Solana developers have proposed retiring durable nonces, a feature that allows signed transactions to remain valid for weeks or longer. The mechanism was used in the attack that drained at least $270 million from Drift in April, and its removal would force some custodians and exchanges to redesign offline transaction workflows.

The proposed retirement

The change is outlined in SIMD-0723, filed Nov. 5 by Gabe Rodriguez of Anza, the firm behind Solana’s primary validator software. The draft says that, after activation, every transaction would need to use a recent blockhash rather than a durable nonce.

Ordinary Solana transactions currently carry a blockhash tied to a recent block and expire after roughly 30 seconds. Durable nonces replace that short-lived reference with one that does not become stale, allowing a transaction signed on an offline computer to be submitted much later.

The proposal does not directly cite the Drift exploit. Instead, it points to a history of implementation problems, including a 2022 incident in which a failed transaction was processed through both the blockhash and nonce paths, contributing to a mainnet halt of about 4.5 hours.

The draft sets May 5, 2027, as the earliest possible activation date, providing at least six months for migration from the proposal’s publication. However, the Solana Foundation’s deprecation guidance says the clock begins only after a replacement is available, meaning the deadline could move later.

Custody trade-offs

The change would affect a relatively small but economically significant part of network activity:

• Durable nonce transactions represented about 3% of Solana traffic during one June measurement period.
• They generated roughly 30% of all priority fees during that period.
• Just 555 accounts sent 97.5% of those transactions, according to researcher Max Resnick.

The concentration suggests that the feature is used disproportionately by specialized operators, including custodians and exchanges whose approval processes run on air-gapped machines. Those systems may take longer than the normal blockhash validity window to authorize and transmit a transaction.

Potential replacements include onchain programs that verify offline signatures. The proposal names Anza’s Programmatic Signer and Blueshift’s Vector as options, but warns that these alternatives introduce different risks. In particular, a failed execution could leave an authorization usable, meaning a custody desk could not assume that a rejected submission automatically revoked the underlying approval.

What This Means

Retiring durable nonces could reduce a long-standing source of transaction complexity and remove a mechanism associated with serious operational and security failures. It would also shift risk rather than eliminate it, requiring custodians to build, test and audit replacement signing systems well before any mainnet activation.

For Solana, the proposal represents a significant infrastructure upgrade with a deliberately long migration runway. The limited number of heavy users should make coordination more manageable, but their large share of priority fees means the transition could affect transaction engineering, custody operations and fee-market behavior across the network.