Time-delay proxies (#6770)

* Time-delay proxies. * Tests * Initial couple of benchmarks * Fix up runtime * Last couple of benchmarks * Tests * Docs * Migration * add tests to proxy benchmarks * generated benchmarks, not integrated * Fix weight trait * integrate weightinfo * default weight * Grumble * Deduplication, split proxy from announced_proxy and don't require reauthentication * Fix * Remoe superfluous * Typos * Indent * Fix * Fixes * rename 'proxy_announced' -> 'announced_proxy' * flip rename * comments and spacing * fix proxy_announced * remove unneeded `execute` marker * Avoid unneeded changes to extrinsic indices * Cleanup * Fixes * Update Benchmarks and Weights for Delayed Proxy (#6811) * update bechmarks to parameterize announcements * remove announcement param from proxy * Update pallet_proxy.rs * Update weights * Bump runtime * Fix benchmark Co-authored-by: Shawn Tabrizi <shawntabrizi@gmail.com>
2026-04-28 15:37:56 +00:00 · 2020-08-23 15:52:40 +05:00
parent e7f25ebda8
commit cf4c744eb3
8 changed files with 866 additions and 127 deletions
@@ -20,13 +20,21 @@
 #![cfg(feature = "runtime-benchmarks")]

 use super::*;
-use frame_system::RawOrigin;
+use frame_system::{RawOrigin, EventRecord};
 use frame_benchmarking::{benchmarks, account, whitelisted_caller};
 use sp_runtime::traits::Bounded;
 use crate::Module as Proxy;

 const SEED: u32 = 0;

+fn assert_last_event<T: Trait>(generic_event: <T as Trait>::Event) {
+	let events = frame_system::Module::<T>::events();
+	let system_event: <T as frame_system::Trait>::Event = generic_event.into();
+	// compare to the last event record
+	let EventRecord { event, .. } = &events[events.len() - 1];
+	assert_eq!(event, &system_event);
+}
+
 fn add_proxies<T: Trait>(n: u32, maybe_who: Option<T::AccountId>) -> Result<(), &'static str> {
 	let caller = maybe_who.unwrap_or_else(|| whitelisted_caller());
 	T::Currency::make_free_balance_be(&caller, BalanceOf::<T>::max_value());
@@ -34,7 +42,38 @@ fn add_proxies<T: Trait>(n: u32, maybe_who: Option<T::AccountId>) -> Result<(),
 		Proxy::<T>::add_proxy(
 			RawOrigin::Signed(caller.clone()).into(),
 			account("target", i, SEED),
-			T::ProxyType::default()
+			T::ProxyType::default(),
+			T::BlockNumber::zero(),
+		)?;
+	}
+	Ok(())
+}
+
+fn add_announcements<T: Trait>(
+	n: u32,
+	maybe_who: Option<T::AccountId>,
+	maybe_real: Option<T::AccountId>
+) -> Result<(), &'static str> {
+	let caller = maybe_who.unwrap_or_else(|| account("caller", 0, SEED));
+	T::Currency::make_free_balance_be(&caller, BalanceOf::<T>::max_value());
+	let real = if let Some(real) = maybe_real {
+		real
+	} else {
+		let real = account("real", 0, SEED);
+		T::Currency::make_free_balance_be(&real, BalanceOf::<T>::max_value());
+		Proxy::<T>::add_proxy(
+			RawOrigin::Signed(real.clone()).into(),
+			caller.clone(),
+			T::ProxyType::default(),
+			T::BlockNumber::zero(),
+		)?;
+		real
+	};
+	for _ in 0..n {
+		Proxy::<T>::announce(
+			RawOrigin::Signed(caller.clone()).into(),
+			real.clone(),
+			T::CallHasher::hash_of(&("add_announcement", n)),
 		)?;
 	}
 	Ok(())
@@ -49,43 +88,171 @@ benchmarks! {
 		let p in ...;
 		// In this case the caller is the "target" proxy
 		let caller: T::AccountId = account("target", p - 1, SEED);
+		T::Currency::make_free_balance_be(&caller, BalanceOf::<T>::max_value());
 		// ... and "real" is the traditional caller. This is not a typo.
 		let real: T::AccountId = whitelisted_caller();
 		let call: <T as Trait>::Call = frame_system::Call::<T>::remark(vec![]).into();
 	}: _(RawOrigin::Signed(caller), real, Some(T::ProxyType::default()), Box::new(call))
+	verify {
+		assert_last_event::<T>(RawEvent::ProxyExecuted(Ok(())).into())
+	}
+
+	proxy_announced {
+		let a in 0 .. T::MaxPending::get() - 1;
+		let p in ...;
+		// In this case the caller is the "target" proxy
+		let caller: T::AccountId = account("anonymous", 0, SEED);
+		let delegate: T::AccountId = account("target", p - 1, SEED);
+		T::Currency::make_free_balance_be(&delegate, BalanceOf::<T>::max_value());
+		// ... and "real" is the traditional caller. This is not a typo.
+		let real: T::AccountId = whitelisted_caller();
+		let call: <T as Trait>::Call = frame_system::Call::<T>::remark(vec![]).into();
+		Proxy::<T>::announce(
+			RawOrigin::Signed(delegate.clone()).into(),
+			real.clone(),
+			T::CallHasher::hash_of(&call),
+		)?;
+		add_announcements::<T>(a, Some(delegate.clone()), None)?;
+	}: _(RawOrigin::Signed(caller), delegate, real, Some(T::ProxyType::default()), Box::new(call))
+	verify {
+		assert_last_event::<T>(RawEvent::ProxyExecuted(Ok(())).into())
+	}
+
+	remove_announcement {
+		let a in 0 .. T::MaxPending::get() - 1;
+		let p in ...;
+		// In this case the caller is the "target" proxy
+		let caller: T::AccountId = account("target", p - 1, SEED);
+		T::Currency::make_free_balance_be(&caller, BalanceOf::<T>::max_value());
+		// ... and "real" is the traditional caller. This is not a typo.
+		let real: T::AccountId = whitelisted_caller();
+		let call: <T as Trait>::Call = frame_system::Call::<T>::remark(vec![]).into();
+		Proxy::<T>::announce(
+			RawOrigin::Signed(caller.clone()).into(),
+			real.clone(),
+			T::CallHasher::hash_of(&call),
+		)?;
+		add_announcements::<T>(a, Some(caller.clone()), None)?;
+	}: _(RawOrigin::Signed(caller.clone()), real, T::CallHasher::hash_of(&call))
+	verify {
+		let (announcements, _) = Announcements::<T>::get(&caller);
+		assert_eq!(announcements.len() as u32, a);
+	}
+
+	reject_announcement {
+		let a in 0 .. T::MaxPending::get() - 1;
+		let p in ...;
+		// In this case the caller is the "target" proxy
+		let caller: T::AccountId = account("target", p - 1, SEED);
+		T::Currency::make_free_balance_be(&caller, BalanceOf::<T>::max_value());
+		// ... and "real" is the traditional caller. This is not a typo.
+		let real: T::AccountId = whitelisted_caller();
+		let call: <T as Trait>::Call = frame_system::Call::<T>::remark(vec![]).into();
+		Proxy::<T>::announce(
+			RawOrigin::Signed(caller.clone()).into(),
+			real.clone(),
+			T::CallHasher::hash_of(&call),
+		)?;
+		add_announcements::<T>(a, Some(caller.clone()), None)?;
+	}: _(RawOrigin::Signed(real), caller.clone(), T::CallHasher::hash_of(&call))
+	verify {
+		let (announcements, _) = Announcements::<T>::get(&caller);
+		assert_eq!(announcements.len() as u32, a);
+	}
+
+	announce {
+		let a in 0 .. T::MaxPending::get() - 1;
+		let p in ...;
+		// In this case the caller is the "target" proxy
+		let caller: T::AccountId = account("target", p - 1, SEED);
+		T::Currency::make_free_balance_be(&caller, BalanceOf::<T>::max_value());
+		// ... and "real" is the traditional caller. This is not a typo.
+		let real: T::AccountId = whitelisted_caller();
+		add_announcements::<T>(a, Some(caller.clone()), None)?;
+		let call: <T as Trait>::Call = frame_system::Call::<T>::remark(vec![]).into();
+		let call_hash = T::CallHasher::hash_of(&call);
+	}: _(RawOrigin::Signed(caller.clone()), real.clone(), call_hash)
+	verify {
+		assert_last_event::<T>(RawEvent::Announced(real, caller, call_hash).into());
+	}

