modifier to make a function callable only by a certain role. In
+     * addition to checking the sender's role, `address(0)` 's role is also
+     * considered. Granting a role to `address(0)` is equivalent to enabling
+     * this role for everyone.
+     */
+    modifier onlyRole(bytes32 role) {
+        require(hasRole(role, _msgSender()) || hasRole(role, address(0)), "TimelockController: sender requires permission");
+        _;
+    }
+
+    /*
+     * @dev Contract might receive/hold ETH as part of the maintenance process.
+     */
+    receive() external payable {}
+
+    /**
+     * @dev Returns whether an operation is pending or not.
+     */
+    function isOperationPending(bytes32 id) public view returns (bool pending) {
+        return _timestamps[id] > _DONE_TIMESTAMP;
+    }
+
+    /**
+     * @dev Returns whether an operation is ready or not.
+     */
+    function isOperationReady(bytes32 id) public view returns (bool ready) {
+        // solhint-disable-next-line not-rely-on-time
+        return _timestamps[id] > _DONE_TIMESTAMP && _timestamps[id] <= block.timestamp;
+    }
+
+    /**
+     * @dev Returns whether an operation is done or not.
+     */
+    function isOperationDone(bytes32 id) public view returns (bool done) {
+        return _timestamps[id] == _DONE_TIMESTAMP;
+    }
+
+    /**
+     * @dev Returns the timestamp at with an operation becomes ready (0 for
+     * unset operations, 1 for done operations).
+     */
+    function getTimestamp(bytes32 id) public view returns (uint256 timestamp) {
+        return _timestamps[id];
+    }
+
+    /**
+     * @dev Returns the minimum delay for an operation to become valid.
+     */
+    function getMinDelay() public view returns (uint256 duration) {
+        return _minDelay;
+    }
+
+    /**
+     * @dev Returns the identifier of an operation containing a single
+     * transaction.
+     */
+    function hashOperation(address target, uint256 value, bytes calldata data, bytes32 predecessor, bytes32 salt) public pure returns (bytes32 hash) {
+        return keccak256(abi.encode(target, value, data, predecessor, salt));
+    }
+
+    /**
+     * @dev Returns the identifier of an operation containing a batch of
+     * transactions.
+     */
+    function hashOperationBatch(address[] calldata targets, uint256[] calldata values, bytes[] calldata datas, bytes32 predecessor, bytes32 salt) public pure returns (bytes32 hash) {
+        return keccak256(abi.encode(targets, values, datas, predecessor, salt));
+    }
+
+    /**
+     * @dev Schedule an operation containing a single transaction.
+     *
+     * Emits a {CallScheduled} event.
+     *
+     * Requirements:
+     *
+     * - the caller must have the 'proposer' role.
+     */
+    function schedule(address target, uint256 value, bytes calldata data, bytes32 predecessor, bytes32 salt, uint256 delay) public virtual onlyRole(PROPOSER_ROLE) {
+        bytes32 id = hashOperation(target, value, data, predecessor, salt);
+        _schedule(id, delay);
+        emit CallScheduled(id, 0, target, value, data, predecessor, delay);
+    }
+
+    /**
+     * @dev Schedule an operation containing a batch of transactions.
+     *
+     * Emits one {CallScheduled} event per transaction in the batch.
+     *
+     * Requirements:
+     *
+     * - the caller must have the 'proposer' role.
+     */
+    function scheduleBatch(address[] calldata targets, uint256[] calldata values, bytes[] calldata datas, bytes32 predecessor, bytes32 salt, uint256 delay) public virtual onlyRole(PROPOSER_ROLE) {
+        require(targets.length == values.length, "TimelockController: length mismatch");
+        require(targets.length == datas.length, "TimelockController: length mismatch");
+
+        bytes32 id = hashOperationBatch(targets, values, datas, predecessor, salt);
+        _schedule(id, delay);
+        for (uint256 i = 0; i < targets.length; ++i) {
+            emit CallScheduled(id, i, targets[i], values[i], datas[i], predecessor, delay);
+        }
+    }
+
+    /**
+     * @dev Schedule an operation that is to becomes valid after a given delay.
+     */
+    function _schedule(bytes32 id, uint256 delay) private {
+        require(_timestamps[id] == 0, "TimelockController: operation already scheduled");
+        require(delay >= _minDelay, "TimelockController: insufficient delay");
+        // solhint-disable-next-line not-rely-on-time
+        _timestamps[id] = SafeMath.add(block.timestamp, delay);
+    }
+
+    /**
+     * @dev Cancel an operation.
+     *
+     * Requirements:
+     *
+     * - the caller must have the 'proposer' role.
+     */
+    function cancel(bytes32 id) public virtual onlyRole(PROPOSER_ROLE) {
+        require(isOperationPending(id), "TimelockController: operation cannot be cancelled");
+        delete _timestamps[id];
+
+        emit Cancelled(id);
+    }
+
+    /**
+     * @dev Execute an (ready) operation containing a single transaction.
+     *
+     * Emits a {CallExecuted} event.
+     *
+     * Requirements:
+     *
+     * - the caller must have the 'executor' role.
