durable-nonce-exploitation

Solana Durable-Nonce Exploitation Audit

Audit a Solana governance, multisig, or administrative approval workflow for a narrow time-shift primitive: an unprivileged actor causes the required authorities to sign the actor's exact durable-nonce transaction without reliably seeing its true intent, then holds that still-valid authorization until a later first submission reaches an unauthorized state or funds terminus.

Durable validity is not itself a vulnerability. A transaction that was signed, never submitted, and later lands is normal protocol behavior; do not call it replay. Successful first execution consumes the nonce value, so repeated submission of the same transaction is not the primitive.

Impact class: privileged/control-plane takeover, unauthorized state transition, or funds moved without the attacker's prior privilege. Governing method: Phase-3a hypothesis lane of systematic-attacking; keep the result as a lead until the verification spine promotes it. Any live-target signing or submission is operator-gated.

Precondition gate

Before building a delayed-submission harness, prove all of these on the target workflow:

1. Start from an unprivileged actor. Identify the real proposer, coordinator, UI, encoder, or message replacement path by which that actor can choose or alter the exact serialized transaction that authorities sign.
2. Enumerate every required signature, including the durable-nonce authority and each authority for the terminal instruction. Show how the ordinary target workflow yields those signatures over the attacker-selected message without stolen credentials, compromised keys, privileged collusion, or a signer deliberately authorizing the disclosed action.
3. Bind the display to the signed bytes. Record what each signer sees and prove the approval surface can misdescribe, omit, or fail to authenticate a security-relevant instruction in the exact message. An opaque signature alone is not proof that an attacker can obtain it.
4. Show that the actor can retain and submit the fully signed transaction while its recorded nonce value remains current. Control of a nonce account alone is insufficient unless it establishes the required signature or submission precondition.