CoinDesk
Solana developers have filed a draft proposal to retire durable nonces, the transaction feature attackers exploited to drain at least $270 million from trading protocol Drift in April. SIMD-0723, filed Nov. 5 by Gabe Rodriguez of Anza, would require every transaction to carry a recent blockhash, killing the mechanism that lets a signed transaction stay valid indefinitely. Removal would not take effect before May 5, 2027, and the Solana Foundation's migration requirements could push that date later.
Why it matters
Durable nonces swap the standard 30-second transaction expiry for a stamp that never goes stale, a design built for custodians and exchanges whose approvals happen on air-gapped machines. The same property suited the Drift attackers, who got approvals signed in advance and let them sit for more than a week before emptying the platform on April 1 in an attack Drift blamed on a North Korean state-affiliated group.
The proposal builds its case on years of bugs beyond Drift, including a 2022 incident in which a failed transaction was processed through both the blockhash and nonce paths, halting mainnet for about 4.5 hours. It still needs sign-off from an engineer at Anza and one at Firedancer, Jump's rival validator software, before it can merge.
Market impact
The blast radius is narrow but concentrated. Durable nonce transactions made up about 3% of Solana's traffic in a June measuring period yet paid 30% of all priority fees, with just 555 accounts sending 97.5% of them, according to researcher Max Resnick. Custodians would move to replacement programs like Anza's Programmatic Signer or Blueshift's Vector, but the draft warns those carry their own risk: a failed execution can leave an authorization usable, so a failed submission is not a revocation. Watch the approval path and how custody desks respond before the migration clock starts.
Frequently asked questions
-
What are Solana's durable nonces and why do they exist?
Durable nonces replace the standard blockhash stamp, which expires a transaction after about 30 seconds, with a marker that never goes stale. Custodians and exchanges that sign on air-gapped machines rely on them because their approvals can take longer than the normal expiry window.
-
How did attackers use durable nonces in the Drift hack?
Attackers obtained transaction approvals signed in advance and let them sit for more than a week, since durable nonces keep signatures valid indefinitely. They then used those pre-signed transactions to drain at least $270 million from Drift on April 1, an attack Drift blamed on a North Korean state-affiliated group.
-
When would SIMD-0723 remove durable nonces from Solana?
The draft states the feature will not be removed on mainnet-beta before May 5, 2027, giving users at least six months to migrate from the proposal's November 5 publication. The Solana Foundation's deprecation page starts the clock only once a replacement is ready, which could push the deadline later.
-
Who relies on durable nonces on Solana today?
A small, concentrated group: durable nonce transactions made up about 3% of Solana's traffic in a June measuring period but paid 30% of all priority fees, with just 555 accounts sending 97.5% of them, per researcher Max Resnick.
-
What replaces durable nonces for offline signing?
The proposal points to onchain programs that verify offline signatures, naming Anza's Programmatic Signer and Blueshift's Vector as options. The draft warns that a failed execution can leave an authorization usable, meaning a failed submission does not revoke the approval behind it.
WuBlockchain
WatcherGuru
Lookonchain
CryptoSlate
Crypto News