+     */
+    function execute(address target, uint256 value, bytes calldata data, bytes32 predecessor, bytes32 salt) public payable virtual onlyRole(EXECUTOR_ROLE) {
+        bytes32 id = hashOperation(target, value, data, predecessor, salt);
+        _beforeCall(predecessor);
+        _call(id, 0, target, value, data);
+        _afterCall(id);
+    }
+
+    /**
+     * @dev Execute an (ready) operation containing a batch of transactions.
+     *
+     * Emits one {CallExecuted} event per transaction in the batch.
+     *
+     * Requirements:
+     *
+     * - the caller must have the 'executor' role.
+     */
+    function executeBatch(address[] calldata targets, uint256[] calldata values, bytes[] calldata datas, bytes32 predecessor, bytes32 salt) public payable virtual onlyRole(EXECUTOR_ROLE) {
+        require(targets.length == values.length, "TimelockController: length mismatch");
+        require(targets.length == datas.length, "TimelockController: length mismatch");
+
+        bytes32 id = hashOperationBatch(targets, values, datas, predecessor, salt);
+        _beforeCall(predecessor);
+        for (uint256 i = 0; i < targets.length; ++i) {
+            _call(id, i, targets[i], values[i], datas[i]);
+        }
+        _afterCall(id);
+    }
+
+    /**
+     * @dev Checks before execution of an operation's calls.
+     */
+    function _beforeCall(bytes32 predecessor) private view {
+        require(predecessor == bytes32(0) || isOperationDone(predecessor), "TimelockController: missing dependency");
+    }
+
+    /**
+     * @dev Checks after execution of an operation's calls.
+     */
+    function _afterCall(bytes32 id) private {
+        require(isOperationReady(id), "TimelockController: operation is not ready");
+        _timestamps[id] = _DONE_TIMESTAMP;
+    }
+
+    /**
+     * @dev Execute an operation's call.
+     *
+     * Emits a {CallExecuted} event.
+     */
+    function _call(bytes32 id, uint256 index, address target, uint256 value, bytes calldata data) private {
+        // solhint-disable-next-line avoid-low-level-calls
+        (bool success,) = target.call{value: value}(data);
+        require(success, "TimelockController: underlying transaction reverted");
+
+        emit CallExecuted(id, index, target, value, data);
+    }
+
+    /**
+     * @dev Changes the timelock duration for future operations.
+     *
+     * Emits a {MinDelayChange} event.
+     */
+    function updateDelay(uint256 newDelay) external virtual {
+        require(msg.sender == address(this), "TimelockController: caller must be timelock");
+        emit MinDelayChange(_minDelay, newDelay);
+        _minDelay = newDelay;
+    }
+}

docs/modules/ROOT/pages/access-control.adoc

@@ -185,3 +185,37 @@ for (let i = 0; i < minterCount; ++i) {
     members.push(await myToken.getRoleMember(MINTER_ROLE, i));
 }
 ```
+
+== Delayed operation
+
+Access control is essential to prevent unauthorized access to critical functions. These functions may be used to mint tokens, freeze transfers or perform an upgrade that completely changes the smart contract logic. While xref:api:access.adoc#Ownable[`Ownable`] and xref:api:access.adoc#AccessControl[`AccessControl`] can prevent unauthorized access, they do not address the issue of a misbehaving administrator attacking their own system to the prejudice of their users.
+
+This is the issue the xref:api:access.adoc#TimelockController[`TimelockControler`] is addressing.
+
+The xref:api:access.adoc#TimelockController[`TimelockControler`] is a proxy that is governed by proposers and executors. When set as the owner/admin/controller of a smart contract, it ensures that whichever maintenance operation is ordered by the proposers is subject to a delay. This delay protects the users of the smart contract by giving them time to review the maintenance operation and exit the system if they consider it is in their best interest to do so.
+
+=== Using `TimelockControler`
+
+By default, the address that deployed the xref:api:access.adoc#TimelockController[`TimelockControler`] gets administration privileges over the timelock. This role grants the right to assign proposers, executors, and other administrators.
+
+The first step in configuring the xref:api:access.adoc#TimelockController[`TimelockControler`] is to assign at least one proposer and one executor. These can be assigned during construction or later by anyone with the administrator role. These roles are not exclusive, meaning an account can have both roles.
+
+Roles are managed using the xref:api:access.adoc#AccessControl[`AccessControl`] interface and the `bytes32` values for each role are accessible through the `ADMIN_ROLE`, `PROPOSER_ROLE` and `EXECUTOR_ROLE` constants.
+
+There is an additional feature built on top of `AccessControl`: giving the proposer or executor role to `address(0)` opens access to anyone. This feature, while potentially useful for testing and in some cases for the executor role, is dangerous and should be used with caution.
+
+At this point, with both a proposer and an executor assigned, the timelock can perform operations.
+
+An optional next step is for the deployer to renounce its administrative privileges and leave the timelock self-administered. If the deployer decides to do so, all further maintenance, including assigning new proposers/schedulers or changing the timelock duration will have to follow the timelock workflow. This links the governance of the timelock to the governance of contracts attached to the timelock, and enforce a delay on timelock maintenance operations.
+
+WARNING: If the deployer renounces administrative rights in favour of timelock itself, assigning new proposers or executors will require a timelocked operation. This means that if the accounts in charge of any of these two roles become unavailable, then the entire contract (and any contract it controls) becomes locked indefinitely.
+
+With both the proposer and executor roles assigned and the timelock in charge of its own administration, you can now transfer the ownership/control of any contract to the timelock.
