ERC-4907 — Rental NFT

Back to Token Standards

ERC-4907: Rental NFT — User Role with Expiry

ERC-4907 splits ERC-721 ownership into two roles: the owner (holds the NFT, can sell it) and the user (has time-limited usage rights). The user role expires automatically at a unix timestamp; querying userOf after expiry returns address(0) without requiring an on-chain reset call. This is the standard rental primitive used by gaming guilds, scholarship programs, virtual-land subleasing, and Yuga Labs-style member portals.

Required Interface (delta from ERC-721)

interface IERC4907 {
    event UpdateUser(uint256 indexed tokenId, address indexed user, uint64 expires);

    function setUser(uint256 tokenId, address user, uint64 expires) external;
    function userOf(uint256 tokenId) external view returns (address);
    function userExpires(uint256 tokenId) external view returns (uint256);
}

Semantics:

• setUser — owner sets the renter and expiry; only the owner (or approved operator) can call.
• userOf — returns the renter iff block.timestamp <= expires, otherwise address(0).
• The user role is not transferable independently — transferring the NFT clears the user (per OpenZeppelin's reference implementation).

Neo Equivalent: NEP-11 + Per-Token Storage

NEP-11 has no native user-role concept, but the extension is a clean storage-only addition: store (tokenId) -> (user, expires) and check the timestamp on read. Two design choices to make:

A. Clear-on-transfer — owner-side transfers reset the user role (matches the OpenZeppelin reference). Use this when the rental is per-NFT and shouldn't survive secondary sales.

B. Persist-across-transfer — keep the user role even when the NFT moves (rare; useful for rentals that are independently tradeable). The ERC permits this but the de-facto convention is clear-on-transfer.

ERC-4907 (Ethereum)	Neo Equivalent	Notes
setUser(tokenId, user, expires)	SetUser(tokenId, user, expires) with Runtime.CheckWitness(OwnerOf(tokenId))	Owner-only auth via witness
userOf(tokenId) returns user iff block.timestamp <= expires	UserOf(tokenId) returns user iff Runtime.Time <= expires	Direct equivalent; Runtime.Time is unix ms
UpdateUser event	OnUserUpdated notification	Wire-format equivalent
Transfer clears user (OZ reference)	Override NEP-11 Transfer to delete user/expires keys before delegating to base impl	Pattern A; explicit
Owner-side approval	NEP-11 Approve extension (if present) → SetUser honours approved operators	Optional; depends on NEP-11 base

Pairs Well With

• ERC-6551 — the renter (user) of an NFT could itself control the NFT's TBA, so granting user role grants TBA usage. Useful for "rent a whole character including its inventory".
• ERC-2981 royalty splits — set the renter as a partial royalty recipient during the rental window, owner gets the rest.

Migration Notes

OpenZeppelin's ERC4907 reference contract ports cleanly to Neo via neo-solc: replace block.timestamp with block.timestamp (lowered to Runtime.Time / 1000 by the compiler), replace the _userInfo mapping with NEP-11 storage prefixes, and override the inherited _beforeTokenTransfer hook (or transfer directly) to clear user/expires on movement.

The C# port (next tab) is the idiomatic Neo shape.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

contract ERC4907 {
    struct UserInfo { address user; uint64 expires; }

    mapping(uint256 => address)  public ownerOf;
    mapping(uint256 => UserInfo) internal _users;

    event Transfer(address indexed from, address indexed to, uint256 indexed tokenId);
    event UpdateUser(uint256 indexed tokenId, address indexed user, uint64 expires);

    function setUser(uint256 tokenId, address user, uint64 expires) external {
        require(msg.sender == ownerOf[tokenId], "not owner");
        _users[tokenId] = UserInfo(user, expires);
        emit UpdateUser(tokenId, user, expires);
    }

    function userOf(uint256 tokenId) public view returns (address) {
        UserInfo memory u = _users[tokenId];
        return u.expires >= block.timestamp ? u.user : address(0);
    }

