Durable Nonce

Overview

Solana transactions normally include a recent blockhash so old signed transactions cannot be replayed indefinitely. That blockhash expires after a limited period. A durable nonce replaces the short-lived value with one stored in a nonce account.

The nonce account has an authority that can advance or withdraw it. To use the nonce, the transaction references the stored value and places the nonce-advance instruction first. When the transaction succeeds, the account receives a new nonce value, preventing reuse of the old signed transaction.

This design supports workflows where signatures are collected slowly or on offline devices. A treasury can prepare a transaction, gather approvals, and submit it later without rebuilding it every time the recent blockhash expires.

Operational risks include concurrent use and account control. Two transactions built from the same nonce compete, and only the one that advances it successfully can remain valid. If the nonce authority is compromised, an attacker can disrupt or misuse the workflow. Systems should store the nonce account, expected nonce value, authority, and transaction intent together.

Durable nonce transactions still need fees, valid signatures, and correct account state. The mechanism extends validity; it does not guarantee execution or finality.

Nonce-account lifecycle matters after use. The authority can advance the nonce without submitting the originally planned transaction, invalidating previously signed payloads. This can serve as a cancellation mechanism but must be coordinated with all signers. Applications should also distinguish durable-nonce accounts from ordinary account nonces used on other chains. The shared word “nonce” does not imply the same data structure or transaction-ordering behavior.