diff --git a/.github/workflows/builds.yml b/.github/workflows/builds.yml
index f8b2eeee677..92da5a94e84 100644
--- a/.github/workflows/builds.yml
+++ b/.github/workflows/builds.yml
@@ -1,6 +1,6 @@
+name: Build Node Docker Images
 # This workflow is used to build and push one-off images for specific node types. This is useful
 # when deploying hotfixes or any time a change is not needed for all node roles.
-name: Build Node Docker Images
 
 on:
   workflow_dispatch:
@@ -38,9 +38,10 @@ on:
         type: boolean
         description: 'Observer'
         required: false
-      include_without_netgo:
+      # GHA allows only up to 10 inputs - regroup two entries in one
+      include_alternative_builds:
         type: boolean
-        description: 'Build `without_netgo` images'
+        description: 'Build amd64 `without_adx` and `without_netgo_without_adx` images, and arm64 images'
         required: false
 
 jobs:
@@ -111,17 +112,22 @@ jobs:
       run: |
         gcloud auth configure-docker
 
-    - name: Build/Push ${{ matrix.role }} images
+    - name: Build/Push ${{ matrix.role }} amd64 images with adx (default)
       env:
         IMAGE_TAG: ${{ inputs.docker_tag }}
         CADENCE_DEPLOY_KEY: ${{ secrets.CADENCE_DEPLOY_KEY }}
       run: |
-        make docker-build-${{ matrix.role }} docker-push-${{ matrix.role }}
+        make docker-build-${{ matrix.role }}-with-adx docker-push-${{ matrix.role }}-with-adx
 
-    - name: Build/Push ${{ matrix.role }} without_netgo images
-      if: ${{ inputs.include_without_netgo }}
+    - name: Build/Push ${{ matrix.role }} amd64 images without netgo and without adx, arm64 images
+      if: ${{ inputs.include_alternative_builds }}
       env:
         IMAGE_TAG: ${{ inputs.docker_tag }}
         CADENCE_DEPLOY_KEY: ${{ secrets.CADENCE_DEPLOY_KEY }}
       run: |
-        make docker-build-${{ matrix.role }}-without-netgo docker-push-${{ matrix.role }}-without-netgo
+        make docker-build-${{ matrix.role }}-without-adx docker-push-${{ matrix.role }}-without-adx \
+          docker-build-${{ matrix.role }}-without-netgo-without-adx docker-push-${{ matrix.role }}-without-netgo-without-adx \
+          docker-cross-build-${{ matrix.role }}-arm docker-push-${{ matrix.role }}-arm
+
+
+        
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 301398077d2..3efb672e568 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -33,9 +33,13 @@ jobs:
       env:
         CADENCE_DEPLOY_KEY: ${{ secrets.CADENCE_DEPLOY_KEY }}
       run: |
-        make docker-build-flow
-        make docker-build-flow-without-netgo
+        make docker-build-flow-with-adx
+        make docker-build-flow-without-adx
+        make docker-build-flow-without-netgo-without-adx
+        make docker-cross-build-flow-arm
     - name: Docker push
       run: |
-        make docker-push-flow
-        make docker-push-flow-without-netgo
+        make docker-push-flow-with-adx
+        make docker-push-flow-without-adx
+        make docker-push-flow-without-netgo-without-adx
+        make docker-push-flow-arm
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fe55d205edd..b14ba2d69c5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -89,7 +89,43 @@ jobs:
           cache: true
       - name: Set Test Matrix
         id: set-test-matrix
-        run: go run utils/test_matrix/test_matrix.go admin cmd consensus engine/access engine/collection engine/common engine/consensus engine/execution/ingestion:buildjet-8vcpu-ubuntu-2204 engine/execution/computation engine/execution engine/verification engine:buildjet-4vcpu-ubuntu-2204 fvm ledger module/dkg module:buildjet-4vcpu-ubuntu-2204 network/alsp network/test/cohort1:buildjet-16vcpu-ubuntu-2204 network/test/cohort2:buildjet-4vcpu-ubuntu-2204 network/p2p/connection network/p2p/node:buildjet-4vcpu-ubuntu-2204 network/p2p/scoring network/p2p network state storage utils
+        run: go run tools/test_matrix_generator/matrix.go
+
+  create-insecure-dynamic-test-matrix:
+    name: Create Dynamic Unit Test Insecure Package Matrix
+    runs-on: ubuntu-latest
+    outputs:
+      dynamic-matrix: ${{ steps.set-test-matrix.outputs.dynamicMatrix }}
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+      - name: Setup Go
+        uses: actions/setup-go@v4
+        timeout-minutes: 10 # fail fast. sometimes this step takes an extremely long time
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+      - name: Set Test Matrix
+        id: set-test-matrix
+        run: go run tools/test_matrix_generator/matrix.go -c insecure
+
+  create-integration-dynamic-test-matrix:
+    name: Create Dynamic Integration Test Package Matrix
+    runs-on: ubuntu-latest
+    outputs:
+      dynamic-matrix: ${{ steps.set-test-matrix.outputs.dynamicMatrix }}
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+      - name: Setup Go
+        uses: actions/setup-go@v4
+        timeout-minutes: 10 # fail fast. sometimes this step takes an extremely long time
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+      - name: Set Test Matrix
+        id: set-test-matrix
+        run: go run tools/test_matrix_generator/matrix.go -c integration
 
   unit-test:
     name: Unit Tests (${{ matrix.targets.name }})
@@ -127,23 +163,15 @@ jobs:
         flags: unittests
         name: codecov-umbrella
 
-  unit-test-modules:
-    name: Unit Tests (Modules)
+  unit-test-insecure:
+    name: Unit Tests Insecure (${{ matrix.targets.name }})
+    needs: create-insecure-dynamic-test-matrix
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - name: insecure
-            setup: install-tools
-            retries: 5
-            race: 0
-            runner: buildjet-4vcpu-ubuntu-2204
-          - name: integration
-            setup: install-tools
-            retries: 5
-            race: 0
-            runner: buildjet-4vcpu-ubuntu-2204
-    runs-on: ${{ matrix.runner }}
+        targets: ${{ fromJSON(needs.create-insecure-dynamic-test-matrix.outputs.dynamic-matrix)}}
+    ## need to set image explicitly due to GitHub logging issue as described in https://github.com/onflow/flow-go/pull/3087#issuecomment-1234383202
+    runs-on: ${{ matrix.targets.runner }}
     steps:
       - name: Checkout repo
         uses: actions/checkout@v3
@@ -153,17 +181,17 @@ jobs:
         with:
           go-version: ${{ env.GO_VERSION }}
           cache: true
-      - name: Setup tests (${{ matrix.name }})
-        run: make ${{ matrix.setup }}
-      - name: Run tests (${{ matrix.name }})
-        env:
-          RACE_DETECTOR: ${{ matrix.race }}
+      - name: Setup tests (${{ matrix.targets.name }})
+        run: VERBOSE=1 make -e GO_TEST_PACKAGES="${{ matrix.targets.packages }}" install-tools
+      - name: Run tests (${{ matrix.targets.name }})
         uses: nick-fields/retry@v2
         with:
           timeout_minutes: 35
-          max_attempts: ${{ matrix.retries }}
-          # run test target inside each module's root
-          command: VERBOSE=1 make -C ${{ matrix.name }} test
+          max_attempts: 5
+          command: VERBOSE=1 make -C ./insecure -e GO_TEST_PACKAGES="${{ matrix.targets.packages }}" test
+        # TODO(rbtz): re-enable when we fix exisiting races.
+        #env:
+        #  RACE_DETECTOR: 1
       - name: Upload coverage report
         uses: codecov/codecov-action@v3
         with:
@@ -191,7 +219,7 @@ jobs:
       - name: Docker build
         env:
           CADENCE_DEPLOY_KEY: ${{ secrets.CADENCE_DEPLOY_KEY }}
-        run: make docker-build-flow docker-build-flow-corrupt
+        run: make docker-native-build-flow docker-native-build-flow-corrupt
       - name: Save Docker images
         run: |
           docker save \
@@ -212,6 +240,42 @@ jobs:
           # use the workflow run id as part of the cache key to ensure these docker images will only be used for a single workflow run
           key: flow-docker-images-${{ hashFiles('**/Dockerfile') }}-${{ github.run_id }}
 
+  integration-test-others:
+    name: Integration Tests Others (${{ matrix.targets.name }})
+    needs: create-integration-dynamic-test-matrix
+    strategy:
+      fail-fast: false
+      matrix:
+        targets: ${{ fromJSON(needs.create-integration-dynamic-test-matrix.outputs.dynamic-matrix)}}
+    ## need to set image explicitly due to GitHub logging issue as described in https://github.com/onflow/flow-go/pull/3087#issuecomment-1234383202
+    runs-on: ${{ matrix.targets.runner }}
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v3
+      - name: Setup Go
+        uses: actions/setup-go@v4
+        timeout-minutes: 10 # fail fast. sometimes this step takes an extremely long time
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+      - name: Setup tests (${{ matrix.targets.name }})
+        run: VERBOSE=1 make -e GO_TEST_PACKAGES="${{ matrix.targets.packages }}" install-tools
+      - name: Run tests (${{ matrix.targets.name }})
+        uses: nick-fields/retry@v2
+        with:
+          timeout_minutes: 35
+          max_attempts: 5
+          command: VERBOSE=1 make -C ./integration -e GO_TEST_PACKAGES="${{ matrix.targets.packages }}" test
+        # TODO(rbtz): re-enable when we fix exisiting races.
+        #env:
+        #  RACE_DETECTOR: 1
+      - name: Upload coverage report
+        uses: codecov/codecov-action@v3
+        with:
+          file: ./coverage.txt
+          flags: unittests
+          name: codecov-umbrella
+
   integration-test:
     name: Integration Tests
     needs: docker-build
diff --git a/.github/workflows/flaky-test-monitor.yml b/.github/workflows/flaky-test-monitor.yml
index 3a47ef7b829..146408c67ee 100644
--- a/.github/workflows/flaky-test-monitor.yml
+++ b/.github/workflows/flaky-test-monitor.yml
@@ -165,7 +165,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
           cache: true
       - name: Docker build
-        run: make docker-build-flow docker-build-flow-corrupt
+        run: make docker-native-build-flow docker-native-build-flow-corrupt
       - name: Run tests
         run: make -es -C integration ${{ matrix.target }} > test-output
         timeout-minutes: 100
diff --git a/.gitignore b/.gitignore
index 0c025be2692..18a29096f72 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,8 @@
 /cmd/util/util
 /cmd/bootstrap/bootstrap
 
+# Test ouput of  bootstrapping CLI
+cmd/bootstrap/bootstrap-example
 
 # Test binary, build with `go test -c`
 *.test
diff --git a/Makefile b/Makefile
index 3d04db92b5b..7ba432f6bb6 100644
--- a/Makefile
+++ b/Makefile
@@ -19,7 +19,9 @@ ifeq (${IMAGE_TAG},)
 IMAGE_TAG := ${SHORT_COMMIT}
 endif
 
-IMAGE_TAG_NO_NETGO := $(IMAGE_TAG)-without-netgo
+IMAGE_TAG_NO_ADX := $(IMAGE_TAG)-without-adx
+IMAGE_TAG_NO_NETGO_NO_ADX := $(IMAGE_TAG)-without-netgo-without-adx
+IMAGE_TAG_ARM := $(IMAGE_TAG)-arm
 
 # Name of the cover profile
 COVER_PROFILE := coverage.txt
@@ -39,20 +41,19 @@ K8S_YAMLS_LOCATION_STAGING=./k8s/staging
 export CONTAINER_REGISTRY := gcr.io/flow-container-registry
 export DOCKER_BUILDKIT := 1
 
+# set `CRYPTO_FLAG` when building natively (not cross-compiling)
 include crypto_adx_flag.mk
 
-CGO_FLAG := CGO_CFLAGS=$(CRYPTO_FLAG)
-
 # needed for CI
 .PHONY: noop
 noop:
 	@echo "This is a no-op target"
 
 cmd/collection/collection:
-	$(CGO_FLAG) go build -o cmd/collection/collection cmd/collection/main.go
+	CGO_CFLAGS=$(CRYPTO_FLAG) go build -o cmd/collection/collection cmd/collection/main.go
 
 cmd/util/util:
-	$(CGO_FLAG) go build -o cmd/util/util cmd/util/main.go
+	CGO_CFLAGS=$(CRYPTO_FLAG) go build -o cmd/util/util cmd/util/main.go
 
 .PHONY: update-core-contracts-version
 update-core-contracts-version:
@@ -71,7 +72,7 @@ update-cadence-version:
 .PHONY: unittest-main
 unittest-main:
 	# test all packages
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) -coverprofile=$(COVER_PROFILE) -covermode=atomic $(if $(RACE_DETECTOR),-race,) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) $(GO_TEST_PACKAGES)
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test $(if $(VERBOSE),-v,) -coverprofile=$(COVER_PROFILE) -covermode=atomic $(if $(RACE_DETECTOR),-race,) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) $(GO_TEST_PACKAGES)
 
 .PHONY: install-mock-generators
 install-mock-generators:
@@ -111,17 +112,17 @@ code-sanity-check: go-math-rand-check
 .PHONY: fuzz-fvm
 fuzz-fvm:
 	# run fuzz tests in the fvm package
-	cd ./fvm && $(CGO_FLAG) go test -fuzz=Fuzz -run ^$$
+	cd ./fvm && CGO_CFLAGS=$(CRYPTO_FLAG) go test -fuzz=Fuzz -run ^$$
 
 .PHONY: test
 test: verify-mocks unittest-main
 
 .PHONY: integration-test
-integration-test: docker-build-flow
+integration-test: docker-native-build-flow
 	$(MAKE) -C integration integration-test
 
 .PHONY: benchmark
-benchmark: docker-build-flow
+benchmark: docker-native-build-flow
 	$(MAKE) -C integration benchmark
 
 .PHONY: coverage
@@ -149,15 +150,13 @@ generate-proto:
 
 .PHONY: generate-fvm-env-wrappers
 generate-fvm-env-wrappers:
-	$(CGO_FLAG) go run ./fvm/environment/generate-wrappers fvm/environment/parse_restricted_checker.go
+	CGO_CFLAGS=$(CRYPTO_FLAG) go run ./fvm/environment/generate-wrappers fvm/environment/parse_restricted_checker.go
 
 .PHONY: generate-mocks
 generate-mocks: install-mock-generators
 	mockery --name '(Connector|PingInfoProvider)' --dir=network/p2p --case=underscore --output="./network/mocknetwork" --outpkg="mocknetwork"
-	$(CGO_FLAG) mockgen -destination=storage/mocks/storage.go -package=mocks github.com/onflow/flow-go/storage Blocks,Headers,Payloads,Collections,Commits,Events,ServiceEvents,TransactionResults
-	$(CGO_FLAG) mockgen -destination=module/mocks/network.go -package=mocks github.com/onflow/flow-go/module Local,Requester
-	$(CGO_FLAG) mockgen -destination=network/mocknetwork/mock_network.go -package=mocknetwork github.com/onflow/flow-go/network EngineRegistry
-	mockery --name='.*' --dir=integration/benchmark/mocksiface --case=underscore --output="integration/benchmark/mock" --outpkg="mock"
+	CGO_CFLAGS=$(CRYPTO_FLAG) mockgen -destination=storage/mocks/storage.go -package=mocks github.com/onflow/flow-go/storage Blocks,Headers,Payloads,Collections,Commits,Events,ServiceEvents,TransactionResults
+	CGO_CFLAGS=$(CRYPTO_FLAG) mockgen -destination=network/mocknetwork/mock_network.go -package=mocknetwork github.com/onflow/flow-go/network EngineRegistry
 	mockery --name=ExecutionDataStore --dir=module/executiondatasync/execution_data --case=underscore --output="./module/executiondatasync/execution_data/mock" --outpkg="mock"
 	mockery --name=Downloader --dir=module/executiondatasync/execution_data --case=underscore --output="./module/executiondatasync/execution_data/mock" --outpkg="mock"
 	mockery --name '(ExecutionDataRequester|IndexReporter)' --dir=module/state_synchronization --case=underscore --output="./module/state_synchronization/mock" --outpkg="state_synchronization"
@@ -177,6 +176,7 @@ generate-mocks: install-mock-generators
 	mockery --name '.*' --dir=storage --case=underscore --output="./storage/mock" --outpkg="mock"
 	mockery --name '.*' --dir="state/protocol" --case=underscore --output="state/protocol/mock" --outpkg="mock"
 	mockery --name '.*' --dir="state/protocol/events" --case=underscore --output="./state/protocol/events/mock" --outpkg="mock"
+	mockery --name '.*' --dir="state/protocol/protocol_state" --case=underscore --output="state/protocol/protocol_state/mock" --outpkg="mock"
 	mockery --name '.*' --dir=engine/execution/computation/computer --case=underscore --output="./engine/execution/computation/computer/mock" --outpkg="mock"
 	mockery --name '.*' --dir=engine/execution/state --case=underscore --output="./engine/execution/state/mock" --outpkg="mock"
 	mockery --name '.*' --dir=engine/collection --case=underscore --output="./engine/collection/mock" --outpkg="mock"
@@ -198,6 +198,8 @@ generate-mocks: install-mock-generators
 	mockery --name 'API' --dir="./access" --case=underscore --output="./access/mock" --outpkg="mock"
 	mockery --name 'API' --dir="./engine/protocol" --case=underscore --output="./engine/protocol/mock" --outpkg="mock"
 	mockery --name '.*' --dir="./engine/access/state_stream" --case=underscore --output="./engine/access/state_stream/mock" --outpkg="mock"
+	mockery --name 'BlockTracker' --dir="./engine/access/subscription" --case=underscore --output="./engine/access/subscription/mock"  --outpkg="mock"
+	mockery --name 'ExecutionDataTracker' --dir="./engine/access/subscription" --case=underscore --output="./engine/access/subscription/mock"  --outpkg="mock"
 	mockery --name 'ConnectionFactory' --dir="./engine/access/rpc/connection" --case=underscore --output="./engine/access/rpc/connection/mock" --outpkg="mock"
 	mockery --name 'Communicator' --dir="./engine/access/rpc/backend" --case=underscore --output="./engine/access/rpc/backend/mock" --outpkg="mock"
 
@@ -246,7 +248,7 @@ ci-integration:
 	$(MAKE) -C integration integration-test
 
 # Runs benchmark tests
-# NOTE: we do not need `docker-build-flow` as this is run as a separate step
+# NOTE: we do not need `docker-native-build-flow` as this is run as a separate step
 # on Teamcity
 .PHONY: ci-benchmark
 ci-benchmark: install-tools
@@ -274,166 +276,323 @@ docker-ci-integration:
 		-w "/go/flow" "$(CONTAINER_REGISTRY)/golang-cmake:v0.0.7" \
 		make ci-integration
 
-.PHONY: docker-build-collection
-docker-build-collection:
-	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/collection --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
+# only works on Debian
+.SILENT: install-cross-build-tools
+install-cross-build-tools:
+	if [ "$(UNAME)" = "Debian" ] ; then \
+		apt-get update && apt-get -y install apt-utils gcc-aarch64-linux-gnu ; \
+	elif [ "$(UNAME)" = "Linux" ] ; then \
+		apt-get update && apt-get -y install apt-utils gcc-aarch64-linux-gnu ; \
+	else \
+		echo "this target only works on Debian or Linux, host runs on" $(UNAME) ; \
+	fi
+
+.PHONY: docker-native-build-collection
+docker-native-build-collection:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/collection --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
 		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG}" \
-		-t "$(CONTAINER_REGISTRY)/collection:latest" -t "$(CONTAINER_REGISTRY)/collection:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/collection:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/collection:latest" \
+		-t "$(CONTAINER_REGISTRY)/collection:$(IMAGE_TAG)" .
+
+.PHONY: docker-build-collection-with-adx
+docker-build-collection-with-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/collection --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=amd64 --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG)" \
+		-t "$(CONTAINER_REGISTRY)/collection:$(IMAGE_TAG)"  .
+
+.PHONY: docker-build-collection-without-adx
+docker-build-collection-without-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/collection --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_ADX) --build-arg GOARCH=amd64 --build-arg CGO_FLAG=$(DISABLE_ADX) --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_ADX)" \
+		-t "$(CONTAINER_REGISTRY)/collection:$(IMAGE_TAG_NO_ADX)"  .
+
+.PHONY: docker-build-collection-without-netgo-without-adx
+docker-build-collection-without-netgo-without-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/collection --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_NETGO_NO_ADX) --build-arg GOARCH=amd64 --build-arg TAGS="" --build-arg CGO_FLAG=$(DISABLE_ADX) --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_NETGO_NO_ADX)" \
+		-t "$(CONTAINER_REGISTRY)/collection:$(IMAGE_TAG_NO_NETGO_NO_ADX)"  .
 
-.PHONY: docker-build-collection-without-netgo
-docker-build-collection-without-netgo:
-	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/collection --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_NETGO) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
+.PHONY: docker-cross-build-collection-arm
+docker-cross-build-collection-arm:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/collection --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_ARM) --build-arg CC=aarch64-linux-gnu-gcc --build-arg GOARCH=arm64 --target production \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
-		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_NETGO)" \
-		-t "$(CONTAINER_REGISTRY)/collection:$(IMAGE_TAG_NO_NETGO)"  .
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_ARM)" \
+		-t "$(CONTAINER_REGISTRY)/collection:$(IMAGE_TAG_ARM)"  .
 
-.PHONY: docker-build-collection-debug
-docker-build-collection-debug:
+.PHONY: docker-native-build-collection-debug
+docker-native-build-collection-debug:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/collection --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target debug \
-		-t "$(CONTAINER_REGISTRY)/collection-debug:latest" -t "$(CONTAINER_REGISTRY)/collection-debug:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/collection-debug:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/collection-debug:latest" \
+		-t "$(CONTAINER_REGISTRY)/collection-debug:$(IMAGE_TAG)" .
 
-.PHONY: docker-build-consensus
-docker-build-consensus:
+.PHONY: docker-native-build-consensus
+docker-native-build-consensus:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/consensus --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
 		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG}" \
-		-t "$(CONTAINER_REGISTRY)/consensus:latest" -t "$(CONTAINER_REGISTRY)/consensus:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/consensus:$(IMAGE_TAG)"  .
-.PHONY: docker-build-consensus-without-netgo
-docker-build-consensus-without-netgo:
-	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/consensus --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_NETGO) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
+		-t "$(CONTAINER_REGISTRY)/consensus:latest" \
+		-t "$(CONTAINER_REGISTRY)/consensus:$(IMAGE_TAG)"  .
+
+.PHONY: docker-build-consensus-with-adx
+docker-build-consensus-with-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/consensus --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=amd64 --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG)" \
+		-t "$(CONTAINER_REGISTRY)/consensus:$(IMAGE_TAG)" .
+
+.PHONY: docker-build-consensus-without-adx
+docker-build-consensus-without-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/consensus --build-arg COMMIT=$(COMMIT) --build-arg VERSION=$(IMAGE_TAG_NO_ADX) --build-arg GOARCH=amd64 --build-arg CGO_FLAG=$(DISABLE_ADX) --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_ADX)" \
+		-t "$(CONTAINER_REGISTRY)/consensus:$(IMAGE_TAG_NO_ADX)" .
+
+.PHONY: docker-build-consensus-without-netgo-without-adx
+docker-build-consensus-without-netgo-without-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/consensus --build-arg COMMIT=$(COMMIT) --build-arg VERSION=$(IMAGE_TAG_NO_NETGO_NO_ADX) --build-arg GOARCH=amd64 --build-arg TAGS="" --build-arg CGO_FLAG=$(DISABLE_ADX) --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_NETGO_NO_ADX)" \
+		-t "$(CONTAINER_REGISTRY)/consensus:$(IMAGE_TAG_NO_NETGO_NO_ADX)" .
+
+.PHONY: docker-cross-build-consensus-arm
+docker-cross-build-consensus-arm:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/consensus --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_ARM) --build-arg GOARCH=arm64 --build-arg CC=aarch64-linux-gnu-gcc --target production \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
-		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_NETGO)" \
-		-t "$(CONTAINER_REGISTRY)/consensus:$(IMAGE_TAG_NO_NETGO)" .
+		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG_ARM}" \
+		-t "$(CONTAINER_REGISTRY)/consensus:$(IMAGE_TAG_ARM)"  .
 
-.PHONY: docker-build-consensus-debug
-docker-build-consensus-debug:
+
+.PHONY: docker-native-build-consensus-debug
+docker-build-native-consensus-debug:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/consensus --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target debug \
-		-t "$(CONTAINER_REGISTRY)/consensus-debug:latest" -t "$(CONTAINER_REGISTRY)/consensus-debug:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/consensus-debug:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/consensus-debug:latest" \
+		-t "$(CONTAINER_REGISTRY)/consensus-debug:$(IMAGE_TAG)" .
 
-.PHONY: docker-build-execution
-docker-build-execution:
+.PHONY: docker-native-build-execution
+docker-native-build-execution:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/execution --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
 		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG}" \
-		-t "$(CONTAINER_REGISTRY)/execution:latest" -t "$(CONTAINER_REGISTRY)/execution:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/execution:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/execution:latest" \
+		-t "$(CONTAINER_REGISTRY)/execution:$(IMAGE_TAG)" .
+
+.PHONY: docker-build-execution-with-adx
+docker-build-execution-with-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/execution --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=amd64 --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG)" \
+		-t "$(CONTAINER_REGISTRY)/execution:$(IMAGE_TAG)" .
+
+.PHONY: docker-build-execution-without-adx
+docker-build-execution-without-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/execution --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_ADX) --build-arg GOARCH=amd64 --build-arg CGO_FLAG=$(DISABLE_ADX) --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_ADX)" \
+		-t "$(CONTAINER_REGISTRY)/execution:$(IMAGE_TAG_NO_ADX)" .
+
+.PHONY: docker-build-execution-without-netgo-without-adx
+docker-build-execution-without-netgo-without-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/execution --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_NETGO_NO_ADX) --build-arg GOARCH=amd64 --build-arg TAGS="" --build-arg CGO_FLAG=$(DISABLE_ADX) --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_NETGO_NO_ADX)" \
+		-t "$(CONTAINER_REGISTRY)/execution:$(IMAGE_TAG_NO_NETGO_NO_ADX)" .
 
-.PHONY: docker-build-execution-without-netgo
-docker-build-execution-without-netgo:
-	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/execution --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_NETGO) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
+.PHONY: docker-cross-build-execution-arm
+docker-cross-build-execution-arm:
+	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/execution --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_ARM) --build-arg GOARCH=arm64 --build-arg CC=aarch64-linux-gnu-gcc --target production \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
-		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_NETGO)" \
-		-t "$(CONTAINER_REGISTRY)/execution:$(IMAGE_TAG_NO_NETGO)" .
+		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG_ARM}" \
+		-t "$(CONTAINER_REGISTRY)/execution:$(IMAGE_TAG_ARM)" .
 
-.PHONY: docker-build-execution-debug
-docker-build-execution-debug:
+.PHONY: docker-native-build-execution-debug
+docker-native-build-execution-debug:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/execution --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target debug \
-		-t "$(CONTAINER_REGISTRY)/execution-debug:latest" -t "$(CONTAINER_REGISTRY)/execution-debug:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/execution-debug:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/execution-debug:latest" \
+		-t "$(CONTAINER_REGISTRY)/execution-debug:$(IMAGE_TAG)" .
 
 # build corrupt execution node for BFT testing
-.PHONY: docker-build-execution-corrupt
-docker-build-execution-corrupt:
+.PHONY: docker-native-build-execution-corrupt
+docker-native-build-execution-corrupt:
 	# temporarily make insecure/ a non-module to allow Docker to use corrupt builders there
 	./insecure/cmd/mods_override.sh
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./insecure/cmd/execution --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
 		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG}" \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
-		-t "$(CONTAINER_REGISTRY)/execution-corrupted:latest" -t "$(CONTAINER_REGISTRY)/execution-corrupted:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/execution-corrupted:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/execution-corrupted:latest" \
+		-t "$(CONTAINER_REGISTRY)/execution-corrupted:$(IMAGE_TAG)" .
 	./insecure/cmd/mods_restore.sh
 
-.PHONY: docker-build-verification
-docker-build-verification:
+.PHONY: docker-native-build-verification
+docker-native-build-verification:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/verification --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
 		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG}" \
-		-t "$(CONTAINER_REGISTRY)/verification:latest" -t "$(CONTAINER_REGISTRY)/verification:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/verification:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/verification:latest" \
+		-t "$(CONTAINER_REGISTRY)/verification:$(IMAGE_TAG)" .
 
-.PHONY: docker-build-verification-without-netgo
-docker-build-verification-without-netgo:
-	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/verification --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_NETGO) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
+.PHONY: docker-build-verification-with-adx
+docker-build-verification-with-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/verification --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=amd64 --target production \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
-		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_NETGO)" \
-		-t "$(CONTAINER_REGISTRY)/verification:$(IMAGE_TAG_NO_NETGO)" .
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG)" \
+		-t "$(CONTAINER_REGISTRY)/verification:$(IMAGE_TAG)" .
 
-.PHONY: docker-build-verification-debug
-docker-build-verification-debug:
+.PHONY: docker-build-verification-without-adx
+docker-build-verification-without-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/verification --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_ADX) --build-arg GOARCH=amd64 --build-arg CGO_FLAG=$(DISABLE_ADX) --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_ADX)" \
+		-t "$(CONTAINER_REGISTRY)/verification:$(IMAGE_TAG_NO_ADX)" .
+
+.PHONY: docker-build-verification-without-netgo-without-adx
+docker-build-verification-without-netgo-without-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/verification --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_NETGO_NO_ADX) --build-arg GOARCH=amd64 --build-arg TAGS=""  --build-arg CGO_FLAG=$(DISABLE_ADX) --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_NETGO_NO_ADX)" \
+		-t "$(CONTAINER_REGISTRY)/verification:$(IMAGE_TAG_NO_NETGO_NO_ADX)" .
+
+.PHONY: docker-cross-build-verification-arm
+docker-cross-build-verification-arm:
+	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/verification --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_ARM) --build-arg GOARCH=arm64 --build-arg CC=aarch64-linux-gnu-gcc --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG_ARM}" \
+		-t "$(CONTAINER_REGISTRY)/verification:$(IMAGE_TAG_ARM)" .
+
+.PHONY: docker-native-build-verification-debug
+docker-native-build-verification-debug:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/verification --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target debug \
-		-t "$(CONTAINER_REGISTRY)/verification-debug:latest" -t "$(CONTAINER_REGISTRY)/verification-debug:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/verification-debug:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/verification-debug:latest" \
+		-t "$(CONTAINER_REGISTRY)/verification-debug:$(IMAGE_TAG)" .
 
 # build corrupt verification node for BFT testing
-.PHONY: docker-build-verification-corrupt
-docker-build-verification-corrupt:
+.PHONY: docker-native-build-verification-corrupt
+docker-native-build-verification-corrupt:
 	# temporarily make insecure/ a non-module to allow Docker to use corrupt builders there
 	./insecure/cmd/mods_override.sh
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./insecure/cmd/verification --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
 		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG}" \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
-		-t "$(CONTAINER_REGISTRY)/verification-corrupted:latest" -t "$(CONTAINER_REGISTRY)/verification-corrupted:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/verification-corrupted:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/verification-corrupted:latest" \
+		-t "$(CONTAINER_REGISTRY)/verification-corrupted:$(IMAGE_TAG)" .
 	./insecure/cmd/mods_restore.sh
 
-.PHONY: docker-build-access
-docker-build-access:
+.PHONY: docker-native-build-access
+docker-native-build-access:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/access --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
 		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG}" \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
-		-t "$(CONTAINER_REGISTRY)/access:latest" -t "$(CONTAINER_REGISTRY)/access:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/access:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/access:latest" \
+		-t "$(CONTAINER_REGISTRY)/access:$(IMAGE_TAG)" .
+
+.PHONY: docker-build-access-with-adx
+docker-build-access-with-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/access --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=amd64 --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG)" \
+		-t "$(CONTAINER_REGISTRY)/access:$(IMAGE_TAG)" .
+
+.PHONY: docker-build-access-without-adx
+docker-build-access-without-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/access --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_ADX) --build-arg GOARCH=amd64 --build-arg CGO_FLAG=$(DISABLE_ADX) --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_ADX)" \
+		-t "$(CONTAINER_REGISTRY)/access:$(IMAGE_TAG_NO_ADX)" .
 
-.PHONY: docker-build-access-without-netgo
-docker-build-access-without-netgo:
-	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/access --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_NETGO) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
+.PHONY: docker-build-access-without-netgo-without-adx
+docker-build-access-without-netgo-without-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/access --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_NETGO_NO_ADX) --build-arg GOARCH=amd64 --build-arg TAGS="" --build-arg CGO_FLAG=$(DISABLE_ADX) --target production \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
-		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_NETGO)" \
-		-t "$(CONTAINER_REGISTRY)/access:$(IMAGE_TAG_NO_NETGO)" .
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_NETGO_NO_ADX)" \
+		-t "$(CONTAINER_REGISTRY)/access:$(IMAGE_TAG_NO_NETGO_NO_ADX)" .
 
-.PHONY: docker-build-access-debug
-docker-build-access-debug:
+.PHONY: docker-cross-build-access-arm
+docker-cross-build-access-arm:
+	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/access --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_ARM) --build-arg GOARCH=arm64 --build-arg CC=aarch64-linux-gnu-gcc --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG_ARM}" \
+		-t "$(CONTAINER_REGISTRY)/access:$(IMAGE_TAG_ARM)" .
+
+
+.PHONY: docker-native-build-access-debug
+docker-native-build-access-debug:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/access  --build-arg COMMIT=$(COMMIT) --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target debug \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
-		-t "$(CONTAINER_REGISTRY)/access-debug:latest" -t "$(CONTAINER_REGISTRY)/access-debug:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/access-debug:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/access-debug:latest" \
+		-t "$(CONTAINER_REGISTRY)/access-debug:$(IMAGE_TAG)" .
 
 # build corrupt access node for BFT testing
-.PHONY: docker-build-access-corrupt
-docker-build-access-corrupt:
+.PHONY: docker-native-build-access-corrupt
+docker-native-build-access-corrupt:
 	#temporarily make insecure/ a non-module to allow Docker to use corrupt builders there
 	./insecure/cmd/mods_override.sh
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./insecure/cmd/access --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
 		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG}" \
-		-t "$(CONTAINER_REGISTRY)/access-corrupted:latest" -t "$(CONTAINER_REGISTRY)/access-corrupted:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/access-corrupted:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/access-corrupted:latest" \
+		-t "$(CONTAINER_REGISTRY)/access-corrupted:$(IMAGE_TAG)" .
 	./insecure/cmd/mods_restore.sh
 
-.PHONY: docker-build-observer
-docker-build-observer:
+.PHONY: docker-native-build-observer
+docker-native-build-observer:
 	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/observer --build-arg COMMIT=$(COMMIT) --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
 		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG}" \
-		-t "$(CONTAINER_REGISTRY)/observer:latest" -t "$(CONTAINER_REGISTRY)/observer:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/observer:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/observer:latest" \
+		-t "$(CONTAINER_REGISTRY)/observer:$(IMAGE_TAG)" .
+
+.PHONY: docker-build-observer-with-adx
+docker-build-observer-with-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/observer --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=amd64 --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG)" \
+		-t "$(CONTAINER_REGISTRY)/observer:$(IMAGE_TAG)" .
+
+.PHONY: docker-build-observer-without-adx
+docker-build-observer-without-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/observer --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_ADX) --build-arg GOARCH=amd64 --build-arg CGO_FLAG=$(DISABLE_ADX) --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_ADX)" \
+		-t "$(CONTAINER_REGISTRY)/observer:$(IMAGE_TAG_NO_ADX)" .
 
-.PHONY: docker-build-observer-without-netgo
-docker-build-observer-without-netgo:
-	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/observer --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_NETGO) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
+.PHONY: docker-build-observer-without-netgo-without-adx
+docker-build-observer-without-netgo-without-adx:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/observer --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG_NO_NETGO_NO_ADX) --build-arg GOARCH=amd64 --build-arg TAGS="" --build-arg CGO_FLAG=$(DISABLE_ADX) --target production \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
-		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_NETGO)" \
-		-t "$(CONTAINER_REGISTRY)/observer:$(IMAGE_TAG_NO_NETGO)" .
+		--label "git_commit=${COMMIT}" --label "git_tag=$(IMAGE_TAG_NO_NETGO_NO_ADX)" \
+		-t "$(CONTAINER_REGISTRY)/observer:$(IMAGE_TAG_NO_NETGO_NO_ADX)" .
 
+.PHONY: docker-cross-build-observer-arm
+docker-cross-build-observer-arm:
+	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/observer --build-arg COMMIT=$(COMMIT) --build-arg VERSION=$(IMAGE_TAG_ARM) --build-arg GOARCH=arm64 --build-arg CC=aarch64-linux-gnu-gcc --target production \
+		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
+		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG_ARM}" \
+		-t "$(CONTAINER_REGISTRY)/observer:$(IMAGE_TAG_ARM)" .
 
-.PHONY: docker-build-ghost
-docker-build-ghost:
+
+.PHONY: docker-native-build-ghost
+docker-native-build-ghost:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/ghost --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
 		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG}" \
 		--secret id=cadence_deploy_key,env=CADENCE_DEPLOY_KEY --build-arg GOPRIVATE=$(GOPRIVATE) \
-		-t "$(CONTAINER_REGISTRY)/ghost:latest" -t "$(CONTAINER_REGISTRY)/ghost:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/ghost:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/ghost:latest" \
+		-t "$(CONTAINER_REGISTRY)/ghost:$(IMAGE_TAG)" .
 
-.PHONY: docker-build-ghost-debug
-docker-build-ghost-debug:
+.PHONY: docker-native-build-ghost-debug
+docker-native-build-ghost-debug:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/ghost --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(IMAGE_TAG) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target debug \
-		-t "$(CONTAINER_REGISTRY)/ghost-debug:latest" -t "$(CONTAINER_REGISTRY)/ghost-debug:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/ghost-debug:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/ghost-debug:latest" \
+		-t "$(CONTAINER_REGISTRY)/ghost-debug:$(IMAGE_TAG)" .
 
 PHONY: docker-build-bootstrap
 docker-build-bootstrap:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/bootstrap --build-arg GOARCH=$(GOARCH) --build-arg VERSION=$(IMAGE_TAG) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
 		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG}" \
-		-t "$(CONTAINER_REGISTRY)/bootstrap:latest" -t "$(CONTAINER_REGISTRY)/bootstrap:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/bootstrap:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/bootstrap:latest" \
+		-t "$(CONTAINER_REGISTRY)/bootstrap:$(IMAGE_TAG)" .
 
 PHONY: tool-bootstrap
 tool-bootstrap: docker-build-bootstrap
@@ -443,120 +602,171 @@ tool-bootstrap: docker-build-bootstrap
 docker-build-bootstrap-transit:
 	docker build -f cmd/Dockerfile  --build-arg TARGET=./cmd/bootstrap/transit --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(VERSION) --build-arg GOARCH=$(GOARCH) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --no-cache \
 	    --target production  \
-		-t "$(CONTAINER_REGISTRY)/bootstrap-transit:latest" -t "$(CONTAINER_REGISTRY)/bootstrap-transit:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/bootstrap-transit:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/bootstrap-transit:latest" \
+		-t "$(CONTAINER_REGISTRY)/bootstrap-transit:$(IMAGE_TAG)" .
 
 PHONY: tool-transit
 tool-transit: docker-build-bootstrap-transit
 	docker container create --name transit $(CONTAINER_REGISTRY)/bootstrap-transit:latest;docker container cp transit:/bin/app ./transit;docker container rm transit
 
-.PHONY: docker-build-loader
-docker-build-loader:
+.PHONY: docker-native-build-loader
+docker-native-build-loader:
 	docker build -f ./integration/benchmark/cmd/manual/Dockerfile --build-arg TARGET=./benchmark/cmd/manual  --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
 		--label "git_commit=${COMMIT}" --label "git_tag=${IMAGE_TAG}" \
-		-t "$(CONTAINER_REGISTRY)/loader:latest" -t "$(CONTAINER_REGISTRY)/loader:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/loader:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/loader:latest" \
+		-t "$(CONTAINER_REGISTRY)/loader:$(IMAGE_TAG)" .
+
+.PHONY: docker-native-build-flow
+docker-native-build-flow: docker-native-build-collection docker-native-build-consensus docker-native-build-execution docker-native-build-verification docker-native-build-access docker-native-build-observer docker-native-build-ghost
+
+.PHONY: docker-build-flow-with-adx
+docker-build-flow-with-adx: docker-build-collection-with-adx docker-build-consensus-with-adx docker-build-execution-with-adx docker-build-verification-with-adx docker-build-access-with-adx docker-build-observer-with-adx
 
-.PHONY: docker-build-flow
-docker-build-flow: docker-build-collection docker-build-consensus docker-build-execution docker-build-verification docker-build-access docker-build-observer docker-build-ghost
+.PHONY: docker-build-flow-without-adx
+docker-build-flow-without-adx: docker-build-collection-without-adx docker-build-consensus-without-adx docker-build-execution-without-adx docker-build-verification-without-adx docker-build-access-without-adx docker-build-observer-without-adx
 
-.PHONY: docker-build-flow-without-netgo
-docker-build-flow-without-netgo: docker-build-collection-without-netgo docker-build-consensus-without-netgo docker-build-execution-without-netgo docker-build-verification-without-netgo docker-build-access-without-netgo docker-build-observer-without-netgo
+.PHONY: docker-build-flow-without-netgo-without-adx
+docker-build-flow-without-netgo-without-adx: docker-build-collection-without-netgo-without-adx docker-build-consensus-without-netgo-without-adx docker-build-execution-without-netgo-without-adx docker-build-verification-without-netgo-without-adx docker-build-access-without-netgo-without-adx docker-build-observer-without-netgo-without-adx
 
-.PHONY: docker-build-flow-corrupt
-docker-build-flow-corrupt: docker-build-execution-corrupt docker-build-verification-corrupt docker-build-access-corrupt
+# in this target, images are arm64 (aarch64), are build with `netgo` and with `adx`.
+# other arm64 images can be built without `netgo` or without `adx`
+.PHONY: docker-cross-build-flow-arm
+docker-cross-build-flow-arm: docker-cross-build-collection-arm docker-cross-build-consensus-arm docker-cross-build-execution-arm docker-cross-build-verification-arm docker-cross-build-access-arm docker-cross-build-observer-arm
 
-.PHONY: docker-build-benchnet
-docker-build-benchnet: docker-build-flow docker-build-loader
+.PHONY: docker-native-build-flow-corrupt
+docker-native-build-flow-corrupt: docker-native-build-execution-corrupt docker-native-build-verification-corrupt docker-native-build-access-corrupt
 
-.PHONY: docker-push-collection
-docker-push-collection:
-	docker push "$(CONTAINER_REGISTRY)/collection:$(SHORT_COMMIT)"
+.PHONY: docker-native-build-benchnet
+docker-native-build-benchnet: docker-native-build-flow docker-native-build-loader
+
+.PHONY: docker-push-collection-with-adx
+docker-push-collection-with-adx:
 	docker push "$(CONTAINER_REGISTRY)/collection:$(IMAGE_TAG)"
 
-.PHONY: docker-push-collection-without-netgo
-docker-push-collection-without-netgo:
-	docker push "$(CONTAINER_REGISTRY)/collection:$(IMAGE_TAG_NO_NETGO)"
+.PHONY: docker-push-collection-without-adx
+docker-push-collection-without-adx:
+	docker push "$(CONTAINER_REGISTRY)/collection:$(IMAGE_TAG_NO_ADX)"
+
+.PHONY: docker-push-collection-without-netgo-without-adx
+docker-push-collection-without-netgo-without-adx:
+	docker push "$(CONTAINER_REGISTRY)/collection:$(IMAGE_TAG_NO_NETGO_NO_ADX)"
+
+.PHONY: docker-push-collection-arm 
+docker-push-collection-arm:
+	docker push "$(CONTAINER_REGISTRY)/collection:$(IMAGE_TAG_ARM)"
 
 .PHONY: docker-push-collection-latest
 docker-push-collection-latest: docker-push-collection
 	docker push "$(CONTAINER_REGISTRY)/collection:latest"
 
-.PHONY: docker-push-consensus
-docker-push-consensus:
-	docker push "$(CONTAINER_REGISTRY)/consensus:$(SHORT_COMMIT)"
+.PHONY: docker-push-consensus-with-adx
+docker-push-consensus-with-adx:
 	docker push "$(CONTAINER_REGISTRY)/consensus:$(IMAGE_TAG)"
 
-.PHONY: docker-push-consensus-without-netgo
-docker-push-consensus-without-netgo:
-	docker push "$(CONTAINER_REGISTRY)/consensus:$(IMAGE_TAG_NO_NETGO)"
+.PHONY: docker-push-consensus-without-adx
+docker-push-consensus-without-adx:
+	docker push "$(CONTAINER_REGISTRY)/consensus:$(IMAGE_TAG_NO_ADX)"
+
+.PHONY: docker-push-consensus-without-netgo-without-adx
+docker-push-consensus-without-netgo-without-adx:
+	docker push "$(CONTAINER_REGISTRY)/consensus:$(IMAGE_TAG_NO_NETGO_NO_ADX)"
+
+.PHONY: docker-push-consensus-arm 
+docker-push-consensus-arm:
+	docker push "$(CONTAINER_REGISTRY)/consensus:$(IMAGE_TAG_ARM)"
 
 .PHONY: docker-push-consensus-latest
 docker-push-consensus-latest: docker-push-consensus
 	docker push "$(CONTAINER_REGISTRY)/consensus:latest"
 
-.PHONY: docker-push-execution
-docker-push-execution:
-	docker push "$(CONTAINER_REGISTRY)/execution:$(SHORT_COMMIT)"
+.PHONY: docker-push-execution-with-adx
+docker-push-execution-with-adx:
 	docker push "$(CONTAINER_REGISTRY)/execution:$(IMAGE_TAG)"
 
 .PHONY: docker-push-execution-corrupt
 docker-push-execution-corrupt:
-	docker push "$(CONTAINER_REGISTRY)/execution-corrupted:$(SHORT_COMMIT)"
 	docker push "$(CONTAINER_REGISTRY)/execution-corrupted:$(IMAGE_TAG)"
 
+.PHONY: docker-push-execution-without-adx
+docker-push-execution-without-adx:
+	docker push "$(CONTAINER_REGISTRY)/execution:$(IMAGE_TAG_NO_ADX)"
+
+.PHONY: docker-push-execution-without-netgo-without-adx
+docker-push-execution-without-netgo-without-adx:
+	docker push "$(CONTAINER_REGISTRY)/execution:$(IMAGE_TAG_NO_NETGO_NO_ADX)"
 
-.PHONY: docker-push-execution-without-netgo
-docker-push-execution-without-netgo:
-	docker push "$(CONTAINER_REGISTRY)/execution:$(IMAGE_TAG_NO_NETGO)"
+.PHONY: docker-push-execution-arm 
+docker-push-execution-arm:
+	docker push "$(CONTAINER_REGISTRY)/execution:$(IMAGE_TAG_ARM)"
 
 .PHONY: docker-push-execution-latest
 docker-push-execution-latest: docker-push-execution
 	docker push "$(CONTAINER_REGISTRY)/execution:latest"
 
-.PHONY: docker-push-verification
-docker-push-verification:
-	docker push "$(CONTAINER_REGISTRY)/verification:$(SHORT_COMMIT)"
+.PHONY: docker-push-verification-with-adx
+docker-push-verification-with-adx:
 	docker push "$(CONTAINER_REGISTRY)/verification:$(IMAGE_TAG)"
 
+.PHONY: docker-push-verification-without-adx
+docker-push-verification-without-adx:
+	docker push "$(CONTAINER_REGISTRY)/verification:$(IMAGE_TAG_NO_ADX)"
+
 .PHONY: docker-push-verification-corrupt
 docker-push-verification-corrupt:
-	docker push "$(CONTAINER_REGISTRY)/verification-corrupted:$(SHORT_COMMIT)"
 	docker push "$(CONTAINER_REGISTRY)/verification-corrupted:$(IMAGE_TAG)"
 
-.PHONY: docker-push-verification-without-netgo
-docker-push-verification-without-netgo:
-	docker push "$(CONTAINER_REGISTRY)/verification:$(IMAGE_TAG_NO_NETGO)"
+.PHONY: docker-push-verification-without-netgo-without-adx
+docker-push-verification-without-netgo-without-adx:
+	docker push "$(CONTAINER_REGISTRY)/verification:$(IMAGE_TAG_NO_NETGO_NO_ADX)"
+
+.PHONY: docker-push-verification-arm 
+docker-push-verification-arm:
+	docker push "$(CONTAINER_REGISTRY)/verification:$(IMAGE_TAG_ARM)"
 
 .PHONY: docker-push-verification-latest
 docker-push-verification-latest: docker-push-verification
 	docker push "$(CONTAINER_REGISTRY)/verification:latest"
 
-.PHONY: docker-push-access
-docker-push-access:
-	docker push "$(CONTAINER_REGISTRY)/access:$(SHORT_COMMIT)"
+.PHONY: docker-push-access-with-adx
+docker-push-access-with-adx:
 	docker push "$(CONTAINER_REGISTRY)/access:$(IMAGE_TAG)"
 
+.PHONY: docker-push-access-without-adx
+docker-push-access-without-adx:
+	docker push "$(CONTAINER_REGISTRY)/access:$(IMAGE_TAG_NO_ADX)"
+
 .PHONY: docker-push-access-corrupt
 docker-push-access-corrupt:
-	docker push "$(CONTAINER_REGISTRY)/access-corrupted:$(SHORT_COMMIT)"
 	docker push "$(CONTAINER_REGISTRY)/access-corrupted:$(IMAGE_TAG)"
 
-.PHONY: docker-push-access-without-netgo
-docker-push-access-without-netgo:
-	docker push "$(CONTAINER_REGISTRY)/access:$(IMAGE_TAG_NO_NETGO)"
+.PHONY: docker-push-access-without-netgo-without-adx
+docker-push-access-without-netgo-without-adx:
+	docker push "$(CONTAINER_REGISTRY)/access:$(IMAGE_TAG_NO_NETGO_NO_ADX)"
+
+.PHONY: docker-push-access-arm 
+docker-push-access-arm:
+	docker push "$(CONTAINER_REGISTRY)/access:$(IMAGE_TAG_ARM)"
 
 .PHONY: docker-push-access-latest
 docker-push-access-latest: docker-push-access
 	docker push "$(CONTAINER_REGISTRY)/access:latest"
 
 
-.PHONY: docker-push-observer
-docker-push-observer:
-	docker push "$(CONTAINER_REGISTRY)/observer:$(SHORT_COMMIT)"
+.PHONY: docker-push-observer-with-adx
+docker-push-observer-with-adx:
 	docker push "$(CONTAINER_REGISTRY)/observer:$(IMAGE_TAG)"
 
-.PHONY: docker-push-observer-without-netgo
-docker-push-observer-without-netgo:
-	docker push "$(CONTAINER_REGISTRY)/observer:$(IMAGE_TAG_NO_NETGO)"
+.PHONY: docker-push-observer-without-adx
+docker-push-observer-without-adx:
+	docker push "$(CONTAINER_REGISTRY)/observer:$(IMAGE_TAG_NO_ADX)"
+
+.PHONY: docker-push-observer-without-netgo-without-adx
+docker-push-observer-without-netgo-without-adx:
+	docker push "$(CONTAINER_REGISTRY)/observer:$(IMAGE_TAG_NO_NETGO_NO_ADX)"
+
+.PHONY: docker-push-observer-arm 
+docker-push-observer-arm:
+	docker push "$(CONTAINER_REGISTRY)/observer:$(IMAGE_TAG_ARM)"
 
 .PHONY: docker-push-observer-latest
 docker-push-observer-latest: docker-push-observer
@@ -564,7 +774,6 @@ docker-push-observer-latest: docker-push-observer
 
 .PHONY: docker-push-ghost
 docker-push-ghost:
-	docker push "$(CONTAINER_REGISTRY)/ghost:$(SHORT_COMMIT)"
 	docker push "$(CONTAINER_REGISTRY)/ghost:$(IMAGE_TAG)"
 
 .PHONY: docker-push-ghost-latest
@@ -573,18 +782,23 @@ docker-push-ghost-latest: docker-push-ghost
 
 .PHONY: docker-push-loader
 docker-push-loader:
-	docker push "$(CONTAINER_REGISTRY)/loader:$(SHORT_COMMIT)"
 	docker push "$(CONTAINER_REGISTRY)/loader:$(IMAGE_TAG)"
 
 .PHONY: docker-push-loader-latest
 docker-push-loader-latest: docker-push-loader
 	docker push "$(CONTAINER_REGISTRY)/loader:latest"
 
-.PHONY: docker-push-flow
-docker-push-flow: docker-push-collection docker-push-consensus docker-push-execution docker-push-verification docker-push-access docker-push-observer
+.PHONY: docker-push-flow-with-adx
+docker-push-flow-with-adx: docker-push-collection-with-adx docker-push-consensus-with-adx docker-push-execution-with-adx docker-push-verification-with-adx docker-push-access-with-adx docker-push-observer-with-adx
+
+.PHONY: docker-push-flow-without-adx
+docker-push-flow-without-adx: docker-push-collection-without-adx docker-push-consensus-without-adx docker-push-execution-without-adx docker-push-verification-without-adx docker-push-access-without-adx docker-push-observer-without-adx
+
+.PHONY: docker-push-flow-without-netgo-without-adx
+docker-push-flow-without-netgo-without-adx: docker-push-collection-without-netgo-without-adx docker-push-consensus-without-netgo-without-adx docker-push-execution-without-netgo-without-adx docker-push-verification-without-netgo-without-adx docker-push-access-without-netgo-without-adx docker-push-observer-without-netgo-without-adx
 
-.PHONY: docker-push-flow-without-netgo
-docker-push-flow-without-netgo: docker-push-collection-without-netgo docker-push-consensus-without-netgo docker-push-execution-without-netgo docker-push-verification-without-netgo docker-push-access-without-netgo docker-push-observer-without-netgo
+.PHONY: docker-push-flow-arm
+docker-push-flow-arm: docker-push-collection-arm docker-push-consensus-arm docker-push-execution-arm docker-push-verification-arm docker-push-access-arm docker-push-observer-arm
 
 .PHONY: docker-push-flow-latest
 docker-push-flow-latest: docker-push-collection-latest docker-push-consensus-latest docker-push-execution-latest docker-push-verification-latest docker-push-access-latest docker-push-observer-latest
@@ -632,7 +846,8 @@ docker-all-tools: tool-util tool-remove-execution-fork
 PHONY: docker-build-util
 docker-build-util:
 	docker build -f cmd/Dockerfile --build-arg TARGET=./cmd/util --build-arg GOARCH=$(GOARCH) --build-arg VERSION=$(IMAGE_TAG) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
-		-t "$(CONTAINER_REGISTRY)/util:latest" -t "$(CONTAINER_REGISTRY)/util:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/util:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/util:latest"  \
+		-t "$(CONTAINER_REGISTRY)/util:$(IMAGE_TAG)" .
 
 PHONY: tool-util
 tool-util: docker-build-util
@@ -641,7 +856,8 @@ tool-util: docker-build-util
 PHONY: docker-build-remove-execution-fork
 docker-build-remove-execution-fork:
 	docker build -f cmd/Dockerfile --ssh default --build-arg TARGET=./cmd/util/cmd/remove-execution-fork --build-arg GOARCH=$(GOARCH) --build-arg VERSION=$(IMAGE_TAG) --build-arg CGO_FLAG=$(CRYPTO_FLAG) --target production \
-		-t "$(CONTAINER_REGISTRY)/remove-execution-fork:latest" -t "$(CONTAINER_REGISTRY)/remove-execution-fork:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/remove-execution-fork:$(IMAGE_TAG)" .
+		-t "$(CONTAINER_REGISTRY)/remove-execution-fork:latest" \
+		-t "$(CONTAINER_REGISTRY)/remove-execution-fork:$(IMAGE_TAG)" .
 
 PHONY: tool-remove-execution-fork
 tool-remove-execution-fork: docker-build-remove-execution-fork
diff --git a/NOTICE b/NOTICE
index e0890e1be36..0c334d1c385 100644
--- a/NOTICE
+++ b/NOTICE
@@ -1,5 +1,5 @@
 Flow-go
-Copyright 2019-2020 Dapper Labs, Inc.
+Copyright 2019-2024 Flow Foundation.
 
-This product includes software developed at Dapper Labs, Inc. (https://www.dapperlabs.com/). 
+This product includes software developed at Flow Foundation (https://flow.com/flow-foundation).
 
diff --git a/README.md b/README.md
index 291e45de347..fa98d67d364 100644
--- a/README.md
+++ b/README.md
@@ -100,15 +100,19 @@ The recommended way to build and run Flow for local development is using Docker.
 Build a Docker image for all nodes:
 
 ```bash
-make docker-build-flow
+make docker-native-build-flow
 ```
 
 Build a Docker image for a particular node role (replace `$ROLE` with `collection`, `consensus`, etc.):
 
 ```bash
-make docker-build-$ROLE
+make docker-native-build-$ROLE
 ```
 
+### Importing the module
+
+When importing the `github.com/onflow/flow-go` module in your Go project, testing or building your project may require setting extra Go flags because the module requires [cgo](https://pkg.go.dev/cmd/cgo). In particular, `CGO_ENABLED` must be set to `1` if `cgo` isn't enabled by default. This constraint comes from the underlying cryptography library. Refer to the [crypto repository build](https://github.com/onflow/crypto?tab=readme-ov-file#build) for more details.
+
 ### Local Network
 
 A local version of the network can be run for manual testing and integration. See
diff --git a/access/api.go b/access/api.go
index 757ae2c9805..3201796c6ed 100644
--- a/access/api.go
+++ b/access/api.go
@@ -6,6 +6,7 @@ import (
 	"github.com/onflow/flow/protobuf/go/flow/access"
 	"github.com/onflow/flow/protobuf/go/flow/entities"
 
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
 	"github.com/onflow/flow-go/model/flow"
 )
@@ -52,6 +53,151 @@ type API interface {
 
 	GetExecutionResultForBlockID(ctx context.Context, blockID flow.Identifier) (*flow.ExecutionResult, error)
 	GetExecutionResultByID(ctx context.Context, id flow.Identifier) (*flow.ExecutionResult, error)
+
+	// SubscribeBlocks
+
+	// SubscribeBlocksFromStartBlockID subscribes to the finalized or sealed blocks starting at the requested
+	// start block id, up until the latest available block. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block as it becomes available.
+	//
+	// Each block is filtered by the provided block status, and only
+	// those blocks that match the status are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - startBlockID: The identifier of the starting block.
+	// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+	//
+	// If invalid parameters will be supplied SubscribeBlocksFromStartBlockID will return a failed subscription.
+	SubscribeBlocksFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, blockStatus flow.BlockStatus) subscription.Subscription
+	// SubscribeBlocksFromStartHeight subscribes to the finalized or sealed blocks starting at the requested
+	// start block height, up until the latest available block. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block as it becomes available.
+	//
+	// Each block is filtered by the provided block status, and only
+	// those blocks that match the status are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - startHeight: The height of the starting block.
+	// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+	//
+	// If invalid parameters will be supplied SubscribeBlocksFromStartHeight will return a failed subscription.
+	SubscribeBlocksFromStartHeight(ctx context.Context, startHeight uint64, blockStatus flow.BlockStatus) subscription.Subscription
+	// SubscribeBlocksFromLatest subscribes to the finalized or sealed blocks starting at the latest sealed block,
+	// up until the latest available block. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block as it becomes available.
+	//
+	// Each block is filtered by the provided block status, and only
+	// those blocks that match the status are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+	//
+	// If invalid parameters will be supplied SubscribeBlocksFromLatest will return a failed subscription.
+	SubscribeBlocksFromLatest(ctx context.Context, blockStatus flow.BlockStatus) subscription.Subscription
+
+	// SubscribeHeaders
+
+	// SubscribeBlockHeadersFromStartBlockID streams finalized or sealed block headers starting at the requested
+	// start block id, up until the latest available block header. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block header as it becomes available.
+	//
+	// Each block header are filtered by the provided block status, and only
+	// those block headers that match the status are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - startBlockID: The identifier of the starting block.
+	// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+	//
+	// If invalid parameters will be supplied SubscribeBlockHeadersFromStartBlockID will return a failed subscription.
+	SubscribeBlockHeadersFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, blockStatus flow.BlockStatus) subscription.Subscription
+	// SubscribeBlockHeadersFromStartHeight streams finalized or sealed block headers starting at the requested
+	// start block height, up until the latest available block header. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block header as it becomes available.
+	//
+	// Each block header are filtered by the provided block status, and only
+	// those block headers that match the status are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - startHeight: The height of the starting block.
+	// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+	//
+	// If invalid parameters will be supplied SubscribeBlockHeadersFromStartHeight will return a failed subscription.
+	SubscribeBlockHeadersFromStartHeight(ctx context.Context, startHeight uint64, blockStatus flow.BlockStatus) subscription.Subscription
+	// SubscribeBlockHeadersFromLatest streams finalized or sealed block headers starting at the latest sealed block,
+	// up until the latest available block header. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block header as it becomes available.
+	//
+	// Each block header are filtered by the provided block status, and only
+	// those block headers that match the status are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+	//
+	// If invalid parameters will be supplied SubscribeBlockHeadersFromLatest will return a failed subscription.
+	SubscribeBlockHeadersFromLatest(ctx context.Context, blockStatus flow.BlockStatus) subscription.Subscription
+
+	// Subscribe digests
+
+	// SubscribeBlockDigestsFromStartBlockID streams finalized or sealed lightweight block starting at the requested
+	// start block id, up until the latest available block. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block as it becomes available.
+	//
+	// Each lightweight block are filtered by the provided block status, and only
+	// those blocks that match the status are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - startBlockID: The identifier of the starting block.
+	// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+	//
+	// If invalid parameters will be supplied SubscribeBlockDigestsFromStartBlockID will return a failed subscription.
+	SubscribeBlockDigestsFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, blockStatus flow.BlockStatus) subscription.Subscription
+	// SubscribeBlockDigestsFromStartHeight streams finalized or sealed lightweight block starting at the requested
+	// start block height, up until the latest available block. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block as it becomes available.
+	//
+	// Each lightweight block are filtered by the provided block status, and only
+	// those blocks that match the status are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - startHeight: The height of the starting block.
+	// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+	//
+	// If invalid parameters will be supplied SubscribeBlockDigestsFromStartHeight will return a failed subscription.
+	SubscribeBlockDigestsFromStartHeight(ctx context.Context, startHeight uint64, blockStatus flow.BlockStatus) subscription.Subscription
+	// SubscribeBlockDigestsFromLatest streams finalized or sealed lightweight block starting at the latest sealed block,
+	// up until the latest available block. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block as it becomes available.
+	//
+	// Each lightweight block are filtered by the provided block status, and only
+	// those blocks that match the status are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+	//
+	// If invalid parameters will be supplied SubscribeBlockDigestsFromLatest will return a failed subscription.
+	SubscribeBlockDigestsFromLatest(ctx context.Context, blockStatus flow.BlockStatus) subscription.Subscription
+	// SubscribeTransactionStatuses streams transaction statuses starting from the reference block saved in the
+	// transaction itself until the block containing the transaction becomes sealed or expired. When the transaction
+	// status becomes TransactionStatusSealed or TransactionStatusExpired, the subscription will automatically shut down.
+	SubscribeTransactionStatuses(ctx context.Context, tx *flow.TransactionBody) subscription.Subscription
 }
 
 // TODO: Combine this with flow.TransactionResult?
diff --git a/access/errors.go b/access/errors.go
index e23c7a7347b..d4103784919 100644
--- a/access/errors.go
+++ b/access/errors.go
@@ -90,3 +90,11 @@ type InvalidTxByteSizeError struct {
 func (e InvalidTxByteSizeError) Error() string {
 	return fmt.Sprintf("transaction byte size (%d) exceeds the maximum byte size allowed for a transaction (%d)", e.Actual, e.Maximum)
 }
+
+type InvalidTxRateLimitedError struct {
+	Payer flow.Address
+}
+
+func (e InvalidTxRateLimitedError) Error() string {
+	return fmt.Sprintf("transaction rate limited for payer (%s)", e.Payer)
+}
diff --git a/access/handler.go b/access/handler.go
index 8059cc9bd7b..a191f333662 100644
--- a/access/handler.go
+++ b/access/handler.go
@@ -5,9 +5,12 @@ import (
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/onflow/flow-go/consensus/hotstuff"
 	"github.com/onflow/flow-go/consensus/hotstuff/signature"
+	"github.com/onflow/flow-go/engine/access/subscription"
+	"github.com/onflow/flow-go/engine/common/rpc"
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module"
@@ -17,6 +20,7 @@ import (
 )
 
 type Handler struct {
+	subscription.StreamingData
 	api                  API
 	chain                flow.Chain
 	signerIndicesDecoder hotstuff.BlockSignerDecoder
@@ -29,8 +33,28 @@ type HandlerOption func(*Handler)
 
 var _ access.AccessAPIServer = (*Handler)(nil)
 
-func NewHandler(api API, chain flow.Chain, finalizedHeader module.FinalizedHeaderCache, me module.Local, options ...HandlerOption) *Handler {
+// sendSubscribeBlocksResponseFunc is a callback function used to send
+// SubscribeBlocksResponse to the client stream.
+type sendSubscribeBlocksResponseFunc func(*access.SubscribeBlocksResponse) error
+
+// sendSubscribeBlockHeadersResponseFunc is a callback function used to send
+// SubscribeBlockHeadersResponse to the client stream.
+type sendSubscribeBlockHeadersResponseFunc func(*access.SubscribeBlockHeadersResponse) error
+
+// sendSubscribeBlockDigestsResponseFunc is a callback function used to send
+// SubscribeBlockDigestsResponse to the client stream.
+type sendSubscribeBlockDigestsResponseFunc func(*access.SubscribeBlockDigestsResponse) error
+
+func NewHandler(
+	api API,
+	chain flow.Chain,
+	finalizedHeader module.FinalizedHeaderCache,
+	me module.Local,
+	maxStreams uint32,
+	options ...HandlerOption,
+) *Handler {
 	h := &Handler{
+		StreamingData:        subscription.NewStreamingData(maxStreams),
 		api:                  api,
 		chain:                chain,
 		finalizedHeaderCache: finalizedHeader,
@@ -684,9 +708,9 @@ func (h *Handler) GetExecutionResultForBlockID(ctx context.Context, req *access.
 func (h *Handler) GetExecutionResultByID(ctx context.Context, req *access.GetExecutionResultByIDRequest) (*access.ExecutionResultByIDResponse, error) {
 	metadata := h.buildMetadataResponse()
 
-	blockID := convert.MessageToIdentifier(req.GetId())
+	resultID := convert.MessageToIdentifier(req.GetId())
 
-	result, err := h.api.GetExecutionResultByID(ctx, blockID)
+	result, err := h.api.GetExecutionResultByID(ctx, resultID)
 	if err != nil {
 		return nil, err
 	}
@@ -701,6 +725,404 @@ func (h *Handler) GetExecutionResultByID(ctx context.Context, req *access.GetExe
 	}, nil
 }
 
+// SubscribeBlocksFromStartBlockID handles subscription requests for blocks started from block id.
+// It takes a SubscribeBlocksFromStartBlockIDRequest and an AccessAPI_SubscribeBlocksFromStartBlockIDServer stream as input.
+// The handler manages the subscription to block updates and sends the subscribed block information
+// to the client via the provided stream.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument - if invalid startBlockID provided or unknown block status provided.
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal - if stream encountered an error, if stream got unexpected response or could not convert block to message or could not send response.
+func (h *Handler) SubscribeBlocksFromStartBlockID(request *access.SubscribeBlocksFromStartBlockIDRequest, stream access.AccessAPI_SubscribeBlocksFromStartBlockIDServer) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	startBlockID, blockStatus, err := h.getSubscriptionDataFromStartBlockID(request.GetStartBlockId(), request.GetBlockStatus())
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeBlocksFromStartBlockID(stream.Context(), startBlockID, blockStatus)
+	return subscription.HandleSubscription(sub, h.handleBlocksResponse(stream.Send, request.GetFullBlockResponse(), blockStatus))
+}
+
+// SubscribeBlocksFromStartHeight handles subscription requests for blocks started from block height.
+// It takes a SubscribeBlocksFromStartHeightRequest and an AccessAPI_SubscribeBlocksFromStartHeightServer stream as input.
+// The handler manages the subscription to block updates and sends the subscribed block information
+// to the client via the provided stream.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument - if unknown block status provided.
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal - if stream encountered an error, if stream got unexpected response or could not convert block to message or could not send response.
+func (h *Handler) SubscribeBlocksFromStartHeight(request *access.SubscribeBlocksFromStartHeightRequest, stream access.AccessAPI_SubscribeBlocksFromStartHeightServer) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	blockStatus := convert.MessageToBlockStatus(request.GetBlockStatus())
+	err := checkBlockStatus(blockStatus)
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeBlocksFromStartHeight(stream.Context(), request.GetStartBlockHeight(), blockStatus)
+	return subscription.HandleSubscription(sub, h.handleBlocksResponse(stream.Send, request.GetFullBlockResponse(), blockStatus))
+}
+
+// SubscribeBlocksFromLatest handles subscription requests for blocks started from latest sealed block.
+// It takes a SubscribeBlocksFromLatestRequest and an AccessAPI_SubscribeBlocksFromLatestServer stream as input.
+// The handler manages the subscription to block updates and sends the subscribed block information
+// to the client via the provided stream.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument - if unknown block status provided.
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal - if stream encountered an error, if stream got unexpected response or could not convert block to message or could not send response.
+func (h *Handler) SubscribeBlocksFromLatest(request *access.SubscribeBlocksFromLatestRequest, stream access.AccessAPI_SubscribeBlocksFromLatestServer) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	blockStatus := convert.MessageToBlockStatus(request.GetBlockStatus())
+	err := checkBlockStatus(blockStatus)
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeBlocksFromLatest(stream.Context(), blockStatus)
+	return subscription.HandleSubscription(sub, h.handleBlocksResponse(stream.Send, request.GetFullBlockResponse(), blockStatus))
+}
+
+// handleBlocksResponse handles the subscription to block updates and sends
+// the subscribed block information to the client via the provided stream.
+//
+// Parameters:
+// - send: The function responsible for sending the block response to the client.
+// - fullBlockResponse: A boolean indicating whether to include full block responses.
+// - blockStatus: The current block status.
+//
+// Returns a function that can be used as a callback for block updates.
+//
+// This function is designed to be used as a callback for block updates in a subscription.
+// It takes a block, processes it, and sends the corresponding response to the client using the provided send function.
+//
+// Expected errors during normal operation:
+//   - codes.Internal: If cannot convert a block to a message or the stream could not send a response.
+func (h *Handler) handleBlocksResponse(send sendSubscribeBlocksResponseFunc, fullBlockResponse bool, blockStatus flow.BlockStatus) func(*flow.Block) error {
+	return func(block *flow.Block) error {
+		msgBlockResponse, err := h.blockResponse(block, fullBlockResponse, blockStatus)
+		if err != nil {
+			return rpc.ConvertError(err, "could not convert block to message", codes.Internal)
+		}
+
+		err = send(&access.SubscribeBlocksResponse{
+			Block: msgBlockResponse.Block,
+		})
+		if err != nil {
+			return rpc.ConvertError(err, "could not send response", codes.Internal)
+		}
+
+		return nil
+	}
+}
+
+// SubscribeBlockHeadersFromStartBlockID handles subscription requests for block headers started from block id.
+// It takes a SubscribeBlockHeadersFromStartBlockIDRequest and an AccessAPI_SubscribeBlockHeadersFromStartBlockIDServer stream as input.
+// The handler manages the subscription to block updates and sends the subscribed block header information
+// to the client via the provided stream.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument - if invalid startBlockID provided or unknown block status provided.
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal - if stream encountered an error, if stream got unexpected response or could not convert block header to message or could not send response.
+func (h *Handler) SubscribeBlockHeadersFromStartBlockID(request *access.SubscribeBlockHeadersFromStartBlockIDRequest, stream access.AccessAPI_SubscribeBlockHeadersFromStartBlockIDServer) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	startBlockID, blockStatus, err := h.getSubscriptionDataFromStartBlockID(request.GetStartBlockId(), request.GetBlockStatus())
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeBlockHeadersFromStartBlockID(stream.Context(), startBlockID, blockStatus)
+	return subscription.HandleSubscription(sub, h.handleBlockHeadersResponse(stream.Send))
+}
+
+// SubscribeBlockHeadersFromStartHeight handles subscription requests for block headers started from block height.
+// It takes a SubscribeBlockHeadersFromStartHeightRequest and an AccessAPI_SubscribeBlockHeadersFromStartHeightServer stream as input.
+// The handler manages the subscription to block updates and sends the subscribed block header information
+// to the client via the provided stream.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument - if unknown block status provided.
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal - if stream encountered an error, if stream got unexpected response or could not convert block header to message or could not send response.
+func (h *Handler) SubscribeBlockHeadersFromStartHeight(request *access.SubscribeBlockHeadersFromStartHeightRequest, stream access.AccessAPI_SubscribeBlockHeadersFromStartHeightServer) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	blockStatus := convert.MessageToBlockStatus(request.GetBlockStatus())
+	err := checkBlockStatus(blockStatus)
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeBlockHeadersFromStartHeight(stream.Context(), request.GetStartBlockHeight(), blockStatus)
+	return subscription.HandleSubscription(sub, h.handleBlockHeadersResponse(stream.Send))
+}
+
+// SubscribeBlockHeadersFromLatest handles subscription requests for block headers started from latest sealed block.
+// It takes a SubscribeBlockHeadersFromLatestRequest and an AccessAPI_SubscribeBlockHeadersFromLatestServer stream as input.
+// The handler manages the subscription to block updates and sends the subscribed block header information
+// to the client via the provided stream.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument - if unknown block status provided.
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal - if stream encountered an error, if stream got unexpected response or could not convert block header to message or could not send response.
+func (h *Handler) SubscribeBlockHeadersFromLatest(request *access.SubscribeBlockHeadersFromLatestRequest, stream access.AccessAPI_SubscribeBlockHeadersFromLatestServer) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	blockStatus := convert.MessageToBlockStatus(request.GetBlockStatus())
+	err := checkBlockStatus(blockStatus)
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeBlockHeadersFromLatest(stream.Context(), blockStatus)
+	return subscription.HandleSubscription(sub, h.handleBlockHeadersResponse(stream.Send))
+}
+
+// handleBlockHeadersResponse handles the subscription to block updates and sends
+// the subscribed block header information to the client via the provided stream.
+//
+// Parameters:
+// - send: The function responsible for sending the block header response to the client.
+//
+// Returns a function that can be used as a callback for block header updates.
+//
+// This function is designed to be used as a callback for block header updates in a subscription.
+// It takes a block header, processes it, and sends the corresponding response to the client using the provided send function.
+//
+// Expected errors during normal operation:
+//   - codes.Internal: If could not decode the signer indices from the given block header, could not convert a block header to a message or the stream could not send a response.
+func (h *Handler) handleBlockHeadersResponse(send sendSubscribeBlockHeadersResponseFunc) func(*flow.Header) error {
+	return func(header *flow.Header) error {
+		signerIDs, err := h.signerIndicesDecoder.DecodeSignerIDs(header)
+		if err != nil {
+			return rpc.ConvertError(err, "could not decode the signer indices from the given block header", codes.Internal) // the block was retrieved from local storage - so no errors are expected
+		}
+
+		msgHeader, err := convert.BlockHeaderToMessage(header, signerIDs)
+		if err != nil {
+			return rpc.ConvertError(err, "could not convert block header to message", codes.Internal)
+		}
+
+		err = send(&access.SubscribeBlockHeadersResponse{
+			Header: msgHeader,
+		})
+		if err != nil {
+			return rpc.ConvertError(err, "could not send response", codes.Internal)
+		}
+
+		return nil
+	}
+}
+
+// SubscribeBlockDigestsFromStartBlockID streams finalized or sealed lightweight block starting at the requested block id.
+// It takes a SubscribeBlockDigestsFromStartBlockIDRequest and an AccessAPI_SubscribeBlockDigestsFromStartBlockIDServer stream as input.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument - if invalid startBlockID provided or unknown block status provided,
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal - if stream encountered an error, if stream got unexpected response or could not convert block to message or could not send response.
+func (h *Handler) SubscribeBlockDigestsFromStartBlockID(request *access.SubscribeBlockDigestsFromStartBlockIDRequest, stream access.AccessAPI_SubscribeBlockDigestsFromStartBlockIDServer) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	startBlockID, blockStatus, err := h.getSubscriptionDataFromStartBlockID(request.GetStartBlockId(), request.GetBlockStatus())
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeBlockDigestsFromStartBlockID(stream.Context(), startBlockID, blockStatus)
+	return subscription.HandleSubscription(sub, h.handleBlockDigestsResponse(stream.Send))
+}
+
+// SubscribeBlockDigestsFromStartHeight handles subscription requests for lightweight blocks started from block height.
+// It takes a SubscribeBlockDigestsFromStartHeightRequest and an AccessAPI_SubscribeBlockDigestsFromStartHeightServer stream as input.
+// The handler manages the subscription to block updates and sends the subscribed block information
+// to the client via the provided stream.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument - if unknown block status provided.
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal - if stream encountered an error, if stream got unexpected response or could not convert block to message or could not send response.
+func (h *Handler) SubscribeBlockDigestsFromStartHeight(request *access.SubscribeBlockDigestsFromStartHeightRequest, stream access.AccessAPI_SubscribeBlockDigestsFromStartHeightServer) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	blockStatus := convert.MessageToBlockStatus(request.GetBlockStatus())
+	err := checkBlockStatus(blockStatus)
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeBlockDigestsFromStartHeight(stream.Context(), request.GetStartBlockHeight(), blockStatus)
+	return subscription.HandleSubscription(sub, h.handleBlockDigestsResponse(stream.Send))
+}
+
+// SubscribeBlockDigestsFromLatest handles subscription requests for lightweight block started from latest sealed block.
+// It takes a SubscribeBlockDigestsFromLatestRequest and an AccessAPI_SubscribeBlockDigestsFromLatestServer stream as input.
+// The handler manages the subscription to block updates and sends the subscribed block header information
+// to the client via the provided stream.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument - if unknown block status provided.
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal - if stream encountered an error, if stream got unexpected response or could not convert block to message or could not send response.
+func (h *Handler) SubscribeBlockDigestsFromLatest(request *access.SubscribeBlockDigestsFromLatestRequest, stream access.AccessAPI_SubscribeBlockDigestsFromLatestServer) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	blockStatus := convert.MessageToBlockStatus(request.GetBlockStatus())
+	err := checkBlockStatus(blockStatus)
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeBlockDigestsFromLatest(stream.Context(), blockStatus)
+	return subscription.HandleSubscription(sub, h.handleBlockDigestsResponse(stream.Send))
+}
+
+// handleBlockDigestsResponse handles the subscription to block updates and sends
+// the subscribed block digest information to the client via the provided stream.
+//
+// Parameters:
+// - send: The function responsible for sending the block digest response to the client.
+//
+// Returns a function that can be used as a callback for block digest updates.
+//
+// This function is designed to be used as a callback for block digest updates in a subscription.
+// It takes a block digest, processes it, and sends the corresponding response to the client using the provided send function.
+//
+// Expected errors during normal operation:
+//   - codes.Internal: if the stream cannot send a response.
+func (h *Handler) handleBlockDigestsResponse(send sendSubscribeBlockDigestsResponseFunc) func(*flow.BlockDigest) error {
+	return func(blockDigest *flow.BlockDigest) error {
+		err := send(&access.SubscribeBlockDigestsResponse{
+			BlockId:        convert.IdentifierToMessage(blockDigest.ID()),
+			BlockHeight:    blockDigest.Height,
+			BlockTimestamp: timestamppb.New(blockDigest.Timestamp),
+		})
+		if err != nil {
+			return rpc.ConvertError(err, "could not send response", codes.Internal)
+		}
+
+		return nil
+	}
+}
+
+// getSubscriptionDataFromStartBlockID processes subscription start data from start block id.
+// It takes a union representing the start block id and a BlockStatus from the entities package.
+// Performs validation of input data and returns it in expected format for further processing.
+//
+// Returns:
+// - flow.Identifier: The start block id for searching.
+// - flow.BlockStatus: Block status.
+// - error: An error indicating the result of the operation, if any.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument: If blockStatus is flow.BlockStatusUnknown, or startBlockID could not convert to flow.Identifier.
+func (h *Handler) getSubscriptionDataFromStartBlockID(msgBlockId []byte, msgBlockStatus entities.BlockStatus) (flow.Identifier, flow.BlockStatus, error) {
+	startBlockID, err := convert.BlockID(msgBlockId)
+	if err != nil {
+		return flow.ZeroID, flow.BlockStatusUnknown, err
+	}
+
+	blockStatus := convert.MessageToBlockStatus(msgBlockStatus)
+	err = checkBlockStatus(blockStatus)
+	if err != nil {
+		return flow.ZeroID, flow.BlockStatusUnknown, err
+	}
+
+	return startBlockID, blockStatus, nil
+}
+
+// SendAndSubscribeTransactionStatuses streams transaction statuses starting from the reference block saved in the
+// transaction itself until the block containing the transaction becomes sealed or expired. When the transaction
+// status becomes TransactionStatusSealed or TransactionStatusExpired, the subscription will automatically shut down.
+func (h *Handler) SendAndSubscribeTransactionStatuses(
+	request *access.SendAndSubscribeTransactionStatusesRequest,
+	stream access.AccessAPI_SendAndSubscribeTransactionStatusesServer,
+) error {
+	ctx := stream.Context()
+
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	tx, err := convert.MessageToTransaction(request.GetTransaction(), h.chain)
+	if err != nil {
+		return status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	err = h.api.SendTransaction(ctx, &tx)
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeTransactionStatuses(ctx, &tx)
+	return subscription.HandleSubscription(sub, func(txSubInfo *convert.TransactionSubscribeInfo) error {
+		err = stream.Send(convert.TransactionSubscribeInfoToMessage(txSubInfo))
+		if err != nil {
+			return rpc.ConvertError(err, "could not send response", codes.Internal)
+		}
+
+		return nil
+	})
+}
+
 func (h *Handler) blockResponse(block *flow.Block, fullResponse bool, status flow.BlockStatus) (*access.BlockResponse, error) {
 	metadata := h.buildMetadataResponse()
 
@@ -713,7 +1135,7 @@ func (h *Handler) blockResponse(block *flow.Block, fullResponse bool, status flo
 	if fullResponse {
 		msg, err = convert.BlockToMessage(block, signerIDs)
 		if err != nil {
-			return nil, err
+			return nil, rpc.ConvertError(err, "could not convert block to message", codes.Internal)
 		}
 	} else {
 		msg = convert.BlockToMessageLight(block)
@@ -736,7 +1158,7 @@ func (h *Handler) blockHeaderResponse(header *flow.Header, status flow.BlockStat
 
 	msg, err := convert.BlockHeaderToMessage(header, signerIDs)
 	if err != nil {
-		return nil, err
+		return nil, rpc.ConvertError(err, "could not convert block header to message", codes.Internal)
 	}
 
 	return &access.BlockHeaderResponse{
@@ -777,3 +1199,14 @@ func WithBlockSignerDecoder(signerIndicesDecoder hotstuff.BlockSignerDecoder) fu
 		handler.signerIndicesDecoder = signerIndicesDecoder
 	}
 }
+
+// checkBlockStatus checks the validity of the provided block status.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument - if blockStatus is flow.BlockStatusUnknown
+func checkBlockStatus(blockStatus flow.BlockStatus) error {
+	if blockStatus != flow.BlockStatusFinalized && blockStatus != flow.BlockStatusSealed {
+		return status.Errorf(codes.InvalidArgument, "block status is unknown. Possible variants: BLOCK_FINALIZED, BLOCK_SEALED")
+	}
+	return nil
+}
diff --git a/access/mock/api.go b/access/mock/api.go
index 0e9fc6a0919..b27e8a03580 100644
--- a/access/mock/api.go
+++ b/access/mock/api.go
@@ -12,6 +12,8 @@ import (
 	flow "github.com/onflow/flow-go/model/flow"
 
 	mock "github.com/stretchr/testify/mock"
+
+	subscription "github.com/onflow/flow-go/engine/access/subscription"
 )
 
 // API is an autogenerated mock type for the API type
@@ -831,6 +833,166 @@ func (_m *API) SendTransaction(ctx context.Context, tx *flow.TransactionBody) er
 	return r0
 }
 
+// SubscribeBlockDigestsFromLatest provides a mock function with given fields: ctx, blockStatus
+func (_m *API) SubscribeBlockDigestsFromLatest(ctx context.Context, blockStatus flow.BlockStatus) subscription.Subscription {
+	ret := _m.Called(ctx, blockStatus)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, flow.BlockStatus) subscription.Subscription); ok {
+		r0 = rf(ctx, blockStatus)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeBlockDigestsFromStartBlockID provides a mock function with given fields: ctx, startBlockID, blockStatus
+func (_m *API) SubscribeBlockDigestsFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, blockStatus flow.BlockStatus) subscription.Subscription {
+	ret := _m.Called(ctx, startBlockID, blockStatus)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, flow.Identifier, flow.BlockStatus) subscription.Subscription); ok {
+		r0 = rf(ctx, startBlockID, blockStatus)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeBlockDigestsFromStartHeight provides a mock function with given fields: ctx, startHeight, blockStatus
+func (_m *API) SubscribeBlockDigestsFromStartHeight(ctx context.Context, startHeight uint64, blockStatus flow.BlockStatus) subscription.Subscription {
+	ret := _m.Called(ctx, startHeight, blockStatus)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, uint64, flow.BlockStatus) subscription.Subscription); ok {
+		r0 = rf(ctx, startHeight, blockStatus)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeBlockHeadersFromLatest provides a mock function with given fields: ctx, blockStatus
+func (_m *API) SubscribeBlockHeadersFromLatest(ctx context.Context, blockStatus flow.BlockStatus) subscription.Subscription {
+	ret := _m.Called(ctx, blockStatus)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, flow.BlockStatus) subscription.Subscription); ok {
+		r0 = rf(ctx, blockStatus)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeBlockHeadersFromStartBlockID provides a mock function with given fields: ctx, startBlockID, blockStatus
+func (_m *API) SubscribeBlockHeadersFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, blockStatus flow.BlockStatus) subscription.Subscription {
+	ret := _m.Called(ctx, startBlockID, blockStatus)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, flow.Identifier, flow.BlockStatus) subscription.Subscription); ok {
+		r0 = rf(ctx, startBlockID, blockStatus)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeBlockHeadersFromStartHeight provides a mock function with given fields: ctx, startHeight, blockStatus
+func (_m *API) SubscribeBlockHeadersFromStartHeight(ctx context.Context, startHeight uint64, blockStatus flow.BlockStatus) subscription.Subscription {
+	ret := _m.Called(ctx, startHeight, blockStatus)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, uint64, flow.BlockStatus) subscription.Subscription); ok {
+		r0 = rf(ctx, startHeight, blockStatus)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeBlocksFromLatest provides a mock function with given fields: ctx, blockStatus
+func (_m *API) SubscribeBlocksFromLatest(ctx context.Context, blockStatus flow.BlockStatus) subscription.Subscription {
+	ret := _m.Called(ctx, blockStatus)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, flow.BlockStatus) subscription.Subscription); ok {
+		r0 = rf(ctx, blockStatus)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeBlocksFromStartBlockID provides a mock function with given fields: ctx, startBlockID, blockStatus
+func (_m *API) SubscribeBlocksFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, blockStatus flow.BlockStatus) subscription.Subscription {
+	ret := _m.Called(ctx, startBlockID, blockStatus)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, flow.Identifier, flow.BlockStatus) subscription.Subscription); ok {
+		r0 = rf(ctx, startBlockID, blockStatus)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeBlocksFromStartHeight provides a mock function with given fields: ctx, startHeight, blockStatus
+func (_m *API) SubscribeBlocksFromStartHeight(ctx context.Context, startHeight uint64, blockStatus flow.BlockStatus) subscription.Subscription {
+	ret := _m.Called(ctx, startHeight, blockStatus)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, uint64, flow.BlockStatus) subscription.Subscription); ok {
+		r0 = rf(ctx, startHeight, blockStatus)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeTransactionStatuses provides a mock function with given fields: ctx, tx
+func (_m *API) SubscribeTransactionStatuses(ctx context.Context, tx *flow.TransactionBody) subscription.Subscription {
+	ret := _m.Called(ctx, tx)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, *flow.TransactionBody) subscription.Subscription); ok {
+		r0 = rf(ctx, tx)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
 type mockConstructorTestingTNewAPI interface {
 	mock.TestingT
 	Cleanup(func())
diff --git a/access/validator.go b/access/validator.go
index b59a1539b95..f85881c3414 100644
--- a/access/validator.go
+++ b/access/validator.go
@@ -42,6 +42,25 @@ func (b *ProtocolStateBlocks) FinalizedHeader() (*flow.Header, error) {
 	return b.state.Final().Head()
 }
 
+// RateLimiter is an interface for checking if an address is rate limited.
+// By convention, the address used is the payer field of a transaction.
+// This rate limiter is applied when a transaction is first received by a
+// node, meaning that if a transaction is rate-limited it will be dropped.
+type RateLimiter interface {
+	// IsRateLimited returns true if the address is rate limited
+	IsRateLimited(address flow.Address) bool
+}
+
+type NoopLimiter struct{}
+
+func NewNoopLimiter() *NoopLimiter {
+	return &NoopLimiter{}
+}
+
+func (l *NoopLimiter) IsRateLimited(address flow.Address) bool {
+	return false
+}
+
 type TransactionValidationOptions struct {
 	Expiry                       uint
 	ExpiryBuffer                 uint
@@ -58,6 +77,7 @@ type TransactionValidator struct {
 	chain                 flow.Chain // for checking validity of addresses
 	options               TransactionValidationOptions
 	serviceAccountAddress flow.Address
+	limiter               RateLimiter
 }
 
 func NewTransactionValidator(
@@ -70,10 +90,35 @@ func NewTransactionValidator(
 		chain:                 chain,
 		options:               options,
 		serviceAccountAddress: chain.ServiceAddress(),
+		limiter:               NewNoopLimiter(),
+	}
+}
+
+func NewTransactionValidatorWithLimiter(
+	blocks Blocks,
+	chain flow.Chain,
+	options TransactionValidationOptions,
+	rateLimiter RateLimiter,
+) *TransactionValidator {
+	return &TransactionValidator{
+		blocks:                blocks,
+		chain:                 chain,
+		options:               options,
+		serviceAccountAddress: chain.ServiceAddress(),
+		limiter:               rateLimiter,
 	}
 }
 
 func (v *TransactionValidator) Validate(tx *flow.TransactionBody) (err error) {
+	// rate limit transactions for specific payers.
+	// a short term solution to prevent attacks that send too many failed transactions
+	// if a transaction is from a payer that should be rate limited, all the following
+	// checks will be skipped
+	err = v.checkRateLimitPayer(tx)
+	if err != nil {
+		return err
+	}
+
 	err = v.checkTxSizeLimit(tx)
 	if err != nil {
 		return err
@@ -119,6 +164,15 @@ func (v *TransactionValidator) Validate(tx *flow.TransactionBody) (err error) {
 	return nil
 }
 
+func (v *TransactionValidator) checkRateLimitPayer(tx *flow.TransactionBody) error {
+	if v.limiter.IsRateLimited(tx.Payer) {
+		return InvalidTxRateLimitedError{
+			Payer: tx.Payer,
+		}
+	}
+	return nil
+}
+
 func (v *TransactionValidator) checkTxSizeLimit(tx *flow.TransactionBody) error {
 	txSize := uint64(tx.ByteSize())
 	// first check compatibility to collection byte size
diff --git a/admin/README.md b/admin/README.md
index 7e4e5831aa2..9da63d0831e 100644
--- a/admin/README.md
+++ b/admin/README.md
@@ -95,3 +95,23 @@ curl localhost:9002/admin/run_command -H 'Content-Type: application/json' -d '{"
 ```
 curl localhost:9002/admin/run_command -H 'Content-Type: application/json' -d '{"commandName": "stop-at-height", "data": { "height": 1111, "crash": false }}'
 ```
+
+### Trigger checkpoint creation on execution
+```
+curl localhost:9002/admin/run_command -H 'Content-Type: application/json' -d '{"commandName": "trigger-checkpoint"}'
+```
+
+### Add/Remove/Get address to rate limit a payer from adding transactions to collection nodes' mempool
+```
+curl localhost:9002/admin/run_command -H 'Content-Type: application/json' -d '{"commandName": "ingest-tx-rate-limit", "data": { "command": "add", "addresses": "a08d349e8037d6e5,e6765c6113547fb7" }}'
+curl localhost:9002/admin/run_command -H 'Content-Type: application/json' -d '{"commandName": "ingest-tx-rate-limit", "data": { "command": "remove", "addresses": "a08d349e8037d6e5,e6765c6113547fb7" }}'
+curl localhost:9002/admin/run_command -H 'Content-Type: application/json' -d '{"commandName": "ingest-tx-rate-limit", "data": { "command": "get" }}'
+curl localhost:9002/admin/run_command -H 'Content-Type: application/json' -d '{"commandName": "ingest-tx-rate-limit", "data": { "command": "get_config" }}'
+curl localhost:9002/admin/run_command -H 'Content-Type: application/json' -d '{"commandName": "ingest-tx-rate-limit", "data": { "command": "set_config", "limit": 1, "burst": 1 }}'
+```
+
+### To create a protocol snapshot for latest checkpoint (execution node only)
+```
+curl localhost:9002/admin/run_command -H 'Content-Type: application/json' -d '{"commandName": "protocol-snapshot"}'
+curl localhost:9002/admin/run_command -H 'Content-Type: application/json' -d '{"commandName": "protocol-snapshot", "data": { "blocks-to-skip": 10 }}'
+```
diff --git a/admin/command_runner.go b/admin/command_runner.go
index c827fb5ff4c..d0d39fd6c92 100644
--- a/admin/command_runner.go
+++ b/admin/command_runner.go
@@ -239,6 +239,7 @@ func (r *CommandRunner) runAdminServer(ctx irrecoverable.SignalerContext) error
 	for _, name := range []string{"allocs", "block", "goroutine", "heap", "mutex", "threadcreate"} {
 		mux.HandleFunc(fmt.Sprintf("/debug/pprof/%s", name), pprof.Handler(name).ServeHTTP)
 	}
+	mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
 	mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
 
 	httpServer := &http.Server{
diff --git a/admin/commands/collection/tx_rate_limiter.go b/admin/commands/collection/tx_rate_limiter.go
new file mode 100644
index 00000000000..c767f080156
--- /dev/null
+++ b/admin/commands/collection/tx_rate_limiter.go
@@ -0,0 +1,122 @@
+package collection
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/rs/zerolog/log"
+	"golang.org/x/time/rate"
+
+	"github.com/onflow/flow-go/admin"
+	"github.com/onflow/flow-go/admin/commands"
+	"github.com/onflow/flow-go/engine/collection/ingest"
+)
+
+var _ commands.AdminCommand = (*TxRateLimitCommand)(nil)
+
+// TxRateLimitCommand will adjust the transaction ingest rate limiter.
+type TxRateLimitCommand struct {
+	limiter *ingest.AddressRateLimiter
+}
+
+type TxRateLimitCommandAddress struct {
+	Addresses []string
+}
+
+func NewTxRateLimitCommand(limiter *ingest.AddressRateLimiter) *TxRateLimitCommand {
+	return &TxRateLimitCommand{
+		limiter: limiter,
+	}
+}
+
+func (s *TxRateLimitCommand) Handler(_ context.Context, req *admin.CommandRequest) (interface{}, error) {
+	input, ok := req.Data.(map[string]interface{})
+	if !ok {
+		return admin.NewInvalidAdminReqFormatError("expected { \"command\": \"add|remove|get|get_config|set_config\", \"addresses\": \"addresses\""), nil
+	}
+
+	command, ok := input["command"]
+	if !ok {
+		return admin.NewInvalidAdminReqErrorf("the \"command\" field is empty, must be one of add|remove|get|get_config|set_config"), nil
+	}
+
+	cmd, ok := command.(string)
+	if !ok {
+		return admin.NewInvalidAdminReqErrorf("the \"command\" field is not string, must be one of add|remove|get|get_config|set_config"), nil
+	}
+
+	if cmd == "get" {
+		list := s.limiter.GetAddresses()
+		return fmt.Sprintf("rate limited list contains a total of %d addresses: %v", len(list), list), nil
+	}
+
+	if cmd == "add" || cmd == "remove" {
+		result, ok := input["addresses"]
+		if !ok {
+			return admin.NewInvalidAdminReqErrorf("the \"addresses\" field is empty, must be hex formated addresses, can be splitted by \",\""), nil
+		}
+		addresses, ok := result.(string)
+		if !ok {
+			return admin.NewInvalidAdminReqErrorf("the \"addresses\" field is not string, must be hex formated addresses, can be splitted by \",\""), nil
+		}
+
+		log.Info().Msgf("admintool %v addresses: %v", cmd, addresses)
+
+		resp, err := s.AddOrRemove(cmd, addresses)
+		if err != nil {
+			return nil, err
+		}
+		return resp, nil
+	}
+
+	if cmd == "get_config" {
+		limit, burst := s.limiter.GetLimitConfig()
+		return fmt.Sprintf("limit: %v, burst: %v", limit, burst), nil
+	}
+
+	if cmd == "set_config" {
+		dataLimit, limit_ok := input["limit"]
+		dataBurst, burst_ok := input["burst"]
+		if !burst_ok || !limit_ok {
+			return admin.NewInvalidAdminReqErrorf("the \"limit\" or \"burst\" field is empty, must be number"), nil
+		}
+		limit, ok := dataLimit.(float64)
+		if !ok {
+			return admin.NewInvalidAdminReqErrorf("the \"limit\" field is not number: %v", dataLimit), nil
+		}
+
+		burst, ok := dataBurst.(float64)
+		if !ok {
+			return admin.NewInvalidAdminReqErrorf("the \"burst\" field is not number: %v", dataBurst), nil
+		}
+
+		oldLimit, oldBurst := s.limiter.GetLimitConfig()
+		log.Info().Msgf("admintool set_config limit: %v, burst: %v, old limit: %v, old burst: %v", limit, burst, oldLimit, oldBurst)
+		s.limiter.SetLimitConfig(rate.Limit(limit), int(burst))
+		return fmt.Sprintf("succesfully set limit %v, burst %v", limit, burst), nil
+	}
+
+	return fmt.Sprintf(
+		"invalid command field (%s), must be either \"add\" or \"remove\" or \"get\" or \"get_config\" or \"set_config\"",
+		cmd), nil
+}
+
+func (s *TxRateLimitCommand) Validator(req *admin.CommandRequest) error {
+	return nil
+}
+
+func (s *TxRateLimitCommand) AddOrRemove(command string, addresses string) (string, error) {
+	addrList, err := ingest.ParseAddresses(addresses)
+	if err != nil {
+		return "", err
+	}
+
+	if command == "add" {
+		ingest.AddAddresses(s.limiter, addrList)
+		return fmt.Sprintf("added %d addresses", len(addrList)), nil
+	}
+
+	// command == "remove"
+	ingest.RemoveAddresses(s.limiter, addrList)
+	return fmt.Sprintf("removed %d addresses", len(addrList)), nil
+}
diff --git a/admin/commands/storage/read_protocol_snapshot.go b/admin/commands/storage/read_protocol_snapshot.go
new file mode 100644
index 00000000000..738e6409936
--- /dev/null
+++ b/admin/commands/storage/read_protocol_snapshot.go
@@ -0,0 +1,121 @@
+package storage
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/admin"
+	"github.com/onflow/flow-go/admin/commands"
+	"github.com/onflow/flow-go/cmd/util/common"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/state/protocol/inmem"
+	"github.com/onflow/flow-go/storage"
+	"github.com/onflow/flow-go/utils/logging"
+)
+
+var _ commands.AdminCommand = (*ProtocolSnapshotCommand)(nil)
+
+type protocolSnapshotData struct {
+	blocksToSkip uint
+}
+
+// ProtocolSnapshotCommand is a command that generates a protocol snapshot for a checkpoint (usually latest checkpoint)
+// This command is only available for execution node
+type ProtocolSnapshotCommand struct {
+	logger        zerolog.Logger
+	state         protocol.State
+	headers       storage.Headers
+	seals         storage.Seals
+	checkpointDir string // the directory where the checkpoint is stored
+}
+
+func NewProtocolSnapshotCommand(
+	logger zerolog.Logger,
+	state protocol.State,
+	headers storage.Headers,
+	seals storage.Seals,
+	checkpointDir string,
+) *ProtocolSnapshotCommand {
+	return &ProtocolSnapshotCommand{
+		logger:        logger,
+		state:         state,
+		headers:       headers,
+		seals:         seals,
+		checkpointDir: checkpointDir,
+	}
+}
+
+func (s *ProtocolSnapshotCommand) Handler(_ context.Context, req *admin.CommandRequest) (interface{}, error) {
+	validated, ok := req.ValidatorData.(*protocolSnapshotData)
+	if !ok {
+		return nil, fmt.Errorf("fail to parse validator data")
+	}
+
+	blocksToSkip := validated.blocksToSkip
+
+	s.logger.Info().Uint("blocksToSkip", blocksToSkip).Msgf("admintool: generating protocol snapshot")
+
+	snapshot, sealedHeight, commit, checkpointFile, err := common.GenerateProtocolSnapshotForCheckpoint(
+		s.logger, s.state, s.headers, s.seals, s.checkpointDir, blocksToSkip)
+	if err != nil {
+		return nil, fmt.Errorf("could not generate protocol snapshot for checkpoint, checkpointDir %v: %w",
+			s.checkpointDir, err)
+	}
+
+	header, err := snapshot.Head()
+	if err != nil {
+		return nil, fmt.Errorf("could not get header from snapshot: %w", err)
+	}
+
+	serializable, err := inmem.FromSnapshot(snapshot)
+	if err != nil {
+		return nil, fmt.Errorf("could not convert snapshot to serializable: %w", err)
+	}
+
+	s.logger.Info().
+		Uint64("finalized_height", header.Height). // finalized height
+		Hex("finalized_block_id", logging.Entity(header)).
+		Uint64("sealed_height", sealedHeight).
+		Hex("sealed_commit", commit[:]). // not the commit for the finalized height, but for the sealed height
+		Str("checkpoint_file", checkpointFile).
+		Uint("blocks_to_skip", blocksToSkip).
+		Msgf("admintool: protocol snapshot generated successfully")
+
+	return commands.ConvertToMap(protocolSnapshotResponse{
+		Snapshot:   serializable.Encodable(),
+		Checkpoint: checkpointFile,
+	})
+}
+
+type protocolSnapshotResponse struct {
+	Snapshot   inmem.EncodableSnapshot `json:"snapshot"`
+	Checkpoint string                  `json:"checkpoint"`
+}
+
+func (s *ProtocolSnapshotCommand) Validator(req *admin.CommandRequest) error {
+	// blocksToSkip is the number of blocks to skip when iterating the sealed heights to find the state commitment
+	// in the checkpoint file.
+	// default is 0
+	validated := &protocolSnapshotData{
+		blocksToSkip: uint(0),
+	}
+
+	input, ok := req.Data.(map[string]interface{})
+	if ok {
+		data, ok := input["blocks-to-skip"]
+
+		if ok {
+			n, ok := data.(float64)
+			if !ok {
+				return fmt.Errorf("could not parse blocks-to-skip: %v", data)
+			}
+			validated.blocksToSkip = uint(n)
+		}
+	}
+
+	req.ValidatorData = validated
+
+	return nil
+}
diff --git a/cmd/Dockerfile b/cmd/Dockerfile
index 4689dadb265..ba858d12b9c 100644
--- a/cmd/Dockerfile
+++ b/cmd/Dockerfile
@@ -6,7 +6,7 @@
 FROM golang:1.20-bullseye AS build-setup
 
 RUN apt-get update
-RUN apt-get -y install zip
+RUN apt-get -y install zip apt-utils gcc-aarch64-linux-gnu
 
 ## (2) Setup crypto dependencies
 FROM build-setup AS build-env
@@ -36,11 +36,12 @@ FROM build-env as build-production
 WORKDIR /app
 
 ARG GOARCH=amd64
-
 # TAGS can be overriden to modify the go build tags (e.g. build without netgo)
 ARG TAGS="netgo"
-# CGO_FLAG can be overwritten
-ARG CGO_FLAG
+# CC flag can be overwritten to specify a C compiler
+ARG CC=""
+# CGO_FLAG uses ADX instructions by default, flag can be overwritten to build without ADX
+ARG CGO_FLAG=""
 
 # Keep Go's build cache between builds.
 # https://github.com/golang/go/issues/27719#issuecomment-514747274
@@ -50,7 +51,7 @@ RUN --mount=type=cache,sharing=locked,target=/go/pkg/mod \
     # We evaluate the SSH agent to safely pass in a key for cloning dependencies
     # We explicitly use ";" rather than && as we want to safely pass if it is unavailable
     eval `ssh-agent -s` && printf "%s\n" "$(cat /run/secrets/cadence_deploy_key)" | ssh-add - ; \
-    CGO_ENABLED=1 GOOS=linux CGO_FLAGS="${CGO_FLAG}" go build --tags "${TAGS}" -ldflags "-extldflags -static \
+    CGO_ENABLED=1 GOOS=linux GOARCH=${GOARCH} CC="${CC}" CGO_CFLAGS="${CGO_FLAG}" go build --tags "${TAGS}" -ldflags "-extldflags -static \
     -X 'github.com/onflow/flow-go/cmd/build.commit=${COMMIT}' -X  'github.com/onflow/flow-go/cmd/build.semver=${VERSION}'" \
     -o ./app ${TARGET}
 
@@ -68,7 +69,8 @@ ENTRYPOINT ["/bin/app"]
 FROM build-env as build-debug
 WORKDIR /app
 ARG GOARCH=amd64
-
+ARG CC=""
+ARG CGO_FLAG=""
 RUN --mount=type=ssh \
     --mount=type=cache,sharing=locked,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
@@ -76,7 +78,7 @@ RUN --mount=type=ssh \
     # We evaluate the SSH agent to safely pass in a key for cloning dependencies
     # We explicitly use ";" rather than && as we want to safely pass if it is unavailable
     eval `ssh-agent -s` && printf "%s\n" "$(cat /run/secrets/cadence_deploy_key)" | ssh-add - ; \
-    CGO_ENABLED=1 GOOS=linux CGO_FLAGS="${CGO_FLAG}" go build --tags "netgo" -ldflags "-extldflags -static \
+    CGO_ENABLED=1 GOOS=linux GOARCH=${GOARCH} CC="${CC}" CGO_CFLAGS="${CGO_FLAG}" go build --tags "netgo" -ldflags "-extldflags -static \
     -X 'github.com/onflow/flow-go/cmd/build.commit=${COMMIT}' -X  'github.com/onflow/flow-go/cmd/build.semver=${VERSION}'" \
     -gcflags="all=-N -l" -o ./app ${TARGET}
 
diff --git a/cmd/access/node_builder/access_node_builder.go b/cmd/access/node_builder/access_node_builder.go
index 06a3bf652a6..03f942481ca 100644
--- a/cmd/access/node_builder/access_node_builder.go
+++ b/cmd/access/node_builder/access_node_builder.go
@@ -4,18 +4,19 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"math"
 	"os"
 	"path"
 	"path/filepath"
 	"strings"
 	"time"
 