+
+TIP: A recommended configuration is to grant both roles to a secure governance contract such as a DAO or a multisig, and to additionally grant the executor role to a few EOAs held by people in charge of helping with the maintenance operations. These wallets cannot take over control of the timelock but they can help smoothen the workflow.
+
+=== Minimum delay
+
+Operations executed by the xref:api:access.adoc#TimelockController[`TimelockControler`] are not subject to a fixed delay but rather a minimum delay. Some major updates might call for a longer delay. For example, if a delay of just a few days might be sufficient for users to audit a minting operation, it makes sense to use a delay of a few weeks, or even a few months, when scheduling a smart contract upgrade.
+
+The minimum delay (accessible through the xref:api:access.adoc#TimelockController-getMinDelay--[`getMinDelay`] method) can be updated by calling the xref:api:access.adoc#TimelockController-updateDelay-uint256-[`updateDelay`] function. Bear in mind that access to this function is only accessible by the timelock itself, meaning this maintenance operation has to go through the timelock itself.

test/access/TimelockController.test.js

@@ -0,0 +1,997 @@
+const { accounts, contract, web3, config } = require('@openzeppelin/test-environment');
+const { constants, expectEvent, expectRevert, time } = require('@openzeppelin/test-helpers');
+const { ZERO_BYTES32 } = constants;
+
+const { expect } = require('chai');
+
+const TimelockController = contract.fromArtifact('TimelockController');
+const CallReceiverMock = contract.fromArtifact('CallReceiverMock');
+const Implementation2 = contract.fromArtifact('Implementation2');
+const MINDELAY = time.duration.days(1);
+
+function genOperation (target, value, data, predecessor, salt) {
+  const id = web3.utils.keccak256(web3.eth.abi.encodeParameters([
+    'address',
+    'uint256',
+    'bytes',
+    'uint256',
+    'bytes32',
+  ], [
+    target,
+    value,
+    data,
+    predecessor,
+    salt,
+  ]));
+  return { id, target, value, data, predecessor, salt };
+}
+
+function genOperationBatch (targets, values, datas, predecessor, salt) {
+  const id = web3.utils.keccak256(web3.eth.abi.encodeParameters([
+    'address[]',
+    'uint256[]',
+    'bytes[]',
+    'uint256',
+    'bytes32',
+  ], [
+    targets,
+    values,
+    datas,
+    predecessor,
+    salt,
+  ]));
+  return { id, targets, values, datas, predecessor, salt };
+}
+
+describe('TimelockController', function () {
+  const [ admin, proposer, executor, other ] = accounts;
+
+  beforeEach(async function () {
+    // Deploy new timelock
+    this.timelock = await TimelockController.new(
+      MINDELAY,
+      [ proposer ],
+      [ executor ],
+      { from: admin },
+    );
+    // Mocks
+    this.callreceivermock = await CallReceiverMock.new({ from: admin });
+    this.implementation2 = await Implementation2.new({ from: admin });
+  });
+
+  it('initial state', async function () {
+    expect(await this.timelock.getMinDelay()).to.be.bignumber.equal(MINDELAY);
+  });
+
+  describe('methods', function () {
+    describe('operation hashing', function () {
+      it('hashOperation', async function () {
+        this.operation = genOperation(
+          '0x29cebefe301c6ce1bb36b58654fea275e1cacc83',
+          '0xf94fdd6e21da21d2',
+          '0xa3bc5104',
+          '0xba41db3be0a9929145cfe480bd0f1f003689104d275ae912099f925df424ef94',
+          '0x60d9109846ab510ed75c15f979ae366a8a2ace11d34ba9788c13ac296db50e6e',
+        );
+        expect(await this.timelock.hashOperation(
+          this.operation.target,
+          this.operation.value,
+          this.operation.data,
+          this.operation.predecessor,
+          this.operation.salt,
+        )).to.be.equal(this.operation.id);
+      });
+
+      it('hashOperationBatch', async function () {
+        this.operation = genOperationBatch(
+          Array(8).fill('0x2d5f21620e56531c1d59c2df9b8e95d129571f71'),
+          Array(8).fill('0x2b993cfce932ccee'),
+          Array(8).fill('0xcf51966b'),
+          '0xce8f45069cc71d25f71ba05062de1a3974f9849b004de64a70998bca9d29c2e7',
+          '0x8952d74c110f72bfe5accdf828c74d53a7dfb71235dfa8a1e8c75d8576b372ff',
+        );
+        expect(await this.timelock.hashOperationBatch(
+          this.operation.targets,
+          this.operation.values,
+          this.operation.datas,
+          this.operation.predecessor,
+          this.operation.salt,
+        )).to.be.equal(this.operation.id);
+      });
+    });
+    describe('simple', function () {
+      describe('schedule', function () {
+        beforeEach(async function () {
+          this.operation = genOperation(
+            '0x31754f590B97fD975Eb86938f18Cc304E264D2F2',
+            0,
+            '0x3bf92ccc',
+            ZERO_BYTES32,
+            '0x025e7b0be353a74631ad648c667493c0e1cd31caa4cc2d3520fdc171ea0cc726',
+          );
+        });
+
+        it('proposer can schedule', async function () {
+          const receipt = await this.timelock.schedule(
+            this.operation.target,
+            this.operation.value,
+            this.operation.data,
+            this.operation.predecessor,
+            this.operation.salt,
+            MINDELAY,
+            { from: proposer },
+          );
+          expectEvent(receipt, 'CallScheduled', {
+            id: this.operation.id,
+            index: web3.utils.toBN(0),
+            target: this.operation.target,
+            value: web3.utils.toBN(this.operation.value),
+            data: this.operation.data,
+            predecessor: this.operation.predecessor,
+            delay: MINDELAY,
+          });
+
+          const block = await web3.eth.getBlock(receipt.receipt.blockHash);
+
+          expect(await this.timelock.getTimestamp(this.operation.id))
+            .to.be.bignumber.equal(web3.utils.toBN(block.timestamp).add(MINDELAY));
+        });
+
