I was going through compound's Timelock.sol contract and found this function.

function setDelay(uint delay_) public {
            msg.sender == address(this),
            "Timelock::setDelay: Call must come from Timelock."
            delay_ >= MINIMUM_DELAY,
            "Timelock::setDelay: Delay must exceed minimum delay."
            delay_ <= MAXIMUM_DELAY,
            "Timelock::setDelay: Delay must not exceed maximum delay."
        delay = delay_;

        emit NewDelay(delay);

This function is not called anywhere in the whole project, and not in the same contract, still, it requires msg.sender == address(this), which is practically impossible I guess. So how will this method ever execute?

2 Answers 2


The purpose of Timelock contract is to put a limit on the privileges of the admin, by forcing a two step process with a preset delay time. The setDelay() function with the requires msg.sender == address(this) is to prevent any external address from setting himself as the admin and thus changing the delay time because that is considered an exploit that allows to sidestep the delay for the timelock, effectively bypassing all of the timelock’s security guarantees.

See: https://code4rena.com/reports/2021-11-malt/

  • But what is the use of that function if nobody can ever call it. If they didn't want for anyone to ever change delay time. Why not just make it a constant? Why write unusable function?
    – Sky
    Dec 19, 2022 at 6:32
  • The MINIMUM_DELAY and MAXIMUM_DELAY variables are already constants. Dec 19, 2022 at 6:36
  • I think the question is this:"How would functionality of the contract be changed if the function setDelay() wasn't implemented it all"
    – Sky
    Dec 19, 2022 at 6:43
  • 1
    @YongjianP. I kinda have the same question as @Sky. I get that this function puts an added security to the function, but how will it even be executed? There is no function call to setDelay() in the whole project. How will this function be executed? Dec 19, 2022 at 6:44
  • @YongjianP. as per you this is added security that only contract can call this function, but admin can also call this using .call() in any of functions in the same contract. How is this still secure? Dec 19, 2022 at 7:52

In the Solidity programming language, msg.sender is a built-in variable that refers to the address of the contract caller, and address(this) is the address of the contract itself.

The code you provided checks if msg.sender is equal to address(this), which means it checks if the contract caller is the contract itself. This check is used to ensure that the contract's internal logic is being executed, rather than an external contract calling this function.

It is possible that this function is intended to be called internally within the contract, rather than by external contracts. In this case, the function would be called by other functions within the contract, and msg.sender would be equal to address(this).

It is also possible that this function was intended to be called by external contracts, but was never actually used in the project. In this case, the function would never be executed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.