+	"github.com/ipfs/boxo/bitswap"
 	badger "github.com/ipfs/go-ds-badger2"
 	"github.com/libp2p/go-libp2p/core/host"
 	"github.com/libp2p/go-libp2p/core/routing"
 	"github.com/onflow/crypto"
 	"github.com/onflow/flow/protobuf/go/flow/access"
-	"github.com/onflow/go-bitswap"
 	"github.com/rs/zerolog"
 	"github.com/spf13/pflag"
 	"google.golang.org/grpc"
@@ -36,6 +37,7 @@ import (
 	"github.com/onflow/flow-go/consensus/hotstuff/verification"
 	recovery "github.com/onflow/flow-go/consensus/recovery/protocol"
 	"github.com/onflow/flow-go/engine"
+	"github.com/onflow/flow-go/engine/access/index"
 	"github.com/onflow/flow-go/engine/access/ingestion"
 	pingeng "github.com/onflow/flow-go/engine/access/ping"
 	"github.com/onflow/flow-go/engine/access/rest"
@@ -45,6 +47,7 @@ import (
 	rpcConnection "github.com/onflow/flow-go/engine/access/rpc/connection"
 	"github.com/onflow/flow-go/engine/access/state_stream"
 	statestreambackend "github.com/onflow/flow-go/engine/access/state_stream/backend"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	followereng "github.com/onflow/flow-go/engine/common/follower"
 	"github.com/onflow/flow-go/engine/common/requester"
 	synceng "github.com/onflow/flow-go/engine/common/synchronization"
@@ -83,7 +86,7 @@ import (
 	"github.com/onflow/flow-go/network/p2p/conduit"
 	"github.com/onflow/flow-go/network/p2p/connection"
 	"github.com/onflow/flow-go/network/p2p/dht"
-	"github.com/onflow/flow-go/network/p2p/subscription"
+	networkingsubscription "github.com/onflow/flow-go/network/p2p/subscription"
 	"github.com/onflow/flow-go/network/p2p/translator"
 	"github.com/onflow/flow-go/network/p2p/unicast/protocols"
 	relaynet "github.com/onflow/flow-go/network/relay"
@@ -119,34 +122,37 @@ import (
 // For a node running as a standalone process, the config fields will be populated from the command line params,
 // while for a node running as a library, the config fields are expected to be initialized by the caller.
 type AccessNodeConfig struct {
-	supportsObserver             bool // True if this is an Access node that supports observers and consensus follower engines
-	collectionGRPCPort           uint
-	executionGRPCPort            uint
-	pingEnabled                  bool
-	nodeInfoFile                 string
-	apiRatelimits                map[string]int
-	apiBurstlimits               map[string]int
-	rpcConf                      rpc.Config
-	stateStreamConf              statestreambackend.Config
-	stateStreamFilterConf        map[string]int
-	ExecutionNodeAddress         string // deprecated
-	HistoricalAccessRPCs         []access.AccessAPIClient
-	logTxTimeToFinalized         bool
-	logTxTimeToExecuted          bool
-	logTxTimeToFinalizedExecuted bool
-	retryEnabled                 bool
-	rpcMetricsEnabled            bool
-	executionDataSyncEnabled     bool
-	executionDataDir             string
-	executionDataStartHeight     uint64
-	executionDataConfig          edrequester.ExecutionDataConfig
-	PublicNetworkConfig          PublicNetworkConfig
-	TxResultCacheSize            uint
-	TxErrorMessagesCacheSize     uint
-	executionDataIndexingEnabled bool
-	registersDBPath              string
-	checkpointFile               string
-	scriptExecutorConfig         query.QueryConfig
+	supportsObserver                  bool // True if this is an Access node that supports observers and consensus follower engines
+	collectionGRPCPort                uint
+	executionGRPCPort                 uint
+	pingEnabled                       bool
+	nodeInfoFile                      string
+	apiRatelimits                     map[string]int
+	apiBurstlimits                    map[string]int
+	rpcConf                           rpc.Config
+	stateStreamConf                   statestreambackend.Config
+	stateStreamFilterConf             map[string]int
+	ExecutionNodeAddress              string // deprecated
+	HistoricalAccessRPCs              []access.AccessAPIClient
+	logTxTimeToFinalized              bool
+	logTxTimeToExecuted               bool
+	logTxTimeToFinalizedExecuted      bool
+	retryEnabled                      bool
+	rpcMetricsEnabled                 bool
+	executionDataSyncEnabled          bool
+	publicNetworkExecutionDataEnabled bool
+	executionDataDir                  string
+	executionDataStartHeight          uint64
+	executionDataConfig               edrequester.ExecutionDataConfig
+	PublicNetworkConfig               PublicNetworkConfig
+	TxResultCacheSize                 uint
+	TxErrorMessagesCacheSize          uint
+	executionDataIndexingEnabled      bool
+	registersDBPath                   string
+	checkpointFile                    string
+	scriptExecutorConfig              query.QueryConfig
+	scriptExecMinBlock                uint64
+	scriptExecMaxBlock                uint64
 }
 
 type PublicNetworkConfig struct {
@@ -184,6 +190,7 @@ func DefaultAccessNodeConfig() *AccessNodeConfig {
 				},
 				ScriptExecutionMode: backend.IndexQueryModeExecutionNodesOnly.String(), // default to ENs only for now
 				EventQueryMode:      backend.IndexQueryModeExecutionNodesOnly.String(), // default to ENs only for now
+				TxResultQueryMode:   backend.IndexQueryModeExecutionNodesOnly.String(), // default to ENs only for now
 			},
 			RestConfig: rest.Config{
 				ListenAddress: "",
@@ -196,14 +203,14 @@ func DefaultAccessNodeConfig() *AccessNodeConfig {
 		},
 		stateStreamConf: statestreambackend.Config{
 			MaxExecutionDataMsgSize: grpcutils.DefaultMaxMsgSize,
-			ExecutionDataCacheSize:  state_stream.DefaultCacheSize,
-			ClientSendTimeout:       state_stream.DefaultSendTimeout,
-			ClientSendBufferSize:    state_stream.DefaultSendBufferSize,
-			MaxGlobalStreams:        state_stream.DefaultMaxGlobalStreams,
+			ExecutionDataCacheSize:  subscription.DefaultCacheSize,
+			ClientSendTimeout:       subscription.DefaultSendTimeout,
+			ClientSendBufferSize:    subscription.DefaultSendBufferSize,
+			MaxGlobalStreams:        subscription.DefaultMaxGlobalStreams,
 			EventFilterConfig:       state_stream.DefaultEventFilterConfig,
-			ResponseLimit:           state_stream.DefaultResponseLimit,
-			HeartbeatInterval:       state_stream.DefaultHeartbeatInterval,
 			RegisterIDsRequestLimit: state_stream.DefaultRegisterIDsRequestLimit,
+			ResponseLimit:           subscription.DefaultResponseLimit,
+			HeartbeatInterval:       subscription.DefaultHeartbeatInterval,
 		},
 		stateStreamFilterConf:        nil,
 		ExecutionNodeAddress:         "localhost:9000",
@@ -222,9 +229,10 @@ func DefaultAccessNodeConfig() *AccessNodeConfig {
 			BindAddress: cmd.NotSet,
 			Metrics:     metrics.NewNoopCollector(),
 		},
-		executionDataSyncEnabled: true,
-		executionDataDir:         filepath.Join(homedir, ".flow", "execution_data"),
-		executionDataStartHeight: 0,
+		executionDataSyncEnabled:          true,
+		publicNetworkExecutionDataEnabled: false,
+		executionDataDir:                  filepath.Join(homedir, ".flow", "execution_data"),
+		executionDataStartHeight:          0,
 		executionDataConfig: edrequester.ExecutionDataConfig{
 			InitialBlockHeight: 0,
 			MaxSearchAhead:     edrequester.DefaultMaxSearchAhead,
@@ -237,6 +245,8 @@ func DefaultAccessNodeConfig() *AccessNodeConfig {
 		registersDBPath:              filepath.Join(homedir, ".flow", "execution_state"),
 		checkpointFile:               cmd.NotSet,
 		scriptExecutorConfig:         query.NewDefaultConfig(),
+		scriptExecMinBlock:           0,
+		scriptExecMaxBlock:           math.MaxUint64,
 	}
 }
 
@@ -267,6 +277,7 @@ type FlowAccessNodeBuilder struct {
 	FollowerCore               module.HotStuffFollower
 	Validator                  hotstuff.Validator
 	ExecutionDataDownloader    execution_data.Downloader
+	PublicBlobService          network.BlobService
 	ExecutionDataRequester     state_synchronization.ExecutionDataRequester
 	ExecutionDataStore         execution_data.ExecutionDataStore
 	ExecutionDataCache         *execdatacache.ExecutionDataCache
@@ -274,7 +285,10 @@ type FlowAccessNodeBuilder struct {
 	ExecutionIndexerCore       *indexer.IndexerCore
 	ScriptExecutor             *backend.ScriptExecutor
 	RegistersAsyncStore        *execution.RegistersAsyncStore
+	EventsIndex                *index.EventsIndex
+	TxResultsIndex             *index.TransactionResultsIndex
 	IndexerDependencies        *cmd.DependencyList
+	collectionExecutedMetric   module.CollectionExecutedMetric
 
 	// The sync engine participants provider is the libp2p peer store for the access node
 	// which is not available until after the network has started.
@@ -658,6 +672,39 @@ func (builder *FlowAccessNodeBuilder) BuildExecutionSyncComponents() *FlowAccess
 			return builder.ExecutionDataRequester, nil
 		})
 
+	if builder.publicNetworkExecutionDataEnabled {
+		var publicBsDependable *module.ProxiedReadyDoneAware
+
+		builder.Module("public blobservice peer manager dependencies", func(node *cmd.NodeConfig) error {
+			publicBsDependable = module.NewProxiedReadyDoneAware()
+			builder.PeerManagerDependencies.Add(publicBsDependable)
+			return nil
+		})
+		builder.Component("public network execution data service", func(node *cmd.NodeConfig) (module.ReadyDoneAware, error) {
+			opts := []network.BlobServiceOption{
+				blob.WithBitswapOptions(
+					bitswap.WithTracer(
+						blob.NewTracer(node.Logger.With().Str("public_blob_service", channels.PublicExecutionDataService.String()).Logger()),
+					),
+				),
+			}
+
+			net := builder.AccessNodeConfig.PublicNetworkConfig.Network
+
+			var err error
+			builder.PublicBlobService, err = net.RegisterBlobService(channels.PublicExecutionDataService, ds, opts...)
+			if err != nil {
+				return nil, fmt.Errorf("could not register blob service: %w", err)
+			}
+
+			// add blobservice into ReadyDoneAware dependency passed to peer manager
+			// this starts the blob service and configures peer manager to wait for the blobservice
+			// to be ready before starting
+			publicBsDependable.Init(builder.PublicBlobService)
+			return &module.NoopReadyDoneAware{}, nil
+		})
+	}
+
 	if builder.executionDataIndexingEnabled {
 		var indexedBlockHeight storage.ConsumerProgress
 
@@ -746,8 +793,10 @@ func (builder *FlowAccessNodeBuilder) BuildExecutionSyncComponents() *FlowAccess
 					builder.Storage.RegisterIndex,
 					builder.Storage.Headers,
 					builder.Storage.Events,
+					builder.Storage.Collections,
+					builder.Storage.Transactions,
 					builder.Storage.LightTransactionResults,
-					builder.IngestEng.OnCollection,
+					builder.collectionExecutedMetric,
 				)
 				if err != nil {
 					return nil, err
@@ -768,11 +817,6 @@ func (builder *FlowAccessNodeBuilder) BuildExecutionSyncComponents() *FlowAccess
 					return nil, err
 				}
 
-				err = builder.RegistersAsyncStore.InitDataAvailable(registers)
-				if err != nil {
-					return nil, err
-				}
-
 				// setup requester to notify indexer when new execution data is received
 				execDataDistributor.AddOnExecutionDataReceivedConsumer(builder.ExecutionIndexer.OnExecutionData)
 
@@ -791,7 +835,25 @@ func (builder *FlowAccessNodeBuilder) BuildExecutionSyncComponents() *FlowAccess
 					return nil, err
 				}
 
-				builder.ScriptExecutor.InitReporter(builder.ExecutionIndexer, scripts)
+				err = builder.ScriptExecutor.Initialize(builder.ExecutionIndexer, scripts)
+				if err != nil {
+					return nil, err
+				}
+
+				err = builder.EventsIndex.Initialize(builder.ExecutionIndexer)
+				if err != nil {
+					return nil, err
+				}
+
+				err = builder.TxResultsIndex.Initialize(builder.ExecutionIndexer)
+				if err != nil {
+					return nil, err
+				}
+
+				err = builder.RegistersAsyncStore.Initialize(registers)
+				if err != nil {
+					return nil, err
+				}
 
 				return builder.ExecutionIndexer, nil
 			}, builder.IndexerDependencies)
@@ -807,6 +869,8 @@ func (builder *FlowAccessNodeBuilder) BuildExecutionSyncComponents() *FlowAccess
 					builder.stateStreamConf.MaxAddresses = value
 				case "Contracts":
 					builder.stateStreamConf.MaxContracts = value
+				case "AccountAddresses":
+					builder.stateStreamConf.MaxAccountAddress = value
 				}
 			}
 			builder.stateStreamConf.RpcMetricsEnabled = builder.rpcMetricsEnabled
@@ -827,21 +891,37 @@ func (builder *FlowAccessNodeBuilder) BuildExecutionSyncComponents() *FlowAccess
 			useIndex := builder.executionDataIndexingEnabled &&
 				eventQueryMode != backend.IndexQueryModeExecutionNodesOnly
 
+			executionDataTracker := subscription.NewExecutionDataTracker(
+				builder.Logger,
+				node.State,
+				builder.executionDataConfig.InitialBlockHeight,
+				node.Storage.Headers,
+				broadcaster,
+				highestAvailableHeight,
+				builder.EventsIndex,
+				useIndex,
+			)
+
 			builder.stateStreamBackend, err = statestreambackend.New(
 				node.Logger,
-				builder.stateStreamConf,
 				node.State,
 				node.Storage.Headers,
-				node.Storage.Events,
 				node.Storage.Seals,
 				node.Storage.Results,
 				builder.ExecutionDataStore,
 				executionDataStoreCache,
-				broadcaster,
-				builder.executionDataConfig.InitialBlockHeight,
-				highestAvailableHeight,
 				builder.RegistersAsyncStore,
+				builder.EventsIndex,
 				useIndex,
+				int(builder.stateStreamConf.RegisterIDsRequestLimit),
+				subscription.NewSubscriptionHandler(
+					builder.Logger,
+					broadcaster,
+					builder.stateStreamConf.ClientSendTimeout,
+					builder.stateStreamConf.ResponseLimit,
+					builder.stateStreamConf.ClientSendBufferSize,
+				),
+				executionDataTracker,
 			)
 			if err != nil {
 				return nil, fmt.Errorf("could not create state stream backend: %w", err)
@@ -855,14 +935,14 @@ func (builder *FlowAccessNodeBuilder) BuildExecutionSyncComponents() *FlowAccess
 				node.RootChainID,
 				builder.stateStreamGrpcServer,
 				builder.stateStreamBackend,
-				broadcaster,
 			)
 			if err != nil {
 				return nil, fmt.Errorf("could not create state stream engine: %w", err)
 			}
 			builder.StateStreamEng = stateStreamEng
 
-			execDataDistributor.AddOnExecutionDataReceivedConsumer(builder.StateStreamEng.OnExecutionData)
+			// setup requester to notify ExecutionDataTracker when new execution data is received
+			execDataDistributor.AddOnExecutionDataReceivedConsumer(builder.stateStreamBackend.OnExecutionData)
 
 			return builder.StateStreamEng, nil
 		})
@@ -883,7 +963,6 @@ func FlowAccessNode(nodeBuilder *cmd.FlowNodeBuilder) *FlowAccessNodeBuilder {
 }
 
 func (builder *FlowAccessNodeBuilder) ParseFlags() error {
-
 	builder.BaseFlags()
 
 	builder.extraFlags()
@@ -1015,6 +1094,10 @@ func (builder *FlowAccessNodeBuilder) extraFlags() {
 			"execution-data-sync-enabled",
 			defaultConfig.executionDataSyncEnabled,
 			"whether to enable the execution data sync protocol")
+		flags.BoolVar(&builder.publicNetworkExecutionDataEnabled,
+			"public-network-execution-data-sync-enabled",
+			defaultConfig.publicNetworkExecutionDataEnabled,
+			"[experimental] whether to enable the execution data sync protocol on public network")
 		flags.StringVar(&builder.executionDataDir, "execution-data-dir", defaultConfig.executionDataDir, "directory to use for Execution Data database")
 		flags.Uint64Var(&builder.executionDataStartHeight,
 			"execution-data-start-height",
@@ -1086,6 +1169,11 @@ func (builder *FlowAccessNodeBuilder) extraFlags() {
 			defaultConfig.rpcConf.BackendConfig.EventQueryMode,
 			"mode to use when querying events. one of [local-only, execution-nodes-only(default), failover]")
 
+		flags.StringVar(&builder.rpcConf.BackendConfig.TxResultQueryMode,
+			"tx-result-query-mode",
+			defaultConfig.rpcConf.BackendConfig.TxResultQueryMode,
+			"mode to use when querying transaction results. one of [local-only, execution-nodes-only(default), failover]")
+
 		// Script Execution
 		flags.StringVar(&builder.rpcConf.BackendConfig.ScriptExecutionMode,
 			"script-execution-mode",
@@ -1107,7 +1195,14 @@ func (builder *FlowAccessNodeBuilder) extraFlags() {
 			"script-execution-timeout",
 			defaultConfig.scriptExecutorConfig.ExecutionTimeLimit,
 			"timeout value for locally executed scripts. default: 10s")
-
+		flags.Uint64Var(&builder.scriptExecMinBlock,
+			"script-execution-min-height",
+			defaultConfig.scriptExecMinBlock,
+			"lowest block height to allow for script execution. default: no limit")
+		flags.Uint64Var(&builder.scriptExecMaxBlock,
+			"script-execution-max-height",
+			defaultConfig.scriptExecMaxBlock,
+			"highest block height to allow for script execution. default: no limit")
 	}).ValidateFlags(func() error {
 		if builder.supportsObserver && (builder.PublicNetworkConfig.BindAddress == cmd.NotSet || builder.PublicNetworkConfig.BindAddress == "") {
 			return errors.New("public-network-address must be set if supports-observer is true")
@@ -1136,17 +1231,17 @@ func (builder *FlowAccessNodeBuilder) extraFlags() {
 			if builder.stateStreamConf.ClientSendBufferSize == 0 {
 				return errors.New("state-stream-send-buffer-size must be greater than 0")
 			}
-			if len(builder.stateStreamFilterConf) > 3 {
-				return errors.New("state-stream-event-filter-limits must have at most 3 keys (EventTypes, Addresses, Contracts)")
+			if len(builder.stateStreamFilterConf) > 4 {
+				return errors.New("state-stream-event-filter-limits must have at most 3 keys (EventTypes, Addresses, Contracts, AccountAddresses)")
 			}
 			for key, value := range builder.stateStreamFilterConf {
 				switch key {
-				case "EventTypes", "Addresses", "Contracts":
+				case "EventTypes", "Addresses", "Contracts", "AccountAddresses":
 					if value <= 0 {
 						return fmt.Errorf("state-stream-event-filter-limits %s must be greater than 0", key)
 					}
 				default:
-					return errors.New("state-stream-event-filter-limits may only contain the keys EventTypes, Addresses, Contracts")
+					return errors.New("state-stream-event-filter-limits may only contain the keys EventTypes, Addresses, Contracts, AccountAddresses")
 				}
 			}
 			if builder.stateStreamConf.ResponseLimit < 0 {
@@ -1218,9 +1313,9 @@ func (builder *FlowAccessNodeBuilder) InitIDProviders() {
 		builder.SyncEngineParticipantsProviderFactory = func() module.IdentifierProvider {
 			return id.NewIdentityFilterIdentifierProvider(
 				filter.And(
-					filter.HasRole(flow.RoleConsensus),
-					filter.Not(filter.HasNodeID(node.Me.NodeID())),
-					underlay.NotEjectedFilter,
+					filter.HasRole[flow.Identity](flow.RoleConsensus),
+					filter.Not(filter.HasNodeID[flow.Identity](node.Me.NodeID())),
+					filter.NotEjectedFilter,
 				),
 				builder.IdentityProvider,
 			)
@@ -1346,6 +1441,7 @@ func (builder *FlowAccessNodeBuilder) Build() (cmd.Node, error) {
 			}
 
 			builder.BlocksToMarkExecuted, err = stdmap.NewTimes(1 * 300) // assume 1 block per second * 300 seconds
+
 			return err
 		}).
 		Module("transaction metrics", func(node *cmd.NodeConfig) error {
@@ -1374,6 +1470,23 @@ func (builder *FlowAccessNodeBuilder) Build() (cmd.Node, error) {
 			)
 			return nil
 		}).
+		Module("collection metrics", func(node *cmd.NodeConfig) error {
+			var err error
+			builder.collectionExecutedMetric, err = indexer.NewCollectionExecutedMetricImpl(
+				builder.Logger,
+				builder.AccessMetrics,
+				builder.CollectionsToMarkFinalized,
+				builder.CollectionsToMarkExecuted,
+				builder.BlocksToMarkExecuted,
+				builder.Storage.Collections,
+				builder.Storage.Blocks,
+			)
+			if err != nil {
+				return err
+			}
+
+			return nil
+		}).
 		Module("ping metrics", func(node *cmd.NodeConfig) error {
 			builder.PingMetrics = metrics.NewPingCollector()
 			return nil
@@ -1421,7 +1534,7 @@ func (builder *FlowAccessNodeBuilder) Build() (cmd.Node, error) {
 			return nil
 		}).
 		Module("backend script executor", func(node *cmd.NodeConfig) error {
-			builder.ScriptExecutor = backend.NewScriptExecutor()
+			builder.ScriptExecutor = backend.NewScriptExecutor(builder.Logger, builder.scriptExecMinBlock, builder.scriptExecMaxBlock)
 			return nil
 		}).
 		Module("async register store", func(node *cmd.NodeConfig) error {
@@ -1432,6 +1545,14 @@ func (builder *FlowAccessNodeBuilder) Build() (cmd.Node, error) {
 			builder.Storage.Events = bstorage.NewEvents(node.Metrics.Cache, node.DB)
 			return nil
 		}).
+		Module("events index", func(node *cmd.NodeConfig) error {
+			builder.EventsIndex = index.NewEventsIndex(builder.Storage.Events)
+			return nil
+		}).
+		Module("transaction result index", func(node *cmd.NodeConfig) error {
+			builder.TxResultsIndex = index.NewTransactionResultsIndex(builder.Storage.LightTransactionResults)
+			return nil
+		}).
 		Component("RPC engine", func(node *cmd.NodeConfig) (module.ReadyDoneAware, error) {
 			config := builder.rpcConf
 			backendConfig := config.BackendConfig
@@ -1439,12 +1560,12 @@ func (builder *FlowAccessNodeBuilder) Build() (cmd.Node, error) {
 			cacheSize := int(backendConfig.ConnectionPoolSize)
 
 			var connBackendCache *rpcConnection.Cache
+			var err error
 			if cacheSize > 0 {
-				backendCache, err := backend.NewCache(node.Logger, accessMetrics, cacheSize)
+				connBackendCache, err = rpcConnection.NewCache(node.Logger, accessMetrics, cacheSize)
 				if err != nil {
-					return nil, fmt.Errorf("could not initialize backend cache: %w", err)
+					return nil, fmt.Errorf("could not initialize connection cache: %w", err)
 				}
-				connBackendCache = rpcConnection.NewCache(backendCache, cacheSize)
 			}
 
 			connFactory := &rpcConnection.ConnectionFactoryImpl{
@@ -1455,9 +1576,9 @@ func (builder *FlowAccessNodeBuilder) Build() (cmd.Node, error) {
 				AccessMetrics:             accessMetrics,
 				Log:                       node.Logger,
 				Manager: rpcConnection.NewManager(
-					connBackendCache,
 					node.Logger,
 					accessMetrics,
+					connBackendCache,
 					config.MaxMsgSize,
 					backendConfig.CircuitBreakerConfig,
 					config.CompressorName,
@@ -1471,19 +1592,38 @@ func (builder *FlowAccessNodeBuilder) Build() (cmd.Node, error) {
 
 			eventQueryMode, err := backend.ParseIndexQueryMode(config.BackendConfig.EventQueryMode)
 			if err != nil {
-				return nil, fmt.Errorf("could not parse script execution mode: %w", err)
+				return nil, fmt.Errorf("could not parse event query mode: %w", err)
 			}
 			if eventQueryMode == backend.IndexQueryModeCompare {
 				return nil, fmt.Errorf("event query mode 'compare' is not supported")
 			}
 
+			broadcaster := engine.NewBroadcaster()
+			// create BlockTracker that will track for new blocks (finalized and sealed) and
+			// handles block-related operations.
+			blockTracker, err := subscription.NewBlockTracker(
+				node.State,
+				builder.FinalizedRootBlock.Header.Height,
+				node.Storage.Headers,
+				broadcaster,
+			)
+			if err != nil {
+				return nil, fmt.Errorf("failed to initialize block tracker: %w", err)
+			}
+			txResultQueryMode, err := backend.ParseIndexQueryMode(config.BackendConfig.TxResultQueryMode)
+			if err != nil {
+				return nil, fmt.Errorf("could not parse transaction result query mode: %w", err)
+			}
+			if txResultQueryMode == backend.IndexQueryModeCompare {
+				return nil, fmt.Errorf("transaction result query mode 'compare' is not supported")
+			}
+
 			nodeBackend, err := backend.New(backend.Params{
 				State:                     node.State,
 				CollectionRPC:             builder.CollectionRPC,
 				HistoricalAccessNodes:     builder.HistoricalAccessRPCs,
 				Blocks:                    node.Storage.Blocks,
 				Headers:                   node.Storage.Headers,
-				Events:                    node.Storage.Events,
 				Collections:               node.Storage.Collections,
 				Transactions:              node.Storage.Transactions,
 				ExecutionReceipts:         node.Storage.Receipts,
@@ -1503,6 +1643,17 @@ func (builder *FlowAccessNodeBuilder) Build() (cmd.Node, error) {
 				ScriptExecutor:            builder.ScriptExecutor,
 				ScriptExecutionMode:       scriptExecMode,
 				EventQueryMode:            eventQueryMode,
+				BlockTracker:              blockTracker,
+				SubscriptionHandler: subscription.NewSubscriptionHandler(
+					builder.Logger,
+					broadcaster,
+					builder.stateStreamConf.ClientSendTimeout,
+					builder.stateStreamConf.ResponseLimit,
+					builder.stateStreamConf.ClientSendBufferSize,
+				),
+				EventsIndex:       builder.EventsIndex,
+				TxResultQueryMode: txResultQueryMode,
+				TxResultsIndex:    builder.TxResultsIndex,
 			})
 			if err != nil {
 				return nil, fmt.Errorf("could not initialize backend: %w", err)
@@ -1548,7 +1699,7 @@ func (builder *FlowAccessNodeBuilder) Build() (cmd.Node, error) {
 				node.Me,
 				node.State,
 				channels.RequestCollections,
-				filter.HasRole(flow.RoleCollection),
+				filter.HasRole[flow.Identity](flow.RoleCollection),
 				func() flow.Entity { return &flow.Collection{} },
 			)
 			if err != nil {
@@ -1567,10 +1718,7 @@ func (builder *FlowAccessNodeBuilder) Build() (cmd.Node, error) {
 				node.Storage.Transactions,
 				node.Storage.Results,
 				node.Storage.Receipts,
-				builder.AccessMetrics,
-				builder.CollectionsToMarkFinalized,
-				builder.CollectionsToMarkExecuted,
-				builder.BlocksToMarkExecuted,
+				builder.collectionExecutedMetric,
 			)
 			if err != nil {
 				return nil, err
@@ -1633,7 +1781,6 @@ func (builder *FlowAccessNodeBuilder) Build() (cmd.Node, error) {
 			builder.nodeInfoFile,
 			node.PingService,
 		)
-
 		if err != nil {
 			return nil, fmt.Errorf("could not create ping engine: %w", err)
 		}
@@ -1735,12 +1882,12 @@ func (builder *FlowAccessNodeBuilder) enqueuePublicNetworkInit() {
 // - The libp2p node instance for the public network.
 // - Any error encountered during initialization. Any error should be considered fatal.
 func (builder *FlowAccessNodeBuilder) initPublicLibp2pNode(networkKey crypto.PrivateKey, bindAddress string, networkMetrics module.LibP2PMetrics) (p2p.LibP2PNode,
-	error) {
+	error,
+) {
 	connManager, err := connection.NewConnManager(builder.Logger, networkMetrics, &builder.FlowConfig.NetworkConfig.ConnectionManager)
 	if err != nil {
 		return nil, fmt.Errorf("could not create connection manager: %w", err)
 	}
-
 	libp2pNode, err := p2pbuilder.NewNodeBuilder(builder.Logger, &builder.FlowConfig.NetworkConfig.GossipSub, &p2pbuilderconfig.MetricsConfig{
 		HeroCacheFactory: builder.HeroCacheMetricsFactory(),
 		Metrics:          networkMetrics,
@@ -1766,13 +1913,12 @@ func (builder *FlowAccessNodeBuilder) initPublicLibp2pNode(networkKey crypto.Pri
 			Unicast: builder.FlowConfig.NetworkConfig.Unicast,
 		}).
 		SetBasicResolver(builder.Resolver).
-		SetSubscriptionFilter(subscription.NewRoleBasedFilter(flow.RoleAccess, builder.IdentityProvider)).
+		SetSubscriptionFilter(networkingsubscription.NewRoleBasedFilter(flow.RoleAccess, builder.IdentityProvider)).
 		SetConnectionManager(connManager).
 		SetRoutingSystem(func(ctx context.Context, h host.Host) (routing.Routing, error) {
 			return dht.NewDHT(ctx, h, protocols.FlowPublicDHTProtocolID(builder.SporkID), builder.Logger, networkMetrics, dht.AsServer())
 		}).
 		Build()
-
 	if err != nil {
 		return nil, fmt.Errorf("could not build libp2p node for staked access node: %w", err)
 	}
diff --git a/cmd/bootstrap/README.md b/cmd/bootstrap/README.md
index 6b138946ca1..1d4eef5f580 100644
--- a/cmd/bootstrap/README.md
+++ b/cmd/bootstrap/README.md
@@ -97,16 +97,61 @@ Each input is a config file specified as a command line parameter:
 
 #### Example
 ```bash
-go run ./cmd/bootstrap finalize \
-  --root-chain main \
-  --root-height 0 \
-  --root-parent 0000000000000000000000000000000000000000000000000000000000000000 \
-  --root-commit 4b8d01975cf0cd23e046b1fae36518e542f92a6e35bedd627c43da30f4ae761a \
-  --config ./cmd/bootstrap/example_files/node-config.json \
-  --partner-dir ./cmd/bootstrap/example_files/partner-node-infos \
-  --partner-weights ./cmd/bootstrap/example_files/partner-weights.json \
-  --epoch-counter 1 \
-  -o ./bootstrap/root-infos
+go run . genconfig \
+    --address-format "%s%d-example.onflow.org:3569" \
+    --access 2 \
+    --collection 4 \
+    --consensus 3 \
+    --execution 2 \
+    --verification 3 \
+    --weight 100 \
+    -o ./ \
+    --config ./bootstrap-example/node-config.json
+
+```
+
+```bash
+go run . keygen \
+    --machine-account \
+    --config ./bootstrap-example/node-config.json \
+    -o ./bootstrap-example/keys
+
+```
+
+```bash
+go run . rootblock  \
+    --root-chain bench \
+    --root-height 0 \
+    --root-parent 0000000000000000000000000000000000000000000000000000000000000000 \
+    --epoch-counter 0 \
+    --epoch-length 30000 \
+    --epoch-staking-phase-length 20000 \
+    --epoch-dkg-phase-length 2000 \
+    --collection-clusters 1 \
+    --protocol-version=0 \
+    --use-default-epoch-timing \
+    --epoch-commit-safety-threshold=1000 \
+    --config ./bootstrap-example/node-config.json \
+    -o ./bootstrap-example \
+    --partner-dir ./example_files/partner-node-infos \
+    --partner-weights ./example_files/partner-weights.json \
+    --internal-priv-dir ./bootstrap-example/keys
+```
+
+```bash
+go run . finalize \
+    --config ./bootstrap-example/node-config.json \
+    --partner-dir ./example_files/partner-node-infos \
+    --partner-weights ./example_files/partner-weights.json \
+    --internal-priv-dir ./bootstrap-example/keys/private-root-information \
+    --dkg-data ./bootstrap-example/private-root-information/root-dkg-data.priv.json \
+    --root-block ./bootstrap-example/public-root-information/root-block.json \
+    --intermediary-bootstrapping-data ./bootstrap-example/public-root-information/intermediary-bootstrapping-data.json \
+    --root-block-votes-dir ./bootstrap-example/public-root-information/root-block-votes/ \
+    --root-commit 0000000000000000000000000000000000000000000000000000000000000000 \
+    --genesis-token-supply="1000000000.0" \
+    --service-account-public-key-json "{\"PublicKey\":\"R7MTEDdLclRLrj2MI1hcp4ucgRTpR15PCHAWLM5nks6Y3H7+PGkfZTP2di2jbITooWO4DD1yqaBSAVK8iQ6i0A==\",\"SignAlgo\":2,\"HashAlgo\":1,\"SeqNumber\":0,\"Weight\":1000}" \
+    -o ./bootstrap-example
 ```
 
 #### Generated output files
diff --git a/cmd/bootstrap/cmd/block.go b/cmd/bootstrap/cmd/block.go
index 0e9b3612559..222a2179085 100644
--- a/cmd/bootstrap/cmd/block.go
+++ b/cmd/bootstrap/cmd/block.go
@@ -5,21 +5,83 @@ import (
 	"time"
 
 	"github.com/onflow/flow-go/cmd/bootstrap/run"
+	"github.com/onflow/flow-go/model/dkg"
 	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/signature"
+	"github.com/onflow/flow-go/state/protocol/inmem"
 )
 
-func constructRootBlock(rootChain string, rootParent string, rootHeight uint64, rootTimestamp string) *flow.Block {
-
+// constructRootHeader constructs a header for the root block.
+func constructRootHeader(rootChain string, rootParent string, rootHeight uint64, rootTimestamp string) *flow.Header {
 	chainID := parseChainID(rootChain)
 	parentID := parseParentID(rootParent)
 	height := rootHeight
 	timestamp := parseRootTimestamp(rootTimestamp)
 
-	block := run.GenerateRootBlock(chainID, parentID, height, timestamp)
+	return run.GenerateRootHeader(chainID, parentID, height, timestamp)
+}
 
+// constructRootBlock constructs a valid root block based on the given header, setup, and commit.
+func constructRootBlock(rootHeader *flow.Header, setup *flow.EpochSetup, commit *flow.EpochCommit) *flow.Block {
+	block := &flow.Block{
+		Header:  rootHeader,
+		Payload: nil,
+	}
+	block.SetPayload(flow.Payload{
+		Guarantees:      nil,
+		Seals:           nil,
+		Receipts:        nil,
+		Results:         nil,
+		ProtocolStateID: inmem.ProtocolStateFromEpochServiceEvents(setup, commit).ID(),
+	})
 	return block
 }
 
+// constructRootEpochEvents constructs the epoch setup and commit events for the first epoch after spork.
+func constructRootEpochEvents(
+	firstView uint64,
+	participants flow.IdentityList,
+	assignments flow.AssignmentList,
+	clusterQCs []*flow.QuorumCertificate,
+	dkgData dkg.DKGData) (*flow.EpochSetup, *flow.EpochCommit) {
+	epochSetup := &flow.EpochSetup{
+		Counter:            flagEpochCounter,
+		FirstView:          firstView,
+		FinalView:          firstView + flagNumViewsInEpoch - 1,
+		DKGPhase1FinalView: firstView + flagNumViewsInStakingAuction + flagNumViewsInDKGPhase - 1,
+		DKGPhase2FinalView: firstView + flagNumViewsInStakingAuction + flagNumViewsInDKGPhase*2 - 1,
+		DKGPhase3FinalView: firstView + flagNumViewsInStakingAuction + flagNumViewsInDKGPhase*3 - 1,
+		Participants:       participants.Sort(flow.Canonical[flow.Identity]).ToSkeleton(),
+		Assignments:        assignments,
+		RandomSource:       GenerateRandomSeed(flow.EpochSetupRandomSourceLength),
+		TargetDuration:     flagEpochTimingDuration,
+		TargetEndTime:      rootEpochTargetEndTime(),
+	}
+
+	qcsWithSignerIDs := make([]*flow.QuorumCertificateWithSignerIDs, 0, len(clusterQCs))
+	for i, clusterQC := range clusterQCs {
+		members := assignments[i]
+		signerIDs, err := signature.DecodeSignerIndicesToIdentifiers(members, clusterQC.SignerIndices)
+		if err != nil {
+			log.Fatal().Err(err).Msgf("could not decode signer IDs from clusterQC at index %v", i)
+		}
+		qcsWithSignerIDs = append(qcsWithSignerIDs, &flow.QuorumCertificateWithSignerIDs{
+			View:      clusterQC.View,
+			BlockID:   clusterQC.BlockID,
+			SignerIDs: signerIDs,
+			SigData:   clusterQC.SigData,
+		})
+	}
+
+	epochCommit := &flow.EpochCommit{
+		Counter:            flagEpochCounter,
+		ClusterQCs:         flow.ClusterQCVoteDatasFromQCs(qcsWithSignerIDs),
+		DKGGroupKey:        dkgData.PubGroupKey,
+		DKGParticipantKeys: dkgData.PubKeyShares,
+	}
+	return epochSetup, epochCommit
+}
+
 func parseChainID(chainID string) flow.ChainID {
 	switch chainID {
 	case "main":
diff --git a/cmd/bootstrap/cmd/check_machine_account.go b/cmd/bootstrap/cmd/check_machine_account.go
index e2261012219..5594f483060 100644
--- a/cmd/bootstrap/cmd/check_machine_account.go
+++ b/cmd/bootstrap/cmd/check_machine_account.go
@@ -13,6 +13,7 @@ import (
 	sdk "github.com/onflow/flow-go-sdk"
 	client "github.com/onflow/flow-go-sdk/access/grpc"
 	"github.com/onflow/flow-go/cmd"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	model "github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/module/epochs"
 )
@@ -44,7 +45,10 @@ func checkMachineAccountRun(_ *cobra.Command, _ []string) {
 
 	// read the private node information - used to get the role
 	var nodeInfoPriv model.NodeInfoPriv
-	readJSON(filepath.Join(flagOutdir, fmt.Sprintf(model.PathNodeInfoPriv, nodeID)), &nodeInfoPriv)
+	err = common.ReadJSON(filepath.Join(flagOutdir, fmt.Sprintf(model.PathNodeInfoPriv, nodeID)), &nodeInfoPriv)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to read json")
+	}
 
 	// read the machine account info file
 	machineAccountInfo := readMachineAccountInfo(nodeID)
@@ -97,7 +101,10 @@ func readMachineAccountInfo(nodeID string) model.NodeMachineAccountInfo {
 	var machineAccountInfo model.NodeMachineAccountInfo
 
 	path := filepath.Join(flagOutdir, fmt.Sprintf(model.PathNodeMachineAccountInfoPriv, nodeID))
-	readJSON(path, &machineAccountInfo)
+	err := common.ReadJSON(path, &machineAccountInfo)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to read json")
+	}
 
 	return machineAccountInfo
 }
diff --git a/cmd/bootstrap/cmd/clusters.go b/cmd/bootstrap/cmd/clusters.go
deleted file mode 100644
index 441f573f429..00000000000
--- a/cmd/bootstrap/cmd/clusters.go
+++ /dev/null
@@ -1,125 +0,0 @@
-package cmd
-
-import (
-	"errors"
-
-	"github.com/onflow/flow-go/cmd/bootstrap/run"
-	model "github.com/onflow/flow-go/model/bootstrap"
-	"github.com/onflow/flow-go/model/cluster"
-	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/model/flow/assignment"
-	"github.com/onflow/flow-go/model/flow/factory"
-	"github.com/onflow/flow-go/model/flow/filter"
-)
-
-// Construct random cluster assignment with internal and partner nodes.
-// The number of clusters is read from the `flagCollectionClusters` flag.
-// The number of nodes in each cluster is deterministic and only depends on the number of clusters
-// and the number of nodes. The repartition of internal and partner nodes is also deterministic
-// and only depends on the number of clusters and nodes.
-// The identity of internal and partner nodes in each cluster is the non-deterministic and is randomized
-// using the system entropy.
-// The function guarantees a specific constraint when partitioning the nodes into clusters:
-// Each cluster must contain strictly more than 2/3 of internal nodes. If the constraint can't be
-// satisfied, an exception is returned.
-// Note that if an exception is returned with a certain number of internal/partner nodes, there is no chance
-// of succeeding the assignment by re-running the function without increasing the internal nodes ratio.
-func constructClusterAssignment(partnerNodes, internalNodes []model.NodeInfo) (flow.AssignmentList, flow.ClusterList, error) {
-
-	partners := model.ToIdentityList(partnerNodes).Filter(filter.HasRole(flow.RoleCollection))
-	internals := model.ToIdentityList(internalNodes).Filter(filter.HasRole(flow.RoleCollection))
-	nClusters := int(flagCollectionClusters)
-	nCollectors := len(partners) + len(internals)
-
-	// ensure we have at least as many collection nodes as clusters
-	if nCollectors < int(flagCollectionClusters) {
-		log.Fatal().Msgf("network bootstrap is configured with %d collection nodes, but %d clusters - must have at least one collection node per cluster",
-			nCollectors, flagCollectionClusters)
-	}
-
-	// shuffle both collector lists based on a non-deterministic algorithm
-	partners, err := partners.Shuffle()
-	if err != nil {
-		log.Fatal().Err(err).Msg("could not shuffle partners")
-	}
-	internals, err = internals.Shuffle()
-	if err != nil {
-		log.Fatal().Err(err).Msg("could not shuffle internals")
-	}
-
-	identifierLists := make([]flow.IdentifierList, nClusters)
-	// array to track the 2/3 internal-nodes constraint (internal_nodes > 2 * partner_nodes)
-	constraint := make([]int, nClusters)
-
-	// first, round-robin internal nodes into each cluster
-	for i, node := range internals {
-		identifierLists[i%nClusters] = append(identifierLists[i%nClusters], node.NodeID)
-		constraint[i%nClusters] += 1
-	}
-
-	// next, round-robin partner nodes into each cluster
-	for i, node := range partners {
-		identifierLists[i%len(identifierLists)] = append(identifierLists[i%len(identifierLists)], node.NodeID)
-		constraint[i%nClusters] -= 2
-	}
-
-	// check the 2/3 constraint: for every cluster `i`, constraint[i] must be strictly positive
-	for i := 0; i < nClusters; i++ {
-		if constraint[i] <= 0 {
-			return nil, nil, errors.New("there isn't enough internal nodes to have at least 2/3 internal nodes in each cluster")
-		}
-	}
-
-	assignments := assignment.FromIdentifierLists(identifierLists)
-
-	collectors := append(partners, internals...)
-	clusters, err := factory.NewClusterList(assignments, collectors)
-	if err != nil {
-		log.Fatal().Err(err).Msg("could not create cluster list")
-	}
-
-	return assignments, clusters, nil
-}
-
-func constructRootQCsForClusters(
-	clusterList flow.ClusterList,
-	nodeInfos []model.NodeInfo,
-	clusterBlocks []*cluster.Block,
-) []*flow.QuorumCertificate {
-
-	if len(clusterBlocks) != len(clusterList) {
-		log.Fatal().Int("len(clusterBlocks)", len(clusterBlocks)).Int("len(clusterList)", len(clusterList)).
-			Msg("number of clusters needs to equal number of cluster blocks")
-	}
-
-	qcs := make([]*flow.QuorumCertificate, len(clusterBlocks))
-	for i, cluster := range clusterList {
-		signers := filterClusterSigners(cluster, nodeInfos)
-
-		qc, err := run.GenerateClusterRootQC(signers, cluster, clusterBlocks[i])
-		if err != nil {
-			log.Fatal().Err(err).Int("cluster index", i).Msg("generating collector cluster root QC failed")
-		}
-		qcs[i] = qc
-	}
-
-	return qcs
-}
-
-// Filters a list of nodes to include only nodes that will sign the QC for the
-// given cluster. The resulting list of nodes is only nodes that are in the
-// given cluster AND are not partner nodes (ie. we have the private keys).
-func filterClusterSigners(cluster flow.IdentityList, nodeInfos []model.NodeInfo) []model.NodeInfo {
-
-	var filtered []model.NodeInfo
-	for _, node := range nodeInfos {
-		_, isInCluster := cluster.ByNodeID(node.NodeID)
-		isNotPartner := node.Type() == model.NodeInfoTypePrivate
-
-		if isInCluster && isNotPartner {
-			filtered = append(filtered, node)
-		}
-	}
-
-	return filtered
-}
diff --git a/cmd/bootstrap/cmd/constraints.go b/cmd/bootstrap/cmd/constraints.go
index 2b0487b56cc..3fc3c757cad 100644
--- a/cmd/bootstrap/cmd/constraints.go
+++ b/cmd/bootstrap/cmd/constraints.go
@@ -12,15 +12,15 @@ import (
 func ensureUniformNodeWeightsPerRole(allNodes flow.IdentityList) {
 	// ensure all nodes of the same role have equal weight
 	for _, role := range flow.Roles() {
-		withRole := allNodes.Filter(filter.HasRole(role))
+		withRole := allNodes.Filter(filter.HasRole[flow.Identity](role))
 		// each role has at least one node so it's safe to access withRole[0]
-		expectedWeight := withRole[0].Weight
+		expectedWeight := withRole[0].InitialWeight
 		for _, node := range withRole {
-			if node.Weight != expectedWeight {
+			if node.InitialWeight != expectedWeight {
 				log.Fatal().Msgf(
 					"will not bootstrap configuration with non-equal weights\n"+
 						"found nodes with role %s and weight1=%d, weight2=%d",
-					role, expectedWeight, node.Weight)
+					role, expectedWeight, node.InitialWeight)
 			}
 		}
 	}
diff --git a/cmd/bootstrap/cmd/db_encryption_key.go b/cmd/bootstrap/cmd/db_encryption_key.go
index c99843e859b..897a7099c90 100644
--- a/cmd/bootstrap/cmd/db_encryption_key.go
+++ b/cmd/bootstrap/cmd/db_encryption_key.go
@@ -7,6 +7,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/onflow/flow-go/cmd/bootstrap/utils"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	model "github.com/onflow/flow-go/model/bootstrap"
 )
 
@@ -35,7 +36,7 @@ func dbEncryptionKeyRun(_ *cobra.Command, _ []string) {
 	log = log.With().Str("path", dbEncryptionKeyPath).Logger()
 
 	// check if the key already exists
-	exists, err := pathExists(path.Join(flagOutdir, dbEncryptionKeyPath))
+	exists, err := common.PathExists(path.Join(flagOutdir, dbEncryptionKeyPath))
 	if err != nil {
 		log.Fatal().Err(err).Msg("could not check if db encryption key already exists")
 	}
@@ -50,5 +51,10 @@ func dbEncryptionKeyRun(_ *cobra.Command, _ []string) {
 	}
 	log.Info().Msg("generated db encryption key")
 
-	writeText(dbEncryptionKeyPath, dbEncryptionKey)
+	err = common.WriteText(dbEncryptionKeyPath, flagOutdir, dbEncryptionKey)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write file")
+	}
+
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, dbEncryptionKeyPath)
 }
diff --git a/cmd/bootstrap/cmd/dkg.go b/cmd/bootstrap/cmd/dkg.go
index 42d5d84d838..44805407e4e 100644
--- a/cmd/bootstrap/cmd/dkg.go
+++ b/cmd/bootstrap/cmd/dkg.go
@@ -6,6 +6,7 @@ import (
 	"github.com/onflow/crypto"
 
 	bootstrapDKG "github.com/onflow/flow-go/cmd/bootstrap/dkg"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	model "github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/dkg"
 	"github.com/onflow/flow-go/model/encodable"
@@ -38,17 +39,25 @@ func runBeaconKG(nodes []model.NodeInfo) dkg.DKGData {
 		encKey := encodable.RandomBeaconPrivKey{PrivateKey: privKey}
 		privKeyShares = append(privKeyShares, encKey)
 
-		writeJSON(fmt.Sprintf(model.PathRandomBeaconPriv, nodeID), encKey)
+		err = common.WriteJSON(fmt.Sprintf(model.PathRandomBeaconPriv, nodeID), flagOutdir, encKey)
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed to write json")
+		}
+		log.Info().Msgf("wrote file %s/%s", flagOutdir, fmt.Sprintf(model.PathRandomBeaconPriv, nodeID))
 	}
 
 	// write full DKG info that will be used to construct QC
-	writeJSON(model.PathRootDKGData, inmem.EncodableFullDKG{
+	err = common.WriteJSON(model.PathRootDKGData, flagOutdir, inmem.EncodableFullDKG{
 		GroupKey: encodable.RandomBeaconPubKey{
 			PublicKey: dkgData.PubGroupKey,
 		},
 		PubKeyShares:  pubKeyShares,
 		PrivKeyShares: privKeyShares,
 	})
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, model.PathRootDKGData)
 
 	return dkgData
 }
diff --git a/cmd/bootstrap/cmd/final_list.go b/cmd/bootstrap/cmd/final_list.go
index ac1b000876b..ca34739de2a 100644
--- a/cmd/bootstrap/cmd/final_list.go
+++ b/cmd/bootstrap/cmd/final_list.go
@@ -1,9 +1,12 @@
 package cmd
 
 import (
+	"fmt"
+
 	"github.com/spf13/cobra"
 
 	"github.com/onflow/flow-go/cmd"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	model "github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
 )
@@ -65,7 +68,11 @@ func finalList(cmd *cobra.Command, args []string) {
 	validateNodes(localNodes, registeredNodes)
 
 	// write node-config.json with the new list of nodes to be used for the `finalize` command
-	writeJSON(model.PathFinallist, model.ToPublicNodeInfoList(localNodes))
+	err := common.WriteJSON(model.PathFinallist, flagOutdir, model.ToPublicNodeInfoList(localNodes))
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, model.PathFinallist)
 }
 
 func validateNodes(localNodes []model.NodeInfo, registeredNodes []model.NodeInfo) {
@@ -229,18 +236,25 @@ func checkMismatchingNodes(localNodes []model.NodeInfo, registeredNodes []model.
 }
 
 func assembleInternalNodesWithoutWeight() []model.NodeInfo {
-	privInternals := readInternalNodes()
+	privInternals, err := common.ReadInternalNodeInfos(flagInternalNodePrivInfoDir)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to read internal node infos")
+	}
 	log.Info().Msgf("read %v internal private node-info files", len(privInternals))
 
 	var nodes []model.NodeInfo
 	for _, internal := range privInternals {
 		// check if address is valid format
-		validateAddressFormat(internal.Address)
+		common.ValidateAddressFormat(log, internal.Address)
 
 		// validate every single internal node
-		nodeID := validateNodeID(internal.NodeID)
+		err := common.ValidateNodeID(internal.NodeID)
+		if err != nil {
+			log.Fatal().Err(err).Msg(fmt.Sprintf("invalid node ID: %s", internal.NodeID))
+		}
+
 		node := model.NewPrivateNodeInfo(
-			nodeID,
+			internal.NodeID,
 			internal.Role,
 			internal.Address,
 			flow.DefaultInitialWeight,
@@ -255,35 +269,50 @@ func assembleInternalNodesWithoutWeight() []model.NodeInfo {
 }
 
 func assemblePartnerNodesWithoutWeight() []model.NodeInfo {
-	partners := readPartnerNodes()
+	partners, err := common.ReadPartnerNodeInfos(flagPartnerNodeInfoDir)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to read partner node infos")
+	}
 	log.Info().Msgf("read %v partner node configuration files", len(partners))
 	return createPublicNodeInfo(partners)
 }
 
 func readStakingContractDetails() []model.NodeInfo {
 	var stakingNodes []model.NodeInfoPub
-	readJSON(flagStakingNodesPath, &stakingNodes)
+	err := common.ReadJSON(flagStakingNodesPath, &stakingNodes)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to read json")
+	}
 	return createPublicNodeInfo(stakingNodes)
 }
 
 func createPublicNodeInfo(nodes []model.NodeInfoPub) []model.NodeInfo {
 	var publicInfoNodes []model.NodeInfo
 	for _, n := range nodes {
-		validateAddressFormat(n.Address)
+		common.ValidateAddressFormat(log, n.Address)
 
 		// validate every single partner node
-		nodeID := validateNodeID(n.NodeID)
-		networkPubKey := validateNetworkPubKey(n.NetworkPubKey)
-		stakingPubKey := validateStakingPubKey(n.StakingPubKey)
+		err := common.ValidateNodeID(n.NodeID)
+		if err != nil {
+			log.Fatal().Err(err).Msg(fmt.Sprintf("invalid node ID: %s", n.NodeID))
+		}
+		err = common.ValidateNetworkPubKey(n.NetworkPubKey)
+		if err != nil {
+			log.Fatal().Err(err).Msg(fmt.Sprintf("invalid network public key: %s", n.NetworkPubKey))
+		}
+		err = common.ValidateStakingPubKey(n.StakingPubKey)
+		if err != nil {
+			log.Fatal().Err(err).Msg(fmt.Sprintf("invalid staking public key: %s", n.StakingPubKey))
+		}
 
-		// all nodes should have equal weight
+		// all nodes should have equal weight (this might change in the future)
 		node := model.NewPublicNodeInfo(
-			nodeID,
+			n.NodeID,
 			n.Role,
 			n.Address,
 			flow.DefaultInitialWeight,
-			networkPubKey,
-			stakingPubKey,
+			n.NetworkPubKey,
+			n.StakingPubKey,
 		)
 
 		publicInfoNodes = append(publicInfoNodes, node)
diff --git a/cmd/bootstrap/cmd/finalize.go b/cmd/bootstrap/cmd/finalize.go
index 35ed1e23beb..62bc9213006 100644
--- a/cmd/bootstrap/cmd/finalize.go
+++ b/cmd/bootstrap/cmd/finalize.go
@@ -1,24 +1,25 @@
 package cmd
 
 import (
-	"crypto/rand"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/onflow/cadence"
+
 	"github.com/spf13/cobra"
 
 	"github.com/onflow/flow-go/cmd"
 	"github.com/onflow/flow-go/cmd/bootstrap/run"
 	"github.com/onflow/flow-go/cmd/bootstrap/utils"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	hotstuff "github.com/onflow/flow-go/consensus/hotstuff/model"
 	"github.com/onflow/flow-go/fvm"
 	model "github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/dkg"
-	"github.com/onflow/flow-go/model/encodable"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/epochs"
 	"github.com/onflow/flow-go/state/protocol"
@@ -30,29 +31,21 @@ import (
 var (
 	flagConfig                  string
 	flagInternalNodePrivInfoDir string
-	flagCollectionClusters      uint
 	flagPartnerNodeInfoDir      string
 	// Deprecated: use flagPartnerWeights instead
-	deprecatedFlagPartnerStakes     string
-	flagPartnerWeights              string
-	flagDKGDataPath                 string
-	flagRootBlock                   string
-	flagRootBlockVotesDir           string
-	flagRootCommit                  string
-	flagProtocolVersion             uint
+	deprecatedFlagPartnerStakes           string
+	flagPartnerWeights                    string
+	flagDKGDataPath                       string
+	flagRootBlockPath                     string
+	flagRootCommit                        string
+	flagIntermediaryBootstrappingDataPath string
+	flagRootBlockVotesDir                 string
+	// optional flags for creating
 	flagServiceAccountPublicKeyJSON string
 	flagGenesisTokenSupply          string
-	flagEpochCounter                uint64
-	flagNumViewsInEpoch             uint64
-	flagNumViewsInStakingAuction    uint64
-	flagNumViewsInDKGPhase          uint64
-	flagEpochCommitSafetyThreshold  uint64
 )
 
-// PartnerWeights is the format of the JSON file specifying partner node weights.
-type PartnerWeights map[flow.Identifier]uint64
-
-// finalizeCmd represents the finalize command
+// finalizeCmd represents the finalize command`
 var finalizeCmd = &cobra.Command{
 	Use:   "finalize",
 	Short: "Finalize the bootstrapping process",
@@ -80,37 +73,23 @@ func addFinalizeCmdFlags() {
 	finalizeCmd.Flags().StringVar(&flagPartnerWeights, "partner-weights", "", "path to a JSON file containing "+
 		"a map from partner node's NodeID to their weight")
 	finalizeCmd.Flags().StringVar(&flagDKGDataPath, "dkg-data", "", "path to a JSON file containing data as output from DKG process")
+	finalizeCmd.Flags().StringVar(&flagRootCommit, "root-commit", "0000000000000000000000000000000000000000000000000000000000000000", "state commitment of root execution state")
 
 	cmd.MarkFlagRequired(finalizeCmd, "config")
 	cmd.MarkFlagRequired(finalizeCmd, "internal-priv-dir")
 	cmd.MarkFlagRequired(finalizeCmd, "partner-dir")
 	cmd.MarkFlagRequired(finalizeCmd, "partner-weights")
 	cmd.MarkFlagRequired(finalizeCmd, "dkg-data")
+	cmd.MarkFlagRequired(finalizeCmd, "root-commit")
 
 	// required parameters for generation of root block, root execution result and root block seal
-	finalizeCmd.Flags().StringVar(&flagRootBlock, "root-block", "",
-		"path to a JSON file containing root block")
+	finalizeCmd.Flags().StringVar(&flagRootBlockPath, "root-block", "", "path to a JSON file containing root block")
+	finalizeCmd.Flags().StringVar(&flagIntermediaryBootstrappingDataPath, "intermediary-bootstrapping-data", "", "path to a JSON file containing intermediary bootstrapping data generated by the rootblock command")
 	finalizeCmd.Flags().StringVar(&flagRootBlockVotesDir, "root-block-votes-dir", "", "path to directory with votes for root block")
-	finalizeCmd.Flags().StringVar(&flagRootCommit, "root-commit", "0000000000000000000000000000000000000000000000000000000000000000", "state commitment of root execution state")
-	finalizeCmd.Flags().Uint64Var(&flagEpochCounter, "epoch-counter", 0, "epoch counter for the epoch beginning with the root block")
-	finalizeCmd.Flags().Uint64Var(&flagNumViewsInEpoch, "epoch-length", 4000, "length of each epoch measured in views")
-	finalizeCmd.Flags().Uint64Var(&flagNumViewsInStakingAuction, "epoch-staking-phase-length", 100, "length of the epoch staking phase measured in views")
-	finalizeCmd.Flags().Uint64Var(&flagNumViewsInDKGPhase, "epoch-dkg-phase-length", 1000, "length of each DKG phase measured in views")
-	finalizeCmd.Flags().Uint64Var(&flagEpochCommitSafetyThreshold, "epoch-commit-safety-threshold", 500, "defines epoch commitment deadline")
-	finalizeCmd.Flags().UintVar(&flagProtocolVersion, "protocol-version", flow.DefaultProtocolVersion, "major software version used for the duration of this spork")
 
 	cmd.MarkFlagRequired(finalizeCmd, "root-block")
+	cmd.MarkFlagRequired(finalizeCmd, "intermediary-bootstrapping-data")
 	cmd.MarkFlagRequired(finalizeCmd, "root-block-votes-dir")
-	cmd.MarkFlagRequired(finalizeCmd, "root-commit")
-	cmd.MarkFlagRequired(finalizeCmd, "epoch-counter")
-	cmd.MarkFlagRequired(finalizeCmd, "epoch-length")
-	cmd.MarkFlagRequired(finalizeCmd, "epoch-staking-phase-length")
-	cmd.MarkFlagRequired(finalizeCmd, "epoch-dkg-phase-length")
-	cmd.MarkFlagRequired(finalizeCmd, "epoch-commit-safety-threshold")
-	cmd.MarkFlagRequired(finalizeCmd, "protocol-version")
-
-	// optional parameters to influence various aspects of identity generation
-	finalizeCmd.Flags().UintVar(&flagCollectionClusters, "collection-clusters", 2, "number of collection clusters")
 
 	// these two flags are only used when setup a network from genesis
 	finalizeCmd.Flags().StringVar(&flagServiceAccountPublicKeyJSON, "service-account-public-key-json",
@@ -132,21 +111,22 @@ func finalize(cmd *cobra.Command, args []string) {
 		}
 	}
 
-	// validate epoch configs
-	err := validateEpochConfig()
+	log.Info().Msg("collecting partner network and staking keys")
+	partnerNodes, err := common.ReadFullPartnerNodeInfos(log, flagPartnerWeights, flagPartnerNodeInfoDir)
 	if err != nil {
-		log.Fatal().Err(err).Msg("invalid or unsafe epoch commit threshold config")
+		log.Fatal().Err(err).Msg("failed to read full partner node infos")
 	}
-
-	log.Info().Msg("collecting partner network and staking keys")
-	partnerNodes := readPartnerNodeInfos()
 	log.Info().Msg("")
 
 	log.Info().Msg("generating internal private networking and staking keys")
-	internalNodes := readInternalNodeInfos()
+	internalNodes, err := common.ReadFullInternalNodeInfos(log, flagInternalNodePrivInfoDir, flagConfig)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to read full internal node infos")
+	}
+
 	log.Info().Msg("")
 
-	log.Info().Msg("checking constraints on consensus/cluster nodes")
+	log.Info().Msg("checking constraints on consensus nodes")
 	checkConstraints(partnerNodes, internalNodes)
 	log.Info().Msg("")
 
@@ -155,7 +135,7 @@ func finalize(cmd *cobra.Command, args []string) {
 	log.Info().Msg("")
 
 	// create flow.IdentityList representation of participant set
-	participants := model.ToIdentityList(stakingNodes).Sort(flow.Canonical)
+	participants := model.ToIdentityList(stakingNodes).Sort(flow.Canonical[flow.Identity])
 
 	log.Info().Msg("reading root block data")
 	block := readRootBlock()
@@ -171,6 +151,9 @@ func finalize(cmd *cobra.Command, args []string) {
 	dkgData := readDKGData()
 	log.Info().Msg("")
 
+	log.Info().Msg("reading intermediary bootstrapping data")
+	intermediaryData, epochSetup, epochCommit := readIntermediaryBootstrappingData()
+
 	log.Info().Msg("constructing root QC")
 	rootQC := constructRootQC(
 		block,
@@ -181,40 +164,23 @@ func finalize(cmd *cobra.Command, args []string) {
 	)
 	log.Info().Msg("")
 
-	log.Info().Msg("computing collection node clusters")
-	assignments, clusters, err := constructClusterAssignment(partnerNodes, internalNodes)
-	if err != nil {
-		log.Fatal().Err(err).Msg("unable to generate cluster assignment")
-	}
-	log.Info().Msg("")
-
-	log.Info().Msg("constructing root blocks for collection node clusters")
-	clusterBlocks := run.GenerateRootClusterBlocks(flagEpochCounter, clusters)
-	log.Info().Msg("")
-
-	log.Info().Msg("constructing root QCs for collection node clusters")
-	clusterQCs := constructRootQCsForClusters(clusters, internalNodes, clusterBlocks)
-	log.Info().Msg("")
-
 	// if no root commit is specified, bootstrap an empty execution state
 	if flagRootCommit == "0000000000000000000000000000000000000000000000000000000000000000" {
 		commit := generateEmptyExecutionState(
-			block.Header.ChainID,
-			assignments,
-			clusterQCs,
-			dkgData,
+			block.Header,
+			intermediaryData.ExecutionStateConfig,
 			participants,
 		)
 		flagRootCommit = hex.EncodeToString(commit[:])
 	}
 
 	log.Info().Msg("constructing root execution result and block seal")
-	result, seal := constructRootResultAndSeal(flagRootCommit, block, participants, assignments, clusterQCs, dkgData)
+	result, seal := constructRootResultAndSeal(flagRootCommit, block, epochSetup, epochCommit)
 	log.Info().Msg("")
 
 	// construct serializable root protocol snapshot
 	log.Info().Msg("constructing root protocol snapshot")
-	snapshot, err := inmem.SnapshotFromBootstrapStateWithParams(block, result, seal, rootQC, flagProtocolVersion, flagEpochCommitSafetyThreshold)
+	snapshot, err := inmem.SnapshotFromBootstrapStateWithParams(block, result, seal, rootQC, intermediaryData.ProtocolVersion, intermediaryData.EpochCommitSafetyThreshold)
 	if err != nil {
 		log.Fatal().Err(err).Msg("unable to generate root protocol snapshot")
 	}
@@ -233,13 +199,17 @@ func finalize(cmd *cobra.Command, args []string) {
 	}
 
 	// write snapshot to disk
-	writeJSON(model.PathRootProtocolStateSnapshot, snapshot.Encodable())
+	err = common.WriteJSON(model.PathRootProtocolStateSnapshot, flagOutdir, snapshot.Encodable())
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, model.PathRootProtocolStateSnapshot)
 	log.Info().Msg("")
 
 	// read snapshot and verify consistency
 	rootSnapshot, err := loadRootProtocolSnapshot(model.PathRootProtocolStateSnapshot)
 	if err != nil {
-		log.Fatal().Err(err).Msg("unable to load seralized root protocol")
+		log.Fatal().Err(err).Msg("unable to load serialized root protocol")
 	}
 
 	savedResult, savedSeal, err := rootSnapshot.SealedResult()
@@ -288,7 +258,7 @@ func finalize(cmd *cobra.Command, args []string) {
 	log.Info().Msg("")
 
 	// print count of all nodes
-	roleCounts := nodeCountByRole(stakingNodes)
+	roleCounts := common.NodeCountByRole(stakingNodes)
 	log.Info().Msg(fmt.Sprintf("created keys for %d %s nodes", roleCounts[flow.RoleConsensus], flow.RoleConsensus.String()))
 	log.Info().Msg(fmt.Sprintf("created keys for %d %s nodes", roleCounts[flow.RoleCollection], flow.RoleCollection.String()))
 	log.Info().Msg(fmt.Sprintf("created keys for %d %s nodes", roleCounts[flow.RoleVerification], flow.RoleVerification.String()))
@@ -301,7 +271,7 @@ func finalize(cmd *cobra.Command, args []string) {
 // readRootBlockVotes reads votes for root block
 func readRootBlockVotes() []*hotstuff.Vote {
 	var votes []*hotstuff.Vote
-	files, err := filesInDir(flagRootBlockVotesDir)
+	files, err := common.FilesInDir(flagRootBlockVotesDir)
 	if err != nil {
 		log.Fatal().Err(err).Msg("could not read root block votes")
 	}
@@ -313,159 +283,17 @@ func readRootBlockVotes() []*hotstuff.Vote {
 
 		// read file and append to partners
 		var vote hotstuff.Vote
-		readJSON(f, &vote)
+		err = common.ReadJSON(f, &vote)
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed to read json")
+		}
+
 		votes = append(votes, &vote)
 		log.Info().Msgf("read vote %v for block %v from signerID %v", vote.ID(), vote.BlockID, vote.SignerID)
 	}
 	return votes
 }
 
-// readPartnerNodeInfos returns a list of partner nodes after gathering weights
-// and public key information from configuration files
-func readPartnerNodeInfos() []model.NodeInfo {
-	partners := readPartnerNodes()
-	log.Info().Msgf("read %d partner node configuration files", len(partners))
-
-	var weights PartnerWeights
-	readJSON(flagPartnerWeights, &weights)
-	log.Info().Msgf("read %d weights for partner nodes", len(weights))
-
-	var nodes []model.NodeInfo
-	for _, partner := range partners {
-		// validate every single partner node
-		nodeID := validateNodeID(partner.NodeID)
-		networkPubKey := validateNetworkPubKey(partner.NetworkPubKey)
-		stakingPubKey := validateStakingPubKey(partner.StakingPubKey)
-		weight, valid := validateWeight(weights[partner.NodeID])
-		if !valid {
-			log.Error().Msgf("weights: %v", weights)
-			log.Fatal().Msgf("partner node id %x has no weight", nodeID)
-		}
-		if weight != flow.DefaultInitialWeight {
-			log.Warn().Msgf("partner node (id=%x) has non-default weight (%d != %d)", partner.NodeID, weight, flow.DefaultInitialWeight)
-		}
-
-		node := model.NewPublicNodeInfo(
-			nodeID,
-			partner.Role,
-			partner.Address,
-			weight,
-			networkPubKey.PublicKey,
-			stakingPubKey.PublicKey,
-		)
-		nodes = append(nodes, node)
-	}
-
-	return nodes
-}
-
-// readPartnerNodes reads the partner node information
-func readPartnerNodes() []model.NodeInfoPub {
-	var partners []model.NodeInfoPub
-	files, err := filesInDir(flagPartnerNodeInfoDir)
-	if err != nil {
-		log.Fatal().Err(err).Msg("could not read partner node infos")
-	}
-	for _, f := range files {
-		// skip files that do not include node-infos
-		if !strings.Contains(f, model.PathPartnerNodeInfoPrefix) {
-			continue
-		}
-
-		// read file and append to partners
-		var p model.NodeInfoPub
-		readJSON(f, &p)
-		partners = append(partners, p)
-	}
-	return partners
-}
-
-// readInternalNodeInfos returns a list of internal nodes after collecting weights
-// from configuration files
-func readInternalNodeInfos() []model.NodeInfo {
-	privInternals := readInternalNodes()
-	log.Info().Msgf("read %v internal private node-info files", len(privInternals))
-
-	weights := internalWeightsByAddress()
-	log.Info().Msgf("read %d weights for internal nodes", len(weights))
-
-	var nodes []model.NodeInfo
-	for _, internal := range privInternals {
-		// check if address is valid format
-		validateAddressFormat(internal.Address)
-
-		// validate every single internal node
-		nodeID := validateNodeID(internal.NodeID)
-		weight, valid := validateWeight(weights[internal.Address])
-		if !valid {
-			log.Error().Msgf("weights: %v", weights)
-			log.Fatal().Msgf("internal node %v has no weight. Did you forget to update the node address?", internal)
-		}
-		if weight != flow.DefaultInitialWeight {
-			log.Warn().Msgf("internal node (id=%x) has non-default weight (%d != %d)", internal.NodeID, weight, flow.DefaultInitialWeight)
-		}
-
-		node := model.NewPrivateNodeInfo(
-			nodeID,
-			internal.Role,
-			internal.Address,
-			weight,
-			internal.NetworkPrivKey,
-			internal.StakingPrivKey,
-		)
-
-		nodes = append(nodes, node)
-	}
-
-	return nodes
-}
-
-// readInternalNodes reads our internal node private infos generated by
-// `keygen` command and returns it
-func readInternalNodes() []model.NodeInfoPriv {
-	var internalPrivInfos []model.NodeInfoPriv
-
-	// get files in internal priv node infos directory
-	files, err := filesInDir(flagInternalNodePrivInfoDir)
-	if err != nil {
-		log.Fatal().Err(err).Msg("could not read partner node infos")
-	}
-
-	// for each of the files
-	for _, f := range files {
-		// skip files that do not include node-infos
-		if !strings.Contains(f, model.PathPrivNodeInfoPrefix) {
-			continue
-		}
-
-		// read file and append to partners
-		var p model.NodeInfoPriv
-		readJSON(f, &p)
-		internalPrivInfos = append(internalPrivInfos, p)
-	}
-
-	return internalPrivInfos
-}
-
-// internalWeightsByAddress returns a mapping of node address by weight for internal nodes
-func internalWeightsByAddress() map[string]uint64 {
-	// read json
-	var configs []model.NodeConfig
-	readJSON(flagConfig, &configs)
-	log.Info().Interface("config", configs).Msgf("read internal node configurations")
-
-	weights := make(map[string]uint64)
-	for _, config := range configs {
-		if _, ok := weights[config.Address]; !ok {
-			weights[config.Address] = config.Weight
-		} else {
-			log.Error().Msgf("duplicate internal node address %s", config.Address)
-		}
-	}
-
-	return weights
-}
-
 // mergeNodeInfos merges the internal and partner nodes and checks if there are no
 // duplicate addresses or node Ids.
 //
@@ -491,7 +319,7 @@ func mergeNodeInfos(internalNodes, partnerNodes []model.NodeInfo) []model.NodeIn
 	}
 
 	// sort nodes using the canonical ordering
-	nodes = model.Sort(nodes, flow.Canonical)
+	nodes = model.Sort(nodes, flow.Canonical[flow.Identity])
 
 	return nodes
 }
@@ -499,15 +327,17 @@ func mergeNodeInfos(internalNodes, partnerNodes []model.NodeInfo) []model.NodeIn
 // readRootBlock reads root block data from disc, this file needs to be prepared with
 // rootblock command
 func readRootBlock() *flow.Block {
-	rootBlock, err := utils.ReadRootBlock(flagRootBlock)
+	rootBlock, err := utils.ReadData[flow.Block](flagRootBlockPath)
 	if err != nil {
 		log.Fatal().Err(err).Msg("could not read root block data")
 	}
 	return rootBlock
 }
 
+// readDKGData reads DKG data from disc, this file needs to be prepared with
+// rootblock command
 func readDKGData() dkg.DKGData {
-	encodableDKG, err := utils.ReadDKGData(flagDKGDataPath)
+	encodableDKG, err := utils.ReadData[inmem.EncodableFullDKG](flagDKGDataPath)
 	if err != nil {
 		log.Fatal().Err(err).Msg("could not read DKG data")
 	}
@@ -531,31 +361,6 @@ func readDKGData() dkg.DKGData {
 
 // Validation utility methods ------------------------------------------------
 
-func validateNodeID(nodeID flow.Identifier) flow.Identifier {
-	if nodeID == flow.ZeroID {
-		log.Fatal().Msg("NodeID must not be zero")
-	}
-	return nodeID
-}
-
-func validateNetworkPubKey(key encodable.NetworkPubKey) encodable.NetworkPubKey {
-	if key.PublicKey == nil {
-		log.Fatal().Msg("NetworkPubKey must not be nil")
-	}
-	return key
-}
-
-func validateStakingPubKey(key encodable.StakingPubKey) encodable.StakingPubKey {
-	if key.PublicKey == nil {
-		log.Fatal().Msg("StakingPubKey must not be nil")
-	}
-	return key
-}
-
-func validateWeight(weight uint64) (uint64, bool) {
-	return weight, weight > 0
-}
-
 // loadRootProtocolSnapshot loads the root protocol snapshot from disk
 func loadRootProtocolSnapshot(path string) (*inmem.Snapshot, error) {
 	data, err := io.ReadFile(filepath.Join(flagOutdir, path))
@@ -572,13 +377,30 @@ func loadRootProtocolSnapshot(path string) (*inmem.Snapshot, error) {
 	return inmem.SnapshotFromEncodable(snapshot), nil
 }
 
+// readIntermediaryBootstrappingData reads intermediary bootstrapping data file from disk.
+// This file needs to be prepared with rootblock command
+func readIntermediaryBootstrappingData() (*IntermediaryBootstrappingData, *flow.EpochSetup, *flow.EpochCommit) {
+	intermediaryData, err := utils.ReadData[IntermediaryBootstrappingData](flagIntermediaryBootstrappingDataPath)
+	if err != nil {
+		log.Fatal().Err(err).Msg("could not read root epoch data")
+	}
+	epoch := inmem.NewEpoch(intermediaryData.ProtocolStateRootEpoch)
+	setup, err := protocol.ToEpochSetup(epoch)
+	if err != nil {
+		log.Fatal().Err(err).Msg("could not extract setup event")
+	}
+	commit, err := protocol.ToEpochCommit(epoch)
+	if err != nil {
+		log.Fatal().Err(err).Msg("could not extract commit event")
+	}
+	return intermediaryData, setup, commit
+}
+
 // generateEmptyExecutionState generates a new empty execution state with the
 // given configuration. Sets the flagRootCommit variable for future reads.
 func generateEmptyExecutionState(
-	chainID flow.ChainID,
-	assignments flow.AssignmentList,
-	clusterQCs []*flow.QuorumCertificate,
-	dkgData dkg.DKGData,
+	rootBlock *flow.Header,
+	epochConfig epochs.EpochConfig,
 	identities flow.IdentityList,
 ) (commit flow.StateCommitment) {
 
@@ -594,34 +416,11 @@ func generateEmptyExecutionState(
 		log.Fatal().Err(err).Msg("invalid genesis token supply")
 	}
 
-	randomSource := make([]byte, flow.EpochSetupRandomSourceLength)
-	if _, err = rand.Read(randomSource); err != nil {
-		log.Fatal().Err(err).Msg("failed to generate a random source")
-	}
-	cdcRandomSource, err := cadence.NewString(hex.EncodeToString(randomSource))
-	if err != nil {
-		log.Fatal().Err(err).Msg("invalid random source")
-	}
-
-	epochConfig := epochs.EpochConfig{
-		EpochTokenPayout:             cadence.UFix64(0),
-		RewardCut:                    cadence.UFix64(0),
-		CurrentEpochCounter:          cadence.UInt64(flagEpochCounter),
-		NumViewsInEpoch:              cadence.UInt64(flagNumViewsInEpoch),
-		NumViewsInStakingAuction:     cadence.UInt64(flagNumViewsInStakingAuction),
-		NumViewsInDKGPhase:           cadence.UInt64(flagNumViewsInDKGPhase),
-		NumCollectorClusters:         cadence.UInt16(flagCollectionClusters),
-		FLOWsupplyIncreasePercentage: cadence.UFix64(0),
-		RandomSource:                 cdcRandomSource,
-		CollectorClusters:            assignments,
-		ClusterQCs:                   clusterQCs,
-		DKGPubKeys:                   dkgData.PubKeyShares,
-	}
-
 	commit, err = run.GenerateExecutionState(
 		filepath.Join(flagOutdir, model.DirnameExecutionState),
 		serviceAccountPublicKey,
-		chainID.Chain(),
+		rootBlock.ChainID.Chain(),
+		fvm.WithRootBlock(rootBlock),
 		fvm.WithInitialTokenSupply(cdcInitialTokenSupply),
 		fvm.WithMinimumStorageReservation(fvm.DefaultMinimumStorageReservation),
 		fvm.WithAccountCreationFee(fvm.DefaultAccountCreationFee),
@@ -636,29 +435,43 @@ func generateEmptyExecutionState(
 	return commit
 }
 
-// validateEpochConfig validates configuration of the epoch commitment deadline.
-func validateEpochConfig() error {
-	chainID := parseChainID(flagRootChain)
-	dkgFinalView := flagNumViewsInStakingAuction + flagNumViewsInDKGPhase*3 // 3 DKG phases
-	epochCommitDeadline := flagNumViewsInEpoch - flagEpochCommitSafetyThreshold
-
-	defaultSafetyThreshold, err := protocol.DefaultEpochCommitSafetyThreshold(chainID)
-	if err != nil {
-		return fmt.Errorf("could not get default epoch commit safety threshold: %w", err)
-	}
+// validateOrPopulateEpochTimingConfig validates the epoch timing config flags. In case the
+// `flagUseDefaultEpochTargetEndTime` value has been set, the function derives the values for
+// `flagEpochTimingRefCounter`, `flagEpochTimingDuration`, and `flagEpochTimingRefTimestamp`
+// from the configuration. Otherwise, it enforces that compatible values for the respective parameters have been
+// specified (and errors otherwise). Therefore, after `validateOrPopulateEpochTimingConfig` ran,
+// the targeted end time for the epoch can be computed via `rootEpochTargetEndTime()`.
+// You can either let the tool choose default values, or specify a value for each config.
+func validateOrPopulateEpochTimingConfig() error {
+	// Default timing is intended for Benchnet, Localnet, etc.
+	// Manually specified timings for Mainnet, Testnet, Canary.
+	if flagUseDefaultEpochTargetEndTime {
+		// No other flags may be set
+		if !(flagEpochTimingRefTimestamp == 0 && flagEpochTimingDuration == 0 && flagEpochTimingRefCounter == 0) {
+			return fmt.Errorf("invalid epoch timing config: cannot specify ANY of --epoch-timing-ref-counter, --epoch-timing-ref-timestamp, or --epoch-timing-duration if using default timing config")
+		}
+		flagEpochTimingRefCounter = flagEpochCounter
+		flagEpochTimingDuration = flagNumViewsInEpoch
+		flagEpochTimingRefTimestamp = uint64(time.Now().Unix()) + flagNumViewsInEpoch
+
+		// compute target end time for initial (root) epoch from flags: `TargetEndTime = RefTimestamp + (RootEpochCounter - RefEpochCounter) * Duration`
+		rootEpochTargetEndTimeUNIX := rootEpochTargetEndTime()
+		rootEpochTargetEndTime := time.Unix(int64(rootEpochTargetEndTimeUNIX), 0)
+		log.Info().Msgf("using default epoch timing config with root epoch target end time %s, which is in %s", rootEpochTargetEndTime, time.Until(rootEpochTargetEndTime))
+	} else {
+		// All other flags must be set
+		// NOTE: it is valid for flagEpochTimingRefCounter to be set to 0
+		if flagEpochTimingRefTimestamp == 0 || flagEpochTimingDuration == 0 {
+			return fmt.Errorf("invalid epoch timing config: must specify ALL of --epoch-timing-ref-counter, --epoch-timing-ref-timestamp, and --epoch-timing-duration")
+		}
+		if flagEpochCounter < flagEpochTimingRefCounter {
+			return fmt.Errorf("invalid epoch timing config: reference epoch counter must be less than or equal to root epoch counter")
+		}
 
-	// sanity check: the safety threshold is >= the default for the chain
-	if flagEpochCommitSafetyThreshold < defaultSafetyThreshold {
-		return fmt.Errorf("potentially unsafe epoch config: epoch commit safety threshold smaller than expected (%d < %d)", flagEpochCommitSafetyThreshold, defaultSafetyThreshold)
-	}
-	// sanity check: epoch commitment deadline cannot be before the DKG end
-	if epochCommitDeadline <= dkgFinalView {
-		return fmt.Errorf("invalid epoch config: the epoch commitment deadline (%d) is before the DKG final view (%d)", epochCommitDeadline, dkgFinalView)
-	}
-	// sanity check: the difference between DKG end and safety threshold is also >= the default safety threshold
-	if epochCommitDeadline-dkgFinalView < defaultSafetyThreshold {
-		return fmt.Errorf("potentially unsafe epoch config: time between DKG end and epoch commitment deadline is smaller than expected (%d-%d < %d)",
-			epochCommitDeadline, dkgFinalView, defaultSafetyThreshold)
+		// compute target end time for initial (root) epoch from flags: `TargetEndTime = RefTimestamp + (RootEpochCounter - RefEpochCounter) * Duration`
+		rootEpochTargetEndTimeUNIX := rootEpochTargetEndTime()
+		rootEpochTargetEndTime := time.Unix(int64(rootEpochTargetEndTimeUNIX), 0)
+		log.Info().Msgf("using user-specified epoch timing config with root epoch target end time %s, which is in %s", rootEpochTargetEndTime, time.Until(rootEpochTargetEndTime))
 	}
 	return nil
 }
diff --git a/cmd/bootstrap/cmd/finalize_test.go b/cmd/bootstrap/cmd/finalize_test.go
index 58929d21e81..89088898c7d 100644
--- a/cmd/bootstrap/cmd/finalize_test.go
+++ b/cmd/bootstrap/cmd/finalize_test.go
@@ -2,15 +2,18 @@ package cmd
 
 import (
 	"encoding/hex"
+	"math/rand"
 	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
 
+	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	utils "github.com/onflow/flow-go/cmd/bootstrap/utils"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	model "github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/utils/unittest"
@@ -23,16 +26,14 @@ const finalizeHappyPathLogs = "collecting partner network and staking keys" +
 	`read \d+ internal private node-info files` +
 	`read internal node configurations` +
 	`read \d+ weights for internal nodes` +
-	`checking constraints on consensus/cluster nodes` +
+	`checking constraints on consensus nodes` +
 	`assembling network and staking keys` +
 	`reading root block data` +
 	`reading root block votes` +
 	`read vote .*` +
 	`reading dkg data` +
+	`reading intermediary bootstrapping data` +
 	`constructing root QC` +
-	`computing collection node clusters` +
-	`constructing root blocks for collection node clusters` +
-	`constructing root QCs for collection node clusters` +
 	`constructing root execution result and block seal` +
 	`constructing root protocol snapshot` +
 	`wrote file \S+/root-protocol-state-snapshot.json` +
@@ -68,17 +69,22 @@ func TestFinalize_HappyPath(t *testing.T) {
 		flagRootChain = chainName
 		flagRootParent = hex.EncodeToString(rootParent[:])
 		flagRootHeight = rootHeight
-
-		// rootBlock will generate DKG and place it into bootDir/public-root-information
-		rootBlock(nil, nil)
-
 		flagRootCommit = hex.EncodeToString(rootCommit[:])
 		flagEpochCounter = epochCounter
 		flagNumViewsInEpoch = 100_000
 		flagNumViewsInStakingAuction = 50_000
 		flagNumViewsInDKGPhase = 2_000
 		flagEpochCommitSafetyThreshold = 1_000
-		flagRootBlock = filepath.Join(bootDir, model.PathRootBlockData)
+		flagUseDefaultEpochTargetEndTime = true
+		flagEpochTimingRefCounter = 0
+		flagEpochTimingRefTimestamp = 0
+		flagEpochTimingDuration = 0
+
+		// rootBlock will generate DKG and place it into bootDir/public-root-information
+		rootBlock(nil, nil)
+
+		flagRootBlockPath = filepath.Join(bootDir, model.PathRootBlockData)
+		flagIntermediaryBootstrappingDataPath = filepath.Join(bootDir, model.PathIntermediaryBootstrappingData)
 		flagDKGDataPath = filepath.Join(bootDir, model.PathRootDKGData)
 		flagRootBlockVotesDir = filepath.Join(bootDir, model.DirnameRootBlockVotes)
 
@@ -104,20 +110,64 @@ func TestClusterAssignment(t *testing.T) {
 	partners := unittest.NodeInfosFixture(partnersLen, unittest.WithRole(flow.RoleCollection))
 	internals := unittest.NodeInfosFixture(internalLen, unittest.WithRole(flow.RoleCollection))
 
+	log := zerolog.Nop()
 	// should not error
-	_, clusters, err := constructClusterAssignment(partners, internals)
+	_, clusters, err := common.ConstructClusterAssignment(log, model.ToIdentityList(partners), model.ToIdentityList(internals), int(flagCollectionClusters))
 	require.NoError(t, err)
 	require.True(t, checkClusterConstraint(clusters, partners, internals))
 
 	// unhappy Path
 	internals = internals[:21] // reduce one internal node
 	// should error
-	_, _, err = constructClusterAssignment(partners, internals)
+	_, _, err = common.ConstructClusterAssignment(log, model.ToIdentityList(partners), model.ToIdentityList(internals), int(flagCollectionClusters))
 	require.Error(t, err)
 	// revert the flag value
 	flagCollectionClusters = tmp
 }
 
+func TestEpochTimingConfig(t *testing.T) {
+	// Reset flags after test is completed
+	defer func(_flagDefault bool, _flagRefCounter, _flagRefTs, _flagDur uint64) {
+		flagUseDefaultEpochTargetEndTime = _flagDefault
+		flagEpochTimingRefCounter = _flagRefCounter
+		flagEpochTimingRefTimestamp = _flagRefTs
+		flagEpochTimingDuration = _flagDur
+	}(flagUseDefaultEpochTargetEndTime, flagEpochTimingRefCounter, flagEpochTimingRefTimestamp, flagEpochTimingDuration)
+
+	flags := []*uint64{&flagEpochTimingRefCounter, &flagEpochTimingRefTimestamp, &flagEpochTimingDuration}
+	t.Run("if default is set, no other flag may be set", func(t *testing.T) {
+		flagUseDefaultEpochTargetEndTime = true
+		for _, flag := range flags {
+			*flag = rand.Uint64()%100 + 1
+			err := validateOrPopulateEpochTimingConfig()
+			assert.Error(t, err)
+			*flag = 0 // set the flag back to 0
+		}
+		err := validateOrPopulateEpochTimingConfig()
+		assert.NoError(t, err)
+	})
+
+	t.Run("if default is not set, all other flags must be set", func(t *testing.T) {
+		flagUseDefaultEpochTargetEndTime = false
+		// First set all required flags and ensure validation passes
+		flagEpochTimingRefCounter = rand.Uint64() % flagEpochCounter
+		flagEpochTimingDuration = rand.Uint64()%100_000 + 1
+		flagEpochTimingRefTimestamp = rand.Uint64()
+
+		err := validateOrPopulateEpochTimingConfig()
+		assert.NoError(t, err)
+
+		// Next, check that validation fails if any one flag is not set
+		// NOTE: we do not include refCounter here, because it is allowed to be zero.
+		for _, flag := range []*uint64{&flagEpochTimingRefTimestamp, &flagEpochTimingDuration} {
+			*flag = 0
+			err := validateOrPopulateEpochTimingConfig()
+			assert.Error(t, err)
+			*flag = rand.Uint64()%100 + 1 // set the flag back to a non-zero value
+		}
+	})
+}
+
 // Check about the number of internal/partner nodes in each cluster. The identites
 // in each cluster do not matter for this check.
 func checkClusterConstraint(clusters flow.ClusterList, partnersInfo []model.NodeInfo, internalsInfo []model.NodeInfo) bool {
diff --git a/cmd/bootstrap/cmd/genconfig.go b/cmd/bootstrap/cmd/genconfig.go
index ccf66104ecc..f1902778f3a 100644
--- a/cmd/bootstrap/cmd/genconfig.go
+++ b/cmd/bootstrap/cmd/genconfig.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	model "github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
 )
@@ -56,7 +57,11 @@ func genconfigCmdRun(_ *cobra.Command, _ []string) {
 		configs = append(configs, createConf(flow.RoleVerification, i))
 	}
 
-	writeJSON(flagConfig, configs)
+	err := common.WriteJSON(flagConfig, flagOutdir, configs)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, flagConfig)
 }
 
 // genconfigCmd represents the genconfig command
diff --git a/cmd/bootstrap/cmd/intermediary.go b/cmd/bootstrap/cmd/intermediary.go
new file mode 100644
index 00000000000..8b9b311420b
--- /dev/null
+++ b/cmd/bootstrap/cmd/intermediary.go
@@ -0,0 +1,30 @@
+package cmd
+
+import (
+	"github.com/onflow/flow-go/module/epochs"
+	"github.com/onflow/flow-go/state/protocol/inmem"
+)
+
+// IntermediaryBootstrappingData stores data which needs to be passed between the
+// 2 steps of the bootstrapping process: `rootblock` and `finalize`.
+// This structure is created in `rootblock`, written to disk, then read in `finalize`.
+type IntermediaryBootstrappingData struct {
+	IntermediaryParamsData
+	IntermediaryEpochData
+}
+
+// IntermediaryParamsData stores the subset of protocol.GlobalParams which can be independently configured
+// by the network operator (i.e. which is not dependent on other bootstrapping artifacts,
+// like the root block).
+// This is used to pass data between the rootblock command and the finalize command.
+type IntermediaryParamsData struct {
+	ProtocolVersion            uint
+	EpochCommitSafetyThreshold uint64
+}
+
+// IntermediaryEpochData stores the root epoch and the epoch config for the execution state.
+// This is used to pass data between the rootblock command and the finalize command.
+type IntermediaryEpochData struct {
+	ExecutionStateConfig   epochs.EpochConfig
+	ProtocolStateRootEpoch inmem.EncodableEpoch
+}
diff --git a/cmd/bootstrap/cmd/key.go b/cmd/bootstrap/cmd/key.go
index d8cdc46afa1..7ef97a19a8e 100644
--- a/cmd/bootstrap/cmd/key.go
+++ b/cmd/bootstrap/cmd/key.go
@@ -2,18 +2,15 @@ package cmd
 
 import (
 	"fmt"
-	"net"
-	"strconv"
 
-	"github.com/multiformats/go-multiaddr"
 	"github.com/onflow/crypto"
 	"github.com/spf13/cobra"
 
 	"github.com/onflow/flow-go/cmd"
 	"github.com/onflow/flow-go/cmd/bootstrap/utils"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	model "github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
-	p2putils "github.com/onflow/flow-go/network/p2p/utils"
 )
 
 var (
@@ -75,7 +72,7 @@ func keyCmdRun(_ *cobra.Command, _ []string) {
 
 	// validate inputs
 	role := validateRole(flagRole)
-	validateAddressFormat(flagAddress)
+	common.ValidateAddressFormat(log, flagAddress)
 
 	// generate staking and network keys
 	networkKey, stakingKey, secretsDBKey, err := generateKeys()
@@ -97,10 +94,29 @@ func keyCmdRun(_ *cobra.Command, _ []string) {
 	}
 
 	// write files
-	writeText(model.PathNodeID, []byte(nodeInfo.NodeID.String()))
-	writeJSON(fmt.Sprintf(model.PathNodeInfoPriv, nodeInfo.NodeID), private)
-	writeText(fmt.Sprintf(model.PathSecretsEncryptionKey, nodeInfo.NodeID), secretsDBKey)
-	writeJSON(fmt.Sprintf(model.PathNodeInfoPub, nodeInfo.NodeID), nodeInfo.Public())
+	err = common.WriteText(model.PathNodeID, flagOutdir, []byte(nodeInfo.NodeID.String()))
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write file")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, model.PathNodeID)
+
+	err = common.WriteJSON(fmt.Sprintf(model.PathNodeInfoPriv, nodeInfo.NodeID), flagOutdir, private)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, model.PathNodeInfoPriv)
+
+	err = common.WriteText(fmt.Sprintf(model.PathSecretsEncryptionKey, nodeInfo.NodeID), flagOutdir, secretsDBKey)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write file")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, model.PathSecretsEncryptionKey)
+
+	err = common.WriteJSON(fmt.Sprintf(model.PathNodeInfoPub, nodeInfo.NodeID), flagOutdir, nodeInfo.Public())
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, model.PathNodeInfoPub)
 
 	// write machine account info
 	if role == flow.RoleCollection || role == flow.RoleConsensus {
@@ -114,7 +130,11 @@ func keyCmdRun(_ *cobra.Command, _ []string) {
 		log.Debug().Str("address", flagAddress).Msg("assembling machine account information")
 		// write the public key to terminal for entry in Flow Port
 		machineAccountPriv := assembleNodeMachineAccountKey(machineKey)
-		writeJSON(fmt.Sprintf(model.PathNodeMachineAccountPrivateKey, nodeInfo.NodeID), machineAccountPriv)
+		err = common.WriteJSON(fmt.Sprintf(model.PathNodeMachineAccountPrivateKey, nodeInfo.NodeID), flagOutdir, machineAccountPriv)
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed to write json")
+		}
+		log.Info().Msgf("wrote file %s/%s", flagOutdir, model.PathNodeMachineAccountPrivateKey)
 	}
 }
 
@@ -164,27 +184,3 @@ func validateRole(role string) flow.Role {
 	}
 	return parsed
 }
-
-// validateAddressFormat validates the address provided by pretty much doing what the network layer would do before
-// starting the node
-func validateAddressFormat(address string) {
-	checkErr := func(err error) {
-		if err != nil {
-			log.Fatal().Err(err).Str("address", address).Msg("invalid address format.\n" +
-				`Address needs to be in the format hostname:port or ip:port e.g. "flow.com:3569"`)
-		}
-	}
-
-	// split address into ip/hostname and port
-	ip, port, err := net.SplitHostPort(address)
-	checkErr(err)
-
-	// check that port number is indeed a number
-	_, err = strconv.Atoi(port)
-	checkErr(err)
-
-	// create a libp2p address from the ip and port
-	lp2pAddr := p2putils.MultiAddressStr(ip, port)
-	_, err = multiaddr.NewMultiaddr(lp2pAddr)
-	checkErr(err)
-}
diff --git a/cmd/bootstrap/cmd/keygen.go b/cmd/bootstrap/cmd/keygen.go
index 62457fe4b56..43da4d6cf90 100644
--- a/cmd/bootstrap/cmd/keygen.go
+++ b/cmd/bootstrap/cmd/keygen.go
@@ -5,11 +5,11 @@ import (
 	"io"
 	"os"
 
-	"github.com/onflow/flow-go/cmd"
-	"github.com/onflow/flow-go/cmd/bootstrap/utils"
-
 	"github.com/spf13/cobra"
 
+	"github.com/onflow/flow-go/cmd"
+	"github.com/onflow/flow-go/cmd/bootstrap/utils"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	model "github.com/onflow/flow-go/model/bootstrap"
 )
 
@@ -22,7 +22,7 @@ var keygenCmd = &cobra.Command{
 	Long:  `Generate Staking and Networking keys for a list of nodes provided by the flag '--config'`,
 	Run: func(cmd *cobra.Command, args []string) {
 		// check if out directory exists
-		exists, err := pathExists(flagOutdir)
+		exists, err := common.PathExists(flagOutdir)
 		if err != nil {
 			log.Error().Msg("could not check if directory exists")
 			return
@@ -49,12 +49,10 @@ var keygenCmd = &cobra.Command{
 
 		// write key files
 		writeJSONFile := func(relativePath string, val interface{}) error {
-			writeJSON(relativePath, val)
-			return nil
+			return common.WriteJSON(relativePath, flagOutdir, val)
 		}
 		writeFile := func(relativePath string, data []byte) error {
-			writeText(relativePath, data)
-			return nil
+			return common.WriteText(relativePath, flagOutdir, data)
 		}
 
 		log.Info().Msg("writing internal private key files")
@@ -85,7 +83,7 @@ var keygenCmd = &cobra.Command{
 		}
 
 		// count roles
-		roleCounts := nodeCountByRole(nodes)
+		roleCounts := common.NodeCountByRole(nodes)
 		for role, count := range roleCounts {
 			log.Info().Msg(fmt.Sprintf("created keys for %d %s nodes", count, role.String()))
 		}
@@ -127,5 +125,9 @@ func genNodePubInfo(nodes []model.NodeInfo) {
 	for _, node := range nodes {
 		pubNodes = append(pubNodes, node.Public())
 	}
-	writeJSON(model.PathInternalNodeInfosPub, pubNodes)
+	err := common.WriteJSON(model.PathInternalNodeInfosPub, flagOutdir, pubNodes)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, model.PathInternalNodeInfosPub)
 }
diff --git a/cmd/bootstrap/cmd/keys.go b/cmd/bootstrap/cmd/keys.go
index ae4a98cfda0..f33b5f28241 100644
--- a/cmd/bootstrap/cmd/keys.go
+++ b/cmd/bootstrap/cmd/keys.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/onflow/crypto"
 
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	model "github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/encodable"
 	"github.com/onflow/flow-go/model/flow"
@@ -20,7 +21,11 @@ import (
 func genNetworkAndStakingKeys() []model.NodeInfo {
 
 	var nodeConfigs []model.NodeConfig
-	readJSON(flagConfig, &nodeConfigs)
+	err := common.ReadJSON(flagConfig, &nodeConfigs)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to read json")
+	}
+
 	nodes := len(nodeConfigs)
 	log.Info().Msgf("read %v node configurations", nodes)
 
@@ -48,7 +53,7 @@ func genNetworkAndStakingKeys() []model.NodeInfo {
 		internalNodes = append(internalNodes, nodeInfo)
 	}
 
-	return model.Sort(internalNodes, flow.Canonical)
+	return model.Sort(internalNodes, flow.Canonical[flow.Identity])
 }
 
 func assembleNodeInfo(nodeConfig model.NodeConfig, networkKey, stakingKey crypto.PrivateKey) model.NodeInfo {
@@ -62,8 +67,8 @@ func assembleNodeInfo(nodeConfig model.NodeConfig, networkKey, stakingKey crypto
 	}
 
 	log.Debug().
-		Str("networkPubKey", pubKeyToString(networkKey.PublicKey())).
-		Str("stakingPubKey", pubKeyToString(stakingKey.PublicKey())).
+		Str("networkPubKey", networkKey.PublicKey().String()).
+		Str("stakingPubKey", stakingKey.PublicKey().String()).
 		Msg("encoded public staking and network keys")
 
 	nodeInfo := model.NewPrivateNodeInfo(
diff --git a/cmd/bootstrap/cmd/machine_account.go b/cmd/bootstrap/cmd/machine_account.go
index a1305ae1035..bdaa7a08922 100644
--- a/cmd/bootstrap/cmd/machine_account.go
+++ b/cmd/bootstrap/cmd/machine_account.go
@@ -9,6 +9,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/onflow/flow-go/cmd"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	model "github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
 	ioutils "github.com/onflow/flow-go/utils/io"
@@ -52,7 +53,7 @@ func machineAccountRun(_ *cobra.Command, _ []string) {
 
 	// check if node-machine-account-key.priv.json path exists
 	machineAccountKeyPath := fmt.Sprintf(model.PathNodeMachineAccountPrivateKey, nodeID)
-	keyExists, err := pathExists(filepath.Join(flagOutdir, machineAccountKeyPath))
+	keyExists, err := common.PathExists(filepath.Join(flagOutdir, machineAccountKeyPath))
 	if err != nil {
 		log.Fatal().Err(err).Msg("could not check if node-machine-account-key.priv.json exists")
 	}
@@ -63,7 +64,7 @@ func machineAccountRun(_ *cobra.Command, _ []string) {
 
 	// check if node-machine-account-info.priv.json file exists in boostrap dir
 	machineAccountInfoPath := fmt.Sprintf(model.PathNodeMachineAccountInfoPriv, nodeID)
-	infoExists, err := pathExists(filepath.Join(flagOutdir, machineAccountInfoPath))
+	infoExists, err := common.PathExists(filepath.Join(flagOutdir, machineAccountInfoPath))
 	if err != nil {
 		log.Fatal().Err(err).Msg("could not check if node-machine-account-info.priv.json exists")
 	}
@@ -80,7 +81,11 @@ func machineAccountRun(_ *cobra.Command, _ []string) {
 	machineAccountInfo := assembleNodeMachineAccountInfo(machinePrivKey, flagMachineAccountAddress)
 
 	// write machine account info
-	writeJSON(fmt.Sprintf(model.PathNodeMachineAccountInfoPriv, nodeID), machineAccountInfo)
+	err = common.WriteJSON(fmt.Sprintf(model.PathNodeMachineAccountInfoPriv, nodeID), flagOutdir, machineAccountInfo)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, fmt.Sprintf(model.PathNodeMachineAccountInfoPriv, nodeID))
 }
 
 // readMachineAccountPriv reads the machine account private key files in the bootstrap dir
@@ -88,7 +93,10 @@ func readMachineAccountKey(nodeID string) crypto.PrivateKey {
 	var machineAccountPriv model.NodeMachineAccountKey
 
 	path := filepath.Join(flagOutdir, fmt.Sprintf(model.PathNodeMachineAccountPrivateKey, nodeID))
-	readJSON(path, &machineAccountPriv)
+	err := common.ReadJSON(path, &machineAccountPriv)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to read json")
+	}
 
 	return machineAccountPriv.PrivateKey.PrivateKey
 }
diff --git a/cmd/bootstrap/cmd/machine_account_key.go b/cmd/bootstrap/cmd/machine_account_key.go
index 9ec26c68520..14bdef868df 100644
--- a/cmd/bootstrap/cmd/machine_account_key.go
+++ b/cmd/bootstrap/cmd/machine_account_key.go
@@ -8,6 +8,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/onflow/flow-go/cmd/bootstrap/utils"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	model "github.com/onflow/flow-go/model/bootstrap"
 )
 
@@ -37,7 +38,7 @@ func machineAccountKeyRun(_ *cobra.Command, _ []string) {
 
 	// check if node-machine-account-key.priv.json path exists
 	machineAccountKeyPath := fmt.Sprintf(model.PathNodeMachineAccountPrivateKey, nodeID)
-	keyExists, err := pathExists(path.Join(flagOutdir, machineAccountKeyPath))
+	keyExists, err := common.PathExists(path.Join(flagOutdir, machineAccountKeyPath))
 	if err != nil {
 		log.Fatal().Err(err).Msg("could not check if node-machine-account-key.priv.json exists")
 	}
@@ -56,5 +57,9 @@ func machineAccountKeyRun(_ *cobra.Command, _ []string) {
 	// also write the public key to terminal for entry in Flow Port
 	machineAccountPriv := assembleNodeMachineAccountKey(machineKey)
 
-	writeJSON(machineAccountKeyPath, machineAccountPriv)
+	err = common.WriteJSON(machineAccountKeyPath, flagOutdir, machineAccountPriv)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msg(fmt.Sprintf("wrote file %s/%s", flagOutdir, machineAccountKeyPath))
 }
diff --git a/cmd/bootstrap/cmd/machine_account_key_test.go b/cmd/bootstrap/cmd/machine_account_key_test.go
index adcf45ea4b2..dfd93fcd5f6 100644
--- a/cmd/bootstrap/cmd/machine_account_key_test.go
+++ b/cmd/bootstrap/cmd/machine_account_key_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	"github.com/onflow/flow-go/model/bootstrap"
 	model "github.com/onflow/flow-go/model/bootstrap"
 	ioutils "github.com/onflow/flow-go/utils/io"
@@ -49,7 +50,7 @@ func TestMachineAccountKeyFileExists(t *testing.T) {
 
 		// read file priv key file before command
 		var machineAccountPrivBefore model.NodeMachineAccountKey
-		readJSON(machineKeyFilePath, &machineAccountPrivBefore)
+		require.NoError(t, common.ReadJSON(machineKeyFilePath, &machineAccountPrivBefore))
 
 		// run command with flags
 		machineAccountKeyRun(nil, nil)
@@ -59,7 +60,7 @@ func TestMachineAccountKeyFileExists(t *testing.T) {
 
 		// read machine account key file again
 		var machineAccountPrivAfter model.NodeMachineAccountKey
-		readJSON(machineKeyFilePath, &machineAccountPrivAfter)
+		require.NoError(t, common.ReadJSON(machineKeyFilePath, &machineAccountPrivAfter))
 
 		// check if key was modified
 		assert.Equal(t, machineAccountPrivBefore, machineAccountPrivAfter)
diff --git a/cmd/bootstrap/cmd/machine_account_test.go b/cmd/bootstrap/cmd/machine_account_test.go
index 7a1627ca3ac..27631a3bddc 100644
--- a/cmd/bootstrap/cmd/machine_account_test.go
+++ b/cmd/bootstrap/cmd/machine_account_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	"github.com/onflow/flow-go/model/bootstrap"
 	model "github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
@@ -115,14 +116,14 @@ func TestMachineAccountInfoFileExists(t *testing.T) {
 
 		// read in info file
 		var machineAccountInfoBefore model.NodeMachineAccountInfo
-		readJSON(machineInfoFilePath, &machineAccountInfoBefore)
+		require.NoError(t, common.ReadJSON(machineInfoFilePath, &machineAccountInfoBefore))
 
 		// run again and make sure info file was not changed
 		machineAccountRun(nil, nil)
 		require.Regexp(t, regex, hook.logs.String())
 
 		var machineAccountInfoAfter model.NodeMachineAccountInfo
-		readJSON(machineInfoFilePath, &machineAccountInfoAfter)
+		require.NoError(t, common.ReadJSON(machineInfoFilePath, &machineAccountInfoAfter))
 
 		assert.Equal(t, machineAccountInfoBefore, machineAccountInfoAfter)
 	})
diff --git a/cmd/bootstrap/cmd/observer_network_key.go b/cmd/bootstrap/cmd/observer_network_key.go
index 330b2cad47e..dfb6a2f609e 100644
--- a/cmd/bootstrap/cmd/observer_network_key.go
+++ b/cmd/bootstrap/cmd/observer_network_key.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/onflow/flow-go/cmd"
 	"github.com/onflow/flow-go/cmd/bootstrap/utils"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 )
 
 var (
@@ -47,7 +48,7 @@ func observerNetworkKeyRun(_ *cobra.Command, _ []string) {
 	}
 
 	// if the file already exists, exit
-	keyExists, err := pathExists(flagOutputFile)
+	keyExists, err := common.PathExists(flagOutputFile)
 	if err != nil {
 		log.Fatal().Err(err).Msgf("could not check if %s exists", flagOutputFile)
 	}
diff --git a/cmd/bootstrap/cmd/partner_infos.go b/cmd/bootstrap/cmd/partner_infos.go
index 05db3192609..653ee861ff7 100644
--- a/cmd/bootstrap/cmd/partner_infos.go
+++ b/cmd/bootstrap/cmd/partner_infos.go
@@ -64,7 +64,7 @@ func populatePartnerInfosRun(_ *cobra.Command, _ []string) {
 
 	flowClient := getFlowClient()
 
-	partnerWeights := make(PartnerWeights)
+	partnerWeights := make(common.PartnerWeights)
 	skippedNodes := 0
 	numOfPartnerNodesByRole := map[flow.Role]int{
 		flow.RoleCollection:   0,
@@ -203,12 +203,20 @@ func validateANNetworkKey(key string) error {
 // writeNodePubInfoFile writes the node-pub-info file
 func writeNodePubInfoFile(info *bootstrap.NodeInfoPub) {
 	fileOutputPath := fmt.Sprintf(bootstrap.PathNodeInfoPub, info.NodeID)
-	writeJSON(fileOutputPath, info)
+	err := common.WriteJSON(fileOutputPath, flagOutdir, info)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, fileOutputPath)
 }
 
 // writePartnerWeightsFile writes the partner weights file
-func writePartnerWeightsFile(partnerWeights PartnerWeights) {
-	writeJSON(bootstrap.FileNamePartnerWeights, partnerWeights)
+func writePartnerWeightsFile(partnerWeights common.PartnerWeights) {
+	err := common.WriteJSON(bootstrap.FileNamePartnerWeights, flagOutdir, partnerWeights)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, bootstrap.FileNamePartnerWeights)
 }
 
 func printNodeCounts(numOfNodesByType map[flow.Role]int, totalNumOfPartnerNodes, skippedNodes int) {
diff --git a/cmd/bootstrap/cmd/qc.go b/cmd/bootstrap/cmd/qc.go
index 6e97363051b..22474ed1d19 100644
--- a/cmd/bootstrap/cmd/qc.go
+++ b/cmd/bootstrap/cmd/qc.go
@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 
 	"github.com/onflow/flow-go/cmd/bootstrap/run"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	"github.com/onflow/flow-go/consensus/hotstuff/model"
 	"github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/dkg"
@@ -48,6 +49,10 @@ func constructRootVotes(block *flow.Block, allNodes, internalNodes []bootstrap.N
 
 	for _, vote := range votes {
 		path := filepath.Join(bootstrap.DirnameRootBlockVotes, fmt.Sprintf(bootstrap.FilenameRootBlockVote, vote.SignerID))
-		writeJSON(path, vote)
+		err = common.WriteJSON(path, flagOutdir, vote)
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed to write json")
+		}
+		log.Info().Msgf("wrote file %s/%s", flagOutdir, path)
 	}
 }
diff --git a/cmd/bootstrap/cmd/rootblock.go b/cmd/bootstrap/cmd/rootblock.go
index 7060fdf1a4b..9810834c2e4 100644
--- a/cmd/bootstrap/cmd/rootblock.go
+++ b/cmd/bootstrap/cmd/rootblock.go
@@ -1,20 +1,46 @@
 package cmd
 
 import (
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
 	"time"
 
