0xMowgli.

/ Writing · · 7 min read

Solana durable nonces are being removed: how offline signing works next

By Oussama Allamou · Solana · Durable Nonce · Offline Signing · Wallets

Durable nonces let a Solana transaction skip the normal 150-block expiry by using a stored value instead of a recent blockhash. The Solana Foundation published a plan in October 2026 to remove them from the runtime. Offline signing moves into on-chain signer programs: the cold key signs a message with no blockhash, any hot fee payer submits it later, and the program verifies the signature and acts for the key through a PDA. Nothing breaks yet. Removal is planned about six months after a replacement is ready, and no date is set.

This post follows the Solana Foundation's deprecation page. Here is how a transaction gets signed offline once nonces are gone.

COLD KEYFEE PAYERSIGNERPROGRAMsigned messageNO BLOCKHASHDAYS LATERtx + fresh blockhashVERIFYADVANCE NONCECPI · PDA SIGNSsame messageREJECTEDTHE PDA, NOT THE COLD KEY, HOLDS THE FUNDS
Explainer · Offline signing without a durable nonce
  1. Step 01The cold key signs a message

    Offline, the cold key signs a message that lists the instructions to run. There is no blockhash in it, so it does not expire.

  2. Step 02Time passes

    Minutes, days or weeks. The signed message can be carried anywhere, because nothing in it ages.

  3. Step 03A hot fee payer sends it

    A hot wallet that only holds SOL for fees wraps the message in an ordinary transaction with a fresh blockhash and sends it.

  4. Step 04The program checks and advances its nonce

    The signer program verifies the cold key's signature and moves its own nonce forward, so this message can never run again.

  5. Step 05It acts for the cold key

    The program runs the listed instructions through CPI, signing as a PDA derived from the cold key. That PDA, not the cold key, owns the funds and authorities.

  6. Step 06A replay is rejected

    Sending the same signed message again fails: the nonce it was signed for is used. Signing a new advance with nothing else in it cancels a message you no longer want.

What is a durable nonce on Solana?

A normal transaction includes a recent blockhash and expires 150 blocks later. That was about a minute when slots were 400 ms. At today's 200 ms target it is about 30 seconds, and closer to 33 with the 218 ms the chain really averages. A durable nonce replaces the blockhash with a value stored in a nonce account, so the transaction does not expire until the nonce is advanced.

That is what exchanges, custodians, stablecoin issuers and treasury teams use for air-gapped signing and approvals that take hours.

Recent blockhash · 150 blocks
Expired
Durable nonce · Being removed
Lands
Signer program · Until used or cancelled
Lands
Try it · Sign now, send later45 s
Sent 45 s after signing

The blockhash ran out after about 33 seconds. A durable nonce still lands today, but it is being removed. A signer program message has no built-in expiry.

150 blocks was a minute at 400 ms slots. At the 200 ms target it is 30 seconds, and with the 218 ms the chain really averages, about 33. A hardware wallet prompt or a second approver takes longer than that.

Why is Solana removing durable nonces?

The deprecation page gives four reasons:

  1. Security bugs. The special rules for nonce transactions in the runtime have caused outages, emergency patches and bug bounty payouts.
  2. They block asynchronous execution. A nonce transaction can land twice because its nonce does not advance in some cases, which breaks the assumption that a signature is unique.
  3. Spam. In one epoch in June 2026, nonce transactions were 3.1% of transactions but 30% of priority fees, and 555 fee payers sent 97.5% of them.
  4. Expensive filtering. Whether a nonce is valid depends on account data, so a bad nonce transaction is rejected later in the pipeline than a bad blockhash.

Share of transactions

Nonce
3.1%
Other
96.9%

Share of priority fees

Nonce
30%
Other
70%

Nonce transactions Everything else

Explainer · Durable nonce transactions in one June 2026 epoch
  1. Case 01Share of transactions

    Nonce transactions were 3.1% of all transactions in the epoch. Figure from the Solana Foundation's deprecation page, citing SIMD Discussion 564.

  2. Case 02Share of priority fees

    The same transactions paid 30% of all priority fees, and 555 fee payers sent 97.5% of them. Same source.

How does offline signing work without a durable nonce?

