Solana Proposes New Signing System to Replace Durable Nonces

Replacing the durable nonce system

Solana is proposing a new way to handle offline transaction signing that would keep approvals valid even if a transaction fails. The plan would replace what are called durable nonces with program-based signers, changing which addresses control assets while letting cold wallet keys still authorize actions.

The Solana Foundation published an October deprecation plan pointing to onchain signer programs that verify an offline signature and then execute the approved instructions. A program-derived address, known as a PDA, would take control of affected accounts under the new system.

Durable nonces remain available for now. The Foundation has not set a removal date and has not made a final decision between two competing designs from Anza and Blueshift. The roughly six-month migration window depends on a replacement being ready, audited and live on mainnet.

How the proposed system works

Durable nonces solve a timing problem for offline signing. Instead of signing a transaction tied to a recent block hash that expires quickly, an offline signer can approve one using a stored nonce. That allows the approval and the actual broadcast to happen at different times.

Solana recently completed its 200ms slot upgrade on October 9, which doubles block production speed. Faster blocks leave less time for ordinary blockhash-based approvals, making the durable nonce system increasingly important for users who sign transactions offline.

Under the proposed Programmatic Signer design from Anza, the cold key signs an authorization message rather than the transaction itself. A relayer then places that approval in a fresh transaction. The signer program verifies the authorization and executes the approved instructions using the key's derived address as the signer.

The alternative Vector design from Blueshift works differently. It commits to the full instruction buffer including data and accounts before signing. A relayer cannot insert, remove or reorder instructions after the cold key signs without invalidating the approval.

What custody holders must do

The migration creates a new custody architecture. Operators using durable nonces must migrate relevant assets or permissions to the new system. Applications must accept actions arriving through a different program. Risk teams must approve the new signing path.

The migration guide describes moving native SOL into the derived address, transferring token balances into accounts controlled by it, and moving mint or freeze permissions to it. Stake accounts can move the staker authority, withdraw authority or both, depending on what is being migrated.

These are separate controls rather than one universal wallet switch. The Foundation proposes completing those handoffs while legacy durable nonces still work.

What is still unclear

The Solana Foundation has not chosen between the two candidate designs. It has not announced a firm date for removing durable nonces. The migration path for existing users depends on audits, tooling and application support that may not yet be complete.

Why this matters

For exchanges, custodians and treasury operators that rely on offline signing, the proposal changes how approvals flow from cold key to execution. Even though the cold key still authorizes actions, a separate online operator would submit them and pay network fees. Users of durable nonces will need to migrate their account controls and get internal approval for the new signing process.

Sources

• CryptoSlate