+	"github.com/onflow/flow-go/model/encodable"
+	"github.com/onflow/flow-go/module/epochs"
+	"github.com/onflow/flow-go/state/protocol/inmem"
+
+	"github.com/onflow/cadence"
+
+	"github.com/onflow/flow-go/model/dkg"
+	"github.com/onflow/flow-go/state/protocol"
+
 	"github.com/spf13/cobra"
 
 	"github.com/onflow/flow-go/cmd"
+	"github.com/onflow/flow-go/cmd/bootstrap/run"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	model "github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
 )
 
 var (
-	flagRootChain     string
-	flagRootParent    string
-	flagRootHeight    uint64
-	flagRootTimestamp string
+	flagRootChain                  string
+	flagRootParent                 string
+	flagRootHeight                 uint64
+	flagRootTimestamp              string
+	flagProtocolVersion            uint
+	flagEpochCommitSafetyThreshold uint64
+	flagCollectionClusters         uint
+	flagEpochCounter               uint64
+	flagNumViewsInEpoch            uint64
+	flagNumViewsInStakingAuction   uint64
+	flagNumViewsInDKGPhase         uint64
+	// Epoch target end time config
+	flagUseDefaultEpochTargetEndTime bool
+	flagEpochTimingRefCounter        uint64
+	flagEpochTimingRefTimestamp      uint64
+	flagEpochTimingDuration          uint64
 )
 
 // rootBlockCmd represents the rootBlock command
@@ -48,15 +74,52 @@ func addRootBlockCmdFlags() {
 	cmd.MarkFlagRequired(rootBlockCmd, "partner-dir")
 	cmd.MarkFlagRequired(rootBlockCmd, "partner-weights")
 
+	// required parameters for generation of epoch setup and commit events
+	rootBlockCmd.Flags().Uint64Var(&flagEpochCounter, "epoch-counter", 0, "epoch counter for the epoch beginning with the root block")
+	rootBlockCmd.Flags().Uint64Var(&flagNumViewsInEpoch, "epoch-length", 4000, "length of each epoch measured in views")
+	rootBlockCmd.Flags().Uint64Var(&flagNumViewsInStakingAuction, "epoch-staking-phase-length", 100, "length of the epoch staking phase measured in views")
+	rootBlockCmd.Flags().Uint64Var(&flagNumViewsInDKGPhase, "epoch-dkg-phase-length", 1000, "length of each DKG phase measured in views")
+
+	// optional parameters to influence various aspects of identity generation
+	rootBlockCmd.Flags().UintVar(&flagCollectionClusters, "collection-clusters", 2, "number of collection clusters")
+
+	cmd.MarkFlagRequired(rootBlockCmd, "epoch-counter")
+	cmd.MarkFlagRequired(rootBlockCmd, "epoch-length")
+	cmd.MarkFlagRequired(rootBlockCmd, "epoch-staking-phase-length")
+	cmd.MarkFlagRequired(rootBlockCmd, "epoch-dkg-phase-length")
+
 	// required parameters for generation of root block, root execution result and root block seal
 	rootBlockCmd.Flags().StringVar(&flagRootChain, "root-chain", "local", "chain ID for the root block (can be 'main', 'test', 'sandbox', 'bench', or 'local'")
 	rootBlockCmd.Flags().StringVar(&flagRootParent, "root-parent", "0000000000000000000000000000000000000000000000000000000000000000", "ID for the parent of the root block")
 	rootBlockCmd.Flags().Uint64Var(&flagRootHeight, "root-height", 0, "height of the root block")
 	rootBlockCmd.Flags().StringVar(&flagRootTimestamp, "root-timestamp", time.Now().UTC().Format(time.RFC3339), "timestamp of the root block (RFC3339)")
+	rootBlockCmd.Flags().UintVar(&flagProtocolVersion, "protocol-version", flow.DefaultProtocolVersion, "major software version used for the duration of this spork")
+	rootBlockCmd.Flags().Uint64Var(&flagEpochCommitSafetyThreshold, "epoch-commit-safety-threshold", 500, "defines epoch commitment deadline")
 
 	cmd.MarkFlagRequired(rootBlockCmd, "root-chain")
 	cmd.MarkFlagRequired(rootBlockCmd, "root-parent")
 	cmd.MarkFlagRequired(rootBlockCmd, "root-height")
+	cmd.MarkFlagRequired(rootBlockCmd, "protocol-version")
+	cmd.MarkFlagRequired(rootBlockCmd, "epoch-commit-safety-threshold")
+
+	// Epoch timing config - these values must be set identically to `EpochTimingConfig` in the FlowEpoch smart contract.
+	// See https://github.com/onflow/flow-core-contracts/blob/240579784e9bb8d97d91d0e3213614e25562c078/contracts/epochs/FlowEpoch.cdc#L259-L266
+	// Must specify either:
+	//   1. --use-default-epoch-timing and no other `--epoch-timing*` flags
+	//   2. All `--epoch-timing*` flags except --use-default-epoch-timing
+	//
+	// Use Option 1 for Benchnet, Localnet, etc.
+	// Use Option 2 for Mainnet, Testnet, Canary.
+	rootBlockCmd.Flags().BoolVar(&flagUseDefaultEpochTargetEndTime, "use-default-epoch-timing", false, "whether to use the default target end time")
+	rootBlockCmd.Flags().Uint64Var(&flagEpochTimingRefCounter, "epoch-timing-ref-counter", 0, "the reference epoch for computing the root epoch's target end time")
+	rootBlockCmd.Flags().Uint64Var(&flagEpochTimingRefTimestamp, "epoch-timing-ref-timestamp", 0, "the end time of the reference epoch, specified in second-precision Unix time, to use to compute the root epoch's target end time")
+	rootBlockCmd.Flags().Uint64Var(&flagEpochTimingDuration, "epoch-timing-duration", 0, "the duration of each epoch in seconds, used to compute the root epoch's target end time")
+
+	rootBlockCmd.MarkFlagsOneRequired("use-default-epoch-timing", "epoch-timing-ref-counter", "epoch-timing-ref-timestamp", "epoch-timing-duration")
+	rootBlockCmd.MarkFlagsRequiredTogether("epoch-timing-ref-counter", "epoch-timing-ref-timestamp", "epoch-timing-duration")
+	for _, flag := range []string{"epoch-timing-ref-counter", "epoch-timing-ref-timestamp", "epoch-timing-duration"} {
+		rootBlockCmd.MarkFlagsMutuallyExclusive("use-default-epoch-timing", flag)
+	}
 }
 
 func rootBlock(cmd *cobra.Command, args []string) {
@@ -71,12 +134,29 @@ func rootBlock(cmd *cobra.Command, args []string) {
 		}
 	}
 
+	// validate epoch configs
+	err := validateEpochConfig()
+	if err != nil {
+		log.Fatal().Err(err).Msg("invalid or unsafe epoch commit threshold config")
+	}
+	err = validateOrPopulateEpochTimingConfig()
+	if err != nil {
+		log.Fatal().Err(err).Msg("invalid epoch timing config")
+	}
+
 	log.Info().Msg("collecting partner network and staking keys")
-	partnerNodes := readPartnerNodeInfos()
+	partnerNodes, err := common.ReadFullPartnerNodeInfos(log, flagPartnerWeights, flagPartnerNodeInfoDir)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to read full partner node infos")
+	}
 	log.Info().Msg("")
 
 	log.Info().Msg("generating internal private networking and staking keys")
-	internalNodes := readInternalNodeInfos()
+	internalNodes, err := common.ReadFullInternalNodeInfos(log, flagInternalNodePrivInfoDir, flagConfig)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to read full internal node infos")
+	}
+
 	log.Info().Msg("")
 
 	log.Info().Msg("checking constraints on consensus nodes")
@@ -85,16 +165,73 @@ func rootBlock(cmd *cobra.Command, args []string) {
 
 	log.Info().Msg("assembling network and staking keys")
 	stakingNodes := mergeNodeInfos(internalNodes, partnerNodes)
-	writeJSON(model.PathNodeInfosPub, model.ToPublicNodeInfoList(stakingNodes))
+	err = common.WriteJSON(model.PathNodeInfosPub, flagOutdir, model.ToPublicNodeInfoList(stakingNodes))
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, model.PathNodeInfosPub)
 	log.Info().Msg("")
 
 	log.Info().Msg("running DKG for consensus nodes")
 	dkgData := runBeaconKG(model.FilterByRole(stakingNodes, flow.RoleConsensus))
 	log.Info().Msg("")
 
+	// create flow.IdentityList representation of the participant set
+	participants := model.ToIdentityList(stakingNodes).Sort(flow.Canonical[flow.Identity])
+
+	log.Info().Msg("computing collection node clusters")
+	assignments, clusters, err := common.ConstructClusterAssignment(log, model.ToIdentityList(partnerNodes), model.ToIdentityList(internalNodes), int(flagCollectionClusters))
+	if err != nil {
+		log.Fatal().Err(err).Msg("unable to generate cluster assignment")
+	}
+	log.Info().Msg("")
+
+	log.Info().Msg("constructing root blocks for collection node clusters")
+	clusterBlocks := run.GenerateRootClusterBlocks(flagEpochCounter, clusters)
+	log.Info().Msg("")
+
+	log.Info().Msg("constructing root QCs for collection node clusters")
+	clusterQCs := common.ConstructRootQCsForClusters(log, clusters, internalNodes, clusterBlocks)
+	log.Info().Msg("")
+
+	log.Info().Msg("constructing root header")
+	header := constructRootHeader(flagRootChain, flagRootParent, flagRootHeight, flagRootTimestamp)
+	log.Info().Msg("")
+
+	log.Info().Msg("constructing intermediary bootstrapping data")
+	epochSetup, epochCommit := constructRootEpochEvents(header.View, participants, assignments, clusterQCs, dkgData)
+	committedEpoch := inmem.NewCommittedEpoch(epochSetup, epochCommit)
+	encodableEpoch, err := inmem.FromEpoch(committedEpoch)
+	if err != nil {
+		log.Fatal().Msg("could not convert root epoch to encodable")
+	}
+	epochConfig := generateExecutionStateEpochConfig(epochSetup, clusterQCs, dkgData)
+	intermediaryEpochData := IntermediaryEpochData{
+		ProtocolStateRootEpoch: encodableEpoch.Encodable(),
+		ExecutionStateConfig:   epochConfig,
+	}
+	intermediaryParamsData := IntermediaryParamsData{
+		EpochCommitSafetyThreshold: flagEpochCommitSafetyThreshold,
+		ProtocolVersion:            flagProtocolVersion,
+	}
+	intermediaryData := IntermediaryBootstrappingData{
+		IntermediaryEpochData:  intermediaryEpochData,
+		IntermediaryParamsData: intermediaryParamsData,
+	}
+	err = common.WriteJSON(model.PathIntermediaryBootstrappingData, flagOutdir, intermediaryData)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, model.PathIntermediaryBootstrappingData)
+	log.Info().Msg("")
+
 	log.Info().Msg("constructing root block")
-	block := constructRootBlock(flagRootChain, flagRootParent, flagRootHeight, flagRootTimestamp)
-	writeJSON(model.PathRootBlockData, block)
+	block := constructRootBlock(header, epochSetup, epochCommit)
+	err = common.WriteJSON(model.PathRootBlockData, flagOutdir, block)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to write json")
+	}
+	log.Info().Msgf("wrote file %s/%s", flagOutdir, model.PathRootBlockData)
 	log.Info().Msg("")
 
 	log.Info().Msg("constructing and writing votes")
@@ -106,3 +243,65 @@ func rootBlock(cmd *cobra.Command, args []string) {
 	)
 	log.Info().Msg("")
 }
+
+// validateEpochConfig validates configuration of the epoch commitment deadline.
+func validateEpochConfig() error {
+	chainID := parseChainID(flagRootChain)
+	dkgFinalView := flagNumViewsInStakingAuction + flagNumViewsInDKGPhase*3 // 3 DKG phases
+	epochCommitDeadline := flagNumViewsInEpoch - flagEpochCommitSafetyThreshold
+
+	defaultSafetyThreshold, err := protocol.DefaultEpochCommitSafetyThreshold(chainID)
+	if err != nil {
+		return fmt.Errorf("could not get default epoch commit safety threshold: %w", err)
+	}
+
+	// sanity check: the safety threshold is >= the default for the chain
+	if flagEpochCommitSafetyThreshold < defaultSafetyThreshold {
+		return fmt.Errorf("potentially unsafe epoch config: epoch commit safety threshold smaller than expected (%d < %d)", flagEpochCommitSafetyThreshold, defaultSafetyThreshold)
+	}
+	// sanity check: epoch commitment deadline cannot be before the DKG end
+	if epochCommitDeadline <= dkgFinalView {
+		return fmt.Errorf("invalid epoch config: the epoch commitment deadline (%d) is before the DKG final view (%d)", epochCommitDeadline, dkgFinalView)
+	}
+	// sanity check: the difference between DKG end and safety threshold is also >= the default safety threshold
+	if epochCommitDeadline-dkgFinalView < defaultSafetyThreshold {
+		return fmt.Errorf("potentially unsafe epoch config: time between DKG end and epoch commitment deadline is smaller than expected (%d-%d < %d)",
+			epochCommitDeadline, dkgFinalView, defaultSafetyThreshold)
+	}
+	return nil
+}
+
+// generateExecutionStateEpochConfig generates epoch-related configuration used
+// to generate an empty root execution state. This config is generated in the
+// `rootblock` alongside the root epoch and root protocol state ID for consistency.
+func generateExecutionStateEpochConfig(
+	epochSetup *flow.EpochSetup,
+	clusterQCs []*flow.QuorumCertificate,
+	dkgData dkg.DKGData,
+) epochs.EpochConfig {
+
+	randomSource := make([]byte, flow.EpochSetupRandomSourceLength)
+	if _, err := rand.Read(randomSource); err != nil {
+		log.Fatal().Err(err).Msg("failed to generate a random source")
+	}
+	cdcRandomSource, err := cadence.NewString(hex.EncodeToString(randomSource))
+	if err != nil {
+		log.Fatal().Err(err).Msg("invalid random source")
+	}
+
+	epochConfig := epochs.EpochConfig{
+		EpochTokenPayout:             cadence.UFix64(0),
+		RewardCut:                    cadence.UFix64(0),
+		FLOWsupplyIncreasePercentage: cadence.UFix64(0),
+		CurrentEpochCounter:          cadence.UInt64(epochSetup.Counter),
+		NumViewsInEpoch:              cadence.UInt64(flagNumViewsInEpoch),
+		NumViewsInStakingAuction:     cadence.UInt64(flagNumViewsInStakingAuction),
+		NumViewsInDKGPhase:           cadence.UInt64(flagNumViewsInDKGPhase),
+		NumCollectorClusters:         cadence.UInt16(flagCollectionClusters),
+		RandomSource:                 cdcRandomSource,
+		CollectorClusters:            epochSetup.Assignments,
+		ClusterQCs:                   clusterQCs,
+		DKGPubKeys:                   encodable.WrapRandomBeaconPubKeys(dkgData.PubKeyShares),
+	}
+	return epochConfig
+}
diff --git a/cmd/bootstrap/cmd/rootblock_test.go b/cmd/bootstrap/cmd/rootblock_test.go
index a2ccb177e79..01222c0c476 100644
--- a/cmd/bootstrap/cmd/rootblock_test.go
+++ b/cmd/bootstrap/cmd/rootblock_test.go
@@ -2,14 +2,12 @@ package cmd
 
 import (
 	"encoding/hex"
-	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/cmd/bootstrap/utils"
 	model "github.com/onflow/flow-go/model/bootstrap"
@@ -32,6 +30,12 @@ const rootBlockHappyPathLogs = "collecting partner network and staking keys" +
 	`finished running DKG` +
 	`.+/random-beacon.priv.json` +
 	`wrote file \S+/root-dkg-data.priv.json` +
+	`computing collection node clusters` +
+	`constructing root blocks for collection node clusters` +
+	`constructing root QCs for collection node clusters` +
+	`constructing root header` +
+	`constructing intermediary bootstrapping data` +
+	`wrote file \S+/intermediary-bootstrapping-data.json` +
 	`constructing root block` +
 	`wrote file \S+/root-block.json` +
 	`constructing and writing votes` +
@@ -56,6 +60,16 @@ func TestRootBlock_HappyPath(t *testing.T) {
 		flagRootParent = hex.EncodeToString(rootParent[:])
 		flagRootChain = chainName
 		flagRootHeight = rootHeight
+		flagEpochCounter = 0
+		flagNumViewsInEpoch = 100_000
+		flagNumViewsInStakingAuction = 50_000
+		flagNumViewsInDKGPhase = 2_000
+		flagEpochCommitSafetyThreshold = 1_000
+		flagProtocolVersion = 42
+		flagUseDefaultEpochTargetEndTime = true
+		flagEpochTimingRefCounter = 0
+		flagEpochTimingRefTimestamp = 0
+		flagEpochTimingDuration = 0
 
 		hook := zeroLoggerHook{logs: &strings.Builder{}}
 		log = log.Hook(hook)
@@ -69,55 +83,3 @@ func TestRootBlock_HappyPath(t *testing.T) {
 		assert.FileExists(t, rootBlockDataPath)
 	})
 }
-
-func TestRootBlock_Deterministic(t *testing.T) {
-	rootParent := unittest.StateCommitmentFixture()
-	chainName := "main"
-	rootHeight := uint64(1000)
-
-	utils.RunWithSporkBootstrapDir(t, func(bootDir, partnerDir, partnerWeights, internalPrivDir, configPath string) {
-
-		flagOutdir = bootDir
-
-		flagConfig = configPath
-		flagPartnerNodeInfoDir = partnerDir
-		flagPartnerWeights = partnerWeights
-		flagInternalNodePrivInfoDir = internalPrivDir
-
-		flagRootParent = hex.EncodeToString(rootParent[:])
-		flagRootChain = chainName
-		flagRootHeight = rootHeight
-
-		hook := zeroLoggerHook{logs: &strings.Builder{}}
-		log = log.Hook(hook)
-
-		rootBlock(nil, nil)
-		require.Regexp(t, rootBlockHappyPathRegex, hook.logs.String())
-		hook.logs.Reset()
-
-		// check if root protocol snapshot exists
-		rootBlockDataPath := filepath.Join(bootDir, model.PathRootBlockData)
-		assert.FileExists(t, rootBlockDataPath)
-
-		// read snapshot
-		firstRootBlockData, err := utils.ReadRootBlock(rootBlockDataPath)
-		require.NoError(t, err)
-
-		// delete snapshot file
-		err = os.Remove(rootBlockDataPath)
-		require.NoError(t, err)
-
-		rootBlock(nil, nil)
-		require.Regexp(t, rootBlockHappyPathRegex, hook.logs.String())
-		hook.logs.Reset()
-
-		// check if root protocol snapshot exists
-		assert.FileExists(t, rootBlockDataPath)
-
-		// read snapshot
-		secondRootBlockData, err := utils.ReadRootBlock(rootBlockDataPath)
-		require.NoError(t, err)
-
-		assert.Equal(t, firstRootBlockData, secondRootBlockData)
-	})
-}
diff --git a/cmd/bootstrap/cmd/seal.go b/cmd/bootstrap/cmd/seal.go
index 05f1ab293b3..7fedde660aa 100644
--- a/cmd/bootstrap/cmd/seal.go
+++ b/cmd/bootstrap/cmd/seal.go
@@ -2,20 +2,17 @@ package cmd
 
 import (
 	"encoding/hex"
+	"time"
 
 	"github.com/onflow/flow-go/cmd/bootstrap/run"
-	"github.com/onflow/flow-go/model/dkg"
 	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/module/signature"
 )
 
 func constructRootResultAndSeal(
 	rootCommit string,
 	block *flow.Block,
-	participants flow.IdentityList,
-	assignments flow.AssignmentList,
-	clusterQCs []*flow.QuorumCertificate,
-	dkgData dkg.DKGData,
+	epochSetup *flow.EpochSetup,
+	epochCommit *flow.EpochCommit,
 ) (*flow.ExecutionResult, *flow.Seal) {
 
 	stateCommitBytes, err := hex.DecodeString(rootCommit)
@@ -30,41 +27,6 @@ func constructRootResultAndSeal(
 			Msg("root state commitment has incompatible length")
 	}
 
-	firstView := block.Header.View
-	epochSetup := &flow.EpochSetup{
-		Counter:            flagEpochCounter,
-		FirstView:          firstView,
-		FinalView:          firstView + flagNumViewsInEpoch - 1,
-		DKGPhase1FinalView: firstView + flagNumViewsInStakingAuction + flagNumViewsInDKGPhase - 1,
-		DKGPhase2FinalView: firstView + flagNumViewsInStakingAuction + flagNumViewsInDKGPhase*2 - 1,
-		DKGPhase3FinalView: firstView + flagNumViewsInStakingAuction + flagNumViewsInDKGPhase*3 - 1,
-		Participants:       participants.Sort(flow.Canonical),
-		Assignments:        assignments,
-		RandomSource:       GenerateRandomSeed(flow.EpochSetupRandomSourceLength),
-	}
-
-	qcsWithSignerIDs := make([]*flow.QuorumCertificateWithSignerIDs, 0, len(clusterQCs))
-	for i, clusterQC := range clusterQCs {
-		members := assignments[i]
-		signerIDs, err := signature.DecodeSignerIndicesToIdentifiers(members, clusterQC.SignerIndices)
-		if err != nil {
-			log.Fatal().Err(err).Msgf("could not decode signer IDs from clusterQC at index %v", i)
-		}
-		qcsWithSignerIDs = append(qcsWithSignerIDs, &flow.QuorumCertificateWithSignerIDs{
-			View:      clusterQC.View,
-			BlockID:   clusterQC.BlockID,
-			SignerIDs: signerIDs,
-			SigData:   clusterQC.SigData,
-		})
-	}
-
-	epochCommit := &flow.EpochCommit{
-		Counter:            flagEpochCounter,
-		ClusterQCs:         flow.ClusterQCVoteDatasFromQCs(qcsWithSignerIDs),
-		DKGGroupKey:        dkgData.PubGroupKey,
-		DKGParticipantKeys: dkgData.PubKeyShares,
-	}
-
 	result := run.GenerateRootResult(block, stateCommit, epochSetup, epochCommit)
 	seal, err := run.GenerateRootSeal(result)
 	if err != nil {
@@ -77,3 +39,22 @@ func constructRootResultAndSeal(
 
 	return result, seal
 }
+
+// rootEpochTargetEndTime computes the target end time for the given epoch, using the given config.
+// CAUTION: the variables `flagEpochTimingRefCounter`, `flagEpochTimingDuration`, and
+// `flagEpochTimingRefTimestamp` must contain proper values. You can either specify a value for
+// each config parameter or use the function `validateOrPopulateEpochTimingConfig()` to populate the variables
+// from defaults.
+func rootEpochTargetEndTime() uint64 {
+	if flagEpochTimingRefTimestamp == 0 || flagEpochTimingDuration == 0 {
+		panic("invalid epoch timing config: must specify ALL of --epoch-target-end-time-ref-counter, --epoch-target-end-time-ref-timestamp, and --epoch-target-end-time-duration")
+	}
+	if flagEpochCounter < flagEpochTimingRefCounter {
+		panic("invalid epoch timing config: reference epoch counter must be less than or equal to root epoch counter")
+	}
+	targetEndTime := flagEpochTimingRefTimestamp + (flagEpochCounter-flagEpochTimingRefCounter)*flagEpochTimingDuration
+	if targetEndTime <= uint64(time.Now().Unix()) {
+		panic("sanity check failed: root epoch target end time is before current time")
+	}
+	return targetEndTime
+}
diff --git a/cmd/bootstrap/cmd/util.go b/cmd/bootstrap/cmd/util.go
index 38bdc481c8a..ea89d1d2db6 100644
--- a/cmd/bootstrap/cmd/util.go
+++ b/cmd/bootstrap/cmd/util.go
@@ -2,16 +2,6 @@ package cmd
 
 import (
 	"crypto/rand"
-	"encoding/json"
-	"fmt"
-	"os"
-	"path/filepath"
-
-	"github.com/onflow/crypto"
-
-	model "github.com/onflow/flow-go/model/bootstrap"
-	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/utils/io"
 )
 
 func GenerateRandomSeeds(n int, seedLen int) [][]byte {
@@ -29,90 +19,3 @@ func GenerateRandomSeed(seedLen int) []byte {
 	}
 	return seed
 }
-
-func readJSON(path string, target interface{}) {
-	dat, err := io.ReadFile(path)
-	if err != nil {
-		log.Fatal().Err(err).Msg("cannot read json")
-	}
-	err = json.Unmarshal(dat, target)
-	if err != nil {
-		log.Fatal().Err(err).Msgf("cannot unmarshal json in file %s", path)
-	}
-}
-
-func writeJSON(path string, data interface{}) {
-	bz, err := json.MarshalIndent(data, "", "  ")
-	if err != nil {
-		log.Fatal().Err(err).Msg("cannot marshal json")
-	}
-
-	writeText(path, bz)
-}
-
-func writeText(path string, data []byte) {
-	path = filepath.Join(flagOutdir, path)
-
-	err := os.MkdirAll(filepath.Dir(path), 0755)
-	if err != nil {
-		log.Fatal().Err(err).Msg("could not create output dir")
-	}
-
-	err = os.WriteFile(path, data, 0644)
-	if err != nil {
-		log.Fatal().Err(err).Msg("could not write file")
-	}
-
-	log.Info().Msgf("wrote file %v", path)
-}
-
-func pubKeyToString(key crypto.PublicKey) string {
-	return fmt.Sprintf("%x", key.Encode())
-}
-
-func filesInDir(dir string) ([]string, error) {
-	exists, err := pathExists(dir)
-	if err != nil {
-		return nil, fmt.Errorf("could not check if dir exists: %w", err)
-	}
-
-	if !exists {
-		return nil, fmt.Errorf("dir %v does not exist", dir)
-	}
-
-	var files []string
-	err = filepath.Walk(dir, func(path string, info os.FileInfo, err error) error {
-		if !info.IsDir() {
-			files = append(files, path)
-		}
-		return nil
-	})
-	return files, err
-}
-
-// pathExists
-func pathExists(path string) (bool, error) {
-	_, err := os.Stat(path)
-	if err == nil {
-		return true, nil
-	}
-	if os.IsNotExist(err) {
-		return false, nil
-	}
-	return false, err
-}
-
-func nodeCountByRole(nodes []model.NodeInfo) map[flow.Role]uint16 {
-	roleCounts := map[flow.Role]uint16{
-		flow.RoleCollection:   0,
-		flow.RoleConsensus:    0,
-		flow.RoleExecution:    0,
-		flow.RoleVerification: 0,
-		flow.RoleAccess:       0,
-	}
-	for _, node := range nodes {
-		roleCounts[node.Role] = roleCounts[node.Role] + 1
-	}
-
-	return roleCounts
-}
diff --git a/cmd/bootstrap/run/block.go b/cmd/bootstrap/run/block.go
index d5a4a10a38d..cbd58b32d97 100644
--- a/cmd/bootstrap/run/block.go
+++ b/cmd/bootstrap/run/block.go
@@ -6,17 +6,11 @@ import (
 	"github.com/onflow/flow-go/model/flow"
 )
 
-func GenerateRootBlock(chainID flow.ChainID, parentID flow.Identifier, height uint64, timestamp time.Time) *flow.Block {
-
-	payload := &flow.Payload{
-		Guarantees: nil,
-		Seals:      nil,
-	}
-	header := &flow.Header{
+func GenerateRootHeader(chainID flow.ChainID, parentID flow.Identifier, height uint64, timestamp time.Time) *flow.Header {
+	return &flow.Header{
 		ChainID:            chainID,
 		ParentID:           parentID,
 		Height:             height,
-		PayloadHash:        payload.Hash(),
 		Timestamp:          timestamp,
 		View:               0,
 		ParentVoterIndices: nil,
@@ -24,9 +18,4 @@ func GenerateRootBlock(chainID flow.ChainID, parentID flow.Identifier, height ui
 		ProposerID:         flow.ZeroID,
 		ProposerSigData:    nil,
 	}
-
-	return &flow.Block{
-		Header:  header,
-		Payload: payload,
-	}
 }
diff --git a/cmd/bootstrap/run/cluster_qc.go b/cmd/bootstrap/run/cluster_qc.go
index 7d3e41ed8c8..9c45e45497f 100644
--- a/cmd/bootstrap/run/cluster_qc.go
+++ b/cmd/bootstrap/run/cluster_qc.go
@@ -18,7 +18,10 @@ import (
 )
 
 // GenerateClusterRootQC creates votes and generates a QC based on participant data
-func GenerateClusterRootQC(signers []bootstrap.NodeInfo, allCommitteeMembers flow.IdentityList, clusterBlock *cluster.Block) (*flow.QuorumCertificate, error) {
+func GenerateClusterRootQC(signers []bootstrap.NodeInfo, allCommitteeMembers flow.IdentitySkeletonList, clusterBlock *cluster.Block) (*flow.QuorumCertificate, error) {
+	if !allCommitteeMembers.Sorted(flow.Canonical[flow.IdentitySkeleton]) {
+		return nil, fmt.Errorf("can't create root cluster QC: committee members are not sorted in canonical order")
+	}
 	clusterRootBlock := model.GenesisBlockFromFlow(clusterBlock.Header)
 
 	// STEP 1: create votes for cluster root block
@@ -27,9 +30,21 @@ func GenerateClusterRootQC(signers []bootstrap.NodeInfo, allCommitteeMembers flo
 		return nil, err
 	}
 
+	// STEP 1.5: patch committee to include dynamic identities. This is a temporary measure until bootstrapping is refactored.
+	// We need a Committee for creating the cluster's root QC and the Committee requires dynamic identities to be instantiated.
+	// The clustering for root block contain only static identities, since there no state transitions have happened yet.
+	dynamicCommitteeMembers := make(flow.IdentityList, 0, len(allCommitteeMembers))
+	for _, participant := range allCommitteeMembers {
+		dynamicCommitteeMembers = append(dynamicCommitteeMembers, &flow.Identity{
+			IdentitySkeleton: *participant,
+			DynamicIdentity: flow.DynamicIdentity{
+				EpochParticipationStatus: flow.EpochParticipationStatusActive,
+			},
+		})
+	}
+
 	// STEP 2: create VoteProcessor
-	ordered := allCommitteeMembers.Sort(flow.Canonical)
-	committee, err := committees.NewStaticCommittee(ordered, flow.Identifier{}, nil, nil)
+	committee, err := committees.NewStaticCommittee(dynamicCommitteeMembers, flow.Identifier{}, nil, nil)
 	if err != nil {
 		return nil, err
 	}
@@ -79,7 +94,7 @@ func createRootBlockVotes(participants []bootstrap.NodeInfo, rootBlock *model.Bl
 		if err != nil {
 			return nil, fmt.Errorf("could not retrieve private keys for participant: %w", err)
 		}
-		me, err := local.New(participant.Identity(), keys.StakingKey)
+		me, err := local.New(participant.Identity().IdentitySkeleton, keys.StakingKey)
 		if err != nil {
 			return nil, err
 		}
diff --git a/cmd/bootstrap/run/cluster_qc_test.go b/cmd/bootstrap/run/cluster_qc_test.go
index 19a379d5b47..69b181d6bbe 100644
--- a/cmd/bootstrap/run/cluster_qc_test.go
+++ b/cmd/bootstrap/run/cluster_qc_test.go
@@ -32,7 +32,8 @@ func TestGenerateClusterRootQC(t *testing.T) {
 	payload := cluster.EmptyPayload(flow.ZeroID)
 	clusterBlock.SetPayload(payload)
 
-	_, err := GenerateClusterRootQC(participants, model.ToIdentityList(participants), &clusterBlock)
+	orderedParticipants := model.ToIdentityList(participants).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
+	_, err := GenerateClusterRootQC(participants, orderedParticipants, &clusterBlock)
 	require.NoError(t, err)
 }
 
@@ -48,7 +49,7 @@ func createClusterParticipants(t *testing.T, n int) []model.NodeInfo {
 			id.NodeID,
 			id.Role,
 			id.Address,
-			id.Weight,
+			id.InitialWeight,
 			networkKeys[i],
 			stakingKeys[i],
 		)
diff --git a/cmd/bootstrap/run/execution_state.go b/cmd/bootstrap/run/execution_state.go
index 38bd1d8de10..c1896668c38 100644
--- a/cmd/bootstrap/run/execution_state.go
+++ b/cmd/bootstrap/run/execution_state.go
@@ -43,7 +43,7 @@ func GenerateExecutionState(
 		return flow.DummyStateCommitment, err
 	}
 
-	compactor, err := complete.NewCompactor(ledgerStorage, diskWal, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+	compactor, err := complete.NewCompactor(ledgerStorage, diskWal, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metricsCollector)
 	if err != nil {
 		return flow.DummyStateCommitment, err
 	}
diff --git a/cmd/bootstrap/run/qc.go b/cmd/bootstrap/run/qc.go
index 57d1f17aa7a..a2e3fc7e42a 100644
--- a/cmd/bootstrap/run/qc.go
+++ b/cmd/bootstrap/run/qc.go
@@ -120,7 +120,7 @@ func GenerateRootBlockVotes(block *flow.Block, participantData *ParticipantData)
 		if err != nil {
 			return nil, fmt.Errorf("could not get private keys for participant: %w", err)
 		}
-		me, err := local.New(p.Identity(), keys.StakingKey)
+		me, err := local.New(p.Identity().IdentitySkeleton, keys.StakingKey)
 		if err != nil {
 			return nil, err
 		}
diff --git a/cmd/bootstrap/run/qc_test.go b/cmd/bootstrap/run/qc_test.go
index cf5777dcf33..701bc17e836 100644
--- a/cmd/bootstrap/run/qc_test.go
+++ b/cmd/bootstrap/run/qc_test.go
@@ -44,7 +44,7 @@ func TestGenerateRootQCWithSomeInvalidVotes(t *testing.T) {
 }
 
 func createSignerData(t *testing.T, n int) *ParticipantData {
-	identities := unittest.IdentityListFixture(n).Sort(flow.Canonical)
+	identities := unittest.IdentityListFixture(n).Sort(flow.Canonical[flow.Identity])
 
 	networkingKeys := unittest.NetworkingKeys(n)
 	stakingKeys := unittest.StakingKeys(n)
@@ -73,7 +73,7 @@ func createSignerData(t *testing.T, n int) *ParticipantData {
 			identity.NodeID,
 			identity.Role,
 			identity.Address,
-			identity.Weight,
+			identity.InitialWeight,
 			networkingKeys[i],
 			stakingKeys[i],
 		)
diff --git a/cmd/bootstrap/transit/cmd/generate_root_block_vote.go b/cmd/bootstrap/transit/cmd/generate_root_block_vote.go
index 89702a388fa..562edc67372 100644
--- a/cmd/bootstrap/transit/cmd/generate_root_block_vote.go
+++ b/cmd/bootstrap/transit/cmd/generate_root_block_vote.go
@@ -60,11 +60,11 @@ func generateVote(c *cobra.Command, args []string) {
 	}
 
 	stakingPrivKey := nodeInfo.StakingPrivKey.PrivateKey
-	identity := &flow.Identity{
+	identity := flow.IdentitySkeleton{
 		NodeID:        nodeID,
 		Address:       nodeInfo.Address,
 		Role:          nodeInfo.Role,
-		Weight:        flow.DefaultInitialWeight,
+		InitialWeight: flow.DefaultInitialWeight,
 		StakingPubKey: stakingPrivKey.PublicKey(),
 		NetworkPubKey: nodeInfo.NetworkPrivKey.PrivateKey.PublicKey(),
 	}
diff --git a/cmd/bootstrap/utils/file.go b/cmd/bootstrap/utils/file.go
index fc5f35c7122..b0d278b5249 100644
--- a/cmd/bootstrap/utils/file.go
+++ b/cmd/bootstrap/utils/file.go
@@ -7,7 +7,6 @@ import (
 
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
 	model "github.com/onflow/flow-go/model/bootstrap"
-	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/state/protocol/inmem"
 	io "github.com/onflow/flow-go/utils/io"
 )
@@ -32,30 +31,16 @@ func ReadRootProtocolSnapshot(bootDir string) (*inmem.Snapshot, error) {
 	return snapshot, nil
 }
 
-func ReadRootBlock(rootBlockDataPath string) (*flow.Block, error) {
-	bytes, err := io.ReadFile(rootBlockDataPath)
+func ReadData[T any](path string) (*T, error) {
+	bytes, err := io.ReadFile(path)
 	if err != nil {
-		return nil, fmt.Errorf("could not read root block file: %w", err)
+		return nil, fmt.Errorf("could not read data from file: %w", err)
 	}
 
-	var encodable flow.Block
+	var encodable T
 	err = json.Unmarshal(bytes, &encodable)
 	if err != nil {
 		return nil, fmt.Errorf("could not unmarshal root block: %w", err)
 	}
 	return &encodable, nil
 }
-
-func ReadDKGData(dkgDataPath string) (*inmem.EncodableFullDKG, error) {
-	bytes, err := io.ReadFile(dkgDataPath)
-	if err != nil {
-		return nil, fmt.Errorf("could not read dkg data: %w", err)
-	}
-
-	var encodable inmem.EncodableFullDKG
-	err = json.Unmarshal(bytes, &encodable)
-	if err != nil {
-		return nil, fmt.Errorf("could not unmarshal dkg data: %w", err)
-	}
-	return &encodable, nil
-}
diff --git a/cmd/bootstrap/utils/node_info.go b/cmd/bootstrap/utils/node_info.go
index 8cc45c4f26b..2dbafa7d1fa 100644
--- a/cmd/bootstrap/utils/node_info.go
+++ b/cmd/bootstrap/utils/node_info.go
@@ -108,35 +108,35 @@ func GenerateNodeInfos(consensus, collection, execution, verification, access in
 	// CONSENSUS = 1
 	consensusNodes := unittest.NodeInfosFixture(consensus,
 		unittest.WithRole(flow.RoleConsensus),
-		unittest.WithWeight(flow.DefaultInitialWeight),
+		unittest.WithInitialWeight(flow.DefaultInitialWeight),
 	)
 	nodes = append(nodes, consensusNodes...)
 
 	// COLLECTION = 1
 	collectionNodes := unittest.NodeInfosFixture(collection,
 		unittest.WithRole(flow.RoleCollection),
-		unittest.WithWeight(flow.DefaultInitialWeight),
+		unittest.WithInitialWeight(flow.DefaultInitialWeight),
 	)
 	nodes = append(nodes, collectionNodes...)
 
 	// EXECUTION = 1
 	executionNodes := unittest.NodeInfosFixture(execution,
 		unittest.WithRole(flow.RoleExecution),
-		unittest.WithWeight(flow.DefaultInitialWeight),
+		unittest.WithInitialWeight(flow.DefaultInitialWeight),
 	)
 	nodes = append(nodes, executionNodes...)
 
 	// VERIFICATION = 1
 	verificationNodes := unittest.NodeInfosFixture(verification,
 		unittest.WithRole(flow.RoleVerification),
-		unittest.WithWeight(flow.DefaultInitialWeight),
+		unittest.WithInitialWeight(flow.DefaultInitialWeight),
 	)
 	nodes = append(nodes, verificationNodes...)
 
 	// ACCESS = 1
 	accessNodes := unittest.NodeInfosFixture(access,
 		unittest.WithRole(flow.RoleAccess),
-		unittest.WithWeight(flow.DefaultInitialWeight),
+		unittest.WithInitialWeight(flow.DefaultInitialWeight),
 	)
 	nodes = append(nodes, accessNodes...)
 
diff --git a/cmd/collection/main.go b/cmd/collection/main.go
index f867661a711..9946e751efa 100644
--- a/cmd/collection/main.go
+++ b/cmd/collection/main.go
@@ -5,10 +5,12 @@ import (
 	"time"
 
 	"github.com/spf13/pflag"
+	"golang.org/x/time/rate"
 
 	client "github.com/onflow/flow-go-sdk/access/grpc"
 	sdkcrypto "github.com/onflow/flow-go-sdk/crypto"
 	"github.com/onflow/flow-go/admin/commands"
+	collectionCommands "github.com/onflow/flow-go/admin/commands/collection"
 	storageCommands "github.com/onflow/flow-go/admin/commands/storage"
 	"github.com/onflow/flow-go/cmd"
 	"github.com/onflow/flow-go/cmd/util/cmd/common"
@@ -83,6 +85,7 @@ func main() {
 
 		pools               *epochpool.TransactionPools // epoch-scoped transaction pools
 		followerDistributor *pubsub.FollowerDistributor
+		addressRateLimiter  *ingest.AddressRateLimiter
 
 		push              *pusher.Engine
 		ing               *ingest.Engine
@@ -99,6 +102,9 @@ func main() {
 		accessNodeIDS      []string
 		apiRatelimits      map[string]int
 		apiBurstlimits     map[string]int
+		txRatelimits       float64
+		txBurstlimits      int
+		txRatelimitPayers  string
 	)
 	var deprecatedFlagBlockRateDelay time.Duration
 
@@ -159,6 +165,17 @@ func main() {
 		flags.StringToIntVar(&apiRatelimits, "api-rate-limits", map[string]int{}, "per second rate limits for GRPC API methods e.g. Ping=300,SendTransaction=500 etc. note limits apply globally to all clients.")
 		flags.StringToIntVar(&apiBurstlimits, "api-burst-limits", map[string]int{}, "burst limits for gRPC API methods e.g. Ping=100,SendTransaction=100 etc. note limits apply globally to all clients.")
 
+		// rate limiting for accounts, default is 2 transactions every 2.5 seconds
+		// Note: The rate limit configured for each node may differ from the effective network-wide rate limit
+		// for a given payer. In particular, the number of clusters and the message propagation factor will
+		// influence how the individual rate limit translates to a network-wide rate limit.
+		// For example, suppose we have 5 collection clusters and configure each Collection Node with a rate
+		// limit of 1 message per second. Then, the effective network-wide rate limit for a payer address would
+		// be *at least* 5 messages per second.
+		flags.Float64Var(&txRatelimits, "ingest-tx-rate-limits", 2.5, "per second rate limits for processing transactions for limited account")
+		flags.IntVar(&txBurstlimits, "ingest-tx-burst-limits", 2, "burst limits for processing transactions for limited account")
+		flags.StringVar(&txRatelimitPayers, "ingest-tx-rate-limit-payers", "", "comma separated list of accounts to apply rate limiting to")
+
 		// deprecated flags
 		flags.DurationVar(&deprecatedFlagBlockRateDelay, "block-rate-delay", 0, "the delay to broadcast block proposal in order to control block production rate")
 	}).ValidateFlags(func() error {
@@ -181,6 +198,21 @@ func main() {
 
 	nodeBuilder.
 		PreInit(cmd.DynamicStartPreInit).
+		Module("transaction rate limiter", func(node *cmd.NodeConfig) error {
+			// To be managed by admin tool, and used by ingestion engine
+			addressRateLimiter = ingest.NewAddressRateLimiter(rate.Limit(txRatelimits), txBurstlimits)
+			// read the rate limit addresses from flag and add to the rate limiter
+			addrs, err := ingest.ParseAddresses(txRatelimitPayers)
+			if err != nil {
+				return fmt.Errorf("could not parse rate limit addresses: %w", err)
+			}
+			ingest.AddAddresses(addressRateLimiter, addrs)
+
+			return nil
+		}).
+		AdminCommand("ingest-tx-rate-limit", func(node *cmd.NodeConfig) commands.AdminCommand {
+			return collectionCommands.NewTxRateLimitCommand(addressRateLimiter)
+		}).
 		AdminCommand("read-range-cluster-blocks", func(conf *cmd.NodeConfig) commands.AdminCommand {
 			clusterPayloads := badger.NewClusterPayloads(&metrics.NoopCollector{}, conf.DB)
 			headers, ok := conf.Storage.Headers.(*badger.Headers)
@@ -391,6 +423,7 @@ func main() {
 				node.RootChainID.Chain(),
 				pools,
 				ingestConf,
+				addressRateLimiter,
 			)
 			return ing, err
 		}).
@@ -427,8 +460,8 @@ func main() {
 				collectionProviderWorkers,
 				channels.ProvideCollections,
 				filter.And(
-					filter.HasWeight(true),
-					filter.HasRole(flow.RoleAccess, flow.RoleExecution),
+					filter.IsValidCurrentEpochParticipantOrJoining,
+					filter.HasRole[flow.Identity](flow.RoleAccess, flow.RoleExecution),
 				),
 				retrieve,
 			)
diff --git a/cmd/consensus/main.go b/cmd/consensus/main.go
index 401272ec338..115be265e30 100644
--- a/cmd/consensus/main.go
+++ b/cmd/consensus/main.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package main
 
 import (
@@ -65,6 +63,7 @@ import (
 	badgerState "github.com/onflow/flow-go/state/protocol/badger"
 	"github.com/onflow/flow-go/state/protocol/blocktimer"
 	"github.com/onflow/flow-go/state/protocol/events/gadgets"
+	"github.com/onflow/flow-go/state/protocol/protocol_state"
 	"github.com/onflow/flow-go/storage"
 	bstorage "github.com/onflow/flow-go/storage/badger"
 	"github.com/onflow/flow-go/utils/io"
@@ -91,7 +90,6 @@ func main() {
 		emergencySealing                      bool
 		dkgMessagingEngineConfig              = dkgeng.DefaultMessagingEngineConfig()
 		cruiseCtlConfig                       = cruisectl.DefaultConfig()
-		cruiseCtlTargetTransitionTimeFlag     = cruiseCtlConfig.TargetTransition.String()
 		cruiseCtlFallbackProposalDurationFlag time.Duration
 		cruiseCtlMinViewDurationFlag          time.Duration
 		cruiseCtlMaxViewDurationFlag          time.Duration
@@ -149,7 +147,6 @@ func main() {
 		flags.DurationVar(&hotstuffMinTimeout, "hotstuff-min-timeout", 2500*time.Millisecond, "the lower timeout bound for the hotstuff pacemaker, this is also used as initial timeout")
 		flags.Float64Var(&hotstuffTimeoutAdjustmentFactor, "hotstuff-timeout-adjustment-factor", timeout.DefaultConfig.TimeoutAdjustmentFactor, "adjustment of timeout duration in case of time out event")
 		flags.Uint64Var(&hotstuffHappyPathMaxRoundFailures, "hotstuff-happy-path-max-round-failures", timeout.DefaultConfig.HappyPathMaxRoundFailures, "number of failed rounds before first timeout increase")
-		flags.StringVar(&cruiseCtlTargetTransitionTimeFlag, "cruise-ctl-target-epoch-transition-time", cruiseCtlTargetTransitionTimeFlag, "the target epoch switchover schedule")
 		flags.DurationVar(&cruiseCtlFallbackProposalDurationFlag, "cruise-ctl-fallback-proposal-duration", cruiseCtlConfig.FallbackProposalDelay.Load(), "the proposal duration value to use when the controller is disabled, or in epoch fallback mode. In those modes, this value has the same as the old `--block-rate-delay`")
 		flags.DurationVar(&cruiseCtlMinViewDurationFlag, "cruise-ctl-min-view-duration", cruiseCtlConfig.MinViewDuration.Load(), "the lower bound of authority for the controller, when active. This is the smallest amount of time a view is allowed to take.")
 		flags.DurationVar(&cruiseCtlMaxViewDurationFlag, "cruise-ctl-max-view-duration", cruiseCtlConfig.MaxViewDuration.Load(), "the upper bound of authority for the controller when active. This is the largest amount of time a view is allowed to take.")
@@ -175,14 +172,6 @@ func main() {
 			startupTime = t
 			nodeBuilder.Logger.Info().Time("startup_time", startupTime).Msg("got startup_time")
 		}
-		// parse target transition time string, if set
-		if cruiseCtlTargetTransitionTimeFlag != cruiseCtlConfig.TargetTransition.String() {
-			transitionTime, err := cruisectl.ParseTransition(cruiseCtlTargetTransitionTimeFlag)
-			if err != nil {
-				return fmt.Errorf("invalid epoch transition time string: %w", err)
-			}
-			cruiseCtlConfig.TargetTransition = *transitionTime
-		}
 		// convert local flag variables to atomic config variables, for dynamically updatable fields
 		if cruiseCtlEnabledFlag != cruiseCtlConfig.Enabled.Load() {
 			cruiseCtlConfig.Enabled.Store(cruiseCtlEnabledFlag)
@@ -480,7 +469,7 @@ func main() {
 				node.Me,
 				node.State,
 				channels.RequestReceiptsByBlockID,
-				filter.HasRole(flow.RoleExecution),
+				filter.HasRole[flow.Identity](flow.RoleExecution),
 				func() flow.Entity { return &flow.ExecutionReceipt{} },
 				requester.WithRetryInitial(2*time.Second),
 				requester.WithRetryMaximum(30*time.Second),
@@ -720,6 +709,14 @@ func main() {
 			return ctl, nil
 		}).
 		Component("consensus participant", func(node *cmd.NodeConfig) (module.ReadyDoneAware, error) {
+			mutableProtocolState := protocol_state.NewMutableProtocolState(
+				node.Storage.ProtocolState,
+				node.State.Params(),
+				node.Storage.Headers,
+				node.Storage.Results,
+				node.Storage.Setups,
+				node.Storage.EpochCommits,
+			)
 			// initialize the block builder
 			var build module.Builder
 			build, err = builder.NewBuilder(
@@ -732,6 +729,7 @@ func main() {
 				node.Storage.Blocks,
 				node.Storage.Results,
 				node.Storage.Receipts,
+				mutableProtocolState,
 				guarantees,
 				seals,
 				receipts,
diff --git a/cmd/dynamic_startup.go b/cmd/dynamic_startup.go
index 49ccd3dcb7a..616773c1e00 100644
--- a/cmd/dynamic_startup.go
+++ b/cmd/dynamic_startup.go
@@ -3,116 +3,21 @@ package cmd
 import (
 	"context"
 	"encoding/hex"
-	"encoding/json"
 	"fmt"
 	"path/filepath"
 	"strconv"
 	"strings"
-	"time"
 
 	"github.com/onflow/crypto"
-	"github.com/rs/zerolog"
-	"github.com/sethvargo/go-retry"
 
-	client "github.com/onflow/flow-go-sdk/access/grpc"
 	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	"github.com/onflow/flow-go/model/bootstrap"
+	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/state/protocol"
 	badgerstate "github.com/onflow/flow-go/state/protocol/badger"
 	utilsio "github.com/onflow/flow-go/utils/io"
-
-	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/state/protocol/inmem"
 )
 
-const getSnapshotTimeout = 30 * time.Second
-
-// GetProtocolSnapshot callback that will get latest finalized protocol snapshot
-type GetProtocolSnapshot func(ctx context.Context) (protocol.Snapshot, error)
-
-// GetSnapshot will attempt to get the latest finalized protocol snapshot with the given flow configs
-func GetSnapshot(ctx context.Context, client *client.Client) (*inmem.Snapshot, error) {
-	ctx, cancel := context.WithTimeout(ctx, getSnapshotTimeout)
-	defer cancel()
-
-	b, err := client.GetLatestProtocolStateSnapshot(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get latest finalized protocol state snapshot during pre-initialization: %w", err)
-	}
-
-	var snapshotEnc inmem.EncodableSnapshot
-	err = json.Unmarshal(b, &snapshotEnc)
-	if err != nil {
-		return nil, fmt.Errorf("failed to unmarshal protocol state snapshot: %w", err)
-	}
-
-	snapshot := inmem.SnapshotFromEncodable(snapshotEnc)
-	return snapshot, nil
-}
-
-// GetSnapshotAtEpochAndPhase will get the latest finalized protocol snapshot and check the current epoch and epoch phase.
-// If we are past the target epoch and epoch phase we exit the retry mechanism immediately.
-// If not check the snapshot at the specified interval until we reach the target epoch and phase.
-func GetSnapshotAtEpochAndPhase(ctx context.Context, log zerolog.Logger, startupEpoch uint64, startupEpochPhase flow.EpochPhase, retryInterval time.Duration, getSnapshot GetProtocolSnapshot) (protocol.Snapshot, error) {
-	start := time.Now()
-
-	log = log.With().
-		Uint64("target_epoch_counter", startupEpoch).
-		Str("target_epoch_phase", startupEpochPhase.String()).
-		Logger()
-
-	log.Info().Msg("starting dynamic startup - waiting until target epoch/phase to start...")
-
-	var snapshot protocol.Snapshot
-	var err error
-
-	backoff := retry.NewConstant(retryInterval)
-	err = retry.Do(ctx, backoff, func(ctx context.Context) error {
-		snapshot, err = getSnapshot(ctx)
-		if err != nil {
-			err = fmt.Errorf("failed to get protocol snapshot: %w", err)
-			log.Error().Err(err).Msg("could not get protocol snapshot")
-			return retry.RetryableError(err)
-		}
-
-		// if we encounter any errors interpreting the snapshot something went wrong stop retrying
-		currEpochCounter, err := snapshot.Epochs().Current().Counter()
-		if err != nil {
-			return fmt.Errorf("failed to get the current epoch counter: %w", err)
-		}
-
-		currEpochPhase, err := snapshot.Phase()
-		if err != nil {
-			return fmt.Errorf("failed to get the current epoch phase: %w", err)
-		}
-
-		// check if we are in or past the target epoch and phase
-		if currEpochCounter > startupEpoch || (currEpochCounter == startupEpoch && currEpochPhase >= startupEpochPhase) {
-			log.Info().
-				Dur("time-waiting", time.Since(start)).
-				Uint64("current-epoch", currEpochCounter).
-				Str("current-epoch-phase", currEpochPhase.String()).
-				Msg("finished dynamic startup - reached desired epoch and phase")
-
-			return nil
-		}
-
-		// wait then poll for latest snapshot again
-		log.Info().
-			Dur("time-waiting", time.Since(start)).
-			Uint64("current-epoch", currEpochCounter).
-			Str("current-epoch-phase", currEpochPhase.String()).
-			Msgf("waiting for epoch %d and phase %s", startupEpoch, startupEpochPhase.String())
-
-		return retry.RetryableError(fmt.Errorf("dynamic startup epoch and epoch phase not reached"))
-	})
-	if err != nil {
-		return nil, fmt.Errorf("failed to wait for target epoch and phase: %w", err)
-	}
-
-	return snapshot, nil
-}
-
 // ValidateDynamicStartupFlags will validate flags necessary for dynamic node startup
 // - assert dynamic-startup-access-publickey  is valid ECDSA_P256 public key hex
 // - assert dynamic-startup-access-address is not empty
@@ -182,7 +87,7 @@ func DynamicStartPreInit(nodeConfig *NodeConfig) error {
 	}
 
 	getSnapshotFunc := func(ctx context.Context) (protocol.Snapshot, error) {
-		return GetSnapshot(ctx, flowClient)
+		return common.GetSnapshot(ctx, flowClient)
 	}
 
 	// validate dynamic startup epoch flag
@@ -199,7 +104,7 @@ func DynamicStartPreInit(nodeConfig *NodeConfig) error {
 		return err
 	}
 
-	snapshot, err := GetSnapshotAtEpochAndPhase(
+	snapshot, err := common.GetSnapshotAtEpochAndPhase(
 		ctx,
 		log,
 		startupEpoch,
@@ -218,7 +123,7 @@ func DynamicStartPreInit(nodeConfig *NodeConfig) error {
 
 // validateDynamicStartEpochFlags parse the start epoch flag and return the uin64 value,
 // if epoch = current return the current epoch counter
-func validateDynamicStartEpochFlags(ctx context.Context, getSnapshot GetProtocolSnapshot, flagEpoch string) (uint64, error) {
+func validateDynamicStartEpochFlags(ctx context.Context, getSnapshot common.GetProtocolSnapshot, flagEpoch string) (uint64, error) {
 
 	// if flag is not `current` sentinel, it must be a specific epoch counter (uint64)
 	if flagEpoch != "current" {
diff --git a/cmd/dynamic_startup_test.go b/cmd/dynamic_startup_test.go
index 775e8221fbf..27da13fca72 100644
--- a/cmd/dynamic_startup_test.go
+++ b/cmd/dynamic_startup_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/state/protocol"
 	protocolmock "github.com/onflow/flow-go/state/protocol/mock"
@@ -87,7 +88,7 @@ func TestGetSnapshotAtEpochAndPhase(t *testing.T) {
 		_, _, targetPhase, targetEpoch := dynamicJoinFlagsFixture()
 
 		// get snapshot
-		actualSnapshot, err := GetSnapshotAtEpochAndPhase(
+		actualSnapshot, err := common.GetSnapshotAtEpochAndPhase(
 			context.Background(),
 			unittest.Logger(),
 			targetEpoch,
@@ -113,7 +114,7 @@ func TestGetSnapshotAtEpochAndPhase(t *testing.T) {
 		_, _, targetPhase, targetEpoch := dynamicJoinFlagsFixture()
 
 		// get snapshot
-		actualSnapshot, err := GetSnapshotAtEpochAndPhase(
+		actualSnapshot, err := common.GetSnapshotAtEpochAndPhase(
 			context.Background(),
 			unittest.Logger(),
 			targetEpoch,
@@ -143,7 +144,7 @@ func TestGetSnapshotAtEpochAndPhase(t *testing.T) {
 		_, _, targetPhase, _ := dynamicJoinFlagsFixture()
 
 		// get snapshot
-		actualSnapshot, err := GetSnapshotAtEpochAndPhase(
+		actualSnapshot, err := common.GetSnapshotAtEpochAndPhase(
 			context.Background(),
 			unittest.Logger(),
 			5,
diff --git a/cmd/execution_builder.go b/cmd/execution_builder.go
index 847a38d45e1..b6d83a8bde9 100644
--- a/cmd/execution_builder.go
+++ b/cmd/execution_builder.go
@@ -14,15 +14,16 @@ import (
 	awsconfig "github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	badgerDB "github.com/dgraph-io/badger/v2"
+	"github.com/ipfs/boxo/bitswap"
 	"github.com/ipfs/go-cid"
 	badger "github.com/ipfs/go-ds-badger2"
 	"github.com/onflow/flow-core-contracts/lib/go/templates"
-	"github.com/onflow/go-bitswap"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"github.com/shirou/gopsutil/v3/cpu"
 	"github.com/shirou/gopsutil/v3/host"
 	"github.com/shirou/gopsutil/v3/mem"
+	"github.com/vmihailenco/msgpack"
 	"go.uber.org/atomic"
 
 	"github.com/onflow/flow-go/admin/commands"
@@ -70,24 +71,30 @@ import (
 	modelbootstrap "github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/flow/filter"
+	"github.com/onflow/flow-go/model/messages"
 	"github.com/onflow/flow-go/module"
 	"github.com/onflow/flow-go/module/blobs"
 	"github.com/onflow/flow-go/module/chainsync"
 	"github.com/onflow/flow-go/module/executiondatasync/execution_data"
+	execdatacache "github.com/onflow/flow-go/module/executiondatasync/execution_data/cache"
 	exedataprovider "github.com/onflow/flow-go/module/executiondatasync/provider"
 	"github.com/onflow/flow-go/module/executiondatasync/pruner"
 	"github.com/onflow/flow-go/module/executiondatasync/tracker"
 	"github.com/onflow/flow-go/module/finalizedreader"
 	finalizer "github.com/onflow/flow-go/module/finalizer/consensus"
+	"github.com/onflow/flow-go/module/mempool/herocache"
 	"github.com/onflow/flow-go/module/mempool/queue"
 	"github.com/onflow/flow-go/module/metrics"
+	edrequester "github.com/onflow/flow-go/module/state_synchronization/requester"
 	"github.com/onflow/flow-go/network"
 	"github.com/onflow/flow-go/network/channels"
 	"github.com/onflow/flow-go/network/p2p/blob"
+	"github.com/onflow/flow-go/network/underlay"
 	"github.com/onflow/flow-go/state/protocol"
 	badgerState "github.com/onflow/flow-go/state/protocol/badger"
 	"github.com/onflow/flow-go/state/protocol/blocktimer"
 	storageerr "github.com/onflow/flow-go/storage"
+	bstorage "github.com/onflow/flow-go/storage/badger"
 	storage "github.com/onflow/flow-go/storage/badger"
 	"github.com/onflow/flow-go/storage/badger/procedure"
 	storagepebble "github.com/onflow/flow-go/storage/pebble"
@@ -135,7 +142,7 @@ type ExecutionNode struct {
 	txResults              *storage.TransactionResults
 	results                *storage.ExecutionResults
 	myReceipts             *storage.MyExecutionReceipts
-	providerEngine         *exeprovider.Engine
+	providerEngine         exeprovider.ProviderEngine
 	checkerEng             *checker.Engine
 	syncCore               *chainsync.Core
 	syncEngine             *synchronization.Engine
@@ -185,6 +192,15 @@ func (builder *ExecutionNodeBuilder) LoadComponentsAndModules() {
 		AdminCommand("get-transactions", func(conf *NodeConfig) commands.AdminCommand {
 			return storageCommands.NewGetTransactionsCommand(conf.State, conf.Storage.Payloads, conf.Storage.Collections)
 		}).
+		AdminCommand("protocol-snapshot", func(conf *NodeConfig) commands.AdminCommand {
+			return storageCommands.NewProtocolSnapshotCommand(
+				conf.Logger,
+				conf.State,
+				conf.Storage.Headers,
+				conf.Storage.Seals,
+				exeNode.exeConf.triedir,
+			)
+		}).
 		Module("mutable follower state", exeNode.LoadMutableFollowerState).
 		Module("system specs", exeNode.LoadSystemSpecs).
 		Module("execution metrics", exeNode.LoadExecutionMetrics).
@@ -208,7 +224,11 @@ func (builder *ExecutionNodeBuilder) LoadComponentsAndModules() {
 		Component("execution state", exeNode.LoadExecutionState).
 		Component("stop control", exeNode.LoadStopControl).
 		Component("execution state ledger WAL compactor", exeNode.LoadExecutionStateLedgerWALCompactor).
-		Component("execution data pruner", exeNode.LoadExecutionDataPruner).
+		// disable execution data pruner for now, since storehouse is going to need the execution data
+		// for recovery,
+		// TODO: will re-visit this once storehouse has implemented new WAL for checkpoint file of
+		// payloadless trie.
+		// Component("execution data pruner", exeNode.LoadExecutionDataPruner).
 		Component("blob service", exeNode.LoadBlobService).
 		Component("block data upload manager", exeNode.LoadBlockUploaderManager).
 		Component("GCP block data uploader", exeNode.LoadGCPBlockDataUploader).
@@ -223,7 +243,8 @@ func (builder *ExecutionNodeBuilder) LoadComponentsAndModules() {
 		Component("collection requester engine", exeNode.LoadCollectionRequesterEngine).
 		Component("receipt provider engine", exeNode.LoadReceiptProviderEngine).
 		Component("synchronization engine", exeNode.LoadSynchronizationEngine).
-		Component("grpc server", exeNode.LoadGrpcServer)
+		Component("grpc server", exeNode.LoadGrpcServer).
+		Component("observer collection indexer", exeNode.LoadObserverCollectionIndexer)
 }
 
 func (exeNode *ExecutionNode) LoadMutableFollowerState(node *NodeConfig) error {
@@ -322,8 +343,11 @@ func (exeNode *ExecutionNode) LoadBlobService(
 				return nil, fmt.Errorf("allowed node ID %s is not an access node", id.NodeID.String())
 			}
 
-			if id.Ejected {
-				return nil, fmt.Errorf("allowed node ID %s is ejected", id.NodeID.String())
+			if id.IsEjected() {
+				exeNode.builder.Logger.Warn().
+					Str("node_id", idHex).
+					Msg("removing Access Node from the set of nodes authorized to request Execution Data, because it is ejected")
+				continue
 			}
 
 			allowedANs[anID] = true
@@ -346,7 +370,11 @@ func (exeNode *ExecutionNode) LoadBlobService(
 		opts = append(opts, blob.WithRateLimit(float64(exeNode.exeConf.blobstoreRateLimit), exeNode.exeConf.blobstoreBurstLimit))
 	}
 
-	bs, err := node.EngineRegistry.RegisterBlobService(channels.ExecutionDataService, exeNode.executionDataDatastore, opts...)
+	edsChannel := channels.ExecutionDataService
+	if node.ObserverMode {
+		edsChannel = channels.PublicExecutionDataService
+	}
+	bs, err := node.EngineRegistry.RegisterBlobService(edsChannel, exeNode.executionDataDatastore, opts...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to register blob service: %w", err)
 	}
@@ -517,26 +545,30 @@ func (exeNode *ExecutionNode) LoadProviderEngine(
 	}
 	exeNode.computationManager = manager
 
-	var chunkDataPackRequestQueueMetrics module.HeroCacheMetrics = metrics.NewNoopCollector()
-	if node.HeroCacheMetricsEnable {
-		chunkDataPackRequestQueueMetrics = metrics.ChunkDataPackRequestQueueMetricsFactory(node.MetricsRegisterer)
-	}
-	chdpReqQueue := queue.NewHeroStore(exeNode.exeConf.chunkDataPackRequestsCacheSize, node.Logger, chunkDataPackRequestQueueMetrics)
-	exeNode.providerEngine, err = exeprovider.New(
-		node.Logger,
-		node.Tracer,
-		node.EngineRegistry,
-		node.State,
-		exeNode.executionState,
-		exeNode.collector,
-		exeNode.checkAuthorizedAtBlock,
-		chdpReqQueue,
-		exeNode.exeConf.chunkDataPackRequestWorkers,
-		exeNode.exeConf.chunkDataPackQueryTimeout,
-		exeNode.exeConf.chunkDataPackDeliveryTimeout,
-	)
-	if err != nil {
-		return nil, err
+	if node.ObserverMode {
+		exeNode.providerEngine = &exeprovider.NoopEngine{}
+	} else {
+		var chunkDataPackRequestQueueMetrics module.HeroCacheMetrics = metrics.NewNoopCollector()
+		if node.HeroCacheMetricsEnable {
+			chunkDataPackRequestQueueMetrics = metrics.ChunkDataPackRequestQueueMetricsFactory(node.MetricsRegisterer)
+		}
+		chdpReqQueue := queue.NewHeroStore(exeNode.exeConf.chunkDataPackRequestsCacheSize, node.Logger, chunkDataPackRequestQueueMetrics)
+		exeNode.providerEngine, err = exeprovider.New(
+			node.Logger,
+			node.Tracer,
+			node.EngineRegistry,
+			node.State,
+			exeNode.executionState,
+			exeNode.collector,
+			exeNode.checkAuthorizedAtBlock,
+			chdpReqQueue,
+			exeNode.exeConf.chunkDataPackRequestWorkers,
+			exeNode.exeConf.chunkDataPackQueryTimeout,
+			exeNode.exeConf.chunkDataPackDeliveryTimeout,
+		)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	// Get latest executed block and a view at that block
@@ -801,15 +833,9 @@ func (exeNode *ExecutionNode) LoadRegisterStore(
 
 	if !bootstrapped {
 		checkpointFile := path.Join(exeNode.exeConf.triedir, modelbootstrap.FilenameWALRootCheckpoint)
-		sealedRoot, err := node.State.Params().SealedRoot()
-		if err != nil {
-			return fmt.Errorf("could not get sealed root: %w", err)
-		}
+		sealedRoot := node.State.Params().SealedRoot()
 
-		rootSeal, err := node.State.Params().Seal()
-		if err != nil {
-			return fmt.Errorf("could not get root seal: %w", err)
-		}
+		rootSeal := node.State.Params().Seal()
 
 		if sealedRoot.ID() != rootSeal.BlockID {
 			return fmt.Errorf("mismatching root seal and sealed root: %v != %v", sealedRoot.ID(), rootSeal.BlockID)
@@ -884,6 +910,7 @@ func (exeNode *ExecutionNode) LoadExecutionStateLedgerWALCompactor(
 		exeNode.exeConf.checkpointDistance,
 		exeNode.exeConf.checkpointsToKeep,
 		exeNode.toTriggerCheckpoint, // compactor will listen to the signal from admin tool for force triggering checkpointing
+		exeNode.collector,
 	)
 }
 
@@ -935,6 +962,87 @@ func (exeNode *ExecutionNode) LoadExecutionDataPruner(
 	return exeNode.executionDataPruner, err
 }
 
+func (exeNode *ExecutionNode) LoadObserverCollectionIndexer(
+	node *NodeConfig,
+) (
+	module.ReadyDoneAware,
+	error,
+) {
+	if !node.ObserverMode {
+		node.Logger.Info().Msg("execution data downloader is disabled")
+		return &module.NoopReadyDoneAware{}, nil
+	}
+
+	node.Logger.Info().Msg("observer-mode is enabled, creating execution data downloader")
+
+	execDataDistributor := edrequester.NewExecutionDataDistributor()
+
+	executionDataDownloader := execution_data.NewDownloader(exeNode.blobService)
+
+	var heroCacheCollector module.HeroCacheMetrics = metrics.NewNoopCollector()
+	execDataCacheBackend := herocache.NewBlockExecutionData(10, node.Logger, heroCacheCollector)
+
+	// Execution Data cache that a downloader as the backend
+	// If the execution data doesn't exist, it uses the downloader to fetch it
+	executionDataCache := execdatacache.NewExecutionDataCache(
+		executionDataDownloader,
+		node.Storage.Headers,
+		node.Storage.Seals,
+		node.Storage.Results,
+		execDataCacheBackend,
+	)
+
+	processedBlockHeight := bstorage.NewConsumerProgress(node.DB, module.ConsumeProgressExecutionDataRequesterBlockHeight)
+	processedNotifications := bstorage.NewConsumerProgress(node.DB, module.ConsumeProgressExecutionDataRequesterNotification)
+
+	executionDataConfig := edrequester.ExecutionDataConfig{
+		InitialBlockHeight: node.SealedRootBlock.Header.Height,
+		MaxSearchAhead:     edrequester.DefaultMaxSearchAhead,
+		FetchTimeout:       edrequester.DefaultFetchTimeout,
+		MaxFetchTimeout:    edrequester.DefaultMaxFetchTimeout,
+		RetryDelay:         edrequester.DefaultRetryDelay,
+		MaxRetryDelay:      edrequester.DefaultMaxRetryDelay,
+	}
+
+	r, err := edrequester.New(
+		node.Logger,
+		metrics.NewExecutionDataRequesterCollector(),
+		executionDataDownloader,
+		executionDataCache,
+		processedBlockHeight,
+		processedNotifications,
+		node.State,
+		node.Storage.Headers,
+		executionDataConfig,
+		execDataDistributor,
+	)
+
+	if err != nil {
+		return &module.NoopReadyDoneAware{}, err
+	}
+
+	// subscribe the block finalization event, and trigger workers to fetch execution data
+	exeNode.followerDistributor.AddOnBlockFinalizedConsumer(r.OnBlockFinalized)
+
+	execDataDistributor.AddOnExecutionDataReceivedConsumer(func(data *execution_data.BlockExecutionDataEntity) {
+		res := &messages.EntityResponse{}
+		for _, chunk := range data.BlockExecutionData.ChunkExecutionDatas {
+			col := chunk.Collection
+			blob, _ := msgpack.Marshal(col)
+			res.EntityIDs = append(res.EntityIDs, col.ID())
+			res.Blobs = append(res.Blobs, blob)
+		}
+
+		// notify the collection requester that collections have been received
+		err := exeNode.collectionRequester.ProcessLocal(res)
+		if err != nil {
+			node.Logger.Fatal().Err(err).Msgf("failed to process collection from local execution data for block %v", data.BlockExecutionData.BlockID)
+		}
+	})
+
+	return r, nil
+}
+
 func (exeNode *ExecutionNode) LoadCheckerEngine(
 	node *NodeConfig,
 ) (
@@ -963,8 +1071,13 @@ func (exeNode *ExecutionNode) LoadIngestionEngine(
 	module.ReadyDoneAware,
 	error,
 ) {
+	engineRegister := node.EngineRegistry
+	if node.ObserverMode {
+		engineRegister = &underlay.NoopEngineRegister{}
+	}
+
 	var err error
-	exeNode.collectionRequester, err = requester.New(node.Logger, node.Metrics.Engine, node.EngineRegistry, node.Me, node.State,
+	exeNode.collectionRequester, err = requester.New(node.Logger, node.Metrics.Engine, engineRegister, node.Me, node.State,
 		channels.RequestCollections,
 		filter.Any,
 		func() flow.Entity { return &flow.Collection{} },
@@ -1159,18 +1272,22 @@ func (exeNode *ExecutionNode) LoadReceiptProviderEngine(
 	}
 	receiptRequestQueue := queue.NewHeroStore(exeNode.exeConf.receiptRequestsCacheSize, node.Logger, receiptRequestQueueMetric)
 
+	engineRegister := node.EngineRegistry
+	if node.ObserverMode {
+		engineRegister = &underlay.NoopEngineRegister{}
+	}
 	eng, err := provider.New(
 		node.Logger.With().Str("engine", "receipt_provider").Logger(),
 		node.Metrics.Engine,
-		node.EngineRegistry,
+		engineRegister,
 		node.Me,
 		node.State,
 		receiptRequestQueue,
 		exeNode.exeConf.receiptRequestWorkers,
 		channels.ProvideReceiptsByBlockID,
 		filter.And(
-			filter.HasWeight(true),
-			filter.HasRole(flow.RoleConsensus),
+			filter.IsValidCurrentEpochParticipantOrJoining,
+			filter.HasRole[flow.Identity](flow.RoleConsensus),
 		),
 		retrieve,
 	)
@@ -1189,6 +1306,7 @@ func (exeNode *ExecutionNode) LoadSynchronizationEngine(
 	if err != nil {
 		return nil, fmt.Errorf("could not initialize spam detection config: %w", err)
 	}
+
 	exeNode.syncEngine, err = synchronization.New(
 		node.Logger,
 		node.Metrics.Engine,
diff --git a/cmd/node_builder.go b/cmd/node_builder.go
index 267ea791b99..f69a3c7acb8 100644
--- a/cmd/node_builder.go
+++ b/cmd/node_builder.go
@@ -141,6 +141,7 @@ type BaseConfig struct {
 	AdminMaxMsgSize             uint
 	BindAddr                    string
 	NodeRole                    string
+	ObserverMode                bool
 	DynamicStartupANAddress     string
 	DynamicStartupANPubkey      string
 	DynamicStartupEpochPhase    string
@@ -255,6 +256,7 @@ func DefaultBaseConfig() *BaseConfig {
 		AdminClientCAs:   NotSet,
 		AdminMaxMsgSize:  grpcutils.DefaultMaxMsgSize,
 		BindAddr:         NotSet,
+		ObserverMode:     false,
 		BootstrapDir:     "bootstrap",
 		datadir:          datadir,
 		secretsdir:       NotSet,
diff --git a/cmd/observer/node_builder/observer_builder.go b/cmd/observer/node_builder/observer_builder.go
index 63ccb62ecc9..b50aab6144d 100644
--- a/cmd/observer/node_builder/observer_builder.go
+++ b/cmd/observer/node_builder/observer_builder.go
@@ -6,9 +6,15 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"math"
+	"os"
+	"path"
+	"path/filepath"
 	"strings"
 	"time"
 
+	"github.com/ipfs/boxo/bitswap"
+	badger "github.com/ipfs/go-ds-badger2"
 	dht "github.com/libp2p/go-libp2p-kad-dht"
 	"github.com/libp2p/go-libp2p/core/host"
 	"github.com/libp2p/go-libp2p/core/peer"
@@ -18,6 +24,8 @@ import (
 	"github.com/spf13/pflag"
 	"google.golang.org/grpc/credentials"
 
+	"github.com/onflow/flow-go/admin/commands"
+	stateSyncCommands "github.com/onflow/flow-go/admin/commands/state_synchronization"
 	"github.com/onflow/flow-go/cmd"
 	"github.com/onflow/flow-go/consensus"
 	"github.com/onflow/flow-go/consensus/hotstuff"
@@ -28,27 +36,43 @@ import (
 	hotstuffvalidator "github.com/onflow/flow-go/consensus/hotstuff/validator"
 	"github.com/onflow/flow-go/consensus/hotstuff/verification"
 	recovery "github.com/onflow/flow-go/consensus/recovery/protocol"
+	"github.com/onflow/flow-go/engine"
 	"github.com/onflow/flow-go/engine/access/apiproxy"
+	"github.com/onflow/flow-go/engine/access/index"
 	"github.com/onflow/flow-go/engine/access/rest"
 	restapiproxy "github.com/onflow/flow-go/engine/access/rest/apiproxy"
 	"github.com/onflow/flow-go/engine/access/rest/routes"
 	"github.com/onflow/flow-go/engine/access/rpc"
 	"github.com/onflow/flow-go/engine/access/rpc/backend"
 	rpcConnection "github.com/onflow/flow-go/engine/access/rpc/connection"
+	"github.com/onflow/flow-go/engine/access/state_stream"
 	statestreambackend "github.com/onflow/flow-go/engine/access/state_stream/backend"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/engine/common/follower"
 	synceng "github.com/onflow/flow-go/engine/common/synchronization"
-	"github.com/onflow/flow-go/engine/protocol"
+	"github.com/onflow/flow-go/engine/execution/computation/query"
+	"github.com/onflow/flow-go/ledger"
+	"github.com/onflow/flow-go/ledger/complete/wal"
+	"github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/encodable"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/flow/filter"
 	"github.com/onflow/flow-go/module"
+	"github.com/onflow/flow-go/module/blobs"
 	"github.com/onflow/flow-go/module/chainsync"
+	"github.com/onflow/flow-go/module/execution"
+	"github.com/onflow/flow-go/module/executiondatasync/execution_data"
+	execdatacache "github.com/onflow/flow-go/module/executiondatasync/execution_data/cache"
 	finalizer "github.com/onflow/flow-go/module/finalizer/consensus"
 	"github.com/onflow/flow-go/module/grpcserver"
 	"github.com/onflow/flow-go/module/id"
 	"github.com/onflow/flow-go/module/local"
+	"github.com/onflow/flow-go/module/mempool/herocache"
+	"github.com/onflow/flow-go/module/mempool/stdmap"
 	"github.com/onflow/flow-go/module/metrics"
+	"github.com/onflow/flow-go/module/state_synchronization"
+	"github.com/onflow/flow-go/module/state_synchronization/indexer"
+	edrequester "github.com/onflow/flow-go/module/state_synchronization/requester"
 	consensus_follower "github.com/onflow/flow-go/module/upstream"
 	"github.com/onflow/flow-go/network"
 	alspmgr "github.com/onflow/flow-go/network/alsp/manager"
@@ -56,6 +80,7 @@ import (
 	"github.com/onflow/flow-go/network/channels"
 	"github.com/onflow/flow-go/network/converter"
 	"github.com/onflow/flow-go/network/p2p"
+	"github.com/onflow/flow-go/network/p2p/blob"
 	p2pbuilder "github.com/onflow/flow-go/network/p2p/builder"
 	p2pbuilderconfig "github.com/onflow/flow-go/network/p2p/builder/config"
 	"github.com/onflow/flow-go/network/p2p/cache"
@@ -63,7 +88,7 @@ import (
 	p2pdht "github.com/onflow/flow-go/network/p2p/dht"
 	"github.com/onflow/flow-go/network/p2p/keyutils"
 	p2plogging "github.com/onflow/flow-go/network/p2p/logging"
-	"github.com/onflow/flow-go/network/p2p/subscription"
+	networkingsubscription "github.com/onflow/flow-go/network/p2p/subscription"
 	"github.com/onflow/flow-go/network/p2p/translator"
 	"github.com/onflow/flow-go/network/p2p/unicast/protocols"
 	"github.com/onflow/flow-go/network/p2p/utils"
@@ -74,6 +99,9 @@ import (
 	badgerState "github.com/onflow/flow-go/state/protocol/badger"
 	"github.com/onflow/flow-go/state/protocol/blocktimer"
 	"github.com/onflow/flow-go/state/protocol/events/gadgets"
+	"github.com/onflow/flow-go/storage"
+	bstorage "github.com/onflow/flow-go/storage/badger"
+	pStorage "github.com/onflow/flow-go/storage/pebble"
 	"github.com/onflow/flow-go/utils/grpcutils"
 	"github.com/onflow/flow-go/utils/io"
 )
@@ -98,22 +126,39 @@ import (
 // For a node running as a standalone process, the config fields will be populated from the command line params,
 // while for a node running as a library, the config fields are expected to be initialized by the caller.
 type ObserverServiceConfig struct {
-	bootstrapNodeAddresses    []string
-	bootstrapNodePublicKeys   []string
-	observerNetworkingKeyPath string
-	bootstrapIdentities       flow.IdentityList // the identity list of bootstrap peers the node uses to discover other nodes
-	apiRatelimits             map[string]int
-	apiBurstlimits            map[string]int
-	rpcConf                   rpc.Config
-	rpcMetricsEnabled         bool
-	apiTimeout                time.Duration
-	upstreamNodeAddresses     []string
-	upstreamNodePublicKeys    []string
-	upstreamIdentities        flow.IdentityList // the identity list of upstream peers the node uses to forward API requests to
+	bootstrapNodeAddresses       []string
+	bootstrapNodePublicKeys      []string
+	observerNetworkingKeyPath    string
+	bootstrapIdentities          flow.IdentitySkeletonList // the identity list of bootstrap peers the node uses to discover other nodes
+	apiRatelimits                map[string]int
+	apiBurstlimits               map[string]int
+	rpcConf                      rpc.Config
+	rpcMetricsEnabled            bool
+	registersDBPath              string
+	checkpointFile               string
+	apiTimeout                   time.Duration
+	stateStreamConf              statestreambackend.Config
+	stateStreamFilterConf        map[string]int
+	upstreamNodeAddresses        []string
+	upstreamNodePublicKeys       []string
+	upstreamIdentities           flow.IdentitySkeletonList // the identity list of upstream peers the node uses to forward API requests to
+	scriptExecutorConfig         query.QueryConfig
+	logTxTimeToFinalized         bool
+	logTxTimeToExecuted          bool
+	logTxTimeToFinalizedExecuted bool
+	executionDataSyncEnabled     bool
+	executionDataIndexingEnabled bool
+	localServiceAPIEnabled       bool
+	executionDataDir             string
+	executionDataStartHeight     uint64
+	executionDataConfig          edrequester.ExecutionDataConfig
+	scriptExecMinBlock           uint64
+	scriptExecMaxBlock           uint64
 }
 
 // DefaultObserverServiceConfig defines all the default values for the ObserverServiceConfig
 func DefaultObserverServiceConfig() *ObserverServiceConfig {
+	homedir, _ := os.UserHomeDir()
 	return &ObserverServiceConfig{
 		rpcConf: rpc.Config{
 			UnsecureGRPCListenAddr: "0.0.0.0:9000",
@@ -128,6 +173,9 @@ func DefaultObserverServiceConfig() *ObserverServiceConfig {
 				MaxHeightRange:            backend.DefaultMaxHeightRange,
 				PreferredExecutionNodeIDs: nil,
 				FixedExecutionNodeIDs:     nil,
+				ScriptExecutionMode:       backend.IndexQueryModeExecutionNodesOnly.String(), // default to ENs only for now
+				EventQueryMode:            backend.IndexQueryModeExecutionNodesOnly.String(), // default to ENs only for now
+				TxResultQueryMode:         backend.IndexQueryModeExecutionNodesOnly.String(), // default to ENs only for now
 			},
 			RestConfig: rest.Config{
 				ListenAddress: "",
@@ -138,15 +186,48 @@ func DefaultObserverServiceConfig() *ObserverServiceConfig {
 			MaxMsgSize:     grpcutils.DefaultMaxMsgSize,
 			CompressorName: grpcutils.NoCompressor,
 		},
-		rpcMetricsEnabled:         false,
-		apiRatelimits:             nil,
-		apiBurstlimits:            nil,
-		bootstrapNodeAddresses:    []string{},
-		bootstrapNodePublicKeys:   []string{},
-		observerNetworkingKeyPath: cmd.NotSet,
-		apiTimeout:                3 * time.Second,
-		upstreamNodeAddresses:     []string{},
-		upstreamNodePublicKeys:    []string{},
+		stateStreamConf: statestreambackend.Config{
+			MaxExecutionDataMsgSize: grpcutils.DefaultMaxMsgSize,
+			ExecutionDataCacheSize:  subscription.DefaultCacheSize,
+			ClientSendTimeout:       subscription.DefaultSendTimeout,
+			ClientSendBufferSize:    subscription.DefaultSendBufferSize,
+			MaxGlobalStreams:        subscription.DefaultMaxGlobalStreams,
+			EventFilterConfig:       state_stream.DefaultEventFilterConfig,
+			ResponseLimit:           subscription.DefaultResponseLimit,
+			HeartbeatInterval:       subscription.DefaultHeartbeatInterval,
+			RegisterIDsRequestLimit: state_stream.DefaultRegisterIDsRequestLimit,
+		},
+		stateStreamFilterConf:        nil,
+		rpcMetricsEnabled:            false,
+		apiRatelimits:                nil,
+		apiBurstlimits:               nil,
+		bootstrapNodeAddresses:       []string{},
+		bootstrapNodePublicKeys:      []string{},
+		observerNetworkingKeyPath:    cmd.NotSet,
+		apiTimeout:                   3 * time.Second,
+		upstreamNodeAddresses:        []string{},
+		upstreamNodePublicKeys:       []string{},
+		registersDBPath:              filepath.Join(homedir, ".flow", "execution_state"),
+		checkpointFile:               cmd.NotSet,
+		scriptExecutorConfig:         query.NewDefaultConfig(),
+		logTxTimeToFinalized:         false,
+		logTxTimeToExecuted:          false,
+		logTxTimeToFinalizedExecuted: false,
+		executionDataSyncEnabled:     false,
+		executionDataIndexingEnabled: false,
+		localServiceAPIEnabled:       false,
+		executionDataDir:             filepath.Join(homedir, ".flow", "execution_data"),
+		executionDataStartHeight:     0,
+		executionDataConfig: edrequester.ExecutionDataConfig{
+			InitialBlockHeight: 0,
+			MaxSearchAhead:     edrequester.DefaultMaxSearchAhead,
+			FetchTimeout:       edrequester.DefaultFetchTimeout,
+			MaxFetchTimeout:    edrequester.DefaultMaxFetchTimeout,
+			RetryDelay:         edrequester.DefaultRetryDelay,
+			MaxRetryDelay:      edrequester.DefaultMaxRetryDelay,
+		},
+		scriptExecMinBlock: 0,
+		scriptExecMaxBlock: math.MaxUint64,
 	}
 }
 
@@ -157,32 +238,52 @@ type ObserverServiceBuilder struct {
 	*ObserverServiceConfig
 
 	// components
-	LibP2PNode          p2p.LibP2PNode
-	FollowerState       stateprotocol.FollowerState
-	SyncCore            *chainsync.Core
-	RpcEng              *rpc.Engine
-	FollowerDistributor *pubsub.FollowerDistributor
-	Committee           hotstuff.DynamicCommittee
-	Finalized           *flow.Header
-	Pending             []*flow.Header
-	FollowerCore        module.HotStuffFollower
+
+	LibP2PNode           p2p.LibP2PNode
+	FollowerState        stateprotocol.FollowerState
+	SyncCore             *chainsync.Core
+	RpcEng               *rpc.Engine
+	TransactionTimings   *stdmap.TransactionTimings
+	FollowerDistributor  *pubsub.FollowerDistributor
+	Committee            hotstuff.DynamicCommittee
+	Finalized            *flow.Header
+	Pending              []*flow.Header
+	FollowerCore         module.HotStuffFollower
+	ExecutionIndexer     *indexer.Indexer
+	ExecutionIndexerCore *indexer.IndexerCore
+	TxResultsIndex       *index.TransactionResultsIndex
+	IndexerDependencies  *cmd.DependencyList
+
+	ExecutionDataDownloader execution_data.Downloader
+	ExecutionDataRequester  state_synchronization.ExecutionDataRequester
+	ExecutionDataStore      execution_data.ExecutionDataStore
+
+	RegistersAsyncStore *execution.RegistersAsyncStore
+	EventsIndex         *index.EventsIndex
+	ScriptExecutor      *backend.ScriptExecutor
 
 	// available until after the network has started. Hence, a factory function that needs to be called just before
 	// creating the sync engine
 	SyncEngineParticipantsProviderFactory func() module.IdentifierProvider
 
 	// engines
-	FollowerEng *follower.ComplianceEngine
-	SyncEng     *synceng.Engine
+	FollowerEng    *follower.ComplianceEngine
+	SyncEng        *synceng.Engine
+	StateStreamEng *statestreambackend.Engine
 
 	// Public network
 	peerID peer.ID
 
-	RestMetrics   *metrics.RestCollector
-	AccessMetrics module.AccessMetrics
+	TransactionMetrics *metrics.TransactionCollector
+	RestMetrics        *metrics.RestCollector
+	AccessMetrics      module.AccessMetrics
+
 	// grpc servers
-	secureGrpcServer   *grpcserver.GrpcServer
-	unsecureGrpcServer *grpcserver.GrpcServer
+	secureGrpcServer      *grpcserver.GrpcServer
+	unsecureGrpcServer    *grpcserver.GrpcServer
+	stateStreamGrpcServer *grpcserver.GrpcServer
+
+	stateStreamBackend *statestreambackend.StateStreamBackend
 }
 
 // deriveBootstrapPeerIdentities derives the Flow Identity of the bootstrap peers from the parameters.
@@ -194,7 +295,7 @@ func (builder *ObserverServiceBuilder) deriveBootstrapPeerIdentities() error {
 		return nil
 	}
 
-	ids, err := BootstrapIdentities(builder.bootstrapNodeAddresses, builder.bootstrapNodePublicKeys)
+	ids, err := cmd.BootstrapIdentities(builder.bootstrapNodeAddresses, builder.bootstrapNodePublicKeys)
 	if err != nil {
 		return fmt.Errorf("failed to derive bootstrap peer identities: %w", err)
 	}
@@ -222,7 +323,7 @@ func (builder *ObserverServiceBuilder) deriveUpstreamIdentities() error {
 		return fmt.Errorf("number of addresses and keys provided for the boostrap nodes don't match")
 	}
 
-	ids := make([]*flow.Identity, len(addresses))
+	ids := make(flow.IdentitySkeletonList, len(addresses))
 	for i, address := range addresses {
 		key := keys[i]
 
@@ -234,7 +335,7 @@ func (builder *ObserverServiceBuilder) deriveUpstreamIdentities() error {
 		}
 
 		// create the identity of the peer by setting only the relevant fields
-		ids[i] = &flow.Identity{
+		ids[i] = &flow.IdentitySkeleton{
 			NodeID:        flow.ZeroID, // the NodeID is the hash of the staking key and for the public network it does not apply
 			Address:       address,
 			Role:          flow.RoleAccess, // the upstream node has to be an access node
@@ -447,6 +548,7 @@ func NewFlowObserverServiceBuilder(opts ...Option) *ObserverServiceBuilder {
 		ObserverServiceConfig: config,
 		FlowNodeBuilder:       cmd.FlowNode("observer"),
 		FollowerDistributor:   pubsub.NewFollowerDistributor(),
+		IndexerDependencies:   cmd.NewDependencyList(),
 	}
 	anb.FollowerDistributor.AddProposalViolationConsumer(notifications.NewSlashingViolationsConsumer(anb.Logger))
 	// the observer gets a version of the root snapshot file that does not contain any node addresses
@@ -456,7 +558,6 @@ func NewFlowObserverServiceBuilder(opts ...Option) *ObserverServiceBuilder {
 }
 
 func (builder *ObserverServiceBuilder) ParseFlags() error {
-
 	builder.BaseFlags()
 
 	builder.extraFlags()
@@ -532,7 +633,156 @@ func (builder *ObserverServiceBuilder) extraFlags() {
 			"upstream-node-public-keys",
 			defaultConfig.upstreamNodePublicKeys,
 			"the networking public key of the upstream access node (in the same order as the upstream node addresses) e.g. \"d57a5e9c5.....\",\"44ded42d....\"")
+
+		flags.BoolVar(&builder.logTxTimeToFinalized, "log-tx-time-to-finalized", defaultConfig.logTxTimeToFinalized, "log transaction time to finalized")
+		flags.BoolVar(&builder.logTxTimeToExecuted, "log-tx-time-to-executed", defaultConfig.logTxTimeToExecuted, "log transaction time to executed")
+		flags.BoolVar(&builder.logTxTimeToFinalizedExecuted,
+			"log-tx-time-to-finalized-executed",
+			defaultConfig.logTxTimeToFinalizedExecuted,
+			"log transaction time to finalized and executed")
 		flags.BoolVar(&builder.rpcMetricsEnabled, "rpc-metrics-enabled", defaultConfig.rpcMetricsEnabled, "whether to enable the rpc metrics")
+		flags.BoolVar(&builder.executionDataIndexingEnabled,
+			"execution-data-indexing-enabled",
+			defaultConfig.executionDataIndexingEnabled,
+			"whether to enable the execution data indexing")
+		flags.BoolVar(&builder.localServiceAPIEnabled, "local-service-api-enabled", defaultConfig.localServiceAPIEnabled, "whether to use local indexed data for api queries")
+		flags.StringVar(&builder.registersDBPath, "execution-state-dir", defaultConfig.registersDBPath, "directory to use for execution-state database")
+		flags.StringVar(&builder.checkpointFile, "execution-state-checkpoint", defaultConfig.checkpointFile, "execution-state checkpoint file")
+
+		// ExecutionDataRequester config
+		flags.BoolVar(&builder.executionDataSyncEnabled,
+			"execution-data-sync-enabled",
+			defaultConfig.executionDataSyncEnabled,
+			"whether to enable the execution data sync protocol")
+		flags.StringVar(&builder.executionDataDir,
+			"execution-data-dir",
+			defaultConfig.executionDataDir,
+			"directory to use for Execution Data database")
+		flags.Uint64Var(&builder.executionDataStartHeight,
+			"execution-data-start-height",
+			defaultConfig.executionDataStartHeight,
+			"height of first block to sync execution data from when starting with an empty Execution Data database")
+		flags.Uint64Var(&builder.executionDataConfig.MaxSearchAhead,
+			"execution-data-max-search-ahead",
+			defaultConfig.executionDataConfig.MaxSearchAhead,
+			"max number of heights to search ahead of the lowest outstanding execution data height")
+		flags.DurationVar(&builder.executionDataConfig.FetchTimeout,
+			"execution-data-fetch-timeout",
+			defaultConfig.executionDataConfig.FetchTimeout,
+			"initial timeout to use when fetching execution data from the network. timeout increases using an incremental backoff until execution-data-max-fetch-timeout. e.g. 30s")
+		flags.DurationVar(&builder.executionDataConfig.MaxFetchTimeout,
+			"execution-data-max-fetch-timeout",
+			defaultConfig.executionDataConfig.MaxFetchTimeout,
+			"maximum timeout to use when fetching execution data from the network e.g. 300s")
+		flags.DurationVar(&builder.executionDataConfig.RetryDelay,
+			"execution-data-retry-delay",
+			defaultConfig.executionDataConfig.RetryDelay,
+			"initial delay for exponential backoff when fetching execution data fails e.g. 10s")
+		flags.DurationVar(&builder.executionDataConfig.MaxRetryDelay,
+			"execution-data-max-retry-delay",
+			defaultConfig.executionDataConfig.MaxRetryDelay,
+			"maximum delay for exponential backoff when fetching execution data fails e.g. 5m")
+
+		// Streaming API
+		flags.StringVar(&builder.stateStreamConf.ListenAddr,
+			"state-stream-addr",
+			defaultConfig.stateStreamConf.ListenAddr,
+			"the address the state stream server listens on (if empty the server will not be started)")
+		flags.Uint32Var(&builder.stateStreamConf.ExecutionDataCacheSize,
+			"execution-data-cache-size",
+			defaultConfig.stateStreamConf.ExecutionDataCacheSize,
+			"block execution data cache size")
+		flags.Uint32Var(&builder.stateStreamConf.MaxGlobalStreams,
+			"state-stream-global-max-streams", defaultConfig.stateStreamConf.MaxGlobalStreams,
+			"global maximum number of concurrent streams")
+		flags.UintVar(&builder.stateStreamConf.MaxExecutionDataMsgSize,
+			"state-stream-max-message-size",
+			defaultConfig.stateStreamConf.MaxExecutionDataMsgSize,
+			"maximum size for a gRPC message containing block execution data")
+		flags.StringToIntVar(&builder.stateStreamFilterConf,
+			"state-stream-event-filter-limits",
+			defaultConfig.stateStreamFilterConf,
+			"event filter limits for ExecutionData SubscribeEvents API e.g. EventTypes=100,Addresses=100,Contracts=100 etc.")
+		flags.DurationVar(&builder.stateStreamConf.ClientSendTimeout,
+			"state-stream-send-timeout",
+			defaultConfig.stateStreamConf.ClientSendTimeout,
+			"maximum wait before timing out while sending a response to a streaming client e.g. 30s")
+		flags.UintVar(&builder.stateStreamConf.ClientSendBufferSize,
+			"state-stream-send-buffer-size",
+			defaultConfig.stateStreamConf.ClientSendBufferSize,
+			"maximum number of responses to buffer within a stream")
+		flags.Float64Var(&builder.stateStreamConf.ResponseLimit,
+			"state-stream-response-limit",
+			defaultConfig.stateStreamConf.ResponseLimit,
+			"max number of responses per second to send over streaming endpoints. this helps manage resources consumed by each client querying data not in the cache e.g. 3 or 0.5. 0 means no limit")
+		flags.Uint64Var(&builder.stateStreamConf.HeartbeatInterval,
+			"state-stream-heartbeat-interval",
+			defaultConfig.stateStreamConf.HeartbeatInterval,
+			"default interval in blocks at which heartbeat messages should be sent. applied when client did not specify a value.")
+		flags.Uint32Var(&builder.stateStreamConf.RegisterIDsRequestLimit,
+			"state-stream-max-register-values",
+			defaultConfig.stateStreamConf.RegisterIDsRequestLimit,
+			"maximum number of register ids to include in a single request to the GetRegisters endpoint")
+		flags.StringVar(&builder.rpcConf.BackendConfig.EventQueryMode,
+			"event-query-mode",
+			defaultConfig.rpcConf.BackendConfig.EventQueryMode,
+			"mode to use when querying events. one of [local-only, execution-nodes-only(default), failover]")
+		flags.Uint64Var(&builder.scriptExecMinBlock,
+			"script-execution-min-height",
+			defaultConfig.scriptExecMinBlock,
+			"lowest block height to allow for script execution. default: no limit")
+		flags.Uint64Var(&builder.scriptExecMaxBlock,
+			"script-execution-max-height",
+			defaultConfig.scriptExecMaxBlock,
+			"highest block height to allow for script execution. default: no limit")
+
+	}).ValidateFlags(func() error {
+		if builder.executionDataSyncEnabled {
+			if builder.executionDataConfig.FetchTimeout <= 0 {
+				return errors.New("execution-data-fetch-timeout must be greater than 0")
+			}
+			if builder.executionDataConfig.MaxFetchTimeout < builder.executionDataConfig.FetchTimeout {
+				return errors.New("execution-data-max-fetch-timeout must be greater than execution-data-fetch-timeout")
+			}
+			if builder.executionDataConfig.RetryDelay <= 0 {
+				return errors.New("execution-data-retry-delay must be greater than 0")
+			}
+			if builder.executionDataConfig.MaxRetryDelay < builder.executionDataConfig.RetryDelay {
+				return errors.New("execution-data-max-retry-delay must be greater than or equal to execution-data-retry-delay")
+			}
+			if builder.executionDataConfig.MaxSearchAhead == 0 {
+				return errors.New("execution-data-max-search-ahead must be greater than 0")
+			}
+		}
+		if builder.stateStreamConf.ListenAddr != "" {
+			if builder.stateStreamConf.ExecutionDataCacheSize == 0 {
+				return errors.New("execution-data-cache-size must be greater than 0")
+			}
+			if builder.stateStreamConf.ClientSendBufferSize == 0 {
+				return errors.New("state-stream-send-buffer-size must be greater than 0")
+			}
+			if len(builder.stateStreamFilterConf) > 4 {
+				return errors.New("state-stream-event-filter-limits must have at most 4 keys (EventTypes, Addresses, Contracts, AccountAddresses)")
+			}
+			for key, value := range builder.stateStreamFilterConf {
+				switch key {
+				case "EventTypes", "Addresses", "Contracts", "AccountAddresses":
+					if value <= 0 {
+						return fmt.Errorf("state-stream-event-filter-limits %s must be greater than 0", key)
+					}
+				default:
+					return errors.New("state-stream-event-filter-limits may only contain the keys EventTypes, Addresses, Contracts, AccountAddresses")
+				}
+			}
+			if builder.stateStreamConf.ResponseLimit < 0 {
+				return errors.New("state-stream-response-limit must be greater than or equal to 0")
+			}
+			if builder.stateStreamConf.RegisterIDsRequestLimit <= 0 {
+				return errors.New("state-stream-max-register-values must be greater than 0")
+			}
+		}
+
+		return nil
 	})
 }
 
@@ -551,37 +801,6 @@ func publicNetworkMsgValidators(log zerolog.Logger, idProvider module.IdentityPr
 	}
 }
 
-// BootstrapIdentities converts the bootstrap node addresses and keys to a Flow Identity list where
-// each Flow Identity is initialized with the passed address, the networking key
-// and the Node ID set to ZeroID, role set to Access, 0 stake and no staking key.
-func BootstrapIdentities(addresses []string, keys []string) (flow.IdentityList, error) {
-	if len(addresses) != len(keys) {
-		return nil, fmt.Errorf("number of addresses and keys provided for the boostrap nodes don't match")
-	}
-
-	ids := make([]*flow.Identity, len(addresses))
-	for i, address := range addresses {
-		bytes, err := hex.DecodeString(keys[i])
-		if err != nil {
-			return nil, fmt.Errorf("failed to decode secured GRPC server public key hex %w", err)
-		}
-
-		publicFlowNetworkingKey, err := crypto.DecodePublicKey(crypto.ECDSAP256, bytes)
-		if err != nil {
-			return nil, fmt.Errorf("failed to get public flow networking key could not decode public key bytes %w", err)
-		}
-
-		// create the identity of the peer by setting only the relevant fields
-		ids[i] = &flow.Identity{
-			NodeID:        flow.ZeroID, // the NodeID is the hash of the staking key and for the public network it does not apply
-			Address:       address,
-			Role:          flow.RoleAccess, // the upstream node has to be an access node
-			NetworkPubKey: publicFlowNetworkingKey,
-		}
-	}
-	return ids, nil
-}
-
 func (builder *ObserverServiceBuilder) initNodeInfo() error {
 	// use the networking key that was loaded from the configured file
 	networkingKey, err := loadNetworkingKey(builder.observerNetworkingKeyPath)
@@ -678,8 +897,6 @@ func (builder *ObserverServiceBuilder) Initialize() error {
 
 	builder.enqueueConnectWithStakedAN()
 
-	builder.enqueueRPCServer()
-
 	if builder.BaseConfig.MetricsEnabled {
 		builder.EnqueueMetricsServerInit()
 		if err := builder.RegisterBadgerMetrics(); err != nil {
@@ -763,8 +980,8 @@ func (builder *ObserverServiceBuilder) initPublicLibp2pNode(networkKey crypto.Pr
 			Unicast: builder.FlowConfig.NetworkConfig.Unicast,
 		}).
 		SetSubscriptionFilter(
-			subscription.NewRoleBasedFilter(
-				subscription.UnstakedRole, builder.IdentityProvider,
+			networkingsubscription.NewRoleBasedFilter(
+				networkingsubscription.UnstakedRole, builder.IdentityProvider,
 			),
 		).
 		SetRoutingSystem(func(ctx context.Context, h host.Host) (routing.Routing, error) {
@@ -776,7 +993,6 @@ func (builder *ObserverServiceBuilder) initPublicLibp2pNode(networkKey crypto.Pr
 			)
 		}).
 		Build()
-
 	if err != nil {
 		return nil, fmt.Errorf("could not initialize libp2p node for observer: %w", err)
 	}
@@ -792,7 +1008,7 @@ func (builder *ObserverServiceBuilder) initPublicLibp2pNode(networkKey crypto.Pr
 func (builder *ObserverServiceBuilder) initObserverLocal() func(node *cmd.NodeConfig) error {
 	return func(node *cmd.NodeConfig) error {
 		// for an observer, set the identity here explicitly since it will not be found in the protocol state
-		self := &flow.Identity{
+		self := flow.IdentitySkeleton{
 			NodeID:        node.NodeID,
 			NetworkPubKey: node.NetworkKey.PublicKey(),
 			StakingPubKey: nil,             // no staking key needed for the observer
@@ -813,9 +1029,431 @@ func (builder *ObserverServiceBuilder) initObserverLocal() func(node *cmd.NodeCo
 // Currently, the observer only runs the follower engine.
 func (builder *ObserverServiceBuilder) Build() (cmd.Node, error) {
 	builder.BuildConsensusFollower()
+
+	if builder.executionDataSyncEnabled {
+		builder.BuildExecutionSyncComponents()
+	}
+
+	builder.enqueueRPCServer()
 	return builder.FlowNodeBuilder.Build()
 }
 
