The Solana Foundation plans to retire durable nonces and replace them with onchain signer programs. Both candidate designs can leave a failed approval executable later, which makes deadlines and nonce revocation material custody controls. Durable nonces still work, and no removal date is set.
The Solana Foundation's plan to retire durable nonces would keep cold-key approval but change which addresses control the affected assets. Durable nonces let users sign transactions offline and broadcast them later. For exchanges, custodians and treasury operators who rely on that method, the replacement adds a program between the cold key's approval and execution.
Durable nonces remain usable. The Foundation has not set a removal date or chosen between Anza's Programmatic Signer and Blueshift's Vector, and its roughly six-month migration window depends on a replacement being ready, audited and live on mainnet.
The key keeps approving, but the account changes
Under the proposal, a program-derived address, or PDA, would control the affected accounts. The original key would still authorize actions, while a separate online operator submits them and pays the network fee. Deriving the address does not move any assets or permissions, so operators must transfer those separately.
The migration guide describes moving native SOL into the derived address, transferring token balances and moving mint or freeze permissions. Stake accounts can move the staker authority, the withdraw authority or both. As a result, a treasury's account inventory determines what must change, and approving new signing software is only part of the job.
Failed approvals can stay executable
The two designs differ in what a cold signature covers. Programmatic Signer's message documentation says the cold signatures bind the executor, nonce account and embedded execution message, while a relayer can still choose the outer fee payer and blockhash. Vector commits to the top-level instruction buffer, so surrounding instructions must be included before signing.
Both designs share a risk. A failed execution attempt can leave a cold approval executable later, and without an enforced deadline it can remain available while its nonce is unchanged. Vector explicitly warns that a relayer could withhold a transaction until conditions change. A timeout included in the signed instructions can reject execution after a deadline, but revocation requires a separately authorized nonce advance to land.
Applications and audits still stand in the way
Applications would receive approved actions through cross-program invocation, which can conflict with rules that an action must arrive as a top-level instruction. The Foundation suggests supporting known signer programs or offering another execution path.
Institutional concerns surfaced in the March 4 discussion, where a participant identifying himself as Michael from Fireblocks supported nonce deprecation but objected to CPI Passthrough's migration, contract dependence and DeFi compatibility burdens.
Programmatic Signer's documentation reports devnet deployment and audits in progress, with remediation required before its v1 release and any mainnet deployment. Vector's README does not state an audit or mainnet deployment status.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
