# ERC-7066: Lockable Extension for ERC-721 Source: https://www.eipsfordesigners.com/standards/ERC-7066 Agent brief: https://www.eipsfordesigners.com/standards/ERC-7066/agent.md Machine-readable JSON: https://www.eipsfordesigners.com/api/standards/ERC-7066 Last reviewed: 2026-05-25 Last updated: 2026-05-25 | Field | Value | | --- | --- | | Status | Final | | Chain | both | | Category | NFT Capabilities | | Journey stages | Asset Management | | Detailed guide | Yes | | Official specification | https://eips.ethereum.org/EIPS/erc-7066 | | Discussion search | https://ethereum-magicians.org/search?q=ERC-7066 | ## UX Impact NFTs can be locked in owner's wallet — usable but non-transferable until unlocked. Design implications: show 'Locked' status badge with locker address, enable lock/unlock flows with locker assignment, indicate locked tokens differently from transferable ones, show who can unlock. Design decisions: how to explain lock vs soulbound difference, whether locked tokens appear in marketplace listings, transferAndLock flow complexity, safety messaging about cold wallet as unlocker. ## Summary NFTs can be locked in owner's wallet — usable but non-transferable until unlocked. ## For Designers - You can show Locked badge with who can unlock on every locked token. - Your lock flow can recommend cold wallet as locker with safety copy. - You can block marketplace List while locked with explanation, not disabled mystery button. ## Applicability ### When to Use - High-value NFTs need anti-theft lock without full cold storage. - Games require usable but non-transferable state. - Locker address is separate trusted key. ### When to Avoid - Soulbound tokens with no unlock path. - Users need frequent transfers — lock adds friction. - Marketplace primary use case for asset. ## Problems It Solves ### Hot wallet drain steals NFTs Impact: critical Old way: Transfer out instantly on compromise New way: Lock blocks transfer while app use continues ### Cold storage removes utility Impact: high Old way: Move to vault, cannot use in game New way: Locked but usable in connected apps ### Accidental listing of locked item Impact: medium Old way: Listing fails at settlement New way: Pre-check lock before list UI ## Anti-Patterns ### Lock without explaining locker role Severity: critical Users lock themselves out permanently Instead: Cold wallet recommendation and locker explainer ### Disabled List with no reason Severity: high Users think marketplace bug Instead: Cannot list while locked — Unlock first ### Conflating lock with soulbound Severity: medium Wrong recovery expectations Instead: Distinct Locked vs Non-transferable badges ## Design Decisions ### Recommend cold wallet as locker? Recommendation: Yes with default suggestion and explainer. Rationale: Hot wallet as locker defeats anti-theft purpose. ### Show locked items in marketplace search? Recommendation: Hide or badge Locked — do not allow list flow. Rationale: Prevent failed listings and buyer confusion. ### Explain lock vs soulbound? Recommendation: Tooltip: Locked = you chose protection; Soulbound = issuer rule. Rationale: Users conflate two restriction types. ## States to Design ### Unlocked — normal Trigger: No active lock. User need: Transfer and sell freely. Design response: Standard actions plus optional Lock asset. ### Locked — owner can unlock Trigger: Owner is locker. User need: Use in app; unlock when ready to sell. Design response: Locked badge with Unlock CTA. ### Locked — external locker Trigger: Cold wallet is locker. User need: Know must use cold key to unlock. Design response: Locked by [address] with connect cold wallet hint. ### List blocked Trigger: User tries marketplace list. User need: Understand lock prevents sale. Design response: Unlock to list message before wallet. ### transferAndLock incoming Trigger: Receiving locked token. User need: Know incoming asset is locked. Design response: Receive preview shows Locked on arrival. ## Vocabulary - Use "Locked for protection" instead of "Transfer restricted flag": Security framing. - Use "Unlock with [locker]" instead of "Call unlock() from locker EOA": Action and actor, not function. - Use "Still usable here" instead of "Lock does not affect utility hook": Reassurance for gamers. ## What to Prototype First ### Lock asset flow Owner chooses anti-theft lock before threat. Covers: Unlocked, Select locker, Confirm lock - Locker address field - Cold wallet tip - Usable but not transferable note ### Locked asset detail Daily view must show lock status clearly. Covers: Locked by self, Locked by other locker - Locked chip - Unlock authority - Use in app still enabled ### Unlock confirmation Unlocking restores transfer — high risk moment. Covers: Unlock success, Wrong locker fails - Scary confirm copy - 2-step confirm - Explorer link ### Blocked listing while locked Marketplace must pre-check lock. Covers: List blocked - Cannot list while locked - Unlock first CTA ## Mental Model ### Locked Token cannot transfer; may still work in approved apps. ### Locker Address authorized to unlock — often cold wallet. ### Owner Still owns token; may or may not unlock depending on config. ### Lock vs soulbound Lock is temporary and reversible; soulbound is policy-level permanent. ### transferAndLock Send to new owner already locked — preview both transfer and lock. ## Seen in the Wild - ERC-6147 Guard: Related guard patterns for transfer restriction UX. (https://eips.ethereum.org/EIPS/eip-6147) - OpenSea: Listing restriction patterns for non-transferable states. (https://opensea.io/) - MetaMask: Wallet security flows inform locker assignment copy. (https://metamask.io/) ## On Monad ### Lock/unlock cost Ethereum: Users hesitate to lock due to gas Monad: Cheap lock/unlock enables proactive protection Design implication: Promote lock after high-value mint on Monad. ### Game integration Ethereum: Locked state sync lag Monad: Fast finality keeps game and wallet lock state aligned Design implication: Refresh lock status after every game session. ## UX Patterns ### Lock Asset Flow Assign locker and confirm anti-theft lock. Components: LockButton, LockerInput, SafetyCopy User flow: - User taps Lock - Sets locker - Confirms - Locked badge appears Mockup registry key: `concept/nft-gallery` (React UI on the live standard page). ### Locked Status Badge Persistent locked indicator with unlock path. Components: LockedChip, UnlockCTA, LockerLabel User flow: - View locked NFT - See locker - Unlock when ready - Transfer enabled Mockup registry key: `concept/verify-safety` (React UI on the live standard page). ## Related Standards - ERC-6147: Guard-based transfer restriction alternative - ERC-6454: Transfer detection when locked ## Technical Notes ERC-7066 lock differs from soulbound — always show locker and unlock path.