+func (builder *ObserverServiceBuilder) BuildExecutionSyncComponents() *ObserverServiceBuilder {
+	var ds *badger.Datastore
+	var bs network.BlobService
+	var processedBlockHeight storage.ConsumerProgress
+	var processedNotifications storage.ConsumerProgress
+	var publicBsDependable *module.ProxiedReadyDoneAware
+	var execDataDistributor *edrequester.ExecutionDataDistributor
+	var execDataCacheBackend *herocache.BlockExecutionData
+	var executionDataStoreCache *execdatacache.ExecutionDataCache
+
+	// setup dependency chain to ensure indexer starts after the requester
+	requesterDependable := module.NewProxiedReadyDoneAware()
+	builder.IndexerDependencies.Add(requesterDependable)
+
+	builder.
+		AdminCommand("read-execution-data", func(config *cmd.NodeConfig) commands.AdminCommand {
+			return stateSyncCommands.NewReadExecutionDataCommand(builder.ExecutionDataStore)
+		}).
+		Module("execution data datastore and blobstore", func(node *cmd.NodeConfig) error {
+			datastoreDir := filepath.Join(builder.executionDataDir, "blobstore")
+			err := os.MkdirAll(datastoreDir, 0700)
+			if err != nil {
+				return err
+			}
+
+			ds, err = badger.NewDatastore(datastoreDir, &badger.DefaultOptions)
+			if err != nil {
+				return err
+			}
+
+			builder.ShutdownFunc(func() error {
+				if err := ds.Close(); err != nil {
+					return fmt.Errorf("could not close execution data datastore: %w", err)
+				}
+				return nil
+			})
+
+			return nil
+		}).
+		Module("processed block height consumer progress", func(node *cmd.NodeConfig) error {
+			// Note: progress is stored in the datastore's DB since that is where the jobqueue
+			// writes execution data to.
+			processedBlockHeight = bstorage.NewConsumerProgress(ds.DB, module.ConsumeProgressExecutionDataRequesterBlockHeight)
+			return nil
+		}).
+		Module("processed notifications consumer progress", func(node *cmd.NodeConfig) error {
+			// Note: progress is stored in the datastore's DB since that is where the jobqueue
+			// writes execution data to.
+			processedNotifications = bstorage.NewConsumerProgress(ds.DB, module.ConsumeProgressExecutionDataRequesterNotification)
+			return nil
+		}).
+		Module("blobservice peer manager dependencies", func(node *cmd.NodeConfig) error {
+			publicBsDependable = module.NewProxiedReadyDoneAware()
+			builder.PeerManagerDependencies.Add(publicBsDependable)
+			return nil
+		}).
+		Module("execution datastore", func(node *cmd.NodeConfig) error {
+			blobstore := blobs.NewBlobstore(ds)
+			builder.ExecutionDataStore = execution_data.NewExecutionDataStore(blobstore, execution_data.DefaultSerializer)
+			return nil
+		}).
+		Module("execution data cache", func(node *cmd.NodeConfig) error {
+			var heroCacheCollector module.HeroCacheMetrics = metrics.NewNoopCollector()
+			if builder.HeroCacheMetricsEnable {
+				heroCacheCollector = metrics.AccessNodeExecutionDataCacheMetrics(builder.MetricsRegisterer)
+			}
+
+			execDataCacheBackend = herocache.NewBlockExecutionData(builder.stateStreamConf.ExecutionDataCacheSize, builder.Logger, heroCacheCollector)
+
+			// Execution Data cache that uses a blobstore as the backend (instead of a downloader)
+			// This ensures that it simply returns a not found error if the blob doesn't exist
+			// instead of attempting to download it from the network.
+			executionDataStoreCache = execdatacache.NewExecutionDataCache(
+				builder.ExecutionDataStore,
+				builder.Storage.Headers,
+				builder.Storage.Seals,
+				builder.Storage.Results,
+				execDataCacheBackend,
+			)
+
+			return nil
+		}).
+		Component("public execution data service", func(node *cmd.NodeConfig) (module.ReadyDoneAware, error) {
+			opts := []network.BlobServiceOption{
+				blob.WithBitswapOptions(
+					bitswap.WithTracer(
+						blob.NewTracer(node.Logger.With().Str("public_blob_service", channels.PublicExecutionDataService.String()).Logger()),
+					),
+				),
+			}
+
+			var err error
+			bs, err = node.EngineRegistry.RegisterBlobService(channels.PublicExecutionDataService, ds, opts...)
+			if err != nil {
+				return nil, fmt.Errorf("could not register blob service: %w", err)
+			}
+
+			// add blobservice into ReadyDoneAware dependency passed to peer manager
+			// this starts the blob service and configures peer manager to wait for the blobservice
+			// to be ready before starting
+			publicBsDependable.Init(bs)
+
+			builder.ExecutionDataDownloader = execution_data.NewDownloader(bs)
+
+			return builder.ExecutionDataDownloader, nil
+		}).
+		Component("execution data requester", func(node *cmd.NodeConfig) (module.ReadyDoneAware, error) {
+			// Validation of the start block height needs to be done after loading state
+			if builder.executionDataStartHeight > 0 {
+				if builder.executionDataStartHeight <= builder.FinalizedRootBlock.Header.Height {
+					return nil, fmt.Errorf(
+						"execution data start block height (%d) must be greater than the root block height (%d)",
+						builder.executionDataStartHeight, builder.FinalizedRootBlock.Header.Height)
+				}
+
+				latestSeal, err := builder.State.Sealed().Head()
+				if err != nil {
+					return nil, fmt.Errorf("failed to get latest sealed height")
+				}
+
+				// Note: since the root block of a spork is also sealed in the root protocol state, the
+				// latest sealed height is always equal to the root block height. That means that at the
+				// very beginning of a spork, this check will always fail. Operators should not specify
+				// an InitialBlockHeight when starting from the beginning of a spork.
+				if builder.executionDataStartHeight > latestSeal.Height {
+					return nil, fmt.Errorf(
+						"execution data start block height (%d) must be less than or equal to the latest sealed block height (%d)",
+						builder.executionDataStartHeight, latestSeal.Height)
+				}
+
+				// executionDataStartHeight is provided as the first block to sync, but the
+				// requester expects the initial last processed height, which is the first height - 1
+				builder.executionDataConfig.InitialBlockHeight = builder.executionDataStartHeight - 1
+			} else {
+				builder.executionDataConfig.InitialBlockHeight = builder.FinalizedRootBlock.Header.Height
+			}
+
+			execDataDistributor = edrequester.NewExecutionDataDistributor()
+
+			// Execution Data cache with a downloader as the backend. This is used by the requester
+			// to download and cache execution data for each block. It shares a cache backend instance
+			// with the datastore implementation.
+			executionDataCache := execdatacache.NewExecutionDataCache(
+				builder.ExecutionDataDownloader,
+				builder.Storage.Headers,
+				builder.Storage.Seals,
+				builder.Storage.Results,
+				execDataCacheBackend,
+			)
+
+			r, err := edrequester.New(
+				builder.Logger,
+				metrics.NewExecutionDataRequesterCollector(),
+				builder.ExecutionDataDownloader,
+				executionDataCache,
+				processedBlockHeight,
+				processedNotifications,
+				builder.State,
+				builder.Storage.Headers,
+				builder.executionDataConfig,
+				execDataDistributor,
+			)
+			if err != nil {
+				return nil, fmt.Errorf("failed to create execution data requester: %w", err)
+			}
+			builder.ExecutionDataRequester = r
+
+			builder.FollowerDistributor.AddOnBlockFinalizedConsumer(builder.ExecutionDataRequester.OnBlockFinalized)
+
+			// add requester into ReadyDoneAware dependency passed to indexer. This allows the indexer
+			// to wait for the requester to be ready before starting.
+			requesterDependable.Init(builder.ExecutionDataRequester)
+
+			return builder.ExecutionDataRequester, nil
+		})
+
+	if builder.executionDataIndexingEnabled {
+		var indexedBlockHeight storage.ConsumerProgress
+
+		builder.Module("indexed block height consumer progress", func(node *cmd.NodeConfig) error {
+			// Note: progress is stored in the MAIN db since that is where indexed execution data is stored.
+			indexedBlockHeight = bstorage.NewConsumerProgress(builder.DB, module.ConsumeProgressExecutionDataIndexerBlockHeight)
+			return nil
+		}).Module("transaction results storage", func(node *cmd.NodeConfig) error {
+			builder.Storage.LightTransactionResults = bstorage.NewLightTransactionResults(node.Metrics.Cache, node.DB, bstorage.DefaultCacheSize)
+			return nil
+		}).DependableComponent("execution data indexer", func(node *cmd.NodeConfig) (module.ReadyDoneAware, error) {
+			// Note: using a DependableComponent here to ensure that the indexer does not block
+			// other components from starting while bootstrapping the register db since it may
+			// take hours to complete.
+
+			pdb, err := pStorage.OpenRegisterPebbleDB(builder.registersDBPath)
+			if err != nil {
+				return nil, fmt.Errorf("could not open registers db: %w", err)
+			}
+			builder.ShutdownFunc(func() error {
+				return pdb.Close()
+			})
+
+			bootstrapped, err := pStorage.IsBootstrapped(pdb)
+			if err != nil {
+				return nil, fmt.Errorf("could not check if registers db is bootstrapped: %w", err)
+			}
+
+			if !bootstrapped {
+				checkpointFile := builder.checkpointFile
+				if checkpointFile == cmd.NotSet {
+					checkpointFile = path.Join(builder.BootstrapDir, bootstrap.PathRootCheckpoint)
+				}
+
+				// currently, the checkpoint must be from the root block.
+				// read the root hash from the provided checkpoint and verify it matches the
+				// state commitment from the root snapshot.
+				err := wal.CheckpointHasRootHash(
+					node.Logger,
+					"", // checkpoint file already full path
+					checkpointFile,
+					ledger.RootHash(node.RootSeal.FinalState),
+				)
+				if err != nil {
+					return nil, fmt.Errorf("could not verify checkpoint file: %w", err)
+				}
+
+				checkpointHeight := builder.SealedRootBlock.Header.Height
+
+				if builder.SealedRootBlock.ID() != builder.RootSeal.BlockID {
+					return nil, fmt.Errorf("mismatching sealed root block and root seal: %v != %v",
+						builder.SealedRootBlock.ID(), builder.RootSeal.BlockID)
+				}
+
+				rootHash := ledger.RootHash(builder.RootSeal.FinalState)
+				bootstrap, err := pStorage.NewRegisterBootstrap(pdb, checkpointFile, checkpointHeight, rootHash, builder.Logger)
+				if err != nil {
+					return nil, fmt.Errorf("could not create registers bootstrap: %w", err)
+				}
+
+				// TODO: find a way to hook a context up to this to allow a graceful shutdown
+				workerCount := 10
+				err = bootstrap.IndexCheckpointFile(context.Background(), workerCount)
+				if err != nil {
+					return nil, fmt.Errorf("could not load checkpoint file: %w", err)
+				}
+			}
+
+			registers, err := pStorage.NewRegisters(pdb)
+			if err != nil {
+				return nil, fmt.Errorf("could not create registers storage: %w", err)
+			}
+
+			builder.Storage.RegisterIndex = registers
+
+			var collectionExecutedMetric module.CollectionExecutedMetric = metrics.NewNoopCollector()
+			indexerCore, err := indexer.New(
+				builder.Logger,
+				metrics.NewExecutionStateIndexerCollector(),
+				builder.DB,
+				builder.Storage.RegisterIndex,
+				builder.Storage.Headers,
+				builder.Storage.Events,
+				builder.Storage.Collections,
+				builder.Storage.Transactions,
+				builder.Storage.LightTransactionResults,
+				collectionExecutedMetric,
+			)
+			if err != nil {
+				return nil, err
+			}
+			builder.ExecutionIndexerCore = indexerCore
+
+			// execution state worker uses a jobqueue to process new execution data and indexes it by using the indexer.
+			builder.ExecutionIndexer, err = indexer.NewIndexer(
+				builder.Logger,
+				registers.FirstHeight(),
+				registers,
+				indexerCore,
+				executionDataStoreCache,
+				builder.ExecutionDataRequester.HighestConsecutiveHeight,
+				indexedBlockHeight,
+			)
+			if err != nil {
+				return nil, err
+			}
+
+			// setup requester to notify indexer when new execution data is received
+			execDataDistributor.AddOnExecutionDataReceivedConsumer(builder.ExecutionIndexer.OnExecutionData)
+
+			err = builder.EventsIndex.Initialize(builder.ExecutionIndexer)
+			if err != nil {
+				return nil, err
+			}
+
+			// create script execution module, this depends on the indexer being initialized and the
+			// having the register storage bootstrapped
+			scripts, err := execution.NewScripts(
+				builder.Logger,
+				metrics.NewExecutionCollector(builder.Tracer),
+				builder.RootChainID,
+				query.NewProtocolStateWrapper(builder.State),
+				builder.Storage.Headers,
+				builder.ExecutionIndexerCore.RegisterValue,
+				builder.scriptExecutorConfig,
+			)
+			if err != nil {
+				return nil, err
+			}
+
+			err = builder.ScriptExecutor.Initialize(builder.ExecutionIndexer, scripts)
+			if err != nil {
+				return nil, err
+			}
+
+			err = builder.TxResultsIndex.Initialize(builder.ExecutionIndexer)
+			if err != nil {
+				return nil, err
+			}
+
+			err = builder.RegistersAsyncStore.Initialize(registers)
+			if err != nil {
+				return nil, err
+			}
+
+			return builder.ExecutionIndexer, nil
+		}, builder.IndexerDependencies)
+	}
+
+	if builder.stateStreamConf.ListenAddr != "" {
+		builder.Component("exec state stream engine", func(node *cmd.NodeConfig) (module.ReadyDoneAware, error) {
+			for key, value := range builder.stateStreamFilterConf {
+				switch key {
+				case "EventTypes":
+					builder.stateStreamConf.MaxEventTypes = value
+				case "Addresses":
+					builder.stateStreamConf.MaxAddresses = value
+				case "Contracts":
+					builder.stateStreamConf.MaxContracts = value
+				case "AccountAddresses":
+					builder.stateStreamConf.MaxAccountAddress = value
+				}
+			}
+			builder.stateStreamConf.RpcMetricsEnabled = builder.rpcMetricsEnabled
+
+			highestAvailableHeight, err := builder.ExecutionDataRequester.HighestConsecutiveHeight()
+			if err != nil {
+				return nil, fmt.Errorf("could not get highest consecutive height: %w", err)
+			}
+			broadcaster := engine.NewBroadcaster()
+
+			eventQueryMode, err := backend.ParseIndexQueryMode(builder.rpcConf.BackendConfig.EventQueryMode)
+			if err != nil {
+				return nil, fmt.Errorf("could not parse event query mode: %w", err)
+			}
+
+			// use the events index for events if enabled and the node is configured to use it for
+			// regular event queries
+			useIndex := builder.executionDataIndexingEnabled &&
+				eventQueryMode != backend.IndexQueryModeExecutionNodesOnly
+
+			executionDataTracker := subscription.NewExecutionDataTracker(
+				builder.Logger,
+				node.State,
+				builder.executionDataConfig.InitialBlockHeight,
+				node.Storage.Headers,
+				broadcaster,
+				highestAvailableHeight,
+				builder.EventsIndex,
+				useIndex,
+			)
+
+			builder.stateStreamBackend, err = statestreambackend.New(
+				node.Logger,
+				node.State,
+				node.Storage.Headers,
+				node.Storage.Seals,
+				node.Storage.Results,
+				builder.ExecutionDataStore,
+				executionDataStoreCache,
+				builder.RegistersAsyncStore,
+				builder.EventsIndex,
+				useIndex,
+				int(builder.stateStreamConf.RegisterIDsRequestLimit),
+				subscription.NewSubscriptionHandler(
+					builder.Logger,
+					broadcaster,
+					builder.stateStreamConf.ClientSendTimeout,
+					builder.stateStreamConf.ResponseLimit,
+					builder.stateStreamConf.ClientSendBufferSize,
+				),
+				executionDataTracker,
+			)
+			if err != nil {
+				return nil, fmt.Errorf("could not create state stream backend: %w", err)
+			}
+
+			stateStreamEng, err := statestreambackend.NewEng(
+				node.Logger,
+				builder.stateStreamConf,
+				executionDataStoreCache,
+				node.Storage.Headers,
+				node.RootChainID,
+				builder.stateStreamGrpcServer,
+				builder.stateStreamBackend,
+			)
+			if err != nil {
+				return nil, fmt.Errorf("could not create state stream engine: %w", err)
+			}
+			builder.StateStreamEng = stateStreamEng
+
+			// setup requester to notify ExecutionDataTracker when new execution data is received
+			execDataDistributor.AddOnExecutionDataReceivedConsumer(builder.stateStreamBackend.OnExecutionData)
+
+			return builder.StateStreamEng, nil
+		})
+	}
+	return builder
+}
+
 // enqueuePublicNetworkInit enqueues the observer network component initialized for the observer
 func (builder *ObserverServiceBuilder) enqueuePublicNetworkInit() {
 	var publicLibp2pNode p2p.LibP2PNode
@@ -896,22 +1534,21 @@ func (builder *ObserverServiceBuilder) enqueueConnectWithStakedAN() {
 }
 
 func (builder *ObserverServiceBuilder) enqueueRPCServer() {
-	builder.Module("creating grpc servers", func(node *cmd.NodeConfig) error {
-		builder.secureGrpcServer = grpcserver.NewGrpcServerBuilder(node.Logger,
-			builder.rpcConf.SecureGRPCListenAddr,
-			builder.rpcConf.MaxMsgSize,
-			builder.rpcMetricsEnabled,
-			builder.apiRatelimits,
-			builder.apiBurstlimits,
-			grpcserver.WithTransportCredentials(builder.rpcConf.TransportCredentials)).Build()
 
-		builder.unsecureGrpcServer = grpcserver.NewGrpcServerBuilder(node.Logger,
-			builder.rpcConf.UnsecureGRPCListenAddr,
-			builder.rpcConf.MaxMsgSize,
-			builder.rpcMetricsEnabled,
-			builder.apiRatelimits,
-			builder.apiBurstlimits).Build()
+	builder.Module("transaction metrics", func(node *cmd.NodeConfig) error {
+		var err error
+		builder.TransactionTimings, err = stdmap.NewTransactionTimings(1500 * 300) // assume 1500 TPS * 300 seconds
+		if err != nil {
+			return err
+		}
 
+		builder.TransactionMetrics = metrics.NewTransactionCollector(
+			node.Logger,
+			builder.TransactionTimings,
+			builder.logTxTimeToFinalized,
+			builder.logTxTimeToExecuted,
+			builder.logTxTimeToFinalizedExecuted,
+		)
 		return nil
 	})
 	builder.Module("rest metrics", func(node *cmd.NodeConfig) error {
@@ -924,6 +1561,8 @@ func (builder *ObserverServiceBuilder) enqueueRPCServer() {
 	})
 	builder.Module("access metrics", func(node *cmd.NodeConfig) error {
 		builder.AccessMetrics = metrics.NewAccessCollector(
+			metrics.WithTransactionMetrics(builder.TransactionMetrics),
+			metrics.WithBackendScriptsMetrics(builder.TransactionMetrics),
 			metrics.WithRestMetrics(builder.RestMetrics),
 		)
 		return nil
@@ -938,6 +1577,57 @@ func (builder *ObserverServiceBuilder) enqueueRPCServer() {
 		builder.rpcConf.TransportCredentials = credentials.NewTLS(tlsConfig)
 		return nil
 	})
+	builder.Module("creating grpc servers", func(node *cmd.NodeConfig) error {
+		builder.secureGrpcServer = grpcserver.NewGrpcServerBuilder(node.Logger,
+			builder.rpcConf.SecureGRPCListenAddr,
+			builder.rpcConf.MaxMsgSize,
+			builder.rpcMetricsEnabled,
+			builder.apiRatelimits,
+			builder.apiBurstlimits,
+			grpcserver.WithTransportCredentials(builder.rpcConf.TransportCredentials)).Build()
+
+		builder.stateStreamGrpcServer = grpcserver.NewGrpcServerBuilder(
+			node.Logger,
+			builder.stateStreamConf.ListenAddr,
+			builder.stateStreamConf.MaxExecutionDataMsgSize,
+			builder.rpcMetricsEnabled,
+			builder.apiRatelimits,
+			builder.apiBurstlimits,
+			grpcserver.WithStreamInterceptor()).Build()
+
+		if builder.rpcConf.UnsecureGRPCListenAddr != builder.stateStreamConf.ListenAddr {
+			builder.unsecureGrpcServer = grpcserver.NewGrpcServerBuilder(node.Logger,
+				builder.rpcConf.UnsecureGRPCListenAddr,
+				builder.rpcConf.MaxMsgSize,
+				builder.rpcMetricsEnabled,
+				builder.apiRatelimits,
+				builder.apiBurstlimits).Build()
+		} else {
+			builder.unsecureGrpcServer = builder.stateStreamGrpcServer
+		}
+
+		return nil
+	})
+	builder.Module("async register store", func(node *cmd.NodeConfig) error {
+		builder.RegistersAsyncStore = execution.NewRegistersAsyncStore()
+		return nil
+	})
+	builder.Module("events storage", func(node *cmd.NodeConfig) error {
+		builder.Storage.Events = bstorage.NewEvents(node.Metrics.Cache, node.DB)
+		return nil
+	})
+	builder.Module("events index", func(node *cmd.NodeConfig) error {
+		builder.EventsIndex = index.NewEventsIndex(builder.Storage.Events)
+		return nil
+	})
+	builder.Module("transaction result index", func(node *cmd.NodeConfig) error {
+		builder.TxResultsIndex = index.NewTransactionResultsIndex(builder.Storage.LightTransactionResults)
+		return nil
+	})
+	builder.Module("script executor", func(node *cmd.NodeConfig) error {
+		builder.ScriptExecutor = backend.NewScriptExecutor(builder.Logger, builder.scriptExecMinBlock, builder.scriptExecMaxBlock)
+		return nil
+	})
 	builder.Component("RPC engine", func(node *cmd.NodeConfig) (module.ReadyDoneAware, error) {
 		accessMetrics := builder.AccessMetrics
 		config := builder.rpcConf
@@ -945,12 +1635,12 @@ func (builder *ObserverServiceBuilder) enqueueRPCServer() {
 		cacheSize := int(backendConfig.ConnectionPoolSize)
 
 		var connBackendCache *rpcConnection.Cache
+		var err error
 		if cacheSize > 0 {
-			backendCache, err := backend.NewCache(node.Logger, accessMetrics, cacheSize)
+			connBackendCache, err = rpcConnection.NewCache(node.Logger, accessMetrics, cacheSize)
 			if err != nil {
-				return nil, fmt.Errorf("could not initialize backend cache: %w", err)
+				return nil, fmt.Errorf("could not initialize connection cache: %w", err)
 			}
-			connBackendCache = rpcConnection.NewCache(backendCache, cacheSize)
 		}
 
 		connFactory := &rpcConnection.ConnectionFactoryImpl{
@@ -961,16 +1651,29 @@ func (builder *ObserverServiceBuilder) enqueueRPCServer() {
 			AccessMetrics:             accessMetrics,
 			Log:                       node.Logger,
 			Manager: rpcConnection.NewManager(
-				connBackendCache,
 				node.Logger,
 				accessMetrics,
+				connBackendCache,
 				config.MaxMsgSize,
 				backendConfig.CircuitBreakerConfig,
 				config.CompressorName,
 			),
 		}
 
-		accessBackend, err := backend.New(backend.Params{
+		broadcaster := engine.NewBroadcaster()
+		// create BlockTracker that will track for new blocks (finalized and sealed) and
+		// handles block-related operations.
+		blockTracker, err := subscription.NewBlockTracker(
+			node.State,
+			builder.FinalizedRootBlock.Header.Height,
+			node.Storage.Headers,
+			broadcaster,
+		)
+		if err != nil {
+			return nil, fmt.Errorf("failed to initialize block tracker: %w", err)
+		}
+
+		backendParams := backend.Params{
 			State:                     node.State,
 			Blocks:                    node.Storage.Blocks,
 			Headers:                   node.Storage.Headers,
@@ -988,7 +1691,25 @@ func (builder *ObserverServiceBuilder) enqueueRPCServer() {
 			Log:                       node.Logger,
 			SnapshotHistoryLimit:      backend.DefaultSnapshotHistoryLimit,
 			Communicator:              backend.NewNodeCommunicator(backendConfig.CircuitBreakerConfig.Enabled),
-		})
+			BlockTracker:              blockTracker,
+			SubscriptionHandler: subscription.NewSubscriptionHandler(
+				builder.Logger,
+				broadcaster,
+				builder.stateStreamConf.ClientSendTimeout,
+				builder.stateStreamConf.ResponseLimit,
+				builder.stateStreamConf.ClientSendBufferSize,
+			),
+		}
+
+		if builder.localServiceAPIEnabled {
+			backendParams.ScriptExecutionMode = backend.IndexQueryModeLocalOnly
+			backendParams.EventQueryMode = backend.IndexQueryModeLocalOnly
+			backendParams.TxResultsIndex = builder.TxResultsIndex
+			backendParams.EventsIndex = builder.EventsIndex
+			backendParams.ScriptExecutor = builder.ScriptExecutor
+		}
+
+		accessBackend, err := backend.New(backendParams)
 		if err != nil {
 			return nil, fmt.Errorf("could not initialize backend: %w", err)
 		}
@@ -1005,7 +1726,6 @@ func (builder *ObserverServiceBuilder) enqueueRPCServer() {
 			return nil, err
 		}
 
-		stateStreamConfig := statestreambackend.Config{}
 		engineBuilder, err := rpc.NewBuilder(
 			node.Logger,
 			node.State,
@@ -1018,8 +1738,8 @@ func (builder *ObserverServiceBuilder) enqueueRPCServer() {
 			restHandler,
 			builder.secureGrpcServer,
 			builder.unsecureGrpcServer,
-			nil, // state streaming is not supported
-			stateStreamConfig,
+			builder.stateStreamBackend,
+			builder.stateStreamConf,
 		)
 		if err != nil {
 			return nil, err
@@ -1031,22 +1751,13 @@ func (builder *ObserverServiceBuilder) enqueueRPCServer() {
 			return nil, err
 		}
 
-		rpcHandler := &apiproxy.FlowAccessAPIRouter{
-			Logger:   builder.Logger,
+		rpcHandler := apiproxy.NewFlowAccessAPIRouter(apiproxy.Params{
+			Log:      builder.Logger,
 			Metrics:  observerCollector,
 			Upstream: forwarder,
-			Observer: protocol.NewHandler(protocol.New(
-				node.State,
-				node.Storage.Blocks,
-				node.Storage.Headers,
-				backend.NewNetworkAPI(
-					node.State,
-					node.RootChainID,
-					node.Storage.Headers,
-					backend.DefaultSnapshotHistoryLimit,
-				),
-			)),
-		}
+			Local:    engineBuilder.DefaultHandler(hotsignature.NewBlockSignerDecoder(builder.Committee)),
+			UseIndex: builder.localServiceAPIEnabled,
+		})
 
 		// build the rpc engine
 		builder.RpcEng, err = engineBuilder.
@@ -1065,10 +1776,15 @@ func (builder *ObserverServiceBuilder) enqueueRPCServer() {
 		return builder.secureGrpcServer, nil
 	})
 
-	// build unsecure grpc server
-	builder.Component("unsecure grpc server", func(node *cmd.NodeConfig) (module.ReadyDoneAware, error) {
-		return builder.unsecureGrpcServer, nil
+	builder.Component("state stream unsecure grpc server", func(node *cmd.NodeConfig) (module.ReadyDoneAware, error) {
+		return builder.stateStreamGrpcServer, nil
 	})
+
+	if builder.rpcConf.UnsecureGRPCListenAddr != builder.stateStreamConf.ListenAddr {
+		builder.Component("unsecure grpc server", func(node *cmd.NodeConfig) (module.ReadyDoneAware, error) {
+			return builder.unsecureGrpcServer, nil
+		})
+	}
 }
 
 func loadNetworkingKey(path string) (crypto.PrivateKey, error) {
diff --git a/cmd/scaffold.go b/cmd/scaffold.go
index 64ffcf20c94..d645dc9cf85 100644
--- a/cmd/scaffold.go
+++ b/cmd/scaffold.go
@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"errors"
@@ -13,12 +14,18 @@ import (
 	gcemd "cloud.google.com/go/compute/metadata"
 	"github.com/dgraph-io/badger/v2"
 	"github.com/hashicorp/go-multierror"
+	dht "github.com/libp2p/go-libp2p-kad-dht"
+	"github.com/libp2p/go-libp2p/core/host"
+	"github.com/libp2p/go-libp2p/core/peer"
+	"github.com/libp2p/go-libp2p/core/routing"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/rs/zerolog"
 	"github.com/spf13/pflag"
 	"golang.org/x/time/rate"
 	"google.golang.org/api/option"
 
+	"github.com/onflow/crypto"
+
 	"github.com/onflow/flow-go/admin"
 	"github.com/onflow/flow-go/admin/commands"
 	"github.com/onflow/flow-go/admin/commands/common"
@@ -46,16 +53,23 @@ import (
 	"github.com/onflow/flow-go/network"
 	alspmgr "github.com/onflow/flow-go/network/alsp/manager"
 	netcache "github.com/onflow/flow-go/network/cache"
+	"github.com/onflow/flow-go/network/channels"
+	"github.com/onflow/flow-go/network/converter"
 	"github.com/onflow/flow-go/network/p2p"
 	p2pbuilder "github.com/onflow/flow-go/network/p2p/builder"
 	p2pbuilderconfig "github.com/onflow/flow-go/network/p2p/builder/config"
 	"github.com/onflow/flow-go/network/p2p/cache"
 	"github.com/onflow/flow-go/network/p2p/conduit"
 	"github.com/onflow/flow-go/network/p2p/connection"
+	p2pdht "github.com/onflow/flow-go/network/p2p/dht"
 	"github.com/onflow/flow-go/network/p2p/dns"
+	"github.com/onflow/flow-go/network/p2p/keyutils"
 	"github.com/onflow/flow-go/network/p2p/ping"
+	"github.com/onflow/flow-go/network/p2p/subscription"
+	"github.com/onflow/flow-go/network/p2p/translator"
 	"github.com/onflow/flow-go/network/p2p/unicast/protocols"
 	"github.com/onflow/flow-go/network/p2p/unicast/ratelimit"
+	"github.com/onflow/flow-go/network/p2p/utils"
 	"github.com/onflow/flow-go/network/p2p/utils/ratelimiter"
 	"github.com/onflow/flow-go/network/slashing"
 	"github.com/onflow/flow-go/network/topology"
@@ -124,6 +138,8 @@ type FlowNodeBuilder struct {
 	adminCommandBootstrapper *admin.CommandRunnerBootstrapper
 	adminCommands            map[string]func(config *NodeConfig) commands.AdminCommand
 	componentBuilder         component.ComponentManagerBuilder
+	bootstrapNodeAddresses   []string
+	bootstrapNodePublicKeys  []string
 }
 
 var _ NodeBuilder = (*FlowNodeBuilder)(nil)
@@ -226,6 +242,17 @@ func (fnb *FlowNodeBuilder) BaseFlags() {
 		"compliance-skip-proposals-threshold",
 		defaultConfig.ComplianceConfig.SkipNewProposalsThreshold,
 		"threshold at which new proposals are discarded rather than cached, if their height is this much above local finalized height")
+
+	// observer mode allows a unstaked execution node to fetch blocks from a public staked access node, and being able to execute blocks
+	fnb.flags.BoolVar(&fnb.BaseConfig.ObserverMode, "observer-mode", defaultConfig.ObserverMode, "whether the node is running in observer mode")
+	fnb.flags.StringSliceVar(&fnb.bootstrapNodePublicKeys,
+		"observer-mode-bootstrap-node-public-keys",
+		nil,
+		"the networking public key of the bootstrap access node if this is an observer (in the same order as the bootstrap node addresses) e.g. \"d57a5e9c5.....\",\"44ded42d....\"")
+	fnb.flags.StringSliceVar(&fnb.bootstrapNodeAddresses,
+		"observer-mode-bootstrap-node-addresses",
+		nil,
+		"the network addresses of the bootstrap access node if this is an observer e.g. access-001.mainnet.flow.org:9653,access-002.mainnet.flow.org:9653")
 }
 
 func (fnb *FlowNodeBuilder) EnqueuePingService() {
@@ -376,6 +403,17 @@ func (fnb *FlowNodeBuilder) EnqueueNetworkInit() {
 			myAddr = fnb.BaseConfig.BindAddr
 		}
 
+		if fnb.ObserverMode {
+			// observer mode only init pulbic libp2p node
+			publicLibp2pNode, err := fnb.BuildPublicLibp2pNode(myAddr)
+			if err != nil {
+				return nil, fmt.Errorf("could not build public libp2p node: %w", err)
+			}
+			fnb.LibP2PNode = publicLibp2pNode
+
+			return publicLibp2pNode, nil
+		}
+
 		dhtActivationStatus, err := DhtSystemActivationStatus(fnb.NodeRole)
 		if err != nil {
 			return nil, fmt.Errorf("could not determine dht activation status: %w", err)
@@ -431,9 +469,11 @@ func (fnb *FlowNodeBuilder) EnqueueNetworkInit() {
 	})
 
 	// peer manager won't be created until all PeerManagerDependencies are ready.
-	fnb.DependableComponent("peer manager", func(node *NodeConfig) (module.ReadyDoneAware, error) {
-		return fnb.LibP2PNode.PeerManagerComponent(), nil
-	}, fnb.PeerManagerDependencies)
+	if !fnb.ObserverMode {
+		fnb.DependableComponent("peer manager", func(node *NodeConfig) (module.ReadyDoneAware, error) {
+			return fnb.LibP2PNode.PeerManagerComponent(), nil
+		}, fnb.PeerManagerDependencies)
+	}
 }
 
 // HeroCacheMetricsFactory returns a HeroCacheMetricsFactory based on the MetricsEnabled flag.
@@ -446,6 +486,89 @@ func (fnb *FlowNodeBuilder) HeroCacheMetricsFactory() metrics.HeroCacheMetricsFa
 	return metrics.NewNoopHeroCacheMetricsFactory()
 }
 
+// initPublicLibp2pNode creates a libp2p node for the observer service in the public (unstaked) network.
+// The factory function is later passed into the initMiddleware function to eventually instantiate the p2p.LibP2PNode instance
+// The LibP2P host is created with the following options:
+// * DHT as client and seeded with the given bootstrap peers
+// * The specified bind address as the listen address
+// * The passed in private key as the libp2p key
+// * No connection gater
+// * No connection manager
+// * No peer manager
+// * Default libp2p pubsub options.
+// Args:
+// - networkKey: the private key to use for the libp2p node
+// Returns:
+// - p2p.LibP2PNode: the libp2p node
+// - error: if any error occurs. Any error returned is considered irrecoverable.
+func (fnb *FlowNodeBuilder) BuildPublicLibp2pNode(address string) (p2p.LibP2PNode, error) {
+	var pis []peer.AddrInfo
+
+	ids, err := BootstrapIdentities(fnb.bootstrapNodeAddresses, fnb.bootstrapNodePublicKeys)
+	if err != nil {
+		return nil, fmt.Errorf("could not create bootstrap identities: %w", err)
+	}
+
+	for _, b := range ids {
+		pi, err := utils.PeerAddressInfo(*b)
+		if err != nil {
+			return nil, fmt.Errorf("could not extract peer address info from bootstrap identity %v: %w", b, err)
+		}
+
+		pis = append(pis, pi)
+	}
+
+	for _, b := range ids {
+		pi, err := utils.PeerAddressInfo(*b)
+		if err != nil {
+			return nil, fmt.Errorf("could not extract peer address info from bootstrap identity %v: %w", b, err)
+		}
+
+		pis = append(pis, pi)
+	}
+
+	node, err := p2pbuilder.NewNodeBuilder(
+		fnb.Logger,
+		&fnb.FlowConfig.NetworkConfig.GossipSub,
+		&p2pbuilderconfig.MetricsConfig{
+			HeroCacheFactory: fnb.HeroCacheMetricsFactory(),
+			Metrics:          fnb.Metrics.Network,
+		},
+		network.PublicNetwork,
+		address,
+		fnb.NetworkKey,
+		fnb.SporkID,
+		fnb.IdentityProvider,
+		&fnb.FlowConfig.NetworkConfig.ResourceManager,
+		p2pbuilderconfig.PeerManagerDisableConfig(), // disable peer manager for observer node.
+		&p2p.DisallowListCacheConfig{
+			MaxSize: fnb.FlowConfig.NetworkConfig.DisallowListNotificationCacheSize,
+			Metrics: metrics.DisallowListCacheMetricsFactory(fnb.HeroCacheMetricsFactory(), network.PublicNetwork),
+		},
+		&p2pbuilderconfig.UnicastConfig{
+			Unicast: fnb.FlowConfig.NetworkConfig.Unicast,
+		}).
+		SetSubscriptionFilter(
+			subscription.NewRoleBasedFilter(
+				subscription.UnstakedRole, fnb.IdentityProvider,
+			),
+		).
+		SetRoutingSystem(func(ctx context.Context, h host.Host) (routing.Routing, error) {
+			return p2pdht.NewDHT(ctx, h, protocols.FlowPublicDHTProtocolID(fnb.SporkID),
+				fnb.Logger,
+				fnb.Metrics.Network,
+				p2pdht.AsClient(),
+				dht.BootstrapPeers(pis...),
+			)
+		}).
+		Build()
+
+	if err != nil {
+		return nil, fmt.Errorf("could not initialize libp2p node for observer: %w", err)
+	}
+	return node, nil
+}
+
 func (fnb *FlowNodeBuilder) InitFlowNetworkWithConduitFactory(
 	node *NodeConfig,
 	cf network.ConduitFactory,
@@ -479,6 +602,12 @@ func (fnb *FlowNodeBuilder) InitFlowNetworkWithConduitFactory(
 		return nil, fmt.Errorf("could not register networking receive cache metric: %w", err)
 	}
 
+	networkType := network.PrivateNetwork
+	if fnb.ObserverMode {
+		// observer mode uses public network
+		networkType = network.PublicNetwork
+	}
+
 	// creates network instance
 	net, err := underlay.NewNetwork(&underlay.NetworkConfig{
 		Logger:                fnb.Logger,
@@ -502,7 +631,7 @@ func (fnb *FlowNodeBuilder) InitFlowNetworkWithConduitFactory(
 			HeartBeatInterval:       fnb.FlowConfig.NetworkConfig.AlspConfig.HearBeatInterval,
 			AlspMetrics:             fnb.Metrics.Network,
 			HeroCacheMetricsFactory: fnb.HeroCacheMetricsFactory(),
-			NetworkType:             network.PrivateNetwork,
+			NetworkType:             networkType,
 		},
 		SlashingViolationConsumerFactory: func(adapter network.ConduitAdapter) network.ViolationsConsumer {
 			return slashing.NewSlashingViolationsConsumer(fnb.Logger, fnb.Metrics.Network, adapter)
@@ -512,7 +641,11 @@ func (fnb *FlowNodeBuilder) InitFlowNetworkWithConduitFactory(
 		return nil, fmt.Errorf("could not initialize network: %w", err)
 	}
 
-	fnb.EngineRegistry = net  // setting network as the fnb.Network for the engine-level components
+	if node.ObserverMode {
+		fnb.EngineRegistry = converter.NewNetwork(net, channels.SyncCommittee, channels.PublicSyncCommittee)
+	} else {
+		fnb.EngineRegistry = net // setting network as the fnb.Network for the engine-level components
+	}
 	fnb.NetworkUnderlay = net // setting network as the fnb.Underlay for the lower-level components
 
 	// register network ReadyDoneAware interface so other components can depend on it for startup
@@ -654,13 +787,48 @@ func (fnb *FlowNodeBuilder) initNodeInfo() error {
 		return fmt.Errorf("failed to load private node info: %w", err)
 	}
 
+	fnb.StakingKey = info.StakingPrivKey.PrivateKey
+
+	if fnb.ObserverMode {
+		// observer mode uses a network private key with different format than the staked node,
+		// so it has to load the network private key from a separate file
+		networkingPrivateKey, err := LoadNetworkPrivateKey(fnb.BaseConfig.BootstrapDir, nodeID)
+		if err != nil {
+			return fmt.Errorf("failed to load networking private key: %w", err)
+		}
+
+		peerID, err := peerIDFromNetworkKey(networkingPrivateKey)
+		if err != nil {
+			return fmt.Errorf("could not get peer ID from network key: %w", err)
+		}
+
+		// public node ID for observer is derived from peer ID which is derived from network key
+		pubNodeID, err := translator.NewPublicNetworkIDTranslator().GetFlowID(peerID)
+		if err != nil {
+			return fmt.Errorf("could not get flow node ID: %w", err)
+		}
+
+		fnb.NodeID = pubNodeID
+		fnb.NetworkKey = networkingPrivateKey
+
+		return nil
+	}
+
 	fnb.NodeID = nodeID
 	fnb.NetworkKey = info.NetworkPrivKey.PrivateKey
-	fnb.StakingKey = info.StakingPrivKey.PrivateKey
 
 	return nil
 }
 
+func peerIDFromNetworkKey(privateKey crypto.PrivateKey) (peer.ID, error) {
+	pubKey, err := keyutils.LibP2PPublicKeyFromFlow(privateKey.PublicKey())
+	if err != nil {
+		return "", fmt.Errorf("could not load libp2p public key: %w", err)
+	}
+
+	return peer.IDFromPublicKey(pubKey)
+}
+
 func (fnb *FlowNodeBuilder) initLogger() error {
 	// configure logger with standard level, node ID and UTC timestamp
 	zerolog.TimeFieldFormat = time.RFC3339Nano
@@ -755,10 +923,7 @@ func (fnb *FlowNodeBuilder) initMetrics() error {
 		// metrics enabled, report node info metrics as post init event
 		fnb.PostInit(func(nodeConfig *NodeConfig) error {
 			nodeInfoMetrics := metrics.NewNodeInfoCollector()
-			protocolVersion, err := fnb.RootSnapshot.Params().ProtocolVersion()
-			if err != nil {
-				return fmt.Errorf("could not query root snapshoot protocol version: %w", err)
-			}
+			protocolVersion := fnb.RootSnapshot.Params().ProtocolVersion()
 			nodeInfoMetrics.NodeInfo(build.Version(), build.Commit(), nodeConfig.SporkID.String(), protocolVersion)
 			return nil
 		})
@@ -1006,8 +1171,9 @@ func (fnb *FlowNodeBuilder) initStorage() error {
 	collections := bstorage.NewCollections(fnb.DB, transactions)
 	setups := bstorage.NewEpochSetups(fnb.Metrics.Cache, fnb.DB)
 	epochCommits := bstorage.NewEpochCommits(fnb.Metrics.Cache, fnb.DB)
-	statuses := bstorage.NewEpochStatuses(fnb.Metrics.Cache, fnb.DB)
 	commits := bstorage.NewCommits(fnb.Metrics.Cache, fnb.DB)
+	protocolState := bstorage.NewProtocolState(fnb.Metrics.Cache, setups, epochCommits, fnb.DB,
+		bstorage.DefaultProtocolStateCacheSize, bstorage.DefaultProtocolStateByBlockIDCacheSize)
 	versionBeacons := bstorage.NewVersionBeacons(fnb.DB)
 
 	fnb.Storage = Storage{
@@ -1025,7 +1191,7 @@ func (fnb *FlowNodeBuilder) initStorage() error {
 		Setups:             setups,
 		EpochCommits:       epochCommits,
 		VersionBeacons:     versionBeacons,
-		Statuses:           statuses,
+		ProtocolState:      protocolState,
 		Commits:            commits,
 	}
 
@@ -1038,7 +1204,6 @@ func (fnb *FlowNodeBuilder) InitIDProviders() {
 		if err != nil {
 			return fmt.Errorf("could not initialize ProtocolStateIDCache: %w", err)
 		}
-		node.IDTranslator = idCache
 
 		// The following wrapper allows to disallow-list byzantine nodes via an admin command:
 		// the wrapper overrides the 'Ejected' flag of disallow-listed nodes to true
@@ -1050,6 +1215,33 @@ func (fnb *FlowNodeBuilder) InitIDProviders() {
 		}
 		node.IdentityProvider = disallowListWrapper
 
+		if node.ObserverMode {
+			// identifier providers decides which node to connect to when syncing blocks,
+			// in observer mode, the peer nodes have to be specific public access node,
+			// rather than the staked consensus nodes.
+			idTranslator, factory, err := CreatePublicIDTranslatorAndIdentifierProvider(
+				fnb.Logger,
+				fnb.NetworkKey,
+				fnb.SporkID,
+				// fnb.LibP2PNode is not created yet, until EnqueueNetworkInit is called.
+				// so we pass a function that will return the LibP2PNode when called.
+				func() p2p.LibP2PNode {
+					return fnb.LibP2PNode
+				},
+				idCache,
+			)
+			if err != nil {
+				return fmt.Errorf("could not initialize public ID translator and identifier provider: %w", err)
+			}
+
+			fnb.IDTranslator = idTranslator
+			fnb.SyncEngineIdentifierProvider = factory()
+
+			return nil
+		}
+
+		node.IDTranslator = idCache
+
 		// register the disallow list wrapper for dynamic configuration via admin command
 		err = node.ConfigManager.RegisterIdentifierListConfig("network-id-provider-blocklist",
 			disallowListWrapper.GetDisallowList, disallowListWrapper.Update)
@@ -1059,9 +1251,9 @@ func (fnb *FlowNodeBuilder) InitIDProviders() {
 
 		node.SyncEngineIdentifierProvider = id.NewIdentityFilterIdentifierProvider(
 			filter.And(
-				filter.HasRole(flow.RoleConsensus),
-				filter.Not(filter.HasNodeID(node.Me.NodeID())),
-				underlay.NotEjectedFilter,
+				filter.HasRole[flow.Identity](flow.RoleConsensus),
+				filter.Not(filter.HasNodeID[flow.Identity](node.Me.NodeID())),
+				filter.NotEjectedFilter,
 			),
 			node.IdentityProvider,
 		)
@@ -1089,7 +1281,7 @@ func (fnb *FlowNodeBuilder) initState() error {
 			fnb.Storage.QuorumCertificates,
 			fnb.Storage.Setups,
 			fnb.Storage.EpochCommits,
-			fnb.Storage.Statuses,
+			fnb.Storage.ProtocolState,
 			fnb.Storage.VersionBeacons,
 		)
 		if err != nil {
@@ -1098,11 +1290,7 @@ func (fnb *FlowNodeBuilder) initState() error {
 		fnb.State = state
 
 		// set root snapshot field
-		rootBlock, err := state.Params().FinalizedRoot()
-		if err != nil {
-			return fmt.Errorf("could not get root block from protocol state: %w", err)
-		}
-
+		rootBlock := state.Params().FinalizedRoot()
 		rootSnapshot := state.AtBlockID(rootBlock.ID())
 		if err := fnb.setRootSnapshot(rootSnapshot); err != nil {
 			return err
@@ -1141,7 +1329,7 @@ func (fnb *FlowNodeBuilder) initState() error {
 			fnb.Storage.QuorumCertificates,
 			fnb.Storage.Setups,
 			fnb.Storage.EpochCommits,
-			fnb.Storage.Statuses,
+			fnb.Storage.ProtocolState,
 			fnb.Storage.VersionBeacons,
 			fnb.RootSnapshot,
 			options...,
@@ -1230,24 +1418,50 @@ func (fnb *FlowNodeBuilder) setRootSnapshot(rootSnapshot protocol.Snapshot) erro
 	}
 
 	fnb.RootChainID = fnb.FinalizedRootBlock.Header.ChainID
-	fnb.SporkID, err = fnb.RootSnapshot.Params().SporkID()
-	if err != nil {
-		return fmt.Errorf("failed to read spork ID: %w", err)
-	}
+	fnb.SporkID = fnb.RootSnapshot.Params().SporkID()
 
 	return nil
 }
 
 func (fnb *FlowNodeBuilder) initLocal() error {
+	// NodeID has been set in initNodeInfo
+	myID := fnb.NodeID
+	if fnb.ObserverMode {
+		nodeID, err := flow.HexStringToIdentifier(fnb.BaseConfig.nodeIDHex)
+		if err != nil {
+			return fmt.Errorf("could not parse node ID from string (id: %v): %w", fnb.BaseConfig.nodeIDHex, err)
+		}
+		info, err := LoadPrivateNodeInfo(fnb.BaseConfig.BootstrapDir, nodeID)
+		if err != nil {
+			return fmt.Errorf("could not load private node info: %w", err)
+		}
+
+		if info.Role != flow.RoleExecution {
+			return fmt.Errorf("observer mode is only available for execution nodes")
+		}
+
+		id := flow.IdentitySkeleton{
+			// observer mode uses the node id derived from the network key,
+			// rather than the node id from the node info file
+			NodeID:        myID,
+			Address:       info.Address,
+			Role:          info.Role,
+			InitialWeight: 0,
+			NetworkPubKey: fnb.NetworkKey.PublicKey(),
+			StakingPubKey: fnb.StakingKey.PublicKey(),
+		}
+		fnb.Me, err = local.New(id, fnb.StakingKey)
+		if err != nil {
+			return fmt.Errorf("could not initialize local: %w", err)
+		}
+
+		return nil
+	}
+
 	// Verify that my ID (as given in the configuration) is known to the network
 	// (i.e. protocol state). There are two cases that will cause the following error:
 	// 1) used the wrong node id, which is not part of the identity list of the finalized state
 	// 2) the node id is a new one for a new spork, but the bootstrap data has not been updated.
-	myID, err := flow.HexStringToIdentifier(fnb.BaseConfig.nodeIDHex)
-	if err != nil {
-		return fmt.Errorf("could not parse node identifier: %w", err)
-	}
-
 	self, err := fnb.State.Final().Identity(myID)
 	if err != nil {
 		return fmt.Errorf("node identity not found in the identity list of the finalized state (id: %v): %w", myID, err)
@@ -1257,11 +1471,7 @@ func (fnb *FlowNodeBuilder) initLocal() error {
 	// We enforce this strictly for MainNet. For other networks (e.g. TestNet or BenchNet), we
 	// are lenient, to allow ghost node to run as any role.
 	if self.Role.String() != fnb.BaseConfig.NodeRole {
-		rootBlockHeader, err := fnb.State.Params().FinalizedRoot()
-		if err != nil {
-			return fmt.Errorf("could not get root block from protocol state: %w", err)
-		}
-
+		rootBlockHeader := fnb.State.Params().FinalizedRoot()
 		if rootBlockHeader.ChainID == flow.Mainnet {
 			return fmt.Errorf("running as incorrect role, expected: %v, actual: %v, exiting",
 				self.Role.String(),
@@ -1282,7 +1492,7 @@ func (fnb *FlowNodeBuilder) initLocal() error {
 		return fmt.Errorf("configured staking key does not match protocol state")
 	}
 
-	fnb.Me, err = local.New(self, fnb.StakingKey)
+	fnb.Me, err = local.New(self.IdentitySkeleton, fnb.StakingKey)
 	if err != nil {
 		return fmt.Errorf("could not initialize local: %w", err)
 	}
@@ -1312,6 +1522,7 @@ func (fnb *FlowNodeBuilder) initFvmOptions() {
 
 // handleModules initializes the given module.
 func (fnb *FlowNodeBuilder) handleModule(v namedModuleFunc) error {
+	fnb.Logger.Info().Str("module", v.name).Msg("module initialization started")
 	err := v.fn(fnb.NodeConfig)
 	if err != nil {
 		return fmt.Errorf("module %s initialization failed: %w", v.name, err)
@@ -1411,11 +1622,15 @@ func (fnb *FlowNodeBuilder) handleComponent(v namedComponentFunc, dependencies <
 
 		logger := fnb.Logger.With().Str("component", v.name).Logger()
 
+		logger.Info().Msg("component initialization started")
 		// First, build the component using the factory method.
 		readyAware, err := v.fn(fnb.NodeConfig)
 		if err != nil {
 			ctx.Throw(fmt.Errorf("component %s initialization failed: %w", v.name, err))
 		}
+		if readyAware == nil {
+			ctx.Throw(fmt.Errorf("component %s initialization failed: nil component", v.name))
+		}
 		logger.Info().Msg("component initialization complete")
 
 		// if this is a Component, use the Startable interface to start the component, otherwise
@@ -1482,6 +1697,7 @@ func (fnb *FlowNodeBuilder) handleRestartableComponent(v namedComponentFunc, par
 
 		// This may be called multiple times if the component is restarted
 		componentFactory := func() (component.Component, error) {
+			log.Info().Msg("component initialization started")
 			c, err := v.fn(fnb.NodeConfig)
 			if err != nil {
 				return nil, err
diff --git a/cmd/util/cmd/addresses/cmd.go b/cmd/util/cmd/addresses/cmd.go
new file mode 100644
index 00000000000..ffef57366e6
--- /dev/null
+++ b/cmd/util/cmd/addresses/cmd.go
@@ -0,0 +1,50 @@
+package addresses
+
+import (
+	"github.com/rs/zerolog/log"
+	"github.com/spf13/cobra"
+
+	"github.com/onflow/flow-go/model/flow"
+)
+
+var (
+	flagChain     string
+	flagCount     int
+	flagSeparator string
+)
+
+var Cmd = &cobra.Command{
+	Use:   "addresses",
+	Short: "generate addresses for a chain",
+	Run:   run,
+}
+
+func init() {
+	Cmd.Flags().StringVar(&flagChain, "chain", "", "Chain name")
+	_ = Cmd.MarkFlagRequired("chain")
+
+	Cmd.Flags().IntVar(&flagCount, "count", 1, "Count")
+	_ = Cmd.MarkFlagRequired("count")
+
+	Cmd.Flags().StringVar(&flagSeparator, "separator", ",", "Separator to use between addresses")
+}
+
+func run(*cobra.Command, []string) {
+	chain := flow.ChainID(flagChain).Chain()
+
+	generator := chain.NewAddressGenerator()
+
+	for i := 0; i < flagCount; i++ {
+		address, err := generator.NextAddress()
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed to generate address")
+		}
+
+		str := address.Hex()
+
+		if i > 0 {
+			print(flagSeparator)
+		}
+		print(str)
+	}
+}
diff --git a/cmd/util/cmd/bootstrap-execution-state-payloads/cmd.go b/cmd/util/cmd/bootstrap-execution-state-payloads/cmd.go
new file mode 100644
index 00000000000..94a317326ac
--- /dev/null
+++ b/cmd/util/cmd/bootstrap-execution-state-payloads/cmd.go
@@ -0,0 +1,90 @@
+package addresses
+
+import (
+	"github.com/rs/zerolog/log"
+	"github.com/spf13/cobra"
+
+	"github.com/onflow/flow-go/cmd/util/ledger/util"
+	"github.com/onflow/flow-go/fvm"
+	"github.com/onflow/flow-go/fvm/storage/snapshot"
+	"github.com/onflow/flow-go/ledger"
+	"github.com/onflow/flow-go/ledger/common/convert"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+var (
+	flagChain                 string
+	flagOutputPayloadFileName string
+)
+
+var Cmd = &cobra.Command{
+	Use:   "bootstrap-execution-state-payloads",
+	Short: "generate payloads for execution state of bootstrapped chain",
+	Run:   run,
+}
+
+func init() {
+	Cmd.Flags().StringVar(&flagChain, "chain", "", "Chain name")
+	_ = Cmd.MarkFlagRequired("chain")
+
+	Cmd.Flags().StringVar(
+		&flagOutputPayloadFileName,
+		"output-filename",
+		"",
+		"Output payload file name")
+	_ = Cmd.MarkFlagRequired("output-filename")
+
+}
+
+func run(*cobra.Command, []string) {
+
+	chain := flow.ChainID(flagChain).Chain()
+
+	log.Info().Msgf("creating payloads for chain %s", chain)
+
+	ctx := fvm.NewContext(
+		fvm.WithChain(chain),
+	)
+
+	vm := fvm.NewVirtualMachine()
+
+	storageSnapshot := snapshot.MapStorageSnapshot{}
+
+	bootstrapProcedure := fvm.Bootstrap(
+		unittest.ServiceAccountPublicKey,
+		fvm.WithInitialTokenSupply(unittest.GenesisTokenSupply),
+	)
+
+	executionSnapshot, _, err := vm.Run(
+		ctx,
+		bootstrapProcedure,
+		storageSnapshot,
+	)
+	if err != nil {
+		log.Fatal().Err(err)
+	}
+
+	payloads := make([]*ledger.Payload, 0, len(executionSnapshot.WriteSet))
+
+	for registerID, registerValue := range executionSnapshot.WriteSet {
+		payloadKey := convert.RegisterIDToLedgerKey(registerID)
+		payload := ledger.NewPayload(payloadKey, registerValue)
+		payloads = append(payloads, payload)
+	}
+
+	log.Info().Msgf("writing payloads to %s", flagOutputPayloadFileName)
+
+	numOfPayloadWritten, err := util.CreatePayloadFile(
+		log.Logger,
+		flagOutputPayloadFileName,
+		payloads,
+		nil,
+		false,
+	)
+	if err != nil {
+		log.Fatal().Err(err)
+	}
+
+	log.Info().Msgf("wrote %d payloads", numOfPayloadWritten)
+}
diff --git a/cmd/util/cmd/checkpoint-collect-stats/cmd.go b/cmd/util/cmd/checkpoint-collect-stats/cmd.go
index cf74b467758..29c7bd1c5ef 100644
--- a/cmd/util/cmd/checkpoint-collect-stats/cmd.go
+++ b/cmd/util/cmd/checkpoint-collect-stats/cmd.go
@@ -93,7 +93,7 @@ func run(*cobra.Command, []string) {
 	if err != nil {
 		log.Fatal().Err(err).Msg("cannot create ledger from write-a-head logs and checkpoints")
 	}
-	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), complete.DefaultCacheSize, math.MaxInt, 1, atomic.NewBool(false))
+	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), complete.DefaultCacheSize, math.MaxInt, 1, atomic.NewBool(false), &metrics.NoopCollector{})
 	if err != nil {
 		log.Fatal().Err(err).Msg("cannot create compactor")
 	}
diff --git a/cmd/util/cmd/common/clusters.go b/cmd/util/cmd/common/clusters.go
new file mode 100644
index 00000000000..3e912b6d224
--- /dev/null
+++ b/cmd/util/cmd/common/clusters.go
@@ -0,0 +1,198 @@
+package common
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/cadence"
+
+	"github.com/onflow/flow-go/cmd/bootstrap/run"
+	"github.com/onflow/flow-go/model/bootstrap"
+	model "github.com/onflow/flow-go/model/bootstrap"
+	"github.com/onflow/flow-go/model/cluster"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/model/flow/assignment"
+	"github.com/onflow/flow-go/model/flow/factory"
+	"github.com/onflow/flow-go/model/flow/filter"
+	"github.com/onflow/flow-go/module/signature"
+)
+
+// ConstructClusterAssignment generates a partially randomized collector cluster assignment with internal and partner nodes.
+// The number of nodes in each cluster is deterministic and only depends on the number of clusters
+// and the number of nodes. The repartition of internal and partner nodes is also deterministic
+// and only depends on the number of clusters and nodes.
+// The identity of internal and partner nodes in each cluster is the non-deterministic and is randomized
+// using the system entropy.
+// The function guarantees a specific constraint when partitioning the nodes into clusters:
+// Each cluster must contain strictly more than 2/3 of internal nodes. If the constraint can't be
+// satisfied, an exception is returned.
+// Note that if an exception is returned with a certain number of internal/partner nodes, there is no chance
+// of succeeding the assignment by re-running the function without increasing the internal nodes ratio.
+// Args:
+// - log: the logger instance.
+// - partnerNodes: identity list of partner nodes.
+// - internalNodes: identity list of internal nodes.
+// - numCollectionClusters: the number of clusters to generate
+// Returns:
+// - flow.AssignmentList: the generated assignment list.
+// - flow.ClusterList: the generate collection cluster list.
+// - error: if any error occurs. Any error returned from this function is irrecoverable.
+func ConstructClusterAssignment(log zerolog.Logger, partnerNodes, internalNodes flow.IdentityList, numCollectionClusters int) (flow.AssignmentList, flow.ClusterList, error) {
+
+	partners := partnerNodes.Filter(filter.HasRole[flow.Identity](flow.RoleCollection))
+	internals := internalNodes.Filter(filter.HasRole[flow.Identity](flow.RoleCollection))
+	nCollectors := len(partners) + len(internals)
+
+	// ensure we have at least as many collection nodes as clusters
+	if nCollectors < int(numCollectionClusters) {
+		log.Fatal().Msgf("network bootstrap is configured with %d collection nodes, but %d clusters - must have at least one collection node per cluster",
+			nCollectors, numCollectionClusters)
+	}
+
+	// shuffle both collector lists based on a non-deterministic algorithm
+	partners, err := partners.Shuffle()
+	if err != nil {
+		log.Fatal().Err(err).Msg("could not shuffle partners")
+	}
+	internals, err = internals.Shuffle()
+	if err != nil {
+		log.Fatal().Err(err).Msg("could not shuffle internals")
+	}
+
+	// The following is a heuristic for distributing the internal collector nodes (private staking key available
+	// to generate QC for cluster root block) and partner nodes (private staking unknown). We need internal nodes
+	// to control strictly more than 2/3 of the cluster's total weight.
+	// The following is a heuristic that distributes collectors round-robbin across the specified number of clusters.
+	// This heuristic only works when all collectors have equal weight! The following sanity check enforces this:
+	if len(partnerNodes) > 0 && len(partnerNodes) > 2*len(internalNodes) {
+		return nil, nil, fmt.Errorf("requiring at least x>0 number of partner nodes and y > 2x number of internal nodes, but got x,y=%d,%d", len(partnerNodes), len(internalNodes))
+	}
+	// sanity check ^ enforces that there is at least one internal node, hence `internalNodes[0].InitialWeight` is always a valid reference weight
+	refWeight := internalNodes[0].InitialWeight
+
+	identifierLists := make([]flow.IdentifierList, numCollectionClusters)
+	// array to track the 2/3 internal-nodes constraint (internal_nodes > 2 * partner_nodes)
+	constraint := make([]int, numCollectionClusters)
+
+	// first, round-robin internal nodes into each cluster
+	for i, node := range internals {
+		if node.InitialWeight != refWeight {
+			return nil, nil, fmt.Errorf("current implementation requires all collectors (partner & interal nodes) to have equal weight")
+		}
+		clusterIndex := i % numCollectionClusters
+		identifierLists[clusterIndex] = append(identifierLists[clusterIndex], node.NodeID)
+		constraint[clusterIndex] += 1
+	}
+
+	// next, round-robin partner nodes into each cluster
+	for i, node := range partners {
+		if node.InitialWeight != refWeight {
+			return nil, nil, fmt.Errorf("current implementation requires all collectors (partner & interal nodes) to have equal weight")
+		}
+		clusterIndex := i % numCollectionClusters
+		identifierLists[clusterIndex] = append(identifierLists[clusterIndex], node.NodeID)
+		constraint[clusterIndex] -= 2
+	}
+
+	// check the 2/3 constraint: for every cluster `i`, constraint[i] must be strictly positive
+	for i := 0; i < numCollectionClusters; i++ {
+		if constraint[i] <= 0 {
+			return nil, nil, errors.New("there isn't enough internal nodes to have at least 2/3 internal nodes in each cluster")
+		}
+	}
+
+	assignments := assignment.FromIdentifierLists(identifierLists)
+
+	collectors := append(partners, internals...)
+	clusters, err := factory.NewClusterList(assignments, collectors.ToSkeleton())
+	if err != nil {
+		log.Fatal().Err(err).Msg("could not create cluster list")
+	}
+
+	return assignments, clusters, nil
+}
+
+// ConstructRootQCsForClusters constructs a root QC for each cluster in the list.
+// Args:
+// - log: the logger instance.
+// - clusterList: list of clusters
+// - nodeInfos: list of NodeInfos (must contain all internal nodes)
+// - clusterBlocks: list of root blocks for each cluster
+// Returns:
+// - flow.AssignmentList: the generated assignment list.
+// - flow.ClusterList: the generate collection cluster list.
+func ConstructRootQCsForClusters(log zerolog.Logger, clusterList flow.ClusterList, nodeInfos []bootstrap.NodeInfo, clusterBlocks []*cluster.Block) []*flow.QuorumCertificate {
+
+	if len(clusterBlocks) != len(clusterList) {
+		log.Fatal().Int("len(clusterBlocks)", len(clusterBlocks)).Int("len(clusterList)", len(clusterList)).
+			Msg("number of clusters needs to equal number of cluster blocks")
+	}
+
+	qcs := make([]*flow.QuorumCertificate, len(clusterBlocks))
+	for i, cluster := range clusterList {
+		signers := filterClusterSigners(cluster, nodeInfos)
+
+		qc, err := run.GenerateClusterRootQC(signers, cluster, clusterBlocks[i])
+		if err != nil {
+			log.Fatal().Err(err).Int("cluster index", i).Msg("generating collector cluster root QC failed")
+		}
+		qcs[i] = qc
+	}
+
+	return qcs
+}
+
+// ConvertClusterAssignmentsCdc converts golang cluster assignments type to Cadence type `[[String]]`.
+func ConvertClusterAssignmentsCdc(assignments flow.AssignmentList) cadence.Array {
+	assignmentsCdc := make([]cadence.Value, len(assignments))
+	for i, asmt := range assignments {
+		vals := make([]cadence.Value, asmt.Len())
+		for j, nodeID := range asmt {
+			vals[j] = cadence.String(nodeID.String())
+		}
+		assignmentsCdc[i] = cadence.NewArray(vals).WithType(cadence.NewVariableSizedArrayType(cadence.StringType{}))
+	}
+
+	return cadence.NewArray(assignmentsCdc).WithType(cadence.NewVariableSizedArrayType(cadence.NewVariableSizedArrayType(cadence.StringType{})))
+}
+
+// ConvertClusterQcsCdc converts cluster QCs from `QuorumCertificate` type to `ClusterQCVoteData` type.
+func ConvertClusterQcsCdc(qcs []*flow.QuorumCertificate, clusterList flow.ClusterList) ([]*flow.ClusterQCVoteData, error) {
+	voteData := make([]*flow.ClusterQCVoteData, len(qcs))
+	for i, qc := range qcs {
+		c, ok := clusterList.ByIndex(uint(i))
+		if !ok {
+			return nil, fmt.Errorf("could not get cluster list for cluster index %v", i)
+		}
+		voterIds, err := signature.DecodeSignerIndicesToIdentifiers(c.NodeIDs(), qc.SignerIndices)
+		if err != nil {
+			return nil, fmt.Errorf("could not decode signer indices: %w", err)
+		}
+		voteData[i] = &flow.ClusterQCVoteData{
+			SigData:  qc.SigData,
+			VoterIDs: voterIds,
+		}
+	}
+
+	return voteData, nil
+}
+
+// Filters a list of nodes to include only nodes that will sign the QC for the
+// given cluster. The resulting list of nodes is only nodes that are in the
+// given cluster AND are not partner nodes (ie. we have the private keys).
+func filterClusterSigners(cluster flow.IdentitySkeletonList, nodeInfos []model.NodeInfo) []model.NodeInfo {
+
+	var filtered []model.NodeInfo
+	for _, node := range nodeInfos {
+		_, isInCluster := cluster.ByNodeID(node.NodeID)
+		isNotPartner := node.Type() == model.NodeInfoTypePrivate
+
+		if isInCluster && isNotPartner {
+			filtered = append(filtered, node)
+		}
+	}
+
+	return filtered
+}
diff --git a/cmd/util/cmd/common/flow_client.go b/cmd/util/cmd/common/flow_client.go
index 4f7fe6a704e..3566b309747 100644
--- a/cmd/util/cmd/common/flow_client.go
+++ b/cmd/util/cmd/common/flow_client.go
@@ -92,7 +92,7 @@ func insecureFlowClient(accessAddress string) (*client.Client, error) {
 func FlowClientConfigs(accessNodeIDS []flow.Identifier, insecureAccessAPI bool, snapshot protocol.Snapshot) ([]*FlowClientConfig, error) {
 	flowClientOpts := make([]*FlowClientConfig, 0)
 
-	identities, err := snapshot.Identities(filter.HasNodeID(accessNodeIDS...))
+	identities, err := snapshot.Identities(filter.HasNodeID[flow.Identity](accessNodeIDS...))
 	if err != nil {
 		return nil, fmt.Errorf("failed get identities access node identities (ids=%v) from snapshot: %w", accessNodeIDS, err)
 	}
@@ -138,7 +138,7 @@ func convertAccessAddrFromState(address string, insecureAccessAPI bool) string {
 
 // DefaultAccessNodeIDS will return all the access node IDS in the protocol state for staked access nodes
 func DefaultAccessNodeIDS(snapshot protocol.Snapshot) ([]flow.Identifier, error) {
-	identities, err := snapshot.Identities(filter.HasRole(flow.RoleAccess))
+	identities, err := snapshot.Identities(filter.HasRole[flow.Identity](flow.RoleAccess))
 	if err != nil {
 		return nil, fmt.Errorf("failed to get staked access node IDs from protocol state %w", err)
 	}
diff --git a/cmd/util/cmd/common/node_info.go b/cmd/util/cmd/common/node_info.go
new file mode 100644
index 00000000000..061741d0955
--- /dev/null
+++ b/cmd/util/cmd/common/node_info.go
@@ -0,0 +1,226 @@
+package common
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/model/bootstrap"
+	"github.com/onflow/flow-go/model/flow"
+)
+
+// ReadFullPartnerNodeInfos reads partner node info and partner weight information from the specified paths and constructs
+// a list of full bootstrap.NodeInfo for each partner node.
+// Args:
+// - log: logger used to log debug information.
+// - partnerWeightsPath: path to partner weights configuration file.
+// - partnerNodeInfoDir: path to partner nodes configuration file.
+// Returns:
+// - []bootstrap.NodeInfo: the generated node info list. (public information, private keys not set)
+// - error: if any error occurs. Any error returned from this function is irrecoverable.
+func ReadFullPartnerNodeInfos(log zerolog.Logger, partnerWeightsPath, partnerNodeInfoDir string) ([]bootstrap.NodeInfo, error) {
+	partners, err := ReadPartnerNodeInfos(partnerNodeInfoDir)
+	if err != nil {
+		return nil, err
+	}
+	log.Info().Msgf("read %d partner node configuration files", len(partners))
+
+	weights, err := ReadPartnerWeights(partnerWeightsPath)
+	if err != nil {
+		return nil, err
+	}
+	log.Info().Msgf("read %d weights for partner nodes", len(weights))
+
+	var nodes []bootstrap.NodeInfo
+	for _, partner := range partners {
+		// validate every single partner node
+		err = ValidateNodeID(partner.NodeID)
+		if err != nil {
+			return nil, fmt.Errorf("invalid node ID: %s", partner.NodeID)
+		}
+		err = ValidateNetworkPubKey(partner.NetworkPubKey)
+		if err != nil {
+			return nil, fmt.Errorf(fmt.Sprintf("invalid network public key: %s", partner.NetworkPubKey))
+		}
+		err = ValidateStakingPubKey(partner.StakingPubKey)
+		if err != nil {
+			return nil, fmt.Errorf(fmt.Sprintf("invalid staking public key: %s", partner.StakingPubKey))
+		}
+
+		weight := weights[partner.NodeID]
+		if valid := ValidateWeight(weight); !valid {
+			return nil, fmt.Errorf(fmt.Sprintf("invalid partner weight: %d", weight))
+		}
+
+		if weight != flow.DefaultInitialWeight {
+			log.Warn().Msgf("partner node (id=%x) has non-default weight (%d != %d)", partner.NodeID, weight, flow.DefaultInitialWeight)
+		}
+
+		node := bootstrap.NewPublicNodeInfo(
+			partner.NodeID,
+			partner.Role,
+			partner.Address,
+			weight,
+			partner.NetworkPubKey.PublicKey,
+			partner.StakingPubKey.PublicKey,
+		)
+		nodes = append(nodes, node)
+	}
+
+	return nodes, nil
+}
+
+// ReadPartnerWeights reads the partner weights configuration file and returns a list of PartnerWeights.
+// Args:
+// - partnerWeightsPath: path to partner weights configuration file.
+// Returns:
+// - PartnerWeights: map from NodeID → node's weight
+// - error: if any error occurs. Any error returned from this function is irrecoverable.
+func ReadPartnerWeights(partnerWeightsPath string) (PartnerWeights, error) {
+	var weights PartnerWeights
+
+	err := ReadJSON(partnerWeightsPath, &weights)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read partner weights json: %w", err)
+	}
+	return weights, nil
+}
+
+// ReadPartnerNodeInfos reads the partner node info from the configuration file and returns a list of []bootstrap.NodeInfoPub.
+// Args:
+// - partnerNodeInfoDir: path to partner nodes configuration file.
+// Returns:
+// - []bootstrap.NodeInfoPub: the generated partner node info list.
+// - error: if any error occurs. Any error returned from this function is irrecoverable.
+func ReadPartnerNodeInfos(partnerNodeInfoDir string) ([]bootstrap.NodeInfoPub, error) {
+	var partners []bootstrap.NodeInfoPub
+	files, err := FilesInDir(partnerNodeInfoDir)
+	if err != nil {
+		return nil, fmt.Errorf("could not read partner node infos: %w", err)
+	}
+	for _, f := range files {
+		// skip files that do not include node-infos
+		if !strings.Contains(f, bootstrap.PathPartnerNodeInfoPrefix) {
+			continue
+		}
+		// read file and append to partners
+		var p bootstrap.NodeInfoPub
+		err = ReadJSON(f, &p)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read node info: %w", err)
+		}
+		partners = append(partners, p)
+	}
+	return partners, nil
+}
+
+// ReadFullInternalNodeInfos reads internal node info and internal node weight information from the specified paths and constructs
+// a list of full bootstrap.NodeInfo for each internal node.
+// Args:
+// - log: logger used to log debug information.
+// - internalNodePrivInfoDir: path to internal nodes  private info.
+// - internalWeightsConfig: path to internal weights configuration file.
+// Returns:
+// - []bootstrap.NodeInfo: the generated node info list. Caution: contains private keys!
+// - error: if any error occurs. Any error returned from this function is irrecoverable.
+func ReadFullInternalNodeInfos(log zerolog.Logger, internalNodePrivInfoDir, internalWeightsConfig string) ([]bootstrap.NodeInfo, error) {
+	privInternals, err := ReadInternalNodeInfos(internalNodePrivInfoDir)
+	if err != nil {
+		return nil, err
+	}
+
+	log.Info().Msgf("read %v internal private node-info files", len(privInternals))
+
+	weights := internalWeightsByAddress(log, internalWeightsConfig)
+	log.Info().Msgf("read %d weights for internal nodes", len(weights))
+
+	var nodes []bootstrap.NodeInfo
+	for _, internal := range privInternals {
+		// check if address is valid format
+		ValidateAddressFormat(log, internal.Address)
+
+		// validate every single internal node
+		err := ValidateNodeID(internal.NodeID)
+		if err != nil {
+			return nil, fmt.Errorf(fmt.Sprintf("invalid internal node ID: %s", internal.NodeID))
+		}
+		weight := weights[internal.Address]
+
+		if valid := ValidateWeight(weight); !valid {
+			return nil, fmt.Errorf(fmt.Sprintf("invalid partner weight: %d", weight))
+		}
+		if weight != flow.DefaultInitialWeight {
+			log.Warn().Msgf("internal node (id=%x) has non-default weight (%d != %d)", internal.NodeID, weight, flow.DefaultInitialWeight)
+		}
+
+		node := bootstrap.NewPrivateNodeInfo(
+			internal.NodeID,
+			internal.Role,
+			internal.Address,
+			weight,
+			internal.NetworkPrivKey,
+			internal.StakingPrivKey,
+		)
+
+		nodes = append(nodes, node)
+	}
+
+	return nodes, nil
+}
+
+// ReadInternalNodeInfos reads our internal node private infos generated by `keygen` command and returns it.
+// Args:
+// - internalNodePrivInfoDir: path to internal nodes  private info.
+// Returns:
+// - []bootstrap.NodeInfo: the generated private node info list. Caution: contains private keys!
+// - error: if any error occurs. Any error returned from this function is irrecoverable.
+func ReadInternalNodeInfos(internalNodePrivInfoDir string) ([]bootstrap.NodeInfoPriv, error) {
+	var internalPrivInfos []bootstrap.NodeInfoPriv
+
+	// get files in internal priv node infos directory
+	files, err := FilesInDir(internalNodePrivInfoDir)
+	if err != nil {
+		return nil, fmt.Errorf("could not read partner node infos: %w", err)
+	}
+
+	// for each of the files
+	for _, f := range files {
+		// skip files that do not include node-infos
+		if !strings.Contains(f, bootstrap.PathPrivNodeInfoPrefix) {
+			continue
+		}
+
+		// read file and append to partners
+		var p bootstrap.NodeInfoPriv
+		err = ReadJSON(f, &p)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read json: %w", err)
+		}
+		internalPrivInfos = append(internalPrivInfos, p)
+	}
+
+	return internalPrivInfos, nil
+}
+
+// internalWeightsByAddress returns a mapping of node address by weight for internal nodes
+func internalWeightsByAddress(log zerolog.Logger, config string) map[string]uint64 {
+	// read json
+	var configs []bootstrap.NodeConfig
+	err := ReadJSON(config, &configs)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to read json")
+	}
+	log.Info().Interface("config", configs).Msgf("read internal node configurations")
+
+	weights := make(map[string]uint64)
+	for _, config := range configs {
+		if _, ok := weights[config.Address]; !ok {
+			weights[config.Address] = config.Weight
+		} else {
+			log.Error().Msgf("duplicate internal node address %s", config.Address)
+		}
+	}
+
+	return weights
+}
diff --git a/cmd/util/cmd/common/snapshot.go b/cmd/util/cmd/common/snapshot.go
new file mode 100644
index 00000000000..5d73895d5ff
--- /dev/null
+++ b/cmd/util/cmd/common/snapshot.go
@@ -0,0 +1,114 @@
+package common
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/rs/zerolog"
+	"github.com/sethvargo/go-retry"
+
+	"github.com/onflow/flow-go-sdk/access/grpc"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/state/protocol/inmem"
+)
+
+const getSnapshotTimeout = 30 * time.Second
+
+// GetProtocolSnapshot callback that will get latest finalized protocol snapshot
+type GetProtocolSnapshot func(ctx context.Context) (protocol.Snapshot, error)
+
+// GetSnapshot will attempt to get the latest finalized protocol snapshot with the given flow configs
+func GetSnapshot(ctx context.Context, client *grpc.Client) (*inmem.Snapshot, error) {
+	ctx, cancel := context.WithTimeout(ctx, getSnapshotTimeout)
+	defer cancel()
+
+	b, err := client.GetLatestProtocolStateSnapshot(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get latest finalized protocol state snapshot during pre-initialization: %w", err)
+	}
+
+	var snapshotEnc inmem.EncodableSnapshot
+	err = json.Unmarshal(b, &snapshotEnc)
+	if err != nil {
+		return nil, fmt.Errorf("failed to unmarshal protocol state snapshot: %w", err)
+	}
+
+	snapshot := inmem.SnapshotFromEncodable(snapshotEnc)
+	return snapshot, nil
+}
+
+// GetSnapshotAtEpochAndPhase will get the latest finalized protocol snapshot and check the current epoch and epoch phase.
+// If we are past the target epoch and epoch phase we exit the retry mechanism immediately.
+// If not check the snapshot at the specified interval until we reach the target epoch and phase.
+// Args:
+// - ctx: context used when getting the snapshot from the network.
+// - log: the logger
+// - startupEpoch: the desired epoch in which to take a snapshot for startup.
+// - startupEpochPhase: the desired epoch phase in which to take a snapshot for startup.
+// - retryInterval: sleep interval used to retry getting the snapshot from the network in our desired epoch and epoch phase.
+// - getSnapshot: func used to get the snapshot.
+// Returns:
+// - protocol.Snapshot: the protocol snapshot.
+// - error: if any error occurs. Any error returned from this function is irrecoverable.
+func GetSnapshotAtEpochAndPhase(ctx context.Context, log zerolog.Logger, startupEpoch uint64, startupEpochPhase flow.EpochPhase, retryInterval time.Duration, getSnapshot GetProtocolSnapshot) (protocol.Snapshot, error) {
+	start := time.Now()
+
+	log = log.With().
+		Uint64("target_epoch_counter", startupEpoch).
+		Str("target_epoch_phase", startupEpochPhase.String()).
+		Logger()
+
+	log.Info().Msg("starting dynamic startup - waiting until target epoch/phase to start...")
+
+	var snapshot protocol.Snapshot
+	var err error
+
+	backoff := retry.NewConstant(retryInterval)
+	err = retry.Do(ctx, backoff, func(ctx context.Context) error {
+		snapshot, err = getSnapshot(ctx)
+		if err != nil {
+			err = fmt.Errorf("failed to get protocol snapshot: %w", err)
+			log.Error().Err(err).Msg("could not get protocol snapshot")
+			return retry.RetryableError(err)
+		}
+
+		// if we encounter any errors interpreting the snapshot something went wrong stop retrying
+		currEpochCounter, err := snapshot.Epochs().Current().Counter()
+		if err != nil {
+			return fmt.Errorf("failed to get the current epoch counter: %w", err)
+		}
+
+		currEpochPhase, err := snapshot.Phase()
+		if err != nil {
+			return fmt.Errorf("failed to get the current epoch phase: %w", err)
+		}
+
+		// check if we are in or past the target epoch and phase
+		if currEpochCounter > startupEpoch || (currEpochCounter == startupEpoch && currEpochPhase >= startupEpochPhase) {
+			log.Info().
+				Dur("time-waiting", time.Since(start)).
+				Uint64("current-epoch", currEpochCounter).
+				Str("current-epoch-phase", currEpochPhase.String()).
+				Msg("finished dynamic startup - reached desired epoch and phase")
+
+			return nil
+		}
+
+		// wait then poll for latest snapshot again
+		log.Info().
+			Dur("time-waiting", time.Since(start)).
+			Uint64("current-epoch", currEpochCounter).
+			Str("current-epoch-phase", currEpochPhase.String()).
+			Msgf("waiting for epoch %d and phase %s", startupEpoch, startupEpochPhase.String())
+
+		return retry.RetryableError(fmt.Errorf("dynamic startup epoch and epoch phase not reached"))
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to wait for target epoch and phase: %w", err)
+	}
+
+	return snapshot, nil
+}
diff --git a/cmd/util/cmd/common/state.go b/cmd/util/cmd/common/state.go
index 16d5295a729..4d0f0024ce1 100644
--- a/cmd/util/cmd/common/state.go
+++ b/cmd/util/cmd/common/state.go
@@ -24,7 +24,7 @@ func InitProtocolState(db *badger.DB, storages *storage.All) (protocol.State, er
 		storages.QuorumCertificates,
 		storages.Setups,
 		storages.EpochCommits,
-		storages.Statuses,
+		storages.ProtocolState,
 		storages.VersionBeacons,
 	)
 
diff --git a/cmd/util/cmd/common/utils.go b/cmd/util/cmd/common/utils.go
new file mode 100644
index 00000000000..f5b9570071e
--- /dev/null
+++ b/cmd/util/cmd/common/utils.go
@@ -0,0 +1,180 @@
+package common
+
+import (
+	"encoding/json"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"strconv"
+
+	"github.com/multiformats/go-multiaddr"
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/crypto"
+
+	"github.com/onflow/flow-go/model/bootstrap"
+	"github.com/onflow/flow-go/model/encodable"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/network/p2p/utils"
+	"github.com/onflow/flow-go/utils/io"
+)
+
+func FilesInDir(dir string) ([]string, error) {
+	exists, err := PathExists(dir)
+	if err != nil {
+		return nil, fmt.Errorf("could not check if dir exists: %w", err)
+	}
+
+	if !exists {
+		return nil, fmt.Errorf("dir %v does not exist", dir)
+	}
+
+	var files []string
+	err = filepath.Walk(dir, func(path string, info os.FileInfo, err error) error {
+		if !info.IsDir() {
+			files = append(files, path)
+		}
+		return nil
+	})
+	return files, err
+}
+
+// PathExists
+func PathExists(path string) (bool, error) {
+	_, err := os.Stat(path)
+	if err == nil {
+		return true, nil
+	}
+	if os.IsNotExist(err) {
+		return false, nil
+	}
+	return false, err
+}
+
+func ReadJSON(path string, target interface{}) error {
+	dat, err := io.ReadFile(path)
+	if err != nil {
+		return fmt.Errorf("cannot read json: %w", err)
+	}
+	err = json.Unmarshal(dat, target)
+	if err != nil {
+		return fmt.Errorf("cannot unmarshal json in file %s: %w", path, err)
+	}
+	return nil
+}
+
+func WriteJSON(path string, out string, data interface{}) error {
+	bz, err := json.MarshalIndent(data, "", "  ")
+	if err != nil {
+		return fmt.Errorf("cannot marshal json: %w", err)
+	}
+
+	return WriteText(path, out, bz)
+}
+
+func WriteText(path string, out string, data []byte) error {
+	path = filepath.Join(out, path)
+
+	err := os.MkdirAll(filepath.Dir(path), 0755)
+	if err != nil {
+		return fmt.Errorf("could not create output dir: %w", err)
+	}
+
+	err = os.WriteFile(path, data, 0644)
+	if err != nil {
+		return fmt.Errorf("could not write file: %w", err)
+	}
+	return nil
+}
+
+func PubKeyToString(key crypto.PublicKey) string {
+	return fmt.Sprintf("%x", key.Encode())
+}
+
+func NodeCountByRole(nodes []bootstrap.NodeInfo) map[flow.Role]uint16 {
+	roleCounts := map[flow.Role]uint16{
+		flow.RoleCollection:   0,
+		flow.RoleConsensus:    0,
+		flow.RoleExecution:    0,
+		flow.RoleVerification: 0,
+		flow.RoleAccess:       0,
+	}
+	for _, node := range nodes {
+		roleCounts[node.Role] = roleCounts[node.Role] + 1
+	}
+
+	return roleCounts
+}
+
+// ValidateAddressFormat validates the address provided by pretty much doing what the network layer would do before
+// starting the node
+func ValidateAddressFormat(log zerolog.Logger, address string) {
+	checkErr := func(err error) {
+		if err != nil {
+			log.Fatal().Err(err).Str("address", address).Msg("invalid address format.\n" +
+				`Address needs to be in the format hostname:port or ip:port e.g. "flow.com:3569"`)
+		}
+	}
+
+	// split address into ip/hostname and port
+	ip, port, err := net.SplitHostPort(address)
+	checkErr(err)
+
+	// check that port number is indeed a number
+	_, err = strconv.Atoi(port)
+	checkErr(err)
+
+	// create a libp2p address from the ip and port
+	lp2pAddr := utils.MultiAddressStr(ip, port)
+	_, err = multiaddr.NewMultiaddr(lp2pAddr)
+	checkErr(err)
+}
+
+// ValidateNodeID returns an error if node ID is non-zero.
+// Args:
+// - nodeID: the node ID to validate.
+// Returns:
+// - error: if node id is the zero value.
+func ValidateNodeID(nodeID flow.Identifier) error {
+	if nodeID == flow.ZeroID {
+		return fmt.Errorf("NodeID must not be zero")
+	}
+	return nil
+}
+
+// ValidateNetworkPubKey returns an error if network public key is nil.
+// Args:
+// - key: the public key.
+// Returns:
+// - error: if the network key is nil.
+func ValidateNetworkPubKey(key encodable.NetworkPubKey) error {
+	if key.PublicKey == nil {
+		return fmt.Errorf("network public key must not be nil")
+	}
+	return nil
+}
+
+// ValidateStakingPubKey returns an error if the staking key is nil.
+// Args:
+// - key: the public key.
+// Returns:
+// - error: if the staking key is nil.
+func ValidateStakingPubKey(key encodable.StakingPubKey) error {
+	if key.PublicKey == nil {
+		return fmt.Errorf("staking public key must not be nil")
+	}
+	return nil
+}
+
+// ValidateWeight returns true if weight is greater than 0.
+// Args:
+// - weight: the weight to check.
+// Returns:
+// - bool: true if weight is greater than 0.
+func ValidateWeight(weight uint64) bool {
+	return weight > 0
+}
+
+// PartnerWeights is the format of the JSON file specifying partner node weights.
+type PartnerWeights map[flow.Identifier]uint64
diff --git a/cmd/util/cmd/epochs/cmd/move_machine_acct.go b/cmd/util/cmd/epochs/cmd/move_machine_acct.go
index 7f51867693b..f3443d63c5c 100644
--- a/cmd/util/cmd/epochs/cmd/move_machine_acct.go
+++ b/cmd/util/cmd/epochs/cmd/move_machine_acct.go
@@ -72,7 +72,7 @@ func moveMachineAcctRun(cmd *cobra.Command, args []string) {
 	}
 
 	// identities with machine accounts
-	machineAcctIdentities := identities.Filter(filter.HasRole(flow.RoleCollection, flow.RoleConsensus))
+	machineAcctIdentities := identities.Filter(filter.HasRole[flow.Identity](flow.RoleCollection, flow.RoleConsensus))
 
 	machineAcctFiles, err := os.ReadDir(flagMachineAccountsSrcDir)
 	if err != nil {
diff --git a/cmd/util/cmd/epochs/cmd/recover.go b/cmd/util/cmd/epochs/cmd/recover.go
new file mode 100644
index 00000000000..049a8657910
--- /dev/null
+++ b/cmd/util/cmd/epochs/cmd/recover.go
@@ -0,0 +1,249 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/spf13/cobra"
+
+	"github.com/onflow/cadence"
+
+	"github.com/onflow/flow-go/cmd/bootstrap/run"
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
+	epochcmdutil "github.com/onflow/flow-go/cmd/util/cmd/epochs/utils"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/model/flow/filter"
+	"github.com/onflow/flow-go/state/protocol/inmem"
+)
+
+// generateRecoverEpochTxArgsCmd represents a command to generate the data needed to submit an epoch-recovery transaction
+// to the network when it is in EFM (epoch fallback mode).
+// EFM can be exited only by a special service event, EpochRecover, which initially originates from a manual service account transaction.
+// The full epoch data must be generated manually and submitted with this transaction in order for an
+// EpochRecover event to be emitted. This command retrieves the current protocol state identities, computes the cluster assignment using those
+// identities, generates the cluster QCs and retrieves the DKG key vector of the last successful epoch.
+// This recovery process has some constraints:
+//   - The RecoveryEpoch must have exactly the same consensus committee as participated in the most recent successful DKG.
+//   - The RecoveryEpoch must contain enough "internal" collection nodes so that all clusters contain a supermajority of "internal" collection nodes (same constraint as sporks)
+var (
+	generateRecoverEpochTxArgsCmd = &cobra.Command{
+		Use:   "efm-recover-tx-args",
+		Short: "Generates recover epoch transaction arguments",
+		Long: `
+Generates transaction arguments for the epoch recovery transaction.
+The epoch recovery transaction is used to recover from any failure in the epoch transition process without requiring a spork.
+This recovery process has some constraints:
+- The RecoveryEpoch must have exactly the same consensus committee as participated in the most recent successful DKG.
+- The RecoveryEpoch must contain enough "internal" collection nodes so that all clusters contain a supermajority of "internal" collection nodes (same constraint as sporks)
+`,
+		Run: generateRecoverEpochTxArgs(getSnapshot),
+	}
+
+	flagAnAddress                string
+	flagAnPubkey                 string
+	flagInternalNodePrivInfoDir  string
+	flagNodeConfigJson           string
+	flagCollectionClusters       int
+	flagNumViewsInEpoch          uint64
+	flagNumViewsInStakingAuction uint64
+	flagEpochCounter             uint64
+)
+
+func init() {
+	rootCmd.AddCommand(generateRecoverEpochTxArgsCmd)
+	err := addGenerateRecoverEpochTxArgsCmdFlags()
+	if err != nil {
+		panic(err)
+	}
+}
+
+func addGenerateRecoverEpochTxArgsCmdFlags() error {
+	generateRecoverEpochTxArgsCmd.Flags().IntVar(&flagCollectionClusters, "collection-clusters", 0,
+		"number of collection clusters")
+	// required parameters for network configuration and generation of root node identities
+	generateRecoverEpochTxArgsCmd.Flags().StringVar(&flagNodeConfigJson, "config", "",
+		"path to a JSON file containing multiple node configurations (fields Role, Address, Weight)")
+	generateRecoverEpochTxArgsCmd.Flags().StringVar(&flagInternalNodePrivInfoDir, "internal-priv-dir", "", "path to directory "+
+		"containing the output from the `keygen` command for internal nodes")
+	generateRecoverEpochTxArgsCmd.Flags().Uint64Var(&flagNumViewsInEpoch, "epoch-length", 0, "length of each epoch measured in views")
+	generateRecoverEpochTxArgsCmd.Flags().Uint64Var(&flagNumViewsInStakingAuction, "epoch-staking-phase-length", 0, "length of the epoch staking phase measured in views")
+	generateRecoverEpochTxArgsCmd.Flags().Uint64Var(&flagEpochCounter, "epoch-counter", 0, "the epoch counter used to generate the root cluster block")
+
+	err := generateRecoverEpochTxArgsCmd.MarkFlagRequired("epoch-length")
+	if err != nil {
+		return fmt.Errorf("failed to mark epoch-length flag as required")
+	}
+	err = generateRecoverEpochTxArgsCmd.MarkFlagRequired("epoch-staking-phase-length")
+	if err != nil {
+		return fmt.Errorf("failed to mark epoch-staking-phase-length flag as required")
+	}
+	err = generateRecoverEpochTxArgsCmd.MarkFlagRequired("epoch-counter")
+	if err != nil {
+		return fmt.Errorf("failed to mark epoch-counter flag as required")
+	}
+	err = generateRecoverEpochTxArgsCmd.MarkFlagRequired("collection-clusters")
+	if err != nil {
+		return fmt.Errorf("failed to mark collection-clusters flag as required")
+	}
+	return nil
+}
+
+func getSnapshot() *inmem.Snapshot {
+	// get flow client with secure client connection to download protocol snapshot from access node
+	config, err := common.NewFlowClientConfig(flagAnAddress, flagAnPubkey, flow.ZeroID, false)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to create flow client config")
+	}
+
+	flowClient, err := common.FlowClient(config)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to create flow client")
+	}
+
+	snapshot, err := common.GetSnapshot(context.Background(), flowClient)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed")
+	}
+
+	return snapshot
+}
+
+// generateRecoverEpochTxArgs generates recover epoch transaction arguments from a root protocol state snapshot and writes it to a JSON file
+func generateRecoverEpochTxArgs(getSnapshot func() *inmem.Snapshot) func(cmd *cobra.Command, args []string) {
+	return func(cmd *cobra.Command, args []string) {
+		stdout := cmd.OutOrStdout()
+
+		// extract arguments from recover epoch tx from snapshot
+		txArgs := extractRecoverEpochArgs(getSnapshot())
+
+		// encode to JSON
+		encodedTxArgs, err := epochcmdutil.EncodeArgs(txArgs)
+		if err != nil {
+			log.Fatal().Err(err).Msg("could not encode recover epoch transaction arguments")
+		}
+
+		// write JSON args to stdout
+		_, err = stdout.Write(encodedTxArgs)
+		if err != nil {
+			log.Fatal().Err(err).Msg("could not write jsoncdc encoded arguments")
+		}
+	}
+}
+
+// extractRecoverEpochArgs extracts the required transaction arguments for the `recoverEpoch` transaction.
+func extractRecoverEpochArgs(snapshot *inmem.Snapshot) []cadence.Value {
+	epoch := snapshot.Epochs().Current()
+
+	currentEpochIdentities, err := snapshot.Identities(filter.IsValidProtocolParticipant)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to get  valid protocol participants from snapshot")
+	}
+
+	// separate collector nodes by internal and partner nodes
+	collectors := currentEpochIdentities.Filter(filter.HasRole[flow.Identity](flow.RoleCollection))
+	internalCollectors := make(flow.IdentityList, 0)
+	partnerCollectors := make(flow.IdentityList, 0)
+
+	log.Info().Msg("collecting internal node network and staking keys")
+	internalNodes, err := common.ReadFullInternalNodeInfos(log, flagInternalNodePrivInfoDir, flagNodeConfigJson)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to read full internal node infos")
+	}
+
+	internalNodesMap := make(map[flow.Identifier]struct{})
+	for _, node := range internalNodes {
+		if !currentEpochIdentities.Exists(node.Identity()) {
+			log.Fatal().Msg(fmt.Sprintf("node ID found in internal node infos missing from protocol snapshot identities: %s", node.NodeID))
+		}
+		internalNodesMap[node.NodeID] = struct{}{}
+	}
+	log.Info().Msg("")
+
+	for _, collector := range collectors {
+		if _, ok := internalNodesMap[collector.NodeID]; ok {
+			internalCollectors = append(internalCollectors, collector)
+		} else {
+			partnerCollectors = append(partnerCollectors, collector)
+		}
+	}
+
+	currentEpochDKG, err := epoch.DKG()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to get DKG for current epoch")
+	}
+
+	log.Info().Msg("computing collection node clusters")
+
+	assignments, clusters, err := common.ConstructClusterAssignment(log, partnerCollectors, internalCollectors, flagCollectionClusters)
+	if err != nil {
+		log.Fatal().Err(err).Msg("unable to generate cluster assignment")
+	}
+	log.Info().Msg("")
+
+	log.Info().Msg("constructing root blocks for collection node clusters")
+	clusterBlocks := run.GenerateRootClusterBlocks(flagEpochCounter, clusters)
+	log.Info().Msg("")
+
+	log.Info().Msg("constructing root QCs for collection node clusters")
+	clusterQCs := common.ConstructRootQCsForClusters(log, clusters, internalNodes, clusterBlocks)
+	log.Info().Msg("")
+
+	dkgPubKeys := make([]cadence.Value, 0)
+	nodeIds := make([]cadence.Value, 0)
+
+	// NOTE: The RecoveryEpoch will re-use the last successful DKG output. This means that the consensus
+	// committee in the RecoveryEpoch must be identical to the committee which participated in that DKG.
+	dkgGroupKeyCdc, cdcErr := cadence.NewString(currentEpochDKG.GroupKey().String())
+	if cdcErr != nil {
+		log.Fatal().Err(cdcErr).Msg("failed to get dkg group key cadence string")
+	}
+	dkgPubKeys = append(dkgPubKeys, dkgGroupKeyCdc)
+	for _, id := range currentEpochIdentities {
+		if id.GetRole() == flow.RoleConsensus {
+			dkgPubKey, keyShareErr := currentEpochDKG.KeyShare(id.GetNodeID())
+			if keyShareErr != nil {
+				log.Fatal().Err(keyShareErr).Msg(fmt.Sprintf("failed to get dkg pub key share for node: %s", id.GetNodeID()))
+			}
+			dkgPubKeyCdc, cdcErr := cadence.NewString(dkgPubKey.String())
+			if cdcErr != nil {
+				log.Fatal().Err(cdcErr).Msg(fmt.Sprintf("failed to get dkg pub key cadence string for node: %s", id.GetNodeID()))
+			}
+			dkgPubKeys = append(dkgPubKeys, dkgPubKeyCdc)
+		}
+		nodeIdCdc, err := cadence.NewString(id.GetNodeID().String())
+		if err != nil {
+			log.Fatal().Err(err).Msg(fmt.Sprintf("failed to convert node ID to cadence string: %s", id.GetNodeID()))
+		}
+		nodeIds = append(nodeIds, nodeIdCdc)
+	}
+
+	// @TODO: cluster qcs are converted into flow.ClusterQCVoteData types,
+	// we need a corresponding type in cadence on the FlowClusterQC contract
+	// to store this struct.
+	_, err = common.ConvertClusterQcsCdc(clusterQCs, clusters)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to convert cluster qcs to cadence type")
+	}
+
+	currEpochFinalView, err := epoch.FinalView()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to get final view of current epoch")
+	}
+
+	args := []cadence.Value{
+		// epoch start view
+		cadence.NewUInt64(currEpochFinalView + 1),
+		// staking phase end view
+		cadence.NewUInt64(currEpochFinalView + flagNumViewsInStakingAuction),
+		// epoch end view
+		cadence.NewUInt64(currEpochFinalView + flagNumViewsInEpoch),
+		// dkg pub keys
+		cadence.NewArray(dkgPubKeys),
+		// node ids
+		cadence.NewArray(nodeIds),
+		// clusters,
+		common.ConvertClusterAssignmentsCdc(assignments),
+	}
+
+	return args
+}
diff --git a/cmd/util/cmd/epochs/cmd/recover_test.go b/cmd/util/cmd/epochs/cmd/recover_test.go
new file mode 100644
index 00000000000..980a9788a55
--- /dev/null
+++ b/cmd/util/cmd/epochs/cmd/recover_test.go
@@ -0,0 +1,63 @@
+package cmd
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
+	"github.com/onflow/flow-go/model/flow"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/cmd/bootstrap/utils"
+	"github.com/onflow/flow-go/state/protocol/inmem"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+// TestRecoverEpochHappyPath ensures recover epoch transaction arguments are generated as expected.
+func TestRecoverEpochHappyPath(t *testing.T) {
+	// tests that given the root snapshot, the command
+	// writes the expected arguments to stdout.
+	utils.RunWithSporkBootstrapDir(t, func(bootDir, partnerDir, partnerWeights, internalPrivDir, configPath string) {
+		internalNodes, err := common.ReadFullInternalNodeInfos(log, internalPrivDir, configPath)
+		require.NoError(t, err)
+		partnerNodes, err := common.ReadFullPartnerNodeInfos(log, partnerWeights, partnerDir)
+		require.NoError(t, err)
+
+		allNodeIds := make(flow.IdentityList, 0)
+		for _, node := range internalNodes {
+			allNodeIds = append(allNodeIds, node.Identity())
+		}
+		for _, node := range partnerNodes {
+			allNodeIds = append(allNodeIds, node.Identity())
+		}
+
+		// create a root snapshot
+		rootSnapshot := unittest.RootSnapshotFixture(allNodeIds)
+
+		snapshotFn := func() *inmem.Snapshot { return rootSnapshot }
+
+		// run command with overwritten stdout
+		stdout := bytes.NewBuffer(nil)
+		generateRecoverEpochTxArgsCmd.SetOut(stdout)
+
+		flagInternalNodePrivInfoDir = internalPrivDir
+		flagNodeConfigJson = configPath
+		flagCollectionClusters = 2
+		flagNumViewsInEpoch = 4000
+		flagNumViewsInStakingAuction = 100
+		flagEpochCounter = 2
+
+		generateRecoverEpochTxArgs(snapshotFn)(generateRecoverEpochTxArgsCmd, nil)
+
+		// read output from stdout
+		var outputTxArgs []interface{}
+		err = json.NewDecoder(stdout).Decode(&outputTxArgs)
+		require.NoError(t, err)
+		// compare to expected values
+		expectedArgs := extractRecoverEpochArgs(rootSnapshot)
+		unittest.VerifyCdcArguments(t, expectedArgs[:len(expectedArgs)-1], outputTxArgs[:len(expectedArgs)-1])
+		// @TODO validate cadence values for generated cluster assignments and clusters
+	})
+}
diff --git a/cmd/util/cmd/epochs/cmd/reset_test.go b/cmd/util/cmd/epochs/cmd/reset_test.go
index 25983e5cf61..30e7d0178f2 100644
--- a/cmd/util/cmd/epochs/cmd/reset_test.go
+++ b/cmd/util/cmd/epochs/cmd/reset_test.go
@@ -11,9 +11,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/onflow/cadence"
-	jsoncdc "github.com/onflow/cadence/encoding/json"
-
 	"github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/state/protocol/inmem"
 	"github.com/onflow/flow-go/utils/unittest"
@@ -50,7 +47,7 @@ func TestReset_LocalSnapshot(t *testing.T) {
 
 			// compare to expected values
 			expectedArgs := extractResetEpochArgs(rootSnapshot)
-			verifyArguments(t, expectedArgs, outputTxArgs)
+			unittest.VerifyCdcArguments(t, expectedArgs, outputTxArgs)
 		})
 	})
 
@@ -98,7 +95,7 @@ func TestReset_BucketSnapshot(t *testing.T) {
 		rootSnapshot, err := getSnapshotFromBucket(fmt.Sprintf(rootSnapshotBucketURL, flagBucketNetworkName))
 		require.NoError(t, err)
 		expectedArgs := extractResetEpochArgs(rootSnapshot)
-		verifyArguments(t, expectedArgs, outputTxArgs)
+		unittest.VerifyCdcArguments(t, expectedArgs, outputTxArgs)
 	})
 
 	// should output arguments to stdout, including specified payout
@@ -120,7 +117,7 @@ func TestReset_BucketSnapshot(t *testing.T) {
 		rootSnapshot, err := getSnapshotFromBucket(fmt.Sprintf(rootSnapshotBucketURL, flagBucketNetworkName))
 		require.NoError(t, err)
 		expectedArgs := extractResetEpochArgs(rootSnapshot)
-		verifyArguments(t, expectedArgs, outputTxArgs)
+		unittest.VerifyCdcArguments(t, expectedArgs, outputTxArgs)
 	})
 
 	// with a missing snapshot, should log an error
@@ -139,22 +136,6 @@ func TestReset_BucketSnapshot(t *testing.T) {
 	})
 }
 
-func verifyArguments(t *testing.T, expected []cadence.Value, actual []interface{}) {
-
-	for index, arg := range actual {
-
-		// marshal to bytes
-		bz, err := json.Marshal(arg)
-		require.NoError(t, err)
-
-		// parse cadence value
-		decoded, err := jsoncdc.Decode(nil, bz)
-		require.NoError(t, err)
-
-		assert.Equal(t, expected[index], decoded)
-	}
-}
-
 func writeRootSnapshot(bootDir string, snapshot *inmem.Snapshot) error {
 	rootSnapshotPath := filepath.Join(bootDir, bootstrap.PathRootProtocolStateSnapshot)
 	return writeJSON(rootSnapshotPath, snapshot.Encodable())
diff --git a/cmd/util/cmd/exec-data-json-export/ledger_exporter.go b/cmd/util/cmd/exec-data-json-export/ledger_exporter.go
index ee8573d8963..a9d75734d9b 100644
--- a/cmd/util/cmd/exec-data-json-export/ledger_exporter.go
+++ b/cmd/util/cmd/exec-data-json-export/ledger_exporter.go
@@ -35,7 +35,7 @@ func ExportLedger(ledgerPath string, targetstate string, outputPath string) erro
 		return fmt.Errorf("cannot create ledger from write-a-head logs and checkpoints: %w", err)
 	}
 
-	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), complete.DefaultCacheSize, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), complete.DefaultCacheSize, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), &metrics.NoopCollector{})
 	if err != nil {
 		return fmt.Errorf("cannot create compactor: %w", err)
 	}
diff --git a/cmd/util/cmd/execution-state-extract/cmd.go b/cmd/util/cmd/execution-state-extract/cmd.go
index 55728b428a8..7cd4ed7bdeb 100644
--- a/cmd/util/cmd/execution-state-extract/cmd.go
+++ b/cmd/util/cmd/execution-state-extract/cmd.go
@@ -2,12 +2,18 @@ package extract
 
 import (
 	"encoding/hex"
+	"fmt"
+	"os"
 	"path"
+	"strings"
 
 	"github.com/rs/zerolog/log"
 	"github.com/spf13/cobra"
 
+	runtimeCommon "github.com/onflow/cadence/runtime/common"
+
 	"github.com/onflow/flow-go/cmd/util/cmd/common"
+	"github.com/onflow/flow-go/cmd/util/ledger/util"
 	"github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/metrics"
@@ -15,17 +21,24 @@ import (
 )
 
 var (
-	flagExecutionStateDir         string
-	flagOutputDir                 string
-	flagBlockHash                 string
-	flagStateCommitment           string
-	flagDatadir                   string
-	flagChain                     string
-	flagNWorker                   int
-	flagNoMigration               bool
-	flagNoReport                  bool
-	flagValidateMigration         bool
-	flagLogVerboseValidationError bool
+	flagExecutionStateDir                  string
+	flagOutputDir                          string
+	flagBlockHash                          string
+	flagStateCommitment                    string
+	flagDatadir                            string
+	flagChain                              string
+	flagNWorker                            int
+	flagNoMigration                        bool
+	flagNoReport                           bool
+	flagValidateMigration                  bool
+	flagLogVerboseValidationError          bool
+	flagAllowPartialStateFromPayloads      bool
+	flagContinueMigrationOnValidationError bool
+	flagCheckStorageHealthBeforeMigration  bool
+	flagCheckStorageHealthAfterMigration   bool
+	flagInputPayloadFileName               string
+	flagOutputPayloadFileName              string
+	flagOutputPayloadByAddresses           string
 )
 
 var Cmd = &cobra.Command{
@@ -68,6 +81,47 @@ func init() {
 	Cmd.Flags().BoolVar(&flagLogVerboseValidationError, "log-verbose-validation-error", false,
 		"log entire Cadence values on validation error (atree migration)")
 
+	Cmd.Flags().BoolVar(&flagAllowPartialStateFromPayloads, "allow-partial-state-from-payload-file", false,
+		"allow input payload file containing partial state (e.g. not all accounts)")
+
+	Cmd.Flags().BoolVar(&flagCheckStorageHealthBeforeMigration, "check-storage-health-before", false,
+		"check (atree) storage health before migration")
+
+	Cmd.Flags().BoolVar(&flagCheckStorageHealthAfterMigration, "check-storage-health-after", false,
+		"check (atree) storage health after migration")
+
+	Cmd.Flags().BoolVar(&flagContinueMigrationOnValidationError, "continue-migration-on-validation-errors", false,
+		"continue migration even if validation fails")
+
+	// If specified, the state will consist of payloads from the given input payload file.
+	// If not specified, then the state will be extracted from the latest checkpoint file.
+	// This flag can be used to reduce total duration of migrations when state extraction involves
+	// multiple migrations because it helps avoid repeatedly reading from checkpoint file to rebuild trie.
+	// The input payload file must be created by state extraction running with either
+	// flagOutputPayloadFileName or flagOutputPayloadByAddresses.
+	Cmd.Flags().StringVar(
+		&flagInputPayloadFileName,
+		"input-payload-filename",
+		"",
+		"input payload file",
+	)
+
+	Cmd.Flags().StringVar(
+		&flagOutputPayloadFileName,
+		"output-payload-filename",
+		"",
+		"output payload file",
+	)
+
+	Cmd.Flags().StringVar(
+		// Extract payloads of specified addresses (comma separated list of hex-encoded addresses)
+		// to file specified by --output-payload-filename.
+		// If no address is specified (empty string) then this flag is ignored.
+		&flagOutputPayloadByAddresses,
+		"extract-payloads-by-address",
+		"",
+		"extract payloads of addresses (comma separated hex-encoded addresses) to file specified by output-payload-filename",
+	)
 }
 
 func run(*cobra.Command, []string) {
@@ -78,6 +132,19 @@ func run(*cobra.Command, []string) {
 		return
 	}
 
+	if len(flagBlockHash) == 0 && len(flagStateCommitment) == 0 && len(flagInputPayloadFileName) == 0 {
+		log.Fatal().Msg("--block-hash or --state-commitment or --input-payload-filename must be specified")
+	}
+
+	if len(flagInputPayloadFileName) > 0 && (len(flagBlockHash) > 0 || len(flagStateCommitment) > 0) {
+		log.Fatal().Msg("--input-payload-filename cannot be used with --block-hash or --state-commitment")
+	}
+
+	// When flagOutputPayloadByAddresses is specified, flagOutputPayloadFileName is required.
+	if len(flagOutputPayloadFileName) == 0 && len(flagOutputPayloadByAddresses) > 0 {
+		log.Fatal().Msg("--extract-payloads-by-address requires --output-payload-filename to be specified")
+	}
+
 	if len(flagBlockHash) > 0 {
 		blockID, err := flow.HexStringToIdentifier(flagBlockHash)
 		if err != nil {
@@ -112,20 +179,61 @@ func run(*cobra.Command, []string) {
 		log.Info().Msgf("extracting state by state commitment: %x", stateCommitment)
 	}
 