    function userExpires(uint256 tokenId) external view returns (uint256) {
        return _users[tokenId].expires;
    }

    function transferFrom(address from, address to, uint256 tokenId) external {
        require(msg.sender == ownerOf[tokenId], "not owner");
        ownerOf[tokenId] = to;
        delete _users[tokenId];                                  // clear-on-transfer
        emit Transfer(from, to, tokenId);
        emit UpdateUser(tokenId, address(0), 0);
    }
}

using System;
using System.ComponentModel;
using System.Numerics;
using Neo;
using Neo.SmartContract.Framework;
using Neo.SmartContract.Framework.Attributes;
using Neo.SmartContract.Framework.Native;
using Neo.SmartContract.Framework.Services;

namespace R3E.Examples;

[DisplayName("RentalNFT")]
[ContractPermission("*", "*")]
[SupportedStandards(NepStandard.Nep11)]
public class RentalNFT : Nep11Token<TokenState>
{
    public override string Symbol => "RENT";

    private const byte Prefix_User    = 0x20;
    private const byte Prefix_Expires = 0x21;

    [DisplayName("UserUpdated")]
    public static event Action<ByteString, UInt160, BigInteger> OnUserUpdated;

    public static void SetUser(ByteString tokenId, UInt160 user, BigInteger expires)
    {
        var owner = OwnerOf(tokenId);
        if (!Runtime.CheckWitness(owner)) throw new Exception("not owner");
        if (expires < Runtime.Time)       throw new Exception("expires in past");

        var ctx = Storage.CurrentContext;
        Storage.Put(ctx, UserKey(tokenId),    user);
        Storage.Put(ctx, ExpiresKey(tokenId), expires);
        OnUserUpdated(tokenId, user, expires);
    }

    public static UInt160 UserOf(ByteString tokenId)
    {
        var ctx = Storage.CurrentContext;
        var expires = (BigInteger)(Storage.Get(ctx, ExpiresKey(tokenId)) ?? ByteString.Empty);
        if (expires < Runtime.Time) return UInt160.Zero;
        return (UInt160)Storage.Get(ctx, UserKey(tokenId));
    }

    public static BigInteger UserExpires(ByteString tokenId)
        => (BigInteger)(Storage.Get(Storage.CurrentContext, ExpiresKey(tokenId)) ?? ByteString.Empty);

    // Redefine Transfer with `public new static` to clear user/expires
    // post-transfer (Pattern A — clear-on-transfer). Nep11Token<T> exposes
    // no virtual hook for this.
    public new static bool Transfer(UInt160 to, ByteString tokenId, object data = null)
    {
        var ok = Nep11Token<TokenState>.Transfer(to, tokenId, data);
        if (ok)
        {
            var ctx = Storage.CurrentContext;
            Storage.Delete(ctx, UserKey(tokenId));
            Storage.Delete(ctx, ExpiresKey(tokenId));
            OnUserUpdated(tokenId, UInt160.Zero, 0);
        }
        return ok;
    }

    private static byte[] UserKey(ByteString tokenId)
        => new byte[] { Prefix_User }.Concat(tokenId);

    private static byte[] ExpiresKey(ByteString tokenId)
        => new byte[] { Prefix_Expires }.Concat(tokenId);
}

Storage Layout Notes

• Prefix_User (0x20) → user UInt160 per tokenId.
• Prefix_Expires (0x21) → expiry timestamp BigInteger (Neo's Runtime.Time is unix ms).

Both are deleted on transfer in the override above. The deletion is recorded in the same OnUserUpdated notification that clients use to track rental state — clients don't need a separate "transfer cleared the rental" event.

Combining With ERC-6551 (TBA)

If the NFT has a token-bound account (see ERC-6551), override the TBA's authorization check to honour the user role during the rental window — Verify() returns true when the renter signs, instead of the owner. That gives gaming-guild scholars full inventory access for the duration of their rental, automatically revoked when the timer expires.