Solana Proposal Would Retire Durable Nonces After the Drift Exploit

November 9, 2026 — A Solana protocol proposal would phase out durable nonces, the mechanism that enabled long-lived signed transactions. It remains a draft and still needs approval.

A proposed change to Solana would remove durable nonces, a feature that lets a signed transaction remain valid far beyond the short window available to ordinary transactions. The proposal, SIMD-0723, was filed on Nov. 5 by Anza developer Gabe Rodriguez and is still marked as a draft. It has not been adopted or activated.

Primary material current to Nov. 9: SIMD-0723 (draft), Solana Foundation’s durable-nonce deprecation guidance, and Drift Protocol’s April incident account; independently reported by CoinDesk and The Defiant.

The proposal draws attention partly because attackers used pre-signed transactions in the April 1 theft from Drift, a Solana-based trading platform. But SIMD-0723’s stated case is broader: it points to recurring security and validator-consensus complications tied to the nonce system, rather than presenting itself as a response to that incident alone.

What a durable nonce does

A regular Solana transaction includes a recent blockhash. That reference expires after roughly 150 blocks, around 30 seconds at the network’s current slot timing. The short lifetime limits how long a signed transaction can wait before it becomes unusable.

Durable nonces replace that expiring reference with a stored nonce value. This gives a transaction a much longer useful life, which can help organizations that prepare approvals on offline or air-gapped computers. Their security procedures may involve several people and machines, making it difficult to sign and submit within half a minute.

The feature has a trade-off: an authorization can remain usable long after it was created. Teams need to track the nonce state and ensure that approvals are invalidated or consumed as intended. The proposal argues that these special cases also complicate how validators check and replay transactions.

What SIMD-0723 proposes

If adopted, the proposal would require every transaction to use a recent blockhash. It would also stop the System Program from initializing, advancing or upgrading nonce accounts, while retaining instructions that allow users to withdraw from those accounts or change their authority.

That is a substantial compatibility change for workflows that depend on durable nonces. Ordinary Solana wallets and transactions that already use recent blockhashes would not be affected in the same way; the migration burden falls mainly on specialized custody, exchange and treasury systems.

The draft says the change would not be activated on mainnet-beta before May 5, 2027, setting a floor rather than a guaranteed launch date. The Solana Foundation’s separate deprecation page says no final date has been set and describes a six-month migration period beginning only after a replacement is ready. That readiness condition could push the actual retirement later.

Why the proposal cites validator complexity

SIMD-0723 describes durable nonces as a continuing source of exceptional processing paths. A 2022 incident cited in the draft involved a failed transaction being processed through both the blockhash and nonce paths, halting Solana mainnet for about four and a half hours. The proposal also points to more recent nonce-related validator issues.

This does not mean every durable-nonce transaction is unsafe, nor that the proposal itself has proven a single cause for every incident. Its argument is that each special rule increases the surface area for bugs and makes protocol changes harder to reason about. Removing the exception would let validators rely on recent-blockhash rules for transaction expiry.

What the Drift exploit illustrates—and what it does not

In April, attackers obtained approvals in advance and held them for more than a week before using them in the Drift exploit, which took at least $270 million. Drift later attributed the operation to a North Korean state-affiliated group. The durable-nonce mechanism provided a way for those signed transactions to stay valid during that delay.

That sequence illustrates the risk of long-lived authorization: a signature may outlast the context in which its signer expected it to be used. Drift’s own April account described unauthorized access involving nonce accounts and advance approvals; the team said attackers gained administrative powers and disabled withdrawal limits. Drift later attributed the operation to a North Korean state-linked group, while independent blockchain analysts described attribution as suspected. Removing a transaction feature cannot substitute for reviewing signers, permissions and operational controls.

The affected group is small, but important

A June measurement period cited in reporting found durable-nonce transactions represented about 3% of Solana traffic but paid about 30% of priority fees. Researcher Max Resnick’s analysis attributed 97.5% of those transactions to 555 accounts. The figures describe that measurement period, not a permanent network-wide pattern, and the public data does not identify who controlled those accounts.

The proposal specifically calls out custodians and exchanges using air-gapped signing. Their workflows may rely on keeping keys offline while allowing more time for approval and submission. Stablecoin issuers and treasury teams with delayed signing processes may also need to examine whether their systems use nonce accounts.

Replacement programs change the workflow

The Solana Foundation has described a direction based on on-chain programs that verify signatures created offline. Anza’s Programmatic Signer and Blueshift’s Vector are named as candidate approaches. In broad terms, a cold key signs instructions, and an on-chain program checks that signature before executing them through a program-derived authority.

This could preserve an offline approval process without asking validators to support durable nonces as a special transaction type. But it is not a drop-in change for every operator: account authorities, transaction construction, monitoring and recovery procedures may need to change. The Foundation’s page notes that the replacement implementations are still being developed and that the final design and schedule remain unsettled.

The proposal also flags a different operational risk: if execution fails, an authorization may remain usable. A failed submission therefore should not automatically be treated as a revoked approval. Custody teams would need clear ways to track whether an authorization has been consumed, cancelled or remains live.

What users and builders should watch

For most people sending ordinary wallet transactions, the proposal does not require immediate action. The draft has not been approved, and the proposed earliest activation date is months away. Durable-nonce users, however, should inventory where nonce accounts are used, identify the systems that depend on them, and follow the proposal and replacement-program testing before changing production flows.

The practical question is not simply whether nonces disappear, but whether alternatives can preserve safe offline signing while avoiding the same replay and authorization risks. The draft must still receive sign-off from engineers at Anza and Firedancer before it can be merged, and the Foundation’s migration conditions may shift any eventual deadline.

For now, SIMD-0723 is a proposal—not a network upgrade already in force. Its progress will show how Solana’s developers weigh a narrower validator design against the migration costs for institutions that use long-lived, offline approvals.