-	if len(flagBlockHash) == 0 && len(flagStateCommitment) == 0 {
-		log.Fatal().Msg("no --block-hash or --state-commitment was specified")
+	if len(flagInputPayloadFileName) > 0 {
+		if _, err := os.Stat(flagInputPayloadFileName); os.IsNotExist(err) {
+			log.Fatal().Msgf("payload input file %s doesn't exist", flagInputPayloadFileName)
+		}
+
+		partialState, err := util.IsPayloadFilePartialState(flagInputPayloadFileName)
+		if err != nil {
+			log.Fatal().Err(err).Msgf("cannot get flag from payload input file %s", flagInputPayloadFileName)
+		}
+
+		// Check if payload file contains partial state and is allowed by --allow-partial-state-from-payload-file.
+		if !flagAllowPartialStateFromPayloads && partialState {
+			log.Fatal().Msgf("payload input file %s contains partial state, please specify --allow-partial-state-from-payload-file", flagInputPayloadFileName)
+		}
+
+		msg := "input payloads represent "
+		if partialState {
+			msg += "partial state"
+		} else {
+			msg += "complete state"
+		}
+		if flagAllowPartialStateFromPayloads {
+			msg += ", and --allow-partial-state-from-payload-file is specified"
+		} else {
+			msg += ", and --allow-partial-state-from-payload-file is NOT specified"
+		}
+		log.Info().Msg(msg)
+	}
+
+	if len(flagOutputPayloadFileName) > 0 {
+		if _, err := os.Stat(flagOutputPayloadFileName); os.IsExist(err) {
+			log.Fatal().Msgf("payload output file %s exists", flagOutputPayloadFileName)
+		}
 	}
 
-	log.Info().Msgf("Extracting state from %s, exporting root checkpoint to %s, version: %v",
-		flagExecutionStateDir,
-		path.Join(flagOutputDir, bootstrap.FilenameWALRootCheckpoint),
-		6,
-	)
+	var exportedAddresses []runtimeCommon.Address
+
+	if len(flagOutputPayloadByAddresses) > 0 {
+
+		addresses := strings.Split(flagOutputPayloadByAddresses, ",")
 
-	log.Info().Msgf("Block state commitment: %s from %v, output dir: %s",
-		hex.EncodeToString(stateCommitment[:]),
-		flagExecutionStateDir,
-		flagOutputDir)
+		for _, hexAddr := range addresses {
+			b, err := hex.DecodeString(strings.TrimSpace(hexAddr))
+			if err != nil {
+				log.Fatal().Err(err).Msgf("cannot hex decode address %s for payload export", strings.TrimSpace(hexAddr))
+			}
+
+			addr, err := runtimeCommon.BytesToAddress(b)
+			if err != nil {
+				log.Fatal().Err(err).Msgf("cannot decode address %x for payload export", b)
+			}
+
+			exportedAddresses = append(exportedAddresses, addr)
+		}
+	}
 
 	// err := ensureCheckpointFileExist(flagExecutionStateDir)
 	// if err != nil {
@@ -148,14 +256,73 @@ func run(*cobra.Command, []string) {
 		log.Warn().Msgf("atree migration has verbose validation error logging enabled which may increase size of log")
 	}
 
-	err := extractExecutionState(
-		log.Logger,
-		flagExecutionStateDir,
-		stateCommitment,
-		flagOutputDir,
-		flagNWorker,
-		!flagNoMigration,
-	)
+	if flagCheckStorageHealthBeforeMigration {
+		log.Warn().Msgf("--check-storage-health-before flag is enabled and will increase duration of migration")
+	}
+
+	if flagCheckStorageHealthAfterMigration {
+		log.Warn().Msgf("--check-storage-health-after flag is enabled and will increase duration of migration")
+	}
+
+	var inputMsg string
+	if len(flagInputPayloadFileName) > 0 {
+		// Input is payloads
+		inputMsg = fmt.Sprintf("reading payloads from %s", flagInputPayloadFileName)
+	} else {
+		// Input is execution state
+		inputMsg = fmt.Sprintf("reading block state commitment %s from %s",
+			hex.EncodeToString(stateCommitment[:]),
+			flagExecutionStateDir,
+		)
+	}
+
+	var outputMsg string
+	if len(flagOutputPayloadFileName) > 0 {
+		// Output is payload file
+		if len(exportedAddresses) == 0 {
+			outputMsg = fmt.Sprintf("exporting all payloads to %s", flagOutputPayloadFileName)
+		} else {
+			outputMsg = fmt.Sprintf(
+				"exporting payloads by addresses %v to %s",
+				flagOutputPayloadByAddresses,
+				flagOutputPayloadFileName,
+			)
+		}
+	} else {
+		// Output is checkpoint files
+		outputMsg = fmt.Sprintf(
+			"exporting root checkpoint to %s, version: %d",
+			path.Join(flagOutputDir, bootstrap.FilenameWALRootCheckpoint),
+			6,
+		)
+	}
+
+	log.Info().Msgf("state extraction plan: %s, %s", inputMsg, outputMsg)
+
+	var err error
+	if len(flagInputPayloadFileName) > 0 {
+		err = extractExecutionStateFromPayloads(
+			log.Logger,
+			flagExecutionStateDir,
+			flagOutputDir,
+			flagNWorker,
+			!flagNoMigration,
+			flagInputPayloadFileName,
+			flagOutputPayloadFileName,
+			exportedAddresses,
+		)
+	} else {
+		err = extractExecutionState(
+			log.Logger,
+			flagExecutionStateDir,
+			stateCommitment,
+			flagOutputDir,
+			flagNWorker,
+			!flagNoMigration,
+			flagOutputPayloadFileName,
+			exportedAddresses,
+		)
+	}
 
 	if err != nil {
 		log.Fatal().Err(err).Msgf("error extracting the execution state: %s", err.Error())
diff --git a/cmd/util/cmd/execution-state-extract/execution_state_extract.go b/cmd/util/cmd/execution-state-extract/execution_state_extract.go
index 90bcd70533d..4b991936ae7 100644
--- a/cmd/util/cmd/execution-state-extract/execution_state_extract.go
+++ b/cmd/util/cmd/execution-state-extract/execution_state_extract.go
@@ -5,12 +5,15 @@ import (
 	"fmt"
 	"math"
 	"os"
+	"time"
 
+	"github.com/onflow/cadence/runtime/common"
 	"github.com/rs/zerolog"
 	"go.uber.org/atomic"
 
 	migrators "github.com/onflow/flow-go/cmd/util/ledger/migrations"
 	"github.com/onflow/flow-go/cmd/util/ledger/reporters"
+	"github.com/onflow/flow-go/cmd/util/ledger/util"
 	"github.com/onflow/flow-go/ledger"
 	"github.com/onflow/flow-go/ledger/common/hash"
 	"github.com/onflow/flow-go/ledger/common/pathfinder"
@@ -34,6 +37,8 @@ func extractExecutionState(
 	outputDir string,
 	nWorker int, // number of concurrent worker to migation payloads
 	runMigrations bool,
+	outputPayloadFile string,
+	exportPayloadsByAddresses []common.Address,
 ) error {
 
 	log.Info().Msg("init WAL")
@@ -70,7 +75,7 @@ func extractExecutionState(
 
 	log.Info().Msg("init compactor")
 
-	compactor, err := complete.NewCompactor(led, diskWal, log, complete.DefaultCacheSize, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+	compactor, err := complete.NewCompactor(led, diskWal, log, complete.DefaultCacheSize, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), &metrics.NoopCollector{})
 	if err != nil {
 		return fmt.Errorf("cannot create compactor: %w", err)
 	}
@@ -84,30 +89,7 @@ func extractExecutionState(
 		<-compactor.Done()
 	}()
 
-	var migrations []ledger.Migration
-
-	if runMigrations {
-		rwf := reporters.NewReportFileWriterFactory(dir, log)
-
-		migrations = []ledger.Migration{
-			migrators.CreateAccountBasedMigration(
-				log,
-				nWorker,
-				[]migrators.AccountBasedMigration{
-					migrators.NewAtreeRegisterMigrator(
-						rwf,
-						flagValidateMigration,
-						flagLogVerboseValidationError,
-					),
-
-					&migrators.DeduplicateContractNamesMigration{},
-
-					// This will fix storage used discrepancies caused by the
-					// DeduplicateContractNamesMigration.
-					&migrators.AccountUsageMigrator{},
-				}),
-		}
-	}
+	migrations := newMigrations(log, dir, nWorker, runMigrations)
 
 	newState := ledger.State(targetHash)
 
@@ -134,6 +116,36 @@ func extractExecutionState(
 		log.Error().Err(err).Msgf("can not generate report for migrated state: %v", newMigratedState)
 	}
 
+	exportPayloads := len(outputPayloadFile) > 0
+	if exportPayloads {
+		payloads := newTrie.AllPayloads()
+
+		log.Info().Msgf("sorting %d payloads", len(payloads))
+
+		// Sort payloads to produce deterministic payload file with
+		// same sequence of payloads inside.
+		payloads = util.SortPayloadsByAddress(payloads, nWorker)
+
+		log.Info().Msgf("sorted %d payloads", len(payloads))
+
+		log.Info().Msgf("creating payloads file %s", outputPayloadFile)
+
+		exportedPayloadCount, err := util.CreatePayloadFile(
+			log,
+			outputPayloadFile,
+			payloads,
+			exportPayloadsByAddresses,
+			false, // payloads represents entire state.
+		)
+		if err != nil {
+			return fmt.Errorf("cannot generate payloads file: %w", err)
+		}
+
+		log.Info().Msgf("Exported %d payloads out of %d payloads", exportedPayloadCount, len(payloads))
+
+		return nil
+	}
+
 	migratedState, err := createCheckpoint(
 		newTrie,
 		log,
@@ -191,3 +203,181 @@ func writeStatusFile(fileName string, e error) error {
 	err := os.WriteFile(fileName, checkpointStatusJson, 0644)
 	return err
 }
+
+func extractExecutionStateFromPayloads(
+	log zerolog.Logger,
+	dir string,
+	outputDir string,
+	nWorker int, // number of concurrent worker to migation payloads
+	runMigrations bool,
+	inputPayloadFile string,
+	outputPayloadFile string,
+	exportPayloadsByAddresses []common.Address,
+) error {
+
+	inputPayloadsFromPartialState, payloads, err := util.ReadPayloadFile(log, inputPayloadFile)
+	if err != nil {
+		return err
+	}
+
+	log.Info().Msgf("read %d payloads", len(payloads))
+
+	migrations := newMigrations(log, dir, nWorker, runMigrations)
+
+	payloads, err = migratePayloads(log, payloads, migrations)
+	if err != nil {
+		return err
+	}
+
+	exportPayloads := len(outputPayloadFile) > 0
+	if exportPayloads {
+
+		log.Info().Msgf("sorting %d payloads", len(payloads))
+
+		// Sort payloads to produce deterministic payload file with
+		// same sequence of payloads inside.
+		payloads = util.SortPayloadsByAddress(payloads, nWorker)
+
+		log.Info().Msgf("sorted %d payloads", len(payloads))
+
+		log.Info().Msgf("creating payloads file %s", outputPayloadFile)
+
+		exportedPayloadCount, err := util.CreatePayloadFile(
+			log,
+			outputPayloadFile,
+			payloads,
+			exportPayloadsByAddresses,
+			inputPayloadsFromPartialState,
+		)
+		if err != nil {
+			return fmt.Errorf("cannot generate payloads file: %w", err)
+		}
+
+		log.Info().Msgf("Exported %d payloads out of %d payloads", exportedPayloadCount, len(payloads))
+
+		return nil
+	}
+
+	newTrie, err := createTrieFromPayloads(log, payloads)
+	if err != nil {
+		return err
+	}
+
+	migratedState, err := createCheckpoint(
+		newTrie,
+		log,
+		outputDir,
+		bootstrap.FilenameWALRootCheckpoint,
+	)
+	if err != nil {
+		return fmt.Errorf("cannot generate the output checkpoint: %w", err)
+	}
+
+	log.Info().Msgf(
+		"New state commitment for the exported state is: %s (base64: %s)",
+		migratedState.String(),
+		migratedState.Base64(),
+	)
+
+	return nil
+}
+
+func migratePayloads(logger zerolog.Logger, payloads []*ledger.Payload, migrations []ledger.Migration) ([]*ledger.Payload, error) {
+
+	if len(migrations) == 0 {
+		return payloads, nil
+	}
+
+	var err error
+	payloadCount := len(payloads)
+
+	// migrate payloads
+	for i, migrate := range migrations {
+		logger.Info().Msgf("migration %d/%d is underway", i, len(migrations))
+
+		start := time.Now()
+		payloads, err = migrate(payloads)
+		elapsed := time.Since(start)
+
+		if err != nil {
+			return nil, fmt.Errorf("error applying migration (%d): %w", i, err)
+		}
+
+		newPayloadCount := len(payloads)
+
+		if payloadCount != newPayloadCount {
+			logger.Warn().
+				Int("migration_step", i).
+				Int("expected_size", payloadCount).
+				Int("outcome_size", newPayloadCount).
+				Msg("payload counts has changed during migration, make sure this is expected.")
+		}
+		logger.Info().Str("timeTaken", elapsed.String()).Msgf("migration %d is done", i)
+
+		payloadCount = newPayloadCount
+	}
+
+	return payloads, nil
+}
+
+func createTrieFromPayloads(logger zerolog.Logger, payloads []*ledger.Payload) (*trie.MTrie, error) {
+	// get paths
+	paths, err := pathfinder.PathsFromPayloads(payloads, complete.DefaultPathFinderVersion)
+	if err != nil {
+		return nil, fmt.Errorf("cannot export checkpoint, can't construct paths: %w", err)
+	}
+
+	logger.Info().Msgf("constructing a new trie with migrated payloads (count: %d)...", len(payloads))
+
+	emptyTrie := trie.NewEmptyMTrie()
+
+	derefPayloads := make([]ledger.Payload, len(payloads))
+	for i, p := range payloads {
+		derefPayloads[i] = *p
+	}
+
+	// no need to prune the data since it has already been prunned through migrations
+	applyPruning := false
+	newTrie, _, err := trie.NewTrieWithUpdatedRegisters(emptyTrie, paths, derefPayloads, applyPruning)
+	if err != nil {
+		return nil, fmt.Errorf("constructing updated trie failed: %w", err)
+	}
+
+	return newTrie, nil
+}
+
+func newMigrations(
+	log zerolog.Logger,
+	dir string,
+	nWorker int, // number of concurrent worker to migation payloads
+	runMigrations bool,
+) []ledger.Migration {
+	if runMigrations {
+		rwf := reporters.NewReportFileWriterFactory(dir, log)
+
+		migrations := []ledger.Migration{
+			migrators.CreateAccountBasedMigration(
+				log,
+				nWorker,
+				[]migrators.AccountBasedMigration{
+					migrators.NewAtreeRegisterMigrator(
+						rwf,
+						flagValidateMigration,
+						flagLogVerboseValidationError,
+						flagContinueMigrationOnValidationError,
+						flagCheckStorageHealthBeforeMigration,
+						flagCheckStorageHealthAfterMigration,
+					),
+
+					&migrators.DeduplicateContractNamesMigration{},
+
+					// This will fix storage used discrepancies caused by the previous migrations
+					&migrators.AccountUsageMigrator{},
+				}),
+		}
+
+		return migrations
+	}
+
+	return nil
+}
diff --git a/cmd/util/cmd/execution-state-extract/execution_state_extract_test.go b/cmd/util/cmd/execution-state-extract/execution_state_extract_test.go
index 2f91ea7d603..800897084f9 100644
--- a/cmd/util/cmd/execution-state-extract/execution_state_extract_test.go
+++ b/cmd/util/cmd/execution-state-extract/execution_state_extract_test.go
@@ -2,14 +2,20 @@ package extract
 
 import (
 	"crypto/rand"
+	"encoding/hex"
 	"math"
+	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/atomic"
 
+	runtimeCommon "github.com/onflow/cadence/runtime/common"
+
 	"github.com/onflow/flow-go/cmd/util/cmd/common"
+	"github.com/onflow/flow-go/cmd/util/ledger/util"
 	"github.com/onflow/flow-go/ledger"
 	"github.com/onflow/flow-go/ledger/common/pathfinder"
 	"github.com/onflow/flow-go/ledger/complete"
@@ -66,6 +72,8 @@ func TestExtractExecutionState(t *testing.T) {
 				outdir,
 				10,
 				false,
+				"",
+				nil,
 			)
 			require.Error(t, err)
 		})
@@ -90,13 +98,13 @@ func TestExtractExecutionState(t *testing.T) {
 			require.NoError(t, err)
 			f, err := complete.NewLedger(diskWal, size*10, metr, zerolog.Nop(), complete.DefaultPathFinderVersion)
 			require.NoError(t, err)
-			compactor, err := complete.NewCompactor(f, diskWal, zerolog.Nop(), uint(size), checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+			compactor, err := complete.NewCompactor(f, diskWal, zerolog.Nop(), uint(size), checkpointDistance, checkpointsToKeep, atomic.NewBool(false), &metrics.NoopCollector{})
 			require.NoError(t, err)
 			<-compactor.Ready()
 
 			var stateCommitment = f.InitialState()
 
-			//saved data after updates
+			// saved data after updates
 			keysValuesByCommit := make(map[string]map[string]keyPair)
 			commitsByBlocks := make(map[flow.Identifier]ledger.State)
 			blocksInOrder := make([]flow.Identifier, size)
@@ -108,7 +116,7 @@ func TestExtractExecutionState(t *testing.T) {
 				require.NoError(t, err)
 
 				stateCommitment, _, err = f.Set(update)
-				//stateCommitment, err = f.UpdateRegisters(keys, values, stateCommitment)
+				// stateCommitment, err = f.UpdateRegisters(keys, values, stateCommitment)
 				require.NoError(t, err)
 
 				// generate random block and map it to state commitment
@@ -135,13 +143,13 @@ func TestExtractExecutionState(t *testing.T) {
 			err = db.Close()
 			require.NoError(t, err)
 
-			//for blockID, stateCommitment := range commitsByBlocks {
+			// for blockID, stateCommitment := range commitsByBlocks {
 
 			for i, blockID := range blocksInOrder {
 
 				stateCommitment := commitsByBlocks[blockID]
 
-				//we need fresh output dir to prevent contamination
+				// we need fresh output dir to prevent contamination
 				unittest.RunWithTempDir(t, func(outdir string) {
 
 					Cmd.SetArgs([]string{
@@ -166,7 +174,7 @@ func TestExtractExecutionState(t *testing.T) {
 						checkpointDistance = math.MaxInt // A large number to prevent checkpoint creation.
 						checkpointsToKeep  = 1
 					)
-					compactor, err := complete.NewCompactor(storage, diskWal, zerolog.Nop(), uint(size), checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+					compactor, err := complete.NewCompactor(storage, diskWal, zerolog.Nop(), uint(size), checkpointDistance, checkpointsToKeep, atomic.NewBool(false), &metrics.NoopCollector{})
 					require.NoError(t, err)
 
 					<-compactor.Ready()
@@ -182,7 +190,7 @@ func TestExtractExecutionState(t *testing.T) {
 					require.NoError(t, err)
 
 					registerValues, err := storage.Get(query)
-					//registerValues, err := mForest.Read([]byte(stateCommitment), keys)
+					// registerValues, err := mForest.Read([]byte(stateCommitment), keys)
 					require.NoError(t, err)
 
 					for i, key := range keys {
@@ -190,7 +198,7 @@ func TestExtractExecutionState(t *testing.T) {
 						require.Equal(t, data[key.String()].value, registerValue)
 					}
 
-					//make sure blocks after this one are not in checkpoint
+					// make sure blocks after this one are not in checkpoint
 					// ie - extraction stops after hitting right hash
 					for j := i + 1; j < len(blocksInOrder); j++ {
 
@@ -207,6 +215,413 @@ func TestExtractExecutionState(t *testing.T) {
 	})
 }
 
+// TestExtractPayloadsFromExecutionState tests state extraction with checkpoint as input and payload as output.
+func TestExtractPayloadsFromExecutionState(t *testing.T) {
+	metr := &metrics.NoopCollector{}
+
+	const payloadFileName = "root.payload"
+
+	t.Run("all payloads", func(t *testing.T) {
+		withDirs(t, func(_, execdir, outdir string) {
+
+			const (
+				checkpointDistance = math.MaxInt // A large number to prevent checkpoint creation.
+				checkpointsToKeep  = 1
+			)
+
+			outputPayloadFileName := filepath.Join(outdir, payloadFileName)
+
+			size := 10
+
+			diskWal, err := wal.NewDiskWAL(zerolog.Nop(), nil, metrics.NewNoopCollector(), execdir, size, pathfinder.PathByteSize, wal.SegmentSize)
+			require.NoError(t, err)
+			f, err := complete.NewLedger(diskWal, size*10, metr, zerolog.Nop(), complete.DefaultPathFinderVersion)
+			require.NoError(t, err)
+			compactor, err := complete.NewCompactor(f, diskWal, zerolog.Nop(), uint(size), checkpointDistance, checkpointsToKeep, atomic.NewBool(false), &metrics.NoopCollector{})
+			require.NoError(t, err)
+			<-compactor.Ready()
+
+			var stateCommitment = f.InitialState()
+
+			// Save generated data after updates
+			keysValues := make(map[string]keyPair)
+
+			for i := 0; i < size; i++ {
+				keys, values := getSampleKeyValues(i)
+
+				update, err := ledger.NewUpdate(stateCommitment, keys, values)
+				require.NoError(t, err)
+
+				stateCommitment, _, err = f.Set(update)
+				require.NoError(t, err)
+
+				for j, key := range keys {
+					keysValues[key.String()] = keyPair{
+						key:   key,
+						value: values[j],
+					}
+				}
+			}
+
+			<-f.Done()
+			<-compactor.Done()
+
+			tries, err := f.Tries()
+			require.NoError(t, err)
+
+			err = wal.StoreCheckpointV6SingleThread(tries, execdir, "checkpoint.00000001", zerolog.Nop())
+			require.NoError(t, err)
+
+			// Export all payloads
+			Cmd.SetArgs([]string{
+				"--execution-state-dir", execdir,
+				"--output-dir", outdir,
+				"--state-commitment", hex.EncodeToString(stateCommitment[:]),
+				"--no-migration",
+				"--no-report",
+				"--output-payload-filename", outputPayloadFileName,
+				"--chain", flow.Emulator.Chain().String()})
+
+			err = Cmd.Execute()
+			require.NoError(t, err)
+
+			// Verify exported payloads.
+			partialState, payloadsFromFile, err := util.ReadPayloadFile(zerolog.Nop(), outputPayloadFileName)
+			require.NoError(t, err)
+			require.Equal(t, len(keysValues), len(payloadsFromFile))
+			require.False(t, partialState)
+
+			for _, payloadFromFile := range payloadsFromFile {
+				k, err := payloadFromFile.Key()
+				require.NoError(t, err)
+
+				kv, exist := keysValues[k.String()]
+				require.True(t, exist)
+				require.Equal(t, kv.value, payloadFromFile.Value())
+			}
+		})
+	})
+
+	t.Run("some payloads", func(t *testing.T) {
+		withDirs(t, func(_, execdir, outdir string) {
+			const (
+				checkpointDistance = math.MaxInt // A large number to prevent checkpoint creation.
+				checkpointsToKeep  = 1
+			)
+
+			outputPayloadFileName := filepath.Join(outdir, payloadFileName)
+
+			size := 10
+
+			diskWal, err := wal.NewDiskWAL(zerolog.Nop(), nil, metrics.NewNoopCollector(), execdir, size, pathfinder.PathByteSize, wal.SegmentSize)
+			require.NoError(t, err)
+			f, err := complete.NewLedger(diskWal, size*10, metr, zerolog.Nop(), complete.DefaultPathFinderVersion)
+			require.NoError(t, err)
+			compactor, err := complete.NewCompactor(f, diskWal, zerolog.Nop(), uint(size), checkpointDistance, checkpointsToKeep, atomic.NewBool(false), &metrics.NoopCollector{})
+			require.NoError(t, err)
+			<-compactor.Ready()
+
+			var stateCommitment = f.InitialState()
+
+			// Save generated data after updates
+			keysValues := make(map[string]keyPair)
+
+			for i := 0; i < size; i++ {
+				keys, values := getSampleKeyValues(i)
+
+				update, err := ledger.NewUpdate(stateCommitment, keys, values)
+				require.NoError(t, err)
+
+				stateCommitment, _, err = f.Set(update)
+				require.NoError(t, err)
+
+				for j, key := range keys {
+					keysValues[key.String()] = keyPair{
+						key:   key,
+						value: values[j],
+					}
+				}
+			}
+
+			<-f.Done()
+			<-compactor.Done()
+
+			tries, err := f.Tries()
+			require.NoError(t, err)
+
+			err = wal.StoreCheckpointV6SingleThread(tries, execdir, "checkpoint.00000001", zerolog.Nop())
+			require.NoError(t, err)
+
+			const selectedAddressCount = 10
+			selectedAddresses := make(map[string]struct{})
+			selectedKeysValues := make(map[string]keyPair)
+			for k, kv := range keysValues {
+				owner := kv.key.KeyParts[0].Value
+				if len(owner) != runtimeCommon.AddressLength {
+					continue
+				}
+
+				address, err := runtimeCommon.BytesToAddress(owner)
+				require.NoError(t, err)
+
+				if len(selectedAddresses) < selectedAddressCount {
+					selectedAddresses[address.Hex()] = struct{}{}
+				}
+
+				if _, exist := selectedAddresses[address.Hex()]; exist {
+					selectedKeysValues[k] = kv
+				}
+			}
+
+			addresses := make([]string, 0, len(selectedAddresses))
+			for address := range selectedAddresses {
+				addresses = append(addresses, address)
+			}
+
+			// Export selected payloads
+			Cmd.SetArgs([]string{
+				"--execution-state-dir", execdir,
+				"--output-dir", outdir,
+				"--state-commitment", hex.EncodeToString(stateCommitment[:]),
+				"--no-migration",
+				"--no-report",
+				"--output-payload-filename", outputPayloadFileName,
+				"--extract-payloads-by-address", strings.Join(addresses, ","),
+				"--chain", flow.Emulator.Chain().String()})
+
+			err = Cmd.Execute()
+			require.NoError(t, err)
+
+			// Verify exported payloads.
+			partialState, payloadsFromFile, err := util.ReadPayloadFile(zerolog.Nop(), outputPayloadFileName)
+			require.NoError(t, err)
+			require.Equal(t, len(selectedKeysValues), len(payloadsFromFile))
+			require.True(t, partialState)
+
+			for _, payloadFromFile := range payloadsFromFile {
+				k, err := payloadFromFile.Key()
+				require.NoError(t, err)
+
+				kv, exist := selectedKeysValues[k.String()]
+				require.True(t, exist)
+				require.Equal(t, kv.value, payloadFromFile.Value())
+			}
+		})
+	})
+}
+
+// TestExtractStateFromPayloads tests state extraction with payload as input.
+func TestExtractStateFromPayloads(t *testing.T) {
+
+	const payloadFileName = "root.payload"
+
+	t.Run("create checkpoint", func(t *testing.T) {
+		withDirs(t, func(_, execdir, outdir string) {
+			size := 10
+
+			inputPayloadFileName := filepath.Join(execdir, payloadFileName)
+
+			// Generate some data
+			keysValues := make(map[string]keyPair)
+			var payloads []*ledger.Payload
+
+			for i := 0; i < size; i++ {
+				keys, values := getSampleKeyValues(i)
+
+				for j, key := range keys {
+					keysValues[key.String()] = keyPair{
+						key:   key,
+						value: values[j],
+					}
+
+					payloads = append(payloads, ledger.NewPayload(key, values[j]))
+				}
+			}
+
+			numOfPayloadWritten, err := util.CreatePayloadFile(
+				zerolog.Nop(),
+				inputPayloadFileName,
+				payloads,
+				nil,
+				false,
+			)
+			require.NoError(t, err)
+			require.Equal(t, len(payloads), numOfPayloadWritten)
+
+			// Export checkpoint file
+			Cmd.SetArgs([]string{
+				"--execution-state-dir", execdir,
+				"--output-dir", outdir,
+				"--no-migration",
+				"--no-report",
+				"--state-commitment", "",
+				"--input-payload-filename", inputPayloadFileName,
+				"--output-payload-filename", "",
+				"--extract-payloads-by-address", "",
+				"--chain", flow.Emulator.Chain().String()})
+
+			err = Cmd.Execute()
+			require.NoError(t, err)
+
+			tries, err := wal.OpenAndReadCheckpointV6(outdir, "root.checkpoint", zerolog.Nop())
+			require.NoError(t, err)
+			require.Equal(t, 1, len(tries))
+
+			// Verify exported checkpoint
+			payloadsFromFile := tries[0].AllPayloads()
+			require.NoError(t, err)
+			require.Equal(t, len(keysValues), len(payloadsFromFile))
+
+			for _, payloadFromFile := range payloadsFromFile {
+				k, err := payloadFromFile.Key()
+				require.NoError(t, err)
+
+				kv, exist := keysValues[k.String()]
+				require.True(t, exist)
+
+				require.Equal(t, kv.value, payloadFromFile.Value())
+			}
+		})
+
+	})
+
+	t.Run("create payloads", func(t *testing.T) {
+		withDirs(t, func(_, execdir, outdir string) {
+			inputPayloadFileName := filepath.Join(execdir, payloadFileName)
+			outputPayloadFileName := filepath.Join(outdir, "selected.payload")
+
+			size := 10
+
+			// Generate some data
+			keysValues := make(map[string]keyPair)
+			var payloads []*ledger.Payload
+
+			for i := 0; i < size; i++ {
+				keys, values := getSampleKeyValues(i)
+
+				for j, key := range keys {
+					keysValues[key.String()] = keyPair{
+						key:   key,
+						value: values[j],
+					}
+
+					payloads = append(payloads, ledger.NewPayload(key, values[j]))
+				}
+			}
+
+			numOfPayloadWritten, err := util.CreatePayloadFile(
+				zerolog.Nop(),
+				inputPayloadFileName,
+				payloads,
+				nil,
+				false,
+			)
+			require.NoError(t, err)
+			require.Equal(t, len(payloads), numOfPayloadWritten)
+
+			// Export all payloads
+			Cmd.SetArgs([]string{
+				"--execution-state-dir", execdir,
+				"--output-dir", outdir,
+				"--no-migration",
+				"--no-report",
+				"--state-commitment", "",
+				"--input-payload-filename", inputPayloadFileName,
+				"--output-payload-filename", outputPayloadFileName,
+				"--extract-payloads-by-address", "",
+				"--chain", flow.Emulator.Chain().String()})
+
+			err = Cmd.Execute()
+			require.NoError(t, err)
+
+			// Verify exported payloads.
+			partialState, payloadsFromFile, err := util.ReadPayloadFile(zerolog.Nop(), outputPayloadFileName)
+			require.NoError(t, err)
+			require.Equal(t, len(keysValues), len(payloadsFromFile))
+			require.False(t, partialState)
+
+			for _, payloadFromFile := range payloadsFromFile {
+				k, err := payloadFromFile.Key()
+				require.NoError(t, err)
+
+				kv, exist := keysValues[k.String()]
+				require.True(t, exist)
+
+				require.Equal(t, kv.value, payloadFromFile.Value())
+			}
+		})
+	})
+
+	t.Run("input is partial state", func(t *testing.T) {
+		withDirs(t, func(_, execdir, outdir string) {
+			size := 10
+
+			inputPayloadFileName := filepath.Join(execdir, payloadFileName)
+			outputPayloadFileName := filepath.Join(outdir, "selected.payload")
+
+			// Generate some data
+			keysValues := make(map[string]keyPair)
+			var payloads []*ledger.Payload
+
+			for i := 0; i < size; i++ {
+				keys, values := getSampleKeyValues(i)
+
+				for j, key := range keys {
+					keysValues[key.String()] = keyPair{
+						key:   key,
+						value: values[j],
+					}
+
+					payloads = append(payloads, ledger.NewPayload(key, values[j]))
+				}
+			}
+
+			// Create input payload file that represents partial state
+			numOfPayloadWritten, err := util.CreatePayloadFile(
+				zerolog.Nop(),
+				inputPayloadFileName,
+				payloads,
+				nil,
+				true,
+			)
+			require.NoError(t, err)
+			require.Equal(t, len(payloads), numOfPayloadWritten)
+
+			// Since input payload file is partial state, --allow-partial-state-from-payload-file must be specified.
+			Cmd.SetArgs([]string{
+				"--execution-state-dir", execdir,
+				"--output-dir", outdir,
+				"--no-migration",
+				"--no-report",
+				"--state-commitment", "",
+				"--input-payload-filename", inputPayloadFileName,
+				"--output-payload-filename", outputPayloadFileName,
+				"--extract-payloads-by-address", "",
+				"--allow-partial-state-from-payload-file",
+				"--chain", flow.Emulator.Chain().String()})
+
+			err = Cmd.Execute()
+			require.NoError(t, err)
+
+			// Verify exported payloads.
+			partialState, payloadsFromFile, err := util.ReadPayloadFile(zerolog.Nop(), outputPayloadFileName)
+			require.NoError(t, err)
+			require.Equal(t, len(keysValues), len(payloadsFromFile))
+			require.True(t, partialState)
+
+			for _, payloadFromFile := range payloadsFromFile {
+				k, err := payloadFromFile.Key()
+				require.NoError(t, err)
+
+				kv, exist := keysValues[k.String()]
+				require.True(t, exist)
+
+				require.Equal(t, kv.value, payloadFromFile.Value())
+			}
+		})
+	})
+}
+
 func getSampleKeyValues(i int) ([]ledger.Key, []ledger.Value) {
 	switch i {
 	case 0:
@@ -226,7 +641,8 @@ func getSampleKeyValues(i int) ([]ledger.Key, []ledger.Value) {
 		keys := make([]ledger.Key, 0)
 		values := make([]ledger.Value, 0)
 		for j := 0; j < 10; j++ {
-			address := make([]byte, 32)
+			// address := make([]byte, 32)
+			address := make([]byte, 8)
 			_, err := rand.Read(address)
 			if err != nil {
 				panic(err)
diff --git a/cmd/util/cmd/extract-payloads-by-address/cmd.go b/cmd/util/cmd/extract-payloads-by-address/cmd.go
new file mode 100644
index 00000000000..3d66ea65cf1
--- /dev/null
+++ b/cmd/util/cmd/extract-payloads-by-address/cmd.go
@@ -0,0 +1,115 @@
+package extractpayloads
+
+import (
+	"encoding/hex"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/rs/zerolog/log"
+	"github.com/spf13/cobra"
+
+	"github.com/onflow/cadence/runtime/common"
+
+	"github.com/onflow/flow-go/cmd/util/ledger/util"
+)
+
+var (
+	flagInputPayloadFileName  string
+	flagOutputPayloadFileName string
+	flagAddresses             string
+)
+
+var Cmd = &cobra.Command{
+	Use:   "extract-payload-by-address",
+	Short: "Read payload file and generate payload file containing payloads with specified addresses",
+	Run:   run,
+}
+
+func init() {
+	Cmd.Flags().StringVar(
+		&flagInputPayloadFileName,
+		"input-filename",
+		"",
+		"Input payload file name")
+	_ = Cmd.MarkFlagRequired("input-filename")
+
+	Cmd.Flags().StringVar(
+		&flagOutputPayloadFileName,
+		"output-filename",
+		"",
+		"Output payload file name")
+	_ = Cmd.MarkFlagRequired("output-filename")
+
+	Cmd.Flags().StringVar(
+		&flagAddresses,
+		"addresses",
+		"",
+		"extract payloads of addresses (comma separated hex-encoded addresses) to file specified by output-payload-filename",
+	)
+	_ = Cmd.MarkFlagRequired("addresses")
+}
+
+func run(*cobra.Command, []string) {
+
+	if _, err := os.Stat(flagInputPayloadFileName); os.IsNotExist(err) {
+		log.Fatal().Msgf("Input file %s doesn't exist", flagInputPayloadFileName)
+	}
+
+	if _, err := os.Stat(flagOutputPayloadFileName); os.IsExist(err) {
+		log.Fatal().Msgf("Output file %s exists", flagOutputPayloadFileName)
+	}
+
+	addresses, err := parseAddresses(strings.Split(flagAddresses, ","))
+	if err != nil {
+		log.Fatal().Err(err)
+	}
+
+	log.Info().Msgf(
+		"extracting payloads with address %v from %s to %s",
+		addresses,
+		flagInputPayloadFileName,
+		flagOutputPayloadFileName,
+	)
+
+	inputPayloadsFromPartialState, payloads, err := util.ReadPayloadFile(log.Logger, flagInputPayloadFileName)
+	if err != nil {
+		log.Fatal().Err(err)
+	}
+
+	numOfPayloadWritten, err := util.CreatePayloadFile(log.Logger, flagOutputPayloadFileName, payloads, addresses, inputPayloadsFromPartialState)
+	if err != nil {
+		log.Fatal().Err(err)
+	}
+
+	log.Info().Msgf(
+		"extracted %d payloads with address %v from %s to %s",
+		numOfPayloadWritten,
+		addresses,
+		flagInputPayloadFileName,
+		flagOutputPayloadFileName,
+	)
+}
+
+func parseAddresses(hexAddresses []string) ([]common.Address, error) {
+	if len(hexAddresses) == 0 {
+		return nil, fmt.Errorf("at least one address must be provided")
+	}
+
+	addresses := make([]common.Address, len(hexAddresses))
+	for i, hexAddr := range hexAddresses {
+		b, err := hex.DecodeString(strings.TrimSpace(hexAddr))
+		if err != nil {
+			return nil, fmt.Errorf("address is not hex encoded %s: %w", strings.TrimSpace(hexAddr), err)
+		}
+
+		addr, err := common.BytesToAddress(b)
+		if err != nil {
+			return nil, fmt.Errorf("cannot decode address %x", b)
+		}
+
+		addresses[i] = addr
+	}
+
+	return addresses, nil
+}
diff --git a/cmd/util/cmd/extract-payloads-by-address/extract_payloads_test.go b/cmd/util/cmd/extract-payloads-by-address/extract_payloads_test.go
new file mode 100644
index 00000000000..a30574b926a
--- /dev/null
+++ b/cmd/util/cmd/extract-payloads-by-address/extract_payloads_test.go
@@ -0,0 +1,243 @@
+package extractpayloads
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/hex"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/cadence/runtime/common"
+
+	"github.com/onflow/flow-go/cmd/util/ledger/util"
+	"github.com/onflow/flow-go/ledger"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+type keyPair struct {
+	key   ledger.Key
+	value ledger.Value
+}
+
+func TestExtractPayloads(t *testing.T) {
+
+	t.Run("some payloads", func(t *testing.T) {
+
+		unittest.RunWithTempDir(t, func(datadir string) {
+
+			inputFile := filepath.Join(datadir, "input.payload")
+			outputFile := filepath.Join(datadir, "output.payload")
+
+			size := 10
+
+			// Generate some data
+			keysValues := make(map[string]keyPair)
+			var payloads []*ledger.Payload
+
+			for i := 0; i < size; i++ {
+				keys, values := getSampleKeyValues(i)
+
+				for j, key := range keys {
+					keysValues[key.String()] = keyPair{
+						key:   key,
+						value: values[j],
+					}
+
+					payloads = append(payloads, ledger.NewPayload(key, values[j]))
+				}
+			}
+
+			numOfPayloadWritten, err := util.CreatePayloadFile(zerolog.Nop(), inputFile, payloads, nil, false)
+			require.NoError(t, err)
+			require.Equal(t, len(payloads), numOfPayloadWritten)
+
+			const selectedAddressCount = 10
+			selectedAddresses := make(map[string]struct{})
+			selectedKeysValues := make(map[string]keyPair)
+			for k, kv := range keysValues {
+				owner := kv.key.KeyParts[0].Value
+				if len(owner) != common.AddressLength {
+					continue
+				}
+
+				address, err := common.BytesToAddress(owner)
+				require.NoError(t, err)
+
+				if len(selectedAddresses) < selectedAddressCount {
+					selectedAddresses[address.Hex()] = struct{}{}
+				}
+
+				if _, exist := selectedAddresses[address.Hex()]; exist {
+					selectedKeysValues[k] = kv
+				}
+			}
+
+			addresses := make([]string, 0, len(selectedAddresses))
+			for address := range selectedAddresses {
+				addresses = append(addresses, address)
+			}
+
+			// Export selected payloads
+			Cmd.SetArgs([]string{
+				"--input-filename", inputFile,
+				"--output-filename", outputFile,
+				"--addresses", strings.Join(addresses, ","),
+			})
+
+			err = Cmd.Execute()
+			require.NoError(t, err)
+
+			// Verify exported payloads.
+			partialState, payloadsFromFile, err := util.ReadPayloadFile(zerolog.Nop(), outputFile)
+			require.NoError(t, err)
+			require.Equal(t, len(selectedKeysValues), len(payloadsFromFile))
+			require.True(t, partialState)
+
+			for _, payloadFromFile := range payloadsFromFile {
+				k, err := payloadFromFile.Key()
+				require.NoError(t, err)
+
+				kv, exist := selectedKeysValues[k.String()]
+				require.True(t, exist)
+				require.Equal(t, kv.value, payloadFromFile.Value())
+			}
+		})
+	})
+
+	t.Run("no payloads", func(t *testing.T) {
+
+		emptyAddress := common.Address{}
+
+		unittest.RunWithTempDir(t, func(datadir string) {
+
+			inputFile := filepath.Join(datadir, "input.payload")
+			outputFile := filepath.Join(datadir, "output.payload")
+
+			size := 10
+
+			// Generate some data
+			keysValues := make(map[string]keyPair)
+			var payloads []*ledger.Payload
+
+			for i := 0; i < size; i++ {
+				keys, values := getSampleKeyValues(i)
+
+				for j, key := range keys {
+					if bytes.Equal(key.KeyParts[0].Value, emptyAddress[:]) {
+						continue
+					}
+					keysValues[key.String()] = keyPair{
+						key:   key,
+						value: values[j],
+					}
+
+					payloads = append(payloads, ledger.NewPayload(key, values[j]))
+				}
+			}
+
+			numOfPayloadWritten, err := util.CreatePayloadFile(zerolog.Nop(), inputFile, payloads, nil, false)
+			require.NoError(t, err)
+			require.Equal(t, len(payloads), numOfPayloadWritten)
+
+			// Export selected payloads
+			Cmd.SetArgs([]string{
+				"--input-filename", inputFile,
+				"--output-filename", outputFile,
+				"--addresses", hex.EncodeToString(emptyAddress[:]),
+			})
+
+			err = Cmd.Execute()
+			require.NoError(t, err)
+
+			// Verify exported payloads.
+			partialState, payloadsFromFile, err := util.ReadPayloadFile(zerolog.Nop(), outputFile)
+			require.NoError(t, err)
+			require.Equal(t, 0, len(payloadsFromFile))
+			require.True(t, partialState)
+		})
+	})
+}
+
+func getSampleKeyValues(i int) ([]ledger.Key, []ledger.Value) {
+	switch i {
+	case 0:
+		return []ledger.Key{getKey("", "uuid"), getKey("", "account_address_state")},
+			[]ledger.Value{[]byte{'1'}, []byte{'A'}}
+	case 1:
+		return []ledger.Key{getKey("ADDRESS", "public_key_count"),
+				getKey("ADDRESS", "public_key_0"),
+				getKey("ADDRESS", "exists"),
+				getKey("ADDRESS", "storage_used")},
+			[]ledger.Value{[]byte{1}, []byte("PUBLICKEYXYZ"), []byte{1}, []byte{100}}
+	case 2:
+		// TODO change the contract_names to CBOR encoding
+		return []ledger.Key{getKey("ADDRESS", "contract_names"), getKey("ADDRESS", "code.mycontract")},
+			[]ledger.Value{[]byte("mycontract"), []byte("CONTRACT Content")}
+	default:
+		keys := make([]ledger.Key, 0)
+		values := make([]ledger.Value, 0)
+		for j := 0; j < 10; j++ {
+			// address := make([]byte, 32)
+			address := make([]byte, 8)
+			_, err := rand.Read(address)
+			if err != nil {
+				panic(err)
+			}
+			keys = append(keys, getKey(string(address), "test"))
+			values = append(values, getRandomCadenceValue())
+		}
+		return keys, values
+	}
+}
+
+func getKey(owner, key string) ledger.Key {
+	return ledger.Key{KeyParts: []ledger.KeyPart{
+		{Type: uint16(0), Value: []byte(owner)},
+		{Type: uint16(2), Value: []byte(key)},
+	},
+	}
+}
+
+func getRandomCadenceValue() ledger.Value {
+
+	randomPart := make([]byte, 10)
+	_, err := rand.Read(randomPart)
+	if err != nil {
+		panic(err)
+	}
+	valueBytes := []byte{
+		// magic prefix
+		0x0, 0xca, 0xde, 0x0, 0x4,
+		// tag
+		0xd8, 132,
+		// array, 5 items follow
+		0x85,
+
+		// tag
+		0xd8, 193,
+		// UTF-8 string, length 4
+		0x64,
+		// t, e, s, t
+		0x74, 0x65, 0x73, 0x74,
+
+		// nil
+		0xf6,
+
+		// positive integer 1
+		0x1,
+
+		// array, 0 items follow
+		0x80,
+
+		// UTF-8 string, length 10
+		0x6a,
+		0x54, 0x65, 0x73, 0x74, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74,
+	}
+
+	valueBytes = append(valueBytes, randomPart...)
+	return ledger.Value(valueBytes)
+}
diff --git a/cmd/util/cmd/read-badger/cmd/epoch_statuses.go b/cmd/util/cmd/read-badger/cmd/epoch_statuses.go
deleted file mode 100644
index 7d0cd055f03..00000000000
--- a/cmd/util/cmd/read-badger/cmd/epoch_statuses.go
+++ /dev/null
@@ -1,41 +0,0 @@
-package cmd
-
-import (
-	"github.com/rs/zerolog/log"
-	"github.com/spf13/cobra"
-
-	"github.com/onflow/flow-go/cmd/util/cmd/common"
-	"github.com/onflow/flow-go/model/flow"
-)
-
-func init() {
-	rootCmd.AddCommand(epochStatusesCmd)
-
-	epochStatusesCmd.Flags().StringVarP(&flagBlockID, "block-id", "b", "", "the block id of which to query the epoch status")
-	_ = epochStatusesCmd.MarkFlagRequired("block-id")
-}
-
-var epochStatusesCmd = &cobra.Command{
-	Use:   "epoch-statuses",
-	Short: "get epoch statuses by block ID",
-	Run: func(cmd *cobra.Command, args []string) {
-		storages, db := InitStorages()
-		defer db.Close()
-
-		log.Info().Msgf("got flag block id: %s", flagBlockID)
-		blockID, err := flow.HexStringToIdentifier(flagBlockID)
-		if err != nil {
-			log.Error().Err(err).Msg("malformed block id")
-			return
-		}
-
-		log.Info().Msgf("getting epoch status by block id: %v", blockID)
-		epochStatus, err := storages.Statuses.ByBlockID(blockID)
-		if err != nil {
-			log.Error().Err(err).Msgf("could not get epoch status for block id: %v", blockID)
-			return
-		}
-
-		common.PrettyPrint(epochStatus)
-	},
-}
diff --git a/cmd/util/cmd/read-badger/cmd/protocol_state.go b/cmd/util/cmd/read-badger/cmd/protocol_state.go
new file mode 100644
index 00000000000..701ecac2c2a
--- /dev/null
+++ b/cmd/util/cmd/read-badger/cmd/protocol_state.go
@@ -0,0 +1,41 @@
+package cmd
+
+import (
+	"github.com/rs/zerolog/log"
+	"github.com/spf13/cobra"
+
+	"github.com/onflow/flow-go/cmd/util/cmd/common"
+	"github.com/onflow/flow-go/model/flow"
+)
+
+func init() {
+	rootCmd.AddCommand(protocolStateCmd)
+
+	protocolStateCmd.Flags().StringVarP(&flagBlockID, "block-id", "b", "", "the block id of which to query the protocol state")
+	_ = protocolStateCmd.MarkFlagRequired("block-id")
+}
+
+var protocolStateCmd = &cobra.Command{
+	Use:   "protocol-state",
+	Short: "get protocol state by block ID",
+	Run: func(cmd *cobra.Command, args []string) {
+		storages, db := InitStorages()
+		defer db.Close()
+
+		log.Info().Msgf("got flag block id: %s", flagBlockID)
+		blockID, err := flow.HexStringToIdentifier(flagBlockID)
+		if err != nil {
+			log.Error().Err(err).Msg("malformed block id")
+			return
+		}
+
+		log.Info().Msgf("getting protocol state by block id: %v", blockID)
+		protocolState, err := storages.ProtocolState.ByBlockID(blockID)
+		if err != nil {
+			log.Error().Err(err).Msgf("could not get protocol state for block id: %v", blockID)
+			return
+		}
+
+		common.PrettyPrint(protocolState)
+	},
+}
diff --git a/cmd/util/cmd/read-hotstuff/cmd/get_liveness.go b/cmd/util/cmd/read-hotstuff/cmd/get_liveness.go
index e5c68d0dfc6..f47819311db 100644
--- a/cmd/util/cmd/read-hotstuff/cmd/get_liveness.go
+++ b/cmd/util/cmd/read-hotstuff/cmd/get_liveness.go
@@ -27,11 +27,7 @@ func runGetLivenessData(*cobra.Command, []string) {
 		log.Fatal().Err(err).Msg("could not init protocol state")
 	}
 
-	rootBlock, err := state.Params().FinalizedRoot()
-	if err != nil {
-		log.Fatal().Err(err).Msgf("could not get root block")
-	}
-
+	rootBlock := state.Params().FinalizedRoot()
 	reader := NewHotstuffReader(db, rootBlock.ChainID)
 
 	log.Info().Msg("getting hotstuff liveness data")
diff --git a/cmd/util/cmd/read-hotstuff/cmd/get_safety.go b/cmd/util/cmd/read-hotstuff/cmd/get_safety.go
index a9e4e6c0bc6..7f43a69686d 100644
--- a/cmd/util/cmd/read-hotstuff/cmd/get_safety.go
+++ b/cmd/util/cmd/read-hotstuff/cmd/get_safety.go
@@ -27,10 +27,7 @@ func runGetSafetyData(*cobra.Command, []string) {
 		log.Fatal().Err(err).Msg("could not init protocol state")
 	}
 
-	rootBlock, err := state.Params().FinalizedRoot()
-	if err != nil {
-		log.Fatal().Err(err).Msgf("could not get root block")
-	}
+	rootBlock := state.Params().FinalizedRoot()
 
 	reader := NewHotstuffReader(db, rootBlock.ChainID)
 
diff --git a/cmd/util/cmd/read-protocol-state/cmd/snapshot.go b/cmd/util/cmd/read-protocol-state/cmd/snapshot.go
index 13386195ab3..765a55fd02f 100644
--- a/cmd/util/cmd/read-protocol-state/cmd/snapshot.go
+++ b/cmd/util/cmd/read-protocol-state/cmd/snapshot.go
@@ -5,10 +5,16 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/onflow/flow-go/cmd/util/cmd/common"
+	commonFuncs "github.com/onflow/flow-go/cmd/util/common"
+	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/state/protocol"
 	"github.com/onflow/flow-go/state/protocol/inmem"
 )
 
+var flagCheckpointDir string
+var flagCheckpointScanStep uint
+var flagCheckpointScanEndHeight int64
+
 var SnapshotCmd = &cobra.Command{
 	Use:   "snapshot",
 	Short: "Read snapshot from protocol state",
@@ -26,6 +32,15 @@ func init() {
 
 	SnapshotCmd.Flags().BoolVar(&flagSealed, "sealed", false,
 		"get sealed block")
+
+	SnapshotCmd.Flags().StringVar(&flagCheckpointDir, "checkpoint-dir", "",
+		"(execution node only) get snapshot from the latest checkpoint file in the given checkpoint directory")
+
+	SnapshotCmd.Flags().UintVar(&flagCheckpointScanStep, "checkpoint-scan-step", 0,
+		"(execution node only) scan step for finding sealed height by checkpoint (use with --checkpoint-dir flag)")
+
+	SnapshotCmd.Flags().Int64Var(&flagCheckpointScanEndHeight, "checkpoint-scan-end-height", -1,
+		"(execution node only) scan end height for finding sealed height by checkpoint (use with --checkpoint-dir flag)")
 }
 
 func runSnapshot(*cobra.Command, []string) {
@@ -49,6 +64,29 @@ func runSnapshot(*cobra.Command, []string) {
 	} else if flagSealed {
 		log.Info().Msgf("get last sealed snapshot")
 		snapshot = state.Sealed()
+	} else if flagCheckpointDir != "" {
+		log.Info().Msgf("get snapshot for latest checkpoint in directory %v (step: %v, endHeight: %v)",
+			flagCheckpointDir, flagCheckpointScanStep, flagCheckpointScanEndHeight)
+		var protocolSnapshot protocol.Snapshot
+		var sealedHeight uint64
+		var sealedCommit flow.StateCommitment
+		var checkpointFile string
+		if flagCheckpointScanEndHeight < 0 {
+			// using default end height which is the last sealed height
+			protocolSnapshot, sealedHeight, sealedCommit, checkpointFile, err = commonFuncs.GenerateProtocolSnapshotForCheckpoint(
+				log.Logger, state, storages.Headers, storages.Seals, flagCheckpointDir, flagCheckpointScanStep)
+		} else {
+			// using customized end height
+			protocolSnapshot, sealedHeight, sealedCommit, checkpointFile, err = commonFuncs.GenerateProtocolSnapshotForCheckpointWithHeights(
+				log.Logger, state, storages.Headers, storages.Seals, flagCheckpointDir, flagCheckpointScanStep, uint64(flagCheckpointScanEndHeight))
+		}
+
+		if err != nil {
+			log.Fatal().Err(err).Msgf("could not generate protocol snapshot for checkpoint in dir: %v", flagCheckpointDir)
+		}
+
+		snapshot = protocolSnapshot
+		log.Info().Msgf("snapshot found for checkpoint file %v, sealed height %v, commit %x", checkpointFile, sealedHeight, sealedCommit)
 	}
 
 	head, err := snapshot.Head()
diff --git a/cmd/util/cmd/reindex/cmd/results.go b/cmd/util/cmd/reindex/cmd/results.go
index 8b62d618755..40e9638816d 100644
--- a/cmd/util/cmd/reindex/cmd/results.go
+++ b/cmd/util/cmd/reindex/cmd/results.go
@@ -26,11 +26,7 @@ var resultsCmd = &cobra.Command{
 		results := storages.Results
 		blocks := storages.Blocks
 
-		root, err := state.Params().FinalizedRoot()
-		if err != nil {
-			log.Fatal().Err(err).Msg("could not get root header from protocol state")
-		}
-
+		root := state.Params().FinalizedRoot()
 		final, err := state.Final().Head()
 		if err != nil {
 			log.Fatal().Err(err).Msg("could not get final header from protocol state")
diff --git a/cmd/util/cmd/rollback-executed-height/cmd/rollback_executed_height.go b/cmd/util/cmd/rollback-executed-height/cmd/rollback_executed_height.go
index 83ef43f79de..33f6622cc1b 100644
--- a/cmd/util/cmd/rollback-executed-height/cmd/rollback_executed_height.go
+++ b/cmd/util/cmd/rollback-executed-height/cmd/rollback_executed_height.go
@@ -121,10 +121,7 @@ func removeExecutionResultsFromHeight(
 	fromHeight uint64) error {
 	log.Info().Msgf("removing results for blocks from height: %v", fromHeight)
 
-	root, err := protoState.Params().FinalizedRoot()
-	if err != nil {
-		return fmt.Errorf("could not get root: %w", err)
-	}
+	root := protoState.Params().FinalizedRoot()
 
 	if fromHeight <= root.Height {
 		return fmt.Errorf("can only remove results for block above root block. fromHeight: %v, rootHeight: %v", fromHeight, root.Height)
diff --git a/cmd/util/cmd/root.go b/cmd/util/cmd/root.go
index d23695404f5..7b2833ade11 100644
--- a/cmd/util/cmd/root.go
+++ b/cmd/util/cmd/root.go
@@ -9,6 +9,8 @@ import (
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 
+	"github.com/onflow/flow-go/cmd/util/cmd/addresses"
+	bootstrap_execution_state_payloads "github.com/onflow/flow-go/cmd/util/cmd/bootstrap-execution-state-payloads"
 	checkpoint_collect_stats "github.com/onflow/flow-go/cmd/util/cmd/checkpoint-collect-stats"
 	checkpoint_list_tries "github.com/onflow/flow-go/cmd/util/cmd/checkpoint-list-tries"
 	checkpoint_trie_stats "github.com/onflow/flow-go/cmd/util/cmd/checkpoint-trie-stats"
@@ -18,6 +20,7 @@ import (
 	extract "github.com/onflow/flow-go/cmd/util/cmd/execution-state-extract"
 	ledger_json_exporter "github.com/onflow/flow-go/cmd/util/cmd/export-json-execution-state"
 	export_json_transactions "github.com/onflow/flow-go/cmd/util/cmd/export-json-transactions"
+	extractpayloads "github.com/onflow/flow-go/cmd/util/cmd/extract-payloads-by-address"
 	read_badger "github.com/onflow/flow-go/cmd/util/cmd/read-badger/cmd"
 	read_execution_state "github.com/onflow/flow-go/cmd/util/cmd/read-execution-state"
 	read_hotstuff "github.com/onflow/flow-go/cmd/util/cmd/read-hotstuff/cmd"
@@ -80,6 +83,9 @@ func addCommands() {
 	rootCmd.AddCommand(snapshot.Cmd)
 	rootCmd.AddCommand(export_json_transactions.Cmd)
 	rootCmd.AddCommand(read_hotstuff.RootCmd)
+	rootCmd.AddCommand(addresses.Cmd)
+	rootCmd.AddCommand(bootstrap_execution_state_payloads.Cmd)
+	rootCmd.AddCommand(extractpayloads.Cmd)
 }
 
 func initConfig() {
diff --git a/cmd/util/common/checkpoint.go b/cmd/util/common/checkpoint.go
new file mode 100644
index 00000000000..098db2cc096
--- /dev/null
+++ b/cmd/util/common/checkpoint.go
@@ -0,0 +1,202 @@
+package common
+
+import (
+	"fmt"
+	"path/filepath"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+
+	"github.com/onflow/flow-go/ledger"
+	"github.com/onflow/flow-go/ledger/complete/wal"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/state/protocol/snapshots"
+	"github.com/onflow/flow-go/storage"
+)
+
+// FindHeightsByCheckpoints finds the sealed height that produces the state commitment included in the checkpoint file.
+func FindHeightsByCheckpoints(
+	logger zerolog.Logger,
+	headers storage.Headers,
+	seals storage.Seals,
+	checkpointFilePath string,
+	blocksToSkip uint,
+	startHeight uint64,
+	endHeight uint64,
+) (
+	uint64, // sealed height that produces the state commitment included in the checkpoint file
+	flow.StateCommitment, // the state commitment that matches the sealed height
+	uint64, // the finalized height that seals the sealed height
+	error,
+) {
+
+	// find all trie root hashes in the checkpoint file
+	dir, fileName := filepath.Split(checkpointFilePath)
+	hashes, err := wal.ReadTriesRootHash(logger, dir, fileName)
+	if err != nil {
+		return 0, flow.DummyStateCommitment, 0,
+			fmt.Errorf("could not read trie root hashes from checkpoint file %v: %w",
+				checkpointFilePath, err)
+	}
+
+	// convert all trie root hashes to state commitments
+	commitments := hashesToCommits(hashes)
+
+	commitMap := make(map[flow.StateCommitment]struct{}, len(commitments))
+	for _, commit := range commitments {
+		commitMap[commit] = struct{}{}
+	}
+
+	// iterate backwards from the end height to the start height
+	// to find the block that produces a state commitment in the given list
+	// It is safe to skip blocks in this linear search because we expect `stateCommitments` to hold commits
+	// for a contiguous range of blocks (for correct operation we assume `blocksToSkip` is smaller than this range).
+	// end height must be a sealed block
+	step := blocksToSkip + 1
+	for height := endHeight; height >= startHeight; height -= uint64(step) {
+		finalizedID, err := headers.BlockIDByHeight(height)
+		if err != nil {
+			return 0, flow.DummyStateCommitment, 0,
+				fmt.Errorf("could not find block by height %v: %w", height, err)
+		}
+
+		// since height is a sealed block height, then we must be able to find the seal for this block
+		finalizedSeal, err := seals.HighestInFork(finalizedID)
+		if err != nil {
+			return 0, flow.DummyStateCommitment, 0,
+				fmt.Errorf("could not find seal for block %v at height %v: %w", finalizedID, height, err)
+		}
+
+		commit := finalizedSeal.FinalState
+
+		_, ok := commitMap[commit]
+		if ok {
+			sealedBlock, err := headers.ByBlockID(finalizedSeal.BlockID)
+			if err != nil {
+				return 0, flow.DummyStateCommitment, 0,
+					fmt.Errorf("could not find block by ID %v: %w", finalizedSeal.BlockID, err)
+			}
+
+			log.Info().Msgf("successfully found block %v (%v) that seals block %v (%v) for commit %x in checkpoint file %v",
+				height, finalizedID,
+				sealedBlock.Height, finalizedSeal.BlockID,
+				commit, checkpointFilePath)
+
+			return sealedBlock.Height, commit, height, nil
+		}
+
+		if height < uint64(step) {
+			break
+		}
+	}
+
+	return 0, flow.DummyStateCommitment, 0,
+		fmt.Errorf("could not find commit within height range [%v,%v]", startHeight, endHeight)
+}
+
+// GenerateProtocolSnapshotForCheckpoint finds a sealed block that produces the state commitment contained in the latest
+// checkpoint file, and return a protocol snapshot for the finalized block that seals the sealed block.
+// The returned protocol snapshot can be used for dynamic bootstrapping an execution node along with the latest checkpoint file.
+//
+// When finding a sealed block it iterates backwards through each sealed height from the last sealed height, and see
+// if the state commitment matches with one of the state commitments contained in the checkpoint file.
+// However, the iteration could be slow, in order to speed up the iteration, we can skip some blocks each time.
+// Since a checkpoint file usually contains 500 tries, which might cover around 250 blocks (assuming 2 tries per block),
+// then skipping 10 blocks each time will still allow us to find the sealed block while not missing the height contained
+// by the checkpoint file.
+// So the blocksToSkip parameter is used to skip some blocks each time when iterating the sealed heights.
+func GenerateProtocolSnapshotForCheckpoint(
+	logger zerolog.Logger,
+	state protocol.State,
+	headers storage.Headers,
+	seals storage.Seals,
+	checkpointDir string,
+	blocksToSkip uint,
+) (protocol.Snapshot, uint64, flow.StateCommitment, string, error) {
+	// skip X blocks (i.e. 10) each time to find the block that produces the state commitment in the checkpoint file
+	// since a checkpoint file contains 500 tries, this allows us to find the block more efficiently
+	sealed, err := state.Sealed().Head()
+	if err != nil {
+		return nil, 0, flow.DummyStateCommitment, "", err
+	}
+	endHeight := sealed.Height
+
+	return GenerateProtocolSnapshotForCheckpointWithHeights(logger, state, headers, seals,
+		checkpointDir,
+		blocksToSkip,
+		endHeight,
+	)
+}
+
+// findLatestCheckpointFilePath finds the latest checkpoint file in the given directory
+// it returns the header file name of the latest checkpoint file
+func findLatestCheckpointFilePath(checkpointDir string) (string, error) {
+	_, last, err := wal.ListCheckpoints(checkpointDir)
+	if err != nil {
+		return "", fmt.Errorf("could not list checkpoints in directory %v: %w", checkpointDir, err)
+	}
+
+	fileName := wal.NumberToFilename(last)
+	if last < 0 {
+		fileName = "root.checkpoint"
+	}
+
+	checkpointFilePath := filepath.Join(checkpointDir, fileName)
+	return checkpointFilePath, nil
+}
+
+// GenerateProtocolSnapshotForCheckpointWithHeights does the same thing as GenerateProtocolSnapshotForCheckpoint
+// except that it allows the caller to specify the end height of the sealed block that we iterate backwards from.
+func GenerateProtocolSnapshotForCheckpointWithHeights(
+	logger zerolog.Logger,
+	state protocol.State,
+	headers storage.Headers,
+	seals storage.Seals,
+	checkpointDir string,
+	blocksToSkip uint,
+	endHeight uint64,
+) (protocol.Snapshot, uint64, flow.StateCommitment, string, error) {
+	// Stop searching after 10,000 iterations or upon reaching the minimum height, whichever comes first.
+	startHeight := uint64(0)
+	// preventing startHeight from being negative
+	length := uint64(blocksToSkip+1) * 10000
+	if endHeight > length {
+		startHeight = endHeight - length
+	}
+
+	checkpointFilePath, err := findLatestCheckpointFilePath(checkpointDir)
+	if err != nil {
+		return nil, 0, flow.DummyStateCommitment, "", fmt.Errorf("could not find latest checkpoint file in directory %v: %w", checkpointDir, err)
+	}
+
+	log.Info().
+		Uint64("start_height", startHeight).
+		Uint64("end_height", endHeight).
+		Uint("blocksToSkip", blocksToSkip).
+		Msgf("generating protocol snapshot for checkpoint file %v", checkpointFilePath)
+	// find the height of the finalized block that produces the state commitment contained in the checkpoint file
+	sealedHeight, commit, finalizedHeight, err := FindHeightsByCheckpoints(logger, headers, seals, checkpointFilePath, blocksToSkip, startHeight, endHeight)
+	if err != nil {
+		return nil, 0, flow.DummyStateCommitment, "", fmt.Errorf("could not find sealed height in range [%v:%v] (blocksToSkip: %v) by checkpoints: %w",
+			startHeight, endHeight, blocksToSkip,
+			err)
+	}
+
+	snapshot := state.AtHeight(finalizedHeight)
+	validSnapshot, err := snapshots.GetDynamicBootstrapSnapshot(state, snapshot)
+	if err != nil {
+		return nil, 0, flow.DummyStateCommitment, "", fmt.Errorf("could not get dynamic bootstrap snapshot: %w", err)
+	}
+
+	return validSnapshot, sealedHeight, commit, checkpointFilePath, nil
+}
+
+// hashesToCommits converts a list of ledger.RootHash to a list of flow.StateCommitment
+func hashesToCommits(hashes []ledger.RootHash) []flow.StateCommitment {
+	commits := make([]flow.StateCommitment, len(hashes))
+	for i, h := range hashes {
+		commits[i] = flow.StateCommitment(h)
+	}
+	return commits
+}
diff --git a/cmd/util/ledger/migrations/account_based_migration.go b/cmd/util/ledger/migrations/account_based_migration.go
index 8a78728b7b6..2b6a4b0c34e 100644
--- a/cmd/util/ledger/migrations/account_based_migration.go
+++ b/cmd/util/ledger/migrations/account_based_migration.go
@@ -73,51 +73,71 @@ func MigrateByAccount(
 		return allPayloads, nil
 	}
 
+	log.Info().
+		Int("inner_migrations", len(migrations)).
+		Int("nWorker", nWorker).
+		Msgf("created account migrations")
+
+	// group the Payloads by account
+	accountGroups := util.GroupPayloadsByAccount(log, allPayloads, nWorker)
+
 	for i, migrator := range migrations {
-		if err := migrator.InitMigration(
+		err := migrator.InitMigration(
 			log.With().
 				Int("migration_index", i).
 				Logger(),
 			allPayloads,
 			nWorker,
-		); err != nil {
+		)
+		if err != nil {
 			return nil, fmt.Errorf("could not init migration: %w", err)
 		}
 	}
 
+	var migrated []*ledger.Payload
+	err := withMigrations(log, migrations, func() error {
+		var err error
+		// migrate the Payloads under accounts
+		migrated, err = MigrateGroupConcurrently(log, migrations, accountGroups, nWorker)
+		return err
+	})
+
 	log.Info().
-		Int("inner_migrations", len(migrations)).
-		Int("nWorker", nWorker).
-		Msgf("created account migrations")
+		Int("account_count", accountGroups.Len()).
+		Int("payload_count", len(allPayloads)).
+		Msgf("finished migrating Payloads")
 
+	if err != nil {
+		return nil, fmt.Errorf("could not migrate accounts: %w", err)
+	}
+
+	return migrated, nil
+}
+
+// withMigrations calls the given function and then closes the given migrations.
+func withMigrations(
+	log zerolog.Logger,
+	migrations []AccountBasedMigration,
+	f func() error,
+) (err error) {
 	defer func() {
 		for i, migrator := range migrations {
 			log.Info().
 				Int("migration_index", i).
 				Type("migration", migrator).
 				Msg("closing migration")
-			if err := migrator.Close(); err != nil {
-				log.Error().Err(err).Msg("error closing migration")
+			if cerr := migrator.Close(); cerr != nil {
+				log.Error().Err(cerr).Msg("error closing migration")
+				if err == nil {
+					// only set the error if it's not already set
+					// so that we don't overwrite the original error
+					err = cerr
+				}
 			}
 		}
 	}()
 
-	// group the Payloads by account
-	accountGroups := util.GroupPayloadsByAccount(log, allPayloads, nWorker)
-
-	// migrate the Payloads under accounts
-	migrated, err := MigrateGroupConcurrently(log, migrations, accountGroups, nWorker)
-
-	if err != nil {
-		return nil, fmt.Errorf("could not migrate accounts: %w", err)
-	}
-
-	log.Info().
-		Int("account_count", accountGroups.Len()).
-		Int("payload_count", len(allPayloads)).
-		Msgf("finished migrating Payloads")
-
-	return migrated, nil
+	return f()
 }
 
 // MigrateGroupConcurrently migrate the Payloads in the given account groups.
@@ -282,8 +302,14 @@ func MigrateGroupConcurrently(
 		Array("top_longest_migrations", durations.Array()).
 		Msgf("Top longest migrations")
 
-	if ctx.Err() != nil {
-		return nil, fmt.Errorf("fail to migrate payload: %w", ctx.Err())
+	err := ctx.Err()
+	if err != nil {
+		cause := context.Cause(ctx)
+		if cause != nil {
+			err = cause
+		}
+
+		return nil, fmt.Errorf("failed to migrate payload: %w", err)
 	}
 
 	return migrated, nil
diff --git a/cmd/util/ledger/migrations/account_based_migration_test.go b/cmd/util/ledger/migrations/account_based_migration_test.go
new file mode 100644
index 00000000000..c430950d682
--- /dev/null
+++ b/cmd/util/ledger/migrations/account_based_migration_test.go
@@ -0,0 +1,113 @@
+package migrations_test
+
+import (
+	"context"
+	"fmt"
+
+	"testing"
+
+	"github.com/onflow/cadence/runtime/common"
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/cmd/util/ledger/migrations"
+	"github.com/onflow/flow-go/ledger"
+)
+
+func TestErrorPropagation(t *testing.T) {
+	t.Parallel()
+
+	log := zerolog.New(zerolog.NewTestWriter(t))
+
+	address, err := common.HexToAddress("0x1")
+	require.NoError(t, err)
+
+	migrateWith := func(mig migrations.AccountBasedMigration) error {
+		_, err := migrations.MigrateByAccount(
+			log,
+			10,
+			[]*ledger.Payload{
+				// at least one payload otherwise the migration will not get called
+				accountStatusPayload(address),
+			},
+			[]migrations.AccountBasedMigration{
+				mig,
+			},
+		)
+		return err
+	}
+
+	t.Run("no err", func(t *testing.T) {
+		err := migrateWith(
+			testMigration{},
+		)
+		require.NoError(t, err)
+	})
+
+	t.Run("err on close", func(t *testing.T) {
+
+		desiredErr := fmt.Errorf("test close error")
+		err := migrateWith(
+			testMigration{
+				CloseFN: func() error {
+					return desiredErr
+				},
+			},
+		)
+		require.ErrorIs(t, err, desiredErr)
+	})
+
+	t.Run("err on init", func(t *testing.T) {
+		desiredErr := fmt.Errorf("test init error")
+		err := migrateWith(
+			testMigration{
+				InitMigrationFN: func(log zerolog.Logger, allPayloads []*ledger.Payload, nWorkers int) error {
+					return desiredErr
+				},
+			},
+		)
+		require.ErrorIs(t, err, desiredErr)
+	})
+
+	t.Run("err on migrate", func(t *testing.T) {
+		desiredErr := fmt.Errorf("test migrate error")
+		err := migrateWith(
+			testMigration{
+				MigrateAccountFN: func(ctx context.Context, address common.Address, payloads []*ledger.Payload) ([]*ledger.Payload, error) {
+					return nil, desiredErr
+				},
+			},
+		)
+		require.ErrorIs(t, err, desiredErr)
+	})
+}
+
+type testMigration struct {
+	InitMigrationFN  func(log zerolog.Logger, allPayloads []*ledger.Payload, nWorkers int) error
+	MigrateAccountFN func(ctx context.Context, address common.Address, payloads []*ledger.Payload) ([]*ledger.Payload, error)
+	CloseFN          func() error
+}
+
+func (t testMigration) InitMigration(log zerolog.Logger, allPayloads []*ledger.Payload, nWorkers int) error {
+	if t.InitMigrationFN != nil {
+		return t.InitMigrationFN(log, allPayloads, nWorkers)
+	}
+	return nil
+}
+
+func (t testMigration) MigrateAccount(ctx context.Context, address common.Address, payloads []*ledger.Payload) ([]*ledger.Payload, error) {
+
+	if t.MigrateAccountFN != nil {
+		return t.MigrateAccountFN(ctx, address, payloads)
+	}
+	return payloads, nil
+}
+
+func (t testMigration) Close() error {
+	if t.CloseFN != nil {
+		return t.CloseFN()
+	}
+	return nil
+}
+
+var _ migrations.AccountBasedMigration = &testMigration{}
diff --git a/cmd/util/ledger/migrations/atree_register_migration.go b/cmd/util/ledger/migrations/atree_register_migration.go
index 1b0873e7a2b..222217572ff 100644
--- a/cmd/util/ledger/migrations/atree_register_migration.go
+++ b/cmd/util/ledger/migrations/atree_register_migration.go
@@ -8,16 +8,14 @@ import (
 	runtime2 "runtime"
 	"time"
 
+	"github.com/onflow/atree"
 	"github.com/rs/zerolog"
 
-	"github.com/onflow/atree"
 	"github.com/onflow/cadence/runtime"
 	"github.com/onflow/cadence/runtime/common"
 	"github.com/onflow/cadence/runtime/interpreter"
-	"github.com/onflow/cadence/runtime/stdlib"
 
 	"github.com/onflow/flow-go/cmd/util/ledger/reporters"
-	"github.com/onflow/flow-go/cmd/util/ledger/util"
 	"github.com/onflow/flow-go/fvm/environment"
 	"github.com/onflow/flow-go/ledger"
 	"github.com/onflow/flow-go/ledger/common/convert"
@@ -33,12 +31,14 @@ type AtreeRegisterMigrator struct {
 
 	sampler zerolog.Sampler
 	rw      reporters.ReportWriter
-	rwf     reporters.ReportWriterFactory
 
 	nWorkers int
 
-	validateMigratedValues    bool
-	logVerboseValidationError bool
+	validateMigratedValues             bool
+	logVerboseValidationError          bool
+	continueMigrationOnValidationError bool
+	checkStorageHealthBeforeMigration  bool
+	checkStorageHealthAfterMigration   bool
 }
 
 var _ AccountBasedMigration = (*AtreeRegisterMigrator)(nil)
@@ -48,16 +48,21 @@ func NewAtreeRegisterMigrator(
 	rwf reporters.ReportWriterFactory,
 	validateMigratedValues bool,
 	logVerboseValidationError bool,
+	continueMigrationOnValidationError bool,
+	checkStorageHealthBeforeMigration bool,
+	checkStorageHealthAfterMigration bool,
 ) *AtreeRegisterMigrator {
 
 	sampler := util2.NewTimedSampler(30 * time.Second)
 
 	migrator := &AtreeRegisterMigrator{
-		sampler:                   sampler,
-		rwf:                       rwf,
-		rw:                        rwf.ReportWriter("atree-register-migrator"),
-		validateMigratedValues:    validateMigratedValues,
-		logVerboseValidationError: logVerboseValidationError,
+		sampler:                            sampler,
+		rw:                                 rwf.ReportWriter("atree-register-migrator"),
+		validateMigratedValues:             validateMigratedValues,
+		logVerboseValidationError:          logVerboseValidationError,
+		continueMigrationOnValidationError: continueMigrationOnValidationError,
+		checkStorageHealthBeforeMigration:  checkStorageHealthBeforeMigration,
+		checkStorageHealthAfterMigration:   checkStorageHealthAfterMigration,
 	}
 
 	return migrator
@@ -87,11 +92,22 @@ func (m *AtreeRegisterMigrator) MigrateAccount(
 	oldPayloads []*ledger.Payload,
 ) ([]*ledger.Payload, error) {
 	// create all the runtime components we need for the migration
-	mr, err := newMigratorRuntime(address, oldPayloads)
+	mr, err := NewAtreeRegisterMigratorRuntime(address, oldPayloads)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create migrator runtime: %w", err)
 	}
 
+	// Check storage health before migration, if enabled.
+	if m.checkStorageHealthBeforeMigration {
+		err = checkStorageHealth(address, mr.Storage, oldPayloads)
+		if err != nil {
+			m.log.Warn().
+				Err(err).
+				Str("account", address.Hex()).
+				Msg("storage health check before migration failed")
+		}
+	}
+
 	// keep track of all storage maps that were accessed
 	// if they are empty they won't be changed, but we still need to copy them over
 	storageMapIds := make(map[string]struct{})
@@ -118,7 +134,14 @@ func (m *AtreeRegisterMigrator) MigrateAccount(
 	if m.validateMigratedValues {
 		err = validateCadenceValues(address, oldPayloads, newPayloads, m.log, m.logVerboseValidationError)
 		if err != nil {
-			return nil, err
+			if !m.continueMigrationOnValidationError {
+				return nil, err
+			}
+
+			m.log.Error().
+				Err(err).
+				Hex("address", address[:]).
+				Msg("failed not validate atree migration")
 		}
 	}
 
@@ -135,16 +158,32 @@ func (m *AtreeRegisterMigrator) MigrateAccount(
 		})
 	}
 
+	// Check storage health after migration, if enabled.
+	if m.checkStorageHealthAfterMigration {
+		mr, err := NewAtreeRegisterMigratorRuntime(address, newPayloads)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create migrator runtime: %w", err)
+		}
+
+		err = checkStorageHealth(address, mr.Storage, newPayloads)
+		if err != nil {
+			m.log.Warn().
+				Err(err).
+				Str("account", address.Hex()).
+				Msg("storage health check after migration failed")
+		}
+	}
+
 	return newPayloads, nil
 }
 
 func (m *AtreeRegisterMigrator) migrateAccountStorage(
-	mr *migratorRuntime,
+	mr *AtreeRegisterMigratorRuntime,
 	storageMapIds map[string]struct{},
 ) (map[flow.RegisterID]flow.RegisterValue, error) {
 
 	// iterate through all domains and migrate them
-	for _, domain := range domains {
+	for _, domain := range allStorageMapDomains {
 		err := m.convertStorageDomain(mr, storageMapIds, domain)
 		if err != nil {
 			return nil, fmt.Errorf("failed to convert storage domain %s : %w", domain, err)
@@ -166,7 +205,7 @@ func (m *AtreeRegisterMigrator) migrateAccountStorage(
 }
 
 func (m *AtreeRegisterMigrator) convertStorageDomain(
-	mr *migratorRuntime,
+	mr *AtreeRegisterMigratorRuntime,
 	storageMapIds map[string]struct{},
 	domain string,
 ) error {
@@ -178,8 +217,8 @@ func (m *AtreeRegisterMigrator) convertStorageDomain(
 	}
 	storageMapIds[string(atree.SlabIndexToLedgerKey(storageMap.StorageID().Index))] = struct{}{}
 
-	iterator := storageMap.Iterator(util.NopMemoryGauge{})
-	keys := make([]interpreter.StringStorageMapKey, 0, storageMap.Count())
+	iterator := storageMap.Iterator(nil)
+	keys := make([]interpreter.StorageMapKey, 0, storageMap.Count())
 	// to be safe avoid modifying the map while iterating
 	for {
 		key := iterator.NextKey()
@@ -187,12 +226,16 @@ func (m *AtreeRegisterMigrator) convertStorageDomain(
 			break
 		}
 
-		stringKey, ok := key.(interpreter.StringAtreeValue)
-		if !ok {
-			return fmt.Errorf("invalid key type %T, expected interpreter.StringAtreeValue", key)
-		}
+		switch key := key.(type) {
+		case interpreter.StringAtreeValue:
+			keys = append(keys, interpreter.StringStorageMapKey(key))
+
+		case interpreter.Uint64AtreeValue:
+			keys = append(keys, interpreter.Uint64StorageMapKey(key))
 
-		keys = append(keys, interpreter.StringStorageMapKey(stringKey))
+		default:
+			return fmt.Errorf("invalid key type %T, expected interpreter.StringAtreeValue or interpreter.Uint64AtreeValue", key)
+		}
 	}
 
 	for _, key := range keys {
@@ -200,7 +243,7 @@ func (m *AtreeRegisterMigrator) convertStorageDomain(
 			var value interpreter.Value
 
 			err := capturePanic(func() {
-				value = storageMap.ReadValue(util.NopMemoryGauge{}, key)
+				value = storageMap.ReadValue(nil, key)
 			})
 			if err != nil {
 				return fmt.Errorf("failed to read value for key %s: %w", key, err)
@@ -228,7 +271,7 @@ func (m *AtreeRegisterMigrator) convertStorageDomain(
 			m.rw.Write(migrationProblem{
 				Address: mr.Address.Hex(),
 				Size:    len(mr.Snapshot.Payloads),
-				Key:     string(key),
+				Key:     fmt.Sprintf("%v (%T)", key, key),
 				Kind:    "migration_failure",
 				Msg:     err.Error(),
 			})
@@ -240,7 +283,7 @@ func (m *AtreeRegisterMigrator) convertStorageDomain(
 }
 
 func (m *AtreeRegisterMigrator) validateChangesAndCreateNewRegisters(
-	mr *migratorRuntime,
+	mr *AtreeRegisterMigratorRuntime,
 	changes map[flow.RegisterID]flow.RegisterValue,
 	storageMapIds map[string]struct{},
 ) ([]*ledger.Payload, error) {
@@ -315,7 +358,7 @@ func (m *AtreeRegisterMigrator) validateChangesAndCreateNewRegisters(
 				continue
 			}
 
-			if _, isADomainKey := domainsLookupMap[id.Key]; isADomainKey {
+			if _, isADomainKey := allStorageMapDomainsSet[id.Key]; isADomainKey {
 				// this is expected. Move it to the new payloads
 				newPayloads = append(newPayloads, value)
 				continue
@@ -375,7 +418,7 @@ func (m *AtreeRegisterMigrator) validateChangesAndCreateNewRegisters(
 }
 
 func (m *AtreeRegisterMigrator) cloneValue(
-	mr *migratorRuntime,
+	mr *AtreeRegisterMigratorRuntime,
 	value interpreter.Value,
 ) (interpreter.Value, error) {
 
@@ -413,25 +456,6 @@ func capturePanic(f func()) (err error) {
 	return
 }
 
-// convert all domains
-var domains = []string{
-	common.PathDomainStorage.Identifier(),
-	common.PathDomainPrivate.Identifier(),
-	common.PathDomainPublic.Identifier(),
-	runtime.StorageDomainContract,
-	stdlib.InboxStorageDomain,
-	stdlib.CapabilityControllerStorageDomain,
-}
-
-var domainsLookupMap = map[string]struct{}{
-	common.PathDomainStorage.Identifier():    {},
-	common.PathDomainPrivate.Identifier():    {},
-	common.PathDomainPublic.Identifier():     {},
-	runtime.StorageDomainContract:            {},
-	stdlib.InboxStorageDomain:                {},
-	stdlib.CapabilityControllerStorageDomain: {},
-}
-
 // migrationProblem is a struct for reporting errors
 type migrationProblem struct {
 	Address string
diff --git a/cmd/util/ledger/migrations/atree_register_migration_test.go b/cmd/util/ledger/migrations/atree_register_migration_test.go
index d4acf230d55..d593e67b4b3 100644
--- a/cmd/util/ledger/migrations/atree_register_migration_test.go
+++ b/cmd/util/ledger/migrations/atree_register_migration_test.go
@@ -30,7 +30,14 @@ func TestAtreeRegisterMigration(t *testing.T) {
 			"test-data/bootstrapped_v0.31",
 			migrations.CreateAccountBasedMigration(log, 2,
 				[]migrations.AccountBasedMigration{
-					migrations.NewAtreeRegisterMigrator(reporters.NewReportFileWriterFactory(dir, log), true, false),
+					migrations.NewAtreeRegisterMigrator(
+						reporters.NewReportFileWriterFactory(dir, log),
+						true,
+						false,
+						false,
+						false,
+						false,
+					),
 				},
 			),
 			func(t *testing.T, oldPayloads []*ledger.Payload, newPayloads []*ledger.Payload) {
diff --git a/cmd/util/ledger/migrations/atree_register_migrator_runtime.go b/cmd/util/ledger/migrations/atree_register_migrator_runtime.go
new file mode 100644
index 00000000000..77f52d9198f
--- /dev/null
+++ b/cmd/util/ledger/migrations/atree_register_migrator_runtime.go
@@ -0,0 +1,64 @@
+package migrations
+
+import (
+	"fmt"
+
+	"github.com/onflow/cadence/runtime"
+	"github.com/onflow/cadence/runtime/common"
+	"github.com/onflow/cadence/runtime/interpreter"
+
+	"github.com/onflow/flow-go/cmd/util/ledger/util"
+	"github.com/onflow/flow-go/fvm/environment"
+	"github.com/onflow/flow-go/fvm/storage/state"
+	"github.com/onflow/flow-go/ledger"
+)
+
+// NewAtreeRegisterMigratorRuntime returns a new runtime to be used with the AtreeRegisterMigrator.
+func NewAtreeRegisterMigratorRuntime(
+	address common.Address,
+	payloads []*ledger.Payload,
+) (
+	*AtreeRegisterMigratorRuntime,
+	error,
+) {
+	snapshot, err := util.NewPayloadSnapshot(payloads)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create payload snapshot: %w", err)
+	}
+	transactionState := state.NewTransactionState(snapshot, state.DefaultParameters())
+	accounts := environment.NewAccounts(transactionState)
+
+	accountsAtreeLedger := util.NewAccountsAtreeLedger(accounts)
+	storage := runtime.NewStorage(accountsAtreeLedger, nil)
+
+	inter, err := interpreter.NewInterpreter(
+		nil,
+		nil,
+		&interpreter.Config{
+			Storage: storage,
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return &AtreeRegisterMigratorRuntime{
+		Address:             address,
+		Payloads:            payloads,
+		Snapshot:            snapshot,
+		TransactionState:    transactionState,
+		Interpreter:         inter,
+		Storage:             storage,
+		AccountsAtreeLedger: accountsAtreeLedger,
+	}, nil
+}
+
+type AtreeRegisterMigratorRuntime struct {
+	Snapshot            *util.PayloadSnapshot
+	TransactionState    state.NestedTransactionPreparer
+	Interpreter         *interpreter.Interpreter
+	Storage             *runtime.Storage
+	Payloads            []*ledger.Payload
+	Address             common.Address
+	AccountsAtreeLedger *util.AccountsAtreeLedger
+}
diff --git a/cmd/util/ledger/migrations/cadence_value_validation.go b/cmd/util/ledger/migrations/cadence_value_validation.go
index ff45b2e2c97..6850a1e6b13 100644
--- a/cmd/util/ledger/migrations/cadence_value_validation.go
+++ b/cmd/util/ledger/migrations/cadence_value_validation.go
@@ -3,22 +3,16 @@ package migrations
 import (
 	"fmt"
 	"strings"
-	"time"
 
-	"github.com/onflow/atree"
-	"github.com/onflow/cadence"
 	"github.com/onflow/cadence/runtime"
 	"github.com/onflow/cadence/runtime/common"
 	"github.com/onflow/cadence/runtime/interpreter"
 	"github.com/rs/zerolog"
-	"go.opentelemetry.io/otel/attribute"
 
 	"github.com/onflow/flow-go/cmd/util/ledger/util"
 	"github.com/onflow/flow-go/ledger"
 )
 
-var nopMemoryGauge = util.NopMemoryGauge{}
-
 // TODO: optimize memory by reusing payloads snapshot created for migration
 func validateCadenceValues(
 	address common.Address,
@@ -39,7 +33,7 @@ func validateCadenceValues(
 	}
 
 	// Iterate through all domains and compare cadence values.
-	for _, domain := range domains {
+	for _, domain := range allStorageMapDomains {
 		err := validateStorageDomain(address, oldRuntime, newRuntime, domain, log, verboseLogging)
 		if err != nil {
 			return err
@@ -79,34 +73,53 @@ func validateStorageDomain(
 		return fmt.Errorf("old storage map count %d, new storage map count %d", oldStorageMap.Count(), newStorageMap.Count())
 	}
 
-	oldIterator := oldStorageMap.Iterator(nopMemoryGauge)
+	oldIterator := oldStorageMap.Iterator(nil)
 	for {
 		key, oldValue := oldIterator.Next()
 		if key == nil {
 			break
 		}
 
-		stringKey, ok := key.(interpreter.StringAtreeValue)
-		if !ok {
-			return fmt.Errorf("invalid key type %T, expected interpreter.StringAtreeValue", key)
+		var mapKey interpreter.StorageMapKey
+
+		switch key := key.(type) {
+		case interpreter.StringAtreeValue:
+			mapKey = interpreter.StringStorageMapKey(key)
+
+		case interpreter.Uint64AtreeValue:
+			mapKey = interpreter.Uint64StorageMapKey(key)
+
+		default:
+			return fmt.Errorf("invalid key type %T, expected interpreter.StringAtreeValue or interpreter.Uint64AtreeValue", key)
 		}
 
-		newValue := newStorageMap.ReadValue(nopMemoryGauge, interpreter.StringStorageMapKey(stringKey))
+		newValue := newStorageMap.ReadValue(nil, mapKey)
 
-		err := cadenceValueEqual(oldRuntime.Interpreter, oldValue, newRuntime.Interpreter, newValue)
+		err := cadenceValueEqual(
+			oldRuntime.Interpreter,
+			oldValue,
+			newRuntime.Interpreter,
+			newValue,
+		)
 		if err != nil {
 			if verboseLogging {
 				log.Info().
 					Str("address", address.Hex()).
 					Str("domain", domain).
-					Str("key", string(stringKey)).
+					Str("key", fmt.Sprintf("%v (%T)", mapKey, mapKey)).
 					Str("trace", err.Error()).
 					Str("old value", oldValue.String()).
 					Str("new value", newValue.String()).
 					Msgf("failed to validate value")
 			}
 
-			return fmt.Errorf("failed to validate value for address %s, domain %s, key %s: %s", address.Hex(), domain, key, err.Error())
+			return fmt.Errorf(
+				"failed to validate value for address %s, domain %s, key %s: %s",
+				address.Hex(),
+				domain,
+				key,
+				err.Error(),
+			)
 		}
 	}
 
@@ -274,7 +287,7 @@ func cadenceCompositeValueEqual(
 
 	var err *validationError
 	vFieldNames := make([]string, 0, 10) // v's field names
-	v.ForEachField(nopMemoryGauge, func(fieldName string, fieldValue interpreter.Value) bool {
+	v.ForEachField(nil, func(fieldName string, fieldValue interpreter.Value) bool {
 		otherFieldValue := otherComposite.GetField(otherInterpreter, interpreter.EmptyLocationRange, fieldName)
 
 		err = cadenceValueEqual(vInterpreter, fieldValue, otherInterpreter, otherFieldValue)
@@ -286,15 +299,17 @@ func cadenceCompositeValueEqual(
 		vFieldNames = append(vFieldNames, fieldName)
 		return true
 	})
+	if err != nil {
+		return err
+	}
 
-	// TODO: Use CompositeValue.FieldCount() from Cadence after it is merged and available.
-	otherFieldNames := make([]string, 0, len(vFieldNames)) // otherComposite's field names
-	otherComposite.ForEachField(nopMemoryGauge, func(fieldName string, _ interpreter.Value) bool {
-		otherFieldNames = append(otherFieldNames, fieldName)
-		return true
-	})
+	if len(vFieldNames) != otherComposite.FieldCount() {
+		otherFieldNames := make([]string, 0, len(vFieldNames)) // otherComposite's field names
+		otherComposite.ForEachField(nil, func(fieldName string, _ interpreter.Value) bool {
+			otherFieldNames = append(otherFieldNames, fieldName)
+			return true
+		})
 
-	if len(vFieldNames) != len(otherFieldNames) {
 		return newValidationErrorf(
 			"composite %s fields differ: %v != %v",
 			v.TypeID(),
@@ -327,7 +342,7 @@ func cadenceDictionaryValueEqual(
 
 	oldIterator := v.Iterator()
 	for {
-		key := oldIterator.NextKey(nopMemoryGauge)
+		key := oldIterator.NextKey(nil)
 		if key == nil {
 			break
 		}
@@ -370,24 +385,15 @@ func newReadonlyStorageRuntime(payloads []*ledger.Payload) (
 
 	readonlyLedger := util.NewPayloadsReadonlyLedger(snapshot)
 
-	storage := runtime.NewStorage(readonlyLedger, nopMemoryGauge)
+	storage := runtime.NewStorage(readonlyLedger, nil)
 
-	env := runtime.NewBaseInterpreterEnvironment(runtime.Config{
-		AccountLinkingEnabled: true,
-		// Attachments are enabled everywhere except for Mainnet
-		AttachmentsEnabled: true,
-		// Capability Controllers are enabled everywhere except for Mainnet
-		CapabilityControllersEnabled: true,
-	})
-
-	env.Configure(
-		&NoopRuntimeInterface{},
-		runtime.NewCodesAndPrograms(),
-		storage,
+	inter, err := interpreter.NewInterpreter(
+		nil,
 		nil,
+		&interpreter.Config{
+			Storage: storage,
+		},
 	)
-
-	inter, err := interpreter.NewInterpreter(nil, nil, env.InterpreterConfig)
 	if err != nil {
 		return nil, err
 	}
@@ -397,203 +403,3 @@ func newReadonlyStorageRuntime(payloads []*ledger.Payload) (
 		Storage:     storage,
 	}, nil
 }
-
-// NoopRuntimeInterface is a runtime interface that can be used in migrations.
-type NoopRuntimeInterface struct {
-}
-
-func (NoopRuntimeInterface) ResolveLocation(_ []runtime.Identifier, _ runtime.Location) ([]runtime.ResolvedLocation, error) {
-	panic("unexpected ResolveLocation call")
-}
-
-func (NoopRuntimeInterface) GetCode(_ runtime.Location) ([]byte, error) {
-	panic("unexpected GetCode call")
-}
-
-func (NoopRuntimeInterface) GetAccountContractCode(_ common.AddressLocation) ([]byte, error) {
-	panic("unexpected GetAccountContractCode call")
-}
-
-func (NoopRuntimeInterface) GetOrLoadProgram(_ runtime.Location, _ func() (*interpreter.Program, error)) (*interpreter.Program, error) {
-	panic("unexpected GetOrLoadProgram call")
-}
-
-func (NoopRuntimeInterface) MeterMemory(_ common.MemoryUsage) error {
-	return nil
-}
-
-func (NoopRuntimeInterface) MeterComputation(_ common.ComputationKind, _ uint) error {
-	return nil
-}
-
-func (NoopRuntimeInterface) GetValue(_, _ []byte) (value []byte, err error) {
-	panic("unexpected GetValue call")
-}
-
-func (NoopRuntimeInterface) SetValue(_, _, _ []byte) (err error) {
-	panic("unexpected SetValue call")
-}
-
-func (NoopRuntimeInterface) CreateAccount(_ runtime.Address) (address runtime.Address, err error) {
-	panic("unexpected CreateAccount call")
-}
-
-func (NoopRuntimeInterface) AddEncodedAccountKey(_ runtime.Address, _ []byte) error {
-	panic("unexpected AddEncodedAccountKey call")
-}
-
-func (NoopRuntimeInterface) RevokeEncodedAccountKey(_ runtime.Address, _ int) (publicKey []byte, err error) {
-	panic("unexpected RevokeEncodedAccountKey call")
-}
-
-func (NoopRuntimeInterface) AddAccountKey(_ runtime.Address, _ *runtime.PublicKey, _ runtime.HashAlgorithm, _ int) (*runtime.AccountKey, error) {
-	panic("unexpected AddAccountKey call")
-}
-
-func (NoopRuntimeInterface) GetAccountKey(_ runtime.Address, _ int) (*runtime.AccountKey, error) {
-	panic("unexpected GetAccountKey call")
-}
-
-func (NoopRuntimeInterface) RevokeAccountKey(_ runtime.Address, _ int) (*runtime.AccountKey, error) {
-	panic("unexpected RevokeAccountKey call")
-}
-
-func (NoopRuntimeInterface) UpdateAccountContractCode(_ common.AddressLocation, _ []byte) (err error) {
-	panic("unexpected UpdateAccountContractCode call")
-}
-
-func (NoopRuntimeInterface) RemoveAccountContractCode(common.AddressLocation) (err error) {
-	panic("unexpected RemoveAccountContractCode call")
-}
-
-func (NoopRuntimeInterface) GetSigningAccounts() ([]runtime.Address, error) {
-	panic("unexpected GetSigningAccounts call")
-}
-
-func (NoopRuntimeInterface) ProgramLog(_ string) error {
-	panic("unexpected ProgramLog call")
-}
-
-func (NoopRuntimeInterface) EmitEvent(_ cadence.Event) error {
-	panic("unexpected EmitEvent call")
-}
-
-func (NoopRuntimeInterface) ValueExists(_, _ []byte) (exists bool, err error) {
-	panic("unexpected ValueExists call")
-}
-
-func (NoopRuntimeInterface) GenerateUUID() (uint64, error) {
-	panic("unexpected GenerateUUID call")
-}
-
-func (NoopRuntimeInterface) GetComputationLimit() uint64 {
-	panic("unexpected GetComputationLimit call")
-}
-
-func (NoopRuntimeInterface) SetComputationUsed(_ uint64) error {
-	panic("unexpected SetComputationUsed call")
-}
-
-func (NoopRuntimeInterface) DecodeArgument(_ []byte, _ cadence.Type) (cadence.Value, error) {
-	panic("unexpected DecodeArgument call")
-}
-
-func (NoopRuntimeInterface) GetCurrentBlockHeight() (uint64, error) {
-	panic("unexpected GetCurrentBlockHeight call")
-}
-
-func (NoopRuntimeInterface) GetBlockAtHeight(_ uint64) (block runtime.Block, exists bool, err error) {
-	panic("unexpected GetBlockAtHeight call")
-}
-
-func (NoopRuntimeInterface) ReadRandom([]byte) error {
-	panic("unexpected ReadRandom call")
-}
-
-func (NoopRuntimeInterface) VerifySignature(_ []byte, _ string, _ []byte, _ []byte, _ runtime.SignatureAlgorithm, _ runtime.HashAlgorithm) (bool, error) {
-	panic("unexpected VerifySignature call")
-}
-
-func (NoopRuntimeInterface) Hash(_ []byte, _ string, _ runtime.HashAlgorithm) ([]byte, error) {
-	panic("unexpected Hash call")
-}
-
-func (NoopRuntimeInterface) GetAccountBalance(_ common.Address) (value uint64, err error) {
-	panic("unexpected GetAccountBalance call")
-}
-
-func (NoopRuntimeInterface) GetAccountAvailableBalance(_ common.Address) (value uint64, err error) {
-	panic("unexpected GetAccountAvailableBalance call")
-}
-
-func (NoopRuntimeInterface) GetStorageUsed(_ runtime.Address) (value uint64, err error) {
-	panic("unexpected GetStorageUsed call")
-}
-
-func (NoopRuntimeInterface) GetStorageCapacity(_ runtime.Address) (value uint64, err error) {
-	panic("unexpected GetStorageCapacity call")
-}
-
-func (NoopRuntimeInterface) ImplementationDebugLog(_ string) error {
-	panic("unexpected ImplementationDebugLog call")
-}
-
-func (NoopRuntimeInterface) ValidatePublicKey(_ *runtime.PublicKey) error {
-	panic("unexpected ValidatePublicKey call")
-}
-
-func (NoopRuntimeInterface) GetAccountContractNames(_ runtime.Address) ([]string, error) {
-	panic("unexpected GetAccountContractNames call")
-}
-
-func (NoopRuntimeInterface) AllocateStorageIndex(_ []byte) (atree.StorageIndex, error) {
-	panic("unexpected AllocateStorageIndex call")
-}
-
-func (NoopRuntimeInterface) ComputationUsed() (uint64, error) {
-	panic("unexpected ComputationUsed call")
-}
-
-func (NoopRuntimeInterface) MemoryUsed() (uint64, error) {
-	panic("unexpected MemoryUsed call")
-}
-
-func (NoopRuntimeInterface) InteractionUsed() (uint64, error) {
-	panic("unexpected InteractionUsed call")
-}
-
-func (NoopRuntimeInterface) SetInterpreterSharedState(_ *interpreter.SharedState) {
-	panic("unexpected SetInterpreterSharedState call")
-}
-
-func (NoopRuntimeInterface) GetInterpreterSharedState() *interpreter.SharedState {
-	panic("unexpected GetInterpreterSharedState call")
-}
-
-func (NoopRuntimeInterface) AccountKeysCount(_ runtime.Address) (uint64, error) {
-	panic("unexpected AccountKeysCount call")
-}
-
-func (NoopRuntimeInterface) BLSVerifyPOP(_ *runtime.PublicKey, _ []byte) (bool, error) {
-	panic("unexpected BLSVerifyPOP call")
-}
-
-func (NoopRuntimeInterface) BLSAggregateSignatures(_ [][]byte) ([]byte, error) {
-	panic("unexpected BLSAggregateSignatures call")
-}
-
-func (NoopRuntimeInterface) BLSAggregatePublicKeys(_ []*runtime.PublicKey) (*runtime.PublicKey, error) {
-	panic("unexpected BLSAggregatePublicKeys call")
-}
-
-func (NoopRuntimeInterface) ResourceOwnerChanged(_ *interpreter.Interpreter, _ *interpreter.CompositeValue, _ common.Address, _ common.Address) {
-	panic("unexpected ResourceOwnerChanged call")
-}
-
-func (NoopRuntimeInterface) GenerateAccountID(_ common.Address) (uint64, error) {
-	panic("unexpected GenerateAccountID call")
-}
-
-func (NoopRuntimeInterface) RecordTrace(_ string, _ runtime.Location, _ time.Duration, _ []attribute.KeyValue) {
-	panic("unexpected RecordTrace call")
-}
diff --git a/cmd/util/ledger/migrations/cadence_value_validation_test.go b/cmd/util/ledger/migrations/cadence_value_validation_test.go
index ab52742a5fd..117e27ea761 100644
--- a/cmd/util/ledger/migrations/cadence_value_validation_test.go
+++ b/cmd/util/ledger/migrations/cadence_value_validation_test.go
@@ -52,7 +52,7 @@ func TestValidateCadenceValues(t *testing.T) {
 				accountStatus.ToBytes(),
 			)
 
-			mr, err := newMigratorRuntime(address, []*ledger.Payload{accountStatusPayload})
+			mr, err := NewAtreeRegisterMigratorRuntime(address, []*ledger.Payload{accountStatusPayload})
 			require.NoError(t, err)
 
 			// Create new storage map
@@ -103,7 +103,7 @@ func TestValidateCadenceValues(t *testing.T) {
 		oldPayloads := createPayloads(interpreter.NewUnmeteredUInt64Value(1))
 		newPayloads := createPayloads(interpreter.NewUnmeteredUInt64Value(2))
 		wantErrorMsg := "failed to validate value for address 0000000000000001, domain storage, key 0: failed to validate ([AnyStruct][0]).([UInt64][1]): values differ: 1 (interpreter.UInt64Value) != 2 (interpreter.UInt64Value)"
-		wantVerboseMsg := "{\"level\":\"info\",\"address\":\"0000000000000001\",\"domain\":\"storage\",\"key\":\"0\",\"trace\":\"failed to validate ([AnyStruct][0]).([UInt64][1]): values differ: 1 (interpreter.UInt64Value) != 2 (interpreter.UInt64Value)\",\"old value\":\"[[0, 1]]\",\"new value\":\"[[0, 2]]\",\"message\":\"failed to validate value\"}\n"
+		wantVerboseMsg := "{\"level\":\"info\",\"address\":\"0000000000000001\",\"domain\":\"storage\",\"key\":\"0 (interpreter.StringStorageMapKey)\",\"trace\":\"failed to validate ([AnyStruct][0]).([UInt64][1]): values differ: 1 (interpreter.UInt64Value) != 2 (interpreter.UInt64Value)\",\"old value\":\"[[0, 1]]\",\"new value\":\"[[0, 2]]\",\"message\":\"failed to validate value\"}\n"
 
 		// Disable verbose logging
 		err := validateCadenceValues(
@@ -140,7 +140,7 @@ func createTestPayloads(t *testing.T, address common.Address, domain string) []*
 		accountStatus.ToBytes(),
 	)
 
-	mr, err := newMigratorRuntime(address, []*ledger.Payload{accountStatusPayload})
+	mr, err := NewAtreeRegisterMigratorRuntime(address, []*ledger.Payload{accountStatusPayload})
 	require.NoError(t, err)
 
 	// Create new storage map
diff --git a/cmd/util/ledger/migrations/change_contract_code_migration.go b/cmd/util/ledger/migrations/change_contract_code_migration.go
index 9c335fb9573..c2715bdc8d0 100644
--- a/cmd/util/ledger/migrations/change_contract_code_migration.go
+++ b/cmd/util/ledger/migrations/change_contract_code_migration.go
@@ -326,10 +326,7 @@ func SystemContractChanges(chainID flow.ChainID) []SystemContractChange {
 		// EVM related contracts
 		NewSystemContractChange(
 			systemContracts.EVMContract,
-			evm.ContractCode(
-				systemContracts.FlowToken.Address,
-				true,
-			),
+			evm.ContractCode(systemContracts.FlowToken.Address),
 		),
 	}
 }
diff --git a/cmd/util/ledger/migrations/deduplicate_contract_names_migration_test.go b/cmd/util/ledger/migrations/deduplicate_contract_names_migration_test.go
index ba81bc826cd..cc6f2a7827d 100644
--- a/cmd/util/ledger/migrations/deduplicate_contract_names_migration_test.go
+++ b/cmd/util/ledger/migrations/deduplicate_contract_names_migration_test.go
@@ -33,12 +33,6 @@ func TestDeduplicateContractNamesMigration(t *testing.T) {
 
 	accountStatus := environment.NewAccountStatus()
 	accountStatus.SetStorageUsed(1000)
-	accountStatusPayload := ledger.NewPayload(
-		convert.RegisterIDToLedgerKey(
-			flow.AccountStatusRegisterID(flow.ConvertAddress(address)),
-		),
-		accountStatus.ToBytes(),
-	)
 
 	contractNamesPayload := func(contractNames []byte) *ledger.Payload {
 		return ledger.NewPayload(
@@ -75,7 +69,7 @@ func TestDeduplicateContractNamesMigration(t *testing.T) {
 	t.Run("no contract names", func(t *testing.T) {
 		payloads, err := migration.MigrateAccount(ctx, address,
 			[]*ledger.Payload{
-				accountStatusPayload,
+				accountStatusPayload(address),
 			},
 		)
 
@@ -90,7 +84,7 @@ func TestDeduplicateContractNamesMigration(t *testing.T) {
 
 		payloads, err := migration.MigrateAccount(ctx, address,
 			[]*ledger.Payload{
-				accountStatusPayload,
+				accountStatusPayload(address),
 				contractNamesPayload(newContractNames),
 			},
 		)
@@ -111,7 +105,7 @@ func TestDeduplicateContractNamesMigration(t *testing.T) {
 
 		payloads, err := migration.MigrateAccount(ctx, address,
 			[]*ledger.Payload{
-				accountStatusPayload,
+				accountStatusPayload(address),
 				contractNamesPayload(newContractNames),
 			},
 		)
@@ -133,7 +127,7 @@ func TestDeduplicateContractNamesMigration(t *testing.T) {
 
 		payloads, err := migration.MigrateAccount(ctx, address,
 			[]*ledger.Payload{
-				accountStatusPayload,
+				accountStatusPayload(address),
 				contractNamesPayload(newContractNames),
 			},
 		)
@@ -154,7 +148,7 @@ func TestDeduplicateContractNamesMigration(t *testing.T) {
 
