Solana developers have filed a proposal to retire durable nonces, the mechanism that allows signed transactions to remain valid for extended periods, moving responsibility for delayed-signature safeguards from the protocol layer to onchain programs and, by extension, toward the custodians that manage them. The draft, SIMD-0723, was submitted on November 5 in Solana's public improvement-documents repository and warns that replacement systems could leave failed transaction approvals valid.

The proposal follows the April 1 breach of Solana-based derivatives platform Drift, which caused losses of at least $270 million. The draft itself cites longstanding validator security and consensus problems rather than naming Drift directly.

Drift Attack Exposed Delayed Transaction Risks

Durable nonces allow signed transfers to remain executable without a fresh blockhash, whereas standard transactions expire after approximately 30 seconds under Solana's current slot settings. As an earlier CoinCentral report detailed, attackers used pre-signed approvals to seize Drift's administrative control. Drift said the approvals had apparently been misrepresented, rather than pointing to a bug in its smart contracts, in its incident recovery update.

In April, Drift outlined stronger multisignature controls, including dedicated signing devices and independent transaction verification, and committed to disabling durable nonces for its signers.

The Solana draft also cites a 2022 network outage lasting approximately 4.5 hours, an incident that involved conflicting nonce and blockhash handling.

New Signer Programs Create Custody Questions

SIMD-0723 would require every transaction to include a recent blockhash. Offline approvals could instead pass through programs that verify signatures before executing instructions. The Solana Foundation identifies Anza's Programmatic Signer and Blueshift's Vector as two candidates in its durable nonce deprecation plans, though neither replacement has received a final designation, according to the Foundation's October roadmap.

The draft warns that failed execution may leave a signed authorization usable. Consequently, custodians cannot treat an unsuccessful submission as automatic revocation — in practice, an offline or delayed approval does not simply expire when a transaction fails onchain.

The shift follows Solana's move toward 200-millisecond slots, which shortened the standard transaction approval window. That change increases the need for alternatives when institutions use offline, air-gapped devices.

Fireblocks previously supported retiring durable nonces but raised concerns about large-scale migrations. In March comments, the institutional custody provider warned that transferring wallet authority into programs could alter cold-storage security arrangements, and questioned whether smart-contract custody arrangements would satisfy existing institutional security policies.

Activation Hinges on Reviews and Migration

The draft prohibits mainnet activation before May 5, 2027, and provides at least six months for affected operators to migrate. The Foundation's roadmap, however, begins its approximate six-month transition only once replacement software becomes ready, and still lists no confirmed activation date. For institutions and program operators, the milestone to watch is a final designation among the replacement candidates, since the roadmap opens the six-month transition only once the replacement software is ready.

The proposal remains open and requires approvals from both Anza and Firedancer engineers. Firedancer's separate security review changes illustrate ongoing scrutiny of Solana's validator infrastructure.

Source: CoinCentral