ERC-5192 — Soulbound NFTs

Back to Token Standards

ERC-5192: Minimal Soulbound NFTs

A soulbound token (SBT) is an NFT that cannot be transferred once issued. Use cases: credentials, attestations, badges, voting power tied to identity, KYC artifacts. ERC-5192 adds a single locked(tokenId) view method plus Locked / Unlocked events.

Required Interface

function locked(uint256 tokenId) external view returns (bool);
event Locked(uint256 tokenId);
event Unlocked(uint256 tokenId);

A locked token's transferFrom MUST revert.

Neo Equivalent: Direct Port

Neo C# port: track per-token lock state in storage, check it in Transfer. The Neo contract is even simpler than the Solidity version because the witness model naturally enforces who can lock/unlock.

Live on Neo TestNet

Both implementations deployed on Neo N3 TestNet.

Implementation	TestNet Address	Contract Hash
Solidity (neo-solc)	NQfv7FPi2BWZBnc3PGB9PggK72bJtZL9HH	0x1b75ecb9…7f3c3034
Neo C# (nccs)	NPuqRsgHLPkRZsxEJgs3igKKhZE1nqHVL3	0x7081fcf3…3c07da2b

Checked-in snapshot verifies Solidity issue/locked behavior and the C# symbol; the manifest now also exercises C# issue/locked behavior. docs/standards-mirror/deployments/erc-5192/.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

abstract contract SoulboundNFT {
    mapping(uint256 => address) private _owner;
    mapping(uint256 => bool)    private _locked;

    event Transfer(address indexed from, address indexed to, uint256 indexed tokenId);
    event Locked(uint256 tokenId);
    event Unlocked(uint256 tokenId);

    function locked(uint256 tokenId) external view returns (bool) {
        return _locked[tokenId];
    }

    function _mint(address to, uint256 tokenId, bool soulbound) internal {
        _owner[tokenId] = to;
        if (soulbound) {
            _locked[tokenId] = true;
            emit Locked(tokenId);
        }
        emit Transfer(address(0), to, tokenId);
    }

    function transferFrom(address from, address to, uint256 tokenId) external {
        require(!_locked[tokenId], "soulbound: token is locked");
        require(_owner[tokenId] == from, "wrong from");
        require(msg.sender == from,      "not authorized");
        _owner[tokenId] = to;
        emit Transfer(from, to, tokenId);
    }
}

using System;
using System.ComponentModel;
using System.Numerics;
using Neo;
using Neo.SmartContract.Framework;
using Neo.SmartContract.Framework.Attributes;
using Neo.SmartContract.Framework.Native;
using Neo.SmartContract.Framework.Services;

namespace R3E.Examples;

[DisplayName("SoulboundCert")]
[ContractPermission("*", "*")]
[SupportedStandards(NepStandard.Nep11)]
public class SoulboundCert : SmartContract
{
    private const byte Prefix_Owner  = 0x01;
    private const byte Prefix_Locked = 0x02;

    [DisplayName("Transfer")]
    public static event Action<UInt160, UInt160, BigInteger, ByteString> OnTransfer;
    [DisplayName("Locked")]
    public static event Action<ByteString> OnLocked;
    [DisplayName("Unlocked")]
    public static event Action<ByteString> OnUnlocked;

    public static bool Locked(ByteString tokenId)
        => Storage.Get(Storage.CurrentContext, new byte[] { Prefix_Locked }.Concat(tokenId)) != null;

    public static UInt160 OwnerOf(ByteString tokenId)
    {
        var raw = Storage.Get(Storage.CurrentContext,
                              new byte[] { Prefix_Owner }.Concat(tokenId));
        if (raw == null) throw new Exception("nonexistent");
        return (UInt160)raw;
    }

    public static void Issue(UInt160 to, ByteString tokenId, bool soulbound)
    {
        if (!Runtime.CheckWitness(GetIssuer())) throw new Exception("issuer only");
        if (Storage.Get(Storage.CurrentContext,
                        new byte[] { Prefix_Owner }.Concat(tokenId)) != null)
            throw new Exception("already issued");

        Storage.Put(Storage.CurrentContext,
                    new byte[] { Prefix_Owner }.Concat(tokenId), to);
        if (soulbound)
        {
            Storage.Put(Storage.CurrentContext,
                        new byte[] { Prefix_Locked }.Concat(tokenId), 1);
            OnLocked(tokenId);
        }
        OnTransfer(UInt160.Zero, to, 1, tokenId);
    }

    public static bool Transfer(UInt160 to, ByteString tokenId, object data)
    {
        if (Locked(tokenId)) throw new Exception("soulbound: token is locked");
        var from = OwnerOf(tokenId);
        if (!Runtime.CheckWitness(from)) throw new Exception("not authorized");
        Storage.Put(Storage.CurrentContext,
                    new byte[] { Prefix_Owner }.Concat(tokenId), to);
        OnTransfer(from, to, 1, tokenId);
        return true;
    }

    /// <summary>Issuer can revoke the soulbound flag (e.g. expired credential).</summary>
    public static void Unlock(ByteString tokenId)
    {
        if (!Runtime.CheckWitness(GetIssuer())) throw new Exception("issuer only");
        Storage.Delete(Storage.CurrentContext, new byte[] { Prefix_Locked }.Concat(tokenId));
        OnUnlocked(tokenId);
    }

    private static UInt160 GetIssuer() => (UInt160)"0x0000000000000000000000000000000000000000";
}