+        it('prevent overwritting active operation', async function () {
+          await this.timelock.schedule(
+            this.operation.target,
+            this.operation.value,
+            this.operation.data,
+            this.operation.predecessor,
+            this.operation.salt,
+            MINDELAY,
+            { from: proposer },
+          );
+
+          await expectRevert(
+            this.timelock.schedule(
+              this.operation.target,
+              this.operation.value,
+              this.operation.data,
+              this.operation.predecessor,
+              this.operation.salt,
+              MINDELAY,
+              { from: proposer },
+            ),
+            'TimelockController: operation already scheduled',
+          );
+        });
+
+        it('prevent non-proposer from commiting', async function () {
+          await expectRevert(
+            this.timelock.schedule(
+              this.operation.target,
+              this.operation.value,
+              this.operation.data,
+              this.operation.predecessor,
+              this.operation.salt,
+              MINDELAY,
+              { from: other },
+            ),
+            'TimelockController: sender requires permission',
+          );
+        });
+
+        it('enforce minimum delay', async function () {
+          await expectRevert(
+            this.timelock.schedule(
+              this.operation.target,
+              this.operation.value,
+              this.operation.data,
+              this.operation.predecessor,
+              this.operation.salt,
+              MINDELAY - 1,
+              { from: proposer },
+            ),
+            'TimelockController: insufficient delay',
+          );
+        });
+      });
+
+      describe('execute', function () {
+        beforeEach(async function () {
+          this.operation = genOperation(
+            '0xAe22104DCD970750610E6FE15E623468A98b15f7',
+            0,
+            '0x13e414de',
+            ZERO_BYTES32,
+            '0xc1059ed2dc130227aa1d1d539ac94c641306905c020436c636e19e3fab56fc7f',
+          );
+        });
+
+        it('revert if operation is not scheduled', async function () {
+          await expectRevert(
+            this.timelock.execute(
+              this.operation.target,
+              this.operation.value,
+              this.operation.data,
+              this.operation.predecessor,
+              this.operation.salt,
+              { from: executor },
+            ),
+            'TimelockController: operation is not ready',
+          );
+        });
+
+        describe('with scheduled operation', function () {
+          beforeEach(async function () {
+            ({ receipt: this.receipt, logs: this.logs } = await this.timelock.schedule(
+              this.operation.target,
+              this.operation.value,
+              this.operation.data,
+              this.operation.predecessor,
+              this.operation.salt,
+              MINDELAY,
+              { from: proposer },
+            ));
+          });
+
+          it('revert if execution comes too early 1/2', async function () {
+            await expectRevert(
+              this.timelock.execute(
+                this.operation.target,
+                this.operation.value,
+                this.operation.data,
+                this.operation.predecessor,
+                this.operation.salt,
+                { from: executor },
+              ),
+              'TimelockController: operation is not ready',
+            );
+          });
+
+          it('revert if execution comes too early 2/2', async function () {
+            const timestamp = await this.timelock.getTimestamp(this.operation.id);
+            await time.increaseTo(timestamp - 2); // -1 is too tight, test sometime fails
+
+            await expectRevert(
+              this.timelock.execute(
+                this.operation.target,
+                this.operation.value,
+                this.operation.data,
+                this.operation.predecessor,
+                this.operation.salt,
+                { from: executor },
+              ),
+              'TimelockController: operation is not ready',
+            );
+          });
+
+          describe('on time', function () {
+            beforeEach(async function () {
+              const timestamp = await this.timelock.getTimestamp(this.operation.id);
+              await time.increaseTo(timestamp);
+            });
+
+            it('executor can reveal', async function () {
+              const receipt = await this.timelock.execute(
+                this.operation.target,
+                this.operation.value,
+                this.operation.data,
+                this.operation.predecessor,
+                this.operation.salt,
+                { from: executor },
+              );
+              expectEvent(receipt, 'CallExecuted', {
+                id: this.operation.id,
+                index: web3.utils.toBN(0),
+                target: this.operation.target,
+                value: web3.utils.toBN(this.operation.value),
+                data: this.operation.data,
+              });
+            });
+
+            it('prevent non-executor from revealing', async function () {
+              await expectRevert(
+                this.timelock.execute(
+                  this.operation.target,
+                  this.operation.value,
+                  this.operation.data,
+                  this.operation.predecessor,
+                  this.operation.salt,
+                  { from: other },
+                ),
+                'TimelockController: sender requires permission',
+              );
+            });
+          });
+        });
+      });
+    });
+
+    describe('batch', function () {
+      describe('schedule', function () {
+        beforeEach(async function () {
+          this.operation = genOperationBatch(
+            Array(8).fill('0xEd912250835c812D4516BBD80BdaEA1bB63a293C'),
