Sigil ships native NFT support at the executor level. NFTs are not contracts; they are typed state records. Two collection kinds exist: standard (transferable) and identity (DID-bound). Royalty enforcement, cross-zone semantics, and identity-revocation cascade are part of the protocol.

​
Collection kinds

KindDescriptionTransferable
StandardThe familiar ERC-721 / SPL-NFT model. Unique per instance, fungible per class.Yes
IdentityDID-bound credentials, attestations, or roles.No

​
Token IDs

Token IDs are 64-bit unsigned integers, scoped per collection. Collection IDs are derived from the creator DID, collection name, and creation height: 
collection_id = blake3(creator_did || name || height)[..32]

​
Transactions

VariantPurpose
MintCollectionCreate a new collection.
MintNftMint a token into a collection.
TransferNftMove a standard NFT between DIDs.
BurnNftDestroy a token.
SetRoyaltyUpdate the royalty policy on a collection.
VerifyIdentityNftAdvance the verification level of an identity NFT.

​
Royalty model

Sigil enforces royalties through an ERC-2981-style metadata signal plus a governance allowlist. Marketplaces that route trades through Sigil must honour the royalty record on the collection. 
pub struct RoyaltyPolicy {
    pub receiver_did: Did,
    pub basis_points: u16, // 0..=1000 (max 10%)
    pub enforced_on_chain: bool,
}
When enforced_on_chain = true, the executor rejects transfers that do not carry a royalty-payment subtransaction. When false, the policy is informational and marketplaces honour it at their discretion. The governance-allowlist gating prevents royalty griefing through micro-royalty traps.

​
Cross-zone NFT semantics

NFTs minted in zone A and referenced from zone B carry an explicit cross-zone token reference. The reference is verified during send_zone_message; the executor refuses to transmit an NFT that does not have a valid cross-zone capability proof. The capability proof is signed by the source zone DID and pinned at the destination zone. Once accepted, the destination zone can use the NFT in its own contracts until the capability is revoked.

​
Identity revocation cascade

When a DID is revoked through the GAL system, identity NFTs bound to that DID enter a cascading invalidation:
  1. The DID record is marked revoked at height h.
  2. All IdentityBinding(did) NFTs are flagged binding_revoked = true at height h + 1.
  3. Issuers can re-issue under a new DID; the previous identity NFT is dead.
Standard NFTs owned by the revoked DID are not affected; they remain transferable by the recovery successor (after the recovery ceremony completes).

​
RPC

MethodReturns
sigil_getCollectionCollection record.
sigil_listCollectionsByCreatorCollections by creator DID.
sigil_getNftSingle NFT record.
sigil_listNftsByOwnerNFTs owned by a DID.
sigil_getRoyaltyPolicyRoyalty record for a collection.

​
Limits

LimitValue
Collection name3–64 chars
Max NFTs per collection2^64 − 1
Metadata size on-chain64 bytes (BLAKE3 hash). Body lives off-chain in Weave.
Max royalty10% (1,000 bps).

​
Implementation

  • Types: node/sigil-core/src/nft.rs.
  • Executor: node/sigil-node/src/executor_nft.rs.
  • Durable state: node/sigil-node/src/nft_durable.rs.

​
See also