 	add_proxy {
 		let p in ...;
 		let caller: T::AccountId = whitelisted_caller();
-	}: _(RawOrigin::Signed(caller), account("target", T::MaxProxies::get().into(), SEED), T::ProxyType::default())
+	}: _(
+		RawOrigin::Signed(caller.clone()),
+		account("target", T::MaxProxies::get().into(), SEED),
+		T::ProxyType::default(),
+		T::BlockNumber::zero()
+	)
+	verify {
+		let (proxies, _) = Proxies::<T>::get(caller);
+		assert_eq!(proxies.len() as u32, p + 1);
+	}

 	remove_proxy {
 		let p in ...;
 		let caller: T::AccountId = whitelisted_caller();
-	}: _(RawOrigin::Signed(caller), account("target", 0, SEED), T::ProxyType::default())
+	}: _(
+		RawOrigin::Signed(caller.clone()),
+		account("target", 0, SEED),
+		T::ProxyType::default(),
+		T::BlockNumber::zero()
+	)
+	verify {
+		let (proxies, _) = Proxies::<T>::get(caller);
+		assert_eq!(proxies.len() as u32, p - 1);
+	}

 	remove_proxies {
 		let p in ...;
 		let caller: T::AccountId = whitelisted_caller();
-	}: _(RawOrigin::Signed(caller))
+	}: _(RawOrigin::Signed(caller.clone()))
+	verify {
+		let (proxies, _) = Proxies::<T>::get(caller);
+		assert_eq!(proxies.len() as u32, 0);
+	}

 	anonymous {
 		let p in ...;
-	}: _(RawOrigin::Signed(whitelisted_caller()), T::ProxyType::default(), 0)
+		let caller: T::AccountId = whitelisted_caller();
+	}: _(
+		RawOrigin::Signed(caller.clone()),
+		T::ProxyType::default(),
+		T::BlockNumber::zero(),
+		0
+	)
+	verify {
+		let anon_account = Module::<T>::anonymous_account(&caller, &T::ProxyType::default(), 0, None);
+		assert_last_event::<T>(RawEvent::AnonymousCreated(
+			anon_account,
+			caller,
+			T::ProxyType::default(),
+			0,
+		).into());
+	}

 	kill_anonymous {
 		let p in 0 .. (T::MaxProxies::get() - 2).into();

 		let caller: T::AccountId = whitelisted_caller();
 		T::Currency::make_free_balance_be(&caller, BalanceOf::<T>::max_value());
-		Module::<T>::anonymous(RawOrigin::Signed(whitelisted_caller()).into(), T::ProxyType::default(), 0)?;
+		Module::<T>::anonymous(
+			RawOrigin::Signed(whitelisted_caller()).into(),
+			T::ProxyType::default(),
+			T::BlockNumber::zero(),
+			0
+		)?;
 		let height = system::Module::<T>::block_number();
 		let ext_index = system::Module::<T>::extrinsic_index().unwrap_or(0);
 		let anon = Module::<T>::anonymous_account(&caller, &T::ProxyType::default(), 0, None);

 		add_proxies::<T>(p, Some(anon.clone()))?;
-
-	}: _(RawOrigin::Signed(anon), caller, T::ProxyType::default(), 0, height, ext_index)
+		ensure!(Proxies::<T>::contains_key(&anon), "anon proxy not created");
+	}: _(RawOrigin::Signed(anon.clone()), caller.clone(), T::ProxyType::default(), 0, height, ext_index)
+	verify {
+		assert!(!Proxies::<T>::contains_key(&anon));
+	}
 }

 #[cfg(test)]
@@ -98,6 +265,10 @@ mod tests {
 	fn test_benchmarks() {
 		new_test_ext().execute_with(|| {
 			assert_ok!(test_benchmark_proxy::<Test>());
+			assert_ok!(test_benchmark_proxy_announced::<Test>());
+			assert_ok!(test_benchmark_remove_announcement::<Test>());
+			assert_ok!(test_benchmark_reject_announcement::<Test>());
+			assert_ok!(test_benchmark_announce::<Test>());
 			assert_ok!(test_benchmark_add_proxy::<Test>());
 			assert_ok!(test_benchmark_remove_proxy::<Test>());
 			assert_ok!(test_benchmark_remove_proxies::<Test>());
@@ -0,0 +1,84 @@
+// Copyright (C) 2020 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// 	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! THIS FILE WAS AUTO-GENERATED USING THE SUBSTRATE BENCHMARK CLI VERSION 2.0.0-rc5
+
+use frame_support::weights::{Weight, constants::RocksDbWeight as DbWeight};
+
+impl crate::WeightInfo for () {
+	fn proxy(p: u32, ) -> Weight {
+		(26127000 as Weight)
+			.saturating_add((214000 as Weight).saturating_mul(p as Weight))
+			.saturating_add(DbWeight::get().reads(1 as Weight))
+	}
+	fn proxy_announced(a: u32, p: u32, ) -> Weight {
+		(55405000 as Weight)
+			.saturating_add((774000 as Weight).saturating_mul(a as Weight))
+			.saturating_add((209000 as Weight).saturating_mul(p as Weight))
+			.saturating_add(DbWeight::get().reads(3 as Weight))
+			.saturating_add(DbWeight::get().writes(2 as Weight))
+	}
+	fn remove_announcement(a: u32, p: u32, ) -> Weight {
+		(35879000 as Weight)
+			.saturating_add((783000 as Weight).saturating_mul(a as Weight))
+			.saturating_add((20000 as Weight).saturating_mul(p as Weight))
+			.saturating_add(DbWeight::get().reads(2 as Weight))
+			.saturating_add(DbWeight::get().writes(2 as Weight))
+	}
+	fn reject_announcement(a: u32, p: u32, ) -> Weight {
+		(36097000 as Weight)
+			.saturating_add((780000 as Weight).saturating_mul(a as Weight))
+			.saturating_add((12000 as Weight).saturating_mul(p as Weight))
+			.saturating_add(DbWeight::get().reads(2 as Weight))
+			.saturating_add(DbWeight::get().writes(2 as Weight))
+	}
+	fn announce(a: u32, p: u32, ) -> Weight {
+		(53769000 as Weight)
+			.saturating_add((675000 as Weight).saturating_mul(a as Weight))
+			.saturating_add((214000 as Weight).saturating_mul(p as Weight))
+			.saturating_add(DbWeight::get().reads(3 as Weight))
+			.saturating_add(DbWeight::get().writes(2 as Weight))
+	}
+	fn add_proxy(p: u32, ) -> Weight {
+		(36082000 as Weight)
+			.saturating_add((234000 as Weight).saturating_mul(p as Weight))
+			.saturating_add(DbWeight::get().reads(1 as Weight))
+			.saturating_add(DbWeight::get().writes(1 as Weight))
+	}
+	fn remove_proxy(p: u32, ) -> Weight {
+		(32885000 as Weight)
+			.saturating_add((267000 as Weight).saturating_mul(p as Weight))
+			.saturating_add(DbWeight::get().reads(1 as Weight))
+			.saturating_add(DbWeight::get().writes(1 as Weight))
+	}
+	fn remove_proxies(p: u32, ) -> Weight {
+		(31735000 as Weight)
+			.saturating_add((215000 as Weight).saturating_mul(p as Weight))
+			.saturating_add(DbWeight::get().reads(1 as Weight))
+			.saturating_add(DbWeight::get().writes(1 as Weight))
+	}
+	fn anonymous(p: u32, ) -> Weight {
+		(50907000 as Weight)
+			.saturating_add((61000 as Weight).saturating_mul(p as Weight))
+			.saturating_add(DbWeight::get().reads(2 as Weight))
+			.saturating_add(DbWeight::get().writes(1 as Weight))
+	}
+	fn kill_anonymous(p: u32, ) -> Weight {
+		(33926000 as Weight)
+			.saturating_add((208000 as Weight).saturating_mul(p as Weight))
+			.saturating_add(DbWeight::get().reads(1 as Weight))
+			.saturating_add(DbWeight::get().writes(1 as Weight))
+	}
+}
@@ -19,6 +19,10 @@
 //! A module allowing accounts to give permission to other accounts to dispatch types of calls from
 //! their signed origin.
 //!
+//! The accounts to which permission is delegated may be requied to announce the action that they
+//! wish to execute some duration prior to execution happens. In this case, the target account may
+//! reject the announcement and in doing so, veto the execution.
+//!
 //! - [`proxy::Trait`](./trait.Trait.html)
 //! - [`Call`](./enum.Call.html)
 //!
@@ -37,23 +41,27 @@
 use sp_std::prelude::*;
 use codec::{Encode, Decode};
 use sp_io::hashing::blake2_256;
-use sp_runtime::{DispatchResult, traits::{Dispatchable, Zero}};
-use sp_runtime::traits::Member;
+use sp_runtime::{DispatchResult, traits::{Dispatchable, Zero, Hash, Member, Saturating}};
 use frame_support::{
-	decl_module, decl_event, decl_error, decl_storage, Parameter, ensure, traits::{
-		Get, ReservableCurrency, Currency, InstanceFilter,
-		OriginTrait, IsType,
-	}, weights::{Weight, GetDispatchInfo, constants::{WEIGHT_PER_MICROS, WEIGHT_PER_NANOS}},
-	dispatch::{PostDispatchInfo, IsSubType},
+	decl_module, decl_event, decl_error, decl_storage, Parameter, ensure, RuntimeDebug, traits::{
+		Get, ReservableCurrency, Currency, InstanceFilter, OriginTrait, IsType,
+	}, weights::{Weight, GetDispatchInfo},
+	dispatch::{PostDispatchInfo, IsSubType}, storage::IterableStorageMap,
 };
 use frame_system::{self as system, ensure_signed};
+use frame_support::dispatch::DispatchError;

