Solana Foundation Reviews Two Signing Programs to Replace Durable Nonce

Durable Nonce Replacement Under Review

Solana (SOL) has no shipped change behind this item yet: the Solana Foundation is reviewing a design that would retire the network's durable nonce feature and move offline transaction approval into a purpose-built signing program. The Solana price slipped 3.4% over the past 24 hours, the market backdrop the review lands in, but the engineering itself is proposal-stage. Durable nonce is the mechanism that lets a device approve a transaction while disconnected from the internet and broadcast it later, and exchanges and financial institutions that hold large digital asset reserves offline to cut hacking exposure lean on it for exactly that workflow. Under the proposed design, an asset manager approves a transfer offline, a separate online system relays the approval to the network, and a Solana program verifies the approval content and executes the transaction. The relaying system acts as courier only: it forwards what was signed and cannot rewrite it. Authority moves in the process: rather than a wallet directly managing assets, the new program holds the right to execute. Institutions would likely have to migrate assets and permissions tied to the old setup into the new system. The Foundation frames the work as a replacement rather than an add-on, with the durable nonce pathway phased out only after the new system passes security validation and runs on mainnet. Signing stays on the offline device; what changes is who delivers the approval to the network and which program enforces it. For routine consumer transfers the change is largely invisible. The constituency that feels it sits on the custody side: exchanges, qualified custodians and treasury desks whose signing infrastructure is built around pre-approved offline transactions. Nothing in the current proposal sets an activation date or names a final program, so node operators have no upgrade to schedule from this item alone.

The headline property of the redesign is that a pre-obtained approval survives a failed execution. If an institution approves a $1 million transfer offline and the broadcast fails on a network problem, the new flow lets it retry later on the strength of the original approval instead of reconnecting the offline device to sign again. That difference is the operational payoff, and it explains why the work matters more to custody desks than to retail spot trading activity. It also creates the security question the review has to settle: an approval that stays valid can execute later than its owner intended, so a canceled transfer plan can still go through if the approval remains live. An approval can reach the network well after the moment it was signed, which is what makes lifespan controls a design-level requirement. Expiry windows and revocation paths for unused approvals therefore carry real weight in the design. Two candidate programs are under evaluation, Programmatic Signer and Vector. Both are built so that an online operator cannot arbitrarily alter the content of an offline approval; they differ in how much additional instruction they allow during execution. The Foundation has not chosen between them, and security validation plus mainnet integration must complete before the legacy durable nonce pathway is retired in stages. The blast radius concentrates on the institutional side: exchange hot-and-cold workflows, custody stacks, and the wallet layer above them, from consumer categories such as the AI crypto wallet segment to dedicated custody systems, would need to support the new program. User-facing standards such as Solana Blinks and Actions sit elsewhere in the stack and are untouched by this review, and institutions that pair cold storage with delegated staking would face the same migration question, since their pre-signed authority covers more than plain transfers.

Validation Still Stands Before Activation

Our reading: this is a custody-infrastructure story, not a throughput story, and it should be treated as review-stage until the Foundation publishes final security validation and an activation path. Flow data, not protocol design, is steering the near-term tape: Bitwise's BSOL led $24.8 million in weekly outflows from Solana ETFs, and the calendar still carries a demand-side item in Hong Kong's second spot Solana ETF, which Pando Finance lists on Tuesday, October 13. Levels are mapped in our Solana technical analysis coverage. What runs on mainnet now that did not run before is separate work: Anza's final SIMD-0525 upgrade has block times down to 200 milliseconds, while the signing-program replacement waits behind validation, not ahead of it.