 		_, err = migration.MigrateAccount(ctx, address,
 			[]*ledger.Payload{
-				accountStatusPayload,
+				accountStatusPayload(address),
 				contractNamesPayload(newContractNames),
 			},
 		)
@@ -169,7 +163,7 @@ func TestDeduplicateContractNamesMigration(t *testing.T) {
 
 		payloads, err := migration.MigrateAccount(ctx, address,
 			[]*ledger.Payload{
-				accountStatusPayload,
+				accountStatusPayload(address),
 				contractNamesPayload(newContractNames),
 			},
 		)
@@ -206,7 +200,7 @@ func TestDeduplicateContractNamesMigration(t *testing.T) {
 
 		payloads, err := migration.MigrateAccount(ctx, address,
 			[]*ledger.Payload{
-				accountStatusPayload,
+				accountStatusPayload(address),
 				contractNamesPayload(newContractNames),
 			},
 		)
@@ -219,3 +213,14 @@ func TestDeduplicateContractNamesMigration(t *testing.T) {
 		})
 	})
 }
+
+func accountStatusPayload(address common.Address) *ledger.Payload {
+	accountStatus := environment.NewAccountStatus()
+
+	return ledger.NewPayload(
+		convert.RegisterIDToLedgerKey(
+			flow.AccountStatusRegisterID(flow.ConvertAddress(address)),
+		),
+		accountStatus.ToBytes(),
+	)
+}
diff --git a/cmd/util/ledger/migrations/migrator_runtime.go b/cmd/util/ledger/migrations/migrator_runtime.go
deleted file mode 100644
index 7157e705e7a..00000000000
--- a/cmd/util/ledger/migrations/migrator_runtime.go
+++ /dev/null
@@ -1,84 +0,0 @@
-package migrations
-
-import (
-	"fmt"
-
-	"github.com/onflow/cadence/runtime"
-	"github.com/onflow/cadence/runtime/common"
-	"github.com/onflow/cadence/runtime/interpreter"
-
-	"github.com/onflow/flow-go/cmd/util/ledger/util"
-	"github.com/onflow/flow-go/fvm/environment"
-	"github.com/onflow/flow-go/fvm/storage/state"
-	"github.com/onflow/flow-go/ledger"
-)
-
-// migratorRuntime is a runtime that can be used to run a migration on a single account
-func newMigratorRuntime(
-	address common.Address,
-	payloads []*ledger.Payload,
-) (
-	*migratorRuntime,
-	error,
-) {
-	snapshot, err := util.NewPayloadSnapshot(payloads)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create payload snapshot: %w", err)
-	}
-	transactionState := state.NewTransactionState(snapshot, state.DefaultParameters())
-	accounts := environment.NewAccounts(transactionState)
-
-	accountsAtreeLedger := util.NewAccountsAtreeLedger(accounts)
-	storage := runtime.NewStorage(accountsAtreeLedger, util.NopMemoryGauge{})
-
-	ri := &util.MigrationRuntimeInterface{
-		Accounts: accounts,
-	}
-
-	env := runtime.NewBaseInterpreterEnvironment(runtime.Config{
-		AccountLinkingEnabled: true,
-		// Attachments are enabled everywhere except for Mainnet
-		AttachmentsEnabled: true,
-		// Capability Controllers are enabled everywhere except for Mainnet
-		CapabilityControllersEnabled: true,
-	})
-
-	env.Configure(
-		ri,
-		runtime.NewCodesAndPrograms(),
-		storage,
-		runtime.NewCoverageReport(),
-	)
-
-	inter, err := interpreter.NewInterpreter(
-		nil,
-		nil,
-		env.InterpreterConfig)
-	if err != nil {
-		return nil, err
-	}
-
-	return &migratorRuntime{
-		Address:          address,
-		Payloads:         payloads,
-		Snapshot:         snapshot,
-		TransactionState: transactionState,
-		Interpreter:      inter,
-		Storage:          storage,
-		Accounts:         accountsAtreeLedger,
-	}, nil
-}
-
-type migratorRuntime struct {
-	Snapshot         *util.PayloadSnapshot
-	TransactionState state.NestedTransactionPreparer
-	Interpreter      *interpreter.Interpreter
-	Storage          *runtime.Storage
-	Payloads         []*ledger.Payload
-	Address          common.Address
-	Accounts         *util.AccountsAtreeLedger
-}
-
-func (mr *migratorRuntime) GetReadOnlyStorage() *runtime.Storage {
-	return runtime.NewStorage(util.NewPayloadsReadonlyLedger(mr.Snapshot), util.NopMemoryGauge{})
-}
diff --git a/cmd/util/ledger/migrations/utils.go b/cmd/util/ledger/migrations/utils.go
index e747b3dc508..f9ce19b84e8 100644
--- a/cmd/util/ledger/migrations/utils.go
+++ b/cmd/util/ledger/migrations/utils.go
@@ -4,58 +4,62 @@ import (
 	"fmt"
 
 	"github.com/onflow/atree"
+	"github.com/onflow/cadence/runtime"
+	"github.com/onflow/cadence/runtime/common"
+	"github.com/onflow/cadence/runtime/stdlib"
 
-	"github.com/onflow/flow-go/fvm/environment"
-	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/ledger"
+	"github.com/onflow/flow-go/ledger/common/convert"
 )
 
-type AccountsAtreeLedger struct {
-	Accounts environment.Accounts
-}
+func checkStorageHealth(
+	address common.Address,
+	storage *runtime.Storage,
+	payloads []*ledger.Payload,
+) error {
 
-func NewAccountsAtreeLedger(accounts environment.Accounts) *AccountsAtreeLedger {
-	return &AccountsAtreeLedger{Accounts: accounts}
-}
+	for _, payload := range payloads {
+		registerID, _, err := convert.PayloadToRegister(payload)
+		if err != nil {
+			return fmt.Errorf("failed to convert payload to register: %w", err)
+		}
 
-var _ atree.Ledger = &AccountsAtreeLedger{}
+		if !registerID.IsSlabIndex() {
+			continue
+		}
 
-func (a *AccountsAtreeLedger) GetValue(owner, key []byte) ([]byte, error) {
-	v, err := a.Accounts.GetValue(
-		flow.NewRegisterID(
-			flow.BytesToAddress(owner),
-			string(key)))
-	if err != nil {
-		return nil, fmt.Errorf("getting value failed: %w", err)
-	}
-	return v, nil
-}
+		// Convert the register ID to a storage ID.
+		slabID := atree.NewStorageID(
+			atree.Address([]byte(registerID.Owner)),
+			atree.StorageIndex([]byte(registerID.Key[1:])))
 
-func (a *AccountsAtreeLedger) SetValue(owner, key, value []byte) error {
-	err := a.Accounts.SetValue(
-		flow.NewRegisterID(
-			flow.BytesToAddress(owner),
-			string(key)),
-		value)
-	if err != nil {
-		return fmt.Errorf("setting value failed: %w", err)
+		// Retrieve the slab.
+		_, _, err = storage.Retrieve(slabID)
+		if err != nil {
+			return fmt.Errorf("failed to retrieve slab %s: %w", slabID, err)
+		}
 	}
-	return nil
-}
 
-func (a *AccountsAtreeLedger) ValueExists(owner, key []byte) (exists bool, err error) {
-	v, err := a.GetValue(owner, key)
-	if err != nil {
-		return false, fmt.Errorf("checking value existence failed: %w", err)
+	for _, domain := range allStorageMapDomains {
+		_ = storage.GetStorageMap(address, domain, false)
 	}
 
-	return len(v) > 0, nil
+	return storage.CheckHealth()
+}
+
+var allStorageMapDomains = []string{
+	common.PathDomainStorage.Identifier(),
+	common.PathDomainPrivate.Identifier(),
+	common.PathDomainPublic.Identifier(),
+	runtime.StorageDomainContract,
+	stdlib.InboxStorageDomain,
+	stdlib.CapabilityControllerStorageDomain,
 }
 
-// AllocateStorageIndex allocates new storage index under the owner accounts to store a new register
-func (a *AccountsAtreeLedger) AllocateStorageIndex(owner []byte) (atree.StorageIndex, error) {
-	v, err := a.Accounts.AllocateStorageIndex(flow.BytesToAddress(owner))
-	if err != nil {
-		return atree.StorageIndex{}, fmt.Errorf("storage address allocation failed: %w", err)
+var allStorageMapDomainsSet = map[string]struct{}{}
+
+func init() {
+	for _, domain := range allStorageMapDomains {
+		allStorageMapDomainsSet[domain] = struct{}{}
 	}
-	return v, nil
 }
diff --git a/cmd/util/ledger/util/migration_runtime_interface.go b/cmd/util/ledger/util/migration_runtime_interface.go
deleted file mode 100644
index c72d8493095..00000000000
--- a/cmd/util/ledger/util/migration_runtime_interface.go
+++ /dev/null
@@ -1,295 +0,0 @@
-package util
-
-import (
-	"fmt"
-	"time"
-
-	"go.opentelemetry.io/otel/attribute"
-
-	"github.com/onflow/atree"
-	"github.com/onflow/cadence"
-	"github.com/onflow/cadence/runtime"
-	"github.com/onflow/cadence/runtime/common"
-	"github.com/onflow/cadence/runtime/interpreter"
-
-	"github.com/onflow/flow-go/fvm/environment"
-	"github.com/onflow/flow-go/model/flow"
-)
-
-// MigrationRuntimeInterface is a runtime interface that can be used in migrations.
-type MigrationRuntimeInterface struct {
-	Accounts environment.Accounts
-	Programs *environment.Programs
-
-	// GetOrLoadProgramFunc allows for injecting extra logic
-	GetOrLoadProgramFunc func(location runtime.Location, load func() (*interpreter.Program, error)) (*interpreter.Program, error)
-}
-
-func (m MigrationRuntimeInterface) ResolveLocation(
-	identifiers []runtime.Identifier,
-	location runtime.Location,
-) ([]runtime.ResolvedLocation, error) {
-
-	addressLocation, isAddress := location.(common.AddressLocation)
-
-	// if the location is not an address location, e.g. an identifier location (`import Crypto`),
-	// then return a single resolved location which declares all identifiers.
-	if !isAddress {
-		return []runtime.ResolvedLocation{
-			{
-				Location:    location,
-				Identifiers: identifiers,
-			},
-		}, nil
-	}
-
-	// if the location is an address,
-	// and no specific identifiers where requested in the import statement,
-	// then fetch all identifiers at this address
-	if len(identifiers) == 0 {
-		address := flow.Address(addressLocation.Address)
-
-		contractNames, err := m.Accounts.GetContractNames(address)
-		if err != nil {
-			return nil, fmt.Errorf("ResolveLocation failed: %w", err)
-		}
-
-		// if there are no contractNames deployed,
-		// then return no resolved locations
-		if len(contractNames) == 0 {
-			return nil, nil
-		}
-
-		identifiers = make([]runtime.Identifier, len(contractNames))
-
-		for i := range identifiers {
-			identifiers[i] = runtime.Identifier{
-				Identifier: contractNames[i],
-			}
-		}
-	}
-
-	// return one resolved location per identifier.
-	// each resolved location is an address contract location
-	resolvedLocations := make([]runtime.ResolvedLocation, len(identifiers))
-	for i := range resolvedLocations {
-		identifier := identifiers[i]
-		resolvedLocations[i] = runtime.ResolvedLocation{
-			Location: common.AddressLocation{
-				Address: addressLocation.Address,
-				Name:    identifier.Identifier,
-			},
-			Identifiers: []runtime.Identifier{identifier},
-		}
-	}
-
-	return resolvedLocations, nil
-}
-
-func (m MigrationRuntimeInterface) GetCode(location runtime.Location) ([]byte, error) {
-	contractLocation, ok := location.(common.AddressLocation)
-	if !ok {
-		return nil, fmt.Errorf("GetCode failed: expected AddressLocation")
-	}
-
-	add, err := m.Accounts.GetContract(contractLocation.Name, flow.Address(contractLocation.Address))
-	if err != nil {
-		return nil, fmt.Errorf("GetCode failed: %w", err)
-	}
-
-	return add, nil
-}
-
-func (m MigrationRuntimeInterface) GetAccountContractCode(
-	l common.AddressLocation,
-) (code []byte, err error) {
-	return m.Accounts.GetContract(l.Name, flow.Address(l.Address))
-}
-
-func (m MigrationRuntimeInterface) GetOrLoadProgram(location runtime.Location, load func() (*interpreter.Program, error)) (*interpreter.Program, error) {
-	if m.GetOrLoadProgramFunc != nil {
-		return m.GetOrLoadProgramFunc(location, load)
-	}
-
-	return m.Programs.GetOrLoadProgram(location, load)
-}
-
-func (m MigrationRuntimeInterface) MeterMemory(_ common.MemoryUsage) error {
-	return nil
-}
-
-func (m MigrationRuntimeInterface) MeterComputation(_ common.ComputationKind, _ uint) error {
-	return nil
-}
-
-func (m MigrationRuntimeInterface) GetValue(_, _ []byte) (value []byte, err error) {
-	panic("unexpected GetValue call")
-}
-
-func (m MigrationRuntimeInterface) SetValue(_, _, _ []byte) (err error) {
-	panic("unexpected SetValue call")
-}
-
-func (m MigrationRuntimeInterface) CreateAccount(_ runtime.Address) (address runtime.Address, err error) {
-	panic("unexpected CreateAccount call")
-}
-
-func (m MigrationRuntimeInterface) AddEncodedAccountKey(_ runtime.Address, _ []byte) error {
-	panic("unexpected AddEncodedAccountKey call")
-}
-
-func (m MigrationRuntimeInterface) RevokeEncodedAccountKey(_ runtime.Address, _ int) (publicKey []byte, err error) {
-	panic("unexpected RevokeEncodedAccountKey call")
-}
-
-func (m MigrationRuntimeInterface) AddAccountKey(_ runtime.Address, _ *runtime.PublicKey, _ runtime.HashAlgorithm, _ int) (*runtime.AccountKey, error) {
-	panic("unexpected AddAccountKey call")
-}
-
-func (m MigrationRuntimeInterface) GetAccountKey(_ runtime.Address, _ int) (*runtime.AccountKey, error) {
-	panic("unexpected GetAccountKey call")
-}
-
-func (m MigrationRuntimeInterface) RevokeAccountKey(_ runtime.Address, _ int) (*runtime.AccountKey, error) {
-	panic("unexpected RevokeAccountKey call")
-}
-
-func (m MigrationRuntimeInterface) UpdateAccountContractCode(_ common.AddressLocation, _ []byte) (err error) {
-	panic("unexpected UpdateAccountContractCode call")
-}
-
-func (m MigrationRuntimeInterface) RemoveAccountContractCode(common.AddressLocation) (err error) {
-	panic("unexpected RemoveAccountContractCode call")
-}
-
-func (m MigrationRuntimeInterface) GetSigningAccounts() ([]runtime.Address, error) {
-	panic("unexpected GetSigningAccounts call")
-}
-
-func (m MigrationRuntimeInterface) ProgramLog(_ string) error {
-	panic("unexpected ProgramLog call")
-}
-
-func (m MigrationRuntimeInterface) EmitEvent(_ cadence.Event) error {
-	panic("unexpected EmitEvent call")
-}
-
-func (m MigrationRuntimeInterface) ValueExists(_, _ []byte) (exists bool, err error) {
-	panic("unexpected ValueExists call")
-}
-
-func (m MigrationRuntimeInterface) GenerateUUID() (uint64, error) {
-	panic("unexpected GenerateUUID call")
-}
-
-func (m MigrationRuntimeInterface) GetComputationLimit() uint64 {
-	panic("unexpected GetComputationLimit call")
-}
-
-func (m MigrationRuntimeInterface) SetComputationUsed(_ uint64) error {
-	panic("unexpected SetComputationUsed call")
-}
-
-func (m MigrationRuntimeInterface) DecodeArgument(_ []byte, _ cadence.Type) (cadence.Value, error) {
-	panic("unexpected DecodeArgument call")
-}
-
-func (m MigrationRuntimeInterface) GetCurrentBlockHeight() (uint64, error) {
-	panic("unexpected GetCurrentBlockHeight call")
-}
-
-func (m MigrationRuntimeInterface) GetBlockAtHeight(_ uint64) (block runtime.Block, exists bool, err error) {
-	panic("unexpected GetBlockAtHeight call")
-}
-
-func (m MigrationRuntimeInterface) ReadRandom([]byte) error {
-	panic("unexpected ReadRandom call")
-}
-
-func (m MigrationRuntimeInterface) VerifySignature(_ []byte, _ string, _ []byte, _ []byte, _ runtime.SignatureAlgorithm, _ runtime.HashAlgorithm) (bool, error) {
-	panic("unexpected VerifySignature call")
-}
-
-func (m MigrationRuntimeInterface) Hash(_ []byte, _ string, _ runtime.HashAlgorithm) ([]byte, error) {
-	panic("unexpected Hash call")
-}
-
-func (m MigrationRuntimeInterface) GetAccountBalance(_ common.Address) (value uint64, err error) {
-	panic("unexpected GetAccountBalance call")
-}
-
-func (m MigrationRuntimeInterface) GetAccountAvailableBalance(_ common.Address) (value uint64, err error) {
-	panic("unexpected GetAccountAvailableBalance call")
-}
-
-func (m MigrationRuntimeInterface) GetStorageUsed(_ runtime.Address) (value uint64, err error) {
-	panic("unexpected GetStorageUsed call")
-}
-
-func (m MigrationRuntimeInterface) GetStorageCapacity(_ runtime.Address) (value uint64, err error) {
-	panic("unexpected GetStorageCapacity call")
-}
-
-func (m MigrationRuntimeInterface) ImplementationDebugLog(_ string) error {
-	panic("unexpected ImplementationDebugLog call")
-}
-
-func (m MigrationRuntimeInterface) ValidatePublicKey(_ *runtime.PublicKey) error {
-	panic("unexpected ValidatePublicKey call")
-}
-
-func (m MigrationRuntimeInterface) GetAccountContractNames(_ runtime.Address) ([]string, error) {
-	panic("unexpected GetAccountContractNames call")
-}
-
-func (m MigrationRuntimeInterface) AllocateStorageIndex(_ []byte) (atree.StorageIndex, error) {
-	panic("unexpected AllocateStorageIndex call")
-}
-
-func (m MigrationRuntimeInterface) ComputationUsed() (uint64, error) {
-	panic("unexpected ComputationUsed call")
-}
-
-func (m MigrationRuntimeInterface) MemoryUsed() (uint64, error) {
-	panic("unexpected MemoryUsed call")
-}
-
-func (m MigrationRuntimeInterface) InteractionUsed() (uint64, error) {
-	panic("unexpected InteractionUsed call")
-}
-
-func (m MigrationRuntimeInterface) SetInterpreterSharedState(_ *interpreter.SharedState) {
-	panic("unexpected SetInterpreterSharedState call")
-}
-
-func (m MigrationRuntimeInterface) GetInterpreterSharedState() *interpreter.SharedState {
-	panic("unexpected GetInterpreterSharedState call")
-}
-
-func (m MigrationRuntimeInterface) AccountKeysCount(_ runtime.Address) (uint64, error) {
-	panic("unexpected AccountKeysCount call")
-}
-
-func (m MigrationRuntimeInterface) BLSVerifyPOP(_ *runtime.PublicKey, _ []byte) (bool, error) {
-	panic("unexpected BLSVerifyPOP call")
-}
-
-func (m MigrationRuntimeInterface) BLSAggregateSignatures(_ [][]byte) ([]byte, error) {
-	panic("unexpected BLSAggregateSignatures call")
-}
-
-func (m MigrationRuntimeInterface) BLSAggregatePublicKeys(_ []*runtime.PublicKey) (*runtime.PublicKey, error) {
-	panic("unexpected BLSAggregatePublicKeys call")
-}
-
-func (m MigrationRuntimeInterface) ResourceOwnerChanged(_ *interpreter.Interpreter, _ *interpreter.CompositeValue, _ common.Address, _ common.Address) {
-	panic("unexpected ResourceOwnerChanged call")
-}
-
-func (m MigrationRuntimeInterface) GenerateAccountID(_ common.Address) (uint64, error) {
-	panic("unexpected GenerateAccountID call")
-}
-
-func (m MigrationRuntimeInterface) RecordTrace(_ string, _ runtime.Location, _ time.Duration, _ []attribute.KeyValue) {
-	panic("unexpected RecordTrace call")
-}
diff --git a/cmd/util/ledger/util/payload_file.go b/cmd/util/ledger/util/payload_file.go
new file mode 100644
index 00000000000..76d80a79cf5
--- /dev/null
+++ b/cmd/util/ledger/util/payload_file.go
@@ -0,0 +1,430 @@
+package util
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"io"
+	"math"
+	"os"
+
+	"github.com/fxamacker/cbor/v2"
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/cadence/runtime/common"
+
+	"github.com/onflow/flow-go/ledger"
+	"github.com/onflow/flow-go/ledger/complete/wal"
+)
+
+const (
+	defaultBufioWriteSize = 1024 * 32
+	defaultBufioReadSize  = 1024 * 32
+
+	payloadEncodingVersion = 1
+)
+
+const (
+	PayloadFileVersionV1 uint16 = 0x01
+
+	encMagicBytesIndex       = 0
+	encMagicBytesSize        = 2
+	encVersionIndex          = 2
+	encVersionSize           = 2
+	encFlagIndex             = 4
+	encFlagLowByteIndex      = 5
+	encPartialStateFlagIndex = encFlagLowByteIndex
+	encFlagSize              = 2
+	headerSize               = encMagicBytesSize + encVersionSize + encFlagSize
+	encPayloadCountSize      = 8
+	footerSize               = encPayloadCountSize
+	crc32SumSize             = 4
+)
+
+const (
+	maskPartialState byte = 0b0000_0001
+)
+
+// newPayloadFileHeader() returns payload header, consisting of:
+// - magic bytes (2 bytes)
+// - version (2 bytes)
+// - flags (2 bytes)
+func newPayloadFileHeader(version uint16, partialState bool) []byte {
+	var header [headerSize]byte
+
+	// Write magic bytes.
+	binary.BigEndian.PutUint16(header[encMagicBytesIndex:], wal.MagicBytesPayloadHeader)
+
+	// Write version.
+	binary.BigEndian.PutUint16(header[encVersionIndex:], version)
+
+	// Write flag.
+	if partialState {
+		header[encPartialStateFlagIndex] |= maskPartialState
+	}
+
+	return header[:]
+}
+
+// parsePayloadFileHeader verifies magic bytes and version in payload header.
+func parsePayloadFileHeader(header []byte) (partialState bool, err error) {
+	if len(header) != headerSize {
+		return false, fmt.Errorf("can't parse payload header: got %d bytes, expected %d bytes", len(header), headerSize)
+	}
+
+	// Read magic bytes.
+	gotMagicBytes := binary.BigEndian.Uint16(header[encMagicBytesIndex:])
+	if gotMagicBytes != wal.MagicBytesPayloadHeader {
+		return false, fmt.Errorf("can't parse payload header: got magic bytes %d, expected %d", gotMagicBytes, wal.MagicBytesPayloadHeader)
+	}
+
+	// Read version.
+	gotVersion := binary.BigEndian.Uint16(header[encVersionIndex:])
+	if gotVersion != PayloadFileVersionV1 {
+		return false, fmt.Errorf("can't parse payload header: got version %d, expected %d", gotVersion, PayloadFileVersionV1)
+	}
+
+	// Read partial state flag.
+	partialState = header[encPartialStateFlagIndex]&maskPartialState != 0
+
+	return partialState, nil
+}
+
+// newPayloadFileFooter returns payload footer.
+// - payload count (8 bytes)
+func newPayloadFileFooter(payloadCount int) []byte {
+	var footer [footerSize]byte
+
+	binary.BigEndian.PutUint64(footer[:], uint64(payloadCount))
+
+	return footer[:]
+}
+
+// parsePayloadFooter returns payload count from footer.
+func parsePayloadFooter(footer []byte) (payloadCount int, err error) {
+	if len(footer) != footerSize {
+		return 0, fmt.Errorf("can't parse payload footer: got %d bytes, expected %d bytes", len(footer), footerSize)
+	}
+
+	count := binary.BigEndian.Uint64(footer)
+	if count > math.MaxInt {
+		return 0, fmt.Errorf("can't parse payload footer: got %d payload count, expected payload count < %d", count, math.MaxInt)
+	}
+
+	return int(count), nil
+}
+
+func CreatePayloadFile(
+	logger zerolog.Logger,
+	payloadFile string,
+	payloads []*ledger.Payload,
+	addresses []common.Address,
+	inputPayloadsFromPartialState bool,
+) (int, error) {
+
+	partialState := inputPayloadsFromPartialState || len(addresses) > 0
+
+	f, err := os.Create(payloadFile)
+	if err != nil {
+		return 0, fmt.Errorf("can't create %s: %w", payloadFile, err)
+	}
+	defer f.Close()
+
+	writer := bufio.NewWriterSize(f, defaultBufioWriteSize)
+	if err != nil {
+		return 0, fmt.Errorf("can't create bufio writer for %s: %w", payloadFile, err)
+	}
+	defer writer.Flush()
+
+	// TODO: replace CRC-32 checksum.
+	// For now, CRC-32 checksum is used because checkpoint files (~21GB input files) already uses CRC-32 checksum.
+	// Additionally, the primary purpose of this intermediate payload file (since Feb 12, 2024) is to speed up
+	// development, testing, and troubleshooting by allowing a small subset of payloads to be extracted.
+	// However, we should replace it since it is inappropriate for large files as already suggested at:
+	// - September 28, 2022: https://github.com/onflow/flow-go/issues/3302
+	// - September 26, 2022 (asked if SHA2 should replace CRC32) https://github.com/onflow/flow-go/pull/3273#discussion_r980433612
+	// - February 24, 2022 (TODO suggested BLAKE2, etc. to replace CRC32):  https://github.com/onflow/flow-go/pull/1944
+	crc32Writer := wal.NewCRC32Writer(writer)
+
+	// Write header with magic bytes, version, and flags.
+	header := newPayloadFileHeader(PayloadFileVersionV1, partialState)
+
+	_, err = crc32Writer.Write(header)
+	if err != nil {
+		return 0, fmt.Errorf("can't write payload file head for %s: %w", payloadFile, err)
+	}
+
+	includeAllPayloads := len(addresses) == 0
+
+	// Write payloads.
+	var writtenPayloadCount int
+	if includeAllPayloads {
+		writtenPayloadCount, err = writePayloads(logger, crc32Writer, payloads)
+	} else {
+		writtenPayloadCount, err = writeSelectedPayloads(logger, crc32Writer, payloads, addresses)
+	}
+
+	if err != nil {
+		return 0, fmt.Errorf("can't write payload for %s: %w", payloadFile, err)
+	}
+
+	// Write footer with payload count.
+	footer := newPayloadFileFooter(writtenPayloadCount)
+
+	_, err = crc32Writer.Write(footer)
+	if err != nil {
+		return 0, fmt.Errorf("can't write payload footer for %s: %w", payloadFile, err)
+	}
+
+	// Write CRC32 sum for validation
+	var crc32buf [crc32SumSize]byte
+	binary.BigEndian.PutUint32(crc32buf[:], crc32Writer.Crc32())
+
+	_, err = writer.Write(crc32buf[:])
+	if err != nil {
+		return 0, fmt.Errorf("can't write CRC32 for %s: %w", payloadFile, err)
+	}
+
+	return writtenPayloadCount, nil
+}
+
+func writePayloads(logger zerolog.Logger, w io.Writer, payloads []*ledger.Payload) (int, error) {
+	logger.Info().Msgf("writing %d payloads to file", len(payloads))
+
+	enc := cbor.NewEncoder(w)
+
+	var payloadScratchBuffer [1024 * 2]byte
+	for _, p := range payloads {
+
+		buf := ledger.EncodeAndAppendPayloadWithoutPrefix(payloadScratchBuffer[:0], p, payloadEncodingVersion)
+
+		// Encode payload
+		err := enc.Encode(buf)
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	return len(payloads), nil
+}
+
+func writeSelectedPayloads(logger zerolog.Logger, w io.Writer, payloads []*ledger.Payload, addresses []common.Address) (int, error) {
+	logger.Info().Msgf("filtering %d payloads and writing selected payloads to file", len(payloads))
+
+	enc := cbor.NewEncoder(w)
+
+	var includedPayloadCount int
+	var payloadScratchBuffer [1024 * 2]byte
+	for _, p := range payloads {
+		include, err := includePayloadByAddresses(p, addresses)
+		if err != nil {
+			return 0, err
+		}
+		if !include {
+			continue
+		}
+
+		buf := ledger.EncodeAndAppendPayloadWithoutPrefix(payloadScratchBuffer[:0], p, payloadEncodingVersion)
+
+		// Encode payload
+		err = enc.Encode(buf)
+		if err != nil {
+			return 0, err
+		}
+
+		includedPayloadCount++
+	}
+
+	return includedPayloadCount, nil
+}
+
+func includePayloadByAddresses(payload *ledger.Payload, addresses []common.Address) (bool, error) {
+	if len(addresses) == 0 {
+		// Include all payloads
+		return true, nil
+	}
+
+	k, err := payload.Key()
+	if err != nil {
+		return false, fmt.Errorf("can't get key from payload: %w", err)
+	}
+
+	owner := k.KeyParts[0].Value
+
+	for _, address := range addresses {
+		if bytes.Equal(owner, address[:]) {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+func ReadPayloadFile(logger zerolog.Logger, payloadFile string) (bool, []*ledger.Payload, error) {
+
+	fInfo, err := os.Stat(payloadFile)
+	if os.IsNotExist(err) {
+		return false, nil, fmt.Errorf("%s doesn't exist", payloadFile)
+	}
+
+	fsize := fInfo.Size()
+
+	f, err := os.Open(payloadFile)
+	if err != nil {
+		return false, nil, fmt.Errorf("can't open %s: %w", payloadFile, err)
+	}
+	defer f.Close()
+
+	partialState, payloadCount, err := readMetaDataFromPayloadFile(f)
+	if err != nil {
+		return false, nil, err
+	}
+
+	bufReader := bufio.NewReaderSize(f, defaultBufioReadSize)
+
+	crcReader := wal.NewCRC32Reader(bufReader)
+
+	// Skip header (processed already)
+	_, err = io.CopyN(io.Discard, crcReader, headerSize)
+	if err != nil {
+		return false, nil, fmt.Errorf("can't read and discard header: %w", err)
+	}
+
+	if partialState {
+		logger.Info().Msgf("reading %d payloads (partial state) from file", payloadCount)
+	} else {
+		logger.Info().Msgf("reading %d payloads from file", payloadCount)
+	}
+
+	encPayloadSize := fsize - headerSize - footerSize - crc32SumSize
+
+	// NOTE: We need to limit the amount of data CBOR codec reads
+	// because CBOR codec reads chunks of data under the hood for
+	// performance and we don't want crcReader to proces data
+	// containing CRC-32 checksum.
+	dec := cbor.NewDecoder(io.LimitReader(crcReader, encPayloadSize))
+
+	payloads := make([]*ledger.Payload, payloadCount)
+
+	for i := 0; i < payloadCount; i++ {
+		var rawPayload []byte
+		err := dec.Decode(&rawPayload)
+		if err != nil {
+			return false, nil, fmt.Errorf("can't decode payload in CBOR: %w", err)
+		}
+
+		payload, err := ledger.DecodePayloadWithoutPrefix(rawPayload, false, payloadEncodingVersion)
+		if err != nil {
+			return false, nil, fmt.Errorf("can't decode payload 0x%x: %w", rawPayload, err)
+		}
+
+		payloads[i] = payload
+	}
+
+	// Skip footer (processed already)
+	_, err = io.CopyN(io.Discard, crcReader, footerSize)
+	if err != nil {
+		return false, nil, fmt.Errorf("can't read and discard footer: %w", err)
+	}
+
+	// Read CRC32
+	var crc32buf [crc32SumSize]byte
+	_, err = io.ReadFull(bufReader, crc32buf[:])
+	if err != nil {
+		return false, nil, fmt.Errorf("can't read CRC32: %w", err)
+	}
+
+	readCrc32 := binary.BigEndian.Uint32(crc32buf[:])
+
+	calculatedCrc32 := crcReader.Crc32()
+
+	if calculatedCrc32 != readCrc32 {
+		return false, nil, fmt.Errorf("payload file checksum failed! File contains %x but calculated crc32 is %x", readCrc32, calculatedCrc32)
+	}
+
+	// Verify EOF is reached
+	_, err = io.CopyN(io.Discard, bufReader, 1)
+	if err == nil || err != io.EOF {
+		return false, nil, fmt.Errorf("can't process payload file: found trailing data")
+	}
+
+	return partialState, payloads, nil
+}
+
+// readMetaDataFromPayloadFile reads metadata from header and footer.
+// NOTE: readMetaDataFromPayloadFile resets file offset to start of file in exit.
+func readMetaDataFromPayloadFile(f *os.File) (partialState bool, payloadCount int, err error) {
+	defer func() {
+		_, seekErr := f.Seek(0, io.SeekStart)
+		if err == nil {
+			err = seekErr
+		}
+	}()
+
+	// Seek to header
+	_, err = f.Seek(0, io.SeekStart)
+	if err != nil {
+		return false, 0, fmt.Errorf("can't seek to start of payload file: %w", err)
+	}
+
+	var header [headerSize]byte
+
+	// Read header
+	_, err = io.ReadFull(f, header[:])
+	if err != nil {
+		return false, 0, fmt.Errorf("can't read payload header: %w", err)
+	}
+
+	// Parse header
+	partialState, err = parsePayloadFileHeader(header[:])
+	if err != nil {
+		return false, 0, err
+	}
+
+	const footerOffset = footerSize + crc32SumSize
+
+	// Seek to footer
+	_, err = f.Seek(-footerOffset, io.SeekEnd)
+	if err != nil {
+		return false, 0, fmt.Errorf("can't seek to payload footer: %w", err)
+	}
+
+	var footer [footerSize]byte
+
+	// Read footer
+	_, err = io.ReadFull(f, footer[:])
+	if err != nil {
+		return false, 0, fmt.Errorf("can't read payload footer: %w", err)
+	}
+
+	// Parse footer
+	payloadCount, err = parsePayloadFooter(footer[:])
+	if err != nil {
+		return false, 0, err
+	}
+
+	return partialState, payloadCount, nil
+}
+
+func IsPayloadFilePartialState(payloadFile string) (bool, error) {
+	if _, err := os.Stat(payloadFile); os.IsNotExist(err) {
+		return false, fmt.Errorf("%s doesn't exist", payloadFile)
+	}
+
+	f, err := os.Open(payloadFile)
+	if err != nil {
+		return false, fmt.Errorf("can't open %s: %w", payloadFile, err)
+	}
+	defer f.Close()
+
+	var header [headerSize]byte
+
+	// Read header
+	_, err = io.ReadFull(f, header[:])
+	if err != nil {
+		return false, fmt.Errorf("can't read payload header: %w", err)
+	}
+
+	return header[encPartialStateFlagIndex]&maskPartialState != 0, nil
+}
diff --git a/cmd/util/ledger/util/payload_file_test.go b/cmd/util/ledger/util/payload_file_test.go
new file mode 100644
index 00000000000..2ce69dc5876
--- /dev/null
+++ b/cmd/util/ledger/util/payload_file_test.go
@@ -0,0 +1,343 @@
+package util_test
+
+import (
+	"bytes"
+	"crypto/rand"
+	"path/filepath"
+	"testing"
+
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/cadence/runtime/common"
+
+	"github.com/onflow/flow-go/cmd/util/ledger/util"
+	"github.com/onflow/flow-go/ledger"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+type keyPair struct {
+	key   ledger.Key
+	value ledger.Value
+}
+
+func TestPayloadFile(t *testing.T) {
+
+	const fileName = "root.payload"
+
+	t.Run("without filter, input payloads represent partial state", func(t *testing.T) {
+		unittest.RunWithTempDir(t, func(datadir string) {
+			size := 10
+
+			payloadFileName := filepath.Join(datadir, fileName)
+
+			// Generate some data
+			keysValues := make(map[string]keyPair)
+			var payloads []*ledger.Payload
+
+			for i := 0; i < size; i++ {
+				keys, values := getSampleKeyValues(i)
+
+				for j, key := range keys {
+					keysValues[key.String()] = keyPair{
+						key:   key,
+						value: values[j],
+					}
+
+					payloads = append(payloads, ledger.NewPayload(key, values[j]))
+				}
+			}
+
+			numOfPayloadWritten, err := util.CreatePayloadFile(
+				zerolog.Nop(),
+				payloadFileName,
+				payloads,
+				nil,
+				true, // input payloads represent partial state
+			)
+			require.NoError(t, err)
+			require.Equal(t, len(payloads), numOfPayloadWritten)
+
+			partialState, err := util.IsPayloadFilePartialState(payloadFileName)
+			require.NoError(t, err)
+			require.True(t, partialState)
+
+			partialState, payloadsFromFile, err := util.ReadPayloadFile(zerolog.Nop(), payloadFileName)
+			require.NoError(t, err)
+			require.Equal(t, len(payloads), len(payloadsFromFile))
+			require.True(t, partialState)
+
+			for _, payloadFromFile := range payloadsFromFile {
+				k, err := payloadFromFile.Key()
+				require.NoError(t, err)
+
+				kv, exist := keysValues[k.String()]
+				require.True(t, exist)
+
+				require.Equal(t, kv.value, payloadFromFile.Value())
+			}
+		})
+	})
+	t.Run("without filter", func(t *testing.T) {
+		unittest.RunWithTempDir(t, func(datadir string) {
+			size := 10
+
+			payloadFileName := filepath.Join(datadir, fileName)
+
+			// Generate some data
+			keysValues := make(map[string]keyPair)
+			var payloads []*ledger.Payload
+
+			for i := 0; i < size; i++ {
+				keys, values := getSampleKeyValues(i)
+
+				for j, key := range keys {
+					keysValues[key.String()] = keyPair{
+						key:   key,
+						value: values[j],
+					}
+
+					payloads = append(payloads, ledger.NewPayload(key, values[j]))
+				}
+			}
+
+			numOfPayloadWritten, err := util.CreatePayloadFile(
+				zerolog.Nop(),
+				payloadFileName,
+				payloads,
+				nil,
+				false, // input payloads represent entire state
+			)
+			require.NoError(t, err)
+			require.Equal(t, len(payloads), numOfPayloadWritten)
+
+			partialState, err := util.IsPayloadFilePartialState(payloadFileName)
+			require.NoError(t, err)
+			require.False(t, partialState)
+
+			partialState, payloadsFromFile, err := util.ReadPayloadFile(zerolog.Nop(), payloadFileName)
+			require.NoError(t, err)
+			require.Equal(t, len(payloads), len(payloadsFromFile))
+			require.False(t, partialState)
+
+			for _, payloadFromFile := range payloadsFromFile {
+				k, err := payloadFromFile.Key()
+				require.NoError(t, err)
+
+				kv, exist := keysValues[k.String()]
+				require.True(t, exist)
+
+				require.Equal(t, kv.value, payloadFromFile.Value())
+			}
+		})
+	})
+
+	t.Run("with filter", func(t *testing.T) {
+		unittest.RunWithTempDir(t, func(datadir string) {
+			size := 10
+
+			payloadFileName := filepath.Join(datadir, fileName)
+
+			// Generate some data
+			keysValues := make(map[string]keyPair)
+			var payloads []*ledger.Payload
+
+			for i := 0; i < size; i++ {
+				keys, values := getSampleKeyValues(i)
+
+				for j, key := range keys {
+					keysValues[key.String()] = keyPair{
+						key:   key,
+						value: values[j],
+					}
+
+					payloads = append(payloads, ledger.NewPayload(key, values[j]))
+				}
+			}
+
+			const selectedAddressCount = 10
+			selectedAddresses := make(map[common.Address]struct{})
+			selectedKeysValues := make(map[string]keyPair)
+			for k, kv := range keysValues {
+				owner := kv.key.KeyParts[0].Value
+				if len(owner) != common.AddressLength {
+					continue
+				}
+
+				address, err := common.BytesToAddress(owner)
+				require.NoError(t, err)
+
+				if len(selectedAddresses) < selectedAddressCount {
+					selectedAddresses[address] = struct{}{}
+				}
+
+				if _, exist := selectedAddresses[address]; exist {
+					selectedKeysValues[k] = kv
+				}
+			}
+
+			addresses := make([]common.Address, 0, len(selectedAddresses))
+			for address := range selectedAddresses {
+				addresses = append(addresses, address)
+			}
+
+			numOfPayloadWritten, err := util.CreatePayloadFile(
+				zerolog.Nop(),
+				payloadFileName,
+				payloads,
+				addresses,
+				false, // input payloads represent entire state
+			)
+			require.NoError(t, err)
+			require.Equal(t, len(selectedKeysValues), numOfPayloadWritten)
+
+			partialState, err := util.IsPayloadFilePartialState(payloadFileName)
+			require.NoError(t, err)
+			require.True(t, partialState)
+
+			partialState, payloadsFromFile, err := util.ReadPayloadFile(zerolog.Nop(), payloadFileName)
+			require.NoError(t, err)
+			require.Equal(t, len(selectedKeysValues), len(payloadsFromFile))
+			require.True(t, partialState)
+
+			for _, payloadFromFile := range payloadsFromFile {
+				k, err := payloadFromFile.Key()
+				require.NoError(t, err)
+
+				kv, exist := selectedKeysValues[k.String()]
+				require.True(t, exist)
+
+				require.Equal(t, kv.value, payloadFromFile.Value())
+			}
+		})
+	})
+
+	t.Run("no payloads found with filter", func(t *testing.T) {
+		emptyAddress := common.Address{}
+
+		unittest.RunWithTempDir(t, func(datadir string) {
+			size := 10
+
+			payloadFileName := filepath.Join(datadir, fileName)
+
+			// Generate some data
+			keysValues := make(map[string]keyPair)
+			var payloads []*ledger.Payload
+
+			for i := 0; i < size; i++ {
+				keys, values := getSampleKeyValues(i)
+
+				for j, key := range keys {
+					if bytes.Equal(key.KeyParts[0].Value, emptyAddress[:]) {
+						continue
+					}
+					keysValues[key.String()] = keyPair{
+						key:   key,
+						value: values[j],
+					}
+
+					payloads = append(payloads, ledger.NewPayload(key, values[j]))
+				}
+			}
+
+			numOfPayloadWritten, err := util.CreatePayloadFile(
+				zerolog.Nop(),
+				payloadFileName,
+				payloads,
+				[]common.Address{emptyAddress},
+				false,
+			)
+			require.NoError(t, err)
+			require.Equal(t, 0, numOfPayloadWritten)
+
+			partialState, err := util.IsPayloadFilePartialState(payloadFileName)
+			require.NoError(t, err)
+			require.True(t, partialState)
+
+			partialState, payloadsFromFile, err := util.ReadPayloadFile(zerolog.Nop(), payloadFileName)
+			require.NoError(t, err)
+			require.Equal(t, 0, len(payloadsFromFile))
+			require.True(t, partialState)
+		})
+	})
+}
+
+func getSampleKeyValues(i int) ([]ledger.Key, []ledger.Value) {
+	switch i {
+	case 0:
+		return []ledger.Key{getKey("", "uuid"), getKey("", "account_address_state")},
+			[]ledger.Value{[]byte{'1'}, []byte{'A'}}
+	case 1:
+		return []ledger.Key{getKey("ADDRESS", "public_key_count"),
+				getKey("ADDRESS", "public_key_0"),
+				getKey("ADDRESS", "exists"),
+				getKey("ADDRESS", "storage_used")},
+			[]ledger.Value{[]byte{1}, []byte("PUBLICKEYXYZ"), []byte{1}, []byte{100}}
+	case 2:
+		// TODO change the contract_names to CBOR encoding
+		return []ledger.Key{getKey("ADDRESS", "contract_names"), getKey("ADDRESS", "code.mycontract")},
+			[]ledger.Value{[]byte("mycontract"), []byte("CONTRACT Content")}
+	default:
+		keys := make([]ledger.Key, 0)
+		values := make([]ledger.Value, 0)
+		for j := 0; j < 10; j++ {
+			// address := make([]byte, 32)
+			address := make([]byte, 8)
+			_, err := rand.Read(address)
+			if err != nil {
+				panic(err)
+			}
+			keys = append(keys, getKey(string(address), "test"))
+			values = append(values, getRandomCadenceValue())
+		}
+		return keys, values
+	}
+}
+
+func getKey(owner, key string) ledger.Key {
+	return ledger.Key{KeyParts: []ledger.KeyPart{
+		{Type: uint16(0), Value: []byte(owner)},
+		{Type: uint16(2), Value: []byte(key)},
+	},
+	}
+}
+
+func getRandomCadenceValue() ledger.Value {
+
+	randomPart := make([]byte, 10)
+	_, err := rand.Read(randomPart)
+	if err != nil {
+		panic(err)
+	}
+	valueBytes := []byte{
+		// magic prefix
+		0x0, 0xca, 0xde, 0x0, 0x4,
+		// tag
+		0xd8, 132,
+		// array, 5 items follow
+		0x85,
+
+		// tag
+		0xd8, 193,
+		// UTF-8 string, length 4
+		0x64,
+		// t, e, s, t
+		0x74, 0x65, 0x73, 0x74,
+
+		// nil
+		0xf6,
+
+		// positive integer 1
+		0x1,
+
+		// array, 0 items follow
+		0x80,
+
+		// UTF-8 string, length 10
+		0x6a,
+		0x54, 0x65, 0x73, 0x74, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74,
+	}
+
+	valueBytes = append(valueBytes, randomPart...)
+	return ledger.Value(valueBytes)
+}
diff --git a/cmd/util/ledger/util/payload_grouping.go b/cmd/util/ledger/util/payload_grouping.go
index 9aec5d76efa..9f368abc45f 100644
--- a/cmd/util/ledger/util/payload_grouping.go
+++ b/cmd/util/ledger/util/payload_grouping.go
@@ -112,7 +112,7 @@ func GroupPayloadsByAccount(
 	indexes := make([]int, 0, estimatedNumOfAccount)
 	for i := 0; i < len(p); {
 		indexes = append(indexes, i)
-		i = p.FindNextKeyIndex(i)
+		i = p.FindNextKeyIndexUntil(i, len(p))
 	}
 	end = time.Now()
 
@@ -177,17 +177,17 @@ func (s sortablePayloads) Swap(i, j int) {
 	s[i], s[j] = s[j], s[i]
 }
 
-func (s sortablePayloads) FindNextKeyIndex(i int) int {
+func (s sortablePayloads) FindNextKeyIndexUntil(i int, upperBound int) int {
 	low := i
 	step := 1
-	for low+step < len(s) && s.Compare(low+step, i) == 0 {
+	for low+step < upperBound && s.Compare(low+step, i) == 0 {
 		low += step
 		step *= 2
 	}
 
 	high := low + step
-	if high > len(s) {
-		high = len(s)
+	if high > upperBound {
+		high = upperBound
 	}
 
 	for low < high {
@@ -248,13 +248,13 @@ func mergeInto(source, buffer sortablePayloads, i int, mid int, j int) {
 		// More elements in the both partitions to process.
 		if source.Compare(left, right) <= 0 {
 			// Move left partition elements with the same address to buffer.
-			nextLeft := source.FindNextKeyIndex(left)
+			nextLeft := source.FindNextKeyIndexUntil(left, mid)
 			n := copy(buffer[k:], source[left:nextLeft])
 			left = nextLeft
 			k += n
 		} else {
 			// Move right partition elements with the same address to buffer.
-			nextRight := source.FindNextKeyIndex(right)
+			nextRight := source.FindNextKeyIndexUntil(right, j)
 			n := copy(buffer[k:], source[right:nextRight])
 			right = nextRight
 			k += n
@@ -273,3 +273,12 @@ func mergeInto(source, buffer sortablePayloads, i int, mid int, j int) {
 	// Copy merged buffer back to source.
 	copy(source[i:j], buffer[i:j])
 }
+
+func SortPayloadsByAddress(payloads []*ledger.Payload, nWorkers int) []*ledger.Payload {
+	p := sortablePayloads(payloads)
+
+	// Sort the payloads by address
+	sortPayloads(0, len(p), p, make(sortablePayloads, len(p)), nWorkers)
+
+	return p
+}
diff --git a/cmd/util/ledger/util/payload_grouping_test.go b/cmd/util/ledger/util/payload_grouping_test.go
index 96b50bd4e5b..9ab7392e5e6 100644
--- a/cmd/util/ledger/util/payload_grouping_test.go
+++ b/cmd/util/ledger/util/payload_grouping_test.go
@@ -29,6 +29,20 @@ func TestGroupPayloadsByAccount(t *testing.T) {
 	require.Greater(t, groups.Len(), 1)
 }
 
+func TestGroupPayloadsByAccountForDataRace(t *testing.T) {
+	log := zerolog.New(zerolog.NewTestWriter(t))
+
+	const accountSize = 4
+	var payloads []*ledger.Payload
+	for i := 0; i < accountSize; i++ {
+		payloads = append(payloads, generateRandomPayloadsWithAddress(generateRandomAddress(), 100_000)...)
+	}
+
+	const nWorkers = 8
+	groups := util.GroupPayloadsByAccount(log, payloads, nWorkers)
+	require.Equal(t, accountSize, groups.Len())
+}
+
 func TestGroupPayloadsByAccountCompareResults(t *testing.T) {
 	log := zerolog.Nop()
 	payloads := generateRandomPayloads(1000000)
@@ -129,6 +143,36 @@ func generateRandomPayloads(n int) []*ledger.Payload {
 	return payloads
 }
 
+func generateRandomPayloadsWithAddress(address string, n int) []*ledger.Payload {
+	const meanPayloadsPerAccount = 100
+	const minPayloadsPerAccount = 1
+
+	payloads := make([]*ledger.Payload, 0, n)
+
+	for i := 0; i < n; {
+
+		registersForAccount := minPayloadsPerAccount + int(rand2.ExpFloat64()*(meanPayloadsPerAccount-minPayloadsPerAccount))
+		if registersForAccount > n-i {
+			registersForAccount = n - i
+		}
+		i += registersForAccount
+
+		accountKey := convert.RegisterIDToLedgerKey(flow.RegisterID{
+			Owner: address,
+			Key:   generateRandomString(10),
+		})
+		for j := 0; j < registersForAccount; j++ {
+			payloads = append(payloads,
+				ledger.NewPayload(
+					accountKey,
+					[]byte(generateRandomString(10)),
+				))
+		}
+	}
+
+	return payloads
+}
+
 func generateRandomAccountKey() ledger.Key {
 	return convert.RegisterIDToLedgerKey(flow.RegisterID{
 		Owner: generateRandomAddress(),
diff --git a/cmd/util/ledger/util/util.go b/cmd/util/ledger/util/util.go
index 46cc54e6850..f486c21edb4 100644
--- a/cmd/util/ledger/util/util.go
+++ b/cmd/util/ledger/util/util.go
@@ -96,15 +96,6 @@ func (p PayloadSnapshot) Get(id flow.RegisterID) (flow.RegisterValue, error) {
 	return value.Value(), nil
 }
 
-// NopMemoryGauge is a no-op implementation of the MemoryGauge interface
-type NopMemoryGauge struct{}
-
-func (n NopMemoryGauge) MeterMemory(common.MemoryUsage) error {
-	return nil
-}
-
-var _ common.MemoryGauge = (*NopMemoryGauge)(nil)
-
 type PayloadsReadonlyLedger struct {
 	Snapshot *PayloadSnapshot
 
diff --git a/cmd/utils.go b/cmd/utils.go
index 05763933ebc..a3464bceb7b 100644
--- a/cmd/utils.go
+++ b/cmd/utils.go
@@ -1,15 +1,26 @@
 package cmd
 
 import (
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"path/filepath"
+	"strings"
 
 	"github.com/libp2p/go-libp2p/core/peer"
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/crypto"
 
 	"github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module"
+	"github.com/onflow/flow-go/module/id"
 	"github.com/onflow/flow-go/network/p2p"
+	"github.com/onflow/flow-go/network/p2p/cache"
+	p2plogging "github.com/onflow/flow-go/network/p2p/logging"
+	"github.com/onflow/flow-go/network/p2p/translator"
+	"github.com/onflow/flow-go/network/p2p/unicast/protocols"
 	"github.com/onflow/flow-go/state/protocol/inmem"
 	"github.com/onflow/flow-go/utils/io"
 )
@@ -43,6 +54,26 @@ func LoadPrivateNodeInfo(dir string, myID flow.Identifier) (*bootstrap.NodeInfoP
 	return &info, err
 }
 
+func LoadNetworkPrivateKey(dir string, myID flow.Identifier) (crypto.PrivateKey, error) {
+	path := filepath.Join(dir, fmt.Sprintf(filepath.Join(bootstrap.DirPrivateRoot,
+		"private-node-info_%v/network_private_key"), myID))
+	data, err := io.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("could not read private node info (path=%s): %w", path, err)
+	}
+
+	keyBytes, err := hex.DecodeString(strings.Trim(string(data), "\n "))
+	if err != nil {
+		return nil, fmt.Errorf("could not hex decode networking key (path=%s): %w", path, err)
+	}
+
+	networkingKey, err := crypto.DecodePrivateKey(crypto.ECDSASecp256k1, keyBytes)
+	if err != nil {
+		return nil, fmt.Errorf("could not decode networking key (path=%s): %w", path, err)
+	}
+	return networkingKey, nil
+}
+
 // loadSecretsEncryptionKey loads the encryption key for the secrets database.
 // If the file does not exist, returns os.ErrNotExist.
 func loadSecretsEncryptionKey(dir string, myID flow.Identifier) ([]byte, error) {
@@ -63,3 +94,78 @@ func rateLimiterPeerFilter(rateLimiter p2p.RateLimiter) p2p.PeerFilter {
 		return nil
 	}
 }
+
+// BootstrapIdentities converts the bootstrap node addresses and keys to a Flow Identity list where
+// each Flow Identity is initialized with the passed address, the networking key
+// and the Node ID set to ZeroID, role set to Access, 0 stake and no staking key.
+func BootstrapIdentities(addresses []string, keys []string) (flow.IdentitySkeletonList, error) {
+	if len(addresses) != len(keys) {
+		return nil, fmt.Errorf("number of addresses and keys provided for the boostrap nodes don't match")
+	}
+
+	ids := make(flow.IdentitySkeletonList, len(addresses))
+	for i, address := range addresses {
+		bytes, err := hex.DecodeString(keys[i])
+		if err != nil {
+			return nil, fmt.Errorf("failed to decode secured GRPC server public key hex %w", err)
+		}
+
+		publicFlowNetworkingKey, err := crypto.DecodePublicKey(crypto.ECDSAP256, bytes)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get public flow networking key could not decode public key bytes %w", err)
+		}
+
+		// create the identity of the peer by setting only the relevant fields
+		ids[i] = &flow.IdentitySkeleton{
+			NodeID:        flow.ZeroID, // the NodeID is the hash of the staking key and for the public network it does not apply
+			Address:       address,
+			Role:          flow.RoleAccess, // the upstream node has to be an access node
+			NetworkPubKey: publicFlowNetworkingKey,
+		}
+	}
+	return ids, nil
+}
+
+func CreatePublicIDTranslatorAndIdentifierProvider(
+	logger zerolog.Logger,
+	networkKey crypto.PrivateKey,
+	sporkID flow.Identifier,
+	getLibp2pNode func() p2p.LibP2PNode,
+	idCache *cache.ProtocolStateIDCache,
+) (
+	p2p.IDTranslator,
+	func() module.IdentifierProvider,
+	error,
+) {
+	idTranslator := translator.NewHierarchicalIDTranslator(idCache, translator.NewPublicNetworkIDTranslator())
+
+	peerID, err := peerIDFromNetworkKey(networkKey)
+	if err != nil {
+		return nil, nil, fmt.Errorf("could not get peer ID from network key: %w", err)
+	}
+	// use the default identifier provider
+	factory := func() module.IdentifierProvider {
+		return id.NewCustomIdentifierProvider(func() flow.IdentifierList {
+			pids := getLibp2pNode().GetPeersForProtocol(protocols.FlowProtocolID(sporkID))
+			result := make(flow.IdentifierList, 0, len(pids))
+
+			for _, pid := range pids {
+				// exclude own Identifier
+				if pid == peerID {
+					continue
+				}
+
+				if flowID, err := idTranslator.GetFlowID(pid); err != nil {
+					// TODO: this is an instance of "log error and continue with best effort" anti-pattern
+					logger.Err(err).Str("peer", p2plogging.PeerId(pid)).Msg("failed to translate to Flow ID")
+				} else {
+					result = append(result, flowID)
+				}
+			}
+
+			return result
+		})
+	}
+
+	return idTranslator, factory, nil
+}
diff --git a/cmd/verification_builder.go b/cmd/verification_builder.go
index 1871aa63bc3..70c84617f02 100644
--- a/cmd/verification_builder.go
+++ b/cmd/verification_builder.go
@@ -18,6 +18,7 @@ import (
 	"github.com/onflow/flow-go/engine/common/follower"
 	followereng "github.com/onflow/flow-go/engine/common/follower"
 	commonsync "github.com/onflow/flow-go/engine/common/synchronization"
+	"github.com/onflow/flow-go/engine/execution/computation"
 	"github.com/onflow/flow-go/engine/verification/assigner"
 	"github.com/onflow/flow-go/engine/verification/assigner/blockconsumer"
 	"github.com/onflow/flow-go/engine/verification/fetcher"
@@ -194,7 +195,11 @@ func (v *VerificationNodeBuilder) LoadComponentsAndModules() {
 				[]fvm.Option{fvm.WithLogger(node.Logger)},
 				node.FvmOptions...,
 			)
+
+			// TODO(JanezP): cleanup creation of fvm context github.com/onflow/flow-go/issues/5249
+			fvmOptions = append(fvmOptions, computation.DefaultFVMOptions(node.RootChainID, false, false)...)
 			vmCtx := fvm.NewContext(fvmOptions...)
+
 			chunkVerifier := chunks.NewChunkVerifier(vm, vmCtx, node.Logger)
 			approvalStorage := badger.NewResultApprovals(node.Metrics.Cache, node.DB)
 			verifierEng, err = verifier.New(
diff --git a/config/README.md b/config/README.md
index 8308efcde8a..65800c7d73d 100644
--- a/config/README.md
+++ b/config/README.md
@@ -122,4 +122,4 @@ store this config value will be prefixed with `network-config` e.g.
 
 Later in the config process we bind the underlying config store with our pflag set, this allows us to override default values using CLI flags.
 At this time the underlying config store would have 2 separate keys `networking-connection-pruning` and `network-config.networking-connection-pruning` for the same configuration value. This is because we don't use the network prefix for the CLI flags
-used to override network configs. As a result, an alias must be set from `network-config.networking-connection-pruning` -> `networking-connection-pruning` so that they both point to the value loaded from the CLI flag. See `SetAliases` in [network/netconf/flags.go](https://github.com/onflow/flow-go/blob/master/config/network/netconf/flags.go) in the network package for a reference. 
+used to override network configs. As a result, an alias must be set from `network-config.networking-connection-pruning` -> `networking-connection-pruning` so that they both point to the value loaded from the CLI flag. See `SetAliases` in [network/netconf/flags.go](https://github.com/onflow/flow-go/blob/master/config/network/netconf/flags.go) in the network package for a reference.
\ No newline at end of file
diff --git a/config/default-config.yml b/config/default-config.yml
index 1436008e8ee..2e8422b4529 100644
--- a/config/default-config.yml
+++ b/config/default-config.yml
@@ -160,6 +160,9 @@ network-config:
           # to avoid penalizing peers that are not malicious but are misbehaving due to bugs or other issues.
           # A topic id is considered duplicate if it appears more than once in a single GRAFT or PRUNE message.
           duplicate-topic-id-threshold: 50
+          # Maximum number of total invalid topic ids in GRAFTs/PRUNEs of a single RPC, ideally this should be 0 but we allow for some tolerance
+          # to avoid penalizing peers that are not malicious but are misbehaving due to bugs or other issues. Exceeding this threshold causes RPC inspection failure with an invalid control message notification (penalty).
+          invalid-topic-id-threshold: 50
         ihave:
           # The maximum allowed number of iHave messages in a single RPC message.
           #	Each iHave message represents the list of message ids. When the total number of iHave messages
@@ -181,6 +184,9 @@ network-config:
           # Ideally, an iHave message should not have any duplicate message IDs, hence a message id is considered duplicate when it is repeated more than once
           # within the same iHave message. When the total number of duplicate message ids in a single iHave message exceeds this threshold, the inspection of message will fail.
           duplicate-message-id-threshold: 100
+          # Maximum number of total invalid topic ids in an IHAVE message on a single RPC, ideally this should be 0 but we allow for some tolerance
+          # to avoid penalizing peers that are not malicious but are misbehaving due to bugs or other issues.  Exceeding this threshold causes RPC inspection failure with an invalid control message notification (penalty).
+          invalid-topic-id-threshold: 50
         iwant:
           # The maximum allowed number of iWant messages in a single RPC message.
           #	Each iWant message represents the list of message ids. When the total number of iWant messages
@@ -208,6 +214,45 @@ network-config:
           tracker-cache-decay: 0.99
           # The upper bound on the amount of cluster prefixed control messages that will be processed
           hard-threshold: 100
+        process:
+          inspection:
+            # Serves as a fail-safe mechanism to globally deactivate inspection logic. When this fail-safe is activated it disables all
+            # aspects of the inspection logic, irrespective of individual configurations like inspection.enable-graft, inspection.enable-prune, etc.
+            # Consequently, all metrics collection and logging related to the rpc and inspection will also be disabled.
+            # It is important to note that activating this fail-safe results in a comprehensive deactivation inspection features.
+            # Please use this setting judiciously, considering its broad impact on the behavior of control message handling.
+            disabled: false
+            # Enables graft control message inspection.
+            enable-graft: true
+            # Enables prune control message inspection.
+            enable-prune: true
+            # Enables ihave control message inspection.
+            enable-ihave: true
+            # Enables iwant control message inspection.
+            enable-iwant: true
+            # Enables publish message inspection.
+            enable-publish: true
+            # When set to true RPC's will be rejected from unstaked peers
+            reject-unstaked-peers: true
+          truncation:
+            # Serves as a fail-safe mechanism to globally deactivate truncation logic. When this fail-safe is activated it disables all
+            # aspects of the truncation logic, irrespective of individual configurations like truncation.enable-graft, truncation.enable-prune, etc.
+            # Consequently, all metrics collection and logging related to the rpc and inspection will also be disabled.
+            # It is important to note that activating this fail-safe results in a comprehensive deactivation truncation features.
+            # Please use this setting judiciously, considering its broad impact on the behavior of control message handling.
+            disabled: false
+            # Enables graft control message truncation.
+            enable-graft: true
+            # Enables prune control message truncation.
+            enable-prune: true
+            # Enables ihave control message truncation.
+            enable-ihave: true
+            # Enables ihave message id truncation.
+            enable-ihave-message-id: true
+            # Enables iwant control message truncation.
+            enable-iwant: true
+            # Enables iwant message id truncation.
+            enable-iwant-message-id: true
     rpc-tracer:
       # The default interval at which the mesh tracer logs the mesh topology. This is used for debugging and forensics purposes.
       #	Note that we purposefully choose this logging interval high enough to avoid spamming the logs. Moreover, the
@@ -224,7 +269,14 @@ network-config:
       rpc-sent-tracker-queue-cache-size: 100_000
       # Number of workers for rpc sent tracker worker pool.
       rpc-sent-tracker-workers: 5
-      # Peer scoring is the default value for enabling peer scoring
+      # Cache size of the gossipsub duplicate message tracker.
+      duplicate-message-tracker:
+         cache-size: 10_000
+         decay: .5
+         # The threshold for which when the counter is below this value, the decay function will not be called.
+         # instead, the counter will be set to 0. This is to prevent the counter from becoming a large number over time.
+         skip-decay-threshold: 0.1
+    # Peer scoring is the default value for enabling peer scoring
     peer-scoring-enabled: true
     scoring-parameters:
       peer-scoring:
@@ -468,6 +520,11 @@ network-config:
             # It is applied to the peer's score when the peer subscribes to a topic that it is
             # not authorized to subscribe to.
             invalid-subscription-penalty: -100
+            # The penalty for duplicate messages detected by the gossipsub tracer for a peer.
+            # The penalty is multiplied by the current duplicate message count for a peer before it is applied to the application specific score.
+            duplicate-message-penalty: -10e-4
+            # The threshold at which the duplicate message count for a peer will result in the peer being penalized
+            duplicate-message-threshold: 10e+4
             # This is the reward for well-behaving staked peers.
             # If a peer does not have any misbehavior record, e.g., invalid subscription,
             # invalid message, etc., it will be rewarded with this score.
@@ -489,12 +546,14 @@ network-config:
           # number of workers that asynchronously update the app specific score requests when they are expired.
           score-update-worker-num: 5
           # size of the queue used by the worker pool for the app specific score update requests. The queue is used to buffer the app specific score update requests
-          # before they are processed by the worker pool. The queue size must be larger than total number of peers in the network.
+          # before they are processed by the worker pool. The queue size must be larger than 10x total number of peers in the network.
           # The queue is deduplicated based on the peer ids ensuring that there is only one app specific score update request per peer in the queue.
           score-update-request-queue-size: 10_000
           # score ttl is the time to live for the app specific score. Once the score is expired; a new request will be sent to the app specific score provider to update the score.
           # until the score is updated, the previous score will be used.
           score-ttl: 1m
+          # size of the queue used by the score registry to buffer the invalid control message notifications before they are processed by the worker pool. The queue size must be larger than 10x total number of peers in the network.
+          invalid-control-message-notification-queue-size: 10_000
         spam-record-cache:
           # size of cache used to track spam records at gossipsub. Each peer id is mapped to a spam record that keeps track of the spam score for that peer.
           # cache should be big enough to keep track of the entire network's size. Otherwise, the local node's view of the network will be incomplete due to cache eviction.
diff --git a/config/docs/resourceManager.MD b/config/docs/resourceManager.MD
new file mode 100644
index 00000000000..620e6ba3547
--- /dev/null
+++ b/config/docs/resourceManager.MD
@@ -0,0 +1,229 @@
+# libp2p Resource Manager Configuration in Flow Go
+## Table of Contents
+1. [Overview](#overview)
+2. [What are These Limits?](#what-are-these-limits)
+3. [How to Set Limits](#how-to-set-limits)
+    1. [In Configuration File (`default-config.yaml`)](#in-configuration-file-default-configyaml)
+    2. [Via Runtime Flags](#via-runtime-flags)
+4. [Importance of Each Resource Scope](#importance-of-each-resource-scope)
+    1. [What does each scope mean?](#what-does-each-scope-mean)
+    2. [Scope Hierarchy](#scope-hierarchy)
+    3. [On Transient Scope](#on-transient-scope)
+5. [Case Study: what does scopes mean in terms of one resource?](#case-study-what-does-scopes-mean-in-terms-of-one-resource)
+    1. [System Scope](#system-scope)
+    2. [Transient Scope](#transient-scope)
+    3. [Protocol Scope](#protocol-scope)
+    4. [Peer Scope](#peer-scope)
+    5. [Peer-Protocol Scope](#peer-protocol-scope)
+6. [Troubleshooting (For Flow Node Operators)](#troubleshooting-for-flow-node-operators)
+    1. [Observation](#observation)
+    2. [Excessive Streams Across All Protocols and Peers](#excessive-streams-across-all-protocols-and-peers)
+    3. [Excessive Streams in a Specific Protocol](#excessive-streams-in-a-specific-protocol)
+    4. [Excessive Streams from Individual Peers](#excessive-streams-from-individual-peers)
+    5. [Excessive Streams from a Specific Peer on a Specific Protocol](#excessive-streams-from-a-specific-peer-on-a-specific-protocol)
+7. [Wildcard: Increasing all limit overrides at scale](#wildcard-increasing-all-limit-overrides-at-scale)
+8. [References](#references)
+
+## Overview
+In Flow Go, the libp2p Resource Manager plays a crucial role in managing network resources effectively. This document provides guidance on setting various limits through configuration files and runtime flags, helping you optimize resource usage based on specific network conditions or protocol behaviors.
+
+### What are These Limits?
+The libp2p Resource Manager in Flow Go allows setting limits on different types of network resources like streams, connections, file descriptors, and memory. These limits are categorized under different scopes: `system`, `transient`, `protocol`, `peer`, and `peer-protocol`. Each scope serves a distinct purpose in resource management.
+
+### How to Set Limits
+
+#### In Configuration File (`default-config.yaml`)
+You can define these limits in the `default-config.yaml` file under the `libp2p-resource-manager` section. Each limit can be set for different scopes as shown:
+
+```yaml
+libp2p-resource-manager:
+  memory-limit-ratio: <value>
+  file-descriptors-ratio: <value>
+  limits-override:
+    <scope>:
+      streams-inbound: <value>
+      streams-outbound: <value>
+      ...
+```
+
+#### Via Runtime Flags
+Each limit can also be dynamically set using runtime flags in the format:
+`--libp2p-resource-manager-limits-override-<scope>-<limit>`
+
+For example:
+- To set inbound stream limits for the system scope: `--libp2p-resource-manager-limits-override-system-streams-inbound=<value>`
+- For outbound streams in the protocol scope: `--libp2p-resource-manager-limits-override-protocol-streams-outbound=<value>`
+
+**Exceptions:** The `memory-limit-ratio` and `file-descriptors-ratio` limits are set as the following flags and both must be **between 0 and 1**:
+- `--libp2p-resource-manager-memory-limit-ratio=<value>`
+- `--libp2p-resource-manager-file-descriptors-ratio=<value>`
+- For example: `--libp2p-resource-manager-memory-limit-ratio=0.5` means that the memory limit for libp2p resources is set to 50% of the available memory, i.e.,
+    the libp2p can take up to 50% of the available memory on the system.
+
+  
+### Importance of Each Resource Scope
+In the libp2p Resource Manager, scopes are organized hierarchically; `system`, `protocol`, `peer`, and `peer-protocol` scopes are arranged in a _descending order of priority_.
+This means that the `system` scope has the highest priority, then `protocol` scope, `peer` scope, and `peer-protocol` scope.
+As we explain later in this documentation, the `transient` scope is a special case and does not strictly fit in the hierarchy of scopes.
+
+#### What does each scope mean?
+   - **System Scope**: sets the global limits for the entire system and ensures overall stability and prevents resource hogging by any single component.
+   - **Transient Scope**: manages resources for partially established connections or streams and prevents resource drainage during the establishment phase. 
+       Transient resources are those that are not yet fully established, like a connection that's not yet fully established or a stream that's not yet fully opened. The transient scope is critical
+       for guarding against resource drainage during the establishment phase.
+   - **Protocol Scope**: sets limits for specific protocols (e.g., DHT, gossipsub) and prevents any single protocol from dominating resource usage. The protocol scope is essential for 
+     protocol-specific resource tuning and preventing abuse by any single protocol.
+   - **Peer Scope**: manages resources used by individual (remote) peers on the local peer and prevents a single (remote) peer from exhausting resources of the local peer. The peer scope is critical for preventing abuse by any single (remote) peer.
+   - **Peer-Protocol Scope**: sets limits for specific (remote) peers on specific protocols at the local peer and prevents any single (remote) peer from dominating resource usage on a specific protocol at the local peer. It also prevents a single protocol 
+      to dominate resource usage of a specific (remote) peer on the local peer among all the protocols the (remote) peer is participating in with the local peer. 
+
+#### Scope Hierarchy
+The higher order scopes **"override"** limits on lower scopes:
+1. **System Scope vs. Protocol/Peer Scopes**:
+    - The system scope sets global limits. If the system scope has a lower limit than a protocol or peer scope, the system limit will be the effective constraint 
+      because it's the upper bound for the entire system.
+    - For example, if the system scope has an inbound stream limit of 10,000 and a protocol scope has a limit of 15,000, 
+        the effective limit will be 10,000 because the system scope's limit applies globally.
+
+2. **Protocol Scope vs. Peer Scope**:
+    - The protocol scope sets limits for specific protocols, while the peer scope sets limits for individual peers. These are independent of each other but both are under the overarching system scope.
+    - A peer can't exceed the limits set by the protocol scope, and vice versa. They operate within their own contexts but under the maximum limits imposed by the system scope.
+
+It's essential to understand that the lowest limit in the hierarchy of applicable scopes will effectively be the operational limit. 
+If the system inbound stream limit is lower than the protocol inbound stream limit, the system limit will effectively cap the maximum number of inbound streams, regardless of the higher limit set at the protocol level.
+Also, the higher scopes limits must be configured in a way that they don't override the limits of lower scopes; rather, they add another layer of constraint. 
+Each scope must independently satisfy its own limits without violating the limits of the scopes above it.
+When configuring limits, it's crucial to consider the hierarchical nature of these scopes. 
+Ensure that the limits at lower scopes (like protocol or peer) are set within the bounds of higher scopes (like system) to maintain a coherent and effective resource management strategy.
+
+#### On Transient Scope
+The `transient` scope in the libp2p Resource Manager hierarchy has a specific and unique role. 
+It is placed **alongside** other scopes like `system`, `protocol`, `peer`, and `peer-protocol`, but it serves a distinct purpose. Here's how the `transient` scope fits into the hierarchy:
+The `transient` scope is designed to manage resources for connections and streams that are in the process of being established but haven't yet been fully negotiated or associated with a specific peer or protocol.
+This includes streams that are awaiting protocol negotiation or connections that are in the initial stages of establishment.
+
+In terms of hierarchy, the `transient` scope is below `system`, but is not strictly above or below other scopes like `protocol`. 
+Instead, it operates more as a parallel scope that specifically handles resources in a temporary, intermediate state.
+While the `system` scope sets the global limits, the `transient` scope sets limits on resources that are not yet fully categorized into other specific scopes (like `peer` or `protocol`).
+The limits set in the `transient` scope are independent of those in the `protocol`, `peer`, and `peer-protocol` scopes but still operate under the overarching constraints of the `system` scope. 
+Once a connection or stream transitions out of the `transient` state (i.e., when a protocol is negotiated, or a peer is identified), it then falls under the appropriate scope (such as `protocol` or `peer`) and adheres to the limits set within those scopes.
+The `transient` scope is critical for managing resources during the negotiation phase of connections and streams. It helps in protecting the system against resource exhaustion attacks that can occur at the initial stages of connection or stream establishment.
+
+**Example:** For example, when the limit for system-wide connections is set lower than the limit for transient-wide connections in the libp2p Resource Manager, the system-wide limit effectively becomes the constraining factor
+In this example, the system-wide connections limit acts as the global cap for all connections in the libp2p network, regardless of their state (established, transient, etc.).
+If this limit is lower than the transient-wide limit, it essentially restricts the total number of connections (including transient ones) to this lower system-wide limit.
+The transient-wide limit is intended to manage connections that are in the process of being fully established. 
+
+### Case Study: what does scopes mean in terms of one resource?
+As an example, we study the default limits for "Streams Inbound/Outbound" at different scopes in the libp2p Resource Manager. The limtis on other resources follow a similar pattern.
+Here's an explanation of what these default limits mean at each scope:
+
+### System Scope
+- **Streams Inbound/Outbound (e.g., 15,000)**:
+    - **Meaning**: This limit defines the maximum number of inbound and outbound streams that can be active across the entire system, regardless of the specific protocols or peers involved.
+    - **Implication**: It is a global cap ensuring that the total number of streams at any time does not exceed this limit, thus preventing system-wide resource exhaustion due to too many streams.
+
+### Transient Scope
+- **Streams Inbound/Outbound (e.g., 15,000)**:
+    - **Meaning**: This limit controls the number of streams in the transient state, i.e., streams that are being set up but not yet fully established or associated with a peer/protocol.
+    - **Implication**: It provides a buffer for handling stream negotiations, ensuring the system can manage a high volume of initiating connections without overwhelming the resources during the setup phase.
+
+### Protocol Scope
+- **Streams Inbound/Outbound (e.g., 5,000)**:
+    - **Meaning**: This limit specifies the maximum number of inbound and outbound streams for each protocol. It applies to each protocol independently.
+    - **Implication**: It ensures that no single protocol can dominate the network's resources, maintaining a balance in resource allocation among various protocols.
+
+### Peer Scope
+- **Streams Inbound/Outbound (e.g., 1,000)**:
+    - **Meaning**: This sets the maximum number of inbound and outbound streams allowed per (remote) peer on the local peer.
+    - **Implication**: It restricts the resource usage by individual peers, ensuring no single (remote) peer can exhaust network resources with too many streams.
+
+### Peer-Protocol Scope
+- **Streams Inbound/Outbound (e.g., 500)**:
+    - **Meaning**: This limit is the most granular, applying to streams from each (remote) peer for each protocol on the local peer.
+    - **Implication**: It offers fine-grained control, preventing any (remote) peer from using excessive resources in a specific protocol on the local peer, thus ensuring balanced resource use.
+
+## Troubleshooting (For Flow Node Operators)
+This troubleshooting guide works based on the case of excessive streams in the network. Similar guidelines can be applied to other resources as well.
+
+### Observation
+If you observe an excessive number of open streams (or open `goroutines` affiliated with a libp2p protocol) in your network, 
+the appropriate action would be to adjust the stream limits within specific scopes, depending on the nature of the issue.
+
+### 1. Excessive Streams Across All Protocols and Peers
+- **Scope**: System Scope
+- **Limits to Adjust**:
+    - `streams-inbound`
+    - `streams-outbound`
+- **Reason**: The system scope applies globally across all peers and protocols. Adjusting these limits helps manage the overall number of streams in the network.
+
+### 2. Excessive Streams in a Specific Protocol
+- **Scope**: Protocol Scope
+- **Limits to Adjust**:
+    - `streams-inbound`
+    - `streams-outbound`
+- **Reason**: If a particular protocol (e.g., DHT, gossipsub) is opening too many streams, tightening limits in the protocol scope can restrict the resource usage by that specific protocol.
+
+### 3. Excessive Streams from Individual Peers
+- **Scope**: Peer Scope
+- **Limits to Adjust**:
+    - `streams-inbound`
+    - `streams-outbound`
+- **Reason**: When specific peers are opening too many streams, adjusting these limits can prevent any single peer from using an excessive number of streams.
+
+### 4. Excessive Streams from a Specific Peer on a Specific Protocol
+- **Scope**: Peer-Protocol Scope
+- **Limits to Adjust**:
+    - `streams-inbound`
+    - `streams-outbound`
+- **Reason**: This is the most granular level of control, where you can restrict stream usage for a specific protocol used by a specific peer.
+
+## Wildcard: Increasing all limit overrides at scale
+In order to preserve the hierarchy of scopes, you need to adjust the limits in each scope in a way that they don't override the limits of higher scopes.
+One easy way is to increase all limits by a certain factor across all scopes. For example, if you want to increase all limits by 1.5 times, you can do so by adjusting the flags for each limit within each scope.
+
+### System Scope
+1. **Streams Inbound/Outbound**
+    - `--libp2p-resource-manager-limits-override-system-streams-inbound=<1.5 * current value>`
+    - `--libp2p-resource-manager-limits-override-system-streams-outbound=<1.5 * current value>`
+2. **Connections Inbound/Outbound**
+    - `--libp2p-resource-manager-limits-override-system-connections-inbound=<1.5 * current value>`
+    - `--libp2p-resource-manager-limits-override-system-connections-outbound=<1.5 * current value>`
+3. **File Descriptors**
+    - `--libp2p-resource-manager-limits-override-system-fd=<1.5 * current value>`
+4. **Memory Bytes**
+    - `--libp2p-resource-manager-limits-override-system-memory-bytes=<1.5 * current value>`
+
+### Transient Scope
+1. **Streams Inbound/Outbound**
+    - `--libp2p-resource-manager-limits-override-transient-streams-inbound=<1.5 * current value>`
+    - `--libp2p-resource-manager-limits-override-transient-streams-outbound=<1.5 * current value>`
+2. **Connections Inbound/Outbound**
+    - `--libp2p-resource-manager-limits-override-transient-connections-inbound=<1.5 * current value>`
+    - `--libp2p-resource-manager-limits-override-transient-connections-outbound=<1.5 * current value>`
+3. **File Descriptors**
+    - `--libp2p-resource-manager-limits-override-transient-fd=<1.5 * current value>`
+4. **Memory Bytes**
+    - `--libp2p-resource-manager-limits-override-transient-memory-bytes=<1.5 * current value>`
+
+### Protocol Scope
+1. **Streams Inbound/Outbound**
+    - `--libp2p-resource-manager-limits-override-protocol-streams-inbound=<1.5 * current value>`
+    - `--libp2p-resource-manager-limits-override-protocol-streams-outbound=<1.5 * current value>`
+
+### Peer Scope
+1. **Streams Inbound/Outbound**
+    - `--libp2p-resource-manager-limits-override-peer-streams-inbound=<1.5 * current value>`
+    - `--libp2p-resource-manager-limits-override-peer-streams-outbound=<1.5 * current value>`
+
+### Peer-Protocol Scope
+1. **Streams Inbound/Outbound**
+    - `--libp2p-resource-manager-limits-override-peer-protocol-streams-inbound=<1.5 * current value>`
+    - `--libp2p-resource-manager-limits-override-peer-protocol-streams-outbound=<1.5 * current value>`
+
+### Notes
+- Replace `<1.5 * current value>` with the actual calculated value from `default-config.yaml`. For example, if the current system streams inbound limit is 10,000, the new value would be `--libp2p-resource-manager-limits-override-system-streams-inbound=15000`.
+
+
+# References
+- https://github.com/libp2p/go-libp2p/blob/master/p2p/host/resource-manager/README.md
\ No newline at end of file
diff --git a/consensus/follower_test.go b/consensus/follower_test.go
index 06e81b70f25..0efed602dfa 100644
--- a/consensus/follower_test.go
+++ b/consensus/follower_test.go
@@ -75,7 +75,7 @@ type HotStuffFollowerSuite struct {
 // SetupTest initializes all the components needed for the Follower.
 // The follower itself is instantiated in method BeforeTest
 func (s *HotStuffFollowerSuite) SetupTest() {
-	identities := unittest.IdentityListFixture(4, unittest.WithRole(flow.RoleConsensus))
+	identities := unittest.IdentityListFixture(4, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical[flow.Identity])
 	s.mockConsensus = &MockConsensus{identities: identities}
 
 	// mock storage headers
diff --git a/consensus/hotstuff/blockproducer/block_producer.go b/consensus/hotstuff/blockproducer/block_producer.go
index 74d01cc317d..3238507393a 100644
--- a/consensus/hotstuff/blockproducer/block_producer.go
+++ b/consensus/hotstuff/blockproducer/block_producer.go
@@ -43,7 +43,11 @@ func (bp *BlockProducer) MakeBlockProposal(view uint64, qc *flow.QuorumCertifica
 		header.ParentVoterSigData = qc.SigData
 		header.ProposerID = bp.committee.Self()
 		header.LastViewTC = lastViewTC
+		return nil
+	}
 
+	// TODO: We should utilize the `EventHandler`'s `SafetyRules` to generate the block signature instead of using an independent signing logic: https://github.com/dapperlabs/flow-go/issues/6892
+	signProposal := func(header *flow.Header) error {
 		// turn the header into a block header proposal as known by hotstuff
 		block := model.Block{
 			BlockID:     header.ID(),
@@ -65,7 +69,7 @@ func (bp *BlockProducer) MakeBlockProposal(view uint64, qc *flow.QuorumCertifica
 	}
 
 	// retrieve a fully built block header from the builder
-	header, err := bp.builder.BuildOn(qc.BlockID, setHotstuffFields)
+	header, err := bp.builder.BuildOn(qc.BlockID, setHotstuffFields, signProposal)
 	if err != nil {
 		return nil, fmt.Errorf("could not build block proposal on top of %v: %w", qc.BlockID, err)
 	}
diff --git a/consensus/hotstuff/blockproducer/metrics_wrapper.go b/consensus/hotstuff/blockproducer/metrics_wrapper.go
index 004b238d3e1..80fcb563541 100644
--- a/consensus/hotstuff/blockproducer/metrics_wrapper.go
+++ b/consensus/hotstuff/blockproducer/metrics_wrapper.go
@@ -24,9 +24,9 @@ func NewMetricsWrapper(builder module.Builder, metrics module.HotstuffMetrics) *
 	}
 }
 
-func (w BlockBuilderMetricsWrapper) BuildOn(parentID flow.Identifier, setter func(*flow.Header) error) (*flow.Header, error) {
+func (w BlockBuilderMetricsWrapper) BuildOn(parentID flow.Identifier, setter func(*flow.Header) error, sign func(*flow.Header) error) (*flow.Header, error) {
 	processStart := time.Now()
-	header, err := w.builder.BuildOn(parentID, setter)
+	header, err := w.builder.BuildOn(parentID, setter, sign)
 	w.metrics.PayloadProductionDuration(time.Since(processStart))
 	return header, err
 }
diff --git a/consensus/hotstuff/committee.go b/consensus/hotstuff/committee.go
index cac2e3a877e..caf2e0f0e34 100644
--- a/consensus/hotstuff/committee.go
+++ b/consensus/hotstuff/committee.go
@@ -78,8 +78,7 @@ type Replicas interface {
 	// Returns the following expected errors for invalid inputs:
 	//   - model.ErrViewForUnknownEpoch if no epoch containing the given view is known
 	//
-	// TODO: should return identity skeleton https://github.com/dapperlabs/flow-go/issues/6232
-	IdentitiesByEpoch(view uint64) (flow.IdentityList, error)
+	IdentitiesByEpoch(view uint64) (flow.IdentitySkeletonList, error)
 
 	// IdentityByEpoch returns the full Identity for specified HotStuff participant.
 	// The node must be a legitimate HotStuff participant with NON-ZERO WEIGHT at the specified block.
@@ -92,8 +91,7 @@ type Replicas interface {
 	// Returns the following expected errors for invalid inputs:
 	//   - model.ErrViewForUnknownEpoch if no epoch containing the given view is known
 	//
-	// TODO: should return identity skeleton https://github.com/dapperlabs/flow-go/issues/6232
-	IdentityByEpoch(view uint64, participantID flow.Identifier) (*flow.Identity, error)
+	IdentityByEpoch(view uint64, participantID flow.Identifier) (*flow.IdentitySkeleton, error)
 }
 
 // DynamicCommittee extends Replicas to provide the consensus committee for the purposes
diff --git a/consensus/hotstuff/committees/cluster_committee.go b/consensus/hotstuff/committees/cluster_committee.go
index 565261dd7ee..1a018bd7b55 100644
--- a/consensus/hotstuff/committees/cluster_committee.go
+++ b/consensus/hotstuff/committees/cluster_committee.go
@@ -20,18 +20,18 @@ import (
 // implementation reference blocks on the cluster chain, which in turn reference
 // blocks on the main chain - this implementation manages that translation.
 type Cluster struct {
-	state    protocol.State
-	payloads storage.ClusterPayloads
-	me       flow.Identifier
-	// pre-computed leader selection for the full lifecycle of the cluster
-	selection *leader.LeaderSelection
-	// a filter that returns all members of the cluster committee allowed to vote
-	clusterMemberFilter flow.IdentityFilter
-	// initial set of cluster members, WITHOUT dynamic weight changes
-	// TODO: should use identity skeleton https://github.com/dapperlabs/flow-go/issues/6232
-	initialClusterMembers flow.IdentityList
-	weightThresholdForQC  uint64 // computed based on initial cluster committee weights
-	weightThresholdForTO  uint64 // computed based on initial cluster committee weights
+	state     protocol.State
+	payloads  storage.ClusterPayloads
+	me        flow.Identifier
+	selection *leader.LeaderSelection // pre-computed leader selection for the full lifecycle of the cluster
+
+	clusterMembers       flow.IdentitySkeletonList          // cluster members in canonical order as specified by the epoch smart contract
+	clusterMemberFilter  flow.IdentityFilter[flow.Identity] // filter that returns true for all members of the cluster committee allowed to vote
+	weightThresholdForQC uint64                             // computed based on initial cluster committee weights
+	weightThresholdForTO uint64                             // computed based on initial cluster committee weights
+
+	// initialClusterIdentities lists full Identities for cluster members (in canonical order) at time of cluster initialization by Epoch smart contract
+	initialClusterIdentities flow.IdentityList
 }
 
 var _ hotstuff.Replicas = (*Cluster)(nil)
@@ -44,26 +44,28 @@ func NewClusterCommittee(
 	epoch protocol.Epoch,
 	me flow.Identifier,
 ) (*Cluster, error) {
-
 	selection, err := leader.SelectionForCluster(cluster, epoch)
 	if err != nil {
 		return nil, fmt.Errorf("could not compute leader selection for cluster: %w", err)
 	}
 
-	totalWeight := cluster.Members().TotalWeight()
+	initialClusterIdentities := votingClusterParticipants(cluster.Members()) // drops nodes with `InitialWeight=0`
+	initialClusterMembersSelector := initialClusterIdentities.Selector()     // hence, any node accepted by this selector has `InitialWeight>0`
+	totalWeight := initialClusterIdentities.TotalWeight()
+
 	com := &Cluster{
 		state:     state,
 		payloads:  payloads,
 		me:        me,
 		selection: selection,
-		clusterMemberFilter: filter.And(
-			cluster.Members().Selector(),
-			filter.Not(filter.Ejected),
-			filter.HasWeight(true),
+		clusterMemberFilter: filter.And[flow.Identity](
+			initialClusterMembersSelector,
+			filter.IsValidCurrentEpochParticipant,
 		),
-		initialClusterMembers: cluster.Members(),
-		weightThresholdForQC:  WeightThresholdToBuildQC(totalWeight),
-		weightThresholdForTO:  WeightThresholdToTimeout(totalWeight),
+		clusterMembers:           initialClusterIdentities.ToSkeleton(),
+		initialClusterIdentities: initialClusterIdentities,
+		weightThresholdForQC:     WeightThresholdToBuildQC(totalWeight),
+		weightThresholdForTO:     WeightThresholdToTimeout(totalWeight),
 	}
 	return com, nil
 }
@@ -74,18 +76,15 @@ func (c *Cluster) IdentitiesByBlock(blockID flow.Identifier) (flow.IdentityList,
 	// blockID is a collection block not a block produced by consensus,
 	// to query the identities from protocol state, we need to use the reference block id from the payload
 	//
-	// first retrieve the cluster block payload
+	// first retrieve the cluster block's payload
 	payload, err := c.payloads.ByBlockID(blockID)
 	if err != nil {
 		return nil, fmt.Errorf("could not get cluster payload: %w", err)
 	}
 
-	// an empty reference block ID indicates a root block
-	isRootBlock := payload.ReferenceBlockID == flow.ZeroID
-
-	// use the initial cluster members for root block
-	if isRootBlock {
-		return c.initialClusterMembers, nil
+	// An empty reference block ID indicates a root block. In this case, use the initial cluster members for root block
+	if isRootBlock := payload.ReferenceBlockID == flow.ZeroID; isRootBlock {
+		return c.initialClusterIdentities, nil
 	}
 
 	// otherwise use the snapshot given by the reference block
@@ -94,19 +93,15 @@ func (c *Cluster) IdentitiesByBlock(blockID flow.Identifier) (flow.IdentityList,
 }
 
 func (c *Cluster) IdentityByBlock(blockID flow.Identifier, nodeID flow.Identifier) (*flow.Identity, error) {
-
-	// first retrieve the cluster block payload
+	// first retrieve the cluster block's payload
 	payload, err := c.payloads.ByBlockID(blockID)
 	if err != nil {
 		return nil, fmt.Errorf("could not get cluster payload: %w", err)
 	}
 
-	// an empty reference block ID indicates a root block
-	isRootBlock := payload.ReferenceBlockID == flow.ZeroID
-
-	// use the initial cluster members for root block
-	if isRootBlock {
-		identity, ok := c.initialClusterMembers.ByNodeID(nodeID)
+	// An empty reference block ID indicates a root block. In this case, use the initial cluster members for root block
+	if isRootBlock := payload.ReferenceBlockID == flow.ZeroID; isRootBlock {
+		identity, ok := c.initialClusterIdentities.ByNodeID(nodeID)
 		if !ok {
 			return nil, model.NewInvalidSignerErrorf("node %v is not an authorized hotstuff participant", nodeID)
 		}
@@ -127,11 +122,12 @@ func (c *Cluster) IdentityByBlock(blockID flow.Identifier, nodeID flow.Identifie
 	return identity, nil
 }
 
-// IdentitiesByEpoch returns the initial cluster members for this epoch. The view
-// parameter is the view in the cluster consensus. Since clusters only exist for
-// one epoch, we don't need to check the view.
-func (c *Cluster) IdentitiesByEpoch(_ uint64) (flow.IdentityList, error) {
-	return c.initialClusterMembers, nil
+// IdentitiesByEpoch returns the IdentitySkeletons of the cluster members in canonical order.
+// This represents the cluster composition at the time the cluster was specified by the epoch smart
+// contract (hence, we return IdentitySkeletons as opposed to full identities). Since clusters only
+// exist for one epoch, we don't need to check the view.
+func (c *Cluster) IdentitiesByEpoch(_ uint64) (flow.IdentitySkeletonList, error) {
+	return c.clusterMembers, nil
 }
 
 // IdentityByEpoch returns the node from the initial cluster members for this epoch.
@@ -141,10 +137,10 @@ func (c *Cluster) IdentitiesByEpoch(_ uint64) (flow.IdentityList, error) {
 // Returns:
 //   - model.InvalidSignerError if nodeID was not listed by the Epoch Setup event as an
 //     authorized participant in this cluster
-func (c *Cluster) IdentityByEpoch(_ uint64, nodeID flow.Identifier) (*flow.Identity, error) {
-	identity, ok := c.initialClusterMembers.ByNodeID(nodeID)
+func (c *Cluster) IdentityByEpoch(view uint64, participantID flow.Identifier) (*flow.IdentitySkeleton, error) {
+	identity, ok := c.clusterMembers.ByNodeID(participantID)
 	if !ok {
-		return nil, model.NewInvalidSignerErrorf("node %v is not an authorized hotstuff participant", nodeID)
+		return nil, model.NewInvalidSignerErrorf("node %v is not an authorized hotstuff participant", participantID)
 	}
 	return identity, nil
 }
@@ -180,3 +176,38 @@ func (c *Cluster) Self() flow.Identifier {
 func (c *Cluster) DKG(_ uint64) (hotstuff.DKG, error) {
 	panic("queried DKG of cluster committee")
 }
+
+// votingClusterParticipants extends the IdentitySkeletons of the cluster members to their full Identities
+// at the time of cluster initialization by EpochSetup event.
+// IMPORTANT CONVENTIONS:
+//  1. clusterMembers with zero `InitialWeight` are _not included_ as "contributing" cluster participants.
+//     In accordance with their zero weight, they cannot contribute to advancing the cluster consensus.
+//     For example, the consensus leader selection allows zero-weighted nodes among the weighted participants,
+//     but these nodes have zero probability to be selected as leader. Similarly, they cannot meaningfully contribute
+//     votes or Timeouts to QCs or TC, due to their zero weight. Therefore, we do not consider them a valid signer.
+//  2. This operation maintains the relative order. In other words, if `clusterMembers` is in canonical order,
+//     then the output `IdentityList` is also canonically ordered.
+//
+// CONTEXT: The EpochSetup event contains the IdentitySkeletons for each cluster, thereby specifying cluster membership.
+// While ejection status is not part of the EpochSetup event, we can supplement this information as follows:
+//   - Per convention, service events are delivered (asynchronously) in an *order-preserving* manner. Furthermore,
+//     node ejection is also mediated by system smart contracts and delivered via service events.
+//   - Therefore, the EpochSetup event contains the up-to-date snapshot of the cluster members. Any node ejection
+//     that happened before should be reflected in the EpochSetup event. Specifically, ejected nodes
+//     should be no longer listed in the EpochSetup event. Hence, when the EpochSetup event is emitted / processed,
+//     the participation status of all cluster members equals flow.EpochParticipationStatusActive.
+func votingClusterParticipants(clusterMembers flow.IdentitySkeletonList) flow.IdentityList {
+	initialClusterIdentities := make(flow.IdentityList, 0, len(clusterMembers))
+	for _, skeleton := range clusterMembers {
+		if skeleton.InitialWeight == 0 {
+			continue
+		}
+		initialClusterIdentities = append(initialClusterIdentities, &flow.Identity{
+			IdentitySkeleton: *skeleton,
+			DynamicIdentity: flow.DynamicIdentity{
+				EpochParticipationStatus: flow.EpochParticipationStatusActive,
+			},
+		})
+	}
+	return initialClusterIdentities
+}
diff --git a/consensus/hotstuff/committees/cluster_committee_test.go b/consensus/hotstuff/committees/cluster_committee_test.go
index e6c36aea044..7ec661d056d 100644
--- a/consensus/hotstuff/committees/cluster_committee_test.go
+++ b/consensus/hotstuff/committees/cluster_committee_test.go
@@ -49,11 +49,11 @@ func (suite *ClusterSuite) SetupTest() {
 	suite.members = unittest.IdentityListFixture(5, unittest.WithRole(flow.RoleCollection))
 	suite.me = suite.members[0]
 	counter := uint64(1)
-	suite.root = clusterstate.CanonicalRootBlock(counter, suite.members)
+	suite.root = clusterstate.CanonicalRootBlock(counter, suite.members.ToSkeleton())
 
 	suite.cluster.On("EpochCounter").Return(counter)
 	suite.cluster.On("Index").Return(uint(1))
-	suite.cluster.On("Members").Return(suite.members)
+	suite.cluster.On("Members").Return(suite.members.ToSkeleton())
 	suite.cluster.On("RootBlock").Return(suite.root)
 	suite.epoch.On("Counter").Return(counter, nil)
 	suite.epoch.On("RandomSource").Return(unittest.SeedFixture(prg.RandomSourceLength), nil)
@@ -73,11 +73,11 @@ func (suite *ClusterSuite) SetupTest() {
 func (suite *ClusterSuite) TestThresholds() {
 	threshold, err := suite.com.QuorumThresholdForView(rand.Uint64())
 	suite.Require().NoError(err)
-	suite.Assert().Equal(WeightThresholdToBuildQC(suite.members.TotalWeight()), threshold)
+	suite.Assert().Equal(WeightThresholdToBuildQC(suite.members.ToSkeleton().TotalWeight()), threshold)
 
 	threshold, err = suite.com.TimeoutThresholdForView(rand.Uint64())
 	suite.Require().NoError(err)
-	suite.Assert().Equal(WeightThresholdToTimeout(suite.members.TotalWeight()), threshold)
+	suite.Assert().Equal(WeightThresholdToTimeout(suite.members.ToSkeleton().TotalWeight()), threshold)
 }
 
 // TestInvalidSigner tests that the InvalidSignerError sentinel is
@@ -97,20 +97,20 @@ func (suite *ClusterSuite) TestInvalidSigner() {
 
 	// a real cluster member which continues to be a valid member
 	realClusterMember := suite.members[1]
-	// a real cluster member which loses all its weight between cluster initialization
+	// a real cluster member which unstaked and is not active anymore
 	// and the test's reference block
-	realNoWeightClusterMember := suite.members[2]
-	realNoWeightClusterMember.Weight = 0
+	realLeavingClusterMember := suite.members[2]
+	realLeavingClusterMember.EpochParticipationStatus = flow.EpochParticipationStatusLeaving
 	// a real cluster member which is ejected between cluster initialization and
 	// the test's reference block
 	realEjectedClusterMember := suite.members[3]
-	realEjectedClusterMember.Ejected = true
+	realEjectedClusterMember.EpochParticipationStatus = flow.EpochParticipationStatusEjected
 	realNonClusterMember := unittest.IdentityFixture(unittest.WithRole(flow.RoleCollection))
 	fakeID := unittest.IdentifierFixture()
 
 	suite.state.On("AtBlockID", refID).Return(suite.snap)
 	suite.snap.On("Identity", realClusterMember.NodeID).Return(realClusterMember, nil)
-	suite.snap.On("Identity", realNoWeightClusterMember.NodeID).Return(realNoWeightClusterMember, nil)
+	suite.snap.On("Identity", realLeavingClusterMember.NodeID).Return(realLeavingClusterMember, nil)
 	suite.snap.On("Identity", realEjectedClusterMember.NodeID).Return(realEjectedClusterMember, nil)
 	suite.snap.On("Identity", realNonClusterMember.NodeID).Return(realNonClusterMember, nil)
 	suite.snap.On("Identity", fakeID).Return(nil, protocol.IdentityNotFoundError{})
@@ -130,6 +130,18 @@ func (suite *ClusterSuite) TestInvalidSigner() {
 		})
 	})
 
+	suite.Run("should return ErrInvalidSigner for existent but not active cluster member", func() {
+		suite.Run("non-root block", func() {
+			_, err := suite.com.IdentityByBlock(nonRootBlockID, realLeavingClusterMember.NodeID)
+			suite.Assert().True(model.IsInvalidSignerError(err))
+		})
+		suite.Run("by epoch", func() {
+			actual, err := suite.com.IdentityByEpoch(rand.Uint64(), realLeavingClusterMember.NodeID)
+			suite.Require().NoError(err)
+			suite.Assert().Equal(realLeavingClusterMember.IdentitySkeleton, *actual)
+		})
+	})
+
 	suite.Run("should return InvalidSignerError for existent non-cluster-member", func() {
 		suite.Run("root block", func() {
 			_, err := suite.com.IdentityByBlock(rootBlockID, realNonClusterMember.NodeID)
@@ -146,12 +158,6 @@ func (suite *ClusterSuite) TestInvalidSigner() {
 	})
 
 	suite.Run("should return ErrInvalidSigner for existent but ejected cluster member", func() {
-		// at the root block, the cluster member is not ejected yet
-		suite.Run("root block", func() {
-			actual, err := suite.com.IdentityByBlock(rootBlockID, realEjectedClusterMember.NodeID)
-			suite.Require().NoError(err)
-			suite.Assert().Equal(realEjectedClusterMember, actual)
-		})
 		suite.Run("non-root block", func() {
 			_, err := suite.com.IdentityByBlock(nonRootBlockID, realEjectedClusterMember.NodeID)
 			suite.Assert().True(model.IsInvalidSignerError(err))
@@ -159,25 +165,7 @@ func (suite *ClusterSuite) TestInvalidSigner() {
 		suite.Run("by epoch", func() {
 			actual, err := suite.com.IdentityByEpoch(rand.Uint64(), realEjectedClusterMember.NodeID)
 			suite.Assert().NoError(err)
-			suite.Assert().Equal(realEjectedClusterMember, actual)
-		})
-	})
-
-	suite.Run("should return ErrInvalidSigner for existent but zero-weight cluster member", func() {
-		// at the root block, the cluster member has its initial weight
-		suite.Run("root block", func() {
-			actual, err := suite.com.IdentityByBlock(rootBlockID, realNoWeightClusterMember.NodeID)
-			suite.Require().NoError(err)
-			suite.Assert().Equal(realNoWeightClusterMember, actual)
-		})
-		suite.Run("non-root block", func() {
-			_, err := suite.com.IdentityByBlock(nonRootBlockID, realNoWeightClusterMember.NodeID)
-			suite.Assert().True(model.IsInvalidSignerError(err))
-		})
-		suite.Run("by epoch", func() {
-			actual, err := suite.com.IdentityByEpoch(rand.Uint64(), realNoWeightClusterMember.NodeID)
-			suite.Require().NoError(err)
-			suite.Assert().Equal(realNoWeightClusterMember, actual)
+			suite.Assert().Equal(realEjectedClusterMember.IdentitySkeleton, *actual)
 		})
 	})
 
@@ -195,7 +183,7 @@ func (suite *ClusterSuite) TestInvalidSigner() {
 		suite.Run("by epoch", func() {
 			actual, err := suite.com.IdentityByEpoch(rand.Uint64(), realClusterMember.NodeID)
 			suite.Require().NoError(err)
-			suite.Assert().Equal(realClusterMember, actual)
+			suite.Assert().Equal(realClusterMember.IdentitySkeleton, *actual)
 		})
 	})
 }
diff --git a/consensus/hotstuff/committees/consensus_committee.go b/consensus/hotstuff/committees/consensus_committee.go
index 2c81adc78f3..f4dd5548670 100644
--- a/consensus/hotstuff/committees/consensus_committee.go
+++ b/consensus/hotstuff/committees/consensus_committee.go
@@ -21,13 +21,12 @@ import (
 // staticEpochInfo contains leader selection and the initial committee for one epoch.
 // This data structure must not be mutated after construction.
 type staticEpochInfo struct {
-	firstView    uint64                  // first view of the epoch (inclusive)
-	finalView    uint64                  // final view of the epoch (inclusive)
-	randomSource []byte                  // random source of epoch
-	leaders      *leader.LeaderSelection // pre-computed leader selection for the epoch
-	// TODO: should use identity skeleton https://github.com/dapperlabs/flow-go/issues/6232
-	initialCommittee     flow.IdentityList
-	initialCommitteeMap  map[flow.Identifier]*flow.Identity
+	firstView            uint64                  // first view of the epoch (inclusive)
+	finalView            uint64                  // final view of the epoch (inclusive)
+	randomSource         []byte                  // random source of epoch
+	leaders              *leader.LeaderSelection // pre-computed leader selection for the epoch
+	initialCommittee     flow.IdentitySkeletonList
+	initialCommitteeMap  map[flow.Identifier]*flow.IdentitySkeleton
 	weightThresholdForQC uint64 // computed based on initial committee weights
 	weightThresholdForTO uint64 // computed based on initial committee weights
 	dkg                  hotstuff.DKG
@@ -56,7 +55,7 @@ func newStaticEpochInfo(epoch protocol.Epoch) (*staticEpochInfo, error) {
 	if err != nil {
 		return nil, fmt.Errorf("could not initial identities: %w", err)
 	}
-	initialCommittee := initialIdentities.Filter(filter.IsVotingConsensusCommitteeMember)
+	initialCommittee := initialIdentities.Filter(filter.IsConsensusCommitteeMember).ToSkeleton()
 	dkg, err := epoch.DKG()
 	if err != nil {
 		return nil, fmt.Errorf("could not get dkg: %w", err)
@@ -84,12 +83,16 @@ func newStaticEpochInfo(epoch protocol.Epoch) (*staticEpochInfo, error) {
 // * lasts until the next spork (estimated 6 months)
 // * has the same static committee as the last committed epoch
 func newEmergencyFallbackEpoch(lastCommittedEpoch *staticEpochInfo) (*staticEpochInfo, error) {
-
 	rng, err := prg.New(lastCommittedEpoch.randomSource, prg.ConsensusLeaderSelection, nil)
 	if err != nil {
 		return nil, fmt.Errorf("could not create rng from seed: %w", err)
 	}
-	leaders, err := leader.ComputeLeaderSelection(lastCommittedEpoch.finalView+1, rng, leader.EstimatedSixMonthOfViews, lastCommittedEpoch.initialCommittee)
+	leaders, err := leader.ComputeLeaderSelection(
+		lastCommittedEpoch.finalView+1,
+		rng,
+		leader.EstimatedSixMonthOfViews,
+		lastCommittedEpoch.initialCommittee,
+	)
 	if err != nil {
 		return nil, fmt.Errorf("could not compute leader selection for fallback epoch: %w", err)
 	}
@@ -126,7 +129,6 @@ var _ hotstuff.Replicas = (*Consensus)(nil)
 var _ hotstuff.DynamicCommittee = (*Consensus)(nil)
 
 func NewConsensusCommittee(state protocol.State, me flow.Identifier) (*Consensus, error) {
-
 	com := &Consensus{
 		state:                  state,
 		me:                     me,
@@ -226,7 +228,7 @@ func (c *Consensus) IdentityByBlock(blockID flow.Identifier, nodeID flow.Identif
 //   - model.ErrViewForUnknownEpoch if no committed epoch containing the given view is known.
 //     This is an expected error and must be handled.
 //   - unspecific error in case of unexpected problems and bugs
-func (c *Consensus) IdentitiesByEpoch(view uint64) (flow.IdentityList, error) {
+func (c *Consensus) IdentitiesByEpoch(view uint64) (flow.IdentitySkeletonList, error) {
 	epochInfo, err := c.staticEpochInfoByView(view)
 	if err != nil {
 		return nil, err
@@ -245,14 +247,14 @@ func (c *Consensus) IdentitiesByEpoch(view uint64) (flow.IdentityList, error) {
 //   - model.InvalidSignerError if nodeID was not listed by the Epoch Setup event as an
 //     authorized consensus participants.
 //   - unspecific error in case of unexpected problems and bugs
-func (c *Consensus) IdentityByEpoch(view uint64, nodeID flow.Identifier) (*flow.Identity, error) {
+func (c *Consensus) IdentityByEpoch(view uint64, participantID flow.Identifier) (*flow.IdentitySkeleton, error) {
 	epochInfo, err := c.staticEpochInfoByView(view)
 	if err != nil {
 		return nil, err
 	}
-	identity, ok := epochInfo.initialCommitteeMap[nodeID]
+	identity, ok := epochInfo.initialCommitteeMap[participantID]
 	if !ok {
-		return nil, model.NewInvalidSignerErrorf("id %v is not a valid node id", nodeID)
+		return nil, model.NewInvalidSignerErrorf("id %v is not a valid node id", participantID)
 	}
 	return identity, nil
 }
diff --git a/consensus/hotstuff/committees/consensus_committee_test.go b/consensus/hotstuff/committees/consensus_committee_test.go
index 61012ee51a9..9dd9bd46d9e 100644
--- a/consensus/hotstuff/committees/consensus_committee_test.go
+++ b/consensus/hotstuff/committees/consensus_committee_test.go
@@ -181,7 +181,7 @@ func (suite *ConsensusSuite) TestConstruction_CommittedNextEpoch() {
 	suite.AssertStoredEpochCounterRange(suite.currentEpochCounter, suite.currentEpochCounter+1)
 }
 
-// TestConstruction_EpochFallbackTriggered tests construction when EECC has been triggered.
+// TestConstruction_EpochFallbackTriggered tests construction when EFM has been triggered.
 // Both current and the injected fallback epoch should be cached after construction.
 func (suite *ConsensusSuite) TestConstruction_EpochFallbackTriggered() {
 	curEpoch := newMockEpoch(suite.currentEpochCounter, unittest.IdentityListFixture(10), 101, 200, unittest.SeedFixture(32), true)
@@ -262,9 +262,17 @@ func (suite *ConsensusSuite) TestIdentitiesByBlock() {
 	t := suite.T()
 
 	realIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus))
-	zeroWeightConsensusIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus), unittest.WithWeight(0))
-	ejectedConsensusIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus), unittest.WithEjected(true))
+	joiningConsensusIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus), unittest.WithParticipationStatus(flow.EpochParticipationStatusJoining))
+	leavingConsensusIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus), unittest.WithParticipationStatus(flow.EpochParticipationStatusLeaving))
+	ejectedConsensusIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus), unittest.WithParticipationStatus(flow.EpochParticipationStatusEjected))
 	validNonConsensusIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification))
+	validConsensusIdentities := []*flow.Identity{
+		realIdentity,
+		joiningConsensusIdentity,
+		leavingConsensusIdentity,
+		validNonConsensusIdentity,
+		ejectedConsensusIdentity,
+	}
 	fakeID := unittest.IdentifierFixture()
 	blockID := unittest.IdentifierFixture()
 
@@ -273,10 +281,10 @@ func (suite *ConsensusSuite) TestIdentitiesByBlock() {
 	suite.epochs.Add(currEpoch)
 
 	suite.state.On("AtBlockID", blockID).Return(suite.snapshot)
-	suite.snapshot.On("Identity", realIdentity.NodeID).Return(realIdentity, nil)
-	suite.snapshot.On("Identity", zeroWeightConsensusIdentity.NodeID).Return(zeroWeightConsensusIdentity, nil)
-	suite.snapshot.On("Identity", ejectedConsensusIdentity.NodeID).Return(ejectedConsensusIdentity, nil)
-	suite.snapshot.On("Identity", validNonConsensusIdentity.NodeID).Return(validNonConsensusIdentity, nil)
+	for _, identity := range validConsensusIdentities {
+		i := identity // copy
+		suite.snapshot.On("Identity", i.NodeID).Return(i, nil)
+	}
 	suite.snapshot.On("Identity", fakeID).Return(nil, protocol.IdentityNotFoundError{})
 
 	suite.CreateAndStartCommittee()
@@ -287,8 +295,13 @@ func (suite *ConsensusSuite) TestIdentitiesByBlock() {
 	})
 
 	t.Run("existent but non-committee-member identity should return InvalidSignerError", func(t *testing.T) {
-		t.Run("zero-weight consensus node", func(t *testing.T) {
-			_, err := suite.committee.IdentityByBlock(blockID, zeroWeightConsensusIdentity.NodeID)
+		t.Run("joining consensus node", func(t *testing.T) {
+			_, err := suite.committee.IdentityByBlock(blockID, joiningConsensusIdentity.NodeID)
+			require.True(t, model.IsInvalidSignerError(err))
+		})
+
+		t.Run("leaving consensus node", func(t *testing.T) {
+			_, err := suite.committee.IdentityByBlock(blockID, leavingConsensusIdentity.NodeID)
 			require.True(t, model.IsInvalidSignerError(err))
 		})
 
@@ -327,8 +340,10 @@ func (suite *ConsensusSuite) TestIdentitiesByEpoch() {
 	// epoch 1 identities with varying conditions which would disqualify them
 	// from committee participation
 	realIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus))
-	zeroWeightConsensusIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus), unittest.WithWeight(0))
-	ejectedConsensusIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus), unittest.WithEjected(true))
+	zeroWeightConsensusIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus),
+		unittest.WithInitialWeight(0))
+	ejectedConsensusIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus),
+		unittest.WithParticipationStatus(flow.EpochParticipationStatusEjected))
 	validNonConsensusIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification))
 	epoch1Identities := flow.IdentityList{realIdentity, zeroWeightConsensusIdentity, ejectedConsensusIdentity, validNonConsensusIdentity}
 
@@ -356,11 +371,6 @@ func (suite *ConsensusSuite) TestIdentitiesByEpoch() {
 				require.True(t, model.IsInvalidSignerError(err))
 			})
 
-			t.Run("ejected consensus node", func(t *testing.T) {
-				_, err := suite.committee.IdentityByEpoch(unittest.Uint64InRange(1, 100), ejectedConsensusIdentity.NodeID)
-				require.True(t, model.IsInvalidSignerError(err))
-			})
-
 			t.Run("otherwise valid non-consensus node", func(t *testing.T) {
 				_, err := suite.committee.IdentityByEpoch(unittest.Uint64InRange(1, 100), validNonConsensusIdentity.NodeID)
 				require.True(t, model.IsInvalidSignerError(err))
@@ -370,7 +380,7 @@ func (suite *ConsensusSuite) TestIdentitiesByEpoch() {
 		t.Run("should be able to retrieve real identity", func(t *testing.T) {
 			actual, err := suite.committee.IdentityByEpoch(unittest.Uint64InRange(1, 100), realIdentity.NodeID)
 			require.NoError(t, err)
-			require.Equal(t, realIdentity, actual)
+			require.Equal(t, realIdentity.IdentitySkeleton, *actual)
 		})
 
 		t.Run("should return ErrViewForUnknownEpoch for view outside existing epoch", func(t *testing.T) {
@@ -387,7 +397,7 @@ func (suite *ConsensusSuite) TestIdentitiesByEpoch() {
 		t.Run("should be able to retrieve epoch 1 identity in epoch 1", func(t *testing.T) {
 			actual, err := suite.committee.IdentityByEpoch(unittest.Uint64InRange(1, 100), realIdentity.NodeID)
 			require.NoError(t, err)
-			require.Equal(t, realIdentity, actual)
+			require.Equal(t, realIdentity.IdentitySkeleton, *actual)
 		})
 
 		t.Run("should be unable to retrieve epoch 1 identity in epoch 2", func(t *testing.T) {
@@ -405,7 +415,7 @@ func (suite *ConsensusSuite) TestIdentitiesByEpoch() {
 		t.Run("should be able to retrieve epoch 2 identity in epoch 2", func(t *testing.T) {
 			actual, err := suite.committee.IdentityByEpoch(unittest.Uint64InRange(101, 200), epoch2Identity.NodeID)
 			require.NoError(t, err)
-			require.Equal(t, epoch2Identity, actual)
+			require.Equal(t, epoch2Identity.IdentitySkeleton, *actual)
 		})
 
 		t.Run("should return ErrViewForUnknownEpoch for view outside existing epochs", func(t *testing.T) {
@@ -428,8 +438,8 @@ func (suite *ConsensusSuite) TestThresholds() {
 
 	identities := unittest.IdentityListFixture(10)
 
-	prevEpoch := newMockEpoch(suite.currentEpochCounter-1, identities.Map(mapfunc.WithWeight(100)), 1, 100, unittest.SeedFixture(prg.RandomSourceLength), true)
-	currEpoch := newMockEpoch(suite.currentEpochCounter, identities.Map(mapfunc.WithWeight(200)), 101, 200, unittest.SeedFixture(32), true)
+	prevEpoch := newMockEpoch(suite.currentEpochCounter-1, identities.Map(mapfunc.WithInitialWeight(100)), 1, 100, unittest.SeedFixture(prg.RandomSourceLength), true)
+	currEpoch := newMockEpoch(suite.currentEpochCounter, identities.Map(mapfunc.WithInitialWeight(200)), 101, 200, unittest.SeedFixture(32), true)
 	suite.epochs.Add(prevEpoch)
 	suite.epochs.Add(currEpoch)
 
@@ -466,7 +476,7 @@ func (suite *ConsensusSuite) TestThresholds() {
 	})
 
 	// now, add a valid next epoch
-	nextEpoch := newMockEpoch(suite.currentEpochCounter+1, identities.Map(mapfunc.WithWeight(300)), 201, 300, unittest.SeedFixture(prg.RandomSourceLength), true)
+	nextEpoch := newMockEpoch(suite.currentEpochCounter+1, identities.Map(mapfunc.WithInitialWeight(300)), 201, 300, unittest.SeedFixture(prg.RandomSourceLength), true)
 	suite.CommitEpoch(nextEpoch)
 
 	t.Run("next epoch ready", func(t *testing.T) {
@@ -679,7 +689,7 @@ func newMockEpoch(counter uint64, identities flow.IdentityList, firstView uint64
 
 	epoch := new(protocolmock.Epoch)
 	epoch.On("Counter").Return(counter, nil)
-	epoch.On("InitialIdentities").Return(identities, nil)
+	epoch.On("InitialIdentities").Return(identities.ToSkeleton(), nil)
 	epoch.On("FirstView").Return(firstView, nil)
 	epoch.On("FinalView").Return(finalView, nil)
 	if committed {
diff --git a/consensus/hotstuff/committees/leader/cluster.go b/consensus/hotstuff/committees/leader/cluster.go
index b1a2af13be2..ac95d0ce357 100644
--- a/consensus/hotstuff/committees/leader/cluster.go
+++ b/consensus/hotstuff/committees/leader/cluster.go
@@ -8,9 +8,10 @@ import (
 )
 
 // SelectionForCluster pre-computes and returns leaders for the given cluster
-// committee in the given epoch.
+// committee in the given epoch. A cluster containing nodes with zero `InitialWeight`
+// is an accepted input as long as there are nodes with positive weights. Zero-weight nodes
+// have zero probability of being selected as leaders in accordance with their weight.
 func SelectionForCluster(cluster protocol.Cluster, epoch protocol.Epoch) (*LeaderSelection, error) {
-
 	// sanity check to ensure the cluster and epoch match
 	counter, err := epoch.Counter()
 	if err != nil {
@@ -20,7 +21,6 @@ func SelectionForCluster(cluster protocol.Cluster, epoch protocol.Epoch) (*Leade
 		return nil, fmt.Errorf("inconsistent counter between epoch (%d) and cluster (%d)", counter, cluster.EpochCounter())
 	}
 
-	identities := cluster.Members()
 	// get the random source of the current epoch
 	randomSeed, err := epoch.RandomSource()
 	if err != nil {
@@ -33,14 +33,14 @@ func SelectionForCluster(cluster protocol.Cluster, epoch protocol.Epoch) (*Leade
 	}
 
 	firstView := cluster.RootBlock().Header.View
-	// TODO what is a good value here?
-	finalView := firstView + EstimatedSixMonthOfViews
+	finalView := firstView + EstimatedSixMonthOfViews // TODO what is a good value here?
 
