POL Authority Map: Minting, Upgrades, Multisigs, and Timelocks

Analysis date: September 8, 2026
On-chain snapshot: Ethereum mainnet block 25,925,075 (0x18b95d3)
Block timestamp: September 7, 2026, 11:07:11 UTC
Block hash: 0x325f41f7c5833607749958169e320b3893314b352e39b4add205400c1ae7e4ba

This is a block-specific, independently reconstructed authority map for the Ethereum contracts that control POL issuance, emission policy, migration, Polygon PoS staking administration, and the Polygon Community Treasury.

It answers six practical questions:

1. Who can trigger minting now?
2. Who can appoint a different minter?
3. Who can change the emission algorithm or recipients?
4. Who can raise or lower the 13.37 POL/second mint cap?
5. Who can upgrade each component?
6. What multisig threshold and mandatory timelock apply?

Contract state can change after the snapshot block. Links to the live contracts are included so every controller can be rechecked.

For the legal-entity and ownership perimeter, see Polygon Corporate Structure.

Executive Findings

1. Validators do not directly mint POL. Anyone can call the public DefaultEmissionManager.mint() function, but the only address holding EMISSION_ROLE in the POL token at the snapshot block is the DefaultEmissionManager proxy.
2. The active algorithm targets 2% compounded annual emission. Each mint is divided 50/50 between StakeManager and the Community Treasury.
3. Changing the algorithm requires an implementation upgrade. The current DefaultEmissionManager has no rate setter.
4. The upgrade route has no mandatory timelock. ProxyAdmin is owned by the emergency Protocol Council Safe, which requires 10 of 13 signer accounts and can upgrade the emission manager immediately.
5. 13.37 POL/second is not an immutable cap. It is mutable storage in the otherwise non-upgradeable POL token. CAP_MANAGER_ROLE can set any uint256, including zero or a value above 13.37. The current route is the regular Protocol Council Safe at 7 of 13, followed by a 10-day TimelockController.
6. The regular route can appoint another direct minter. The same 7/13 plus 10-day path holds DEFAULT_ADMIN_ROLE and can grant or revoke EMISSION_ROLE.
7. The POL token itself is not upgradeable. DefaultEmissionManager and Migration are upgradeable through ProxyAdmin; POL is not behind a proxy.
8. StakeManager remains under a legacy authority domain. Its proxy and governance route lead to a legacy 5-of-9 Safe through a TimelockController whose current getMinDelay() is zero.
9. The Community Treasury has a seven-day minimum voting duration, but not a seven-day execution timelock. With EarlyExecution, a proposal can execute after both voting blocks approve it. The current Safe thresholds are 2 of 10 and 2 of 11.
10. Nine owner addresses are common to both Treasury Safes. Two common signing keys can technically satisfy both Safe thresholds. This is a minimum on-chain coalition, not an attribution of real-world identity or custody.

Authority Graph

ANY ADDRESS
  └─ calls DefaultEmissionManager.mint()
       └─ DefaultEmissionManager [only current EMISSION_ROLE member]
            └─ calls POL.mint(), constrained by accrued time × mintPerSecondCap
                 ├─ 50% → StakeManager
                 └─ 50% → Community Treasury

REGULAR PROTOCOL COUNCIL ROUTE
  7/13 Safe 0x9A53...50899
    └─ Timelock 0x29A6...35b18 — 10 days
         ├─ CAP_MANAGER_ROLE → set the 13.37 cap to any uint256
         ├─ DEFAULT_ADMIN_ROLE → grant/revoke POL roles, including EMISSION_ROLE
         ├─ owner of DefaultEmissionManager → ownership functions only
         └─ owner of Migration → lock/unlock unmigration and burn POL held there

EMERGENCY PROTOCOL COUNCIL ROUTE
  10/13 Safe 0x37D0...19516 — no timelock
    └─ owns ProxyAdmin 0xEBea...C39c3
         ├─ upgrade DefaultEmissionManager → change algorithm and recipients
         └─ upgrade Migration

LEGACY POLYGON PoS ADMIN ROUTE
  5/9 Safe 0xFa7D...9b74c
    └─ Timelock 0xCaf0...C8cEf — minDelay = 0
         ├─ owns StakeManager proxy → upgrade implementation
         └─ owns GovernanceProxy → StakeManager configuration/admin calls

COMMUNITY TREASURY
  Proposer Safe 2/10 ── 50.00000001 CTV ┐
                                       ├─ Aragon TokenVoting
  Executor Safe 2/11 ── 49.99999999 CTV ┘  100% participation + 99% support
       └─ EarlyExecution after both yes votes
            ├─ spend treasury assets / make arbitrary DAO calls
            ├─ upgrade DAO
            ├─ upgrade TokenVoting plugin
            └─ change voting settings