+            Array(8).fill(0),
+            Array(8).fill('0x2fcb7a88'),
+            ZERO_BYTES32,
+            '0x6cf9d042ade5de78bed9ffd075eb4b2a4f6b1736932c2dc8af517d6e066f51f5',
+          );
+        });
+
+        it('proposer can schedule', async function () {
+          const receipt = await this.timelock.scheduleBatch(
+            this.operation.targets,
+            this.operation.values,
+            this.operation.datas,
+            this.operation.predecessor,
+            this.operation.salt,
+            MINDELAY,
+            { from: proposer },
+          );
+          for (const i in this.operation.targets) {
+            expectEvent(receipt, 'CallScheduled', {
+              id: this.operation.id,
+              index: web3.utils.toBN(i),
+              target: this.operation.targets[i],
+              value: web3.utils.toBN(this.operation.values[i]),
+              data: this.operation.datas[i],
+              predecessor: this.operation.predecessor,
+              delay: MINDELAY,
+            });
+          }
+
+          const block = await web3.eth.getBlock(receipt.receipt.blockHash);
+
+          expect(await this.timelock.getTimestamp(this.operation.id))
+            .to.be.bignumber.equal(web3.utils.toBN(block.timestamp).add(MINDELAY));
+        });
+
+        it('prevent overwritting active operation', async function () {
+          await this.timelock.scheduleBatch(
+            this.operation.targets,
+            this.operation.values,
+            this.operation.datas,
+            this.operation.predecessor,
+            this.operation.salt,
+            MINDELAY,
+            { from: proposer },
+          );
+
+          await expectRevert(
+            this.timelock.scheduleBatch(
+              this.operation.targets,
+              this.operation.values,
+              this.operation.datas,
+              this.operation.predecessor,
+              this.operation.salt,
+              MINDELAY,
+              { from: proposer },
+            ),
+            'TimelockController: operation already scheduled',
+          );
+        });
+
+        it('prevent non-proposer from commiting', async function () {
+          await expectRevert(
+            this.timelock.scheduleBatch(
+              this.operation.targets,
+              this.operation.values,
+              this.operation.datas,
+              this.operation.predecessor,
+              this.operation.salt,
+              MINDELAY,
+              { from: other },
+            ),
+            'TimelockController: sender requires permission',
+          );
+        });
+
+        it('enforce minimum delay', async function () {
+          await expectRevert(
+            this.timelock.scheduleBatch(
+              this.operation.targets,
+              this.operation.values,
+              this.operation.datas,
+              this.operation.predecessor,
+              this.operation.salt,
+              MINDELAY - 1,
+              { from: proposer },
+            ),
+            'TimelockController: insufficient delay',
+          );
+        });
+      });
+
+      describe('execute', function () {
+        beforeEach(async function () {
+          this.operation = genOperationBatch(
+            Array(8).fill('0x76E53CcEb05131Ef5248553bEBDb8F70536830b1'),
+            Array(8).fill(0),
+            Array(8).fill('0x58a60f63'),
+            ZERO_BYTES32,
+            '0x9545eeabc7a7586689191f78a5532443698538e54211b5bd4d7dc0fc0102b5c7',
+          );
+        });
+
+        it('revert if operation is not scheduled', async function () {
+          await expectRevert(
+            this.timelock.executeBatch(
+              this.operation.targets,
+              this.operation.values,
+              this.operation.datas,
+              this.operation.predecessor,
+              this.operation.salt,
+              { from: executor },
+            ),
+            'TimelockController: operation is not ready',
+          );
+        });
+
+        describe('with scheduled operation', function () {
+          beforeEach(async function () {
+            ({ receipt: this.receipt, logs: this.logs } = await this.timelock.scheduleBatch(
+              this.operation.targets,
+              this.operation.values,
+              this.operation.datas,
+              this.operation.predecessor,
+              this.operation.salt,
+              MINDELAY,
+              { from: proposer },
+            ));
+          });
+
+          it('revert if execution comes too early 1/2', async function () {
+            await expectRevert(
+              this.timelock.executeBatch(
+                this.operation.targets,
+                this.operation.values,
+                this.operation.datas,
+                this.operation.predecessor,
+                this.operation.salt,
+                { from: executor },
+              ),
+              'TimelockController: operation is not ready',
+            );
+          });
+
+          it('revert if execution comes too early 2/2', async function () {
+            const timestamp = await this.timelock.getTimestamp(this.operation.id);
+            await time.increaseTo(timestamp - 2); // -1 is to tight, test sometime fails
+
+            await expectRevert(
+              this.timelock.executeBatch(
+                this.operation.targets,
+                this.operation.values,
+                this.operation.datas,
+                this.operation.predecessor,
+                this.operation.salt,
+                { from: executor },
+              ),
+              'TimelockController: operation is not ready',
+            );
+          });
+
+          describe('on time', function () {
+            beforeEach(async function () {
+              const timestamp = await this.timelock.getTimestamp(this.operation.id);
+              await time.increaseTo(timestamp);
+            });
+
+            it('executor can reveal', async function () {
