ERC-6147 NFT and SBT Guard Extension (Guard of NFT/SBT, an Extension of ERC-721)
Final · NFTs & multi-token · created 2022-12-07
An ERC-721 extension standard that adds a time-limited management role called a guard to NFTs and soulbound tokens (SBTs), so the right to use a token while holding it can be separated from the right to transfer it.
Why it is needed
An NFT is an asset that has both utility and property value, but thefts are common. Moving an NFT to a cold wallet that is isolated from the internet to prevent theft makes it inconvenient to actually use. Borrowing against an NFT also requires handing the NFT over to the lending contract, so the NFT cannot be used while the loan is outstanding. This differs from real life, where you can keep living in a house even after mortgaging it. Soulbound tokens (SBTs), which are tied to one address and cannot be moved, have problems too. If the wallet's private key is lost or stolen, there is no method or standard for recovering the SBT, and a university that issued a diploma SBT also needs a way to revoke it from a graduate whose misconduct comes to light. Without a common rule that separates the right to hold from the right to transfer, a separate solution has to be built for each of these cases.
What to implement
event UpdateGuardLog(uint256 indexed tokenId, address indexed newGuard, address oldGuard, uint64 expires);: An event emitted when the guard address or the expiry time changes. If newGuard is the zero address, the token currently has no guard.function changeGuard(uint256 tokenId, address newGuard, uint64 expires) external;: Sets or changes the guard and expiry time of a token. When there is no guard, the owner and approved addresses can call it. When a valid guard exists, only the guard can call it.function removeGuard(uint256 tokenId) external;: Removes the guard and expiry time of a token. Only the guard itself can remove its own role.function transferAndRemove(address from, address to, uint256 tokenId) external;: Transfers the token to the to address and clears the guard and expiry time at the same time.function guardInfo(uint256 tokenId) external view returns (address, uint64);: Returns the guard address and expiry time of a token. If there is no guard or it has expired, it returns the zero address and 0.
In depth
Permission rules with and without a guard
A guard MUST be valid only before expires. If there is no guard or it has expired, guardInfo MUST return (address(0), 0), and in that case the token's owner, authorised operators, and the approved address MUST be able to set the guard and expires. Conversely, if a valid guard exists, the owner and approved addresses MUST NOT change the guard and expires or transfer the token, and only the guard MUST be able to remove or change the guard and transfer the token. If a token with a valid guard is burned, the guard MUST be deleted.
Interface structure and implementation requirements
The IERC6147 interface consists of four functions, changeGuard, removeGuard, transferAndRemove, and guardInfo, plus the UpdateGuardLog event. In changeGuard, newGuard cannot be the zero address, expires must be valid, and the call fails if tokenId is not a valid NFT. The three state-changing functions MAY be implemented as public or external, and guardInfo MAY be implemented as pure or view. The UpdateGuardLog event MUST be emitted whenever the guard changes, and supportsInterface MUST return true for 0xb61d1057.
How the reference implementation intercepts transfers
The reference implementation overrides ERC-721's transferFrom and safeTransferFrom and checks the guard with _checkGuard before a transfer. If a valid guard exists, the call passes only when the caller is the guard, and the actual sender address is then re-read with ownerOf(tokenId). If there is no guard, it checks whether the caller is the owner or an approved address, as in ordinary ERC-721. _updateGuard allows only the guard to make changes if a guard already exists, and only the owner or an approved address if not. _burn deletes the _guardInfo entry after burning and emits an event. changeGuard checks that expires is greater than the current block timestamp.
Uses that expires opens up
Giving the guard an expiry time widens the design space. At mint time, flexible minting becomes possible, with discounts for NFTs that are locked for a set period. Even if the private key of the guard address is lost and the address becomes inaccessible, the owner can recover the NFT after expiry. SBTs with a usage deadline can also be managed with guard and expires. When minting SBTs, the guard can be set in bulk to a designated address to make management easier (MAY).
Generality and extensibility
This standard analyzes the rights attached to real-world assets and abstracts the rights of NFTs and SBTs into the right to hold and the right to transfer. Creating a dedicated EIP for each use case would multiply the number of standards and burden developers, so a single general rule covers theft prevention, lending, SBT management, and more. If complex features such as social recovery or multisig are needed, the guard can be set to a third-party protocol address and those features implemented on the protocol side. Between guardian and guard, the shorter and more concise guard was chosen as the name.
Compatibility with ERC-721
This standard adds a set of extension functions, so it is fully compatible with ERC-721. Even an NFT minted under this standard is no different from a regular ERC-721 NFT in terms of existing functionality if no guard is set. Its status is Final.
Things to watch out for
- Setting an appropriate expiry time: The guard's expires must be set appropriately for the specific use scenario.
- Guard takes precedence over operator approval: An NFT with a valid guard cannot be transferred, even by an address that was granted operator rights through approve or setApprovalForAll.
- Marketplace listing checks: If a valid guard exists, the owner cannot sell the NFT. Platforms that accept listings through setApprovalForAll and owner signatures are recommended to check guardInfo and block listings of such NFTs.