ERC-6066 — Signature Validation Method for NFTs

Back to Account & Authentication

ERC-6066: Signature Validation for NFTs

ERC-6066 extends ERC-1271 (smart-contract signatures) to NFTs: instead of asking "is this signature valid for this contract address?", you ask "is this signature valid for this specific tokenId held by this contract?". The motivation: NFT marketplaces, attestation systems, and gated communities want to validate signatures from the holder of a specific NFT, not just from the NFT contract as a whole.

OpenSea-like permissions ("only token #42 can sign this off-chain listing"), DAO membership-by-NFT, ERC-6551 token-bound account signatures all benefit from per-NFT signature validation.

Required Interface

interface IERC6066 {
    /// Returns IERC6066.isValidSignature.selector (0x12edb34f) when the
    /// signature is valid for the tokenId; bytes4(0) otherwise.
    function isValidSignature(
        uint256 tokenId,
        bytes32 hash,
        bytes calldata signature
    ) external view returns (bytes4 magicValue);
}

A wallet, marketplace, or scoped-access contract calls isValidSignature(tokenId, hash, sig) and trusts the result iff the return value is 0x12edb34f. The NFT contract's implementation typically delegates to whoever currently holds tokenId — a simple recipe is "return valid iff signer == ownerOf(tokenId)".

Neo Equivalent: NEP-11 + NEP-30 Verify, Per-tokenId

Neo's native NEP-30Verify method is the contract-side signature validator — it returns true if the contract considers the supplied witness valid. The same shape extends to NFTs by adding a tokenId parameter and resolving the witness check against the holder of that token.

public static bool VerifyForToken(ByteString tokenId, ByteString hash, ByteString signature)
{
    var holder = OwnerOf(tokenId);
    if (holder is null) return false;

    // The NFT holder's signature is valid for this token.
    var holderPubKey = ResolvePubKeyForAccount(holder);
    return (bool)CryptoLib.VerifyWithECDsa(hash, holderPubKey, signature, NamedCurveHash.secp256r1SHA256);
}

ERC-6066 (Ethereum)	Neo Equivalent	Notes
IERC6066.isValidSignature(tokenId, hash, sig) returns 0x12edb34f if valid	VerifyForToken(tokenId, hash, sig) returns true if valid	Same shape; magic-selector handshake → boolean
signer == ownerOf(tokenId) is the canonical recipe	holder = OwnerOf(tokenId); CheckWitness(holder) is the canonical recipe	Same
Composable with ERC-6551 (TBA holds the keys)	Composable with ERC-6551 mirror — TBA's Verify() returns true iff NFT holder signed	Direct port
Used by OpenSea, Reservoir, etc. for off-chain order signing	Same use case; Neo NFT marketplaces would call this for off-chain orders	Adoption is downstream-tooling-driven

Composition With ERC-6551 (TBA)

The most powerful use of ERC-6066 is paired with token-bound accounts:

• The NFT's TBA (see ERC-6551) implements Verify (NEP-30) such that signing on behalf of the TBA delegates to the NFT holder.
• ERC-6066 / VerifyForToken on the NFT contract lets external callers validate "did the holder of token #N sign X?" without going through the TBA's address.

Together these two cover the full spectrum:

• TBA-as-signer (you want the TBA to sign on behalf of the NFT) → ERC-1271 + ERC-6551.
• NFT-as-signer (you want a per-tokenId predicate) → ERC-6066.

Migration Notes

For NFT marketplaces being ported from Ethereum to Neo:

1. The off-chain signed-order shape stays the same (canonical hash over listing fields) — only the curve changes (secp256r1 instead of secp256k1).
2. The on-chain validation hook IERC6066.isValidSignature(tokenId, hash, sig) becomes VerifyForToken(tokenId, hash, sig) on the NEP-11 contract.
3. For order-cancellation flows, store consumed-nonce per (tokenId, nonce) in the NEP-11's storage (same pattern as the ERC-3009 mirror).