+              const receipt = await this.timelock.executeBatch(
+                this.operation.targets,
+                this.operation.values,
+                this.operation.datas,
+                this.operation.predecessor,
+                this.operation.salt,
+                { from: executor },
+              );
+              for (const i in this.operation.targets) {
+                expectEvent(receipt, 'CallExecuted', {
+                  id: this.operation.id,
+                  index: web3.utils.toBN(i),
+                  target: this.operation.targets[i],
+                  value: web3.utils.toBN(this.operation.values[i]),
+                  data: this.operation.datas[i],
+                });
+              }
+            });
+
+            it('prevent non-executor from revealing', async function () {
+              await expectRevert(
+                this.timelock.executeBatch(
+                  this.operation.targets,
+                  this.operation.values,
+                  this.operation.datas,
+                  this.operation.predecessor,
+                  this.operation.salt,
+                  { from: other },
+                ),
+                'TimelockController: sender requires permission',
+              );
+            });
+
+            it('length mismatch #1', async function () {
+              await expectRevert(
+                this.timelock.executeBatch(
+                  [],
+                  this.operation.values,
+                  this.operation.datas,
+                  this.operation.predecessor,
+                  this.operation.salt,
+                  { from: executor },
+                ),
+                'TimelockController: length mismatch',
+              );
+            });
+
+            it('length mismatch #2', async function () {
+              await expectRevert(
+                this.timelock.executeBatch(
+                  this.operation.targets,
+                  [],
+                  this.operation.datas,
+                  this.operation.predecessor,
+                  this.operation.salt,
+                  { from: executor },
+                ),
+                'TimelockController: length mismatch',
+              );
+            });
+
+            it('length mismatch #3', async function () {
+              await expectRevert(
+                this.timelock.executeBatch(
+                  this.operation.targets,
+                  this.operation.values,
+                  [],
+                  this.operation.predecessor,
+                  this.operation.salt,
+                  { from: executor },
+                ),
+                'TimelockController: length mismatch',
+              );
+            });
+          });
+        });
+
+        it('partial execution', async function () {
+          const operation = genOperationBatch(
+            [
+              this.callreceivermock.address,
+              this.callreceivermock.address,
+              this.callreceivermock.address,
+            ],
+            [
+              0,
+              0,
+              0,
+            ],
+            [
+              this.callreceivermock.contract.methods.mockFunction().encodeABI(),
+              this.callreceivermock.contract.methods.mockFunctionThrows().encodeABI(),
+              this.callreceivermock.contract.methods.mockFunction().encodeABI(),
+            ],
+            ZERO_BYTES32,
+            '0x8ac04aa0d6d66b8812fb41d39638d37af0a9ab11da507afd65c509f8ed079d3e',
+          );
+
+          await this.timelock.scheduleBatch(
+            operation.targets,
+            operation.values,
+            operation.datas,
+            operation.predecessor,
+            operation.salt,
+            MINDELAY,
+            { from: proposer },
+          );
+          await time.increase(MINDELAY);
+          await expectRevert(
+            this.timelock.executeBatch(
+              operation.targets,
+              operation.values,
+              operation.datas,
+              operation.predecessor,
+              operation.salt,
+              { from: executor },
+            ),
+            'TimelockController: underlying transaction reverted',
+          );
+        });
+      });
+    });
+
+    describe('cancel', function () {
+      beforeEach(async function () {
+        this.operation = genOperation(
+          '0xC6837c44AA376dbe1d2709F13879E040CAb653ca',
+          0,
+          '0x296e58dd',
+          ZERO_BYTES32,
+          '0xa2485763600634800df9fc9646fb2c112cf98649c55f63dd1d9c7d13a64399d9',
+        );
+        ({ receipt: this.receipt, logs: this.logs } = await this.timelock.schedule(
+          this.operation.target,
+          this.operation.value,
+          this.operation.data,
+          this.operation.predecessor,
+          this.operation.salt,
+          MINDELAY,
+          { from: proposer },
+        ));
+      });
+
+      it('proposer can cancel', async function () {
+        const receipt = await this.timelock.cancel(this.operation.id, { from: proposer });
+        expectEvent(receipt, 'Cancelled', { id: this.operation.id });
+      });
+
+      it('prevent non-proposer from canceling', async function () {
+        await expectRevert(
+          this.timelock.cancel(this.operation.id, { from: other }),
+          'TimelockController: sender requires permission',
+        );
+      });
+    });
+  });
+
+  describe('maintenance', function () {
+    it('prevent unauthorized maintenance', async function () {
+      await expectRevert(
+        this.timelock.updateDelay(0, { from: other }),
+        'TimelockController: caller must be timelock',
+      );
+    });
+
+    it('timelock scheduled maintenance', async function () {
+      const newDelay = time.duration.hours(6);
+      const operation = genOperation(
+        this.timelock.address,
+        0,
+        this.timelock.contract.methods.updateDelay(newDelay.toString()).encodeABI(),
+        ZERO_BYTES32,