Direct Answers

POL Token

• Contract: 0x455e53CBB86018Ac2B8092FdCd39d8444aFFC3F6
• Reported version: 1.1.0
• Proxy implementation/admin/beacon slots: empty
• Total supply at the snapshot block: 10,710,035,862.658504237747127725 POL
• mintPerSecondCap: 13.37 POL/second
• lastMint: September 7, 2026, 00:00:23 UTC
• EMISSION_ROLE: DefaultEmissionManager only
• CAP_MANAGER_ROLE: Protocol Council Timelock only
• DEFAULT_ADMIN_ROLE: Protocol Council Timelock only
• PERMIT2_REVOKER_ROLE: Protocol Council Timelock and emergency Safe

The PolygonEcosystemToken.sol contract is not upgradeable. The initial mint-cap value is stored in the token, but updateMintCap(newCap) imposes no bounded range. The cap manager can set any uint256.

At 13.37 POL/second, a full 365-day cap would equal:

13.37 × 31,536,000 = 421,636,320 POL

This is a technical ceiling on minting accrued over time, not the active annual emission formula. At the snapshot timestamp, 40,008 seconds had elapsed since lastMint, giving maximum technical headroom of 534,906.96 POL. The active manager is not required to use all available headroom.

The distinction matters:

• the manager algorithm determines the requested amount and destinations;
• the POL cap bounds what an authorized minter can mint over elapsed time;
• the regular Council can change the cap;
• the emergency Council can change the manager implementation;
• the regular Council can grant EMISSION_ROLE to another address.

DefaultEmissionManager

• Proxy: 0xbC9f74b3b14f460a6c47dCdDFd17411cBc7b6c53
• Implementation: 0x282fd46e108e40a45e4ce425ba75f80245e6c2e0
• Version: 1.4.0
• EIP-1967 admin: ProxyAdmin 0xEBea...C39c3
• owner(): Protocol Council Timelock 0x29A6...35b18
• Treasury recipient: Community Treasury DAO 0x8638...a5b9
• Staking recipient: StakeManager 0x5e3E...D908
• START_SUPPLY_1_4_0: 10,466,456,329.199769051012729173 POL

The active DefaultEmissionManager.sol uses a fixed log2(1.02) constant to target 2% annual compounding and splits each realized mint equally between StakeManager and the Treasury.

Its mint() function is public. Calling it does not let the caller choose an amount or recipient. The manager calculates the target supply, requests the allowed amount from POL, and distributes it according to the implementation.

The current contract has no owner-controlled rate setter. The regular Timelock owns the manager, but cannot change the 2% rate through a normal configuration call. Changing the formula, split, or recipients requires an implementation upgrade through ProxyAdmin, or a separate minter being granted EMISSION_ROLE through the regular role-admin route.

ProxyAdmin and Migration

• ProxyAdmin: 0xEBea33f2c92D03556b417F4F572B2FbbE62C39c3
• ProxyAdmin owner: emergency Protocol Council Safe 0x37D0...9516
• Migration proxy: 0x29e7DF7b6A1B2b07b731457f499E1696c60E2C4e
• Migration implementation: 0xb037347ef306db3b41ab0b250f891887039d9231
• Migration version: 1.2.0
• Migration owner: regular Protocol Council Timelock
• unmigrationLocked: false at the snapshot block

The emergency Safe can replace the implementation of DefaultEmissionManager or Migration without an on-chain delay. The regular Timelock does not own ProxyAdmin.

Migration owner functions, including its locking and burn controls, are implemented in PolygonMigration.sol. These regular owner functions follow the 7/13 plus 10-day route.

Protocol Council

• Regular Safe: 0x9A53B1651C8Dd587c30392f8931e61daBBB50899, threshold 7/13
• Emergency Safe: 0x37D085ca4a24f6b29214204E8A8666f12cf19516, threshold 10/13
• Timelock: 0x29A6f32f36EDeD399763524018F17F03B1435b18, minimum delay 864,000 seconds / 10 days

The regular Safe holds Timelock PROPOSER_ROLE and CANCELLER_ROLE. EXECUTOR_ROLE is open to the zero address, so any address can execute a ready operation after the delay. The Timelock administers itself; changing its delay must be scheduled through the existing ten-day delay.

Both Council Safes had no enabled modules and no guard at the snapshot block.

The 13 signer accounts match final PIP-77:

A nested Safe counts as one Council signer account. Its own internal threshold must also be met. At the snapshot block, the three nested Safes also had no modules or guards.

PIP-29 correctly describes the two active Council routes: 7/13 plus ten days for regular configuration and 10/13 with no delay for proxy upgrades.

