Solana’s core developers have put a date on the end of durable nonces, the transaction feature that let attackers sit on pre-signed approvals for more than a week before draining Drift in April. A draft proposal filed last Thursday, SIMD-0723, would make every Solana transaction carry a recent blockhash and says the change will not reach mainnet before May 5, 2027. The catch for custodians is that the programs meant to replace nonces keep the same basic property that hurt Drift: a signed message that stays valid until someone uses it.
What SIMD-0723 changes
The proposal on GitHub was opened on November 5 by Gabe Rodriguez of Anza, the developer of Solana’s main validator client. “After activation, every transaction needs a recent blockhash,” it says. A normal Solana transaction expires 150 blocks after its blockhash, about 30 seconds at today’s 200-millisecond slots. Durable nonces skip that clock by replacing the blockhash with a value stored in a nonce account, so a transaction signed today can still land weeks later.
Under the draft, the System Program would stop initializing, advancing and upgrading nonce accounts. Withdrawals from those accounts and changes to their authority would keep working. Any nonce transaction signed before the switch “can never become valid after it,” the document says.
There is one group of users who could lose money outright. A funded nonce account that is not initialized can only be emptied with a signature from the account’s own address once the change is live. If nobody holds that key, “the balance stays locked permanently. This proposal accepts that loss,” the draft says. A separate proposal, SIMD-0610, which bars nonce accounts from withdrawing to themselves, has to activate first so no new balances get trapped that way.
Bugs, not Drift, are the stated reason
The draft never mentions Drift. Its case rests on years of bugs in the special rules nonces need inside the validator. It lists a 2019 flaw that let failed nonce transactions be replayed to drain fees, a 2020 bug in the failure path, and a 2022 incident in which “a failed transaction was processed through both the blockhash and nonce paths, halting mainnet for about 4.5 hours.” It also cites several Firedancer fixes and two bugs found this year.
Spam is the other argument. In one epoch in June, nonce transactions made up 3.1% of Solana transactions but paid 30% of all priority fees, and 555 fee payers sent 97.5% of them, according to the Solana Foundation’s durable nonce deprecation page.
Why Drift still hangs over it
As AltcoinReporter reported in April, the attackers spent months building trust with Drift contributors. According to a BlockSec analysis, they got two of the five Security Council signers to pre-sign governance transactions through durable nonce accounts, held them, and on April 1 submitted them four slots apart to take admin control. Drift’s own April 16 recovery update puts the assets taken at about $295.7 million and says durable nonces will be disabled for all signers when the protocol relaunches.
Removing nonces does not remove that risk by itself. The replacements, Anza’s Programmatic Signer and Blueshift’s Vector, verify an offline signature inside an onchain program and then run the approved instructions. Neither has a built-in expiry. The Foundation’s page says a signed message “stays valid until it is used or cancelled, and whoever holds it can submit it later,” and tells wallet makers to warn users that they are signing a delayed transaction. The SIMD adds its own warning: “a failed execution can leave an authorization usable, so a failed submission is not a revocation.”
What changes is where the logic lives. Expiry and cancellation become program features, such as a deadline instruction, rather than rules every validator must get right. That helps the network. It does not stop a signer approving something they do not understand.
Two dates that do not match yet
The SIMD gives affected users “at least six months to migrate, counted from this proposal’s publication on 2026-11-05.” The Foundation’s page, published in October, still lists the mainnet date as “No date set” and ties removal to roughly six months after a replacement is ready. That replacement is not ready. The Programmatic Signer is on devnet, pre-audit, and Vector’s audit status is not stated. Institutions asked for 6 to 12 months after the replacement reaches mainnet, so May 5 is a floor, not a deadline.
The draft also has to clear review. A bot on the pull request says it needs approval from at least one Anza and one Firedancer team member before it can be merged. As of Monday it had a single review comment and no approvals.
Who has to act
The work falls on exchanges, custodians and stablecoin issuers that sign on air-gapped machines, plus teams whose programs reject calls that arrive through another program. Under the new design, authorities move to an address controlled by the signer program. Hardware wallet users have a narrower choice: the Programmatic Signer produces a standard Solana message, while Vector asks the device to sign a raw hash that most hardware wallets refuse.
Next to watch: approvals on the pull request, an audit of either replacement, and a mainnet deployment, which would start the Foundation’s six-month clock.
FAQ
Do ordinary Solana users need to do anything? No. Only workflows that submit a transaction after the roughly 30-second blockhash window are affected, mainly custodians and exchanges.
When would durable nonces stop working? Not before May 5, 2027 under the draft. The Solana Foundation’s plan ties the date to six months after a replacement program is ready, which could push it later.
Does the change stop attacks like the one on Drift? Not on its own. The replacement programs still let signed approvals wait until they are used or cancelled, so signers and wallets need their own checks and deadlines.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