+        '0xf8e775b2c5f4d66fb5c7fa800f35ef518c262b6014b3c0aee6ea21bff157f108',
+      );
+
+      await this.timelock.schedule(
+        operation.target,
+        operation.value,
+        operation.data,
+        operation.predecessor,
+        operation.salt,
+        MINDELAY,
+        { from: proposer },
+      );
+      await time.increase(MINDELAY);
+      const receipt = await this.timelock.execute(
+        operation.target,
+        operation.value,
+        operation.data,
+        operation.predecessor,
+        operation.salt,
+        { from: executor },
+      );
+      expectEvent(receipt, 'MinDelayChange', { newDuration: newDelay.toString(), oldDuration: MINDELAY });
+
+      expect(await this.timelock.getMinDelay()).to.be.bignumber.equal(newDelay);
+    });
+  });
+
+  describe('dependency', function () {
+    beforeEach(async function () {
+      this.operation1 = genOperation(
+        '0xdE66bD4c97304200A95aE0AadA32d6d01A867E39',
+        0,
+        '0x01dc731a',
+        ZERO_BYTES32,
+        '0x64e932133c7677402ead2926f86205e2ca4686aebecf5a8077627092b9bb2feb',
+      );
+      this.operation2 = genOperation(
+        '0x3c7944a3F1ee7fc8c5A5134ba7c79D11c3A1FCa3',
+        0,
+        '0x8f531849',
+        this.operation1.id,
+        '0x036e1311cac523f9548e6461e29fb1f8f9196b91910a41711ea22f5de48df07d',
+      );
+      await this.timelock.schedule(
+        this.operation1.target,
+        this.operation1.value,
+        this.operation1.data,
+        this.operation1.predecessor,
+        this.operation1.salt,
+        MINDELAY,
+        { from: proposer },
+      );
+      await this.timelock.schedule(
+        this.operation2.target,
+        this.operation2.value,
+        this.operation2.data,
+        this.operation2.predecessor,
+        this.operation2.salt,
+        MINDELAY,
+        { from: proposer },
+      );
+      await time.increase(MINDELAY);
+    });
+
+    it('cannot execute before dependency', async function () {
+      await expectRevert(
+        this.timelock.execute(
+          this.operation2.target,
+          this.operation2.value,
+          this.operation2.data,
+          this.operation2.predecessor,
+          this.operation2.salt,
+          { from: executor },
+        ),
+        'TimelockController: missing dependency',
+      );
+    });
+
+    it('can execute after dependency', async function () {
+      await this.timelock.execute(
+        this.operation1.target,
+        this.operation1.value,
+        this.operation1.data,
+        this.operation1.predecessor,
+        this.operation1.salt,
+        { from: executor },
+      );
+      await this.timelock.execute(
+        this.operation2.target,
+        this.operation2.value,
+        this.operation2.data,
+        this.operation2.predecessor,
+        this.operation2.salt,
+        { from: executor },
+      );
+    });
+  });
+
+  describe('usage scenario', function () {
+    this.timeout(10000);
+
+    it('call', async function () {
+      const operation = genOperation(
+        this.implementation2.address,
+        0,
+        this.implementation2.contract.methods.setValue(42).encodeABI(),
+        ZERO_BYTES32,
+        '0x8043596363daefc89977b25f9d9b4d06c3910959ef0c4d213557a903e1b555e2',
+      );
+
+      await this.timelock.schedule(
+        operation.target,
+        operation.value,
+        operation.data,
+        operation.predecessor,
+        operation.salt,
+        MINDELAY,
+        { from: proposer },
+      );
+      await time.increase(MINDELAY);
+      await this.timelock.execute(
+        operation.target,
+        operation.value,
+        operation.data,
+        operation.predecessor,
+        operation.salt,
+        { from: executor },
+      );
+
+      expect(await this.implementation2.getValue()).to.be.bignumber.equal(web3.utils.toBN(42));
+    });
+
+    it('call reverting', async function () {
+      const operation = genOperation(
+        this.callreceivermock.address,
+        0,
+        this.callreceivermock.contract.methods.mockFunctionRevertsNoReason().encodeABI(),
+        ZERO_BYTES32,
+        '0xb1b1b276fdf1a28d1e00537ea73b04d56639128b08063c1a2f70a52e38cba693',
+      );
+
+      await this.timelock.schedule(
+        operation.target,
+        operation.value,
+        operation.data,
+        operation.predecessor,
+        operation.salt,
+        MINDELAY,
+        { from: proposer },
+      );
+      await time.increase(MINDELAY);
+      await expectRevert(
+        this.timelock.execute(
+          operation.target,
+          operation.value,
+          operation.data,
+          operation.predecessor,
+          operation.salt,
+          { from: executor },
+        ),
+        'TimelockController: underlying transaction reverted',
+      );
+    });
+
+    it('call throw', async function () {
+      const operation = genOperation(
+        this.callreceivermock.address,
+        0,
+        this.callreceivermock.contract.methods.mockFunctionThrows().encodeABI(),
+        ZERO_BYTES32,
+        '0xe5ca79f295fc8327ee8a765fe19afb58f4a0cbc5053642bfdd7e73bc68e0fc67',
+      );
+
+      await this.timelock.schedule(
+        operation.target,
+        operation.value,
+        operation.data,
+        operation.predecessor,
+        operation.salt,
+        MINDELAY,
+        { from: proposer },
+      );
+      await time.increase(MINDELAY);
+      await expectRevert(
+        this.timelock.execute(
+          operation.target,
+          operation.value,
+          operation.data,
+          operation.predecessor,
+          operation.salt,
+          { from: executor },
+        ),
+        'TimelockController: underlying transaction reverted',
+      );
+    });
+
+    // Skipped in a coverage mode due to coverage mode setting a block gas limit to 0xffffffffff
+    // which cause a mockFunctionOutOfGas function to crash Ganache and the
+    // subsequent tests before running out of gas.