 mod tests;
 mod benchmarking;
+mod default_weight;

 type BalanceOf<T> = <<T as Trait>::Currency as Currency<<T as frame_system::Trait>::AccountId>>::Balance;

 pub trait WeightInfo {
+	fn proxy_announced(a: u32, p: u32, ) -> Weight;
+	fn remove_announcement(a: u32, p: u32, ) -> Weight;
+	fn reject_announcement(a: u32, p: u32, ) -> Weight;
+	fn announce(a: u32, p: u32, ) -> Weight;
 	fn proxy(p: u32, ) -> Weight;
 	fn add_proxy(p: u32, ) -> Weight;
 	fn remove_proxy(p: u32, ) -> Weight;
@@ -62,15 +70,6 @@ pub trait WeightInfo {
 	fn kill_anonymous(p: u32, ) -> Weight;
 }

-impl WeightInfo for () {
-	fn proxy(_p: u32, ) -> Weight { 1_000_000_000 }
-	fn add_proxy(_p: u32, ) -> Weight { 1_000_000_000 }
-	fn remove_proxy(_p: u32, ) -> Weight { 1_000_000_000 }
-	fn remove_proxies(_p: u32, ) -> Weight { 1_000_000_000 }
-	fn anonymous(_p: u32, ) -> Weight { 1_000_000_000 }
-	fn kill_anonymous(_p: u32, ) -> Weight { 1_000_000_000 }
-}
-
 /// Configuration trait.
 pub trait Trait: frame_system::Trait {
 	/// The overarching event type.
@@ -108,19 +107,67 @@ pub trait Trait: frame_system::Trait {

 	/// Weight information for extrinsics in this pallet.
 	type WeightInfo: WeightInfo;
+
+	/// The maximum amount of time-delayed announcements that are allowed to be pending.
+	type MaxPending: Get<u32>;
+
+	/// The type of hash used for hashing the call.
+	type CallHasher: Hash;
+
+	/// The base amount of currency needed to reserve for creating an announcement.
+	///
+	/// This is held when a new storage item holding a `Balance` is created (typically 16 bytes).
+	type AnnouncementDepositBase: Get<BalanceOf<Self>>;
+
+	/// The amount of currency needed per announcement made.
+	///
+	/// This is held for adding an `AccountId`, `Hash` and `BlockNumber` (typically 68 bytes)
+	/// into a pre-existing storage value.
+	type AnnouncementDepositFactor: Get<BalanceOf<Self>>;
 }

+/// The parameters under which a particular account has a proxy relationship with some other
+/// account.
+#[derive(Encode, Decode, Clone, Copy, Eq, PartialEq, Ord, PartialOrd, RuntimeDebug)]
+pub struct ProxyDefinition<AccountId, ProxyType, BlockNumber> {
+	/// The account which may act on behalf of another.
+	delegate: AccountId,
+	/// A value defining the subset of calls that it is allowed to make.
+	proxy_type: ProxyType,
+	/// The number of blocks that an announcement must be in place for before the corresponding call
+	/// may be dispatched. If zero, then no announcement is needed.
+	delay: BlockNumber,
+}
+
+/// Details surrounding a specific instance of an announcement to make a call.
+#[derive(Encode, Decode, Clone, Copy, Eq, PartialEq, RuntimeDebug)]
+pub struct Announcement<AccountId, Hash, BlockNumber> {
+	/// The account which made the announcement.
+	real: AccountId,
+	/// The hash of the call to be made.
+	call_hash: Hash,
+	/// The height at which the announcement was made.
+	height: BlockNumber,
+}
+
+type CallHashOf<T> = <<T as Trait>::CallHasher as Hash>::Output;
+
 decl_storage! {
 	trait Store for Module<T: Trait> as Proxy {
 		/// The set of account proxies. Maps the account which has delegated to the accounts
 		/// which are being delegated to, together with the amount held on deposit.
-		pub Proxies: map hasher(twox_64_concat) T::AccountId => (Vec<(T::AccountId, T::ProxyType)>, BalanceOf<T>);
+		pub Proxies: map hasher(twox_64_concat) T::AccountId
+			=> (Vec<ProxyDefinition<T::AccountId, T::ProxyType, T::BlockNumber>>, BalanceOf<T>);
+
+		/// The announcements made by the proxy (key).
+		pub Announcements: map hasher(twox_64_concat) T::AccountId
+			=> (Vec<Announcement<T::AccountId, CallHashOf<T>, T::BlockNumber>>, BalanceOf<T>);
 	}
 }

 decl_error! {
 	pub enum Error for Module<T: Trait> {
-		/// There are too many proxies registered.
+		/// There are too many proxies registered or too many announcements pending.
 		TooMany,
 		/// Proxy registration not found.
 		NotFound,
@@ -132,6 +179,8 @@ decl_error! {
 		Duplicate,
 		/// Call may not be made by proxy because it may escalate its privileges.
 		NoPermission,
+		/// Announcement, if made at all, was made too recently.
+		Unannounced,
 	}
 }

