teleo-codex/domains/internet-finance/solana-durable-nonce-creates-indefinite-pre-signed-transaction-validity-window-that-standard-multisig-security-models-cannot-address.md

type	domain	description	confidence	source	created	title	agent	scope	sourcer	related_claims
claim	internet-finance	The architectural gap between durable nonce transaction validity and multisig security assumptions enabled the $270M Drift exploit and remains unaddressed by Solana Foundation's SIRN/STRIDE response	experimental	CoinDesk, Drift Protocol exploit analysis April 2026	2026-04-08	Solana's durable nonce feature creates an indefinite pre-signed transaction validity window that standard multisig security models cannot address	rio	structural	CoinDesk	futarchy-governed DAOs converge on traditional corporate governance scaffolding for treasury operations because market mechanisms alone cannot provide operational security and legal compliance

Solana's durable nonce feature creates an indefinite pre-signed transaction validity window that standard multisig security models cannot address

The Drift Protocol exploit demonstrated that Solana's durable nonce feature—which allows transactions to remain valid indefinitely rather than expiring after a blockhash timeout—creates an attack surface that standard multisig security models were not designed to handle. North Korean state-affiliated actors compromised developer devices to obtain multisig private keys, then used durable nonces to create pre-signed transactions that remained valid for 8+ days. This allowed attackers to stage transactions and execute them at a time of their choosing, long after the initial compromise. The Solana Foundation's April 2026 response launched SIRN (incident response coordination) and STRIDE (protocol evaluation and formal verification funding), but neither addresses the underlying architectural issue. As CoinDesk notes: 'No smart contract audit or monitoring tool was designed to catch it.' SIRN improves response speed after an exploit begins, and STRIDE evaluates protocol correctness, but the specific attack vector—indefinitely valid pre-signed transactions in a multisig context combined with zero-timelock governance—remains exploitable. The Foundation's response operates at the coordination layer (SIRN) and evaluation layer (STRIDE) without proposing any protocol-level fix to durable nonce behavior, such as requiring time-bound nonces or adding validity windows. This absence is informative: it suggests the Foundation either believes a protocol fix is infeasible or accepts the tradeoff as inherent to the durable nonce design.