ERC-7066 — Lockable Extension for ERC-721

Back to Token Standards

ERC-7066: Lockable Extension for ERC-721

ERC-7066 adds an approval-based lock mechanism to ERC-721. Where ERC-6982 gives each NFT a default-locked / per-token override flag controlled by the holder, ERC-7066 lets the holder delegate lock authority to an external contract or operator (typically a staking contract, escrow contract, or rental marketplace). The locker can lock and unlock the NFT; the owner cannot transfer while locked. On unlock or NFT transfer, the locker permission is preserved or cleared per the lock type.

Key distinction:

• ERC-6982 = "owner controls the lock state directly".
• ERC-7066 = "owner delegates lock authority to an approved locker" (e.g. a staking contract that locks the NFT for the staking duration).

Required Interface

interface IERC7066 {
    enum LockType { OWNER_LOCK, APPROVED_LOCK }

    event Locked(uint256 indexed tokenId, address indexed locker, LockType lockType);
    event Unlocked(uint256 indexed tokenId);

    function lock(uint256 tokenId) external;                          // OWNER_LOCK by holder
    function lock(uint256 tokenId, address locker) external;          // APPROVED_LOCK by holder, delegating
    function unlock(uint256 tokenId) external;                        // by current locker
    function locker(uint256 tokenId) external view returns (address);
    function lockType(uint256 tokenId) external view returns (LockType);
    function isLocked(uint256 tokenId) external view returns (bool);
}

Neo Equivalent: NEP-11 + Approval-Based Lock Storage

The Neo port adds two storage slots per locked token:

• Prefix_Locker + tokenId — the address allowed to unlock.
• Prefix_LockType + tokenId — OWNER_LOCK or APPROVED_LOCK.

The base NEP-11 Transfer override checks IsLocked(tokenId) and reverts when locked. Lock owner can lock OR delegate to an external contract; the external contract is the only one that can unlock.

public static void Lock(ByteString tokenId, UInt160 locker)
{
    var owner = OwnerOf(tokenId);
    if (!Runtime.CheckWitness(owner))    throw new Exception("NEP11:NotOwner");
    if (Locker(tokenId) is not null)     throw new Exception("NEP11:AlreadyLocked");
    Storage.Put(Storage.CurrentContext, LockerKey(tokenId),    locker);
    Storage.Put(Storage.CurrentContext, LockTypeKey(tokenId),  locker.Equals(owner) ? 0 : 1);
    OnLocked(tokenId, locker, locker.Equals(owner) ? 0 : 1);
}

public static void Unlock(ByteString tokenId)
{
    var locker = Locker(tokenId);
    if (locker is null)                  throw new Exception("NEP11:NotLocked");
    if (!Runtime.CheckWitness(locker))   throw new Exception("NEP11:NotLocker");
    Storage.Delete(Storage.CurrentContext, LockerKey(tokenId));
    Storage.Delete(Storage.CurrentContext, LockTypeKey(tokenId));
    OnUnlocked(tokenId);
}

// Nep11Token<T> has no virtual hook; redefine Transfer with `public new static`.
public new static bool Transfer(UInt160 to, ByteString tokenId, object data = null)
{
    if (IsLocked(tokenId)) throw new Exception("NEP11:Locked");
    return Nep11Token<TokenState>.Transfer(to, tokenId, data);
}

ERC-7066 (Ethereum)	Neo Equivalent	Notes
lock(tokenId)	Lock(tokenId, owner) (OWNER_LOCK)	Holder locks for themselves
lock(tokenId, locker)	Lock(tokenId, locker) (APPROVED_LOCK)	Holder delegates to a contract
unlock(tokenId)	Unlock(tokenId) checked against current locker	Locker is sole un-locker
locker(tokenId)	Locker(tokenId) view	Returns current locker or null
isLocked(tokenId)	IsLocked(tokenId) view	Truthy iff locker is set
Transfer-block enforcement	OnBeforeTransfer override checks IsLocked	NEP-11 base hook

Comparison With ERC-6982 + ERC-6147

• ERC-6982 (Default Lockable) — owner-controlled binary state with collection-wide default. Cheap, holder-only.
• ERC-7066 (Lockable Extension) — approval-based; locker can be external. Fits staking / escrow / rental patterns.
• ERC-6147 (NFT Guard) — generalised guard delegate with configurable allowed actions. Heavier than 7066.

For most "stake an NFT" / "escrow this NFT" use cases, ERC-7066 is the right shape. For "let an arbitrary delegate authorise multiple action types", reach for ERC-6147.

Composition

• ERC-6982 — default lockable. Use 6982 for collection-wide defaults, 7066 for per-token delegation.
• ERC-4907 — rental NFT. Pair: rental contract is the locker; lock on rent, unlock on rental expiry / return.
• ERC-2981 — royalties. Lock during a sale escrow; unlock and pay royalty on completion.

Migration Notes

For staking / escrow contracts that want to immobilise NFTs without taking custody:

1. The contract calls Lock(tokenId, address(this)) to take lock authority.
2. The NFT stays in the holder's wallet (better UX, no custody transfer).
3. On unstake / release, the contract calls Unlock(tokenId).