@@ -139,13 +188,16 @@ decl_event! {
 	/// Events type.
 	pub enum Event<T> where
 		AccountId = <T as frame_system::Trait>::AccountId,
-		ProxyType = <T as Trait>::ProxyType
+		ProxyType = <T as Trait>::ProxyType,
+		Hash = CallHashOf<T>,
 	{
 		/// A proxy was executed correctly, with the given [result].
 		ProxyExecuted(DispatchResult),
 		/// Anonymous account has been created by new proxy with given
 		/// disambiguation index and proxy type. [anonymous, who, proxy_type, disambiguation_index]
 		AnonymousCreated(AccountId, AccountId, ProxyType, u16),
+		/// An announcement was placed to make a call in the future. [real, proxy, call_hash]
+		Announced(AccountId, AccountId, Hash),
 	}
 }

@@ -165,9 +217,36 @@ decl_module! {
 		/// The maximum amount of proxies allowed for a single account.
 		const MaxProxies: u16 = T::MaxProxies::get();

+		/// `MaxPending` metadata shadow.
+		const MaxPending: u32 = T::MaxPending::get();
+
+		/// `AnnouncementDepositBase` metadata shadow.
+		const AnnouncementDepositBase: BalanceOf<T> = T::AnnouncementDepositBase::get();
+
+		/// `AnnouncementDepositFactor` metadata shadow.
+		const AnnouncementDepositFactor: BalanceOf<T> = T::AnnouncementDepositFactor::get();
+
+		fn on_runtime_upgrade() -> Weight {
+			Proxies::<T>::translate::<(Vec<(T::AccountId, T::ProxyType)>, BalanceOf<T>), _>(
+				|_, (targets, deposit)| Some((
+					targets.into_iter()
+						.map(|(a, t)| ProxyDefinition {
+							delegate: a,
+							proxy_type: t,
+							delay: Zero::zero(),
+						})
+						.collect::<Vec<_>>(),
+					deposit,
+				))
+			);
+			T::MaximumBlockWeight::get()
+		}
+
 		/// Dispatch the given `call` from an account that the sender is authorised for through
 		/// `add_proxy`.
 		///
+		/// Removes any corresponding announcement(s).
+		///
 		/// The dispatch origin for this call must be _Signed_.
 		///
 		/// Parameters:
@@ -176,43 +255,24 @@ decl_module! {
 		/// - `call`: The call to be made by the `real` account.
 		///
 		/// # <weight>
-		/// P is the number of proxies the user has
-		/// - Base weight: 19.87 + .141 * P µs
-		/// - DB weight: 1 storage read.
-		/// - Plus the weight of the `call`
+		/// Weight is a function of the number of proxies the user has (P).
 		/// # </weight>
 		#[weight = {
 			let di = call.get_dispatch_info();
-			(T::DbWeight::get().reads(1)
-				.saturating_add(di.weight)
-				.saturating_add(20 * WEIGHT_PER_MICROS)
-				.saturating_add((140 * WEIGHT_PER_NANOS).saturating_mul(T::MaxProxies::get().into())),
+			(T::WeightInfo::proxy(T::MaxProxies::get().into())
+				.saturating_add(di.weight),
 			di.class)
 		}]
 		fn proxy(origin,
 			real: T::AccountId,
 			force_proxy_type: Option<T::ProxyType>,
-			call: Box<<T as Trait>::Call>
+			call: Box<<T as Trait>::Call>,
 		) {
 			let who = ensure_signed(origin)?;
-			let (_, proxy_type) = Proxies::<T>::get(&real).0.into_iter()
-				.find(|x| &x.0 == &who && force_proxy_type.as_ref().map_or(true, |y| &x.1 == y))
-				.ok_or(Error::<T>::NotProxy)?;
+			let def = Self::find_proxy(&real, &who, force_proxy_type)?;
+			ensure!(def.delay.is_zero(), Error::<T>::Unannounced);

-			// This is a freshly authenticated new account, the origin restrictions doesn't apply.
-			let mut origin: T::Origin = frame_system::RawOrigin::Signed(real).into();
-			origin.add_filter(move |c: &<T as frame_system::Trait>::Call| {
-				let c = <T as Trait>::Call::from_ref(c);
-				match c.is_sub_type() {
-					Some(Call::add_proxy(_, ref pt)) | Some(Call::remove_proxy(_, ref pt))
-						if !proxy_type.is_superset(&pt) => false,
-					Some(Call::remove_proxies(..)) | Some(Call::kill_anonymous(..))
-					    if proxy_type != T::ProxyType::default() => false,
-					_ => proxy_type.filter(c)
-				}
-			});
-			let e = call.dispatch(origin);
-			Self::deposit_event(RawEvent::ProxyExecuted(e.map(|_| ()).map_err(|e| e.error)));
+			Self::do_proxy(def, real, *call);
 		}

