ERC-6551 — Token Bound Accounts

Back to Account & Authentication

ERC-6551: Non-fungible Token Bound Accounts

ERC-6551 gives every ERC-721 NFT a deterministic, smart-contract wallet — a "token bound account" (TBA). The NFT becomes the owner of its own account; the account can hold tokens, sign messages, and execute arbitrary calls, and control of the account follows the NFT through any transfer. This is the foundation of NFT-as-character-inventory systems, NFT-as-DAO-membership, and composable on-chain identities.

Architecture

ERC-6551 has two components:

1. Registry (ERC6551Registry) — a singleton at a known address that computes the deterministic account address for any (implementation, chainId, tokenContract, tokenId, salt) tuple via CREATE2, and deploys the account on first use.

2. Account implementation (IERC6551Account) — a minimal proxy clone (often using ERC-1167) of an account contract. The account exposes:

function token() external view returns (uint256 chainId, address tokenContract, uint256 tokenId);
function owner() external view returns (address);  // resolves NFT owner via tokenContract.ownerOf(tokenId)
function isValidSigner(address signer, bytes calldata context) external view returns (bytes4);
function execute(address to, uint256 value, bytes calldata data, uint8 operation) external payable returns (bytes memory);
function state() external view returns (uint256);  // monotonic — increments on every state-changing call

Combined with ERC-1271 (smart-contract signatures) the TBA can sign messages on behalf of the NFT holder, enabling NFT-as-identity for authentication flows.

Neo Equivalent: Registry + Per-NFT Contract Account

Neo doesn't have CREATE2 with the same address-computation semantics, but the TBA pattern adapts cleanly using a registry contract that mints (or looks up) a per-NFT account. Two viable patterns:

A. Deterministic-mapping registry — the registry stores (NFT contract, tokenId) -> account contract hash, and on first access it deploys a parameterized account contract via ContractManagement.Deploy(...). The account stores the (NFT contract, tokenId) tuple in its storage and resolves ownership via Nep11Token.OwnerOf(tokenId) on every authorization check.

B. Single shared account, scoped storage — one shared account contract holds all TBA state in a (NFT contract, tokenId) -> KV namespaced storage prefix. Cheaper (no per-NFT deploy) but loses the ERC-6551 "every TBA has a distinct address" property. Most production TBA systems use pattern A.

ERC-6551 (Ethereum)	Neo Equivalent	Notes
ERC6551Registry.account(impl, chainId, tokenContract, tokenId, salt)	TBARegistry.AccountFor(nftContract, tokenId)	Deterministic lookup, deploy on first use
CREATE2 + ERC-1167 minimal proxy	ContractManagement.Deploy with a parameterised manifest, or shared-account + scoped storage	No CREATE2, but ContractManagement.GetContractById provides deterministic addressing post-deploy
IERC6551Account.execute(to, value, data, op)	Contract.Call(target, method, callFlags, args)	Neo callflags replace ERC-6551's operation enum
IERC6551Account.owner() → IERC721.ownerOf(tokenId)	Nep11Token.OwnerOf(tokenId)	Both resolve owner on every check
isValidSigner(signer, context)	Runtime.CheckWitness(owner)	Direct equivalent — Neo bakes signer auth in
state() (monotonic)	TBA-side counter incremented on each Execute call	Same pattern, no native helper
ERC-1271 signature path	Verify(...) (NEP-30)	The TBA's Verify returns true iff the NFT holder signed the witness

Why It's Almost Free on Neo

Two pieces that ERC-6551 has to reimplement on Ethereum are already first-class on Neo:

• Smart-contract signers are native (via NEP-30 Verify) — no ERC-1271 shim required.
• Authorization scoping is part of the witness model — the TBA's Execute doesn't need to forward gas, value, or operation flags; it just calls the target contract and the runtime enforces witness rules.

The Ethereum-side need for CREATE2 deterministic addressing is the only genuine impedance mismatch. The registry-with-mapping pattern recovers deterministic lookup without changing any caller-facing behavior.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

interface IERC721 {
    function ownerOf(uint256 tokenId) external view returns (address);
}

interface IERC6551Account {
    function token() external view returns (uint256 chainId, address tokenContract, uint256 tokenId);
    function owner() external view returns (address);
    function execute(address to, uint256 value, bytes calldata data, uint8 operation)
        external payable returns (bytes memory);
    function state() external view returns (uint256);
}

contract ERC6551Account is IERC6551Account {
    uint256 private _state;

    receive() external payable {}

    function token() public view returns (uint256, address, uint256) {
        bytes memory footer = new bytes(0x60);
        assembly { extcodecopy(address(), add(footer, 0x20), 0x4d, 0x60) }
        return abi.decode(footer, (uint256, address, uint256));
    }