The design chosen in SIMD Discussion 456 is called CPI passthrough. It needs no runtime change, which is why it can exist before nonces are removed:

  1. The cold key signs a message that lists the instructions to run. It has no blockhash, so it does not expire.
  2. A hot fee payer that only holds SOL for fees sends it inside an ordinary transaction with a fresh blockhash.
  3. The signer program verifies the signature, advances its own nonce, and runs the instructions through CPI with a PDA as the signer.

Neither design has a built-in expiry. A signed message stays valid until it is used or cancelled, and you can add a deadline instruction if you want one.

Programmatic Signer (Anza)Vector (Blueshift)
What is signedA standard v1 messageA SHA-256 hash of the instruction list
Relayer can add instructionsAround the submit, not inside itNo
Stack height of your program32
Key typesEd25519, more by new programsEd25519, secp256k1, EIP-191, Falcon-512
PDA seedsprogrammatic-signer + authorityvector + identity
LicenseApache-2.0MIT

Programmatic Signer signs a v1 transaction message, so wallets and tools that build it may need the 4,096-byte format. Its devnet example used 54,007 compute units. Vector lists about 14,000 compute units to advance with Ed25519.

Who is affected?

  • People who sign and send at once: no change.
  • Durable nonce users, such as custodians, exchanges, issuers, bots and treasury operations: breaking once nonces are removed.
  • Wallets and offline signing tools: need to decode the new payloads and warn users about delayed transactions.
  • Program developers: not breaking, but your program can lock signer programs out, see below.
  • Relayers, paymasters and guards: must drop nonce-specific rules and allow the new program ids.
  • Indexers and explorers: the cold key no longer signs the transaction. The acting account is a PDA inside inner instructions.
  • RPC providers: the nonce fallback in getFeeForMessage goes away.
  • Validator operators: the vote authority transfer flow that relies on a durable nonce should move to a signer program.

What should I do now?

For durable nonce users, the deprecation page lists four steps:

  1. List every account authorized through a durable nonce: wallets, stake accounts, token accounts and mints.
  2. Derive the signer PDA for each cold key. Programmatic Signer needs no setup; Vector needs an Initialize.
  3. Move authorities and funds to the PDA while durable nonces still work. Reassign stake and mint authorities, create PDA-owned token accounts and transfer, and send SOL to the PDA.
  4. Run a hot fee payer that only holds SOL for fees, and rotate fee payers so your wallets are not linked together.

Test on devnet first. Both programs are pre-audit and their interfaces may change.

For program developers, check three patterns that block a call arriving through CPI:

  • Stack height checks that require your instruction to be top level.
  • Instruction introspection that only looks at top-level instructions, as flash loan repayment checks and signature verification often do.
  • Token-2022 CPI Guard, which blocks actions that arrive through CPI.

And remove any code that looks for AdvanceNonceAccount as the first instruction. It will stop matching anything.

What do the terms mean?

  • Recent blockhash: the hash a transaction includes to prove it is fresh. It expires 150 blocks later.
  • Durable nonce: a value stored in a nonce account that a transaction uses instead of a recent blockhash, so it does not expire.
  • Cold key: a signing key kept offline.
  • Fee payer: the account that signs for and pays the transaction fee. In the new flow it is a separate hot wallet.
  • PDA: a program derived address. An account address with no private key that a program can sign for.
  • CPI: cross-program invocation, one program calling another.

FAQ

Are Solana durable nonces deprecated?

Yes. The Solana Foundation published a deprecation plan in October 2026. They keep working until a replacement is ready and a migration period has passed, about six months, and no removal date is set yet.

How long is a Solana transaction valid without a durable nonce?

150 blocks after its recent blockhash. That is about 30 seconds at the 200 ms slot target, and about 33 seconds at the 218 ms the chain averaged in October 2026.

What replaces durable nonces for offline signing?

An on-chain signer program. The cold key signs a message with no blockhash, a hot fee payer submits it later in a normal transaction, and the program verifies the signature and runs the instructions as a PDA. Anza's Programmatic Signer and Blueshift's Vector both work this way.

Do I need to move my funds?

If they are controlled through a durable nonce, yes, eventually. In the new design a PDA derived from the cold key holds funds and authorities. Move them while durable nonces still work.

Will my program work with signer programs?

Only if it accepts calls that arrive through CPI. Top-level stack height checks, introspection of top-level instructions only, and the Token-2022 CPI Guard all block it.

Further reading