 		/// Register a proxy account for the sender that is able to make calls on its behalf.
@@ -224,21 +284,20 @@ decl_module! {
 		/// - `proxy_type`: The permissions allowed for this proxy account.
 		///
 		/// # <weight>
-		/// P is the number of proxies the user has
-		/// - Base weight: 17.48 + .176 * P µs
-		/// - DB weight: 1 storage read and write.
+		/// Weight is a function of the number of proxies the user has (P).
 		/// # </weight>
-		#[weight = T::DbWeight::get().reads_writes(1, 1)
-			.saturating_add(18 * WEIGHT_PER_MICROS)
-			.saturating_add((200 * WEIGHT_PER_NANOS).saturating_mul(T::MaxProxies::get().into()))
-		]
-		fn add_proxy(origin, proxy: T::AccountId, proxy_type: T::ProxyType) -> DispatchResult {
+		#[weight = T::WeightInfo::add_proxy(T::MaxProxies::get().into())]
+		fn add_proxy(origin,
+			delegate: T::AccountId,
+			proxy_type: T::ProxyType,
+			delay: T::BlockNumber,
+		) -> DispatchResult {
 			let who = ensure_signed(origin)?;
 			Proxies::<T>::try_mutate(&who, |(ref mut proxies, ref mut deposit)| {
 				ensure!(proxies.len() < T::MaxProxies::get() as usize, Error::<T>::TooMany);
-				let typed_proxy = (proxy, proxy_type);
-				let i = proxies.binary_search(&typed_proxy).err().ok_or(Error::<T>::Duplicate)?;
-				proxies.insert(i, typed_proxy);
+				let proxy_def = ProxyDefinition { delegate, proxy_type, delay };
+				let i = proxies.binary_search(&proxy_def).err().ok_or(Error::<T>::Duplicate)?;
+				proxies.insert(i, proxy_def);
 				let new_deposit = T::ProxyDepositBase::get()
 					+ T::ProxyDepositFactor::get() * (proxies.len() as u32).into();
 				if new_deposit > *deposit {
@@ -260,20 +319,19 @@ decl_module! {
 		/// - `proxy_type`: The permissions currently enabled for the removed proxy account.
 		///
 		/// # <weight>
-		/// P is the number of proxies the user has
-		/// - Base weight: 14.37 + .164 * P µs
-		/// - DB weight: 1 storage read and write.
+		/// Weight is a function of the number of proxies the user has (P).
 		/// # </weight>
-		#[weight = T::DbWeight::get().reads_writes(1, 1)
-			.saturating_add(14 * WEIGHT_PER_MICROS)
-			.saturating_add((160 * WEIGHT_PER_NANOS).saturating_mul(T::MaxProxies::get().into()))
-		]
-		fn remove_proxy(origin, proxy: T::AccountId, proxy_type: T::ProxyType) -> DispatchResult {
+		#[weight = T::WeightInfo::remove_proxy(T::MaxProxies::get().into())]
+		fn remove_proxy(origin,
+			delegate: T::AccountId,
+			proxy_type: T::ProxyType,
+			delay: T::BlockNumber,
+		) -> DispatchResult {
 			let who = ensure_signed(origin)?;
 			Proxies::<T>::try_mutate_exists(&who, |x| {
 				let (mut proxies, old_deposit) = x.take().ok_or(Error::<T>::NotFound)?;
-				let typed_proxy = (proxy, proxy_type);
-				let i = proxies.binary_search(&typed_proxy).ok().ok_or(Error::<T>::NotFound)?;
+				let proxy_def = ProxyDefinition { delegate, proxy_type, delay };
+				let i = proxies.binary_search(&proxy_def).ok().ok_or(Error::<T>::NotFound)?;
 				proxies.remove(i);
 				let new_deposit = if proxies.is_empty() {
 					BalanceOf::<T>::zero()
@@ -300,14 +358,9 @@ decl_module! {
 		/// the unreserved fees will be inaccessible. **All access to this account will be lost.**
 		///
 		/// # <weight>
-		/// P is the number of proxies the user has
-		/// - Base weight: 13.73 + .129 * P µs
-		/// - DB weight: 1 storage read and write.
+		/// Weight is a function of the number of proxies the user has (P).
 		/// # </weight>
-		#[weight = T::DbWeight::get().reads_writes(1, 1)
-			.saturating_add(14 * WEIGHT_PER_MICROS)
-			.saturating_add((130 * WEIGHT_PER_NANOS).saturating_mul(T::MaxProxies::get().into()))
-		]
+		#[weight = T::WeightInfo::remove_proxies(T::MaxProxies::get().into())]
 		fn remove_proxies(origin) {
 			let who = ensure_signed(origin)?;
 			let (_, old_deposit) = Proxies::<T>::take(&who);
@@ -325,6 +378,8 @@ decl_module! {
 		/// - `index`: A disambiguation index, in case this is called multiple times in the same
 		/// transaction (e.g. with `utility::batch`). Unless you're using `batch` you probably just
 		/// want to use `0`.
+		/// - `delay`: The announcement period required of the initial proxy. Will generally be
+		/// zero.
 		///
 		/// Fails with `Duplicate` if this has already been called in this transaction, from the
 		/// same sender, with the same parameters.
@@ -332,22 +387,23 @@ decl_module! {
 		/// Fails if there are insufficient funds to pay for deposit.
 		///
 		/// # <weight>
-		/// P is the number of proxies the user has
-		/// - Base weight: 36.48 + .039 * P µs
-		/// - DB weight: 1 storage read and write.
+		/// Weight is a function of the number of proxies the user has (P).
 		/// # </weight>
-		#[weight = T::DbWeight::get().reads_writes(1, 1)
-			.saturating_add(36 * WEIGHT_PER_MICROS)
-			.saturating_add((40 * WEIGHT_PER_NANOS).saturating_mul(T::MaxProxies::get().into()))
-		]
-		fn anonymous(origin, proxy_type: T::ProxyType, index: u16) {
+		/// TODO: Might be over counting 1 read
+		#[weight = T::WeightInfo::anonymous(T::MaxProxies::get().into())]
+		fn anonymous(origin, proxy_type: T::ProxyType, delay: T::BlockNumber, index: u16) {
 			let who = ensure_signed(origin)?;

 			let anonymous = Self::anonymous_account(&who, &proxy_type, index, None);
 			ensure!(!Proxies::<T>::contains_key(&anonymous), Error::<T>::Duplicate);
 			let deposit = T::ProxyDepositBase::get() + T::ProxyDepositFactor::get();
 			T::Currency::reserve(&who, deposit)?;
-			Proxies::<T>::insert(&anonymous, (vec![(who.clone(), proxy_type.clone())], deposit));
+			let proxy_def = ProxyDefinition {
+				delegate: who.clone(),
+				proxy_type: proxy_type.clone(),
+				delay,
+			};
+			Proxies::<T>::insert(&anonymous, (vec![proxy_def], deposit));
 			Self::deposit_event(RawEvent::AnonymousCreated(anonymous, who, proxy_type, index));
 		}