    function owner() public view returns (address) {
        (uint256 chainId, address tokenContract, uint256 tokenId) = token();
        if (chainId != block.chainid) return address(0);
        return IERC721(tokenContract).ownerOf(tokenId);
    }

    function execute(address to, uint256 value, bytes calldata data, uint8 operation)
        external payable returns (bytes memory result)
    {
        require(msg.sender == owner(), "not owner");
        require(operation == 0, "only CALL");
        ++_state;
        bool ok;
        (ok, result) = to.call{value: value}(data);
        require(ok, "call reverted");
    }

    function state() external view returns (uint256) { return _state; }
}

The minimal proxy (ERC-1167) and the singleton registry (ERC-6551 spec) are omitted for brevity; the registry's account() method computes a CREATE2 address from (implementation, chainId, tokenContract, tokenId, salt).

using System;
using System.ComponentModel;
using System.Numerics;
using Neo;
using Neo.SmartContract.Framework;
using Neo.SmartContract.Framework.Attributes;
using Neo.SmartContract.Framework.Native;
using Neo.SmartContract.Framework.Services;

namespace R3E.Examples;

// Pattern A — registry that issues per-NFT account contracts on first use.
//
// The registry stores `keccak(nftContract, tokenId) -> accountHash`. On
// AccountFor(...), if no entry exists it deploys a parameterised account
// contract (manifest baked with the (nftContract, tokenId) tuple) via
// ContractManagement.Deploy, records the resulting hash, and returns it.

[DisplayName("TBARegistry")]
[ContractPermission("*", "deploy")]
public class TBARegistry : SmartContract
{
    private const byte Prefix_Account = 0x01;

    [DisplayName("AccountCreated")]
    public static event Action<UInt160, ByteString, UInt160> OnAccountCreated;

    public static UInt160 AccountFor(UInt160 nftContract, ByteString tokenId)
    {
        var key = AccountKey(nftContract, tokenId);
        var existing = (UInt160)Storage.Get(Storage.CurrentContext, key);
        if (existing is not null) return existing;

        var (nef, manifest) = BuildAccountFor(nftContract, tokenId);
        var deployed = (Contract)ContractManagement.Deploy(nef, manifest);
        Storage.Put(Storage.CurrentContext, key, deployed.Hash);
        OnAccountCreated(nftContract, tokenId, deployed.Hash);
        return deployed.Hash;
    }

    private static byte[] AccountKey(UInt160 nft, ByteString tokenId)
        => new byte[] { Prefix_Account }.Concat(nft).Concat(tokenId);

    private static (ByteString, string) BuildAccountFor(UInt160 nft, ByteString tokenId)
    {
        // Registry-side helpers vendor the account NEF/manifest with the
        // (nft, tokenId) tuple baked into a constant slot. Deploy returns the
        // contract hash, which becomes the deterministic TBA address.
        throw new Exception("vendoring elided for example brevity");
    }
}

// Account contract — one instance per NFT. Owner resolution always defers to
// the live NEP-11 ownership record so transfers of the NFT transfer the TBA.
[DisplayName("TBAAccount")]
[ContractPermission("*", "*")]
public class TBAAccount : SmartContract
{
    private static readonly UInt160 NFT_CONTRACT = (UInt160)"0x0000000000000000000000000000000000000000";
    private static readonly ByteString TOKEN_ID = "";

    private const byte Prefix_State = 0x01;

    public static UInt160 Owner()
        => (UInt160)Contract.Call(NFT_CONTRACT, "ownerOf", CallFlags.ReadOnly, TOKEN_ID);

    public static bool Verify()
    {
        // NEP-30: the TBA "signs" iff the NFT holder signed the witness.
        return Runtime.CheckWitness(Owner());
    }

    public static object Execute(UInt160 target, string method, object[] args)
    {
        if (!Runtime.CheckWitness(Owner())) throw new Exception("not owner");
        BumpState();
        return Contract.Call(target, method, CallFlags.All, args);
    }

    public static BigInteger State()
        => (BigInteger)(Storage.Get(Storage.CurrentContext, new byte[] { Prefix_State }) ?? ByteString.Empty);

    private static void BumpState()
    {
        var k = new byte[] { Prefix_State };
        var s = (BigInteger)(Storage.Get(Storage.CurrentContext, k) ?? ByteString.Empty);
        Storage.Put(Storage.CurrentContext, k, s + 1);
    }
}

Production Notes

• The registry must be *-permissioned for deploy and gate the actual deploy call on a payment, anti-spam quota, or collection allowlist. A naive open-deploy registry is a DoS vector.
• For collections that need cheap TBAs without per-NFT deploys, pattern B (one shared account, scoped storage) drops the deploy cost at the price of losing per-TBA address distinctness. Use it when downstream contracts only need authorization scoping, not address-level segregation.
• The state() counter is essential for off-chain signer verification (matching ERC-6551 wallets and indexers).