A draft Solana upgrade would remove durable nonces no earlier than May 5, 2027, forcing custodians and exchanges that rely on long-lived, pre-signed transactions to rebuild their signing flows.
SIMD-0723, filed Nov. 5 by Anza developer Gabe R., remains a draft, unmerged and not yet accepted. The pull request requires approval from at least one Anza team member and one Firedancer team member before merging.
Durable nonces let a signed transaction remain valid beyond Solana's normal 150-block expiration window, provided its stored nonce value has not changed. That supports approvals on computers kept offline, or processes that take longer than the normal transaction window.
May 5 is an earliest date, not a scheduled shutdown. The draft specification counts a six-month migration window from publication. The Solana Foundation's October guidance instead describes removal roughly six months after a replacement program is ready and lists no activation date.
The feature was part of the April 1 attack on Solana trading protocol Drift. In its incident account, Drift said attackers combined pre-signed durable nonce transactions, “allowing delayed execution,” with compromised multisig approvals, likely obtained through social engineering or transaction misrepresentation. Drift said two pre-signed transactions transferred administrative control, enabling the attacker to introduce a malicious asset and remove withdrawal limits.
Drift's April 16 accounting put assets stolen at about $295.7 million. The attack subsequently led to a token-based recovery plan. The Solana draft's stated rationale for removal is repeated validator security and consensus bugs, as well as nonce-related spam.
Offline Signing Moves Into Programs
Under the proposal, every transaction would need a recent blockhash. Previously signed durable-nonce transactions would stop working after activation. Creating, advancing and upgrading nonce accounts would be disabled, while withdrawals and authority changes would remain available.
The draft names Anza's Programmatic Signer and Blueshift's Vector as replacements. Users would move account authorities and funds to program-controlled addresses, known as PDAs. A cold key would sign an authorization offline; an online relayer would then submit it inside a fresh transaction. The program would verify the signature and execute the approved actions.
The migration burden extends beyond updating transaction software. In a March contribution to the developer discussion, Fireblocks' Michael Gutkin said the company managed signing infrastructure across millions of Solana addresses. He supported removing durable nonces but said a replacement requiring full account migration without a compatibility bridge would need at least 12 months at institutional scale.
Replacement programs also change what a failed transfer means. The draft warns that “a failed submission is not a revocation”: an authorization can remain usable after execution fails, unlike a durable-nonce transaction whose nonce is consumed on failure.
Programmatic Signer's documentation says it is deployed on Devnet, with audits and remediation required before its first mainnet deployment.
Add A Comment
Comments are closed.