@@ -369,14 +425,9 @@ decl_module! {
 		/// account whose `anonymous` call has corresponding parameters.
 		///
 		/// # <weight>
-		/// P is the number of proxies the user has
-		/// - Base weight: 15.65 + .137 * P µs
-		/// - DB weight: 1 storage read and write.
+		/// Weight is a function of the number of proxies the user has (P).
 		/// # </weight>
-		#[weight = T::DbWeight::get().reads_writes(1, 1)
-			.saturating_add(15 * WEIGHT_PER_MICROS)
-			.saturating_add((140 * WEIGHT_PER_NANOS).saturating_mul(T::MaxProxies::get().into()))
-		]
+		#[weight = T::WeightInfo::kill_anonymous(T::MaxProxies::get().into())]
 		fn kill_anonymous(origin,
 			spawner: T::AccountId,
 			proxy_type: T::ProxyType,
@@ -393,6 +444,140 @@ decl_module! {
 			let (_, deposit) = Proxies::<T>::take(&who);
 			T::Currency::unreserve(&spawner, deposit);
 		}
+
+		/// Publish the hash of a proxy-call that will be made in the future.
+		///
+		/// This must be called some number of blocks before the corresponding `proxy` is attempted
+		/// if the delay associated with the proxy relationship is greater than zero.
+		///
+		/// No more than `MaxPending` announcements may be made at any one time.
+		///
+		/// This will take a deposit of `AnnouncementDepositFactor` as well as
+		/// `AnnouncementDepositBase` if there are no other pending announcements.
+		///
+		/// The dispatch origin for this call must be _Signed_ and a proxy of `real`.
+		///
+		/// Parameters:
+		/// - `real`: The account that the proxy will make a call on behalf of.
+		/// - `call_hash`: The hash of the call to be made by the `real` account.
+		///
+		/// # <weight>
+		/// Weight is a function of:
+		/// - A: the number of announcements made.
+		/// - P: the number of proxies the user has.
+		/// # </weight>
+		#[weight = T::WeightInfo::announce(T::MaxPending::get(), T::MaxProxies::get().into())]
+		fn announce(origin, real: T::AccountId, call_hash: CallHashOf<T>) {
+			let who = ensure_signed(origin)?;
+			Proxies::<T>::get(&real).0.into_iter()
+				.find(|x| &x.delegate == &who)
+				.ok_or(Error::<T>::NotProxy)?;
+
+			let announcement = Announcement {
+				real: real.clone(),
+				call_hash: call_hash.clone(),
+				height: system::Module::<T>::block_number(),
+			};
+
+			Announcements::<T>::try_mutate(&who, |(ref mut pending, ref mut deposit)| {
+				ensure!(pending.len() < T::MaxPending::get() as usize, Error::<T>::TooMany);
+				pending.push(announcement);
+				Self::rejig_deposit(
+					&who,
+					*deposit,
+					T::AnnouncementDepositBase::get(),
+					T::AnnouncementDepositFactor::get(),
+					pending.len(),
+				).map(|d| d.expect("Just pushed; pending.len() > 0; rejig_deposit returns Some; qed"))
+				.map(|d| *deposit = d)
+			})?;
+			Self::deposit_event(RawEvent::Announced(real, who, call_hash));
+		}
+
+		/// Remove a given announcement.
+		///
+		/// May be called by a proxy account to remove a call they previously announced and return
+		/// the deposit.
+		///
+		/// The dispatch origin for this call must be _Signed_.
+		///
+		/// Parameters:
+		/// - `real`: The account that the proxy will make a call on behalf of.
+		/// - `call_hash`: The hash of the call to be made by the `real` account.
+		///
+		/// # <weight>
+		/// Weight is a function of:
+		/// - A: the number of announcements made.
+		/// - P: the number of proxies the user has.
+		/// # </weight>
+		#[weight = T::WeightInfo::remove_announcement(T::MaxPending::get(), T::MaxProxies::get().into())]
+		fn remove_announcement(origin, real: T::AccountId, call_hash: CallHashOf<T>) {
+			let who = ensure_signed(origin)?;
+			Self::edit_announcements(&who, |ann| ann.real != real || ann.call_hash != call_hash)?;
+		}
+
+		/// Remove the given announcement of a delegate.
+		///
+		/// May be called by a target (proxied) account to remove a call that one of their delegates
+		/// (`delegate`) has announced they want to execute. The deposit is returned.
+		///
+		/// The dispatch origin for this call must be _Signed_.
+		///
+		/// Parameters:
+		/// - `delegate`: The account that previously announced the call.
+		/// - `call_hash`: The hash of the call to be made.
+		///
+		/// # <weight>
+		/// Weight is a function of:
+		/// - A: the number of announcements made.
+		/// - P: the number of proxies the user has.
+		/// # </weight>
+		#[weight = T::WeightInfo::reject_announcement(T::MaxPending::get(), T::MaxProxies::get().into())]
+		fn reject_announcement(origin, delegate: T::AccountId, call_hash: CallHashOf<T>) {
+			let who = ensure_signed(origin)?;
+			Self::edit_announcements(&delegate, |ann| ann.real != who || ann.call_hash != call_hash)?;
+		}
+
+		/// Dispatch the given `call` from an account that the sender is authorised for through
+		/// `add_proxy`.
+		///
+		/// Removes any corresponding announcement(s).
+		///
+		/// The dispatch origin for this call must be _Signed_.
+		///
+		/// Parameters:
+		/// - `real`: The account that the proxy will make a call on behalf of.
+		/// - `force_proxy_type`: Specify the exact proxy type to be used and checked for this call.
+		/// - `call`: The call to be made by the `real` account.
+		///
+		/// # <weight>
+		/// Weight is a function of:
+		/// - A: the number of announcements made.
+		/// - P: the number of proxies the user has.
+		/// # </weight>
+		#[weight = {
+			let di = call.get_dispatch_info();
+			(T::WeightInfo::proxy_announced(T::MaxPending::get(), T::MaxProxies::get().into())
+				.saturating_add(di.weight),
+			di.class)
+		}]
+		fn proxy_announced(origin,
+			delegate: T::AccountId,
+			real: T::AccountId,
+			force_proxy_type: Option<T::ProxyType>,
+			call: Box<<T as Trait>::Call>,
+		) {
+			ensure_signed(origin)?;
+			let def = Self::find_proxy(&real, &delegate, force_proxy_type)?;
+
+			let call_hash = T::CallHasher::hash_of(&call);
+			let now = system::Module::<T>::block_number();
+			Self::edit_announcements(&delegate, |ann|
+				ann.real != real || ann.call_hash != call_hash || now.saturating_sub(ann.height) < def.delay
+			).map_err(|_| Error::<T>::Unannounced)?;
+
+			Self::do_proxy(def, real, *call);
+		}
 	}
 }

@@ -411,4 +596,82 @@ impl<T: Trait> Module<T> {
 			.using_encoded(blake2_256);
 		T::AccountId::decode(&mut &entropy[..]).unwrap_or_default()
 	}
+
+	fn rejig_deposit(
+		who: &T::AccountId,
+		old_deposit: BalanceOf<T>,
+		base: BalanceOf<T>,
+		factor: BalanceOf<T>,
+		len: usize,
+	) -> Result<Option<BalanceOf<T>>, DispatchError> {
+		let new_deposit = if len == 0 {
+			BalanceOf::<T>::zero()
+		} else {
+			base + factor * (len as u32).into()
+		};
+		if new_deposit > old_deposit {
+			T::Currency::reserve(&who, new_deposit - old_deposit)?;
+		} else if new_deposit < old_deposit {
+			T::Currency::unreserve(&who, old_deposit - new_deposit);
+		}
+		Ok(if len == 0 {
+			None
+		} else {
+			Some(new_deposit)
+		})
+	}
+
+	fn edit_announcements<
+		F: FnMut(&Announcement<T::AccountId, CallHashOf<T>, T::BlockNumber>) -> bool
+	>(delegate: &T::AccountId, f: F) -> DispatchResult {
+		Announcements::<T>::try_mutate_exists(delegate, |x| {
+			let (mut pending, old_deposit) = x.take().ok_or(Error::<T>::NotFound)?;
+			let orig_pending_len = pending.len();
+			pending.retain(f);
+			ensure!(orig_pending_len > pending.len(), Error::<T>::NotFound);
+			*x = Self::rejig_deposit(
+				delegate,
+				old_deposit,
+				T::AnnouncementDepositBase::get(),
+				T::AnnouncementDepositFactor::get(),
+				pending.len(),
+			)?.map(|deposit| (pending, deposit));
+			Ok(())
+		})
+	}
+
+	fn find_proxy(
+		real: &T::AccountId,
+		delegate: &T::AccountId,
+		force_proxy_type: Option<T::ProxyType>,
+	) -> Result<ProxyDefinition<T::AccountId, T::ProxyType, T::BlockNumber>, DispatchError> {
+		let f = |x: &ProxyDefinition<T::AccountId, T::ProxyType, T::BlockNumber>| -> bool {
+			&x.delegate == delegate && force_proxy_type.as_ref().map_or(true, |y| &x.proxy_type == y)
+		};
+		Ok(Proxies::<T>::get(real).0.into_iter().find(f).ok_or(Error::<T>::NotProxy)?)
+	}
+
+	fn do_proxy(
+		def: ProxyDefinition<T::AccountId, T::ProxyType, T::BlockNumber>,
+		real: T::AccountId,
+		call: <T as Trait>::Call,
+	) {
+		// This is a freshly authenticated new account, the origin restrictions doesn't apply.
+		let mut origin: T::Origin = frame_system::RawOrigin::Signed(real).into();
+		origin.add_filter(move |c: &<T as frame_system::Trait>::Call| {
+			let c = <T as Trait>::Call::from_ref(c);
+			// We make sure the proxy call does access this pallet to change modify proxies.
+			match c.is_sub_type() {
+				// Proxy call cannot add or remove a proxy with more permissions than it already has.
+				Some(Call::add_proxy(_, ref pt, _)) | Some(Call::remove_proxy(_, ref pt, _))
+					if !def.proxy_type.is_superset(&pt) => false,
+				// Proxy call cannot remove all proxies or kill anonymous proxies unless it has full permissions.
+				Some(Call::remove_proxies(..)) | Some(Call::kill_anonymous(..))
+					if def.proxy_type != T::ProxyType::default() => false,
+				_ => def.proxy_type.filter(c)
+			}
+		});
+		let e = call.dispatch(origin);
+		Self::deposit_event(RawEvent::ProxyExecuted(e.map(|_| ()).map_err(|e| e.error)));
+	}
 }
@@ -108,6 +108,9 @@ parameter_types! {
 	pub const ProxyDepositBase: u64 = 1;
 	pub const ProxyDepositFactor: u64 = 1;
 	pub const MaxProxies: u16 = 4;
+	pub const MaxPending: u32 = 2;
+	pub const AnnouncementDepositBase: u64 = 1;
+	pub const AnnouncementDepositFactor: u64 = 1;
 }
 #[derive(Copy, Clone, Eq, PartialEq, Ord, PartialOrd, Encode, Decode, RuntimeDebug)]
 pub enum ProxyType {
@@ -148,6 +151,10 @@ impl Trait for Test {
 	type ProxyDepositFactor = ProxyDepositFactor;
 	type MaxProxies = MaxProxies;
 	type WeightInfo = ();
+	type CallHasher = BlakeTwo256;
+	type MaxPending = MaxPending;
+	type AnnouncementDepositBase = AnnouncementDepositBase;
+	type AnnouncementDepositFactor = AnnouncementDepositFactor;
 }

 type System = frame_system::Module<Test>;
@@ -189,13 +196,134 @@ fn expect_events(e: Vec<TestEvent>) {
 	assert_eq!(last_events(e.len()), e);
 }