This pattern is currently informal on Neo — no NEP-X formalises per-tokenId signature validation. The mirror page proposes the shape and recommends adopting it for any NFT contract that wants OpenSea-style off-chain order support.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

interface IERC721 { function ownerOf(uint256 tokenId) external view returns (address); }
interface IERC1271 {
    function isValidSignature(bytes32 hash, bytes memory signature)
        external view returns (bytes4 magicValue);
}

contract NFTWith6066 is IERC721 {
    bytes4 constant ERC6066_MAGIC = 0x12edb34f;
    bytes4 constant ERC1271_MAGIC = 0x1626ba7e;

    mapping(uint256 => address) public ownerOf;

    function isValidSignature(uint256 tokenId, bytes32 hash, bytes calldata signature)
        external view returns (bytes4)
    {
        address holder = ownerOf[tokenId];
        if (holder == address(0)) return 0;

        // If holder is an EOA, recover via ECDSA.
        // If holder is a contract, delegate to ERC-1271 isValidSignature.
        if (_isContract(holder)) {
            try IERC1271(holder).isValidSignature(hash, signature) returns (bytes4 m) {
                return m == ERC1271_MAGIC ? ERC6066_MAGIC : bytes4(0);
            } catch { return bytes4(0); }
        } else {
            return _ecRecover(hash, signature) == holder ? ERC6066_MAGIC : bytes4(0);
        }
    }

    function _isContract(address a) internal view returns (bool) { return a.code.length > 0; }
    function _ecRecover(bytes32 hash, bytes calldata sig) internal pure returns (address) { /* ecrecover */ }
}

using System;
using System.ComponentModel;
using System.Numerics;
using Neo;
using Neo.Cryptography.ECC;
using Neo.SmartContract.Framework;
using Neo.SmartContract.Framework.Attributes;
using Neo.SmartContract.Framework.Native;
using Neo.SmartContract.Framework.Services;

namespace R3E.Examples;

[DisplayName("NFTWith6066")]
[ContractPermission("*", "*")]
[SupportedStandards(NepStandard.Nep11)]
public class NFTWith6066 : Nep11Token<TokenState>
{
    public override string Symbol => "ASIG";

    private const byte Prefix_PubKey = 0x30;

    /// Per-tokenId signature validation. Returns true iff the supplied
    /// signature was made by the current holder of `tokenId`.
    public static bool IsValidSignatureForToken(ByteString tokenId, ByteString hash, ByteString signature)
    {
        var holder = OwnerOf(tokenId);
        if (holder is null) return false;

        // For EOA-style holders, look up the registered pubkey. For
        // contract-style holders, delegate to their NEP-30 Verify.
        if (ContractManagement.GetContract(holder) is null)
        {
            // Holder is an EOA-style account.
            var pubKey = (ECPoint)Storage.Get(Storage.CurrentContext, PubKeyKey(holder));
            if (pubKey is null) return false;
            return (bool)CryptoLib.VerifyWithECDsa(hash, pubKey, signature, NamedCurveHash.secp256r1SHA256);
        }
        else
        {
            // Holder is a contract — delegate to its NEP-30 Verify (or a
            // contract-defined IsValidSignature).
            try
            {
                return (bool)Contract.Call(holder, "verify", CallFlags.ReadOnly,
                    new object[] { hash, signature });
            }
            catch { return false; }
        }
    }

    /// EOAs register their pubkey for signature validation (one-shot per address).
    public static void RegisterPubKey(ECPoint pubKey)
    {
        var account = Contract.CreateStandardAccount(pubKey);
        if (!Runtime.CheckWitness(account)) throw new Exception("not authorised");
        Storage.Put(Storage.CurrentContext, PubKeyKey(account), pubKey.EncodePoint(true));
    }

    private static byte[] PubKeyKey(UInt160 account)
        => new byte[] { Prefix_PubKey }.Concat(account);
}

Why Per-tokenId Beats Per-contract

NFT marketplaces want orders signed per-token (the seller listed token #42 specifically), not per-contract (the contract endorses every token). ERC-6066's per-tokenId scope is the difference between:

• ERC-1271: "my contract endorses this hash" — a single key controls signing for everything the contract holds.
• ERC-6066: "the holder of tokenId N endorses this hash" — each token has its own signing authority, automatically following NFT transfers.

For any NFT-as-membership / NFT-as-key system, ERC-6066 is the right shape.