StakeManager: A Separate Legacy Authority Domain

• StakeManager proxy: 0x5e3Ef299fDDf15eAa0432E6e66473ace8c13D908
• Custom proxy implementation: 0x3ad88467e40399dc6ae10427f8b0842348d9076c
• Proxy owner: legacy Timelock 0xCaf0...C8cEf
• StakeManager governance(): GovernanceProxy 0x6e7a...CE48
• GovernanceProxy owner: the same legacy Timelock
• Staking token: POL
• Legacy Timelock: 0xCaf0aa768A3AE1297DF20072419Db8Bb8b5C8cEf, getMinDelay() = 0
• Legacy PoS Safe: 0xFa7D2a996aC6350f4b56C043112Da0366a59b74c, threshold 5/9

The zero-delay Timelock still requires the schedule/execute mechanics, but it does not impose elapsed time. A Safe batch can schedule and execute without a mandatory waiting period.

The custom proxy path is defined in UpgradableProxy.sol; the administration path is visible in GovernanceProxy.sol and StakeManager.sol.

PIP-54 and PIP-68 describe a proposed transfer of PoS roles to the Protocol Council. Both remained in Peer Review and had not changed the owner graph at the snapshot block.

Community Treasury

• DAO/UUPS proxy: 0x86380e136A3AaD5677A210Ad02713694c4E6a5b9
• DAO implementation: 0x52af16664155608b845be18aa29620ebf6ea2d3a
• TokenVoting/UUPS proxy: 0xCa6f5BD946F52298A7B6154fc827bF87512A15f3
• Voting implementation: 0xd4bfb6c688b2982a3b432f2fc6c35117532a2c27
• CTV voting token: 0xcb8b435481Da1Ed5abC895e03535ce0BbA3B6905, total supply 100
• Proposer Safe: 0x2ff25495d77f380d5F65B95F103181aE8b1cf898, 2/10, holding 50.00000001 CTV
• Executor Safe: 0xb7b02DbC9D054A8BA90b2172B4f8d2D79aC7d3a0, 2/11, holding 49.99999999 CTV
• Voting mode: EarlyExecution
• Support threshold: 99%
• Minimum participation: 100%
• Minimum duration: 604,800 seconds / 7 days
• Minimum proposer voting power: 50 CTV

The Proposer Safe can create a proposal because it holds just over 50 CTV. Because participation is 100% and support is 99%, both CTV blocks must vote yes for a successful proposal.

The seven-day value is a minimum proposal duration, not a post-vote timelock. Once both blocks have voted yes, the result cannot mathematically reverse. Aragon's MajorityVotingBase.sol therefore allows early execution before the nominal end date.

The TokenVoting plugin holds EXECUTE_PERMISSION on the DAO. The DAO itself holds root and upgrade permissions and has upgrade/settings permissions over the voting plugin. The same two voting blocks can therefore:

• spend treasury assets;
• make arbitrary external calls from the DAO;
• upgrade the DAO implementation;
• upgrade the TokenVoting plugin;
• change voting settings.

There is no separate execution timelock after the successful early vote.

PIP-40/PFP-2 described original 3-of-5 Safe thresholds. That description is no longer current. The thresholds were reduced to 2 and the owner sets expanded. The February 25, 2026 threshold-change transactions are public for the Proposer Safe and Executor Safe.

Nine addresses are common to both owner sets. All 12 unique addresses are EOAs rather than nested Safes. Two common keys can technically sign both Safe transactions. This is a lower bound on the on-chain signing coalition, not evidence that two individuals control the keys in practice.

An operational transition announced January 9, 2026 moved the Treasury Board to an advisory role, gave Polygon Foundation strategic direction, and assigned Polygon Labs day-to-day execution. That organizational statement does not replace the on-chain Safe, voting, and permission structure above.

Narrative Versus Current Authority

Full Signer Sets

Nested Protocol Council Signer Safes

L2Beat Safe 0xaE8B85DcaBb12EB2dDb11dAd1ed968b7eD81B410 — 2/3
0xf6782a559cefcd959465fcd9b1059b78cf7b070f
0xf14c77268b57a2ee90f92ebd798cbd0f04cfe3ff
0x6831bae339f1311460b72a9d4359450e06c100a1

Polygon Labs Engineering Safe 0x4e981bae8e3cd06ca911fffe5504b2653ac1c38a — 2/5
0x516eecfb38aa308c5f1878497108c7d054fd46b7
0xeb5eee1f1650b821e0d3a87c1341d85b3a16ea72
0x8b9f18bcdd5838bb1bd4b3d6410e45df813b782b
0xd9478f759a13bfa1d9dab3cdf5ff0c099d5efcfc
0x3038b4dbf022e80169b2a068290d4a3a8b87d3b5

