Solana plans to remove durable nonces, with no date set
The Solana Foundation plans to remove durable nonces from the protocol. Onchain programs that check an offline signature are the replacement. The guide sets no calendar date. Ordinary wallet users need do nothing.
In October 2026 the Solana Foundation describes a plan to remove durable nonces from the protocol. A normal transaction expires 150 blocks after its blockhash. At 200 ms slots that is about 30 seconds, down from about 60 seconds at 400 ms. A durable nonce swaps the blockhash for a stored value, so the transaction does not expire.
Exchanges, custodians, and stablecoin issuers use them when signing happens offline or an approval takes longer than that window.
Durable nonces and the replacement
The replacement is an onchain program that checks an offline signature. The Foundation calls the design CPI Passthrough. The cold key signs a message that lists the instructions. A hot fee payer wraps it in a normal transaction with a fresh blockhash. The program checks the signature, consumes its own nonce, and runs the instructions via CPI. The signer is a PDA.
Two implementations are in progress. Anza’s Programmatic Signer is on Devnet, pre-audit. Audits come before v1. Interfaces may change. Blueshift’s Vector has published program IDs.
The programs need no feature gate and no validator change. Removing durable nonces needs a feature gate, in a regular client release. Validator operators have nothing to configure for that. Anza’s vote-account guide still recommends durable nonces for handing over the authorized voter or withdrawer. That flow is meant to move to an offline signer program.
Indexers that attribute a transaction to its signer have to change. The cold key no longer signs. The relayer is the fee payer and the outer signer. The account that acts is the signer PDA inside inner instructions. For the Programmatic Signer, the PDA is derived with the seeds “programmatic-signer” and the authority.
Who has to act
Only durable-nonce users have to act. Wallets and apps keep working for normal transactions. Anyone who signs before the blockhash expires has nothing to change. If a custodian uses durable nonces, that custodian handles the migration.
Teams that use durable nonces for approvals, treasury moves, or high-frequency sending have to change the process once nonces are removed. The Foundation says to test on Devnet now. The Foundation calls the programs pre-audit. The flow can already be built. Once they are on mainnet, authorities and balances should move to a signer PDA while durable nonces still work. A hot fee payer covers fees and only needs SOL for them. The Foundation names a paymaster such as Kora as one way to do that.
Wallets that offer signing on an air-gapped device need a new path for it. The signed message has no blockhash. It stays valid until it is used or cancelled. Whoever holds it can submit it later.
Programs that accept only top-level instructions lock these users out. So do a stack-height check and Token-2022 CPI Guard. The Foundation describes that as a result of the instructions arriving via CPI, signed by a PDA.
Timeline and the reasons
Removal is expected roughly six months after the replacement is ready. The page sets no calendar date. The Foundation will add the date once it is set. The page says institutions asked for 6 to 12 months after mainnet availability. Core developers have confirmed that durable nonces stay until a suitable replacement is available and there has been ample time to migrate.
On 12 October, Jonas Hahn, whose profile says he is DevRel at the Solana Foundation, pointed to the guide on X. He writes that deprecation comes next year. The guide his post links to still says roughly six months after the replacement is ready.
The page gives four reasons. Special cases in the validator have been where replay bugs showed up. The Foundation cites outages, emergency patches, and bug-bounty payouts. Asynchronous execution breaks on the nonce. If the transaction fails, the nonce stays put, and the same signature can land again. In one epoch in June 2026, nonce transactions were 3.1% of transactions and 30% of all priority fees. 555 fee payers sent 97.5% of them. The page points to SIMD Discussion #564 for that count. An expired blockhash fails a cheap lookup. A nonce check depends on the nonce account’s data, so it travels further down the pipeline.
What to watch
- A calendar date for removal
- Which program becomes the mainnet replacement
- Vector’s cluster, and its audit status
- Whether the interfaces change again before v1
Sources
- Solana Foundation — Durable Nonce Deprecation, October 2026
- Jonas Hahn — Post, 12 October 2026, 10:18 a.m. Berlin, profile: DevRel at Solana Foundation. Solana Developers reposted the same post the same day: solana_devs