Solana developers have proposed retiring durable nonces, the transaction feature attackers used to steal at least $270 million from Drift in April. The draft would not take effect before May 5, 2027, and custodians that sign offline would need to switch to alternatives that carry their own risks.
Solana developers want to retire a feature that lets a signed transaction sit unsent for weeks, the mechanism attackers relied on to drain at least $270 million from trading protocol Drift in April.
A normal Solana transaction carries a blockhash stamp that makes it expire after about 30 seconds. A durable nonce swaps that stamp for one that never goes stale, so a transaction signed today can still go through next month. Custodians and exchanges need that delay because their approvals happen on air-gapped machines, where getting a signature to the network can take longer than 30 seconds.
How the Drift attackers used the feature
The same delay suited the Drift attackers. They got approvals signed in advance and let those transactions sit for more than a week before using them to empty the platform on April 1. Drift later blamed the attack on a North Korean state-affiliated group.
The proposal, SIMD-0723, was filed Nov. 5 by Gabe Rodriguez of Anza, the firm behind Solana's main validator software. It does not mention Drift. Instead, it builds its case on years of bugs, including a 2022 incident in which a failed transaction halted mainnet for about 4.5 hours.
Who would feel the change
The draft says "After activation, every transaction needs a recent blockhash," according to the proposal as quoted by CoinDesk. It says the feature will not be activated on mainnet-beta before 2027-05-05. The Solana Foundation's deprecation page starts the six-month clock only once a replacement is ready, which could push the cutoff later.
A small group would feel most of the change. Durable nonce transactions made up about 3% of Solana's traffic in one June measuring period but paid 30% of all priority fees, and just 555 accounts sent 97.5% of them, according to researcher Max Resnick. His post does not say who runs those accounts.
Custodians and exchanges would move to an onchain program that checks an offline signature, with Anza's Programmatic Signer and Blueshift's Vector named as options. However, the draft warns that a failed execution can leave an authorization usable, so a failed submission is not a revocation. The proposal still needs sign-off from at least one engineer at Anza and one at Firedancer before it can be merged.
Source: CoinDesk
Trading involves risk.
Risk Disclaimer
