Programmatic Signer

Solana transactions must be processed before their recent blockhash expires. This makes it difficult for offline signing or collecting several approvals which often take longer than that window.

Programmatic Signer exists to address this using program verified, long-lived authorizations:

• An authority signs an authorization message off chain
• A relayer flexibly submits it later and pays the fee
• The ed25519 signature is verified in program and the authority's PDA is granted signer privilege
• A nonce is advanced to prevent replays
• The approved instructions are invoked via CPI

This works because the authority never signs a transaction. It signs a message that the program checks, so nothing expires with a blockhash. The program then acts through a PDA derived from the authority's key. That PDA holds the funds and serves as the authority for token, stake, and other accounts.

This offers an alternative to Durable Nonces, whose deprecation and removal are planned through SIMD-XXXX (forthcoming).

Deployments

Currently deployed to Devnet from commit 5eb7ed9.

Use cases

• Make payments from a treasury whose approval key never goes online. An operator submits them and pays the fees.
• Settle a trade between two parties who approve on different days. Both transfers run together once both have signed.
• Sign a series of actions at once and let someone else submit them in order later. Changing an earlier one means re-signing the ones after it.
• Move existing durable-nonce workflows to an approach that does not depend on them.

Source

The programs, clients, and CLI are open source at solana-program/ed25519-programmatic-signer. To report a bug or suggest a change, open an issue.