+	// ComputeLeaderSelection already handles zero-weight nodes with marginal overhead.
 	leaders, err := ComputeLeaderSelection(
 		firstView,
 		rng,
 		int(finalView-firstView+1),
-		identities,
+		cluster.Members().ToSkeleton(),
 	)
 	return leaders, err
 }
diff --git a/consensus/hotstuff/committees/leader/consensus.go b/consensus/hotstuff/committees/leader/consensus.go
index 17f8c108069..f278e690f76 100644
--- a/consensus/hotstuff/committees/leader/consensus.go
+++ b/consensus/hotstuff/committees/leader/consensus.go
@@ -43,7 +43,7 @@ func SelectionForConsensus(epoch protocol.Epoch) (*LeaderSelection, error) {
 		firstView,
 		rng,
 		int(finalView-firstView+1), // add 1 because both first/final view are inclusive
-		identities.Filter(filter.IsVotingConsensusCommitteeMember),
+		identities.Filter(filter.IsConsensusCommitteeMember),
 	)
 	return leaders, err
 }
diff --git a/consensus/hotstuff/committees/leader/leader_selection.go b/consensus/hotstuff/committees/leader/leader_selection.go
index 891fc4d7b43..d39acc34d84 100644
--- a/consensus/hotstuff/committees/leader/leader_selection.go
+++ b/consensus/hotstuff/committees/leader/leader_selection.go
@@ -85,25 +85,28 @@ func (l LeaderSelection) newInvalidViewError(view uint64) InvalidViewError {
 
 // ComputeLeaderSelection pre-generates a certain number of leader selections, and returns a
 // leader selection instance for querying the leader indexes for certain views.
-// firstView - the start view of the epoch, the generated leader selections start from this view.
-// rng - the deterministic source of randoms
-// count - the number of leader selections to be pre-generated and cached.
-// identities - the identities that contain the weight info, which is used as probability for
-// the identity to be selected as leader.
+// Inputs:
+//   - firstView: the start view of the epoch, the generated leader selections start from this view.
+//   - rng: the deterministic source of randoms
+//   - count: the number of leader selections to be pre-generated and cached.
+//   - identities the identities that contain the weight info, which is used as probability for
+//     the identity to be selected as leader.
+//
+// Identities with `InitialWeight=0` are accepted as long as there are nodes with positive weights.
+// Zero-weight nodes have zero probability of being selected as leaders in accordance with their weight.
 func ComputeLeaderSelection(
 	firstView uint64,
 	rng random.Rand,
 	count int,
-	identities flow.IdentityList,
+	identities flow.IdentitySkeletonList,
 ) (*LeaderSelection, error) {
-
 	if count < 1 {
 		return nil, fmt.Errorf("number of views must be positive (got %d)", count)
 	}
 
 	weights := make([]uint64, 0, len(identities))
 	for _, id := range identities {
-		weights = append(weights, id.Weight)
+		weights = append(weights, id.InitialWeight)
 	}
 
 	leaders, err := weightedRandomSelection(rng, count, weights)
@@ -118,7 +121,7 @@ func ComputeLeaderSelection(
 	}, nil
 }
 
-// weightedRandomSelection - given a random source source and a given count, pre-generate the indices of leader.
+// weightedRandomSelection - given a random source and a given count, pre-generate the indices of leader.
 // The chance to be selected as leader is proportional to its weight.
 // If an identity has 0 weight, it won't be selected as leader.
 // This algorithm is essentially Fitness proportionate selection:
@@ -128,11 +131,9 @@ func weightedRandomSelection(
 	count int,
 	weights []uint64,
 ) ([]uint16, error) {
-
 	if len(weights) == 0 {
 		return nil, fmt.Errorf("weights is empty")
 	}
-
 	if len(weights) >= math.MaxUint16 {
 		return nil, fmt.Errorf("number of possible leaders (%d) exceeds maximum (2^16-1)", len(weights))
 	}
@@ -149,7 +150,6 @@ func weightedRandomSelection(
 		cumsum += weight
 		weightSums = append(weightSums, cumsum)
 	}
-
 	if cumsum == 0 {
 		return nil, fmt.Errorf("total weight must be greater than 0")
 	}
diff --git a/consensus/hotstuff/committees/leader/leader_selection_test.go b/consensus/hotstuff/committees/leader/leader_selection_test.go
index 55310de05a2..bda7ce89108 100644
--- a/consensus/hotstuff/committees/leader/leader_selection_test.go
+++ b/consensus/hotstuff/committees/leader/leader_selection_test.go
@@ -23,9 +23,9 @@ var someSeed = []uint8{0x6A, 0x23, 0x41, 0xB7, 0x80, 0xE1, 0x64, 0x59,
 // We test that leader selection works for a committee of size one
 func TestSingleConsensusNode(t *testing.T) {
 
-	identity := unittest.IdentityFixture(unittest.WithWeight(8))
+	identity := unittest.IdentityFixture(unittest.WithInitialWeight(8))
 	rng := getPRG(t, someSeed)
-	selection, err := ComputeLeaderSelection(0, rng, 10, []*flow.Identity{identity})
+	selection, err := ComputeLeaderSelection(0, rng, 10, flow.IdentitySkeletonList{&identity.IdentitySkeleton})
 	require.NoError(t, err)
 	for i := uint64(0); i < 10; i++ {
 		leaderID, err := selection.LeaderForView(i)
@@ -126,9 +126,9 @@ func TestDeterministic(t *testing.T) {
 	const N_VIEWS = 100
 	const N_NODES = 4
 
-	identities := unittest.IdentityListFixture(N_NODES)
+	identities := unittest.IdentityListFixture(N_NODES).ToSkeleton()
 	for i, identity := range identities {
-		identity.Weight = uint64(i + 1)
+		identity.InitialWeight = uint64(i + 1)
 	}
 	rng := getPRG(t, someSeed)
 
@@ -158,16 +158,16 @@ func TestInputValidation(t *testing.T) {
 	// should return an error if we request to compute leader selection for <1 views
 	t.Run("epoch containing no views", func(t *testing.T) {
 		count := 0
-		_, err := ComputeLeaderSelection(0, rng, count, unittest.IdentityListFixture(4))
+		_, err := ComputeLeaderSelection(0, rng, count, unittest.IdentityListFixture(4).ToSkeleton())
 		assert.Error(t, err)
 		count = -1
-		_, err = ComputeLeaderSelection(0, rng, count, unittest.IdentityListFixture(4))
+		_, err = ComputeLeaderSelection(0, rng, count, unittest.IdentityListFixture(4).ToSkeleton())
 		assert.Error(t, err)
 	})
 
 	// epoch with no possible leaders should return an error
 	t.Run("epoch without participants", func(t *testing.T) {
-		identities := unittest.IdentityListFixture(0)
+		identities := unittest.IdentityListFixture(0).ToSkeleton()
 		_, err := ComputeLeaderSelection(0, rng, 100, identities)
 		assert.Error(t, err)
 	})
@@ -181,7 +181,7 @@ func TestViewOutOfRange(t *testing.T) {
 	firstView := uint64(100)
 	finalView := uint64(200)
 
-	identities := unittest.IdentityListFixture(4)
+	identities := unittest.IdentityListFixture(4).ToSkeleton()
 	leaders, err := ComputeLeaderSelection(firstView, rng, int(finalView-firstView+1), identities)
 	require.Nil(t, err)
 
@@ -227,7 +227,7 @@ func TestDifferentSeedWillProduceDifferentSelection(t *testing.T) {
 
 	identities := unittest.IdentityListFixture(N_NODES)
 	for i, identity := range identities {
-		identity.Weight = uint64(i)
+		identity.InitialWeight = uint64(i)
 	}
 
 	rng1 := getPRG(t, someSeed)
@@ -236,10 +236,10 @@ func TestDifferentSeedWillProduceDifferentSelection(t *testing.T) {
 	seed2[0] = 8
 	rng2 := getPRG(t, seed2)
 
-	leaders1, err := ComputeLeaderSelection(0, rng1, N_VIEWS, identities)
+	leaders1, err := ComputeLeaderSelection(0, rng1, N_VIEWS, identities.ToSkeleton())
 	require.NoError(t, err)
 
-	leaders2, err := ComputeLeaderSelection(0, rng2, N_VIEWS, identities)
+	leaders2, err := ComputeLeaderSelection(0, rng2, N_VIEWS, identities.ToSkeleton())
 	require.NoError(t, err)
 
 	diff := 0
@@ -267,9 +267,9 @@ func TestLeaderSelectionAreWeighted(t *testing.T) {
 	const N_VIEWS = 100000
 	const N_NODES = 4
 
-	identities := unittest.IdentityListFixture(N_NODES)
+	identities := unittest.IdentityListFixture(N_NODES).ToSkeleton()
 	for i, identity := range identities {
-		identity.Weight = uint64(i + 1)
+		identity.InitialWeight = uint64(i + 1)
 	}
 
 	leaders, err := ComputeLeaderSelection(0, rng, N_VIEWS, identities)
@@ -287,7 +287,7 @@ func TestLeaderSelectionAreWeighted(t *testing.T) {
 	for nodeID, selectedCount := range selected {
 		identity, ok := identities.ByNodeID(nodeID)
 		require.True(t, ok)
-		target := uint64(N_VIEWS) * identity.Weight / 10
+		target := uint64(N_VIEWS) * identity.InitialWeight / 10
 
 		var diff uint64
 		if selectedCount > target {
@@ -307,14 +307,15 @@ func BenchmarkLeaderSelection(b *testing.B) {
 	const N_VIEWS = 15000000
 	const N_NODES = 20
 
-	identities := make([]*flow.Identity, 0, N_NODES)
+	identities := make(flow.IdentityList, 0, N_NODES)
 	for i := 0; i < N_NODES; i++ {
-		identities = append(identities, unittest.IdentityFixture(unittest.WithWeight(uint64(i))))
+		identities = append(identities, unittest.IdentityFixture(unittest.WithInitialWeight(uint64(i))))
 	}
+	skeletonIdentities := identities.ToSkeleton()
 	rng := getPRG(b, someSeed)
 
 	for n := 0; n < b.N; n++ {
-		_, err := ComputeLeaderSelection(0, rng, N_VIEWS, identities)
+		_, err := ComputeLeaderSelection(0, rng, N_VIEWS, skeletonIdentities)
 
 		require.NoError(b, err)
 	}
@@ -322,8 +323,8 @@ func BenchmarkLeaderSelection(b *testing.B) {
 
 func TestInvalidTotalWeight(t *testing.T) {
 	rng := getPRG(t, someSeed)
-	identities := unittest.IdentityListFixture(4, unittest.WithWeight(0))
-	_, err := ComputeLeaderSelection(0, rng, 10, identities)
+	identities := unittest.IdentityListFixture(4, unittest.WithInitialWeight(0))
+	_, err := ComputeLeaderSelection(0, rng, 10, identities.ToSkeleton())
 	require.Error(t, err)
 }
 
@@ -338,10 +339,10 @@ func TestZeroWeightNodeWillNotBeSelected(t *testing.T) {
 	t.Run("small dataset", func(t *testing.T) {
 		const N_VIEWS = 100
 
-		weightless := unittest.IdentityListFixture(5, unittest.WithWeight(0))
-		weightful := unittest.IdentityListFixture(5)
+		weightless := unittest.IdentityListFixture(5, unittest.WithInitialWeight(0)).ToSkeleton()
+		weightful := unittest.IdentityListFixture(5).ToSkeleton()
 		for i, identity := range weightful {
-			identity.Weight = uint64(i + 1)
+			identity.InitialWeight = uint64(i + 1)
 		}
 
 		identities := append(weightless, weightful...)
@@ -368,23 +369,24 @@ func TestZeroWeightNodeWillNotBeSelected(t *testing.T) {
 		toolRng := getPRG(t, someSeed)
 
 		// create 1002 nodes with all 0 weight
-		identities := unittest.IdentityListFixture(1002, unittest.WithWeight(0))
+		fullIdentities := unittest.IdentityListFixture(1002, unittest.WithInitialWeight(0))
 
 		// create 2 nodes with 1 weight, and place them in between
 		// index 233-777
 		n := toolRng.UintN(777-233) + 233
 		m := toolRng.UintN(777-233) + 233
-		identities[n].Weight = 1
-		identities[m].Weight = 1
+		fullIdentities[n].InitialWeight = 1
+		fullIdentities[m].InitialWeight = 1
 
-		// the following code check the zero weight node should not be selected
-		weightful := identities.Filter(filter.HasWeight(true))
+		// the following code checks that zero-weight nodes are not selected (selection probability is proportional to weight)
+		votingConsensusNodes := fullIdentities.Filter(filter.HasInitialWeight[flow.Identity](true)).ToSkeleton()
+		allEpochConsensusNodes := fullIdentities.ToSkeleton() // including zero-weight nodes
 
 		count := 1000
-		selectionFromAll, err := ComputeLeaderSelection(0, rng, count, identities)
+		selectionFromAll, err := ComputeLeaderSelection(0, rng, count, allEpochConsensusNodes)
 		require.NoError(t, err)
 
-		selectionFromWeightful, err := ComputeLeaderSelection(0, rng_copy, count, weightful)
+		selectionFromWeightful, err := ComputeLeaderSelection(0, rng_copy, count, votingConsensusNodes)
 		require.NoError(t, err)
 
 		for i := 0; i < count; i++ {
@@ -401,11 +403,11 @@ func TestZeroWeightNodeWillNotBeSelected(t *testing.T) {
 		t.Run("if there is only 1 node has weight, then it will be always be the leader and the only leader", func(t *testing.T) {
 			toolRng := getPRG(t, someSeed)
 
-			identities := unittest.IdentityListFixture(1000, unittest.WithWeight(0))
+			identities := unittest.IdentityListFixture(1000, unittest.WithInitialWeight(0)).ToSkeleton()
 
 			n := rng.UintN(1000)
 			weight := n + 1
-			identities[n].Weight = weight
+			identities[n].InitialWeight = weight
 			onlyNodeWithWeight := identities[n]
 
 			selections, err := ComputeLeaderSelection(0, toolRng, 1000, identities)
diff --git a/consensus/hotstuff/committees/metrics_wrapper.go b/consensus/hotstuff/committees/metrics_wrapper.go
index e1bdcbc059a..cbc0d333503 100644
--- a/consensus/hotstuff/committees/metrics_wrapper.go
+++ b/consensus/hotstuff/committees/metrics_wrapper.go
@@ -1,4 +1,3 @@
-// (c) 2020 Dapper Labs - ALL RIGHTS RESERVED
 package committees
 
 import (
@@ -43,14 +42,14 @@ func (w CommitteeMetricsWrapper) IdentityByBlock(blockID flow.Identifier, partic
 	return identity, err
 }
 
-func (w CommitteeMetricsWrapper) IdentitiesByEpoch(view uint64) (flow.IdentityList, error) {
+func (w CommitteeMetricsWrapper) IdentitiesByEpoch(view uint64) (flow.IdentitySkeletonList, error) {
 	processStart := time.Now()
 	identities, err := w.committee.IdentitiesByEpoch(view)
 	w.metrics.CommitteeProcessingDuration(time.Since(processStart))
 	return identities, err
 }
 
-func (w CommitteeMetricsWrapper) IdentityByEpoch(view uint64, participantID flow.Identifier) (*flow.Identity, error) {
+func (w CommitteeMetricsWrapper) IdentityByEpoch(view uint64, participantID flow.Identifier) (*flow.IdentitySkeleton, error) {
 	processStart := time.Now()
 	identity, err := w.committee.IdentityByEpoch(view, participantID)
 	w.metrics.CommitteeProcessingDuration(time.Since(processStart))
diff --git a/consensus/hotstuff/committees/static.go b/consensus/hotstuff/committees/static.go
index 40ef00f5ca6..9fad9a93786 100644
--- a/consensus/hotstuff/committees/static.go
+++ b/consensus/hotstuff/committees/static.go
@@ -11,23 +11,20 @@ import (
 	"github.com/onflow/flow-go/state/protocol"
 )
 
-// NewStaticCommittee returns a new committee with a static participant set.
-func NewStaticCommittee(participants flow.IdentityList, myID flow.Identifier, dkgParticipants map[flow.Identifier]flow.DKGParticipant, dkgGroupKey crypto.PublicKey) (*Static, error) {
-
-	return NewStaticCommitteeWithDKG(participants, myID, staticDKG{
+func NewStaticReplicas(participants flow.IdentitySkeletonList, myID flow.Identifier, dkgParticipants map[flow.Identifier]flow.DKGParticipant, dkgGroupKey crypto.PublicKey) (*StaticReplicas, error) {
+	return NewStaticReplicasWithDKG(participants, myID, staticDKG{
 		dkgParticipants: dkgParticipants,
 		dkgGroupKey:     dkgGroupKey,
 	})
 }
 
-// NewStaticCommitteeWithDKG returns a new committee with a static participant set.
-func NewStaticCommitteeWithDKG(participants flow.IdentityList, myID flow.Identifier, dkg protocol.DKG) (*Static, error) {
+func NewStaticReplicasWithDKG(participants flow.IdentitySkeletonList, myID flow.Identifier, dkg protocol.DKG) (*StaticReplicas, error) {
 	valid := flow.IsIdentityListCanonical(participants)
 	if !valid {
 		return nil, fmt.Errorf("participants %v is not in Canonical order", participants)
 	}
 
-	static := &Static{
+	static := &StaticReplicas{
 		participants: participants,
 		myID:         myID,
 		dkg:          dkg,
@@ -35,31 +32,41 @@ func NewStaticCommitteeWithDKG(participants flow.IdentityList, myID flow.Identif
 	return static, nil
 }
 
-// Static represents a committee with a static participant set. It is used for
-// bootstrapping purposes.
-type Static struct {
-	participants flow.IdentityList
-	myID         flow.Identifier
-	dkg          protocol.DKG
+// NewStaticCommittee returns a new committee with a static participant set.
+func NewStaticCommittee(participants flow.IdentityList, myID flow.Identifier, dkgParticipants map[flow.Identifier]flow.DKGParticipant, dkgGroupKey crypto.PublicKey) (*Static, error) {
+	return NewStaticCommitteeWithDKG(participants, myID, staticDKG{
+		dkgParticipants: dkgParticipants,
+		dkgGroupKey:     dkgGroupKey,
+	})
 }
 
-func (s Static) IdentitiesByBlock(_ flow.Identifier) (flow.IdentityList, error) {
-	return s.participants, nil
-}
+// NewStaticCommitteeWithDKG returns a new committee with a static participant set.
+func NewStaticCommitteeWithDKG(participants flow.IdentityList, myID flow.Identifier, dkg protocol.DKG) (*Static, error) {
+	replicas, err := NewStaticReplicasWithDKG(participants.ToSkeleton(), myID, dkg)
+	if err != nil {
+		return nil, fmt.Errorf("could not create static replicas: %w", err)
+	}
 
-func (s Static) IdentityByBlock(_ flow.Identifier, participantID flow.Identifier) (*flow.Identity, error) {
-	identity, ok := s.participants.ByNodeID(participantID)
-	if !ok {
-		return nil, model.NewInvalidSignerErrorf("unknown participant %x", participantID)
+	static := &Static{
+		StaticReplicas: *replicas,
+		fullIdentities: participants,
 	}
-	return identity, nil
+	return static, nil
 }
 
-func (s Static) IdentitiesByEpoch(_ uint64) (flow.IdentityList, error) {
-	return s.participants, nil
+type StaticReplicas struct {
+	participants flow.IdentitySkeletonList
+	myID         flow.Identifier
+	dkg          protocol.DKG
 }
 
-func (s Static) IdentityByEpoch(_ uint64, participantID flow.Identifier) (*flow.Identity, error) {
+var _ hotstuff.Replicas = (*StaticReplicas)(nil)
+
+func (s StaticReplicas) IdentitiesByEpoch(view uint64) (flow.IdentitySkeletonList, error) {
+	return s.participants.ToSkeleton(), nil
+}
+
+func (s StaticReplicas) IdentityByEpoch(view uint64, participantID flow.Identifier) (*flow.IdentitySkeleton, error) {
 	identity, ok := s.participants.ByNodeID(participantID)
 	if !ok {
 		return nil, model.NewInvalidSignerErrorf("unknown participant %x", participantID)
@@ -67,26 +74,47 @@ func (s Static) IdentityByEpoch(_ uint64, participantID flow.Identifier) (*flow.
 	return identity, nil
 }
 
-func (s Static) LeaderForView(_ uint64) (flow.Identifier, error) {
+func (s StaticReplicas) LeaderForView(_ uint64) (flow.Identifier, error) {
 	return flow.ZeroID, fmt.Errorf("invalid for static committee")
 }
 
-func (s Static) QuorumThresholdForView(_ uint64) (uint64, error) {
-	return WeightThresholdToBuildQC(s.participants.TotalWeight()), nil
+func (s StaticReplicas) QuorumThresholdForView(_ uint64) (uint64, error) {
+	return WeightThresholdToBuildQC(s.participants.ToSkeleton().TotalWeight()), nil
 }
 
-func (s Static) TimeoutThresholdForView(_ uint64) (uint64, error) {
-	return WeightThresholdToTimeout(s.participants.TotalWeight()), nil
+func (s StaticReplicas) TimeoutThresholdForView(_ uint64) (uint64, error) {
+	return WeightThresholdToTimeout(s.participants.ToSkeleton().TotalWeight()), nil
 }
 
-func (s Static) Self() flow.Identifier {
+func (s StaticReplicas) Self() flow.Identifier {
 	return s.myID
 }
 
-func (s Static) DKG(_ uint64) (hotstuff.DKG, error) {
+func (s StaticReplicas) DKG(_ uint64) (hotstuff.DKG, error) {
 	return s.dkg, nil
 }
 
+// Static represents a committee with a static participant set. It is used for
+// bootstrapping purposes.
+type Static struct {
+	StaticReplicas
+	fullIdentities flow.IdentityList
+}
+
+var _ hotstuff.DynamicCommittee = (*Static)(nil)
+
+func (s Static) IdentitiesByBlock(_ flow.Identifier) (flow.IdentityList, error) {
+	return s.fullIdentities, nil
+}
+
+func (s Static) IdentityByBlock(_ flow.Identifier, participantID flow.Identifier) (*flow.Identity, error) {
+	identity, ok := s.fullIdentities.ByNodeID(participantID)
+	if !ok {
+		return nil, model.NewInvalidSignerErrorf("unknown participant %x", participantID)
+	}
+	return identity, nil
+}
+
 type staticDKG struct {
 	dkgParticipants map[flow.Identifier]flow.DKGParticipant
 	dkgGroupKey     crypto.PublicKey
diff --git a/consensus/hotstuff/cruisectl/Readme.md b/consensus/hotstuff/cruisectl/README.md
similarity index 99%
rename from consensus/hotstuff/cruisectl/Readme.md
rename to consensus/hotstuff/cruisectl/README.md
index 1ae65560e31..40b1c0b2e62 100644
--- a/consensus/hotstuff/cruisectl/Readme.md
+++ b/consensus/hotstuff/cruisectl/README.md
@@ -285,9 +285,9 @@ We might incorrectly compute high error in the target view rate, if local curren
 
 **Solution:** determine epoch locally based on view only, do not use `EpochTransition` event.
 
-### EECC
+### EFM
 
-We need to detect EECC and revert to a default block-rate-delay (stop adjusting).
+We need to detect EFM and revert to a default block-rate-delay (stop adjusting).
 
 ## Testing
 
diff --git a/consensus/hotstuff/cruisectl/block_time_controller.go b/consensus/hotstuff/cruisectl/block_time_controller.go
index 0748e8ec760..7f63983521a 100644
--- a/consensus/hotstuff/cruisectl/block_time_controller.go
+++ b/consensus/hotstuff/cruisectl/block_time_controller.go
@@ -34,24 +34,20 @@ type TimedBlock struct {
 // epochInfo stores data about the current and next epoch. It is updated when we enter
 // the first view of a new epoch, or the EpochSetup phase of the current epoch.
 type epochInfo struct {
-	curEpochFirstView     uint64
-	curEpochFinalView     uint64    // F[v] - the final view of the epoch
-	curEpochTargetEndTime time.Time // T[v] - the target end time of the current epoch
-	nextEpochFinalView    *uint64
+	curEpochFirstView       uint64
+	curEpochFinalView       uint64  // F[v] - the final view of the current epoch
+	curEpochTargetDuration  uint64  // desired total duration of current epoch in seconds
+	curEpochTargetEndTime   uint64  // T[v] - the target end time of the current epoch, represented as Unix Time [seconds]
+	nextEpochFinalView      *uint64 // the final view of the next epoch
+	nextEpochTargetDuration *uint64 // desired total duration of next epoch in seconds, or nil if epoch has not yet been set up
+	nextEpochTargetEndTime  *uint64 // the target end time of the next epoch, represented as Unix Time [seconds]
 }
 
 // targetViewTime returns τ[v], the ideal, steady-state view time for the current epoch.
 // For numerical stability, we avoid repetitive conversions between seconds and time.Duration.
 // Instead, internally within the controller, we work with float64 in units of seconds.
 func (epoch *epochInfo) targetViewTime() float64 {
-	return epochLength.Seconds() / float64(epoch.curEpochFinalView-epoch.curEpochFirstView+1)
-}
-
-// fractionComplete returns the percentage of views completed of the epoch for the given curView.
-// curView must be within the range [curEpochFirstView, curEpochFinalView]
-// Returns the completion percentage as a float between [0, 1]
-func (epoch *epochInfo) fractionComplete(curView uint64) float64 {
-	return float64(curView-epoch.curEpochFirstView) / float64(epoch.curEpochFinalView-epoch.curEpochFirstView)
+	return float64(epoch.curEpochTargetDuration) / float64(epoch.curEpochFinalView-epoch.curEpochFirstView+1)
 }
 
 // BlockTimeController dynamically adjusts the ProposalTiming of this node,
@@ -67,8 +63,8 @@ func (epoch *epochInfo) fractionComplete(curView uint64) float64 {
 // This low-level controller output `(B0, x0, d)` is wrapped into a `ProposalTiming`
 // interface, specifically `happyPathBlockTime` on the happy path. The purpose of the
 // `ProposalTiming` wrapper is to translate the raw controller output into a form
-// that is useful for the event handler. Edge cases, such as initialization or
-// EECC are implemented by other implementations of `ProposalTiming`.
+// that is useful for the EventHandler. Edge cases, such as initialization or
+// epoch fallback are implemented by other implementations of `ProposalTiming`.
 type BlockTimeController struct {
 	component.Component
 	protocol.Consumer // consumes protocol state events
@@ -79,7 +75,9 @@ type BlockTimeController struct {
 	log     zerolog.Logger
 	metrics module.CruiseCtlMetrics
 
-	epochInfo              // scheduled transition view for current/next epoch
+	epochInfo // scheduled transition view for current/next epoch
+	// Currently, the only possible state transition for `epochFallbackTriggered` is false → true.
+	// TODO for 'leaving Epoch Fallback via special service event' this might need to change.
 	epochFallbackTriggered bool
 
 	incorporatedBlocks chan TimedBlock   // OnBlockIncorporated events, we desire these blocks to be processed in a timely manner and therefore use a small channel capacity
@@ -128,7 +126,7 @@ func NewBlockTimeController(log zerolog.Logger, metrics module.CruiseCtlMetrics,
 		Build()
 
 	// initialize state
-	err = ctl.initEpochInfo(curView)
+	err = ctl.initEpochInfo()
 	if err != nil {
 		return nil, fmt.Errorf("could not initialize epoch info: %w", err)
 	}
@@ -146,7 +144,7 @@ func NewBlockTimeController(log zerolog.Logger, metrics module.CruiseCtlMetrics,
 
 // initEpochInfo initializes the epochInfo state upon component startup.
 // No errors are expected during normal operation.
-func (ctl *BlockTimeController) initEpochInfo(curView uint64) error {
+func (ctl *BlockTimeController) initEpochInfo() error {
 	finalSnapshot := ctl.state.Final()
 	curEpoch := finalSnapshot.Epochs().Current()
 
@@ -162,6 +160,18 @@ func (ctl *BlockTimeController) initEpochInfo(curView uint64) error {
 	}
 	ctl.curEpochFinalView = curEpochFinalView
 
+	curEpochTargetDuration, err := curEpoch.TargetDuration()
+	if err != nil {
+		return fmt.Errorf("could not initialize current epoch target duration: %w", err)
+	}
+	ctl.curEpochTargetDuration = curEpochTargetDuration
+
+	curEpochTargetEndTime, err := curEpoch.TargetEndTime()
+	if err != nil {
+		return fmt.Errorf("could not initialize current epoch target end time: %w", err)
+	}
+	ctl.curEpochTargetEndTime = curEpochTargetEndTime
+
 	phase, err := finalSnapshot.Phase()
 	if err != nil {
 		return fmt.Errorf("could not check snapshot phase: %w", err)
@@ -172,9 +182,19 @@ func (ctl *BlockTimeController) initEpochInfo(curView uint64) error {
 			return fmt.Errorf("could not initialize next epoch final view: %w", err)
 		}
 		ctl.epochInfo.nextEpochFinalView = &nextEpochFinalView
-	}
 
-	ctl.curEpochTargetEndTime = ctl.config.TargetTransition.inferTargetEndTime(time.Now().UTC(), ctl.epochInfo.fractionComplete(curView))
+		nextEpochTargetDuration, err := finalSnapshot.Epochs().Next().TargetDuration()
+		if err != nil {
+			return fmt.Errorf("could not initialize next epoch target duration: %w", err)
+		}
+		ctl.nextEpochTargetDuration = &nextEpochTargetDuration
+
+		nextEpochTargetEndTime, err := finalSnapshot.Epochs().Next().TargetEndTime()
+		if err != nil {
+			return fmt.Errorf("could not initialize next epoch target end time: %w", err)
+		}
+		ctl.nextEpochTargetEndTime = &nextEpochTargetEndTime
+	}
 
 	epochFallbackTriggered, err := ctl.state.Params().EpochFallbackTriggered()
 	if err != nil {
@@ -197,8 +217,7 @@ func (ctl *BlockTimeController) initProposalTiming(curView uint64) {
 	ctl.storeProposalTiming(newPublishImmediately(curView, time.Now().UTC()))
 }
 
-// storeProposalTiming stores the latest ProposalTiming
-// Concurrency safe.
+// storeProposalTiming stores the latest ProposalTiming. Concurrency safe.
 func (ctl *BlockTimeController) storeProposalTiming(proposalTiming ProposalTiming) {
 	ctl.latestProposalTiming.Store(&proposalTiming)
 }
@@ -242,7 +261,7 @@ func (ctl *BlockTimeController) processEventsWorkerLogic(ctx irrecoverable.Signa
 		case <-ctl.epochFallbacks:
 			err := ctl.processEpochFallbackTriggered()
 			if err != nil {
-				ctl.log.Err(err).Msgf("fatal error processing epoch EECC event")
+				ctl.log.Err(err).Msgf("fatal error processing epoch fallback event")
 				ctx.Throw(err)
 			}
 		default:
@@ -270,7 +289,7 @@ func (ctl *BlockTimeController) processEventsWorkerLogic(ctx irrecoverable.Signa
 		case <-ctl.epochFallbacks:
 			err := ctl.processEpochFallbackTriggered()
 			if err != nil {
-				ctl.log.Err(err).Msgf("fatal error processing epoch EECC event")
+				ctl.log.Err(err).Msgf("fatal error processing epoch fallback event")
 				ctx.Throw(err)
 				return
 			}
@@ -321,6 +340,12 @@ func (ctl *BlockTimeController) checkForEpochTransition(tb TimedBlock) error {
 	if ctl.nextEpochFinalView == nil { // final view of epoch we are entering should be known
 		return fmt.Errorf("cannot transition without nextEpochFinalView set")
 	}
+	if ctl.nextEpochTargetEndTime == nil {
+		return fmt.Errorf("cannot transition without nextEpochTargetEndTime set")
+	}
+	if ctl.nextEpochTargetDuration == nil {
+		return fmt.Errorf("cannot transition without nextEpochTargetDuration set")
+	}
 	if view > *ctl.nextEpochFinalView { // the block's view should be within the upcoming epoch
 		return fmt.Errorf("sanity check failed: curView %d is beyond both current epoch (final view %d) and next epoch (final view %d)",
 			view, ctl.curEpochFinalView, *ctl.nextEpochFinalView)
@@ -328,8 +353,11 @@ func (ctl *BlockTimeController) checkForEpochTransition(tb TimedBlock) error {
 
 	ctl.curEpochFirstView = ctl.curEpochFinalView + 1
 	ctl.curEpochFinalView = *ctl.nextEpochFinalView
+	ctl.curEpochTargetDuration = *ctl.nextEpochTargetDuration
+	ctl.curEpochTargetEndTime = *ctl.nextEpochTargetEndTime
 	ctl.nextEpochFinalView = nil
-	ctl.curEpochTargetEndTime = ctl.config.TargetTransition.inferTargetEndTime(tb.Block.Timestamp, ctl.epochInfo.fractionComplete(view))
+	ctl.nextEpochTargetDuration = nil
+	ctl.nextEpochTargetEndTime = nil
 	return nil
 }
 
@@ -362,9 +390,9 @@ func (ctl *BlockTimeController) measureViewDuration(tb TimedBlock) error {
 	// In accordance with this convention, observing the proposal for the last view of an epoch, marks the start of the last view.
 	// By observing the proposal, nodes enter the last view, verify the block, vote for it, the primary aggregates the votes,
 	// constructs the child (for first view of new epoch). The last view of the epoch ends, when the child proposal is published.
-	tau := ctl.targetViewTime()                                // τ - idealized target view time in units of seconds
-	viewDurationsRemaining := ctl.curEpochFinalView + 1 - view // k[v] - views remaining in current epoch
-	durationRemaining := ctl.curEpochTargetEndTime.Sub(tb.TimeObserved)
+	tau := ctl.targetViewTime()                                                    // τ: idealized target view time in units of seconds
+	viewDurationsRemaining := ctl.curEpochFinalView + 1 - view                     // k[v]: views remaining in current epoch
+	durationRemaining := unix2time(ctl.curEpochTargetEndTime).Sub(tb.TimeObserved) // Γ[v] = T[v] - t[v], with t[v] ≡ tb.TimeObserved the time when observing the block that triggered the view change
 
 	// Compute instantaneous error term: e[v] = k[v]·τ - T[v] i.e. the projected difference from target switchover
 	// and update PID controller's error terms. All UNITS in SECOND.
@@ -377,7 +405,7 @@ func (ctl *BlockTimeController) measureViewDuration(tb TimedBlock) error {
 	u := propErr*ctl.config.KP + itgErr*ctl.config.KI + drivErr*ctl.config.KD
 
 	// compute the controller output for this observation
-	unconstrainedBlockTime := time.Duration((tau - u) * float64(time.Second)) // desired time between parent and child block, in units of seconds
+	unconstrainedBlockTime := sec2dur(tau - u) // desired time between parent and child block, in units of seconds
 	proposalTiming := newHappyPathBlockTime(tb, unconstrainedBlockTime, ctl.config.TimingConfig)
 	constrainedBlockTime := proposalTiming.ConstrainedBlockTime()
 
@@ -390,13 +418,13 @@ func (ctl *BlockTimeController) measureViewDuration(tb TimedBlock) error {
 		Float64("proportional_err", propErr).
 		Float64("integral_err", itgErr).
 		Float64("derivative_err", drivErr).
-		Dur("controller_output", time.Duration(u*float64(time.Second))).
+		Dur("controller_output", sec2dur(u)).
 		Dur("unconstrained_block_time", unconstrainedBlockTime).
 		Dur("constrained_block_time", constrainedBlockTime).
 		Msg("measured error upon view change")
 
 	ctl.metrics.PIDError(propErr, itgErr, drivErr)
-	ctl.metrics.ControllerOutput(time.Duration(u * float64(time.Second)))
+	ctl.metrics.ControllerOutput(sec2dur(u))
 	ctl.metrics.TargetProposalDuration(proposalTiming.ConstrainedBlockTime())
 
 	ctl.storeProposalTiming(proposalTiming)
@@ -416,9 +444,20 @@ func (ctl *BlockTimeController) processEpochSetupPhaseStarted(snapshot protocol.
 	nextEpoch := snapshot.Epochs().Next()
 	finalView, err := nextEpoch.FinalView()
 	if err != nil {
-		return fmt.Errorf("could not get next epochInfo final view: %w", err)
+		return fmt.Errorf("could not get next epoch final view: %w", err)
+	}
+	targetDuration, err := nextEpoch.TargetDuration()
+	if err != nil {
+		return fmt.Errorf("could not get next epoch target duration: %w", err)
+	}
+	targetEndTime, err := nextEpoch.TargetEndTime()
+	if err != nil {
+		return fmt.Errorf("could not get next epoch target end time: %w", err)
 	}
+
 	ctl.epochInfo.nextEpochFinalView = &finalView
+	ctl.epochInfo.nextEpochTargetDuration = &targetDuration
+	ctl.epochInfo.nextEpochTargetEndTime = &targetEndTime
 	return nil
 }
 
@@ -460,3 +499,19 @@ func (ctl *BlockTimeController) EpochSetupPhaseStarted(_ uint64, first *flow.Hea
 func (ctl *BlockTimeController) EpochEmergencyFallbackTriggered() {
 	ctl.epochFallbacks <- struct{}{}
 }
+
+// time2unix converts a time.Time to UNIX time represented as a uint64.
+// Returned timestamp is precise to within one second of input.
+func time2unix(t time.Time) uint64 {
+	return uint64(t.Unix())
+}
+
+// unix2time converts a UNIX timestamp represented as a uint64 to a time.Time.
+func unix2time(unix uint64) time.Time {
+	return time.Unix(int64(unix), 0)
+}
+
+// sec2dur converts a floating-point number of seconds to a time.Duration.
+func sec2dur(sec float64) time.Duration {
+	return time.Duration(int64(sec * float64(time.Second)))
+}
diff --git a/consensus/hotstuff/cruisectl/block_time_controller_test.go b/consensus/hotstuff/cruisectl/block_time_controller_test.go
index d6cc074ab6b..d369370f7be 100644
--- a/consensus/hotstuff/cruisectl/block_time_controller_test.go
+++ b/consensus/hotstuff/cruisectl/block_time_controller_test.go
@@ -29,6 +29,8 @@ type BlockTimeControllerSuite struct {
 	epochCounter           uint64
 	curEpochFirstView      uint64
 	curEpochFinalView      uint64
+	curEpochTargetDuration uint64
+	curEpochTargetEndTime  uint64
 	epochFallbackTriggered bool
 
 	metrics  mockmodule.CruiseCtlMetrics
@@ -48,6 +50,11 @@ func TestBlockTimeController(t *testing.T) {
 	suite.Run(t, new(BlockTimeControllerSuite))
 }
 
+// EpochDurationSeconds returns the number of seconds in the epoch (1hr).
+func (bs *BlockTimeControllerSuite) EpochDurationSeconds() uint64 {
+	return 60 * 60
+}
+
 // SetupTest initializes mocks and default values.
 func (bs *BlockTimeControllerSuite) SetupTest() {
 	bs.config = DefaultConfig()
@@ -55,7 +62,9 @@ func (bs *BlockTimeControllerSuite) SetupTest() {
 	bs.initialView = 0
 	bs.epochCounter = uint64(0)
 	bs.curEpochFirstView = uint64(0)
-	bs.curEpochFinalView = uint64(604_800) // 1 view/sec
+	bs.curEpochFinalView = bs.EpochDurationSeconds() // 1 view/sec for 1hr epoch
+	bs.curEpochTargetDuration = bs.EpochDurationSeconds()
+	bs.curEpochTargetEndTime = uint64(time.Now().Unix()) + bs.EpochDurationSeconds()
 	bs.epochFallbackTriggered = false
 	setupMocks(bs)
 }
@@ -86,6 +95,8 @@ func setupMocks(bs *BlockTimeControllerSuite) {
 	bs.curEpoch.On("Counter").Return(bs.epochCounter, nil)
 	bs.curEpoch.On("FirstView").Return(bs.curEpochFirstView, nil)
 	bs.curEpoch.On("FinalView").Return(bs.curEpochFinalView, nil)
+	bs.curEpoch.On("TargetDuration").Return(bs.curEpochTargetDuration, nil)
+	bs.curEpoch.On("TargetEndTime").Return(bs.curEpochTargetEndTime, nil)
 	bs.epochs.Add(&bs.curEpoch)
 
 	bs.ctx, bs.cancel = irrecoverable.NewMockSignalerContextWithCancel(bs.T(), context.Background())
@@ -126,10 +137,10 @@ func (bs *BlockTimeControllerSuite) AssertCorrectInitialization() {
 
 	// should initialize epoch info
 	epoch := bs.ctl.epochInfo
-	expectedEndTime := bs.config.TargetTransition.inferTargetEndTime(time.Now(), epoch.fractionComplete(bs.initialView))
 	assert.Equal(bs.T(), bs.curEpochFirstView, epoch.curEpochFirstView)
 	assert.Equal(bs.T(), bs.curEpochFinalView, epoch.curEpochFinalView)
-	assert.Equal(bs.T(), expectedEndTime, epoch.curEpochTargetEndTime)
+	assert.Equal(bs.T(), bs.curEpochTargetDuration, epoch.curEpochTargetDuration)
+	assert.Equal(bs.T(), bs.curEpochTargetEndTime, epoch.curEpochTargetEndTime)
 
 	// if next epoch is set up, final view should be set
 	if phase := bs.epochs.Phase(); phase > flow.EpochPhaseStaking {
@@ -196,7 +207,9 @@ func (bs *BlockTimeControllerSuite) TestInit_EpochStakingPhase() {
 func (bs *BlockTimeControllerSuite) TestInit_EpochSetupPhase() {
 	nextEpoch := mockprotocol.NewEpoch(bs.T())
 	nextEpoch.On("Counter").Return(bs.epochCounter+1, nil)
-	nextEpoch.On("FinalView").Return(bs.curEpochFinalView+100_000, nil)
+	nextEpoch.On("FinalView").Return(bs.curEpochFinalView*2, nil)
+	nextEpoch.On("TargetDuration").Return(bs.EpochDurationSeconds(), nil)
+	nextEpoch.On("TargetEndTime").Return(bs.curEpochTargetEndTime+bs.EpochDurationSeconds(), nil)
 	bs.epochs.Add(nextEpoch)
 
 	bs.CreateAndStartController()
@@ -365,7 +378,9 @@ func (bs *BlockTimeControllerSuite) TestOnBlockIncorporated_EpochTransition_Disa
 func (bs *BlockTimeControllerSuite) testOnBlockIncorporated_EpochTransition() {
 	nextEpoch := mockprotocol.NewEpoch(bs.T())
 	nextEpoch.On("Counter").Return(bs.epochCounter+1, nil)
-	nextEpoch.On("FinalView").Return(bs.curEpochFinalView+100_000, nil)
+	nextEpoch.On("FinalView").Return(bs.curEpochFinalView*2, nil)
+	nextEpoch.On("TargetDuration").Return(bs.EpochDurationSeconds(), nil) // 1s/view
+	nextEpoch.On("TargetEndTime").Return(bs.curEpochTargetEndTime+bs.EpochDurationSeconds(), nil)
 	bs.epochs.Add(nextEpoch)
 	bs.CreateAndStartController()
 	defer bs.StopController()
@@ -381,7 +396,8 @@ func (bs *BlockTimeControllerSuite) testOnBlockIncorporated_EpochTransition() {
 	bs.SanityCheckSubsequentMeasurements(initialControllerState, nextControllerState, false)
 	// epoch boundaries should be updated
 	assert.Equal(bs.T(), bs.curEpochFinalView+1, bs.ctl.epochInfo.curEpochFirstView)
-	assert.Equal(bs.T(), bs.ctl.epochInfo.curEpochFinalView, bs.curEpochFinalView+100_000)
+	assert.Equal(bs.T(), bs.ctl.epochInfo.curEpochFinalView, bs.curEpochFinalView*2)
+	assert.Equal(bs.T(), bs.ctl.epochInfo.curEpochTargetEndTime, bs.curEpochTargetEndTime+bs.EpochDurationSeconds())
 	assert.Nil(bs.T(), bs.ctl.nextEpochFinalView)
 }
 
@@ -389,7 +405,9 @@ func (bs *BlockTimeControllerSuite) testOnBlockIncorporated_EpochTransition() {
 func (bs *BlockTimeControllerSuite) TestOnEpochSetupPhaseStarted() {
 	nextEpoch := mockprotocol.NewEpoch(bs.T())
 	nextEpoch.On("Counter").Return(bs.epochCounter+1, nil)
-	nextEpoch.On("FinalView").Return(bs.curEpochFinalView+100_000, nil)
+	nextEpoch.On("FinalView").Return(bs.curEpochFinalView*2, nil)
+	nextEpoch.On("TargetDuration").Return(bs.EpochDurationSeconds(), nil)
+	nextEpoch.On("TargetEndTime").Return(bs.curEpochTargetEndTime+bs.EpochDurationSeconds(), nil)
 	bs.epochs.Add(nextEpoch)
 	bs.CreateAndStartController()
 	defer bs.StopController()
@@ -400,13 +418,15 @@ func (bs *BlockTimeControllerSuite) TestOnEpochSetupPhaseStarted() {
 		return bs.ctl.nextEpochFinalView != nil
 	}, time.Second, time.Millisecond)
 
-	assert.Equal(bs.T(), bs.curEpochFinalView+100_000, *bs.ctl.nextEpochFinalView)
+	assert.Equal(bs.T(), bs.curEpochFinalView*2, *bs.ctl.nextEpochFinalView)
+	assert.Equal(bs.T(), bs.curEpochTargetEndTime+bs.EpochDurationSeconds(), *bs.ctl.nextEpochTargetEndTime)
 
 	// duplicate events should be no-ops
 	for i := 0; i <= cap(bs.ctl.epochSetups); i++ {
 		bs.ctl.EpochSetupPhaseStarted(bs.epochCounter, header)
 	}
-	assert.Equal(bs.T(), bs.curEpochFinalView+100_000, *bs.ctl.nextEpochFinalView)
+	assert.Equal(bs.T(), bs.curEpochFinalView*2, *bs.ctl.nextEpochFinalView)
+	assert.Equal(bs.T(), bs.curEpochTargetEndTime+bs.EpochDurationSeconds(), *bs.ctl.nextEpochTargetEndTime)
 }
 
 // TestProposalDelay_AfterTargetTransitionTime tests the behaviour of the controller
@@ -418,10 +438,10 @@ func (bs *BlockTimeControllerSuite) TestProposalDelay_AfterTargetTransitionTime(
 	bs.CreateAndStartController()
 	defer bs.StopController()
 
-	lastProposalDelay := time.Hour // start with large dummy value
+	lastProposalDelay := float64(bs.EpochDurationSeconds()) // start with large dummy value
 	for view := bs.initialView + 1; view < bs.ctl.curEpochFinalView; view++ {
 		// we have passed the target end time of the epoch
-		receivedParentBlockAt := bs.ctl.curEpochTargetEndTime.Add(time.Duration(view) * time.Second)
+		receivedParentBlockAt := unix2time(bs.ctl.curEpochTargetEndTime + view)
 		timedBlock := makeTimedBlock(view, unittest.IdentifierFixture(), receivedParentBlockAt)
 		err := bs.ctl.measureViewDuration(timedBlock)
 		require.NoError(bs.T(), err)
@@ -430,8 +450,8 @@ func (bs *BlockTimeControllerSuite) TestProposalDelay_AfterTargetTransitionTime(
 		pubTime := bs.ctl.GetProposalTiming().TargetPublicationTime(view+1, time.Now().UTC(), timedBlock.Block.BlockID) // simulate building a child of `timedBlock`
 		delay := pubTime.Sub(receivedParentBlockAt)
 
-		assert.LessOrEqual(bs.T(), delay, lastProposalDelay)
-		lastProposalDelay = delay
+		assert.LessOrEqual(bs.T(), delay.Seconds(), lastProposalDelay)
+		lastProposalDelay = delay.Seconds()
 
 		// transition views until the end of the epoch, or for 100 views
 		if view-bs.initialView >= 100 {
@@ -450,14 +470,14 @@ func (bs *BlockTimeControllerSuite) TestProposalDelay_BehindSchedule() {
 	bs.CreateAndStartController()
 	defer bs.StopController()
 
-	lastProposalDelay := time.Hour // start with large dummy value
-	idealEnteredViewTime := bs.ctl.curEpochTargetEndTime.Add(-epochLength / 2)
+	lastProposalDelay := float64(bs.EpochDurationSeconds()) // start with large dummy value
+	idealEnteredViewTime := unix2time(bs.ctl.curEpochTargetEndTime - (bs.EpochDurationSeconds() / 2))
 
 	// 1s behind of schedule
 	receivedParentBlockAt := idealEnteredViewTime.Add(time.Second)
 	for view := bs.initialView + 1; view < bs.ctl.curEpochFinalView; view++ {
 		// hold the instantaneous error constant for each view
-		receivedParentBlockAt = receivedParentBlockAt.Add(seconds2Duration(bs.ctl.targetViewTime()))
+		receivedParentBlockAt = receivedParentBlockAt.Add(sec2dur(bs.ctl.targetViewTime()))
 		timedBlock := makeTimedBlock(view, unittest.IdentifierFixture(), receivedParentBlockAt)
 		err := bs.ctl.measureViewDuration(timedBlock)
 		require.NoError(bs.T(), err)
@@ -466,8 +486,8 @@ func (bs *BlockTimeControllerSuite) TestProposalDelay_BehindSchedule() {
 		pubTime := bs.ctl.GetProposalTiming().TargetPublicationTime(view+1, time.Now().UTC(), timedBlock.Block.BlockID) // simulate building a child of `timedBlock`
 		delay := pubTime.Sub(receivedParentBlockAt)
 		// expecting decreasing GetProposalTiming
-		assert.LessOrEqual(bs.T(), delay, lastProposalDelay)
-		lastProposalDelay = delay
+		assert.LessOrEqual(bs.T(), delay.Seconds(), lastProposalDelay, "got non-decreasing delay on view %d (initial view: %d)", view, bs.initialView)
+		lastProposalDelay = delay.Seconds()
 
 		// transition views until the end of the epoch, or for 100 views
 		if view-bs.initialView >= 100 {
@@ -487,19 +507,19 @@ func (bs *BlockTimeControllerSuite) TestProposalDelay_AheadOfSchedule() {
 	defer bs.StopController()
 
 	lastProposalDelay := time.Duration(0) // start with large dummy value
-	idealEnteredViewTime := bs.ctl.curEpochTargetEndTime.Add(-epochLength / 2)
+	idealEnteredViewTime := bs.ctl.curEpochTargetEndTime - (bs.EpochDurationSeconds() / 2)
 	// 1s ahead of schedule
-	receivedParentBlockAt := idealEnteredViewTime.Add(-time.Second)
+	receivedParentBlockAt := idealEnteredViewTime - 1
 	for view := bs.initialView + 1; view < bs.ctl.curEpochFinalView; view++ {
 		// hold the instantaneous error constant for each view
-		receivedParentBlockAt = receivedParentBlockAt.Add(seconds2Duration(bs.ctl.targetViewTime()))
-		timedBlock := makeTimedBlock(view, unittest.IdentifierFixture(), receivedParentBlockAt)
+		receivedParentBlockAt = receivedParentBlockAt + uint64(bs.ctl.targetViewTime())
+		timedBlock := makeTimedBlock(view, unittest.IdentifierFixture(), unix2time(receivedParentBlockAt))
 		err := bs.ctl.measureViewDuration(timedBlock)
 		require.NoError(bs.T(), err)
 
 		// compute proposal delay:
 		pubTime := bs.ctl.GetProposalTiming().TargetPublicationTime(view+1, time.Now().UTC(), timedBlock.Block.BlockID) // simulate building a child of `timedBlock`
-		delay := pubTime.Sub(receivedParentBlockAt)
+		delay := pubTime.Sub(unix2time(receivedParentBlockAt))
 
 		// expecting increasing GetProposalTiming
 		assert.GreaterOrEqual(bs.T(), delay, lastProposalDelay)
@@ -543,7 +563,7 @@ func (bs *BlockTimeControllerSuite) TestMetrics() {
 		assert.Greater(bs.T(), output, time.Duration(0))
 	}).Once()
 
-	timedBlock := makeTimedBlock(view, unittest.IdentifierFixture(), enteredViewAt)
+	timedBlock := makeTimedBlock(view, unittest.IdentifierFixture(), unix2time(enteredViewAt))
 	err := bs.ctl.measureViewDuration(timedBlock)
 	require.NoError(bs.T(), err)
 }
@@ -556,16 +576,18 @@ func (bs *BlockTimeControllerSuite) TestMetrics() {
 func (bs *BlockTimeControllerSuite) Test_vs_PythonSimulation() {
 	// PART 1: setup system to mirror python simulation
 	// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+	refT := time.Now().UTC()
+	refT = time.Date(refT.Year(), refT.Month(), refT.Day(), refT.Hour(), refT.Minute(), 0, 0, time.UTC) // truncate to past minute
+
 	totalEpochViews := 483000
 	bs.initialView = 0
 	bs.curEpochFirstView, bs.curEpochFinalView = uint64(0), uint64(totalEpochViews-1) // views [0, .., totalEpochViews-1]
+	bs.curEpochTargetDuration = 7 * 24 * 60 * 60                                      // 1 week in seconds
+	bs.curEpochTargetEndTime = time2unix(refT) + bs.curEpochTargetDuration            // now + 1 week
 	bs.epochFallbackTriggered = false
 
-	refT := time.Now().UTC()
-	refT = time.Date(refT.Year(), refT.Month(), refT.Day(), refT.Hour(), refT.Minute(), 0, 0, time.UTC) // truncate to past minute
 	bs.config = &Config{
 		TimingConfig: TimingConfig{
-			TargetTransition:      EpochTransitionTime{day: refT.Weekday(), hour: uint8(refT.Hour()), minute: uint8(refT.Minute())},
 			FallbackProposalDelay: atomic.NewDuration(500 * time.Millisecond), // irrelevant for this test, as controller should never enter fallback mode
 			MinViewDuration:       atomic.NewDuration(470 * time.Millisecond),
 			MaxViewDuration:       atomic.NewDuration(2010 * time.Millisecond),
@@ -617,7 +639,7 @@ func (bs *BlockTimeControllerSuite) Test_vs_PythonSimulation() {
 	// PART 3: run controller and ensure output matches pre-generated controller response from python ref implementation
 	// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 	// sanity checks:
-	require.Equal(bs.T(), 604800.0, bs.ctl.curEpochTargetEndTime.UTC().Sub(refT).Seconds(), "Epoch should end 1 week from now, i.e. 604800s")
+	require.Equal(bs.T(), uint64(604800), bs.ctl.curEpochTargetEndTime-time2unix(refT), "Epoch should end 1 week from now, i.e. 604800s")
 	require.InEpsilon(bs.T(), ref.targetViewTime, bs.ctl.targetViewTime(), 1e-15) // ideal view time
 	require.Equal(bs.T(), len(ref.observedMinViewTimes), len(ref.realWorldViewDuration))
 
@@ -639,9 +661,10 @@ func (bs *BlockTimeControllerSuite) Test_vs_PythonSimulation() {
 		tpt := proposalTiming.TargetPublicationTime(uint64(v+1), time.Now(), observedBlock.Block.BlockID) // value for `timeViewEntered` should be irrelevant here
 
 		controllerTargetedViewDuration := tpt.Sub(observedBlock.TimeObserved).Seconds()
+		bs.T().Logf("%d: ctl=%f\tref=%f\tdiff=%f", v, controllerTargetedViewDuration, ref.controllerTargetedViewDuration[v], controllerTargetedViewDuration-ref.controllerTargetedViewDuration[v])
 		require.InEpsilon(bs.T(), ref.controllerTargetedViewDuration[v], controllerTargetedViewDuration, 1e-5, "implementations deviate for view %d", v) // ideal view time
 
-		observationTime = observationTime.Add(time.Duration(int64(ref.realWorldViewDuration[v] * float64(time.Second))))
+		observationTime = observationTime.Add(sec2dur(ref.realWorldViewDuration[v]))
 	}
 
 }
@@ -670,7 +693,3 @@ func captureControllerStateDigest(ctl *BlockTimeController) *controllerStateDige
 		latestProposalTiming: ctl.GetProposalTiming(),
 	}
 }
-
-func seconds2Duration(durationinDeconds float64) time.Duration {
-	return time.Duration(int64(durationinDeconds * float64(time.Second)))
-}
diff --git a/consensus/hotstuff/cruisectl/config.go b/consensus/hotstuff/cruisectl/config.go
index 48a6f2b1139..2bc6adc0b9f 100644
--- a/consensus/hotstuff/cruisectl/config.go
+++ b/consensus/hotstuff/cruisectl/config.go
@@ -10,11 +10,10 @@ import (
 func DefaultConfig() *Config {
 	return &Config{
 		TimingConfig{
-			TargetTransition:      DefaultEpochTransitionTime(),
 			FallbackProposalDelay: atomic.NewDuration(250 * time.Millisecond),
 			MinViewDuration:       atomic.NewDuration(600 * time.Millisecond),
 			MaxViewDuration:       atomic.NewDuration(1600 * time.Millisecond),
-			Enabled:               atomic.NewBool(false),
+			Enabled:               atomic.NewBool(true),
 		},
 		ControllerParams{
 			N_ewma: 5,
@@ -34,9 +33,6 @@ type Config struct {
 
 // TimingConfig specifies the BlockTimeController's limits of authority.
 type TimingConfig struct {
-	// TargetTransition defines the target time to transition epochs each week.
-	TargetTransition EpochTransitionTime
-
 	// FallbackProposalDelay is the minimal block construction delay. When used, it behaves like the
 	// old command line flag `block-rate-delay`. Specifically, the primary measures the duration from
 	// starting to construct its proposal to the proposal being ready to be published. If this
@@ -94,33 +90,46 @@ func (c *ControllerParams) beta() float64 {
 	return 1.0 / float64(c.N_itg)
 }
 
-func (ctl *TimingConfig) GetFallbackProposalDuration() time.Duration {
+// GetFallbackProposalDuration returns the proposal duration used when Cruise Control is not active.
+func (ctl TimingConfig) GetFallbackProposalDuration() time.Duration {
 	return ctl.FallbackProposalDelay.Load()
 }
-func (ctl *TimingConfig) GetMaxViewDuration() time.Duration {
+
+// GetMaxViewDuration returns the max view duration returned by the controller.
+func (ctl TimingConfig) GetMaxViewDuration() time.Duration {
 	return ctl.MaxViewDuration.Load()
 }
-func (ctl *TimingConfig) GetMinViewDuration() time.Duration {
+
+// GetMinViewDuration returns the min view duration returned by the controller.
+func (ctl TimingConfig) GetMinViewDuration() time.Duration {
 	return ctl.MinViewDuration.Load()
 }
-func (ctl *TimingConfig) GetEnabled() bool {
+
+// GetEnabled returns whether the controller is enabled.
+func (ctl TimingConfig) GetEnabled() bool {
 	return ctl.Enabled.Load()
 }
 
-func (ctl *TimingConfig) SetFallbackProposalDuration(dur time.Duration) error {
+// SetFallbackProposalDuration sets the proposal duration used when Cruise Control is not active.
+func (ctl TimingConfig) SetFallbackProposalDuration(dur time.Duration) error {
 	ctl.FallbackProposalDelay.Store(dur)
 	return nil
 }
-func (ctl *TimingConfig) SetMaxViewDuration(dur time.Duration) error {
+
+// SetMaxViewDuration sets the max view duration returned by the controller.
+func (ctl TimingConfig) SetMaxViewDuration(dur time.Duration) error {
 	ctl.MaxViewDuration.Store(dur)
 	return nil
 }
-func (ctl *TimingConfig) SetMinViewDuration(dur time.Duration) error {
+
+// SetMinViewDuration sets the min view duration returned by the controller.
+func (ctl TimingConfig) SetMinViewDuration(dur time.Duration) error {
 	ctl.MinViewDuration.Store(dur)
 	return nil
-
 }
-func (ctl *TimingConfig) SetEnabled(enabled bool) error {
+
+// SetEnabled sets whether the controller is enabled.
+func (ctl TimingConfig) SetEnabled(enabled bool) error {
 	ctl.Enabled.Store(enabled)
 	return nil
 }
diff --git a/consensus/hotstuff/cruisectl/proposal_timing.go b/consensus/hotstuff/cruisectl/proposal_timing.go
index acfa4deed28..0b033619595 100644
--- a/consensus/hotstuff/cruisectl/proposal_timing.go
+++ b/consensus/hotstuff/cruisectl/proposal_timing.go
@@ -108,7 +108,7 @@ func (pt *happyPathBlockTime) TargetPublicationTime(proposalView uint64, timeVie
 	return pt.TimeObserved.Add(pt.ConstrainedBlockTime()) // happy path
 }
 
-/* *************************************** fallbackTiming for EECC *************************************** */
+/* *************************************** fallbackTiming for EFM *************************************** */
 
 // fallbackTiming implements ProposalTiming, for the basic fallback:
 // function `TargetPublicationTime(..)` always returns `timeViewEntered + defaultProposalDuration`
diff --git a/consensus/hotstuff/cruisectl/transition_time.go b/consensus/hotstuff/cruisectl/transition_time.go
deleted file mode 100644
index 52bfad3486b..00000000000
--- a/consensus/hotstuff/cruisectl/transition_time.go
+++ /dev/null
@@ -1,172 +0,0 @@
-package cruisectl
-
-import (
-	"fmt"
-	"strings"
-	"time"
-)
-
-// weekdays is a lookup from canonical weekday strings to the time package constant.
-var weekdays = map[string]time.Weekday{
-	strings.ToLower(time.Sunday.String()):    time.Sunday,
-	strings.ToLower(time.Monday.String()):    time.Monday,
-	strings.ToLower(time.Tuesday.String()):   time.Tuesday,
-	strings.ToLower(time.Wednesday.String()): time.Wednesday,
-	strings.ToLower(time.Thursday.String()):  time.Thursday,
-	strings.ToLower(time.Friday.String()):    time.Friday,
-	strings.ToLower(time.Saturday.String()):  time.Saturday,
-}
-
-// epochLength is the length of an epoch (7 days, or 1 week).
-const epochLength = time.Hour * 24 * 7
-
-var transitionFmt = "%s@%02d:%02d" // example: wednesday@08:00
-
-// EpochTransitionTime represents the target epoch transition time.
-// Epochs last one week, so the transition is defined in terms of a day-of-week and time-of-day.
-// The target time is always in UTC to avoid confusion resulting from different
-// representations of the same transition time and around daylight savings time.
-type EpochTransitionTime struct {
-	day    time.Weekday // day of every week to target epoch transition
-	hour   uint8        // hour of the day to target epoch transition
-	minute uint8        // minute of the hour to target epoch transition
-}
-
-// DefaultEpochTransitionTime is the default epoch transition target.
-// The target switchover is Wednesday 12:00 PDT, which is 19:00 UTC.
-// The string representation is `wednesday@19:00`.
-func DefaultEpochTransitionTime() EpochTransitionTime {
-	return EpochTransitionTime{
-		day:    time.Wednesday,
-		hour:   19,
-		minute: 0,
-	}
-}
-
-// String returns the canonical string representation of the transition time.
-// This is the format expected as user input, when this value is configured manually.
-// See ParseSwitchover for details of the format.
-func (tt *EpochTransitionTime) String() string {
-	return fmt.Sprintf(transitionFmt, strings.ToLower(tt.day.String()), tt.hour, tt.minute)
-}
-
-// newInvalidTransitionStrError returns an informational error about an invalid transition string.
-func newInvalidTransitionStrError(s string, msg string, args ...any) error {
-	args = append([]any{s}, args...)
-	return fmt.Errorf("invalid transition string (%s): "+msg, args...)
-}
-
-// ParseTransition parses a transition time string.
-// A transition string must be specified according to the format:
-//
-//	WD@HH:MM
-//
-// WD is the weekday string as defined by `strings.ToLower(time.Weekday.String)`
-// HH is the 2-character hour of day, in the range [00-23]
-// MM is the 2-character minute of hour, in the range [00-59]
-// All times are in UTC.
-//
-// A generic error is returned if the input is an invalid transition string.
-func ParseTransition(s string) (*EpochTransitionTime, error) {
-	strs := strings.Split(s, "@")
-	if len(strs) != 2 {
-		return nil, newInvalidTransitionStrError(s, "split on @ yielded %d substrings - expected %d", len(strs), 2)
-	}
-	dayStr := strs[0]
-	timeStr := strs[1]
-	if len(timeStr) != 5 || timeStr[2] != ':' {
-		return nil, newInvalidTransitionStrError(s, "time part must have form HH:MM")
-	}
-
-	var hour uint8
-	_, err := fmt.Sscanf(timeStr[0:2], "%02d", &hour)
-	if err != nil {
-		return nil, newInvalidTransitionStrError(s, "error scanning hour part: %w", err)
-	}
-	var minute uint8
-	_, err = fmt.Sscanf(timeStr[3:5], "%02d", &minute)
-	if err != nil {
-		return nil, newInvalidTransitionStrError(s, "error scanning minute part: %w", err)
-	}
-
-	day, ok := weekdays[strings.ToLower(dayStr)]
-	if !ok {
-		return nil, newInvalidTransitionStrError(s, "invalid weekday part %s", dayStr)
-	}
-	if hour > 23 {
-		return nil, newInvalidTransitionStrError(s, "invalid hour part: %d>23", hour)
-	}
-	if minute > 59 {
-		return nil, newInvalidTransitionStrError(s, "invalid minute part: %d>59", hour)
-	}
-
-	return &EpochTransitionTime{
-		day:    day,
-		hour:   hour,
-		minute: minute,
-	}, nil
-}
-
-// inferTargetEndTime infers the target end time for the current epoch, based on
-// the current progress through the epoch and the current time.
-// We do this in 3 steps:
-//  1. find the 3 candidate target end times nearest to the current time.
-//  2. compute the estimated end time for the current epoch.
-//  3. select the candidate target end time which is nearest to the estimated end time.
-//
-// NOTE 1: This method is effective only if the node's local notion of current view and
-// time are accurate. If a node is, for example, catching up from a very old state, it
-// will infer incorrect target end times. Since catching-up nodes don't produce usable
-// proposals, this is OK.
-// NOTE 2: In the long run, the target end time should be specified by the smart contract
-// and stored along with the other protocol.Epoch information. This would remove the
-// need for this imperfect inference logic.
-func (tt *EpochTransitionTime) inferTargetEndTime(curTime time.Time, epochFractionComplete float64) time.Time {
-	now := curTime.UTC()
-	// find the nearest target end time, plus the targets one week before and after
-	nearestTargetDate := tt.findNearestTargetTime(now)
-	earlierTargetDate := nearestTargetDate.AddDate(0, 0, -7)
-	laterTargetDate := nearestTargetDate.AddDate(0, 0, 7)
-
-	estimatedTimeRemainingInEpoch := time.Duration((1.0 - epochFractionComplete) * float64(epochLength))
-	estimatedEpochEndTime := now.Add(estimatedTimeRemainingInEpoch)
-
-	minDiff := estimatedEpochEndTime.Sub(nearestTargetDate).Abs()
-	inferredTargetEndTime := nearestTargetDate
-	for _, date := range []time.Time{earlierTargetDate, laterTargetDate} {
-		// compare estimate to actual based on the target
-		diff := estimatedEpochEndTime.Sub(date).Abs()
-		if diff < minDiff {
-			minDiff = diff
-			inferredTargetEndTime = date
-		}
-	}
-
-	return inferredTargetEndTime
-}
-
-// findNearestTargetTime interprets ref as a date (ignores time-of-day portion)
-// and finds the nearest date, either before or after ref, which has the given weekday.
-// We then return a time.Time with this date and the hour/minute specified by the EpochTransitionTime.
-func (tt *EpochTransitionTime) findNearestTargetTime(ref time.Time) time.Time {
-	ref = ref.UTC()
-	hour := int(tt.hour)
-	minute := int(tt.minute)
-	date := time.Date(ref.Year(), ref.Month(), ref.Day(), hour, minute, 0, 0, time.UTC)
-
-	// walk back and forth by date around the reference until we find the closest matching weekday
-	walk := 0
-	for date.Weekday() != tt.day || date.Sub(ref).Abs().Hours() > float64(24*7/2) {
-		walk++
-		if walk%2 == 0 {
-			date = date.AddDate(0, 0, walk)
-		} else {
-			date = date.AddDate(0, 0, -walk)
-		}
-		// sanity check to avoid an infinite loop: should be impossible
-		if walk > 14 {
-			panic(fmt.Sprintf("unexpected failure to find nearest target time with ref=%s, transition=%s", ref.String(), tt.String()))
-		}
-	}
-	return date
-}
diff --git a/consensus/hotstuff/cruisectl/transition_time_test.go b/consensus/hotstuff/cruisectl/transition_time_test.go
deleted file mode 100644
index 15bff07ce1e..00000000000
--- a/consensus/hotstuff/cruisectl/transition_time_test.go
+++ /dev/null
@@ -1,145 +0,0 @@
-package cruisectl
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"pgregory.net/rapid"
-)
-
-// TestParseTransition_Valid tests that valid transition configurations have
-// consistent parsing and formatting behaviour.
-func TestParseTransition_Valid(t *testing.T) {
-	cases := []struct {
-		transition EpochTransitionTime
-		str        string
-	}{{
-		transition: EpochTransitionTime{time.Sunday, 0, 0},
-		str:        "sunday@00:00",
-	}, {
-		transition: EpochTransitionTime{time.Wednesday, 8, 1},
-		str:        "wednesday@08:01",
-	}, {
-		transition: EpochTransitionTime{time.Monday, 23, 59},
-		str:        "monday@23:59",
-	}, {
-		transition: EpochTransitionTime{time.Friday, 12, 21},
-		str:        "FrIdAy@12:21",
-	}}
-
-	for _, c := range cases {
-		t.Run(c.str, func(t *testing.T) {
-			// 1 - the computed string representation should match the string fixture
-			assert.Equal(t, strings.ToLower(c.str), c.transition.String())
-			// 2 - the parsed transition should match the transition fixture
-			parsed, err := ParseTransition(c.str)
-			assert.NoError(t, err)
-			assert.Equal(t, c.transition, *parsed)
-		})
-	}
-}
-
-// TestParseTransition_Invalid tests that a selection of invalid transition strings
-// fail validation and return an error.
-func TestParseTransition_Invalid(t *testing.T) {
-	cases := []string{
-		// invalid WD part
-		"sundy@12:00",
-		"tue@12:00",
-		"@12:00",
-		// invalid HH part
-		"wednesday@24:00",
-		"wednesday@1:00",
-		"wednesday@:00",
-		"wednesday@012:00",
-		// invalid MM part
-		"wednesday@12:60",
-		"wednesday@12:1",
-		"wednesday@12:",
-		"wednesday@12:030",
-		// otherwise invalid
-		"",
-		"@:",
-		"monday@@12:00",
-		"monday@09:00am",
-		"monday@09:00PM",
-		"monday12:00",
-		"monday12::00",
-		"wednesday@1200",
-	}
-
-	for _, transitionStr := range cases {
-		t.Run(transitionStr, func(t *testing.T) {
-			_, err := ParseTransition(transitionStr)
-			assert.Error(t, err)
-		})
-	}
-}
-
-// drawTransitionTime draws a random EpochTransitionTime.
-func drawTransitionTime(t *rapid.T) EpochTransitionTime {
-	day := time.Weekday(rapid.IntRange(0, 6).Draw(t, "wd").(int))
-	hour := rapid.Uint8Range(0, 23).Draw(t, "h").(uint8)
-	minute := rapid.Uint8Range(0, 59).Draw(t, "m").(uint8)
-	return EpochTransitionTime{day, hour, minute}
-}
-
-// TestInferTargetEndTime_Fixture is a single human-readable fixture test,
-// in addition to the property-based rapid tests.
-func TestInferTargetEndTime_Fixture(t *testing.T) {
-	// The target time is around midday Wednesday
-	// |S|M|T|W|T|F|S|
-	// |      *      |
-	ett := EpochTransitionTime{day: time.Wednesday, hour: 13, minute: 24}
-	// The current time is mid-morning on Friday. We are about 28% through the epoch in time terms
-	// |S|M|T|W|T|F|S|
-	// |          *  |
-	// Friday, November 20, 2020 11:44
-	curTime := time.Date(2020, 11, 20, 11, 44, 0, 0, time.UTC)
-	// We are 18% through the epoch in view terms - we are quite behind schedule
-	epochFractionComplete := .18
-	// We should still be able to infer the target switchover time:
-	// Wednesday, November 25, 2020 13:24
-	expectedTarget := time.Date(2020, 11, 25, 13, 24, 0, 0, time.UTC)
-	target := ett.inferTargetEndTime(curTime, epochFractionComplete)
-	assert.Equal(t, expectedTarget, target)
-}
-
-// TestInferTargetEndTime tests that we can infer "the most reasonable" target time.
-func TestInferTargetEndTime_Rapid(t *testing.T) {
-	rapid.Check(t, func(t *rapid.T) {
-		ett := drawTransitionTime(t)
-		curTime := time.Unix(rapid.Int64().Draw(t, "ref_unix").(int64), 0).UTC()
-		epochFractionComplete := rapid.Float64Range(0, 1).Draw(t, "pct_complete").(float64)
-		epochFractionRemaining := 1.0 - epochFractionComplete
-
-		target := ett.inferTargetEndTime(curTime, epochFractionComplete)
-		computedEndTime := curTime.Add(time.Duration(float64(epochLength) * epochFractionRemaining))
-		// selected target must be the nearest to the computed end time
-		delta := computedEndTime.Sub(target).Abs()
-		assert.LessOrEqual(t, delta.Hours(), float64(24*7)/2)
-		// nearest date must be a target time
-		assert.Equal(t, ett.day, target.Weekday())
-		assert.Equal(t, int(ett.hour), target.Hour())
-		assert.Equal(t, int(ett.minute), target.Minute())
-	})
-}
-
-// TestFindNearestTargetTime tests finding the nearest target time to a reference time.
-func TestFindNearestTargetTime(t *testing.T) {
-	rapid.Check(t, func(t *rapid.T) {
-		ett := drawTransitionTime(t)
-		ref := time.Unix(rapid.Int64().Draw(t, "ref_unix").(int64), 0).UTC()
-
-		nearest := ett.findNearestTargetTime(ref)
-		distance := nearest.Sub(ref).Abs()
-		// nearest date must be at most 1/2 a week away
-		assert.LessOrEqual(t, distance.Hours(), float64(24*7)/2)
-		// nearest date must be a target time
-		assert.Equal(t, ett.day, nearest.Weekday())
-		assert.Equal(t, int(ett.hour), nearest.Hour())
-		assert.Equal(t, int(ett.minute), nearest.Minute())
-	})
-}
diff --git a/consensus/hotstuff/integration/instance_test.go b/consensus/hotstuff/integration/instance_test.go
index 6a8d352d14b..fa404c9bd78 100644
--- a/consensus/hotstuff/integration/instance_test.go
+++ b/consensus/hotstuff/integration/instance_test.go
@@ -170,14 +170,14 @@ func NewInstance(t *testing.T, options ...Option) *Instance {
 
 	// program the hotstuff committee state
 	in.committee.On("IdentitiesByEpoch", mock.Anything).Return(
-		func(_ uint64) flow.IdentityList {
-			return in.participants
+		func(_ uint64) flow.IdentitySkeletonList {
+			return in.participants.ToSkeleton()
 		},
 		nil,
 	)
 	for _, participant := range in.participants {
 		in.committee.On("IdentityByBlock", mock.Anything, participant.NodeID).Return(participant, nil)
-		in.committee.On("IdentityByEpoch", mock.Anything, participant.NodeID).Return(participant, nil)
+		in.committee.On("IdentityByEpoch", mock.Anything, participant.NodeID).Return(&participant.IdentitySkeleton, nil)
 	}
 	in.committee.On("Self").Return(in.localID)
 	in.committee.On("LeaderForView", mock.Anything).Return(
@@ -185,12 +185,12 @@ func NewInstance(t *testing.T, options ...Option) *Instance {
 			return in.participants[int(view)%len(in.participants)].NodeID
 		}, nil,
 	)
-	in.committee.On("QuorumThresholdForView", mock.Anything).Return(committees.WeightThresholdToBuildQC(in.participants.TotalWeight()), nil)
-	in.committee.On("TimeoutThresholdForView", mock.Anything).Return(committees.WeightThresholdToTimeout(in.participants.TotalWeight()), nil)
+	in.committee.On("QuorumThresholdForView", mock.Anything).Return(committees.WeightThresholdToBuildQC(in.participants.ToSkeleton().TotalWeight()), nil)
+	in.committee.On("TimeoutThresholdForView", mock.Anything).Return(committees.WeightThresholdToTimeout(in.participants.ToSkeleton().TotalWeight()), nil)
 
 	// program the builder module behaviour
-	in.builder.On("BuildOn", mock.Anything, mock.Anything).Return(
-		func(parentID flow.Identifier, setter func(*flow.Header) error) *flow.Header {
+	in.builder.On("BuildOn", mock.Anything, mock.Anything, mock.Anything).Return(
+		func(parentID flow.Identifier, setter func(*flow.Header) error, sign func(*flow.Header) error) *flow.Header {
 			in.updatingBlocks.Lock()
 			defer in.updatingBlocks.Unlock()
 
@@ -207,10 +207,11 @@ func NewInstance(t *testing.T, options ...Option) *Instance {
 				Timestamp:   time.Now().UTC(),
 			}
 			require.NoError(t, setter(header))
+			require.NoError(t, sign(header))
 			in.headers[header.ID()] = header
 			return header
 		},
-		func(parentID flow.Identifier, setter func(*flow.Header) error) error {
+		func(parentID flow.Identifier, _ func(*flow.Header) error, _ func(*flow.Header) error) error {
 			in.updatingBlocks.RLock()
 			_, ok := in.headers[parentID]
 			in.updatingBlocks.RUnlock()
@@ -413,14 +414,14 @@ func NewInstance(t *testing.T, options ...Option) *Instance {
 		in.queue <- qc
 	}
 
-	minRequiredWeight := committees.WeightThresholdToBuildQC(uint64(in.participants.Count()) * weight)
+	minRequiredWeight := committees.WeightThresholdToBuildQC(uint64(len(in.participants)) * weight)
 	voteProcessorFactory := mocks.NewVoteProcessorFactory(t)
 	voteProcessorFactory.On("Create", mock.Anything, mock.Anything).Return(
 		func(log zerolog.Logger, proposal *model.Proposal) hotstuff.VerifyingVoteProcessor {
 			stakingSigAggtor := helper.MakeWeightedSignatureAggregator(weight)
 			stakingSigAggtor.On("Verify", mock.Anything, mock.Anything).Return(nil).Maybe()
 
-			rbRector := helper.MakeRandomBeaconReconstructor(msig.RandomBeaconThreshold(int(in.participants.Count())))
+			rbRector := helper.MakeRandomBeaconReconstructor(msig.RandomBeaconThreshold(len(in.participants)))
 			rbRector.On("Verify", mock.Anything, mock.Anything).Return(nil).Maybe()
 
 			return votecollector.NewCombinedVoteProcessor(
@@ -468,7 +469,7 @@ func NewInstance(t *testing.T, options ...Option) *Instance {
 					newestView.Set(newestQCView)
 					identity, ok := in.participants.ByNodeID(signerID)
 					require.True(t, ok)
-					return totalWeight.Add(identity.Weight)
+					return totalWeight.Add(identity.InitialWeight)
 				}, nil,
 			).Maybe()
 			aggregator.On("Aggregate", mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(
diff --git a/consensus/hotstuff/mocks/dynamic_committee.go b/consensus/hotstuff/mocks/dynamic_committee.go
index 67acf8f8bcb..e2869b3955d 100644
--- a/consensus/hotstuff/mocks/dynamic_committee.go
+++ b/consensus/hotstuff/mocks/dynamic_committee.go
@@ -41,19 +41,19 @@ func (_m *DynamicCommittee) DKG(view uint64) (hotstuff.DKG, error) {
 }
 
 // IdentitiesByBlock provides a mock function with given fields: blockID
-func (_m *DynamicCommittee) IdentitiesByBlock(blockID flow.Identifier) (flow.IdentityList, error) {
+func (_m *DynamicCommittee) IdentitiesByBlock(blockID flow.Identifier) (flow.GenericIdentityList[flow.Identity], error) {
 	ret := _m.Called(blockID)
 
-	var r0 flow.IdentityList
+	var r0 flow.GenericIdentityList[flow.Identity]
 	var r1 error
-	if rf, ok := ret.Get(0).(func(flow.Identifier) (flow.IdentityList, error)); ok {
+	if rf, ok := ret.Get(0).(func(flow.Identifier) (flow.GenericIdentityList[flow.Identity], error)); ok {
 		return rf(blockID)
 	}
-	if rf, ok := ret.Get(0).(func(flow.Identifier) flow.IdentityList); ok {
+	if rf, ok := ret.Get(0).(func(flow.Identifier) flow.GenericIdentityList[flow.Identity]); ok {
 		r0 = rf(blockID)
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(flow.IdentityList)
+			r0 = ret.Get(0).(flow.GenericIdentityList[flow.Identity])
 		}
 	}
 
@@ -67,19 +67,19 @@ func (_m *DynamicCommittee) IdentitiesByBlock(blockID flow.Identifier) (flow.Ide
 }
 
 // IdentitiesByEpoch provides a mock function with given fields: view
-func (_m *DynamicCommittee) IdentitiesByEpoch(view uint64) (flow.IdentityList, error) {
+func (_m *DynamicCommittee) IdentitiesByEpoch(view uint64) (flow.GenericIdentityList[flow.IdentitySkeleton], error) {
 	ret := _m.Called(view)
 
-	var r0 flow.IdentityList
+	var r0 flow.GenericIdentityList[flow.IdentitySkeleton]
 	var r1 error
-	if rf, ok := ret.Get(0).(func(uint64) (flow.IdentityList, error)); ok {
+	if rf, ok := ret.Get(0).(func(uint64) (flow.GenericIdentityList[flow.IdentitySkeleton], error)); ok {
 		return rf(view)
 	}
-	if rf, ok := ret.Get(0).(func(uint64) flow.IdentityList); ok {
+	if rf, ok := ret.Get(0).(func(uint64) flow.GenericIdentityList[flow.IdentitySkeleton]); ok {
 		r0 = rf(view)
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(flow.IdentityList)
+			r0 = ret.Get(0).(flow.GenericIdentityList[flow.IdentitySkeleton])
 		}
 	}
 
@@ -119,19 +119,19 @@ func (_m *DynamicCommittee) IdentityByBlock(blockID flow.Identifier, participant
 }
 
 // IdentityByEpoch provides a mock function with given fields: view, participantID
-func (_m *DynamicCommittee) IdentityByEpoch(view uint64, participantID flow.Identifier) (*flow.Identity, error) {
+func (_m *DynamicCommittee) IdentityByEpoch(view uint64, participantID flow.Identifier) (*flow.IdentitySkeleton, error) {
 	ret := _m.Called(view, participantID)
 
-	var r0 *flow.Identity
+	var r0 *flow.IdentitySkeleton
 	var r1 error
-	if rf, ok := ret.Get(0).(func(uint64, flow.Identifier) (*flow.Identity, error)); ok {
+	if rf, ok := ret.Get(0).(func(uint64, flow.Identifier) (*flow.IdentitySkeleton, error)); ok {
 		return rf(view, participantID)
 	}
-	if rf, ok := ret.Get(0).(func(uint64, flow.Identifier) *flow.Identity); ok {
+	if rf, ok := ret.Get(0).(func(uint64, flow.Identifier) *flow.IdentitySkeleton); ok {
 		r0 = rf(view, participantID)
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*flow.Identity)
+			r0 = ret.Get(0).(*flow.IdentitySkeleton)
 		}
 	}
 
diff --git a/consensus/hotstuff/mocks/packer.go b/consensus/hotstuff/mocks/packer.go
index b9d7bb573cf..da10b25b3b9 100644
--- a/consensus/hotstuff/mocks/packer.go
+++ b/consensus/hotstuff/mocks/packer.go
@@ -50,15 +50,15 @@ func (_m *Packer) Pack(view uint64, sig *hotstuff.BlockSignatureData) ([]byte, [
 }
 
 // Unpack provides a mock function with given fields: signerIdentities, sigData
-func (_m *Packer) Unpack(signerIdentities flow.IdentityList, sigData []byte) (*hotstuff.BlockSignatureData, error) {
+func (_m *Packer) Unpack(signerIdentities flow.GenericIdentityList[flow.IdentitySkeleton], sigData []byte) (*hotstuff.BlockSignatureData, error) {
 	ret := _m.Called(signerIdentities, sigData)
 
 	var r0 *hotstuff.BlockSignatureData
 	var r1 error
-	if rf, ok := ret.Get(0).(func(flow.IdentityList, []byte) (*hotstuff.BlockSignatureData, error)); ok {
+	if rf, ok := ret.Get(0).(func(flow.GenericIdentityList[flow.IdentitySkeleton], []byte) (*hotstuff.BlockSignatureData, error)); ok {
 		return rf(signerIdentities, sigData)
 	}
-	if rf, ok := ret.Get(0).(func(flow.IdentityList, []byte) *hotstuff.BlockSignatureData); ok {
+	if rf, ok := ret.Get(0).(func(flow.GenericIdentityList[flow.IdentitySkeleton], []byte) *hotstuff.BlockSignatureData); ok {
 		r0 = rf(signerIdentities, sigData)
 	} else {
 		if ret.Get(0) != nil {
@@ -66,7 +66,7 @@ func (_m *Packer) Unpack(signerIdentities flow.IdentityList, sigData []byte) (*h
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func(flow.IdentityList, []byte) error); ok {
+	if rf, ok := ret.Get(1).(func(flow.GenericIdentityList[flow.IdentitySkeleton], []byte) error); ok {
 		r1 = rf(signerIdentities, sigData)
 	} else {
 		r1 = ret.Error(1)
diff --git a/consensus/hotstuff/mocks/replicas.go b/consensus/hotstuff/mocks/replicas.go
index 965031dafd2..8ddba461152 100644
--- a/consensus/hotstuff/mocks/replicas.go
+++ b/consensus/hotstuff/mocks/replicas.go
@@ -41,19 +41,19 @@ func (_m *Replicas) DKG(view uint64) (hotstuff.DKG, error) {
 }
 
 // IdentitiesByEpoch provides a mock function with given fields: view
-func (_m *Replicas) IdentitiesByEpoch(view uint64) (flow.IdentityList, error) {
+func (_m *Replicas) IdentitiesByEpoch(view uint64) (flow.GenericIdentityList[flow.IdentitySkeleton], error) {
 	ret := _m.Called(view)
 
-	var r0 flow.IdentityList
+	var r0 flow.GenericIdentityList[flow.IdentitySkeleton]
 	var r1 error
-	if rf, ok := ret.Get(0).(func(uint64) (flow.IdentityList, error)); ok {
+	if rf, ok := ret.Get(0).(func(uint64) (flow.GenericIdentityList[flow.IdentitySkeleton], error)); ok {
 		return rf(view)
 	}
-	if rf, ok := ret.Get(0).(func(uint64) flow.IdentityList); ok {
+	if rf, ok := ret.Get(0).(func(uint64) flow.GenericIdentityList[flow.IdentitySkeleton]); ok {
 		r0 = rf(view)
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(flow.IdentityList)
+			r0 = ret.Get(0).(flow.GenericIdentityList[flow.IdentitySkeleton])
 		}
 	}
 
@@ -67,19 +67,19 @@ func (_m *Replicas) IdentitiesByEpoch(view uint64) (flow.IdentityList, error) {
 }
 
 // IdentityByEpoch provides a mock function with given fields: view, participantID
-func (_m *Replicas) IdentityByEpoch(view uint64, participantID flow.Identifier) (*flow.Identity, error) {
+func (_m *Replicas) IdentityByEpoch(view uint64, participantID flow.Identifier) (*flow.IdentitySkeleton, error) {
 	ret := _m.Called(view, participantID)
 
-	var r0 *flow.Identity
+	var r0 *flow.IdentitySkeleton
 	var r1 error
-	if rf, ok := ret.Get(0).(func(uint64, flow.Identifier) (*flow.Identity, error)); ok {
+	if rf, ok := ret.Get(0).(func(uint64, flow.Identifier) (*flow.IdentitySkeleton, error)); ok {
 		return rf(view, participantID)
 	}
-	if rf, ok := ret.Get(0).(func(uint64, flow.Identifier) *flow.Identity); ok {
+	if rf, ok := ret.Get(0).(func(uint64, flow.Identifier) *flow.IdentitySkeleton); ok {
 		r0 = rf(view, participantID)
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*flow.Identity)
+			r0 = ret.Get(0).(*flow.IdentitySkeleton)
 		}
 	}
 
diff --git a/consensus/hotstuff/mocks/validator.go b/consensus/hotstuff/mocks/validator.go
index d31e02dd1c9..d8cbf2fc265 100644
--- a/consensus/hotstuff/mocks/validator.go
+++ b/consensus/hotstuff/mocks/validator.go
@@ -58,19 +58,19 @@ func (_m *Validator) ValidateTC(tc *flow.TimeoutCertificate) error {
 }
 
 // ValidateVote provides a mock function with given fields: vote
-func (_m *Validator) ValidateVote(vote *model.Vote) (*flow.Identity, error) {
+func (_m *Validator) ValidateVote(vote *model.Vote) (*flow.IdentitySkeleton, error) {
 	ret := _m.Called(vote)
 
-	var r0 *flow.Identity
+	var r0 *flow.IdentitySkeleton
 	var r1 error
-	if rf, ok := ret.Get(0).(func(*model.Vote) (*flow.Identity, error)); ok {
+	if rf, ok := ret.Get(0).(func(*model.Vote) (*flow.IdentitySkeleton, error)); ok {
 		return rf(vote)
 	}
-	if rf, ok := ret.Get(0).(func(*model.Vote) *flow.Identity); ok {
+	if rf, ok := ret.Get(0).(func(*model.Vote) *flow.IdentitySkeleton); ok {
 		r0 = rf(vote)
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*flow.Identity)
+			r0 = ret.Get(0).(*flow.IdentitySkeleton)
 		}
 	}
 
diff --git a/consensus/hotstuff/mocks/verifier.go b/consensus/hotstuff/mocks/verifier.go
index 3ba02ff54e1..03cd04a934d 100644
--- a/consensus/hotstuff/mocks/verifier.go
+++ b/consensus/hotstuff/mocks/verifier.go
@@ -14,11 +14,11 @@ type Verifier struct {
 }
 
 // VerifyQC provides a mock function with given fields: signers, sigData, view, blockID
-func (_m *Verifier) VerifyQC(signers flow.IdentityList, sigData []byte, view uint64, blockID flow.Identifier) error {
+func (_m *Verifier) VerifyQC(signers flow.GenericIdentityList[flow.IdentitySkeleton], sigData []byte, view uint64, blockID flow.Identifier) error {
 	ret := _m.Called(signers, sigData, view, blockID)
 
 	var r0 error
-	if rf, ok := ret.Get(0).(func(flow.IdentityList, []byte, uint64, flow.Identifier) error); ok {
+	if rf, ok := ret.Get(0).(func(flow.GenericIdentityList[flow.IdentitySkeleton], []byte, uint64, flow.Identifier) error); ok {
 		r0 = rf(signers, sigData, view, blockID)
 	} else {
 		r0 = ret.Error(0)
@@ -28,11 +28,11 @@ func (_m *Verifier) VerifyQC(signers flow.IdentityList, sigData []byte, view uin
 }
 
 // VerifyTC provides a mock function with given fields: signers, sigData, view, highQCViews
-func (_m *Verifier) VerifyTC(signers flow.IdentityList, sigData []byte, view uint64, highQCViews []uint64) error {
+func (_m *Verifier) VerifyTC(signers flow.GenericIdentityList[flow.IdentitySkeleton], sigData []byte, view uint64, highQCViews []uint64) error {
 	ret := _m.Called(signers, sigData, view, highQCViews)
 
 	var r0 error
-	if rf, ok := ret.Get(0).(func(flow.IdentityList, []byte, uint64, []uint64) error); ok {
+	if rf, ok := ret.Get(0).(func(flow.GenericIdentityList[flow.IdentitySkeleton], []byte, uint64, []uint64) error); ok {
 		r0 = rf(signers, sigData, view, highQCViews)
 	} else {
 		r0 = ret.Error(0)
@@ -42,11 +42,11 @@ func (_m *Verifier) VerifyTC(signers flow.IdentityList, sigData []byte, view uin
 }
 
 // VerifyVote provides a mock function with given fields: voter, sigData, view, blockID
-func (_m *Verifier) VerifyVote(voter *flow.Identity, sigData []byte, view uint64, blockID flow.Identifier) error {
+func (_m *Verifier) VerifyVote(voter *flow.IdentitySkeleton, sigData []byte, view uint64, blockID flow.Identifier) error {
 	ret := _m.Called(voter, sigData, view, blockID)
 
 	var r0 error
-	if rf, ok := ret.Get(0).(func(*flow.Identity, []byte, uint64, flow.Identifier) error); ok {
+	if rf, ok := ret.Get(0).(func(*flow.IdentitySkeleton, []byte, uint64, flow.Identifier) error); ok {
 		r0 = rf(voter, sigData, view, blockID)
 	} else {
 		r0 = ret.Error(0)
diff --git a/consensus/hotstuff/safetyrules/safety_rules_test.go b/consensus/hotstuff/safetyrules/safety_rules_test.go
index 2c2d9cc201a..6309394e880 100644
--- a/consensus/hotstuff/safetyrules/safety_rules_test.go
+++ b/consensus/hotstuff/safetyrules/safety_rules_test.go
@@ -61,7 +61,7 @@ func (s *SafetyRulesTestSuite) SetupTest() {
 	s.committee.On("Self").Return(s.ourIdentity.NodeID).Maybe()
 	s.committee.On("IdentityByBlock", mock.Anything, s.ourIdentity.NodeID).Return(s.ourIdentity, nil).Maybe()
 	s.committee.On("IdentityByBlock", s.proposal.Block.BlockID, s.proposal.Block.ProposerID).Return(s.proposerIdentity, nil).Maybe()
-	s.committee.On("IdentityByEpoch", mock.Anything, s.ourIdentity.NodeID).Return(s.ourIdentity, nil).Maybe()
+	s.committee.On("IdentityByEpoch", mock.Anything, s.ourIdentity.NodeID).Return(&s.ourIdentity.IdentitySkeleton, nil).Maybe()
 
 	s.safetyData = &hotstuff.SafetyData{
 		LockedOneChainView:      s.bootstrapBlock.View,
diff --git a/consensus/hotstuff/signature.go b/consensus/hotstuff/signature.go
index 672d75feb5c..0deec84caa4 100644
--- a/consensus/hotstuff/signature.go
+++ b/consensus/hotstuff/signature.go
@@ -175,5 +175,5 @@ type Packer interface {
 	// It returns:
 	//  - (sigData, nil) if successfully unpacked the signature data
 	//  - (nil, model.InvalidFormatError) if failed to unpack the signature data
-	Unpack(signerIdentities flow.IdentityList, sigData []byte) (*BlockSignatureData, error)
+	Unpack(signerIdentities flow.IdentitySkeletonList, sigData []byte) (*BlockSignatureData, error)
 }
diff --git a/consensus/hotstuff/signature/block_signer_decoder.go b/consensus/hotstuff/signature/block_signer_decoder.go
index 46a2036c50a..82c6f865350 100644
--- a/consensus/hotstuff/signature/block_signer_decoder.go
+++ b/consensus/hotstuff/signature/block_signer_decoder.go
@@ -44,11 +44,12 @@ func (b *BlockSignerDecoder) DecodeSignerIDs(header *flow.Header) (flow.Identifi
 			// try asking by parent ID
 			// TODO: this assumes no identity table changes within epochs, must be changed for Dynamic Protocol State
 			//  See https://github.com/onflow/flow-go/issues/4085
-			members, err = b.IdentitiesByBlock(header.ParentID)
+			byBlockMembers, err := b.IdentitiesByBlock(header.ParentID)
 			if err != nil {
 				return nil, fmt.Errorf("could not retrieve identities for block %x with QC view %d for parent %x: %w",
 					header.ID(), header.ParentView, header.ParentID, err) // state.ErrUnknownSnapshotReference or exception
 			}
+			members = byBlockMembers.ToSkeleton()
 		} else {
 			return nil, fmt.Errorf("unexpected error retrieving identities for block %v: %w", header.ID(), err)
 		}
diff --git a/consensus/hotstuff/signature/block_signer_decoder_test.go b/consensus/hotstuff/signature/block_signer_decoder_test.go
index 76d13461ccc..906cd9bbbc4 100644
--- a/consensus/hotstuff/signature/block_signer_decoder_test.go
+++ b/consensus/hotstuff/signature/block_signer_decoder_test.go
@@ -31,11 +31,11 @@ type blockSignerDecoderSuite struct {
 
 func (s *blockSignerDecoderSuite) SetupTest() {
 	// the default header fixture creates signerIDs for a committee of 10 nodes, so we prepare a committee same as that
-	s.allConsensus = unittest.IdentityListFixture(40, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical)
+	s.allConsensus = unittest.IdentityListFixture(40, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical[flow.Identity])
 
 	// mock consensus committee
 	s.committee = hotstuff.NewDynamicCommittee(s.T())
-	s.committee.On("IdentitiesByEpoch", mock.Anything).Return(s.allConsensus, nil).Maybe()
+	s.committee.On("IdentitiesByEpoch", mock.Anything).Return(s.allConsensus.ToSkeleton(), nil).Maybe()
 
 	// prepare valid test block:
 	voterIndices, err := signature.EncodeSignersToIndices(s.allConsensus.NodeIDs(), s.allConsensus.NodeIDs())
@@ -138,13 +138,13 @@ func (s *blockSignerDecoderSuite) Test_EpochTransition() {
 	//   PARENT <- | -- B
 	blockView := s.block.Header.View
 	parentView := s.block.Header.ParentView
-	epoch1Committee := s.allConsensus
+	epoch1Committee := s.allConsensus.ToSkeleton()
 	epoch2Committee, err := s.allConsensus.SamplePct(.8)
 	require.NoError(s.T(), err)
 
 	*s.committee = *hotstuff.NewDynamicCommittee(s.T())
 	s.committee.On("IdentitiesByEpoch", parentView).Return(epoch1Committee, nil).Maybe()
-	s.committee.On("IdentitiesByEpoch", blockView).Return(epoch2Committee, nil).Maybe()
+	s.committee.On("IdentitiesByEpoch", blockView).Return(epoch2Committee.ToSkeleton(), nil).Maybe()
 
 	ids, err := s.decoder.DecodeSignerIDs(s.block.Header)
 	require.NoError(s.T(), err)
diff --git a/consensus/hotstuff/signature/packer.go b/consensus/hotstuff/signature/packer.go
index 4b6652ce66f..20f819569b9 100644
--- a/consensus/hotstuff/signature/packer.go
+++ b/consensus/hotstuff/signature/packer.go
@@ -69,7 +69,7 @@ func (p *ConsensusSigDataPacker) Pack(view uint64, sig *hotstuff.BlockSignatureD
 // It returns:
 //   - (sigData, nil) if successfully unpacked the signature data
 //   - (nil, model.InvalidFormatError) if failed to unpack the signature data
-func (p *ConsensusSigDataPacker) Unpack(signerIdentities flow.IdentityList, sigData []byte) (*hotstuff.BlockSignatureData, error) {
+func (p *ConsensusSigDataPacker) Unpack(signerIdentities flow.IdentitySkeletonList, sigData []byte) (*hotstuff.BlockSignatureData, error) {
 	// decode into typed data
 	data, err := p.Decode(sigData) // all potential error are of type `model.InvalidFormatError`
 	if err != nil {
diff --git a/consensus/hotstuff/signature/packer_test.go b/consensus/hotstuff/signature/packer_test.go
index 862534d6eda..5ff63f77749 100644
--- a/consensus/hotstuff/signature/packer_test.go
+++ b/consensus/hotstuff/signature/packer_test.go
@@ -16,11 +16,11 @@ import (
 	"github.com/onflow/flow-go/utils/unittest"
 )
 
