The plan to retire Solana’s durable nonces is still a proposal, not a scheduled shutdown. The Solana Foundation has not set a removal date, and durable nonces remain usable. Its October deprecation outline gives a roughly six-month migration window, but only if a replacement is ready, audited, and live on mainnet. The Foundation has not chosen between Anza’s Programmatic Signer and Blueshift’s Vector.
What changes for offline signing
Durable nonces solve a timing problem. They let a cold key approve a transaction using a stored nonce, so signing and broadcast can happen at different times. The replacement moves approval into onchain signer programs. Under Programmatic Signer, the cold key signs an authorization message, not the transaction sent to the network. A relayer puts that approval into a fresh-blockhash transaction. The signer program verifies it and executes the approved instructions. A program-derived address, or PDA, then acts as signer.
That PDA has no private key. Its authority comes from the signer program checking the original key’s approval. Deriving the address does not move coins or permissions. Operators must transfer native SOL, token balances, mint or freeze permissions, and stake authorities separately.
Custody and relayer limits
Programmatic Signer’s derived SOL account is System-owned and can send SOL through an approved ordinary transfer. Vector initializes a program-owned account and releases SOL through its own withdrawal or closing operation.
Programmatic Signer binds the executor, nonce account, and embedded execution message. A relayer cannot alter those authorized bytes while keeping valid signatures. It can choose the fee payer and blockhash and add instructions around the submission. Vector commits to the top-level instruction buffer, including data and accounts used to pass approved actions into other programs. Instructions around those actions must be included when the cold key signs.
A current durable-nonce transaction that passes validation but fails during execution still consumes its nonce. Programmatic Signer commits the nonce advance and application changes together, or rolls them back together. Vector documents the same retry ability. Without an enforced deadline, a failed submission may not invalidate the approval and can remain available later.
Vector warns a relayer could withhold a transaction, or a signature exposed by a failed attempt could execute later. A timeout in the signed instructions can reject execution after a deadline.
Applications and migration risks
Applications receive approved actions through cross-program invocation, or CPI. That can conflict with rules requiring a top-level instruction. Checks that inspect only top-level repayment or signature verification can miss nested actions. Token-2022’s CPI Guard adds limits: CPI transfers and burns need delegate authority, and CPI approvals are prohibited.
In March, Fireblocks supported nonce deprecation but objected to CPI migration and DeFi compatibility burdens. Unit 410 said a small signer program might work, but rejected moving assets to a hot signer. Programmatic Signer reports devnet deployment and audits in progress. Vector publishes code but does not state an audit or mainnet status.
