The Solana Foundation has announced an October plan to deprecate durable nonces, proposing a transition toward onchain signer programs to handle offline transaction signing for exchanges, custodians, and treasury managers.
Moving From Durable Nonces to Onchain Signer Programs
Durable nonces have traditionally resolved time-sensitivity issues on Solana by allowing cold keys to authorize transactions without relying on short-lived recent blockhashes. Following the final mainnet rollout of Solana's 200ms slot upgrade on Oct. 9, faster block times have further compressed the window for standard blockhash approvals. Under the deprecation plan, offline signatures will instead be verified by onchain signer programs utilizing Program-Derived Addresses (PDAs) that control affected accounts without holding private keys.
To migrate to the new architecture, operators must manually transfer native SOL, token balances, mint or freeze permissions, and stake authorities to the derived addresses. The Solana Foundation has outlined a conditional six-month migration window once a chosen replacement is audited and deployed to mainnet, though legacy durable nonces will remain active during the transition.
Comparing Programmatic Signer and Vector Candidates
The two primary replacement proposals under consideration are Anza's Programmatic Signer and Blueshift's Vector. Under Anza's Programmatic Signer, a cold key signs an authorization message that a relayer places into a fresh-blockhash transaction. Surrounding instructions can be appended outside the authorization by the relayer, and native SOL accounts remain System-owned.
Conversely, Blueshift's Vector requires the cold key to sign a committed top-level instruction buffer, preventing relayers from modifying surrounding instructions. Vector initializes program-owned accounts and stores replay state directly within the Vector account itself.
Unlike legacy durable nonces, which consume the nonce even if execution fails, both new proposals roll back state changes alongside nonce advances upon failure. This leaves signatures valid for retry, though Vector explicitly warns that relayers could withhold exposed signatures until market conditions change unless time-bound deadline parameters are attached.
Key Takeaways
- The Solana Foundation announced a planned deprecation of durable nonces with a conditional six-month migration window.
- Two candidate designs are under evaluation: Anza's Programmatic Signer and Blueshift's Vector.
- Migration requires individual handoffs of SOL, token balances, mint or freeze permissions, and stake authorities to PDAs.
- Failed execution attempts roll back nonce advances, leaving approvals retryable but requiring timeout constraints to prevent withholding by relayers.
Why It Matters
This architectural pivot fundamentally alters custody risk management across the ecosystem. While execution rollbacks prevent lost approvals during network congestion, retrievable signatures create potential exploit vectors if relayers strategically delay transaction broadcasts. Treasury operators and institutional custodians—who are closely navigating changing market dynamics alongside Solana ETF fund flows—must update their permission structures and transaction-signing infrastructure before legacy durable nonces are sunset.
