StepNet
StepDex Launch dApp

Governance, security & contracts

Governed on-chain. Verifiable by anyone.

StepRegistry, StepNet's on-chain DAO, has governed the protocol on Polygon since 15 June 2026. Every contract is source-verified, the fees and payment splits are constants in the code, and the next steps toward full decentralisation carry published dates.

All contract addressesSource on GitHub

01Path to full decentralisation

Two steps done. The next ones are dated.

The current generation went live on Polygon in June 2026 and handed the address book to the DAO two weeks later. The next steps are scheduled for January 2027.

  1. 2 Jun 2026

    Current generation deployed

    StepNet and StepRegistry, re-engineered and redeployed with fixes.

  2. 15 Jun 2026

    DAO activated on-chain

    Block 88,569,715. Since then no address can be re-pointed directly.

  3. Jan 2027

    Contract KYC + independent audit

    An independent third-party audit, together with contract KYC.

  4. Jan 2027

    renounceControl()

    Retires the controller's veto — the next step toward full decentralisation.

  5. After the audit

    Bug bounty

    Opens once the audit is complete.

02How the DAO works

Every change goes through the vote.

StepRegistry is the address book the core contracts resolve their peers through — and its governance. Since 15 June 2026 no address can be re-pointed directly: every change must pass a 7-day, Box-0-weighted DAO vote followed by a 7-day veto window, both fixed in the code.

  1. 1Proposal

    A change is proposed

    Any re-pointing of the address book starts as a proposal on-chain.

  2. 2DAO vote

    Box-0-weighted vote

    Box 0 is the unit of voting power — the network's members decide.

    7 days
  3. 3Veto window

    A fixed veto window

    Every passed vote waits out a veto window, a constant in the code.

    7 days
  4. 4Timelock

    Migrations wait longer

    Asset migrations add a timelock on top of the vote and the veto window.

    7 days currently

03What the code enforces

Guarantees written into the contracts.

The fees, burns and payment splits are not settings an operator can change. They are constants and code paths you can read on PolygonScan and in the public repository.

Hard guarantees

  • No privileged mint — every new STEP is minted by StepDex against DAI
  • No pause switch and no oracle — price = DAI reserve ÷ STEP supply
  • Fees, burns, the Box split and the revenue split are compile-time constants
  • Reentrancy guards on every value-moving entry point; SafeERC20 transfers and pull-payments
  • Gas-bounded, resumable distributions that cannot be griefed into a halt
  • A 95% minimum-output floor on internal AMM buys, taken from a live quote
  • The revenue conduit holds no balance — every payment leaves in the same transaction
  • Exact accounting under a deflationary token — the NFT fund's books balance to the wei, proven in the test suite
  • CompletedInternal security review — no critical or high-severity findings
  • 76Automated tests in CI — 66 deep + 10 top-level
  • Exact matchEvery StepNet contract's source on PolygonScan
  • Jan 2027Independent third-party audit and contract KYC; a bug bounty follows

CI compiles the contracts, runs the tests and, whenever the contracts change, proves that the repository matches the source verified on-chain. The nine core contracts are also verified on Sourcify.

04Contracts

Polygon mainnet · chainId 137

Every address StepNet runs on, with one-click copy and links to the verified source.

StepNet contract addresses on Polygon mainnet
ContractAddressVerified source
StepRegistryThe DAO — address book and governance0x708fA8F368D15B8293cD6c0A29a790fC1c7F13CePolygonScanSourcify
StepNetCore — Boxes, network and the daily distribution0xeD4a3704d23a134C2219534C601a44fd677A77ffPolygonScanSourcify
StepNetViewRead-only aggregator for dashboard reads0x944ffb44c6C1777aB599325514c7d14bD4f8c61DPolygonScanSourcify
StepCoin (STEP)DAI-backed, dynamic-supply ERC-20 with a 2% transfer levy0x259c17323F9a38118a10D979f21F9eBafAE9c0F6PolygonScanSourcify
StepDexBonding-curve exchange — STEP ⇄ DAI, price = reserve ÷ supply0x512964f922Ec791a93b5E70ED3c9aC09ec4dCf10PolygonScanSourcify
StepNFTTreasuryTiered NFT collection with an on-chain reward pool0x49de1a6516A1eEDb6269224953F03e55F72Dc68cPolygonScanSourcify
StepNFTFundNFT buy-back desk and daily yield vault0xaA739Ce109C72f775212Ed5fd1177120d295b26fPolygonScanSourcify
StepClubLoyalty club — membership and batched distributions0x00d76a71f9c89C79406ed170583BEDb45f3c7AE6PolygonScanSourcify
StepSubscriptionRevenue conduit — every payment split on-chain0x8B567B997B5e80840228D047C8796234992E667CPolygonScanSourcify
StepNetImporterImporter0xA790cF97C8df9253f327ebe9dF2587ab09eD0327PolygonScan
DAICollateral — Polygon PoS DAI (third-party token)0x8f3Cf7ad23Cd3CaDbD9735AFf958023239c6A063PolygonScan

05Verify it yourself

Don't trust — run the check.

The public repository ships the two scripts behind the on-chain claims on this page. Node.js 22 or newer is all you need.

Prove the source

verify-sources.js proves that every file in contracts/ is identical to its verified source — the same check CI runs whenever the contracts change.

git clone https://github.com/stepecosystem/step-eco-system.git
cd step-eco-system
npm ci
node contracts-src/verify-sources.js

Read the live governance state

verify-onchain.js reads StepRegistry's live governance state — whether the DAO is active, the controller and the timelock — straight from Polygon, with the live configuration of StepSubscription, StepNFTTreasury and StepNFTFund. A value it cannot read is reported as UNKNOWN — never as a verdict.

node contracts-src/verify-onchain.js
# optional: your own node
RPC_URL=https://your-node node contracts-src/verify-onchain.js

Run the test suites

The deep suite asserts the money paths directly: the bonding-curve math and the 2% levy, the full DAO lifecycle, Box activation and daily rewards, the subscription conduit and its split, the NFT sale, the buy-back desk and yield vault, and the loyalty club.

npm run compile
npm test                        # top-level suite — 10 tests
cd contracts-test && npm ci && npm test   # deep suite — 66 tests
Open the repository

06Responsible disclosure

Found something? Tell us first.

Please don't open a public GitHub issue for a vulnerability. Email stepecosystemteam@gmail.com with a description and its impact, step-by-step reproduction and the affected contract. We aim to acknowledge reports within 72 hours. A bug bounty follows the independent audit.

Email a reportRead SECURITY.md