Polygon Labs Security Safe 0x9d851f8b8751c5FbC09b9E74E6e68E9950949052 — 2/7
0xf02be0da37db50befa5a525158aa94b50f81d4b2
0xfb2a738ae435610354b132c4a4ee647558f663eb
0x6ab87a62e250a5eb09a53fca832b9bda480c3890
0xed44d1cffb91e163cb7126bdeea83959f175db37
0xffbfc0c8331c5fc912dda3c6d4a86eeb80203238
0xdfed8373695a7b3daf268cf91e71f6a7024a56da
0x21618593f7147235ac8d511d68a547c935f9d417

Legacy PoS Safe — 5 of 9

0xab4045c93e4effa9b325f706c9a690ed00d08958
0x1ae033d45ce93bbb0ddbf71a0da9de01fefd8529
0x4e981bae8e3cd06ca911fffe5504b2653ac1c38a  [nested Engineering Safe 2/5]
0x342ebaca3acc54d6f5ee78073fec4af07f42b94e
0x39415255619783a2e71fcf7d8f708a951d92e1b6
0xb771380f912e4b5f6beddf81314c383c13f16ab5
0x10cb290fc4a5473460572ecf67b4c0cf06da99a3
0xda66df3920091ef4b54782b9463587c314dadd41
0x9d851f8b8751c5fbc09b9e74e6e68e9950949052  [nested Security Safe 2/7]

Community Treasury Proposer Safe — 2 of 10

0x9f02595fbfd199c4cbc02878fc9b2b2e07b0840c
0x1319279d6d54db0883f7baf822191c7184db0c3d
0x6ab87a62e250a5eb09a53fca832b9bda480c3890
0x250237da3092c2fedcf023c64f202e65d7371470
0xf045025c845e786e343df30cc6f67ec6bb822b34
0x6b2ba82994a1606605af1f11e50da0b2b0cee6e6
0x573d7a729cfcf20b81d70732d625ae31549b8b91
0x54dfa4b635e7eb98515feba81d360a3871739277
0xfac88bb6229f47a31a78f0ba91e5a541cb1866a3
0xc3f60bc338e0af8f46f52650c813fbd3c071e165  [Proposer only]

Community Treasury Executor Safe — 2 of 11

0x9f02595fbfd199c4cbc02878fc9b2b2e07b0840c
0x1319279d6d54db0883f7baf822191c7184db0c3d
0x6ab87a62e250a5eb09a53fca832b9bda480c3890
0x573d7a729cfcf20b81d70732d625ae31549b8b91
0x6624307a4f672ec5c289fba196952902bb518dc0  [Executor only]
0xdeb97974dfcc73178672205a1eaddc2bdeac1bd4  [Executor only]
0x6b2ba82994a1606605af1f11e50da0b2b0cee6e6
0x250237da3092c2fedcf023c64f202e65d7371470
0xfac88bb6229f47a31a78f0ba91e5a541cb1866a3
0xf045025c845e786e343df30cc6f67ec6bb822b34
0x54dfa4b635e7eb98515feba81d360a3871739277

Monitoring Checklist

A current authority monitor should read, rather than assume:

1. POL role membership for DEFAULT_ADMIN_ROLE, EMISSION_ROLE, CAP_MANAGER_ROLE, and PERMIT2_REVOKER_ROLE, plus mintPerSecondCap and lastMint;
2. EIP-1967 implementation/admin slots and owners for DefaultEmissionManager and Migration;
3. ProxyAdmin owner;
4. regular and emergency Council Safe owners, thresholds, modules, and guards, plus Timelock roles and delay;
5. StakeManager custom implementation, owner, governance address, GovernanceProxy owner, legacy Timelock delay/roles, and legacy Safe configuration;
6. Treasury DAO/plugin implementations, permissions, voting settings, CTV balances/delegation, and both Safe owner sets;
7. the status and execution of later PIPs, especially proposals that describe authority transfers not yet completed on-chain.

If a governance document and current contract state conflict, the contract state determines who can execute the next transaction.

Primary Sources

• PIP-29 — Protocol Council
• PIP-40 — Community Treasury contracts
• PIP-54 — proposed PoS roles migration, Peer Review
• PIP-68 — proposed PoS roles migration, Peer Review
• PIP-77 — Protocol Council membership
• POL token repository at the analyzed commit
• Legacy Polygon contracts at the analyzed commit
• Aragon TokenVoting majority logic
• Community Treasury operational transition

This page maps technical authority. It does not establish the legal identity, employer, or beneficial owner of an EOA signer, and it does not treat organizational statements as substitutes for contract state.