Gabe Rodriguez of Anza, a core developer of Solana’s validator software, filed a Solana Improvement Document (SIMD), the network’s formal process for protocol changes, on Nov. 5 that would retire durable nonces. A durable nonce is a stored value in a dedicated account that stands in for a recent blockhash, the short-lived reference to a recent block that every Solana transaction normally carries. It lets a transaction be signed now and sent much later.
Under SIMD-0723, “every transaction needs a recent blockhash” once the change activates. That reference goes stale after 150 blocks, and the transaction can no longer land. The instructions in Solana’s built-in System Program that initialize, advance and upgrade nonce accounts would be switched off; the two that let owners pull funds out or reassign control would keep working. Existing accounts would not be touched.
A Nov. 6 commit added the timeline: the migration window is at least six months, measured from the Nov. 5 filing, and the draft says the feature “will not be activated on mainnet-beta before 2027-05-05,” mainnet-beta being Solana’s main network. The proposal’s status is still Draft, and the pull request has no approvals. A bot on the repository lists what it needs to merge: one approval from an Anza team member and one from Jump Crypto’s Firedancer team, which builds a separate validator client.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
Who Has to Rebuild
The draft says anyone who signs a transaction now but broadcasts it after the 150-block expiry will have to rework that process, and it singles out custodians and exchanges whose approvals on air-gapped machines, kept off the internet, can outlast that window. In January, a participant in the originating discussion listed the keys that control USDC and USDT issuance, known as mint authorities, among the feature’s notable users. Michael Gutkin of Fireblocks, which he described as “managing millions of Solana wallets,” wrote in March that “durable nonce deprecation seems like the right direction.” He added that if accounts had to be migrated with no compatibility bridge, such as one wrapping transactions signed in advance, “12 months is the minimum we believe is feasible at institutional scale.” SIMD-0723 rejects that wrapping approach and allows at least six months.
The proposal points to two replacements: Anza’s Programmatic Signer and Blueshift’s Vector. In both, an owner hands its authority to a program-derived address (PDA), an account controlled by a program instead of a private key, signs approvals offline and passes them to a third party, or relayer, and the program checks each signature onchain before running the instructions. Rodriguez, the draft’s author, has made 136 commits to the Programmatic Signer repository as of Nov. 9, more than any other contributor, according to its GitHub contributor data. The draft warns that “a failed submission is not a revocation.”
The Case Against Nonces
The SIMD cites a run of bugs, including a 2022 incident in which validators ran one failed transaction down both the standard blockhash route and the nonce route, which stalled mainnet for roughly 4.5 hours. Max Resnick posted data in June showing nonce transactions were about 3.1% of transactions in one epoch, a fixed stretch of Solana blocks, but about 30% of priority fees, the optional tips that speed up processing. By his count, 555 of the 103,672 accounts paying fees on nonce transactions accounted for 97.5% of them.
The SIMD does not mention Drift. The perpetual futures exchange, which lost about $295.7 million on April 1 by its own accounting, later called the durable-nonce attack surface “central to how the April 1 exploit was executed” in its recovery plan. Unchained covered the suspected North Korean link and Drift’s recovery token claims.
Unchained’s Read
The six-month clock runs from the draft’s publication, not from the replacements’ readiness, and the Programmatic Signer repository still read “under construction” on Nov. 9. Custodians would be planning that migration alongside other recent core changes, such as the Alpenglow consensus switch and the larger 4,096-byte transaction cap.
Related Listen: How DPRK Drained $28550M from Drift — and Got Into Your Device First