+#[test]
+fn announcement_works() {
+	new_test_ext().execute_with(|| {
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 3, ProxyType::Any, 1));
+		assert_ok!(Proxy::add_proxy(Origin::signed(2), 3, ProxyType::Any, 1));
+		assert_eq!(Balances::reserved_balance(3), 0);
+
+		assert_ok!(Proxy::announce(Origin::signed(3), 1, [1; 32].into()));
+		assert_eq!(Announcements::<Test>::get(3), (vec![Announcement {
+			real: 1,
+			call_hash: [1; 32].into(),
+			height: 1,
+		}], 2));
+		assert_eq!(Balances::reserved_balance(3), 2);
+
+		assert_ok!(Proxy::announce(Origin::signed(3), 2, [2; 32].into()));
+		assert_eq!(Announcements::<Test>::get(3), (vec![
+			Announcement {
+				real: 1,
+				call_hash: [1; 32].into(),
+				height: 1,
+			},
+			Announcement {
+				real: 2,
+				call_hash: [2; 32].into(),
+				height: 1,
+			},
+		], 3));
+		assert_eq!(Balances::reserved_balance(3), 3);
+
+		assert_noop!(Proxy::announce(Origin::signed(3), 2, [3; 32].into()), Error::<Test>::TooMany);
+	});
+}
+
+#[test]
+fn remove_announcement_works() {
+	new_test_ext().execute_with(|| {
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 3, ProxyType::Any, 1));
+		assert_ok!(Proxy::add_proxy(Origin::signed(2), 3, ProxyType::Any, 1));
+		assert_ok!(Proxy::announce(Origin::signed(3), 1, [1; 32].into()));
+		assert_ok!(Proxy::announce(Origin::signed(3), 2, [2; 32].into()));
+		let e = Error::<Test>::NotFound;
+		assert_noop!(Proxy::remove_announcement(Origin::signed(3), 1, [0; 32].into()), e);
+		assert_ok!(Proxy::remove_announcement(Origin::signed(3), 1, [1; 32].into()));
+		assert_eq!(Announcements::<Test>::get(3), (vec![Announcement {
+			real: 2,
+			call_hash: [2; 32].into(),
+			height: 1,
+		}], 2));
+		assert_eq!(Balances::reserved_balance(3), 2);
+	});
+}
+
+#[test]
+fn reject_announcement_works() {
+	new_test_ext().execute_with(|| {
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 3, ProxyType::Any, 1));
+		assert_ok!(Proxy::add_proxy(Origin::signed(2), 3, ProxyType::Any, 1));
+		assert_ok!(Proxy::announce(Origin::signed(3), 1, [1; 32].into()));
+		assert_ok!(Proxy::announce(Origin::signed(3), 2, [2; 32].into()));
+		let e = Error::<Test>::NotFound;
+		assert_noop!(Proxy::reject_announcement(Origin::signed(1), 3, [0; 32].into()), e);
+		let e = Error::<Test>::NotFound;
+		assert_noop!(Proxy::reject_announcement(Origin::signed(4), 3, [1; 32].into()), e);
+		assert_ok!(Proxy::reject_announcement(Origin::signed(1), 3, [1; 32].into()));
+		assert_eq!(Announcements::<Test>::get(3), (vec![Announcement {
+			real: 2,
+			call_hash: [2; 32].into(),
+			height: 1,
+		}], 2));
+		assert_eq!(Balances::reserved_balance(3), 2);
+	});
+}
+
+#[test]
+fn announcer_must_be_proxy() {
+	new_test_ext().execute_with(|| {
+		assert_noop!(Proxy::announce(Origin::signed(2), 1, H256::zero()), Error::<Test>::NotProxy);
+	});
+}
+
+#[test]
+fn delayed_requires_pre_announcement() {
+	new_test_ext().execute_with(|| {
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 2, ProxyType::Any, 1));
+		let call = Box::new(Call::Balances(BalancesCall::transfer(6, 1)));
+		let e = Error::<Test>::Unannounced;
+		assert_noop!(Proxy::proxy(Origin::signed(2), 1, None, call.clone()), e);
+		let e = Error::<Test>::Unannounced;
+		assert_noop!(Proxy::proxy_announced(Origin::signed(0), 2, 1, None, call.clone()), e);
+		let call_hash = BlakeTwo256::hash_of(&call);
+		assert_ok!(Proxy::announce(Origin::signed(2), 1, call_hash));
+		system::Module::<Test>::set_block_number(2);
+		assert_ok!(Proxy::proxy_announced(Origin::signed(0), 2, 1, None, call.clone()));
+	});
+}
+
+#[test]
+fn proxy_announced_removes_announcement_and_returns_deposit() {
+	new_test_ext().execute_with(|| {
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 3, ProxyType::Any, 1));
+		assert_ok!(Proxy::add_proxy(Origin::signed(2), 3, ProxyType::Any, 1));
+		let call = Box::new(Call::Balances(BalancesCall::transfer(6, 1)));
+		let call_hash = BlakeTwo256::hash_of(&call);
+		assert_ok!(Proxy::announce(Origin::signed(3), 1, call_hash));
+		assert_ok!(Proxy::announce(Origin::signed(3), 2, call_hash));
+		// Too early to execute announced call
+		let e = Error::<Test>::Unannounced;
+		assert_noop!(Proxy::proxy_announced(Origin::signed(0), 3, 1, None, call.clone()), e);
+
+		system::Module::<Test>::set_block_number(2);
+		assert_ok!(Proxy::proxy_announced(Origin::signed(0), 3, 1, None, call.clone()));
+		assert_eq!(Announcements::<Test>::get(3), (vec![Announcement {
+			real: 2,
+			call_hash,
+			height: 1,
+		}], 2));
+		assert_eq!(Balances::reserved_balance(3), 2);
+	});
+}
+
 #[test]
 fn filtering_works() {
 	new_test_ext().execute_with(|| {
 		Balances::mutate_account(&1, |a| a.free = 1000);
-		assert_ok!(Proxy::add_proxy(Origin::signed(1), 2, ProxyType::Any));
-		assert_ok!(Proxy::add_proxy(Origin::signed(1), 3, ProxyType::JustTransfer));
-		assert_ok!(Proxy::add_proxy(Origin::signed(1), 4, ProxyType::JustUtility));
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 2, ProxyType::Any, 0));
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 3, ProxyType::JustTransfer, 0));
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 4, ProxyType::JustUtility, 0));

 		let call = Box::new(Call::Balances(BalancesCall::transfer(6, 1)));
 		assert_ok!(Proxy::proxy(Origin::signed(2), 1, None, call.clone()));
@@ -228,7 +356,7 @@ fn filtering_works() {
 			RawEvent::ProxyExecuted(Ok(())).into(),
 		]);

