Solana Draft SIMD-0723 Would Retire Durable Nonces After May 2027
Anza's draft SIMD-0723 would kill durable nonces no earlier than May 5, 2027. Replacements like Programmatic Signer are still on Devnet, and Fireblocks says institutional migration needs at least 12 months.
A new Solana improvement proposal would remove durable nonces no earlier than May 5, 2027, a feature tied to the April 1 attack on Drift. SIMD-0723, filed Nov. 5 by Anza developer Gabe R., remains a draft, unmerged and not yet accepted.
Merging requires sign-off from at least one Anza team member and one Firedancer team member. May 5 is an earliest date, not a scheduled shutdown. The draft counts a six-month migration window from publication. The Solana Foundation's October guidance describes removal about six months after a replacement program is ready and lists no activation date.
What changes for signers
Durable nonces keep a signed transaction valid past the normal expiration window, as long as the stored nonce value is unchanged. Custodians and exchanges use them for offline or air-gapped signing.
Under the draft, that goes away. In the draft's words:
"After activation, every transaction needs a recent blockhash"
SIMD-0723 draft, authored by Gabe Rodriguez of Anza
Previously signed durable-nonce transactions would stop working after activation. Creating, advancing and upgrading nonce accounts would be disabled, while withdrawals and authority changes stay available. The stated rationale is repeated validator security and consensus bugs, plus nonce-related spam. The proposal itself does not mention Drift.
The replacement and its gaps
The draft names Anza's Programmatic Signer and Blueshift's Vector as replacements. Authorities and funds move to PDAs (program derived addresses). A cold key signs an authorization offline, and an online relayer submits it in a fresh transaction.
Programmatic Signer's documentation says it is on Devnet, with audits and remediation required before a first mainnet deployment.
The draft also flags a new risk: "a failed submission is not a revocation." An authorization can stay usable after execution fails, unlike a durable-nonce transaction, whose nonce is consumed on failure.
The Drift link
Drift said attackers combined pre-signed durable nonce transactions with compromised multisig approvals, likely via social engineering or transaction misrepresentation. Two pre-signed transactions transferred admin control. Drift described the mechanism as "allowing delayed execution."
Drift's April 16 accounting put the theft at about $295.7 million, the most specific figure available. Other estimates run from at least $270 million up to $285 million. A token-based recovery plan followed, and Drift has resumed operations under the name Velocity.
Migration is the sticking point
Institutions are the likeliest friction. Michael Gutkin of Fireblocks wrote in a March discussion post that the firm manages signing infrastructure across millions of Solana addresses. He supported removal but said a replacement requiring full account migration without a compatibility bridge would take at least 12 months at institutional scale.
That is double the draft's six-month window. Add a replacement still sitting on Devnet, and the May 2027 floor looks tight. The transition could also discourage some usage while institutions adjust.
For now, nothing changes on mainnet. The draft still needs its Anza and Firedancer approvals, and the Foundation's own guidance pegs removal to a ready replacement, not a calendar date.
