TLDR
- Solana developers filed SIMD-0723 on November 5 to eliminate durable nonce transactions.
- The proposed change follows April’s Drift exploit, which caused losses exceeding $270 million.
- Solana’s replacement programs would move transaction authorization checks into onchain applications.
- The proposal warns that failed transactions could leave signed authorizations usable.
- Fireblocks previously raised concerns about institutional custody migrations and smart-contract security.
Solana developers have proposed retiring durable nonces, shifting responsibility for delayed-signature safeguards to onchain programs. Their November 5 draft warns that replacement systems could leave failed transaction approvals valid.
The proposal, SIMD-0723, follows Drift’s April 1 breach, which caused at least $270 million in losses. However, the draft cites longstanding validator security and consensus problems, rather than naming Drift.
Drift Attack Exposed Delayed Transaction Risks
Durable nonces allow signed transfers to remain executable without a fresh blockhash. Standard transactions instead expire after approximately 30 seconds under Solana’s current slot settings.
As an earlier report by CoinCentral detailed, attackers used pre-signed approvals to seize Drift’s administrative control. Drift described apparently misrepresented approvals, rather than a bug in its smart contracts.
In April, Drift outlined stronger multisignature controls, including dedicated signing devices and independent transaction verification. It also committed to disabling durable nonces for its signers.
The Solana draft cites a 2022 network outage lasting approximately 4.5 hours. That incident involved conflicting nonce and blockhash handling.
New Signer Programs Create Custody Questions
SIMD-0723 would require every transaction to include a recent blockhash. Offline approvals could instead pass through programs that verify signatures before executing instructions.
The Solana Foundation identifies Anza’s Programmatic Signer and Blueshift’s Vector as two candidates. Neither replacement has received a final designation, according to its October roadmap.
The draft warns that failed execution may leave a signed authorization usable. Consequently, custodians cannot treat unsuccessful submission as automatic revocation.
The shift follows Solana’s move toward 200-millisecond slots, which shortened the standard transaction approval window. That change increases the need for alternatives when institutions use offline, air-gapped devices.
Fireblocks previously supported retiring durable nonces but raised concerns about large-scale migrations. In March comments, it warned that transferring wallet authority into programs could alter cold-storage security arrangements.
Fireblocks also questioned whether smart-contract custody arrangements would satisfy existing institutional security policies.
Activation Hinges on Reviews and Migration
The draft prohibits mainnet activation before May 5, 2027. It also provides at least six months for affected operators to migrate.
However, the Foundation’s roadmap starts its approximate six-month transition after replacement software becomes ready. It still lists no confirmed activation date.
The proposal remains open and requires approvals from both Anza and Firedancer engineers. Firedancer’s separate security review changes illustrate ongoing scrutiny of Solana’s validator infrastructure.
