Solana’s plan to retire durable nonces remains a proposal, not a scheduled shutdown. The Solana Foundation has not set a removal date, and durable nonces remain usable. Its October deprecation outline describes a roughly six-month migration window, but only if a replacement is ready, audited, and live on mainnet. The Foundation has not yet chosen between Anza’s Programmatic Signer and Blueshift’s Vector.
Durable nonces solve a timing problem by allowing a cold key to approve a transaction with a stored nonce, so signing and broadcasting can happen at different times. The proposed replacement moves approval into onchain signer programs. Under Programmatic Signer, the cold key signs an authorization message rather than the transaction sent to the network. A relayer places that approval into a fresh-blockhash transaction, the signer program verifies it, and a program-derived address, or PDA, acts as signer. The PDA has no private key; its authority comes from the signer program checking the original key’s approval.
Operators would need to migrate custody separately: moving native SOL into the derived address, transferring token balances into accounts controlled by it, and moving mint or freeze permissions. Stake accounts can move staker authority, withdraw authority, or both. The two candidate designs differ in several ways. Programmatic Signer’s derived SOL account is System-owned and can send SOL through an approved ordinary transfer, while Vector initializes a program-owned account and releases SOL through its own authorized withdrawal or closing operation. Programmatic Signer binds the executor, nonce account, and embedded execution message, but a relayer may choose the fee payer and blockhash and add instructions around the submission. Vector commits to the top-level instruction buffer, so surrounding instructions must already be included when the cold key signs.
Retryability is a central custody consideration. A current durable-nonce transaction that passes validation but fails during execution still consumes its nonce. Both replacement designs commit the nonce advance and application changes together, or roll them back together. That means a failed execution attempt can leave a cold approval executable later unless a timeout is included in the signed instructions. Vector explicitly warns that a relayer could withhold a transaction until conditions change, or that a signature exposed by a failed attempt could execute later. Revocation requires a separately authorized nonce advance to land.
Applications would receive approved actions through cross-program invocation, or CPI, which can conflict with rules requiring a top-level instruction. Token-2022’s CPI Guard adds restrictions: CPI transfers and burns require delegate authority, and CPI approvals are prohibited. In March, a Fireblocks participant supported nonce deprecation but objected to CPI migration, contract dependence, and DeFi compatibility burdens. Unit 410 said a small auditable signer program might make authority migration acceptable, while rejecting any workaround that temporarily moves assets to a hot signer.
Programmatic Signer currently reports devnet deployment and audits in progress, with remediation required before v1 or mainnet deployment. Vector publishes implementation code and program IDs but does not state an audit or mainnet status. Fireblocks’ current protocol onboarding kit still describes automatic durable-nonce injection for selected WalletConnect integrations, including Jupiter and Kamino, with a default provider-managed 15-minute validity window. Solana’s separate 200ms slot upgrade reached its final mainnet stage on Oct. 9, leaving less wall-clock time for ordinary blockhash-based approvals.