This is strictly better than the alternative of transferring custody to the staking contract and back — no transfer fees, no risk of contract bugs trapping the NFT.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

contract ERC7066 {
    enum LockType { OWNER_LOCK, APPROVED_LOCK }

    mapping(uint256 => address)  public locker;
    mapping(uint256 => LockType) public lockType_;
    mapping(uint256 => address)  public ownerOf;

    event Locked(uint256 indexed tokenId, address indexed locker, LockType lockType);
    event Unlocked(uint256 indexed tokenId);

    function lock(uint256 tokenId) external {
        require(msg.sender == ownerOf[tokenId], "not owner");
        require(locker[tokenId] == address(0),  "already locked");
        locker[tokenId]    = msg.sender;
        lockType_[tokenId] = LockType.OWNER_LOCK;
        emit Locked(tokenId, msg.sender, LockType.OWNER_LOCK);
    }

    function lock(uint256 tokenId, address _locker) external {
        require(msg.sender == ownerOf[tokenId], "not owner");
        require(locker[tokenId] == address(0),  "already locked");
        locker[tokenId]    = _locker;
        lockType_[tokenId] = LockType.APPROVED_LOCK;
        emit Locked(tokenId, _locker, LockType.APPROVED_LOCK);
    }

    function unlock(uint256 tokenId) external {
        require(msg.sender == locker[tokenId], "not locker");
        delete locker[tokenId];
        delete lockType_[tokenId];
        emit Unlocked(tokenId);
    }

    function isLocked(uint256 tokenId) external view returns (bool) {
        return locker[tokenId] != address(0);
    }
}

using System;
using System.ComponentModel;
using System.Numerics;
using Neo;
using Neo.SmartContract.Framework;
using Neo.SmartContract.Framework.Attributes;
using Neo.SmartContract.Framework.Native;
using Neo.SmartContract.Framework.Services;

namespace R3E.Examples;

[DisplayName("LockableExtNFT")]
[ContractPermission("*", "*")]
[SupportedStandards(NepStandard.Nep11)]
public class LockableExtNFT : Nep11Token<TokenState>
{
    public override string Symbol => "LCK7";

    private const byte Prefix_Locker   = 0xA0;
    private const byte Prefix_LockType = 0xA1;

    [DisplayName("Locked")]
    public static event Action<ByteString, UInt160, BigInteger> OnLocked;
    [DisplayName("Unlocked")]
    public static event Action<ByteString> OnUnlocked;

    public static void Lock(ByteString tokenId, UInt160 lockerAddr)
    {
        var owner = OwnerOf(tokenId);
        if (!Runtime.CheckWitness(owner)) throw new Exception("NEP11:NotOwner");
        if (Locker(tokenId) is not null)  throw new Exception("NEP11:AlreadyLocked");
        var lockType = lockerAddr.Equals(owner) ? 0 : 1;  // 0 = OWNER_LOCK, 1 = APPROVED_LOCK
        Storage.Put(Storage.CurrentContext, LockerKey(tokenId),   lockerAddr);
        Storage.Put(Storage.CurrentContext, LockTypeKey(tokenId), lockType);
        OnLocked(tokenId, lockerAddr, lockType);
    }

    public static void Unlock(ByteString tokenId)
    {
        var lockerAddr = Locker(tokenId);
        if (lockerAddr is null)                  throw new Exception("NEP11:NotLocked");
        if (!Runtime.CheckWitness(lockerAddr))   throw new Exception("NEP11:NotLocker");
        Storage.Delete(Storage.CurrentContext, LockerKey(tokenId));
        Storage.Delete(Storage.CurrentContext, LockTypeKey(tokenId));
        OnUnlocked(tokenId);
    }

    public static UInt160 Locker(ByteString tokenId)
    {
        var raw = Storage.Get(Storage.CurrentContext, LockerKey(tokenId));
        return raw is null ? null : (UInt160)raw;
    }

    public static BigInteger LockType(ByteString tokenId)
        => (BigInteger)(Storage.Get(Storage.CurrentContext, LockTypeKey(tokenId)) ?? ByteString.Empty);

    public static bool IsLocked(ByteString tokenId)
        => Locker(tokenId) is not null;

    public new static bool Transfer(UInt160 to, ByteString tokenId, object data = null)
    {
        if (IsLocked(tokenId)) throw new Exception("NEP11:Locked");
        return Nep11Token<TokenState>.Transfer(to, tokenId, data);
    }

    private static byte[] LockerKey(ByteString tokenId)   => new byte[] { Prefix_Locker   }.Concat(tokenId);
    private static byte[] LockTypeKey(ByteString tokenId) => new byte[] { Prefix_LockType }.Concat(tokenId);
}

Staking Contract Pattern

[DisplayName("NFTStaking")]
public class NFTStaking : SmartContract
{
    public static void Stake(UInt160 nftContract, ByteString tokenId)
    {
        var owner = (UInt160)Contract.Call(nftContract, "ownerOf", CallFlags.ReadOnly, tokenId);
        if (!Runtime.CheckWitness(owner)) throw new Exception("STK:NoAuth");

        // Owner must have pre-approved this contract or call `lock` themselves.
        Contract.Call(nftContract, "lock", CallFlags.All,
            new object[] { tokenId, Runtime.ExecutingScriptHash });

        // ... record stake state, start emissions ...
    }

    public static void Unstake(UInt160 nftContract, ByteString tokenId)
    {
        // ... validate stake duration / rewards ...

        // Release the lock so the NFT can transfer again.
        Contract.Call(nftContract, "unlock", CallFlags.All, new object[] { tokenId });
    }
}