Add escape-hatch admin actions guarded by 48-hour timelock

[greatest0fallt1me]

Description

This is a smart-contract issue for the GrantFox campaign. Critical actions (pause, upgrade, sweep) must propose first and execute only after a 48h timelock window.

Requirements and Context

• propose/execute pair per action
• Window from env
• Cancellable by admin
• Test wall-clock manipulation
• Must be secure, tested, and documented
• Should be efficient and easy to review

Suggested Execution

1. Fork the repo and create a branch

   git checkout -b feature/admin-timelock

2. Implement changes
   • contracts/vault/src/timelock.rs (new)
   • contracts/settlement/src/timelock.rs (new)
   • contracts/vault/src/test.rs
3. Test and commit
   • Run the repo's standard test suite and lint
   • Cover edge cases; include output in the PR

Example commit message

feat: 48h timelock for critical admin actions

Acceptance Criteria

• Propose stores
• Execute fails before window
• Cancel works
• Tests cover boundary

Guidelines

• Minimum 95% test coverage with cargo test
• require_auth on every state-changing entrypoint
• Overflow-safe math; no unwrap() in production paths
• Clear NatSpec-style /// rustdoc
• Timeframe: 96 hours

[TheShnider]

@TheShnider has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi. I have reviewed this issue and would like to work on it.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @TheShnider to this issue.

[Chrisbankz0]

@Chrisbankz0 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello, I’m a full stack developer with hands-on experience building with variety of tools including Nextjs, nodejs, nestjs, React, Typescript and more

I focus on writing clear, maintainable code and making sure features work as expected end to end, not just in isolation. I communicate progress regularly and keep things transparent as I work. I’m confident I can complete this task within an ETA of 6 HOURS

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Chrisbankz0 to this issue.

[IfyJustin91]

@IfyJustin91 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi Maintainers,

I'd like to work on this issue. I understand the goal is to introduce a secure 48-hour timelock for critical admin actions by implementing propose/execute workflows with cancellation support. I can implement the timelock modules, enforce authorization and execution windows, add comprehensive boundary and time-based tests, and ensure the solution is secure, well-documented, and consistent with the existing contract architecture.

I'd appreciate being assigned to this issue. Thank you!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @IfyJustin91 to this issue.

[grantfox-oss]

🦊 GrantFox — @IfyJustin91 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #482)
2. Your PR will be reviewed by the CalloraOrg maintainers

Good luck! Track your progress on GrantFox.

[drips-wave]

Congratulations, @IfyJustin91! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @IfyJustin91: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