Solana proposes retiring durable nonces after $270m-plus Drift attack

Solana developers have proposed removing durable nonces, the feature used to keep transaction approvals alive during April’s $270m-plus attack on Drift. The draft removal proposal, SIMD-0723, sets 5 May 2027 as the earliest mainnet activation date.

Durable nonces let an organisation sign a transaction offline and submit it much later. Exchanges and custodians use that flexibility when approvals pass through disconnected computers or several people. Removing the feature would require those organisations to change how they authorise and relay transactions.

May 2027 is the earliest activation date

Gabe Rodriguez of Anza submitted SIMD-0723 on 5 November 2026. The draft gives affected users at least six months from publication to migrate and requires every transaction to carry a recent blockhash after activation. A blockhash identifies a recent block and gives an ordinary transaction a limited lifetime.

The proposal is undergoing technical review. Its pull request requires approval from engineers at both Anza and Firedancer before merging.

The Solana Foundation’s migration guide describes a further readiness condition: removal roughly six months after the replacement programme is ready. Custody teams therefore have a minimum date to plan against, while the eventual activation still depends on the technical process and replacement readiness.

Offline signatures would be checked by a programme

The proposed replacement moves offline signature verification into an ordinary on-chain programme. Solana’s guide names Anza’s Programmatic Signer and Blueshift’s Vector as implementations under development.

A cold signing key approves a message describing the intended instructions. An online fee payer then puts that message into a fresh transaction. The programme verifies the signature, applies replay protection and executes the authorised instructions through a programme-controlled account.

That requires more than changing a transaction flag. Custodians need to test their signing devices, authority transfers, transaction decoding and cancellation procedures. The Foundation’s guide describes the Anza deployment as pre-audit, so integration teams must account for interface changes during testing.

A failed submission can leave an approval usable

Programme-based signing can preserve an authorisation for a retry after execution fails. SIMD-0723 warns that this makes cancellation a separate operation: a failed submission can leave the signed approval available for later use.

For a custody desk, the practical control is to track the approval’s lifetime as well as the transaction’s result. Operators need a reliable way to revoke or replace authorisations when a transfer is abandoned.

Drift tightened its own signing controls after the attack

Drift’s 16 April recovery plan commits to disabling durable nonces for all signers. The plan also requires dedicated signing devices, independent verification of transaction contents, timelocks on critical administrative actions and real-time alerts.

SIMD-0723 builds its technical case around the maintenance burden of durable nonce handling, including past validator vulnerabilities and consensus failures. Its removal would standardise transaction lifetime rules across validator clients. For organisations using offline signing, the migration centres on preserving that approval workflow while moving its verification and revocation controls into audited programmes.