-		let inner = Box::new(Call::Proxy(ProxyCall::add_proxy(5, ProxyType::Any)));
+		let inner = Box::new(Call::Proxy(ProxyCall::add_proxy(5, ProxyType::Any, 0)));
 		let call = Box::new(Call::Utility(UtilityCall::batch(vec![*inner])));
 		assert_ok!(Proxy::proxy(Origin::signed(2), 1, None, call.clone()));
 		expect_events(vec![UtilityEvent::BatchCompleted.into(), RawEvent::ProxyExecuted(Ok(())).into()]);
@@ -253,24 +381,24 @@ fn filtering_works() {
 #[test]
 fn add_remove_proxies_works() {
 	new_test_ext().execute_with(|| {
-		assert_ok!(Proxy::add_proxy(Origin::signed(1), 2, ProxyType::Any));
-		assert_noop!(Proxy::add_proxy(Origin::signed(1), 2, ProxyType::Any), Error::<Test>::Duplicate);
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 2, ProxyType::Any, 0));
+		assert_noop!(Proxy::add_proxy(Origin::signed(1), 2, ProxyType::Any, 0), Error::<Test>::Duplicate);
 		assert_eq!(Balances::reserved_balance(1), 2);
-		assert_ok!(Proxy::add_proxy(Origin::signed(1), 2, ProxyType::JustTransfer));
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 2, ProxyType::JustTransfer, 0));
 		assert_eq!(Balances::reserved_balance(1), 3);
-		assert_ok!(Proxy::add_proxy(Origin::signed(1), 3, ProxyType::Any));
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 3, ProxyType::Any, 0));
 		assert_eq!(Balances::reserved_balance(1), 4);
-		assert_ok!(Proxy::add_proxy(Origin::signed(1), 4, ProxyType::JustUtility));
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 4, ProxyType::JustUtility, 0));
 		assert_eq!(Balances::reserved_balance(1), 5);
-		assert_noop!(Proxy::add_proxy(Origin::signed(1), 4, ProxyType::Any), Error::<Test>::TooMany);
-		assert_noop!(Proxy::remove_proxy(Origin::signed(1), 3, ProxyType::JustTransfer), Error::<Test>::NotFound);
-		assert_ok!(Proxy::remove_proxy(Origin::signed(1), 4, ProxyType::JustUtility));
+		assert_noop!(Proxy::add_proxy(Origin::signed(1), 4, ProxyType::Any, 0), Error::<Test>::TooMany);
+		assert_noop!(Proxy::remove_proxy(Origin::signed(1), 3, ProxyType::JustTransfer, 0), Error::<Test>::NotFound);
+		assert_ok!(Proxy::remove_proxy(Origin::signed(1), 4, ProxyType::JustUtility, 0));
 		assert_eq!(Balances::reserved_balance(1), 4);
-		assert_ok!(Proxy::remove_proxy(Origin::signed(1), 3, ProxyType::Any));
+		assert_ok!(Proxy::remove_proxy(Origin::signed(1), 3, ProxyType::Any, 0));
 		assert_eq!(Balances::reserved_balance(1), 3);
-		assert_ok!(Proxy::remove_proxy(Origin::signed(1), 2, ProxyType::Any));
+		assert_ok!(Proxy::remove_proxy(Origin::signed(1), 2, ProxyType::Any, 0));
 		assert_eq!(Balances::reserved_balance(1), 2);
-		assert_ok!(Proxy::remove_proxy(Origin::signed(1), 2, ProxyType::JustTransfer));
+		assert_ok!(Proxy::remove_proxy(Origin::signed(1), 2, ProxyType::JustTransfer, 0));
 		assert_eq!(Balances::reserved_balance(1), 0);
 	});
 }
@@ -278,10 +406,10 @@ fn add_remove_proxies_works() {
 #[test]
 fn cannot_add_proxy_without_balance() {
 	new_test_ext().execute_with(|| {
-		assert_ok!(Proxy::add_proxy(Origin::signed(5), 3, ProxyType::Any));
+		assert_ok!(Proxy::add_proxy(Origin::signed(5), 3, ProxyType::Any, 0));
 		assert_eq!(Balances::reserved_balance(5), 2);
 		assert_noop!(
-			Proxy::add_proxy(Origin::signed(5), 4, ProxyType::Any),
+			Proxy::add_proxy(Origin::signed(5), 4, ProxyType::Any, 0),
 			BalancesError::<Test, _>::InsufficientBalance
 		);
 	});
@@ -290,8 +418,8 @@ fn cannot_add_proxy_without_balance() {
 #[test]
 fn proxying_works() {
 	new_test_ext().execute_with(|| {
-		assert_ok!(Proxy::add_proxy(Origin::signed(1), 2, ProxyType::JustTransfer));
-		assert_ok!(Proxy::add_proxy(Origin::signed(1), 3, ProxyType::Any));
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 2, ProxyType::JustTransfer, 0));
+		assert_ok!(Proxy::add_proxy(Origin::signed(1), 3, ProxyType::Any, 0));

 		let call = Box::new(Call::Balances(BalancesCall::transfer(6, 1)));
 		assert_noop!(Proxy::proxy(Origin::signed(4), 1, None, call.clone()), Error::<Test>::NotProxy);
@@ -319,21 +447,21 @@ fn proxying_works() {
 #[test]
 fn anonymous_works() {
 	new_test_ext().execute_with(|| {
-		assert_ok!(Proxy::anonymous(Origin::signed(1), ProxyType::Any, 0));
+		assert_ok!(Proxy::anonymous(Origin::signed(1), ProxyType::Any, 0, 0));
 		let anon = Proxy::anonymous_account(&1, &ProxyType::Any, 0, None);
 		expect_event(RawEvent::AnonymousCreated(anon.clone(), 1, ProxyType::Any, 0));

 		// other calls to anonymous allowed as long as they're not exactly the same.
-		assert_ok!(Proxy::anonymous(Origin::signed(1), ProxyType::JustTransfer, 0));
-		assert_ok!(Proxy::anonymous(Origin::signed(1), ProxyType::Any, 1));
+		assert_ok!(Proxy::anonymous(Origin::signed(1), ProxyType::JustTransfer, 0, 0));
+		assert_ok!(Proxy::anonymous(Origin::signed(1), ProxyType::Any, 0, 1));
 		let anon2 = Proxy::anonymous_account(&2, &ProxyType::Any, 0, None);
-		assert_ok!(Proxy::anonymous(Origin::signed(2), ProxyType::Any, 0));
-		assert_noop!(Proxy::anonymous(Origin::signed(1), ProxyType::Any, 0), Error::<Test>::Duplicate);
+		assert_ok!(Proxy::anonymous(Origin::signed(2), ProxyType::Any, 0, 0));
+		assert_noop!(Proxy::anonymous(Origin::signed(1), ProxyType::Any, 0, 0), Error::<Test>::Duplicate);
 		System::set_extrinsic_index(1);
-		assert_ok!(Proxy::anonymous(Origin::signed(1), ProxyType::Any, 0));
+		assert_ok!(Proxy::anonymous(Origin::signed(1), ProxyType::Any, 0, 0));
 		System::set_extrinsic_index(0);
 		System::set_block_number(2);
-		assert_ok!(Proxy::anonymous(Origin::signed(1), ProxyType::Any, 0));
+		assert_ok!(Proxy::anonymous(Origin::signed(1), ProxyType::Any, 0, 0));

 		let call = Box::new(Call::Balances(BalancesCall::transfer(6, 1)));
 		assert_ok!(Balances::transfer(Origin::signed(3), anon, 5));