Understand why Solana wants to change offline signatures!
Can a transaction signed today move funds weeks later? On Solana, it can, as long as it uses a feature called a durable nonce and the authorization remains valid. A proposal to remove this mechanism drew attention this Monday.
Generally, a Solana transaction includes a reference to a recent block. This reference quickly becomes outdated, so there is little time between signing and submitting the transaction. The durable nonce replaces that reference with a value that can remain valid much longer. This gives custodians and exchanges more flexibility when they sign on machines disconnected from the internet or go through several approval steps before submitting a transaction.
In the attack on the Drift protocol in April, those responsible obtained pre-signed transactions and waited more than a week to execute them. The incident exposes a concrete risk. If an unauthorized approval remains valid, the gap between signing and submission gives an attacker time to choose when to act.
The draft proposes removing this mechanism from the network’s core functionality. Alternatives under discussion include programs that would verify offline-generated signatures on the blockchain. The proposal still needs approval, and says the mechanism could be removed from the mainnet no earlier than May 2027. The effective date also depends on whether services have enough time to migrate.
The quality of the alternative will become clear in the details. How long does an authorization remain valid? Who can cancel it? What happens if an execution attempt fails? In some models, a failed transaction can leave the authorization available for another attempt. For a custody desk, that difference determines whether the matter ends with the failure or whether the order still needs to be revoked. Solana’s challenge is to preserve offline signing while giving those who operate these systems clear control over authorization expiration and cancellation.
Can a transaction signed today move funds weeks later? On Solana, it can, as long as it uses a feature called a durable nonce and the authorization remains valid. A proposal to remove this mechanism drew attention this Monday.
Generally, a Solana transaction includes a reference to a recent block. This reference quickly becomes outdated, so there is little time between signing and submitting the transaction. The durable nonce replaces that reference with a value that can remain valid much longer. This gives custodians and exchanges more flexibility when they sign on machines disconnected from the internet or go through several approval steps before submitting a transaction.
In the attack on the Drift protocol in April, those responsible obtained pre-signed transactions and waited more than a week to execute them. The incident exposes a concrete risk. If an unauthorized approval remains valid, the gap between signing and submission gives an attacker time to choose when to act.
The draft proposes removing this mechanism from the network’s core functionality. Alternatives under discussion include programs that would verify offline-generated signatures on the blockchain. The proposal still needs approval, and says the mechanism could be removed from the mainnet no earlier than May 2027. The effective date also depends on whether services have enough time to migrate.
The quality of the alternative will become clear in the details. How long does an authorization remain valid? Who can cancel it? What happens if an execution attempt fails? In some models, a failed transaction can leave the authorization available for another attempt. For a custody desk, that difference determines whether the matter ends with the failure or whether the order still needs to be revoked. Solana’s challenge is to preserve offline signing while giving those who operate these systems clear control over authorization expiration and cancellation.