+    it('call out of gas', async function () {
+      if (config.coverage) { return this.skip(); }
+      const operation = genOperation(
+        this.callreceivermock.address,
+        0,
+        this.callreceivermock.contract.methods.mockFunctionOutOfGas().encodeABI(),
+        ZERO_BYTES32,
+        '0xf3274ce7c394c5b629d5215723563a744b817e1730cca5587c567099a14578fd',
+      );
+
+      await this.timelock.schedule(
+        operation.target,
+        operation.value,
+        operation.data,
+        operation.predecessor,
+        operation.salt,
+        MINDELAY,
+        { from: proposer },
+      );
+      await time.increase(MINDELAY);
+      await expectRevert(
+        this.timelock.execute(
+          operation.target,
+          operation.value,
+          operation.data,
+          operation.predecessor,
+          operation.salt,
+          { from: executor },
+        ),
+        'TimelockController: underlying transaction reverted',
+      );
+    });
+
+    it('call payable with eth', async function () {
+      const operation = genOperation(
+        this.callreceivermock.address,
+        1,
+        this.callreceivermock.contract.methods.mockFunction().encodeABI(),
+        ZERO_BYTES32,
+        '0x5ab73cd33477dcd36c1e05e28362719d0ed59a7b9ff14939de63a43073dc1f44',
+      );
+
+      await this.timelock.schedule(
+        operation.target,
+        operation.value,
+        operation.data,
+        operation.predecessor,
+        operation.salt,
+        MINDELAY,
+        { from: proposer },
+      );
+      await time.increase(MINDELAY);
+
+      expect(await web3.eth.getBalance(this.timelock.address)).to.be.bignumber.equal(web3.utils.toBN(0));
+      expect(await web3.eth.getBalance(this.callreceivermock.address)).to.be.bignumber.equal(web3.utils.toBN(0));
+
+      await this.timelock.execute(
+        operation.target,
+        operation.value,
+        operation.data,
+        operation.predecessor,
+        operation.salt,
+        { from: executor, value: 1 },
+      );
+
+      expect(await web3.eth.getBalance(this.timelock.address)).to.be.bignumber.equal(web3.utils.toBN(0));
+      expect(await web3.eth.getBalance(this.callreceivermock.address)).to.be.bignumber.equal(web3.utils.toBN(1));
+    });
+
+    it('call nonpayable with eth', async function () {
+      const operation = genOperation(
+        this.callreceivermock.address,
+        1,
+        this.callreceivermock.contract.methods.mockFunctionNonPayable().encodeABI(),
+        ZERO_BYTES32,
+        '0xb78edbd920c7867f187e5aa6294ae5a656cfbf0dea1ccdca3751b740d0f2bdf8',
+      );
+
+      await this.timelock.schedule(
+        operation.target,
+        operation.value,
+        operation.data,
+        operation.predecessor,
+        operation.salt,
+        MINDELAY,
+        { from: proposer },
+      );
+      await time.increase(MINDELAY);
+
+      expect(await web3.eth.getBalance(this.timelock.address)).to.be.bignumber.equal(web3.utils.toBN(0));
+      expect(await web3.eth.getBalance(this.callreceivermock.address)).to.be.bignumber.equal(web3.utils.toBN(0));
+
+      await expectRevert(
+        this.timelock.execute(
+          operation.target,
+          operation.value,
+          operation.data,
+          operation.predecessor,
+          operation.salt,
+          { from: executor },
+        ),
+        'TimelockController: underlying transaction reverted',
+      );
+
+      expect(await web3.eth.getBalance(this.timelock.address)).to.be.bignumber.equal(web3.utils.toBN(0));
+      expect(await web3.eth.getBalance(this.callreceivermock.address)).to.be.bignumber.equal(web3.utils.toBN(0));
+    });
+
+    it('call reverting with eth', async function () {
+      const operation = genOperation(
+        this.callreceivermock.address,
+        1,
+        this.callreceivermock.contract.methods.mockFunctionRevertsNoReason().encodeABI(),
+        ZERO_BYTES32,
+        '0xdedb4563ef0095db01d81d3f2decf57cf83e4a72aa792af14c43a792b56f4de6',
+      );
+
+      await this.timelock.schedule(
+        operation.target,
+        operation.value,
+        operation.data,
+        operation.predecessor,
+        operation.salt,
+        MINDELAY,
+        { from: proposer },
+      );
+      await time.increase(MINDELAY);
+
+      expect(await web3.eth.getBalance(this.timelock.address)).to.be.bignumber.equal(web3.utils.toBN(0));
+      expect(await web3.eth.getBalance(this.callreceivermock.address)).to.be.bignumber.equal(web3.utils.toBN(0));
+
+      await expectRevert(
+        this.timelock.execute(
+          operation.target,
+          operation.value,
+          operation.data,
+          operation.predecessor,
+          operation.salt,
+          { from: executor },
+        ),
+        'TimelockController: underlying transaction reverted',
+      );
+
+      expect(await web3.eth.getBalance(this.timelock.address)).to.be.bignumber.equal(web3.utils.toBN(0));
+      expect(await web3.eth.getBalance(this.callreceivermock.address)).to.be.bignumber.equal(web3.utils.toBN(0));
+    });
+  });
+});