Soulbound Token (SBT) Development

Soulbound Token (SBT) Development

Soulbound Token (SBT) is a non-transferable NFT. Cannot be sold, transferred, or purchased. The token is "bound to the soul" — the address that received it. The concept was proposed by Vitalik Buterin, Glen Weyl, and Puja Ohlhaver in 2022 to represent reputation, achievements, and credentials in Web3.

Technical Implementations

ERC-5192: Minimal Soulbound NFT

The official standard for soulbound NFTs (finalized EIP):

import "@openzeppelin/contracts/token/ERC721/ERC721.sol";

interface IERC5192 {
    event Locked(uint256 tokenId);
    event Unlocked(uint256 tokenId);
    
    function locked(uint256 tokenId) external view returns (bool);
}

contract SoulboundToken is ERC721, IERC5192 {
    mapping(uint256 => bool) private _locked;
    
    function locked(uint256 tokenId) external view override returns (bool) {
        return _locked[tokenId];
    }
    
    // Override transfer functions to block transfers
    function _beforeTokenTransfer(
        address from, address to, uint256 tokenId, uint256 batchSize
    ) internal override {
        require(
            from == address(0) || to == address(0),
            "SBT: Token is non-transferable"
        );
        super._beforeTokenTransfer(from, to, tokenId, batchSize);
    }
    
    function mint(address to, uint256 tokenId) external onlyOwner {
        _locked[tokenId] = true;
        _mint(to, tokenId);
        emit Locked(tokenId);
    }
}

from == address(0) — mint (allowed). to == address(0) — burn (if allowed).

Use Cases and Metadata

Educational certificates: completed course, degree. Metadata: issuer, date, course name, grade.

DAO voting participation: proof of participation. Metadata: dao_address, proposal_id, vote, timestamp.

KYC/AML verified: address passed verification. Metadata: issuer (Persona, Jumio), expiry, level.

Achievements: first 1000 protocol users, liquidity provider > 1 year, contributor.

POAPs (Proof of Attendance Protocol): events, conferences. Technically POAPs are transferable, but by spirit — soulbound.

SBT Privacy

Public SBTs expose full address history. Everyone sees all credentials of a wallet owner. This is a privacy problem.

zkSBT: Zero-Knowledge Soulbound Token. Owner proves possession of a certain type of SBT without revealing the specific token or other SBTs. Implementations: Sismo Protocol, Polygon ID.

Claim: "I have KYC verification SBT from Persona"
ZK Proof: proves the fact without revealing address or other SBTs

Revocation

SBTs should support revocation: if verification expires (outdated KYC), if holder commits a violation.

mapping(uint256 => bool) public revoked;

function revoke(uint256 tokenId) external onlyIssuer {
    revoked[tokenId] = true;
    emit Revoked(tokenId);
}

function isValid(uint256 tokenId) public view returns (bool) {
    return _exists(tokenId) && !revoked[tokenId] && !_isExpired(tokenId);
}

SBT is a building block for on-chain reputation systems. Developing a basic SBT contract takes 1-2 days. With privacy and revocation — 1-2 weeks.