Degree NFT: ERC721 Soulbound Credentials for Universities

The current state of degree verification is a vendor like World Education Services or HEC attestation queues that take weeks to confirm a graduation. Forged degrees are common because the verification surface is so slow that employers often skip it. The actual cost of a fake degree shows up later as a wrongful hire.

A soulbound NFT collapses verification to a single contract read. The employer types the tokenId into a verifier app, the app calls verify(id) on the university's contract, the contract returns the program, year, and revocation status. Seconds instead of weeks. Tamper proof by design.

The same ERC721 base contract is the starting point. The interesting work is the soulbound transfer hook and the verification surface.

// Degree NFT — soulbound ERC721 with revocation
contract Degree is ERC721, AccessControl {
    bytes32 public constant REGISTRAR_ROLE = keccak256("REGISTRAR_ROLE");

    struct Credential {
        string program;       // "BSCS", "MBA", "Diploma in Design"
        uint16 graduationYear;
        bytes32 transcriptHash; // hash of off chain transcript PDF
        bool revoked;
    }

    mapping(uint256 => Credential) public credential;
    uint256 public nextId;

    event Issued(uint256 indexed id, address indexed graduate, string program);
    event Revoked(uint256 indexed id, string reason);

    constructor() ERC721("Degree", "DEG") {
        _grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
    }

    function issue(
        address graduate,
        string calldata program,
        uint16 graduationYear,
        bytes32 transcriptHash
    ) external onlyRole(REGISTRAR_ROLE) returns (uint256 id) {
        id = ++nextId;
        credential[id] = Credential(program, graduationYear, transcriptHash, false);
        _safeMint(graduate, id);
        emit Issued(id, graduate, program);
    }

    function revoke(uint256 id, string calldata reason)
        external
        onlyRole(REGISTRAR_ROLE)
    {
        require(_ownerOf(id) != address(0), "Degree: unknown id");
        credential[id].revoked = true;
        emit Revoked(id, reason);
    }
}

The Credential struct holds the program name, the graduation year, a transcript hash, and a revoked flag. The transcript itself stays off chain because it contains personally identifiable data — grades, courses, sometimes medical accommodations. Only the hash lives on chain. An employer who needs the transcript receives it through the normal channel and checks the hash matches.

The issue function is registrar only. The registrar wallet sits inside the university's student information system and only fires after the academic records office confirms the graduation. The transcript hash is computed at issuance time from the canonical PDF the registrar archives.

// Soulbound — block every transfer that is not a mint or burn
function _beforeTokenTransfer(address from, address to, uint256, uint256)
    internal
    pure
    override
{
    require(from == address(0) || to == address(0), "Degree: soulbound");
}

// Operator approval is meaningless for a soulbound token — disable it
function approve(address, uint256) public pure override {
    revert("Degree: soulbound");
}

function setApprovalForAll(address, bool) public pure override {
    revert("Degree: soulbound");
}

The transfer hook is the primary gate. Any function call that would move the token reverts unless one party is the zero address — that is, the call is a mint or a burn. Direct transfers fail. transferFrom fails. safeTransferFrom fails.

The approve and setApprovalForAll overrides close the secondary path. Without them, a graduate could give a marketplace contract permission to move the NFT, and the marketplace could try to transfer on their behalf. Disabling approval at the contract level means no marketplace can ever list the token.

// Employer verifies a degree without contacting the university
function verify(uint256 id) external view returns (
    address graduate,
    string memory program,
    uint16 year,
    bool valid
) {
    address owner = _ownerOf(id);
    require(owner != address(0), "Degree: not found");
    Credential memory c = credential[id];
    valid = !c.revoked;
    return (owner, c.program, c.graduationYear, valid);
}

// Optional — verify the transcript file the employer received matches on chain
function verifyTranscript(uint256 id, bytes calldata transcriptFile)
    external
    view
    returns (bool)
{
    return keccak256(transcriptFile) == credential[id].transcriptHash
        && !credential[id].revoked;
}

The employer's verifier app is a thin front end over a single RPC call. It takes the tokenId from the candidate's resume or LinkedIn profile, calls verify on the university's known contract address, and renders the result. The university operates the contract but does not see the verification request. Privacy from the registrar side is automatic.

For verifying the transcript file itself — which the candidate sends to the employer through email or a portal — the employer hashes the file and compares to the on chain hash. If they match, the file has not been tampered with since issuance. If they differ, the file was modified after the university issued it.

The contract is what is in this post. Audited once, deployed once, never upgraded. Pick a chain with cheap writes — Polygon or Base — because the university only writes on graduation day and revocation events.

The registrar dashboard is a small internal tool with two screens: a batch issuance form (paste a CSV of graduate wallets plus program details, the dashboard signs the issue calls) and a revocation form. The registrar wallet sits inside a hardware HSM with a 2 of 3 multisig for safety.

The public verifier is a one page app on the university's domain. It takes a tokenId, calls verify, renders the result with the institution's seal. The whole verifier is roughly 200 lines of TypeScript. Employers bookmark the URL and never touch the registrar again.

We help universities, online learning platforms, and certification bodies ship soulbound credential systems, including the contract, the registrar dashboard, the public verifier, and the integration with existing student information systems. The same pattern applies to professional licenses, training certifications, and any credential where ownership must stay with the original holder.