-func newPacker(identities flow.IdentityList) *ConsensusSigDataPacker {
+func newPacker(identities flow.IdentitySkeletonList) *ConsensusSigDataPacker {
 	// mock consensus committee
 	committee := &mocks.DynamicCommittee{}
 	committee.On("IdentitiesByEpoch", mock.Anything).Return(
-		func(_ uint64) flow.IdentityList {
+		func(_ uint64) flow.IdentitySkeletonList {
 			return identities
 		},
 		nil,
@@ -29,7 +29,7 @@ func newPacker(identities flow.IdentityList) *ConsensusSigDataPacker {
 	return NewConsensusSigDataPacker(committee)
 }
 
-func makeBlockSigData(committee flow.IdentityList) *hotstuff.BlockSignatureData {
+func makeBlockSigData(committee flow.IdentitySkeletonList) *hotstuff.BlockSignatureData {
 	blockSigData := &hotstuff.BlockSignatureData{
 		StakingSigners: []flow.Identifier{
 			committee[0].NodeID, // A
@@ -54,7 +54,7 @@ func makeBlockSigData(committee flow.IdentityList) *hotstuff.BlockSignatureData
 // aggregated random beacon sigs are from [D,F]
 func TestPackUnpack(t *testing.T) {
 	// prepare data for testing
-	committee := unittest.IdentityListFixture(6, unittest.WithRole(flow.RoleConsensus))
+	committee := unittest.IdentityListFixture(6, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
 	view := rand.Uint64()
 	blockSigData := makeBlockSigData(committee)
 
@@ -100,9 +100,9 @@ func TestPackUnpack_EmptySigners(t *testing.T) {
 	require.NoError(t, err)
 
 	// create packer with a non-empty committee (honest node trying to decode the sig data)
-	committee := unittest.IdentityListFixture(6, unittest.WithRole(flow.RoleConsensus))
+	committee := unittest.IdentityListFixture(6, unittest.WithRole(flow.RoleConsensus)).ToSkeleton()
 	packer := newPacker(committee)
-	unpacked, err := packer.Unpack(make([]*flow.Identity, 0), sig)
+	unpacked, err := packer.Unpack(make(flow.IdentitySkeletonList, 0), sig)
 	require.NoError(t, err)
 
 	// check that the unpack data match with the original data
@@ -117,7 +117,7 @@ func TestPackUnpack_EmptySigners(t *testing.T) {
 // it's able to pack and unpack
 func TestPackUnpackManyNodes(t *testing.T) {
 	// prepare data for testing
-	committee := unittest.IdentityListFixture(200, unittest.WithRole(flow.RoleConsensus))
+	committee := unittest.IdentityListFixture(200, unittest.WithRole(flow.RoleConsensus)).ToSkeleton()
 	view := rand.Uint64()
 	blockSigData := makeBlockSigData(committee)
 	stakingSigners := make([]flow.Identifier, 0)
@@ -161,7 +161,7 @@ func TestPackUnpackManyNodes(t *testing.T) {
 // if the sig data can not be decoded, return model.InvalidFormatError
 func TestFailToDecode(t *testing.T) {
 	// prepare data for testing
-	committee := unittest.IdentityListFixture(6, unittest.WithRole(flow.RoleConsensus))
+	committee := unittest.IdentityListFixture(6, unittest.WithRole(flow.RoleConsensus)).ToSkeleton()
 	view := rand.Uint64()
 	blockSigData := makeBlockSigData(committee)
 
@@ -184,7 +184,7 @@ func TestFailToDecode(t *testing.T) {
 // if the signer IDs doesn't match, return InvalidFormatError
 func TestMismatchSignerIDs(t *testing.T) {
 	// prepare data for testing
-	committee := unittest.IdentityListFixture(9, unittest.WithRole(flow.RoleConsensus))
+	committee := unittest.IdentityListFixture(9, unittest.WithRole(flow.RoleConsensus)).ToSkeleton()
 	view := rand.Uint64()
 	blockSigData := makeBlockSigData(committee[:6])
 
@@ -216,7 +216,7 @@ func TestMismatchSignerIDs(t *testing.T) {
 // if sig type doesn't match, return InvalidFormatError
 func TestInvalidSigType(t *testing.T) {
 	// prepare data for testing
-	committee := unittest.IdentityListFixture(6, unittest.WithRole(flow.RoleConsensus))
+	committee := unittest.IdentityListFixture(6, unittest.WithRole(flow.RoleConsensus)).ToSkeleton()
 	view := rand.Uint64()
 	blockSigData := makeBlockSigData(committee)
 
@@ -250,7 +250,7 @@ func TestInvalidSigType(t *testing.T) {
 // no random beacon signers
 func TestPackUnpackWithoutRBAggregatedSig(t *testing.T) {
 	// prepare data for testing
-	committee := unittest.IdentityListFixture(3, unittest.WithRole(flow.RoleConsensus))
+	committee := unittest.IdentityListFixture(3, unittest.WithRole(flow.RoleConsensus)).ToSkeleton()
 	view := rand.Uint64()
 
 	blockSigData := &hotstuff.BlockSignatureData{
@@ -292,7 +292,7 @@ func TestPackUnpackWithoutRBAggregatedSig(t *testing.T) {
 // with different structure format, more specifically there is no difference between
 // nil and empty slices for RandomBeaconSigners and AggregatedRandomBeaconSig.
 func TestPackWithoutRBAggregatedSig(t *testing.T) {
-	identities := unittest.IdentityListFixture(3, unittest.WithRole(flow.RoleConsensus))
+	identities := unittest.IdentityListFixture(3, unittest.WithRole(flow.RoleConsensus)).ToSkeleton()
 	committee := identities.NodeIDs()
 
 	// prepare data for testing
diff --git a/consensus/hotstuff/signature/weighted_signature_aggregator.go b/consensus/hotstuff/signature/weighted_signature_aggregator.go
index 3dda42b043b..7e111cff870 100644
--- a/consensus/hotstuff/signature/weighted_signature_aggregator.go
+++ b/consensus/hotstuff/signature/weighted_signature_aggregator.go
@@ -69,7 +69,7 @@ func NewWeightedSignatureAggregator(
 	idToInfo := make(map[flow.Identifier]signerInfo)
 	for i, id := range ids {
 		idToInfo[id.NodeID] = signerInfo{
-			weight: id.Weight,
+			weight: id.InitialWeight,
 			index:  i,
 		}
 	}
diff --git a/consensus/hotstuff/signature/weighted_signature_aggregator_test.go b/consensus/hotstuff/signature/weighted_signature_aggregator_test.go
index 68256071d7c..03942153fe5 100644
--- a/consensus/hotstuff/signature/weighted_signature_aggregator_test.go
+++ b/consensus/hotstuff/signature/weighted_signature_aggregator_test.go
@@ -117,7 +117,7 @@ func TestWeightedSignatureAggregator(t *testing.T) {
 				// ignore weight as comparing against expected weight is not thread safe
 				assert.NoError(t, err)
 			}(i, sig)
-			expectedWeight += ids[i+subSet].Weight
+			expectedWeight += ids[i+subSet].InitialWeight
 		}
 
 		wg.Wait()
@@ -137,7 +137,7 @@ func TestWeightedSignatureAggregator(t *testing.T) {
 		for i, sig := range sigs[:subSet] {
 			weight, err := aggregator.TrustedAdd(ids[i].NodeID, sig)
 			assert.NoError(t, err)
-			expectedWeight += ids[i].Weight
+			expectedWeight += ids[i].InitialWeight
 			assert.Equal(t, expectedWeight, weight)
 			// test TotalWeight
 			assert.Equal(t, expectedWeight, aggregator.TotalWeight())
@@ -181,7 +181,7 @@ func TestWeightedSignatureAggregator(t *testing.T) {
 		// add signatures
 		for i, sig := range sigs {
 			weight, err := aggregator.TrustedAdd(ids[i].NodeID, sig)
-			expectedWeight += ids[i].Weight
+			expectedWeight += ids[i].InitialWeight
 			assert.Equal(t, expectedWeight, weight)
 			require.NoError(t, err)
 		}
@@ -263,7 +263,7 @@ func TestWeightedSignatureAggregator(t *testing.T) {
 			for i, sig := range sigs {
 				weight, err := aggregator.TrustedAdd(ids[i].NodeID, sig)
 				require.NoError(t, err)
-				expectedWeight += ids[i].Weight
+				expectedWeight += ids[i].InitialWeight
 				assert.Equal(t, expectedWeight, weight)
 			}
 
diff --git a/consensus/hotstuff/timeoutcollector/aggregation.go b/consensus/hotstuff/timeoutcollector/aggregation.go
index 7e14680c3a6..6d68c245707 100644
--- a/consensus/hotstuff/timeoutcollector/aggregation.go
+++ b/consensus/hotstuff/timeoutcollector/aggregation.go
@@ -64,7 +64,7 @@ var _ hotstuff.TimeoutSignatureAggregator = (*TimeoutSignatureAggregator)(nil)
 // signature aggregation task in the protocol.
 func NewTimeoutSignatureAggregator(
 	view uint64, // view for which we are aggregating signatures
-	ids flow.IdentityList, // list of all authorized signers
+	ids flow.IdentitySkeletonList, // list of all authorized signers
 	dsTag string, // domain separation tag used by the signature
 ) (*TimeoutSignatureAggregator, error) {
 	if len(ids) == 0 {
@@ -82,7 +82,7 @@ func NewTimeoutSignatureAggregator(
 	for _, id := range ids {
 		idToInfo[id.NodeID] = signerInfo{
 			pk:     id.StakingPubKey,
-			weight: id.Weight,
+			weight: id.InitialWeight,
 		}
 	}
 
diff --git a/consensus/hotstuff/timeoutcollector/aggregation_test.go b/consensus/hotstuff/timeoutcollector/aggregation_test.go
index b449a4f3cc1..c0beaf473fa 100644
--- a/consensus/hotstuff/timeoutcollector/aggregation_test.go
+++ b/consensus/hotstuff/timeoutcollector/aggregation_test.go
@@ -20,7 +20,7 @@ import (
 // createAggregationData is a helper which creates fixture data for testing
 func createAggregationData(t *testing.T, signersNumber int) (
 	*TimeoutSignatureAggregator,
-	flow.IdentityList,
+	flow.IdentitySkeletonList,
 	[]crypto.PublicKey,
 	[]crypto.Signature,
 	[]hotstuff.TimeoutSignerInfo,
@@ -36,14 +36,14 @@ func createAggregationData(t *testing.T, signersNumber int) (
 	hashers := make([]hash.Hasher, 0, signersNumber)
 
 	// create keys, identities and signatures
-	ids := make([]*flow.Identity, 0, signersNumber)
+	ids := make(flow.IdentitySkeletonList, 0, signersNumber)
 	pks := make([]crypto.PublicKey, 0, signersNumber)
 	view := 10 + uint64(rand.Uint32())
 	for i := 0; i < signersNumber; i++ {
 		sk := unittest.PrivateKeyFixture(crypto.BLSBLS12381, crypto.KeyGenSeedMinLen)
 		identity := unittest.IdentityFixture(unittest.WithStakingPubKey(sk.PublicKey()))
 		// id
-		ids = append(ids, identity)
+		ids = append(ids, &identity.IdentitySkeleton)
 		// keys
 		newestQCView := uint64(rand.Intn(int(view)))
 		msg := verification.MakeTimeoutMessage(view, newestQCView)
@@ -73,10 +73,10 @@ func TestNewTimeoutSignatureAggregator(t *testing.T) {
 	sk := unittest.PrivateKeyFixture(crypto.ECDSAP256, crypto.KeyGenSeedMinLen)
 	signer := unittest.IdentityFixture(unittest.WithStakingPubKey(sk.PublicKey()))
 	// wrong key type
-	_, err := NewTimeoutSignatureAggregator(0, flow.IdentityList{signer}, tag)
+	_, err := NewTimeoutSignatureAggregator(0, flow.IdentitySkeletonList{&signer.IdentitySkeleton}, tag)
 	require.Error(t, err)
 	// empty signers
-	_, err = NewTimeoutSignatureAggregator(0, flow.IdentityList{}, tag)
+	_, err = NewTimeoutSignatureAggregator(0, flow.IdentitySkeletonList{}, tag)
 	require.Error(t, err)
 }
 
@@ -101,7 +101,7 @@ func TestTimeoutSignatureAggregator_HappyPath(t *testing.T) {
 			// ignore weight as comparing against expected weight is not thread safe
 			require.NoError(t, err)
 		}(i, sig)
-		expectedWeight += ids[i+subSet].Weight
+		expectedWeight += ids[i+subSet].InitialWeight
 	}
 
 	wg.Wait()
@@ -117,7 +117,7 @@ func TestTimeoutSignatureAggregator_HappyPath(t *testing.T) {
 	for i, sig := range sigs[:subSet] {
 		weight, err := aggregator.VerifyAndAdd(ids[i].NodeID, sig, signersData[i].NewestQCView)
 		require.NoError(t, err)
-		expectedWeight += ids[i].Weight
+		expectedWeight += ids[i].InitialWeight
 		require.Equal(t, expectedWeight, weight)
 		// test TotalWeight
 		require.Equal(t, expectedWeight, aggregator.TotalWeight())
@@ -153,7 +153,7 @@ func TestTimeoutSignatureAggregator_VerifyAndAdd(t *testing.T) {
 		// add signatures
 		for i, sig := range sigs {
 			weight, err := aggregator.VerifyAndAdd(ids[i].NodeID, sig, signersInfo[i].NewestQCView)
-			expectedWeight += ids[i].Weight
+			expectedWeight += ids[i].InitialWeight
 			require.Equal(t, expectedWeight, weight)
 			require.NoError(t, err)
 		}
@@ -204,7 +204,7 @@ func TestTimeoutSignatureAggregator_Aggregate(t *testing.T) {
 		for i, sig := range sigs {
 			weight, err := aggregator.VerifyAndAdd(ids[i].NodeID, sig, signersInfo[i].NewestQCView)
 			if err == nil {
-				expectedWeight += ids[i].Weight
+				expectedWeight += ids[i].InitialWeight
 			}
 			require.Equal(t, expectedWeight, weight)
 		}
diff --git a/consensus/hotstuff/timeoutcollector/timeout_processor_test.go b/consensus/hotstuff/timeoutcollector/timeout_processor_test.go
index c9fe81651f9..e5f443d6898 100644
--- a/consensus/hotstuff/timeoutcollector/timeout_processor_test.go
+++ b/consensus/hotstuff/timeoutcollector/timeout_processor_test.go
@@ -35,8 +35,8 @@ func TestTimeoutProcessor(t *testing.T) {
 type TimeoutProcessorTestSuite struct {
 	suite.Suite
 
-	participants  flow.IdentityList
-	signer        *flow.Identity
+	participants  flow.IdentitySkeletonList
+	signer        *flow.IdentitySkeleton
 	view          uint64
 	sigWeight     uint64
 	totalWeight   atomic.Uint64
@@ -54,7 +54,7 @@ func (s *TimeoutProcessorTestSuite) SetupTest() {
 	s.validator = mocks.NewValidator(s.T())
 	s.sigAggregator = mocks.NewTimeoutSignatureAggregator(s.T())
 	s.notifier = mocks.NewTimeoutCollectorConsumer(s.T())
-	s.participants = unittest.IdentityListFixture(11, unittest.WithWeight(s.sigWeight)).Sort(flow.Canonical)
+	s.participants = unittest.IdentityListFixture(11, unittest.WithInitialWeight(s.sigWeight)).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
 	s.signer = s.participants[0]
 	s.view = (uint64)(rand.Uint32() + 100)
 	s.totalWeight = *atomic.NewUint64(0)
@@ -461,20 +461,19 @@ func TestTimeoutProcessor_BuildVerifyTC(t *testing.T) {
 	// signers hold objects that are created with private key and can sign votes and proposals
 	signers := make(map[flow.Identifier]*verification.StakingSigner)
 	// prepare staking signers, each signer has its own private/public key pair
+	// identities must be in canonical order
 	stakingSigners := unittest.IdentityListFixture(11, func(identity *flow.Identity) {
 		stakingPriv := unittest.StakingPrivKeyFixture()
 		identity.StakingPubKey = stakingPriv.PublicKey()
 
-		me, err := local.New(identity, stakingPriv)
+		me, err := local.New(identity.IdentitySkeleton, stakingPriv)
 		require.NoError(t, err)
 
 		signers[identity.NodeID] = verification.NewStakingSigner(me)
-	})
-	// identities must be in canonical order
-	stakingSigners = stakingSigners.Sort(flow.Canonical)
+	}).Sort(flow.Canonical[flow.Identity])
 
 	// utility function which generates a valid timeout for every signer
-	createTimeouts := func(participants flow.IdentityList, view uint64, newestQC *flow.QuorumCertificate, lastViewTC *flow.TimeoutCertificate) []*model.TimeoutObject {
+	createTimeouts := func(participants flow.IdentitySkeletonList, view uint64, newestQC *flow.QuorumCertificate, lastViewTC *flow.TimeoutCertificate) []*model.TimeoutObject {
 		timeouts := make([]*model.TimeoutObject, 0, len(participants))
 		for _, signer := range participants {
 			timeout, err := signers[signer.NodeID].CreateTimeout(view, newestQC, lastViewTC)
@@ -490,20 +489,22 @@ func TestTimeoutProcessor_BuildVerifyTC(t *testing.T) {
 	block := helper.MakeBlock(helper.WithBlockView(view-1),
 		helper.WithBlockProposer(leader.NodeID))
 
+	stakingSignersSkeleton := stakingSigners.ToSkeleton()
+
 	committee := mocks.NewDynamicCommittee(t)
-	committee.On("IdentitiesByEpoch", mock.Anything).Return(stakingSigners, nil)
+	committee.On("IdentitiesByEpoch", mock.Anything).Return(stakingSignersSkeleton, nil)
 	committee.On("IdentitiesByBlock", mock.Anything).Return(stakingSigners, nil)
-	committee.On("QuorumThresholdForView", mock.Anything).Return(committees.WeightThresholdToBuildQC(stakingSigners.TotalWeight()), nil)
-	committee.On("TimeoutThresholdForView", mock.Anything).Return(committees.WeightThresholdToTimeout(stakingSigners.TotalWeight()), nil)
+	committee.On("QuorumThresholdForView", mock.Anything).Return(committees.WeightThresholdToBuildQC(stakingSignersSkeleton.TotalWeight()), nil)
+	committee.On("TimeoutThresholdForView", mock.Anything).Return(committees.WeightThresholdToTimeout(stakingSignersSkeleton.TotalWeight()), nil)
 
 	// create first QC for view N-1, this will be our olderQC
-	olderQC := createRealQC(t, committee, stakingSigners, signers, block)
+	olderQC := createRealQC(t, committee, stakingSignersSkeleton, signers, block)
 	// now create a second QC for view N, this will be our newest QC
 	nextBlock := helper.MakeBlock(
 		helper.WithBlockView(view),
 		helper.WithBlockProposer(leader.NodeID),
 		helper.WithBlockQC(olderQC))
-	newestQC := createRealQC(t, committee, stakingSigners, signers, nextBlock)
+	newestQC := createRealQC(t, committee, stakingSignersSkeleton, signers, nextBlock)
 
 	// At this point we have created two QCs for round N-1 and N.
 	// Next step is create a TC for view N.
@@ -522,7 +523,7 @@ func TestTimeoutProcessor_BuildVerifyTC(t *testing.T) {
 		lastViewTC = tc
 	}
 
-	aggregator, err := NewTimeoutSignatureAggregator(view, stakingSigners, msig.CollectorTimeoutTag)
+	aggregator, err := NewTimeoutSignatureAggregator(view, stakingSignersSkeleton, msig.CollectorTimeoutTag)
 	require.NoError(t, err)
 
 	notifier := mocks.NewTimeoutCollectorConsumer(t)
@@ -532,7 +533,7 @@ func TestTimeoutProcessor_BuildVerifyTC(t *testing.T) {
 	require.NoError(t, err)
 
 	// last view was successful, no lastViewTC in this case
-	timeouts := createTimeouts(stakingSigners, view, olderQC, nil)
+	timeouts := createTimeouts(stakingSignersSkeleton, view, olderQC, nil)
 	for _, timeout := range timeouts {
 		err := processor.Process(timeout)
 		require.NoError(t, err)
@@ -543,7 +544,7 @@ func TestTimeoutProcessor_BuildVerifyTC(t *testing.T) {
 	// at this point we have created QCs for view N-1 and N additionally a TC for view N, we can create TC for view N+1
 	// with timeout objects containing both QC and TC for view N
 
-	aggregator, err = NewTimeoutSignatureAggregator(view+1, stakingSigners, msig.CollectorTimeoutTag)
+	aggregator, err = NewTimeoutSignatureAggregator(view+1, stakingSignersSkeleton, msig.CollectorTimeoutTag)
 	require.NoError(t, err)
 
 	notifier = mocks.NewTimeoutCollectorConsumer(t)
@@ -554,8 +555,8 @@ func TestTimeoutProcessor_BuildVerifyTC(t *testing.T) {
 
 	// part of committee will use QC, another part TC, this will result in aggregated signature consisting
 	// of two types of messages with views N-1 and N representing the newest QC known to replicas.
-	timeoutsWithQC := createTimeouts(stakingSigners[:len(stakingSigners)/2], view+1, newestQC, nil)
-	timeoutsWithTC := createTimeouts(stakingSigners[len(stakingSigners)/2:], view+1, olderQC, lastViewTC)
+	timeoutsWithQC := createTimeouts(stakingSignersSkeleton[:len(stakingSignersSkeleton)/2], view+1, newestQC, nil)
+	timeoutsWithTC := createTimeouts(stakingSignersSkeleton[len(stakingSignersSkeleton)/2:], view+1, olderQC, lastViewTC)
 	timeouts = append(timeoutsWithQC, timeoutsWithTC...)
 	for _, timeout := range timeouts {
 		err := processor.Process(timeout)
@@ -569,7 +570,7 @@ func TestTimeoutProcessor_BuildVerifyTC(t *testing.T) {
 func createRealQC(
 	t *testing.T,
 	committee hotstuff.DynamicCommittee,
-	signers flow.IdentityList,
+	signers flow.IdentitySkeletonList,
 	signerObjects map[flow.Identifier]*verification.StakingSigner,
 	block *model.Block,
 ) *flow.QuorumCertificate {
diff --git a/consensus/hotstuff/validator.go b/consensus/hotstuff/validator.go
index 5bcc77f1810..be3313e9f26 100644
--- a/consensus/hotstuff/validator.go
+++ b/consensus/hotstuff/validator.go
@@ -31,5 +31,5 @@ type Validator interface {
 	// the following errors are expected:
 	//  * model.InvalidVoteError for invalid votes
 	//  * model.ErrViewForUnknownEpoch if the vote refers unknown epoch
-	ValidateVote(vote *model.Vote) (*flow.Identity, error)
+	ValidateVote(vote *model.Vote) (*flow.IdentitySkeleton, error)
 }
diff --git a/consensus/hotstuff/validator/metrics_wrapper.go b/consensus/hotstuff/validator/metrics_wrapper.go
index 127ca317094..8876acef248 100644
--- a/consensus/hotstuff/validator/metrics_wrapper.go
+++ b/consensus/hotstuff/validator/metrics_wrapper.go
@@ -47,7 +47,7 @@ func (w ValidatorMetricsWrapper) ValidateProposal(proposal *model.Proposal) erro
 	return err
 }
 
-func (w ValidatorMetricsWrapper) ValidateVote(vote *model.Vote) (*flow.Identity, error) {
+func (w ValidatorMetricsWrapper) ValidateVote(vote *model.Vote) (*flow.IdentitySkeleton, error) {
 	processStart := time.Now()
 	identity, err := w.validator.ValidateVote(vote)
 	w.metrics.ValidatorProcessingDuration(time.Since(processStart))
diff --git a/consensus/hotstuff/validator/validator.go b/consensus/hotstuff/validator/validator.go
index b9cafdc5d89..933c3751619 100644
--- a/consensus/hotstuff/validator/validator.go
+++ b/consensus/hotstuff/validator/validator.go
@@ -294,7 +294,7 @@ func (v *Validator) ValidateProposal(proposal *model.Proposal) error {
 //   - model.ErrViewForUnknownEpoch if the vote refers unknown epoch
 //
 // Any other error should be treated as exception
-func (v *Validator) ValidateVote(vote *model.Vote) (*flow.Identity, error) {
+func (v *Validator) ValidateVote(vote *model.Vote) (*flow.IdentitySkeleton, error) {
 	voter, err := v.committee.IdentityByEpoch(vote.View, vote.SignerID)
 	if model.IsInvalidSignerError(err) {
 		return nil, newInvalidVoteError(vote, err)
diff --git a/consensus/hotstuff/validator/validator_test.go b/consensus/hotstuff/validator/validator_test.go
index 6eb3da069ce..7683d7cbe0b 100644
--- a/consensus/hotstuff/validator/validator_test.go
+++ b/consensus/hotstuff/validator/validator_test.go
@@ -30,14 +30,14 @@ type ProposalSuite struct {
 	suite.Suite
 	participants flow.IdentityList
 	indices      []byte
-	leader       *flow.Identity
+	leader       *flow.IdentitySkeleton
 	finalized    uint64
 	parent       *model.Block
 	block        *model.Block
-	voters       flow.IdentityList
+	voters       flow.IdentitySkeletonList
 	proposal     *model.Proposal
 	vote         *model.Vote
-	voter        *flow.Identity
+	voter        *flow.IdentitySkeleton
 	committee    *mocks.Replicas
 	verifier     *mocks.Verifier
 	validator    *Validator
@@ -46,8 +46,8 @@ type ProposalSuite struct {
 func (ps *ProposalSuite) SetupTest() {
 	// the leader is a random node for now
 	ps.finalized = uint64(rand.Uint32() + 1)
-	ps.participants = unittest.IdentityListFixture(8, unittest.WithRole(flow.RoleConsensus))
-	ps.leader = ps.participants[0]
+	ps.participants = unittest.IdentityListFixture(8, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical[flow.Identity])
+	ps.leader = &ps.participants[0].IdentitySkeleton
 
 	// the parent is the last finalized block, followed directly by a block from the leader
 	ps.parent = helper.MakeBlock(
@@ -69,7 +69,7 @@ func (ps *ProposalSuite) SetupTest() {
 	voterIDs, err := signature.DecodeSignerIndicesToIdentifiers(ps.participants.NodeIDs(), ps.block.QC.SignerIndices)
 	require.NoError(ps.T(), err)
 
-	ps.voters = ps.participants.Filter(filter.HasNodeID(voterIDs...))
+	ps.voters = ps.participants.Filter(filter.HasNodeID[flow.Identity](voterIDs...)).ToSkeleton()
 	ps.proposal = &model.Proposal{Block: ps.block}
 	ps.vote = ps.proposal.ProposerVote()
 	ps.voter = ps.leader
@@ -77,15 +77,15 @@ func (ps *ProposalSuite) SetupTest() {
 	// set up the mocked hotstuff Replicas state
 	ps.committee = &mocks.Replicas{}
 	ps.committee.On("LeaderForView", ps.block.View).Return(ps.leader.NodeID, nil)
-	ps.committee.On("QuorumThresholdForView", mock.Anything).Return(committees.WeightThresholdToBuildQC(ps.participants.TotalWeight()), nil)
+	ps.committee.On("QuorumThresholdForView", mock.Anything).Return(committees.WeightThresholdToBuildQC(ps.participants.ToSkeleton().TotalWeight()), nil)
 	ps.committee.On("IdentitiesByEpoch", mock.Anything).Return(
-		func(_ uint64) flow.IdentityList {
-			return ps.participants
+		func(_ uint64) flow.IdentitySkeletonList {
+			return ps.participants.ToSkeleton()
 		},
 		nil,
 	)
 	for _, participant := range ps.participants {
-		ps.committee.On("IdentityByEpoch", mock.Anything, participant.NodeID).Return(participant, nil)
+		ps.committee.On("IdentityByEpoch", mock.Anything, participant.NodeID).Return(&participant.IdentitySkeleton, nil)
 	}
 
 	// set up the mocked verifier
@@ -152,7 +152,7 @@ func (ps *ProposalSuite) TestProposalWrongLeader() {
 	// change the hotstuff.Replicas to return a different leader
 	*ps.committee = mocks.Replicas{}
 	ps.committee.On("LeaderForView", ps.block.View).Return(ps.participants[1].NodeID, nil)
-	for _, participant := range ps.participants {
+	for _, participant := range ps.participants.ToSkeleton() {
 		ps.committee.On("IdentityByEpoch", mock.Anything, participant.NodeID).Return(participant, nil)
 	}
 
@@ -465,7 +465,7 @@ func TestValidateVote(t *testing.T) {
 
 type VoteSuite struct {
 	suite.Suite
-	signer    *flow.Identity
+	signer    *flow.IdentitySkeleton
 	block     *model.Block
 	vote      *model.Vote
 	verifier  *mocks.Verifier
@@ -476,7 +476,7 @@ type VoteSuite struct {
 func (vs *VoteSuite) SetupTest() {
 
 	// create a random signing identity
-	vs.signer = unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus))
+	vs.signer = &unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus)).IdentitySkeleton
 
 	// create a block that should be signed
 	vs.block = helper.MakeBlock()
@@ -570,8 +570,8 @@ func TestValidateQC(t *testing.T) {
 
 type QCSuite struct {
 	suite.Suite
-	participants flow.IdentityList
-	signers      flow.IdentityList
+	participants flow.IdentitySkeletonList
+	signers      flow.IdentitySkeletonList
 	block        *model.Block
 	qc           *flow.QuorumCertificate
 	committee    *mocks.Replicas
@@ -583,8 +583,8 @@ func (qs *QCSuite) SetupTest() {
 	// create a list of 10 nodes with 1-weight each
 	qs.participants = unittest.IdentityListFixture(10,
 		unittest.WithRole(flow.RoleConsensus),
-		unittest.WithWeight(1),
-	)
+		unittest.WithInitialWeight(1),
+	).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
 
 	// signers are a qualified majority at 7
 	qs.signers = qs.participants[:7]
@@ -599,7 +599,7 @@ func (qs *QCSuite) SetupTest() {
 	// return the correct participants and identities from view state
 	qs.committee = &mocks.Replicas{}
 	qs.committee.On("IdentitiesByEpoch", mock.Anything).Return(
-		func(_ uint64) flow.IdentityList {
+		func(_ uint64) flow.IdentitySkeletonList {
 			return qs.participants
 		},
 		nil,
@@ -726,8 +726,8 @@ func TestValidateTC(t *testing.T) {
 
 type TCSuite struct {
 	suite.Suite
-	participants flow.IdentityList
-	signers      flow.IdentityList
+	participants flow.IdentitySkeletonList
+	signers      flow.IdentitySkeletonList
 	indices      []byte
 	block        *model.Block
 	tc           *flow.TimeoutCertificate
@@ -741,8 +741,8 @@ func (s *TCSuite) SetupTest() {
 	// create a list of 10 nodes with 1-weight each
 	s.participants = unittest.IdentityListFixture(10,
 		unittest.WithRole(flow.RoleConsensus),
-		unittest.WithWeight(1),
-	)
+		unittest.WithInitialWeight(1),
+	).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
 
 	// signers are a qualified majority at 7
 	s.signers = s.participants[:7]
@@ -775,7 +775,7 @@ func (s *TCSuite) SetupTest() {
 	// return the correct participants and identities from view state
 	s.committee = &mocks.DynamicCommittee{}
 	s.committee.On("IdentitiesByEpoch", mock.Anything, mock.Anything).Return(
-		func(view uint64) flow.IdentityList {
+		func(view uint64) flow.IdentitySkeletonList {
 			return s.participants
 		},
 		nil,
diff --git a/consensus/hotstuff/verification/combined_signer_v2_test.go b/consensus/hotstuff/verification/combined_signer_v2_test.go
index 776008c01c8..b736e1ebb27 100644
--- a/consensus/hotstuff/verification/combined_signer_v2_test.go
+++ b/consensus/hotstuff/verification/combined_signer_v2_test.go
@@ -40,11 +40,11 @@ func TestCombinedSignWithBeaconKey(t *testing.T) {
 	beaconKeyStore.On("ByView", view).Return(beaconKey, nil)
 
 	stakingPriv := unittest.StakingPrivKeyFixture()
-	nodeID := unittest.IdentityFixture()
+	nodeID := &unittest.IdentityFixture().IdentitySkeleton
 	nodeID.NodeID = signerID
 	nodeID.StakingPubKey = stakingPriv.PublicKey()
 
-	me, err := local.New(nodeID, stakingPriv)
+	me, err := local.New(*nodeID, stakingPriv)
 	require.NoError(t, err)
 	signer := NewCombinedSigner(me, beaconKeyStore)
 
@@ -96,7 +96,7 @@ func TestCombinedSignWithBeaconKey(t *testing.T) {
 	require.ErrorIs(t, err, model.ErrInvalidSignature)
 
 	// vote by different signer should be invalid
-	wrongVoter := identities[1]
+	wrongVoter := &identities[1].IdentitySkeleton
 	wrongVoter.StakingPubKey = unittest.StakingPrivKeyFixture().PublicKey()
 	err = verifier.VerifyVote(wrongVoter, vote.SigData, block.View, block.BlockID)
 	require.ErrorIs(t, err, model.ErrInvalidSignature)
@@ -133,11 +133,11 @@ func TestCombinedSignWithNoBeaconKey(t *testing.T) {
 	beaconKeyStore.On("ByView", view).Return(nil, module.ErrNoBeaconKeyForEpoch)
 
 	stakingPriv := unittest.StakingPrivKeyFixture()
-	nodeID := unittest.IdentityFixture()
+	nodeID := &unittest.IdentityFixture().IdentitySkeleton
 	nodeID.NodeID = signerID
 	nodeID.StakingPubKey = stakingPriv.PublicKey()
 
-	me, err := local.New(nodeID, stakingPriv)
+	me, err := local.New(*nodeID, stakingPriv)
 	require.NoError(t, err)
 	signer := NewCombinedSigner(me, beaconKeyStore)
 
@@ -200,7 +200,7 @@ func Test_VerifyQC_EmptySigners(t *testing.T) {
 	sigData, err := encoder.Encode(&emptySignersInput)
 	require.NoError(t, err)
 
-	err = verifier.VerifyQC([]*flow.Identity{}, sigData, block.View, block.BlockID)
+	err = verifier.VerifyQC(flow.IdentitySkeletonList{}, sigData, block.View, block.BlockID)
 	require.True(t, model.IsInsufficientSignaturesError(err))
 
 	err = verifier.VerifyQC(nil, sigData, block.View, block.BlockID)
@@ -218,7 +218,7 @@ func TestCombinedSign_BeaconKeyStore_ViewForUnknownEpoch(t *testing.T) {
 	nodeID := unittest.IdentityFixture()
 	nodeID.StakingPubKey = stakingPriv.PublicKey()
 
-	me, err := local.New(nodeID, stakingPriv)
+	me, err := local.New(nodeID.IdentitySkeleton, stakingPriv)
 	require.NoError(t, err)
 	signer := NewCombinedSigner(me, beaconKeyStore)
 
diff --git a/consensus/hotstuff/verification/combined_signer_v3_test.go b/consensus/hotstuff/verification/combined_signer_v3_test.go
index 2e533e4f92a..eaab5d6ac47 100644
--- a/consensus/hotstuff/verification/combined_signer_v3_test.go
+++ b/consensus/hotstuff/verification/combined_signer_v3_test.go
@@ -40,11 +40,11 @@ func TestCombinedSignWithBeaconKeyV3(t *testing.T) {
 	beaconKeyStore.On("ByView", view).Return(beaconKey, nil)
 
 	stakingPriv := unittest.StakingPrivKeyFixture()
-	nodeID := unittest.IdentityFixture()
+	nodeID := &unittest.IdentityFixture().IdentitySkeleton
 	nodeID.NodeID = signerID
 	nodeID.StakingPubKey = stakingPriv.PublicKey()
 
-	me, err := local.New(nodeID, stakingPriv)
+	me, err := local.New(*nodeID, stakingPriv)
 	require.NoError(t, err)
 	signer := NewCombinedSignerV3(me, beaconKeyStore)
 
@@ -100,11 +100,11 @@ func TestCombinedSignWithNoBeaconKeyV3(t *testing.T) {
 	beaconKeyStore.On("ByView", view).Return(nil, module.ErrNoBeaconKeyForEpoch)
 
 	stakingPriv := unittest.StakingPrivKeyFixture()
-	nodeID := unittest.IdentityFixture()
+	nodeID := &unittest.IdentityFixture().IdentitySkeleton
 	nodeID.NodeID = signerID
 	nodeID.StakingPubKey = stakingPriv.PublicKey()
 
-	me, err := local.New(nodeID, stakingPriv)
+	me, err := local.New(*nodeID, stakingPriv)
 	require.NoError(t, err)
 	signer := NewCombinedSignerV3(me, beaconKeyStore)
 
@@ -161,7 +161,7 @@ func Test_VerifyQCV3(t *testing.T) {
 	stakingSigners := generateIdentitiesForPrivateKeys(t, privStakingKeys)
 	rbSigners := generateIdentitiesForPrivateKeys(t, privRbKeyShares)
 	registerPublicRbKeys(t, dkg, rbSigners.NodeIDs(), privRbKeyShares)
-	allSigners := append(append(flow.IdentityList{}, stakingSigners...), rbSigners...)
+	allSigners := append(append(flow.IdentityList{}, stakingSigners...), rbSigners...).ToSkeleton()
 
 	packedSigData := unittest.RandomBytes(1021)
 	unpackedSigData := hotstuff.BlockSignatureData{
@@ -272,7 +272,7 @@ func Test_VerifyQC_EmptySignersV3(t *testing.T) {
 	sigData, err := encoder.Encode(&emptySignersInput)
 	require.NoError(t, err)
 
-	err = verifier.VerifyQC([]*flow.Identity{}, sigData, block.View, block.BlockID)
+	err = verifier.VerifyQC(flow.IdentitySkeletonList{}, sigData, block.View, block.BlockID)
 	require.True(t, model.IsInsufficientSignaturesError(err))
 
 	err = verifier.VerifyQC(nil, sigData, block.View, block.BlockID)
@@ -290,7 +290,7 @@ func TestCombinedSign_BeaconKeyStore_ViewForUnknownEpochv3(t *testing.T) {
 	nodeID := unittest.IdentityFixture()
 	nodeID.StakingPubKey = stakingPriv.PublicKey()
 
-	me, err := local.New(nodeID, stakingPriv)
+	me, err := local.New(nodeID.IdentitySkeleton, stakingPriv)
 	require.NoError(t, err)
 	signer := NewCombinedSigner(me, beaconKeyStore)
 
diff --git a/consensus/hotstuff/verification/combined_verifier_v2.go b/consensus/hotstuff/verification/combined_verifier_v2.go
index c66e8c35c4f..73e1043cc11 100644
--- a/consensus/hotstuff/verification/combined_verifier_v2.go
+++ b/consensus/hotstuff/verification/combined_verifier_v2.go
@@ -51,7 +51,7 @@ func NewCombinedVerifier(committee hotstuff.Replicas, packer hotstuff.Packer) *C
 //   - model.ErrViewForUnknownEpoch if no epoch containing the given view is known
 //   - unexpected errors should be treated as symptoms of bugs or uncovered
 //     edge cases in the logic (i.e. as fatal)
-func (c *CombinedVerifier) VerifyVote(signer *flow.Identity, sigData []byte, view uint64, blockID flow.Identifier) error {
+func (c *CombinedVerifier) VerifyVote(signer *flow.IdentitySkeleton, sigData []byte, view uint64, blockID flow.Identifier) error {
 
 	// create the to-be-signed message
 	msg := MakeVoteMessage(view, blockID)
@@ -118,7 +118,7 @@ func (c *CombinedVerifier) VerifyVote(signer *flow.Identity, sigData []byte, vie
 //   - model.ErrInvalidSignature if a signature is invalid
 //   - model.ErrViewForUnknownEpoch if no epoch containing the given view is known
 //   - error if running into any unexpected exception (i.e. fatal error)
-func (c *CombinedVerifier) VerifyQC(signers flow.IdentityList, sigData []byte, view uint64, blockID flow.Identifier) error {
+func (c *CombinedVerifier) VerifyQC(signers flow.IdentitySkeletonList, sigData []byte, view uint64, blockID flow.Identifier) error {
 	dkg, err := c.committee.DKG(view)
 	if err != nil {
 		return fmt.Errorf("could not get dkg data: %w", err)
@@ -158,7 +158,7 @@ func (c *CombinedVerifier) VerifyQC(signers flow.IdentityList, sigData []byte, v
 //   - model.ErrInvalidSignature if a signature is invalid
 //   - unexpected errors should be treated as symptoms of bugs or uncovered
 //     edge cases in the logic (i.e. as fatal)
-func (c *CombinedVerifier) VerifyTC(signers flow.IdentityList, sigData []byte, view uint64, highQCViews []uint64) error {
+func (c *CombinedVerifier) VerifyTC(signers flow.IdentitySkeletonList, sigData []byte, view uint64, highQCViews []uint64) error {
 	stakingPks := signers.PublicStakingKeys()
 	return verifyTCSignatureManyMessages(stakingPks, sigData, view, highQCViews, c.timeoutObjectHasher)
 }
diff --git a/consensus/hotstuff/verification/combined_verifier_v3.go b/consensus/hotstuff/verification/combined_verifier_v3.go
index 0154f364424..6b2c0507381 100644
--- a/consensus/hotstuff/verification/combined_verifier_v3.go
+++ b/consensus/hotstuff/verification/combined_verifier_v3.go
@@ -55,7 +55,7 @@ func NewCombinedVerifierV3(committee hotstuff.Replicas, packer hotstuff.Packer)
 //
 // This implementation already support the cases, where the DKG committee is a
 // _strict subset_ of the full consensus committee.
-func (c *CombinedVerifierV3) VerifyVote(signer *flow.Identity, sigData []byte, view uint64, blockID flow.Identifier) error {
+func (c *CombinedVerifierV3) VerifyVote(signer *flow.IdentitySkeleton, sigData []byte, view uint64, blockID flow.Identifier) error {
 
 	// create the to-be-signed message
 	msg := MakeVoteMessage(view, blockID)
@@ -123,7 +123,7 @@ func (c *CombinedVerifierV3) VerifyVote(signer *flow.Identity, sigData []byte, v
 //
 // This implementation already support the cases, where the DKG committee is a
 // _strict subset_ of the full consensus committee.
-func (c *CombinedVerifierV3) VerifyQC(signers flow.IdentityList, sigData []byte, view uint64, blockID flow.Identifier) error {
+func (c *CombinedVerifierV3) VerifyQC(signers flow.IdentitySkeletonList, sigData []byte, view uint64, blockID flow.Identifier) error {
 	signerIdentities := signers.Lookup()
 	dkg, err := c.committee.DKG(view)
 	if err != nil {
@@ -225,7 +225,7 @@ func (c *CombinedVerifierV3) VerifyQC(signers flow.IdentityList, sigData []byte,
 //   - model.ErrInvalidSignature if a signature is invalid
 //   - unexpected errors should be treated as symptoms of bugs or uncovered
 //     edge cases in the logic (i.e. as fatal)
-func (c *CombinedVerifierV3) VerifyTC(signers flow.IdentityList, sigData []byte, view uint64, highQCViews []uint64) error {
+func (c *CombinedVerifierV3) VerifyTC(signers flow.IdentitySkeletonList, sigData []byte, view uint64, highQCViews []uint64) error {
 	stakingPks := signers.PublicStakingKeys()
 	return verifyTCSignatureManyMessages(stakingPks, sigData, view, highQCViews, c.timeoutObjectHasher)
 }
diff --git a/consensus/hotstuff/verification/staking_signer_test.go b/consensus/hotstuff/verification/staking_signer_test.go
index fc563266f92..69f31bdfed3 100644
--- a/consensus/hotstuff/verification/staking_signer_test.go
+++ b/consensus/hotstuff/verification/staking_signer_test.go
@@ -47,11 +47,11 @@ func TestStakingSigner_CreateProposal(t *testing.T) {
 		require.Nil(t, proposal)
 	})
 	t.Run("created-proposal", func(t *testing.T) {
-		me, err := local.New(signer, stakingPriv)
+		me, err := local.New(signer.IdentitySkeleton, stakingPriv)
 		require.NoError(t, err)
 
-		signerIdentity := unittest.IdentityFixture(unittest.WithNodeID(signerID),
-			unittest.WithStakingPubKey(stakingPriv.PublicKey()))
+		signerIdentity := &unittest.IdentityFixture(unittest.WithNodeID(signerID),
+			unittest.WithStakingPubKey(stakingPriv.PublicKey())).IdentitySkeleton
 
 		signer := NewStakingSigner(me)
 
@@ -88,11 +88,11 @@ func TestStakingSigner_CreateVote(t *testing.T) {
 		require.Nil(t, proposal)
 	})
 	t.Run("created-vote", func(t *testing.T) {
-		me, err := local.New(signer, stakingPriv)
+		me, err := local.New(signer.IdentitySkeleton, stakingPriv)
 		require.NoError(t, err)
 
-		signerIdentity := unittest.IdentityFixture(unittest.WithNodeID(signerID),
-			unittest.WithStakingPubKey(stakingPriv.PublicKey()))
+		signerIdentity := &unittest.IdentityFixture(unittest.WithNodeID(signerID),
+			unittest.WithStakingPubKey(stakingPriv.PublicKey())).IdentitySkeleton
 
 		signer := NewStakingSigner(me)
 
@@ -114,7 +114,7 @@ func TestStakingSigner_VerifyQC(t *testing.T) {
 	sigData := unittest.RandomBytes(127)
 
 	verifier := NewStakingVerifier()
-	err := verifier.VerifyQC([]*flow.Identity{}, sigData, block.View, block.BlockID)
+	err := verifier.VerifyQC(flow.IdentitySkeletonList{}, sigData, block.View, block.BlockID)
 	require.True(t, model.IsInsufficientSignaturesError(err))
 
 	err = verifier.VerifyQC(nil, sigData, block.View, block.BlockID)
diff --git a/consensus/hotstuff/verification/staking_verifier.go b/consensus/hotstuff/verification/staking_verifier.go
index 94e6918aca4..d916adb09d3 100644
--- a/consensus/hotstuff/verification/staking_verifier.go
+++ b/consensus/hotstuff/verification/staking_verifier.go
@@ -35,7 +35,7 @@ func NewStakingVerifier() *StakingVerifier {
 //   - model.ErrInvalidSignature is the signature is invalid
 //   - unexpected errors should be treated as symptoms of bugs or uncovered
 //     edge cases in the logic (i.e. as fatal)
-func (v *StakingVerifier) VerifyVote(signer *flow.Identity, sigData []byte, view uint64, blockID flow.Identifier) error {
+func (v *StakingVerifier) VerifyVote(signer *flow.IdentitySkeleton, sigData []byte, view uint64, blockID flow.Identifier) error {
 
 	// create the to-be-signed message
 	msg := MakeVoteMessage(view, blockID)
@@ -63,7 +63,7 @@ func (v *StakingVerifier) VerifyVote(signer *flow.Identity, sigData []byte, view
 //     edge cases in the logic (i.e. as fatal)
 //
 // In the single verification case, `sigData` represents a single signature (`crypto.Signature`).
-func (v *StakingVerifier) VerifyQC(signers flow.IdentityList, sigData []byte, view uint64, blockID flow.Identifier) error {
+func (v *StakingVerifier) VerifyQC(signers flow.IdentitySkeletonList, sigData []byte, view uint64, blockID flow.Identifier) error {
 	msg := MakeVoteMessage(view, blockID)
 
 	err := verifyAggregatedSignatureOneMessage(signers.PublicStakingKeys(), sigData, v.stakingHasher, msg)
@@ -83,6 +83,6 @@ func (v *StakingVerifier) VerifyQC(signers flow.IdentityList, sigData []byte, vi
 //   - model.ErrInvalidSignature if a signature is invalid
 //   - unexpected errors should be treated as symptoms of bugs or uncovered
 //     edge cases in the logic (i.e. as fatal)
-func (v *StakingVerifier) VerifyTC(signers flow.IdentityList, sigData []byte, view uint64, highQCViews []uint64) error {
+func (v *StakingVerifier) VerifyTC(signers flow.IdentitySkeletonList, sigData []byte, view uint64, highQCViews []uint64) error {
 	return verifyTCSignatureManyMessages(signers.PublicStakingKeys(), sigData, view, highQCViews, v.timeoutObjectHasher)
 }
diff --git a/consensus/hotstuff/verifier.go b/consensus/hotstuff/verifier.go
index 126ac7f78db..354b406cdab 100644
--- a/consensus/hotstuff/verifier.go
+++ b/consensus/hotstuff/verifier.go
@@ -38,7 +38,7 @@ type Verifier interface {
 	//    where querying of DKG might fail if no epoch containing the given view is known.
 	//  * unexpected errors should be treated as symptoms of bugs or uncovered
 	//    edge cases in the logic (i.e. as fatal)
-	VerifyVote(voter *flow.Identity, sigData []byte, view uint64, blockID flow.Identifier) error
+	VerifyVote(voter *flow.IdentitySkeleton, sigData []byte, view uint64, blockID flow.Identifier) error
 
 	// VerifyQC checks the cryptographic validity of a QC's `SigData` w.r.t. the
 	// given view and blockID. It is the responsibility of the calling code to ensure that
@@ -58,7 +58,7 @@ type Verifier interface {
 	//    where querying of DKG might fail if no epoch containing the given view is known.
 	//  * unexpected errors should be treated as symptoms of bugs or uncovered
 	//	  edge cases in the logic (i.e. as fatal)
-	VerifyQC(signers flow.IdentityList, sigData []byte, view uint64, blockID flow.Identifier) error
+	VerifyQC(signers flow.IdentitySkeletonList, sigData []byte, view uint64, blockID flow.Identifier) error
 
 	// VerifyTC checks cryptographic validity of the TC's `sigData` w.r.t. the
 	// given view. It is the responsibility of the calling code to ensure
@@ -69,5 +69,5 @@ type Verifier interface {
 	//  * model.ErrInvalidSignature if a signature is invalid
 	//  * unexpected errors should be treated as symptoms of bugs or uncovered
 	//	  edge cases in the logic (i.e. as fatal)
-	VerifyTC(signers flow.IdentityList, sigData []byte, view uint64, highQCViews []uint64) error
+	VerifyTC(signers flow.IdentitySkeletonList, sigData []byte, view uint64, highQCViews []uint64) error
 }
diff --git a/consensus/hotstuff/votecollector/combined_vote_processor_v2_test.go b/consensus/hotstuff/votecollector/combined_vote_processor_v2_test.go
index 15f88a1d7fb..fe0f48c0f29 100644
--- a/consensus/hotstuff/votecollector/combined_vote_processor_v2_test.go
+++ b/consensus/hotstuff/votecollector/combined_vote_processor_v2_test.go
@@ -118,7 +118,7 @@ func (s *CombinedVoteProcessorV2TestSuite) TestProcess_InvalidSignatureFormat()
 	rapid.Check(s.T(), func(t *rapid.T) {
 		// create a signature with invalid length
 		vote := unittest.VoteForBlockFixture(s.proposal.Block, func(vote *model.Vote) {
-			vote.SigData = unittest.RandomBytes(generator.Draw(t, "sig-size").(int))
+			vote.SigData = unittest.RandomBytes(generator.Draw(t, "sig-size"))
 		})
 		err := s.processor.Process(vote)
 		require.Error(s.T(), err)
@@ -434,8 +434,8 @@ func TestCombinedVoteProcessorV2_PropertyCreatingQCCorrectness(testifyT *testing
 
 	rapid.Check(testifyT, func(t *rapid.T) {
 		// draw participants in range 1 <= participants <= maxParticipants
-		participants := rapid.Uint64Range(1, maxParticipants).Draw(t, "participants").(uint64)
-		beaconSignersCount := rapid.Uint64Range(participants/2+1, participants).Draw(t, "beaconSigners").(uint64)
+		participants := rapid.Uint64Range(1, maxParticipants).Draw(t, "participants")
+		beaconSignersCount := rapid.Uint64Range(participants/2+1, participants).Draw(t, "beaconSigners")
 		stakingSignersCount := participants - beaconSignersCount
 		require.Equal(t, participants, stakingSignersCount+beaconSignersCount)
 
@@ -638,21 +638,21 @@ func TestCombinedVoteProcessorV2_PropertyCreatingQCCorrectness(testifyT *testing
 func TestCombinedVoteProcessorV2_PropertyCreatingQCLiveness(testifyT *testing.T) {
 	rapid.Check(testifyT, func(t *rapid.T) {
 		// draw beacon signers in range 1 <= beaconSignersCount <= 53
-		beaconSignersCount := rapid.Uint64Range(1, 53).Draw(t, "beaconSigners").(uint64)
+		beaconSignersCount := rapid.Uint64Range(1, 53).Draw(t, "beaconSigners")
 		// draw staking signers in range 0 <= stakingSignersCount <= 10
-		stakingSignersCount := rapid.Uint64Range(0, 10).Draw(t, "stakingSigners").(uint64)
+		stakingSignersCount := rapid.Uint64Range(0, 10).Draw(t, "stakingSigners")
 
 		stakingWeightRange, beaconWeightRange := rapid.Uint64Range(1, 10), rapid.Uint64Range(1, 10)
 
 		minRequiredWeight := uint64(0)
 		// draw weight for each signer randomly
 		stakingSigners := unittest.IdentityListFixture(int(stakingSignersCount), func(identity *flow.Identity) {
-			identity.Weight = stakingWeightRange.Draw(t, identity.String()).(uint64)
-			minRequiredWeight += identity.Weight
+			identity.InitialWeight = stakingWeightRange.Draw(t, identity.String())
+			minRequiredWeight += identity.InitialWeight
 		})
 		beaconSigners := unittest.IdentityListFixture(int(beaconSignersCount), func(identity *flow.Identity) {
-			identity.Weight = beaconWeightRange.Draw(t, identity.String()).(uint64)
-			minRequiredWeight += identity.Weight
+			identity.InitialWeight = beaconWeightRange.Draw(t, identity.String())
+			minRequiredWeight += identity.InitialWeight
 		})
 
 		// proposing block
@@ -726,13 +726,13 @@ func TestCombinedVoteProcessorV2_PropertyCreatingQCLiveness(testifyT *testing.T)
 		for _, signer := range stakingSigners {
 			vote := unittest.VoteForBlockFixture(processor.Block(), VoteWithStakingSig())
 			vote.SignerID = signer.ID()
-			expectStakingAggregatorCalls(vote, signer.Weight)
+			expectStakingAggregatorCalls(vote, signer.InitialWeight)
 			votes = append(votes, vote)
 		}
 		for _, signer := range beaconSigners {
 			vote := unittest.VoteForBlockFixture(processor.Block(), VoteWithDoubleSig())
 			vote.SignerID = signer.ID()
-			expectStakingAggregatorCalls(vote, signer.Weight)
+			expectStakingAggregatorCalls(vote, signer.InitialWeight)
 			expectedSig := crypto.Signature(vote.SigData[msig.SigLen:])
 			reconstructor.On("Verify", vote.SignerID, expectedSig).Return(nil).Maybe()
 			reconstructor.On("TrustedAdd", vote.SignerID, expectedSig).Run(func(args mock.Arguments) {
@@ -816,7 +816,7 @@ func TestCombinedVoteProcessorV2_BuildVerifyQC(t *testing.T) {
 
 		beaconSignerStore := hsig.NewEpochAwareRandomBeaconKeyStore(epochLookup, keys)
 
-		me, err := local.New(identity, stakingPriv)
+		me, err := local.New(identity.IdentitySkeleton, stakingPriv)
 		require.NoError(t, err)
 
 		signers[identity.NodeID] = verification.NewCombinedSigner(me, beaconSignerStore)
@@ -838,7 +838,7 @@ func TestCombinedVoteProcessorV2_BuildVerifyQC(t *testing.T) {
 
 		beaconSignerStore := hsig.NewEpochAwareRandomBeaconKeyStore(epochLookup, keys)
 
-		me, err := local.New(identity, stakingPriv)
+		me, err := local.New(identity.IdentitySkeleton, stakingPriv)
 		require.NoError(t, err)
 
 		signers[identity.NodeID] = verification.NewCombinedSigner(me, beaconSignerStore)
@@ -858,8 +858,8 @@ func TestCombinedVoteProcessorV2_BuildVerifyQC(t *testing.T) {
 	require.NoError(t, err)
 
 	committee := &mockhotstuff.DynamicCommittee{}
-	committee.On("QuorumThresholdForView", mock.Anything).Return(committees.WeightThresholdToBuildQC(allIdentities.TotalWeight()), nil)
-	committee.On("IdentitiesByEpoch", block.View).Return(allIdentities, nil)
+	committee.On("QuorumThresholdForView", mock.Anything).Return(committees.WeightThresholdToBuildQC(allIdentities.ToSkeleton().TotalWeight()), nil)
+	committee.On("IdentitiesByEpoch", block.View).Return(allIdentities.ToSkeleton(), nil)
 	committee.On("IdentitiesByBlock", block.BlockID).Return(allIdentities, nil)
 	committee.On("DKG", block.View).Return(inmemDKG, nil)
 
@@ -938,7 +938,7 @@ func TestReadRandomSourceFromPackedQCV2(t *testing.T) {
 	// create a packer
 	committee := &mockhotstuff.DynamicCommittee{}
 	committee.On("IdentitiesByBlock", block.BlockID).Return(allSigners, nil)
-	committee.On("IdentitiesByEpoch", block.View).Return(allSigners, nil)
+	committee.On("IdentitiesByEpoch", block.View).Return(allSigners.ToSkeleton(), nil)
 	packer := signature.NewConsensusSigDataPacker(committee)
 
 	qc, err := buildQCWithPackerAndSigData(packer, block, blockSigData)
diff --git a/consensus/hotstuff/votecollector/combined_vote_processor_v3_test.go b/consensus/hotstuff/votecollector/combined_vote_processor_v3_test.go
index bede2e54942..1f632428c05 100644
--- a/consensus/hotstuff/votecollector/combined_vote_processor_v3_test.go
+++ b/consensus/hotstuff/votecollector/combined_vote_processor_v3_test.go
@@ -434,8 +434,8 @@ func TestCombinedVoteProcessorV3_PropertyCreatingQCCorrectness(testifyT *testing
 
 	rapid.Check(testifyT, func(t *rapid.T) {
 		// draw participants in range 1 <= participants <= maxParticipants
-		participants := rapid.Uint64Range(1, maxParticipants).Draw(t, "participants").(uint64)
-		beaconSignersCount := rapid.Uint64Range(participants/2+1, participants).Draw(t, "beaconSigners").(uint64)
+		participants := rapid.Uint64Range(1, maxParticipants).Draw(t, "participants")
+		beaconSignersCount := rapid.Uint64Range(participants/2+1, participants).Draw(t, "beaconSigners")
 		stakingSignersCount := participants - beaconSignersCount
 		require.Equal(t, participants, stakingSignersCount+beaconSignersCount)
 
@@ -749,21 +749,21 @@ func TestCombinedVoteProcessorV3_OnlyRandomBeaconSigners(testifyT *testing.T) {
 func TestCombinedVoteProcessorV3_PropertyCreatingQCLiveness(testifyT *testing.T) {
 	rapid.Check(testifyT, func(t *rapid.T) {
 		// draw beacon signers in range 1 <= beaconSignersCount <= 53
-		beaconSignersCount := rapid.Uint64Range(1, 53).Draw(t, "beaconSigners").(uint64)
+		beaconSignersCount := rapid.Uint64Range(1, 53).Draw(t, "beaconSigners")
 		// draw staking signers in range 0 <= stakingSignersCount <= 10
-		stakingSignersCount := rapid.Uint64Range(0, 10).Draw(t, "stakingSigners").(uint64)
+		stakingSignersCount := rapid.Uint64Range(0, 10).Draw(t, "stakingSigners")
 
 		stakingWeightRange, beaconWeightRange := rapid.Uint64Range(1, 10), rapid.Uint64Range(1, 10)
 
 		minRequiredWeight := uint64(0)
 		// draw weight for each signer randomly
 		stakingSigners := unittest.IdentityListFixture(int(stakingSignersCount), func(identity *flow.Identity) {
-			identity.Weight = stakingWeightRange.Draw(t, identity.String()).(uint64)
-			minRequiredWeight += identity.Weight
+			identity.InitialWeight = stakingWeightRange.Draw(t, identity.String())
+			minRequiredWeight += identity.InitialWeight
 		})
 		beaconSigners := unittest.IdentityListFixture(int(beaconSignersCount), func(identity *flow.Identity) {
-			identity.Weight = beaconWeightRange.Draw(t, identity.String()).(uint64)
-			minRequiredWeight += identity.Weight
+			identity.InitialWeight = beaconWeightRange.Draw(t, identity.String())
+			minRequiredWeight += identity.InitialWeight
 		})
 
 		// proposing block
@@ -854,7 +854,7 @@ func TestCombinedVoteProcessorV3_PropertyCreatingQCLiveness(testifyT *testing.T)
 		for _, signer := range stakingSigners {
 			vote := unittest.VoteForBlockFixture(processor.Block(), unittest.VoteWithStakingSig())
 			vote.SignerID = signer.ID()
-			weight := signer.Weight
+			weight := signer.InitialWeight
 			expectedSig := crypto.Signature(vote.SigData[1:])
 			stakingAggregator.On("Verify", vote.SignerID, expectedSig).Return(nil).Maybe()
 			stakingAggregator.On("TrustedAdd", vote.SignerID, expectedSig).Run(func(args mock.Arguments) {
@@ -865,7 +865,7 @@ func TestCombinedVoteProcessorV3_PropertyCreatingQCLiveness(testifyT *testing.T)
 		for _, signer := range beaconSigners {
 			vote := unittest.VoteForBlockFixture(processor.Block(), unittest.VoteWithBeaconSig())
 			vote.SignerID = signer.ID()
-			weight := signer.Weight
+			weight := signer.InitialWeight
 			expectedSig := crypto.Signature(vote.SigData[1:])
 			rbSigAggregator.On("Verify", vote.SignerID, expectedSig).Return(nil).Maybe()
 			rbSigAggregator.On("TrustedAdd", vote.SignerID, expectedSig).Run(func(args mock.Arguments) {
@@ -952,7 +952,7 @@ func TestCombinedVoteProcessorV3_BuildVerifyQC(t *testing.T) {
 
 		beaconSignerStore := hsig.NewEpochAwareRandomBeaconKeyStore(epochLookup, keys)
 
-		me, err := local.New(identity, stakingPriv)
+		me, err := local.New(identity.IdentitySkeleton, stakingPriv)
 		require.NoError(t, err)
 
 		signers[identity.NodeID] = verification.NewCombinedSignerV3(me, beaconSignerStore)
@@ -974,7 +974,7 @@ func TestCombinedVoteProcessorV3_BuildVerifyQC(t *testing.T) {
 
 		beaconSignerStore := hsig.NewEpochAwareRandomBeaconKeyStore(epochLookup, keys)
 
-		me, err := local.New(identity, stakingPriv)
+		me, err := local.New(identity.IdentitySkeleton, stakingPriv)
 		require.NoError(t, err)
 
 		signers[identity.NodeID] = verification.NewCombinedSignerV3(me, beaconSignerStore)
@@ -995,8 +995,8 @@ func TestCombinedVoteProcessorV3_BuildVerifyQC(t *testing.T) {
 
 	committee := &mockhotstuff.DynamicCommittee{}
 	committee.On("IdentitiesByBlock", block.BlockID).Return(allIdentities, nil)
-	committee.On("IdentitiesByEpoch", block.View).Return(allIdentities, nil)
-	committee.On("QuorumThresholdForView", mock.Anything).Return(committees.WeightThresholdToBuildQC(allIdentities.TotalWeight()), nil)
+	committee.On("IdentitiesByEpoch", block.View).Return(allIdentities.ToSkeleton(), nil)
+	committee.On("QuorumThresholdForView", mock.Anything).Return(committees.WeightThresholdToBuildQC(allIdentities.ToSkeleton().TotalWeight()), nil)
 	committee.On("DKG", block.View).Return(inmemDKG, nil)
 
 	votes := make([]*model.Vote, 0, len(allIdentities))
diff --git a/consensus/hotstuff/votecollector/staking_vote_processor_test.go b/consensus/hotstuff/votecollector/staking_vote_processor_test.go
index 0f1422b56fd..8f95ee27aa8 100644
--- a/consensus/hotstuff/votecollector/staking_vote_processor_test.go
+++ b/consensus/hotstuff/votecollector/staking_vote_processor_test.go
@@ -260,21 +260,19 @@ func TestStakingVoteProcessorV2_BuildVerifyQC(t *testing.T) {
 		stakingPriv := unittest.StakingPrivKeyFixture()
 		identity.StakingPubKey = stakingPriv.PublicKey()
 
-		me, err := local.New(identity, stakingPriv)
+		me, err := local.New(identity.IdentitySkeleton, stakingPriv)
 		require.NoError(t, err)
 
 		signers[identity.NodeID] = verification.NewStakingSigner(me)
-	})
+	}).Sort(flow.Canonical[flow.Identity])
 
 	leader := stakingSigners[0]
-
-	block := helper.MakeBlock(helper.WithBlockView(view),
-		helper.WithBlockProposer(leader.NodeID))
+	block := helper.MakeBlock(helper.WithBlockView(view), helper.WithBlockProposer(leader.NodeID))
 
 	committee := &mockhotstuff.DynamicCommittee{}
-	committee.On("IdentitiesByEpoch", block.View).Return(stakingSigners, nil)
+	committee.On("IdentitiesByEpoch", block.View).Return(stakingSigners.ToSkeleton(), nil)
 	committee.On("IdentitiesByBlock", block.BlockID).Return(stakingSigners, nil)
-	committee.On("QuorumThresholdForView", mock.Anything).Return(committees.WeightThresholdToBuildQC(stakingSigners.TotalWeight()), nil)
+	committee.On("QuorumThresholdForView", mock.Anything).Return(committees.WeightThresholdToBuildQC(stakingSigners.ToSkeleton().TotalWeight()), nil)
 
 	votes := make([]*model.Vote, 0, len(stakingSigners))
 
diff --git a/consensus/integration/epoch_test.go b/consensus/integration/epoch_test.go
index 2a218fbd2b8..b2a57a3b3ad 100644
--- a/consensus/integration/epoch_test.go
+++ b/consensus/integration/epoch_test.go
@@ -11,15 +11,13 @@ import (
 	"github.com/onflow/flow-go/model/encodable"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/flow/filter"
-	"github.com/onflow/flow-go/model/flow/mapfunc"
+	"github.com/onflow/flow-go/state/protocol"
 	"github.com/onflow/flow-go/state/protocol/inmem"
 	"github.com/onflow/flow-go/utils/unittest"
 )
 
-// should be able to reach consensus when identity table contains nodes with 0 weight.
+// should be able to reach consensus when identity table contains nodes which are joining in next epoch.
 func TestUnweightedNode(t *testing.T) {
-	// stop after building 2 blocks to ensure we can tolerate 0-weight (joining next
-	// epoch) identities, but don't cross an epoch boundary
 	// stop after building 2 blocks to ensure we can tolerate 0-weight (joining next
 	// epoch) identities, but don't cross an epoch boundary
 	stopper := NewStopper(2, 0)
@@ -27,15 +25,17 @@ func TestUnweightedNode(t *testing.T) {
 	rootSnapshot := createRootSnapshot(t, participantsData)
 	consensusParticipants := NewConsensusParticipants(participantsData)
 
-	// add a consensus node to next epoch (it will have 0 weight in the current epoch)
+	// add a consensus node to next epoch (it will have `flow.EpochParticipationStatusJoining` status in the current epoch)
 	nextEpochParticipantsData := createConsensusIdentities(t, 1)
 	// epoch 2 identities includes:
 	// * same collection node from epoch 1, so cluster QCs are consistent
 	// * 1 new consensus node, joining at epoch 2
 	// * random nodes with other roles
+	currentEpochCollectionNodes, err := rootSnapshot.Identities(filter.HasRole[flow.Identity](flow.RoleCollection))
+	require.NoError(t, err)
 	nextEpochIdentities := unittest.CompleteIdentitySet(
 		append(
-			rootSnapshot.Encodable().Identities.Filter(filter.HasRole(flow.RoleCollection)),
+			currentEpochCollectionNodes,
 			nextEpochParticipantsData.Identities()...)...,
 	)
 	rootSnapshot = withNextEpoch(
@@ -119,7 +119,7 @@ func TestEpochTransition_IdentitiesOverlap(t *testing.T) {
 	removedIdentity := privateNodeInfos[0].Identity()
 	newIdentity := privateNodeInfos[3].Identity()
 	nextEpochIdentities := append(
-		firstEpochIdentities.Filter(filter.Not(filter.HasNodeID(removedIdentity.NodeID))),
+		firstEpochIdentities.Filter(filter.Not(filter.HasNodeID[flow.Identity](removedIdentity.NodeID))),
 		newIdentity,
 	)
 
@@ -170,8 +170,8 @@ func TestEpochTransition_IdentitiesDisjoint(t *testing.T) {
 
 	nextEpochParticipantData := createConsensusIdentities(t, 3)
 	nextEpochIdentities := append(
-		firstEpochIdentities.Filter(filter.Not(filter.HasRole(flow.RoleConsensus))), // remove all consensus nodes
-		nextEpochParticipantData.Identities()...,                                    // add new consensus nodes
+		firstEpochIdentities.Filter(filter.Not(filter.HasRole[flow.Identity](flow.RoleConsensus))), // remove all consensus nodes
+		nextEpochParticipantData.Identities()...,                                                   // add new consensus nodes
 	)
 
 	rootSnapshot = withNextEpoch(
@@ -217,19 +217,19 @@ func withNextEpoch(
 	// convert to encodable representation for simple modification
 	encodableSnapshot := snapshot.Encodable()
 
-	nextEpochIdentities = nextEpochIdentities.Sort(flow.Canonical)
+	currEpoch := &encodableSnapshot.Epochs.Current // take pointer so assignments apply
+	nextEpochIdentities = nextEpochIdentities.Sort(flow.Canonical[flow.Identity])
 
-	currEpoch := &encodableSnapshot.Epochs.Current                // take pointer so assignments apply
 	currEpoch.FinalView = currEpoch.FirstView + curEpochViews - 1 // first epoch lasts curEpochViews
 	encodableSnapshot.Epochs.Next = &inmem.EncodableEpoch{
 		Counter:           currEpoch.Counter + 1,
 		FirstView:         currEpoch.FinalView + 1,
 		FinalView:         currEpoch.FinalView + 1 + 10000,
 		RandomSource:      unittest.SeedFixture(flow.EpochSetupRandomSourceLength),
-		InitialIdentities: nextEpochIdentities,
+		InitialIdentities: nextEpochIdentities.ToSkeleton(),
 		// must include info corresponding to EpochCommit event, since we are
 		// starting in committed phase
-		Clustering: unittest.ClusterList(1, nextEpochIdentities),
+		Clustering: unittest.ClusterList(1, nextEpochIdentities.ToSkeleton()),
 		Clusters:   currEpoch.Clusters,
 		DKG: &inmem.EncodableDKG{
 			GroupKey: encodable.RandomBeaconPubKey{
@@ -241,20 +241,22 @@ func withNextEpoch(
 
 	participantsCache.Update(encodableSnapshot.Epochs.Next.Counter, nextEpochParticipantData)
 
-	// we must start the current epoch in committed phase so we can transition to the next epoch
-	encodableSnapshot.Phase = flow.EpochPhaseCommitted
 	encodableSnapshot.LatestSeal.ResultID = encodableSnapshot.LatestResult.ID()
 
-	// set identities for root snapshot to include next epoch identities,
-	// since we are in committed phase
-	encodableSnapshot.Identities = append(
-		// all the current epoch identities
-		encodableSnapshot.Identities,
-		// and all the NEW identities in next epoch, with 0 weight
-		nextEpochIdentities.
-			Filter(filter.Not(filter.In(encodableSnapshot.Identities))).
-			Map(mapfunc.WithWeight(0))...,
-	).Sort(flow.Canonical)
+	// update protocol state
+	protocolState := encodableSnapshot.ProtocolState
+
+	// setup ID has changed, need to update it
+	convertedEpochSetup, _ := protocol.ToEpochSetup(inmem.NewEpoch(*currEpoch))
+	protocolState.CurrentEpoch.SetupID = convertedEpochSetup.ID()
+	// create next epoch protocol state
+	convertedEpochSetup, _ = protocol.ToEpochSetup(inmem.NewEpoch(*encodableSnapshot.Epochs.Next))
+	convertedEpochCommit, _ := protocol.ToEpochCommit(inmem.NewEpoch(*encodableSnapshot.Epochs.Next))
+	protocolState.NextEpoch = &flow.EpochStateContainer{
+		SetupID:          convertedEpochSetup.ID(),
+		CommitID:         convertedEpochCommit.ID(),
+		ActiveIdentities: flow.DynamicIdentityEntryListFromIdentities(nextEpochIdentities),
+	}
 
 	return inmem.SnapshotFromEncodable(encodableSnapshot)
 }
diff --git a/consensus/integration/nodes_test.go b/consensus/integration/nodes_test.go
index 105cea370c6..c50745d7319 100644
--- a/consensus/integration/nodes_test.go
+++ b/consensus/integration/nodes_test.go
@@ -55,6 +55,7 @@ import (
 	"github.com/onflow/flow-go/state/protocol/blocktimer"
 	"github.com/onflow/flow-go/state/protocol/events"
 	"github.com/onflow/flow-go/state/protocol/inmem"
+	"github.com/onflow/flow-go/state/protocol/protocol_state"
 	"github.com/onflow/flow-go/state/protocol/util"
 	storage "github.com/onflow/flow-go/storage/badger"
 	storagemock "github.com/onflow/flow-go/storage/mock"
@@ -187,7 +188,7 @@ func buildEpochLookupList(epochs ...protocol.Epoch) []epochInfo {
 // The list of created nodes, the common network hub, and a function which starts
 // all the nodes together, is returned.
 func createNodes(t *testing.T, participants *ConsensusParticipants, rootSnapshot protocol.Snapshot, stopper *Stopper) (nodes []*Node, hub *Hub, runFor func(time.Duration)) {
-	consensus, err := rootSnapshot.Identities(filter.HasRole(flow.RoleConsensus))
+	consensus, err := rootSnapshot.Identities(filter.HasRole[flow.Identity](flow.RoleConsensus))
 	require.NoError(t, err)
 
 	epochViewLookup := buildEpochLookupList(rootSnapshot.Epochs().Current(),
@@ -256,16 +257,16 @@ func createRootBlockData(participantData *run.ParticipantData) (*flow.Block, *fl
 
 	// add other roles to create a complete identity list
 	participants := unittest.CompleteIdentitySet(consensusParticipants...)
-	participants.Sort(flow.Canonical)
+	participants.Sort(flow.Canonical[flow.Identity])
 
 	dkgParticipantsKeys := make([]crypto.PublicKey, 0, len(consensusParticipants))
-	for _, participant := range participants.Filter(filter.HasRole(flow.RoleConsensus)) {
+	for _, participant := range participants.Filter(filter.HasRole[flow.Identity](flow.RoleConsensus)) {
 		dkgParticipantsKeys = append(dkgParticipantsKeys, participantData.Lookup[participant.NodeID].KeyShare)
 	}
 
 	counter := uint64(1)
 	setup := unittest.EpochSetupFixture(
-		unittest.WithParticipants(participants),
+		unittest.WithParticipants(participants.ToSkeleton()),
 		unittest.SetupWithCounter(counter),
 		unittest.WithFirstView(root.Header.View),
 		unittest.WithFinalView(root.Header.View+1000),
@@ -279,6 +280,7 @@ func createRootBlockData(participantData *run.ParticipantData) (*flow.Block, *fl
 		},
 	)
 
+	root.SetPayload(flow.Payload{ProtocolStateID: inmem.ProtocolStateFromEpochServiceEvents(setup, commit).ID()})
 	result := unittest.BootstrapExecutionResultFixture(root, unittest.GenesisStateCommitment)
 	result.ServiceEvents = []flow.ServiceEvent{setup.ServiceEvent(), commit.ServiceEvent()}
 
@@ -288,7 +290,7 @@ func createRootBlockData(participantData *run.ParticipantData) (*flow.Block, *fl
 }
 
 func createPrivateNodeIdentities(n int) []bootstrap.NodeInfo {
-	consensus := unittest.IdentityListFixture(n, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical)
+	consensus := unittest.IdentityListFixture(n, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical[flow.Identity])
 	infos := make([]bootstrap.NodeInfo, 0, n)
 	for _, node := range consensus {
 		networkPrivKey := unittest.NetworkingPrivKeyFixture()
@@ -297,7 +299,7 @@ func createPrivateNodeIdentities(n int) []bootstrap.NodeInfo {
 			node.NodeID,
 			node.Role,
 			node.Address,
-			node.Weight,
+			node.InitialWeight,
 			networkPrivKey,
 			stakingPrivKey,
 		)
@@ -374,7 +376,8 @@ func createNode(
 	qcsDB := storage.NewQuorumCertificates(metricsCollector, db, storage.DefaultCacheSize)
 	setupsDB := storage.NewEpochSetups(metricsCollector, db)
 	commitsDB := storage.NewEpochCommits(metricsCollector, db)
-	statusesDB := storage.NewEpochStatuses(metricsCollector, db)
+	protocolStateDB := storage.NewProtocolState(metricsCollector, setupsDB, commitsDB, db,
+		storage.DefaultProtocolStateCacheSize, storage.DefaultProtocolStateByBlockIDCacheSize)
 	versionBeaconDB := storage.NewVersionBeacons(db)
 	protocolStateEvents := events.NewDistributor()
 
@@ -395,7 +398,7 @@ func createNode(
 		qcsDB,
 		setupsDB,
 		commitsDB,
-		statusesDB,
+		protocolStateDB,
 		versionBeaconDB,
 		rootSnapshot,
 	)
@@ -443,7 +446,7 @@ func createNode(
 	require.NoError(t, err)
 
 	// make local
-	me, err := local.New(identity, privateKeys.StakingKey)
+	me, err := local.New(identity.IdentitySkeleton, privateKeys.StakingKey)
 	require.NoError(t, err)
 
 	// add a network for this node to the hub
@@ -457,9 +460,32 @@ func createNode(
 
 	seals := stdmap.NewIncorporatedResultSeals(sealLimit)
 
+	mutableProtocolState := protocol_state.NewMutableProtocolState(
+		protocolStateDB,
+		state.Params(),
+		headersDB,
+		resultsDB,
+		setupsDB,
+		commitsDB,
+	)
+
 	// initialize the block builder
-	build, err := builder.NewBuilder(metricsCollector, db, fullState, headersDB, sealsDB, indexDB, blocksDB, resultsDB, receiptsDB,
-		guarantees, consensusMempools.NewIncorporatedResultSeals(seals, receiptsDB), receipts, tracer)
+	build, err := builder.NewBuilder(
+		metricsCollector,
+		db,
+		fullState,
+		headersDB,
+		sealsDB,
+		indexDB,
+		blocksDB,
+		resultsDB,
+		receiptsDB,
+		mutableProtocolState,
+		guarantees,
+		consensusMempools.NewIncorporatedResultSeals(seals, receiptsDB),
+		receipts,
+		tracer,
+	)
 	require.NoError(t, err)
 
 	// initialize the pending blocks cache
@@ -471,7 +497,6 @@ func createNode(
 	rootQC, err := rootSnapshot.QuorumCertificate()
 	require.NoError(t, err)
 
-	// selector := filter.HasRole(flow.RoleConsensus)
 	committee, err := committees.NewConsensusCommittee(state, localID)
 	require.NoError(t, err)
 	protocolStateEvents.AddConsumer(committee)
@@ -620,8 +645,8 @@ func createNode(
 	require.NoError(t, err)
 
 	identities, err := state.Final().Identities(filter.And(
-		filter.HasRole(flow.RoleConsensus),
-		filter.Not(filter.HasNodeID(me.NodeID())),
+		filter.HasRole[flow.Identity](flow.RoleConsensus),
+		filter.Not(filter.HasNodeID[flow.Identity](me.NodeID())),
 	))
 	require.NoError(t, err)
 	idProvider := id.NewFixedIdentifierProvider(identities.NodeIDs())
diff --git a/consensus/recovery/protocol/state_test.go b/consensus/recovery/protocol/state_test.go
index d22b4ef53f9..8852efe3652 100644
--- a/consensus/recovery/protocol/state_test.go
+++ b/consensus/recovery/protocol/state_test.go
@@ -21,23 +21,24 @@ import (
 func TestSaveBlockAsReplica(t *testing.T) {
 	participants := unittest.IdentityListFixture(5, unittest.WithAllRoles())
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	protocolState, err := rootSnapshot.ProtocolState()
+	require.NoError(t, err)
+	rootProtocolStateID := protocolState.Entry().ID()
 	b0, err := rootSnapshot.Head()
 	require.NoError(t, err)
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
 		b1 := unittest.BlockWithParentFixture(b0)
-		b1.SetPayload(flow.Payload{})
+		b1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 
 		err = state.Extend(context.Background(), b1)
 		require.NoError(t, err)
 
-		b2 := unittest.BlockWithParentFixture(b1.Header)
-		b2.SetPayload(flow.Payload{})
+		b2 := unittest.BlockWithParentProtocolState(b1)
 
 		err = state.Extend(context.Background(), b2)
 		require.NoError(t, err)
 
-		b3 := unittest.BlockWithParentFixture(b2.Header)
-		b3.SetPayload(flow.Payload{})
+		b3 := unittest.BlockWithParentProtocolState(b2)
 
 		err = state.Extend(context.Background(), b3)
 		require.NoError(t, err)
diff --git a/crypto_adx_flag.mk b/crypto_adx_flag.mk
index 277a4c3fbb4..0d0d5ac7467 100644
--- a/crypto_adx_flag.mk
+++ b/crypto_adx_flag.mk
@@ -1,5 +1,7 @@
-# This script can be imported by Makefiles in order to set the `CRYPTO_FLAG` automatically.
-# The `CRYPTO_FLAG` is a Go command flag that should be used when the machine's CPU executing 
+# This script can be imported by Makefiles in order to set the `CRYPTO_FLAG` automatically for 
+# a native build (build and run on the same machine NOT for cross-compilation).
+#
+# The `CRYPTO_FLAG` is a Go command flag that should be used when the target machine's CPU executing 
 # the command may not support ADX instructions.
 # For new machines that support ADX instructions, the `CRYPTO_FLAG` flag is not needed (or set
 # to an empty string).  
@@ -14,6 +16,8 @@ else
 	ADX_SUPPORT := 1
 endif
 
+DISABLE_ADX := "-O2 -D__BLST_PORTABLE__"
+
 # Then, set `CRYPTO_FLAG`
 # the crypto package uses BLST source files underneath which may use ADX instructions.
 ifeq ($(ADX_SUPPORT), 1)
@@ -21,5 +25,5 @@ ifeq ($(ADX_SUPPORT), 1)
 	CRYPTO_FLAG := ""
 else
 # if ADX instructions aren't supported, this CGO flags uses a slower non-ADX implementation 
-	CRYPTO_FLAG := "-O -D__BLST_PORTABLE__"
+	CRYPTO_FLAG := $(DISABLE_ADX)
 endif
\ No newline at end of file
diff --git a/engine/access/access_test.go b/engine/access/access_test.go
index a84ef6fac56..6a1593b615f 100644
--- a/engine/access/access_test.go
+++ b/engine/access/access_test.go
@@ -28,6 +28,7 @@ import (
 	accessmock "github.com/onflow/flow-go/engine/access/mock"
 	"github.com/onflow/flow-go/engine/access/rpc/backend"
 	connectionmock "github.com/onflow/flow-go/engine/access/rpc/connection/mock"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/flow/factory"
@@ -38,6 +39,7 @@ import (
 	"github.com/onflow/flow-go/module/metrics"
 	mockmodule "github.com/onflow/flow-go/module/mock"
 	"github.com/onflow/flow-go/module/signature"
+	"github.com/onflow/flow-go/module/state_synchronization/indexer"
 	"github.com/onflow/flow-go/network/channels"
 	"github.com/onflow/flow-go/network/mocknetwork"
 	protocol "github.com/onflow/flow-go/state/protocol/mock"
@@ -170,6 +172,7 @@ func (suite *Suite) RunTest(
 			suite.chainID.Chain(),
 			suite.finalizedHeaderCache,
 			suite.me,
+			subscription.DefaultMaxGlobalStreams,
 			access.WithBlockSignerDecoder(suite.signerIndicesDecoder),
 		)
 		f(handler, db, all)
@@ -287,7 +290,7 @@ func (suite *Suite) TestSendTransactionToRandomCollectionNode() {
 
 		// create collection node cluster
 		count := 2
-		collNodes := unittest.IdentityListFixture(count, unittest.WithRole(flow.RoleCollection))
+		collNodes := unittest.IdentityListFixture(count, unittest.WithRole(flow.RoleCollection)).ToSkeleton()
 		assignments := unittest.ClusterAssignment(uint(count), collNodes)
 		clusters, err := factory.NewClusterList(assignments, collNodes)
 		suite.Require().Nil(err)
@@ -337,7 +340,7 @@ func (suite *Suite) TestSendTransactionToRandomCollectionNode() {
 		})
 		require.NoError(suite.T(), err)
 
-		handler := access.NewHandler(bnd, suite.chainID.Chain(), suite.finalizedHeaderCache, suite.me)
+		handler := access.NewHandler(bnd, suite.chainID.Chain(), suite.finalizedHeaderCache, suite.me, subscription.DefaultMaxGlobalStreams)
 
 		// Send transaction 1
 		resp, err := handler.SendTransaction(context.Background(), sendReq1)
@@ -603,7 +606,6 @@ func (suite *Suite) TestGetSealedTransaction() {
 		block, collection := suite.createChain()
 
 		// setup mocks
-		originID := unittest.IdentifierFixture()
 		conduit := new(mocknetwork.Conduit)
 		suite.net.On("Register", channels.ReceiveReceipts, mock.Anything).Return(conduit, nil).
 			Once()
@@ -656,14 +658,26 @@ func (suite *Suite) TestGetSealedTransaction() {
 			SnapshotHistoryLimit:      backend.DefaultSnapshotHistoryLimit,
 			Communicator:              backend.NewNodeCommunicator(false),
 			TxErrorMessagesCacheSize:  1000,
+			TxResultQueryMode:         backend.IndexQueryModeExecutionNodesOnly,
 		})
 		require.NoError(suite.T(), err)
 
-		handler := access.NewHandler(bnd, suite.chainID.Chain(), suite.finalizedHeaderCache, suite.me)
+		handler := access.NewHandler(bnd, suite.chainID.Chain(), suite.finalizedHeaderCache, suite.me, subscription.DefaultMaxGlobalStreams)
+
+		collectionExecutedMetric, err := indexer.NewCollectionExecutedMetricImpl(
+			suite.log,
+			metrics,
+			collectionsToMarkFinalized,
+			collectionsToMarkExecuted,
+			blocksToMarkExecuted,
+			collections,
+			all.Blocks,
+		)
+		require.NoError(suite.T(), err)
 
 		// create the ingest engine
 		ingestEng, err := ingestion.New(suite.log, suite.net, suite.state, suite.me, suite.request, all.Blocks, all.Headers, collections,
-			transactions, results, receipts, metrics, collectionsToMarkFinalized, collectionsToMarkExecuted, blocksToMarkExecuted)
+			transactions, results, receipts, collectionExecutedMetric)
 		require.NoError(suite.T(), err)
 
 		// 1. Assume that follower engine updated the block storage and the protocol state. The block is reported as sealed
@@ -687,8 +701,9 @@ func (suite *Suite) TestGetSealedTransaction() {
 
 		// 3. Request engine is used to request missing collection
 		suite.request.On("EntityByID", collection.ID(), mock.Anything).Return()
-		// 4. Ingest engine receives the requested collection and all the execution receipts
-		ingestEng.OnCollection(originID, collection)
+		// 4. Indexer HandleCollection receives the requested collection and all the execution receipts
+		err = indexer.HandleCollection(collection, collections, transactions, suite.log, collectionExecutedMetric)
+		require.NoError(suite.T(), err)
 
 		for _, r := range executionReceipts {
 			err = ingestEng.Process(channels.ReceiveReceipts, enNodeIDs[0], r)
@@ -794,14 +809,26 @@ func (suite *Suite) TestGetTransactionResult() {
 			SnapshotHistoryLimit:      backend.DefaultSnapshotHistoryLimit,
 			Communicator:              backend.NewNodeCommunicator(false),
 			TxErrorMessagesCacheSize:  1000,
+			TxResultQueryMode:         backend.IndexQueryModeExecutionNodesOnly,
 		})
 		require.NoError(suite.T(), err)
 
-		handler := access.NewHandler(bnd, suite.chainID.Chain(), suite.finalizedHeaderCache, suite.me)
+		handler := access.NewHandler(bnd, suite.chainID.Chain(), suite.finalizedHeaderCache, suite.me, subscription.DefaultMaxGlobalStreams)
+
+		collectionExecutedMetric, err := indexer.NewCollectionExecutedMetricImpl(
+			suite.log,
+			metrics,
+			collectionsToMarkFinalized,
+			collectionsToMarkExecuted,
+			blocksToMarkExecuted,
+			collections,
+			all.Blocks,
+		)
+		require.NoError(suite.T(), err)
 
 		// create the ingest engine
 		ingestEng, err := ingestion.New(suite.log, suite.net, suite.state, suite.me, suite.request, all.Blocks, all.Headers, collections,
-			transactions, results, receipts, metrics, collectionsToMarkFinalized, collectionsToMarkExecuted, blocksToMarkExecuted)
+			transactions, results, receipts, collectionExecutedMetric)
 		require.NoError(suite.T(), err)
 
 		background, cancel := context.WithCancel(context.Background())
@@ -826,8 +853,9 @@ func (suite *Suite) TestGetTransactionResult() {
 			}
 			ingestEng.OnFinalizedBlock(mb)
 
-			// Ingest engine receives the requested collection and all the execution receipts
-			ingestEng.OnCollection(originID, collection)
+			// Indexer HandleCollection receives the requested collection and all the execution receipts
+			err = indexer.HandleCollection(collection, collections, transactions, suite.log, collectionExecutedMetric)
+			require.NoError(suite.T(), err)
 
 			for _, r := range executionReceipts {
 				err = ingestEng.Process(channels.ReceiveReceipts, enNodeIDs[0], r)
@@ -987,10 +1015,11 @@ func (suite *Suite) TestExecuteScript() {
 			Communicator:             backend.NewNodeCommunicator(false),
 			ScriptExecutionMode:      backend.IndexQueryModeExecutionNodesOnly,
 			TxErrorMessagesCacheSize: 1000,
+			TxResultQueryMode:        backend.IndexQueryModeExecutionNodesOnly,
 		})
 		require.NoError(suite.T(), err)
 
-		handler := access.NewHandler(suite.backend, suite.chainID.Chain(), suite.finalizedHeaderCache, suite.me)
+		handler := access.NewHandler(suite.backend, suite.chainID.Chain(), suite.finalizedHeaderCache, suite.me, subscription.DefaultMaxGlobalStreams)
 
 		// initialize metrics related storage
 		metrics := metrics.NewNoopCollector()
@@ -1001,12 +1030,23 @@ func (suite *Suite) TestExecuteScript() {
 		blocksToMarkExecuted, err := stdmap.NewTimes(100)
 		require.NoError(suite.T(), err)
 
+		collectionExecutedMetric, err := indexer.NewCollectionExecutedMetricImpl(
+			suite.log,
+			metrics,
+			collectionsToMarkFinalized,
+			collectionsToMarkExecuted,
+			blocksToMarkExecuted,
+			collections,
+			all.Blocks,
+		)
+		require.NoError(suite.T(), err)
+
 		conduit := new(mocknetwork.Conduit)
 		suite.net.On("Register", channels.ReceiveReceipts, mock.Anything).Return(conduit, nil).
 			Once()
 		// create the ingest engine
 		ingestEng, err := ingestion.New(suite.log, suite.net, suite.state, suite.me, suite.request, all.Blocks, all.Headers, collections,
-			transactions, results, receipts, metrics, collectionsToMarkFinalized, collectionsToMarkExecuted, blocksToMarkExecuted)
+			transactions, results, receipts, collectionExecutedMetric)
 		require.NoError(suite.T(), err)
 
 		// create another block as a predecessor of the block created earlier
@@ -1186,7 +1226,7 @@ func (suite *Suite) createChain() (*flow.Block, *flow.Collection) {
 	collection := unittest.CollectionFixture(10)
 	refBlockID := unittest.IdentifierFixture()
 	// prepare cluster committee members
-	clusterCommittee := unittest.IdentityListFixture(32 * 4).Filter(filter.HasRole(flow.RoleCollection))
+	clusterCommittee := unittest.IdentityListFixture(32 * 4).Filter(filter.HasRole[flow.Identity](flow.RoleCollection))
 	// guarantee signers must be cluster committee members, so that access will fetch collection from
 	// the signers that are specified by guarantee.SignerIndices
 	indices, err := signature.EncodeSignersToIndices(clusterCommittee.NodeIDs(), clusterCommittee.NodeIDs())
@@ -1201,7 +1241,7 @@ func (suite *Suite) createChain() (*flow.Block, *flow.Collection) {
 	block.SetPayload(unittest.PayloadFixture(unittest.WithGuarantees(guarantee)))
 
 	cluster := new(protocol.Cluster)
-	cluster.On("Members").Return(clusterCommittee, nil)
+	cluster.On("Members").Return(clusterCommittee.ToSkeleton(), nil)
 	epoch := new(protocol.Epoch)
 	epoch.On("ClusterByChainID", mock.Anything).Return(cluster, nil)
 	epochs := new(protocol.EpochQuery)
diff --git a/engine/access/apiproxy/access_api_proxy.go b/engine/access/apiproxy/access_api_proxy.go
index 2df4bd0410c..689d91de6cd 100644
--- a/engine/access/apiproxy/access_api_proxy.go
+++ b/engine/access/apiproxy/access_api_proxy.go
@@ -3,33 +3,59 @@ package apiproxy
 import (
 	"context"
 
-	"google.golang.org/grpc/status"
-
-	"github.com/rs/zerolog"
-
 	"github.com/onflow/flow/protobuf/go/flow/access"
+	"github.com/rs/zerolog"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 
+	accessflow "github.com/onflow/flow-go/access"
 	"github.com/onflow/flow-go/engine/access/rpc/connection"
 	"github.com/onflow/flow-go/engine/common/grpc/forwarder"
-	"github.com/onflow/flow-go/engine/protocol"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/metrics"
 )
 
+const (
+	LocalApiService    = "local"
+	UpstreamApiService = "upstream"
+)
+
 // FlowAccessAPIRouter is a structure that represents the routing proxy algorithm.
 // It splits requests between a local and a remote API service.
 type FlowAccessAPIRouter struct {
-	Logger   zerolog.Logger
+	logger   zerolog.Logger
+	metrics  *metrics.ObserverCollector
+	upstream *FlowAccessAPIForwarder
+	local    *accessflow.Handler
+	useIndex bool
+}
+
+type Params struct {
+	Log      zerolog.Logger
 	Metrics  *metrics.ObserverCollector
 	Upstream *FlowAccessAPIForwarder
-	Observer *protocol.Handler
+	Local    *accessflow.Handler
+	UseIndex bool
+}
+
+// NewFlowAccessAPIRouter creates FlowAccessAPIRouter instance
+func NewFlowAccessAPIRouter(params Params) *FlowAccessAPIRouter {
+	h := &FlowAccessAPIRouter{
+		logger:   params.Log,
+		metrics:  params.Metrics,
+		upstream: params.Upstream,
+		local:    params.Local,
+		useIndex: params.UseIndex,
+	}
+
+	return h
 }
 
 func (h *FlowAccessAPIRouter) log(handler, rpc string, err error) {
 	code := status.Code(err)
-	h.Metrics.RecordRPC(handler, rpc, code)
+	h.metrics.RecordRPC(handler, rpc, code)
 
-	logger := h.Logger.With().
+	logger := h.logger.With().
 		Str("handler", handler).
 		Str("grpc_method", rpc).
 		Str("grpc_code", code.String()).
@@ -46,196 +72,339 @@ func (h *FlowAccessAPIRouter) log(handler, rpc string, err error) {
 // Ping pings the service. It is special in the sense that it responds successful,
 // only if all underlying services are ready.
 func (h *FlowAccessAPIRouter) Ping(context context.Context, req *access.PingRequest) (*access.PingResponse, error) {
-	h.log("observer", "Ping", nil)
+	h.log(LocalApiService, "Ping", nil)
 	return &access.PingResponse{}, nil
 }
 
 func (h *FlowAccessAPIRouter) GetNodeVersionInfo(ctx context.Context, request *access.GetNodeVersionInfoRequest) (*access.GetNodeVersionInfoResponse, error) {
-	res, err := h.Observer.GetNodeVersionInfo(ctx, request)
-	h.log("observer", "GetNodeVersionInfo", err)
+	res, err := h.local.GetNodeVersionInfo(ctx, request)
+	h.log(LocalApiService, "GetNodeVersionInfo", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetLatestBlockHeader(context context.Context, req *access.GetLatestBlockHeaderRequest) (*access.BlockHeaderResponse, error) {
-	res, err := h.Observer.GetLatestBlockHeader(context, req)
-	h.log("observer", "GetLatestBlockHeader", err)
+	res, err := h.local.GetLatestBlockHeader(context, req)
+	h.log(LocalApiService, "GetLatestBlockHeader", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetBlockHeaderByID(context context.Context, req *access.GetBlockHeaderByIDRequest) (*access.BlockHeaderResponse, error) {
-	res, err := h.Observer.GetBlockHeaderByID(context, req)
-	h.log("observer", "GetBlockHeaderByID", err)
+	res, err := h.local.GetBlockHeaderByID(context, req)
+	h.log(LocalApiService, "GetBlockHeaderByID", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetBlockHeaderByHeight(context context.Context, req *access.GetBlockHeaderByHeightRequest) (*access.BlockHeaderResponse, error) {
-	res, err := h.Observer.GetBlockHeaderByHeight(context, req)
-	h.log("observer", "GetBlockHeaderByHeight", err)
+	res, err := h.local.GetBlockHeaderByHeight(context, req)
+	h.log(LocalApiService, "GetBlockHeaderByHeight", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetLatestBlock(context context.Context, req *access.GetLatestBlockRequest) (*access.BlockResponse, error) {
-	res, err := h.Observer.GetLatestBlock(context, req)
-	h.log("observer", "GetLatestBlock", err)
+	res, err := h.local.GetLatestBlock(context, req)
+	h.log(LocalApiService, "GetLatestBlock", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetBlockByID(context context.Context, req *access.GetBlockByIDRequest) (*access.BlockResponse, error) {
-	res, err := h.Observer.GetBlockByID(context, req)
-	h.log("observer", "GetBlockByID", err)
+	res, err := h.local.GetBlockByID(context, req)
+	h.log(LocalApiService, "GetBlockByID", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetBlockByHeight(context context.Context, req *access.GetBlockByHeightRequest) (*access.BlockResponse, error) {
-	res, err := h.Observer.GetBlockByHeight(context, req)
-	h.log("observer", "GetBlockByHeight", err)
+	res, err := h.local.GetBlockByHeight(context, req)
+	h.log(LocalApiService, "GetBlockByHeight", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetCollectionByID(context context.Context, req *access.GetCollectionByIDRequest) (*access.CollectionResponse, error) {
-	res, err := h.Upstream.GetCollectionByID(context, req)
-	h.log("upstream", "GetCollectionByID", err)
+	if h.useIndex {
+		res, err := h.local.GetCollectionByID(context, req)
+		h.log(LocalApiService, "GetCollectionByID", err)
+		return res, err
+	}
+
+	res, err := h.upstream.GetCollectionByID(context, req)
+	h.log(UpstreamApiService, "GetCollectionByID", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) SendTransaction(context context.Context, req *access.SendTransactionRequest) (*access.SendTransactionResponse, error) {
-	res, err := h.Upstream.SendTransaction(context, req)
-	h.log("upstream", "SendTransaction", err)
+	res, err := h.upstream.SendTransaction(context, req)
+	h.log(UpstreamApiService, "SendTransaction", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetTransaction(context context.Context, req *access.GetTransactionRequest) (*access.TransactionResponse, error) {
-	res, err := h.Upstream.GetTransaction(context, req)
-	h.log("upstream", "GetTransaction", err)
+	if h.useIndex {
+		res, err := h.local.GetTransaction(context, req)
+		h.log(LocalApiService, "GetTransaction", err)
+		return res, err
+	}
+
+	res, err := h.upstream.GetTransaction(context, req)
+	h.log(UpstreamApiService, "GetTransaction", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetTransactionResult(context context.Context, req *access.GetTransactionRequest) (*access.TransactionResultResponse, error) {
-	res, err := h.Upstream.GetTransactionResult(context, req)
-	h.log("upstream", "GetTransactionResult", err)
+	//TODO: add implementation for transaction error message before adding local impl
+
+	res, err := h.upstream.GetTransactionResult(context, req)
+	h.log(UpstreamApiService, "GetTransactionResult", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetTransactionResultsByBlockID(context context.Context, req *access.GetTransactionsByBlockIDRequest) (*access.TransactionResultsResponse, error) {
-	res, err := h.Upstream.GetTransactionResultsByBlockID(context, req)
-	h.log("upstream", "GetTransactionResultsByBlockID", err)
+	//TODO: add implementation for transaction error message before adding local impl
+
+	res, err := h.upstream.GetTransactionResultsByBlockID(context, req)
+	h.log(UpstreamApiService, "GetTransactionResultsByBlockID", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetTransactionsByBlockID(context context.Context, req *access.GetTransactionsByBlockIDRequest) (*access.TransactionsResponse, error) {
-	res, err := h.Upstream.GetTransactionsByBlockID(context, req)
-	h.log("upstream", "GetTransactionsByBlockID", err)
+	if h.useIndex {
+		res, err := h.local.GetTransactionsByBlockID(context, req)
+		h.log(LocalApiService, "GetTransactionsByBlockID", err)
+		return res, err
+	}
+
+	res, err := h.upstream.GetTransactionsByBlockID(context, req)
+	h.log(UpstreamApiService, "GetTransactionsByBlockID", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetTransactionResultByIndex(context context.Context, req *access.GetTransactionByIndexRequest) (*access.TransactionResultResponse, error) {
-	res, err := h.Upstream.GetTransactionResultByIndex(context, req)
-	h.log("upstream", "GetTransactionResultByIndex", err)
+	//TODO: add implementation for transaction error message before adding local impl
+
+	res, err := h.upstream.GetTransactionResultByIndex(context, req)
+	h.log(UpstreamApiService, "GetTransactionResultByIndex", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetSystemTransaction(context context.Context, req *access.GetSystemTransactionRequest) (*access.TransactionResponse, error) {
-	res, err := h.Upstream.GetSystemTransaction(context, req)
-	h.log("upstream", "GetSystemTransaction", err)
+	if h.useIndex {
+		res, err := h.local.GetSystemTransaction(context, req)
+		h.log(LocalApiService, "GetSystemTransaction", err)
+		return res, err
+	}
+
+	res, err := h.upstream.GetSystemTransaction(context, req)
+	h.log(UpstreamApiService, "GetSystemTransaction", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetSystemTransactionResult(context context.Context, req *access.GetSystemTransactionResultRequest) (*access.TransactionResultResponse, error) {
-	res, err := h.Upstream.GetSystemTransactionResult(context, req)
-	h.log("upstream", "GetSystemTransactionResult", err)
+	res, err := h.upstream.GetSystemTransactionResult(context, req)
+	h.log(UpstreamApiService, "GetSystemTransactionResult", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetAccount(context context.Context, req *access.GetAccountRequest) (*access.GetAccountResponse, error) {
-	res, err := h.Upstream.GetAccount(context, req)
-	h.log("upstream", "GetAccount", err)
+	if h.useIndex {
+		res, err := h.local.GetAccount(context, req)
+		h.log(LocalApiService, "GetAccount", err)
+		return res, err
+	}
+
+	res, err := h.upstream.GetAccount(context, req)
+	h.log(UpstreamApiService, "GetAccount", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetAccountAtLatestBlock(context context.Context, req *access.GetAccountAtLatestBlockRequest) (*access.AccountResponse, error) {
-	res, err := h.Upstream.GetAccountAtLatestBlock(context, req)
-	h.log("upstream", "GetAccountAtLatestBlock", err)
+	if h.useIndex {
+		res, err := h.local.GetAccountAtLatestBlock(context, req)
+		h.log(LocalApiService, "GetAccountAtLatestBlock", err)
+		return res, err
+	}
+
+	res, err := h.upstream.GetAccountAtLatestBlock(context, req)
+	h.log(UpstreamApiService, "GetAccountAtLatestBlock", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetAccountAtBlockHeight(context context.Context, req *access.GetAccountAtBlockHeightRequest) (*access.AccountResponse, error) {
-	res, err := h.Upstream.GetAccountAtBlockHeight(context, req)
-	h.log("upstream", "GetAccountAtBlockHeight", err)
+	if h.useIndex {
+		res, err := h.local.GetAccountAtBlockHeight(context, req)
+		h.log(LocalApiService, "GetAccountAtBlockHeight", err)
+		return res, err
+	}
+
+	res, err := h.upstream.GetAccountAtBlockHeight(context, req)
+	h.log(UpstreamApiService, "GetAccountAtBlockHeight", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) ExecuteScriptAtLatestBlock(context context.Context, req *access.ExecuteScriptAtLatestBlockRequest) (*access.ExecuteScriptResponse, error) {
-	res, err := h.Upstream.ExecuteScriptAtLatestBlock(context, req)
-	h.log("upstream", "ExecuteScriptAtLatestBlock", err)
+	if h.useIndex {
+		res, err := h.local.ExecuteScriptAtLatestBlock(context, req)
+		h.log(LocalApiService, "ExecuteScriptAtLatestBlock", err)
+		return res, err
+	}
+
+	res, err := h.upstream.ExecuteScriptAtLatestBlock(context, req)
+	h.log(UpstreamApiService, "ExecuteScriptAtLatestBlock", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) ExecuteScriptAtBlockID(context context.Context, req *access.ExecuteScriptAtBlockIDRequest) (*access.ExecuteScriptResponse, error) {
-	res, err := h.Upstream.ExecuteScriptAtBlockID(context, req)
-	h.log("upstream", "ExecuteScriptAtBlockID", err)
+	if h.useIndex {
+		res, err := h.local.ExecuteScriptAtBlockID(context, req)
+		h.log(LocalApiService, "ExecuteScriptAtBlockID", err)
+		return res, err
+	}
+
+	res, err := h.upstream.ExecuteScriptAtBlockID(context, req)
+	h.log(UpstreamApiService, "ExecuteScriptAtBlockID", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) ExecuteScriptAtBlockHeight(context context.Context, req *access.ExecuteScriptAtBlockHeightRequest) (*access.ExecuteScriptResponse, error) {
-	res, err := h.Upstream.ExecuteScriptAtBlockHeight(context, req)
-	h.log("upstream", "ExecuteScriptAtBlockHeight", err)
+	if h.useIndex {
+		res, err := h.local.ExecuteScriptAtBlockHeight(context, req)
+		h.log(LocalApiService, "ExecuteScriptAtBlockHeight", err)
+		return res, err
+	}
+
+	res, err := h.upstream.ExecuteScriptAtBlockHeight(context, req)
+	h.log(UpstreamApiService, "ExecuteScriptAtBlockHeight", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetEventsForHeightRange(context context.Context, req *access.GetEventsForHeightRangeRequest) (*access.EventsResponse, error) {
-	res, err := h.Upstream.GetEventsForHeightRange(context, req)
-	h.log("upstream", "GetEventsForHeightRange", err)
+	if h.useIndex {
+		res, err := h.local.GetEventsForHeightRange(context, req)
+		h.log(LocalApiService, "GetEventsForHeightRange", err)
+		return res, err
+	}
+
+	res, err := h.upstream.GetEventsForHeightRange(context, req)
+	h.log(UpstreamApiService, "GetEventsForHeightRange", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetEventsForBlockIDs(context context.Context, req *access.GetEventsForBlockIDsRequest) (*access.EventsResponse, error) {
-	res, err := h.Upstream.GetEventsForBlockIDs(context, req)
-	h.log("upstream", "GetEventsForBlockIDs", err)
+	if h.useIndex {
+		res, err := h.local.GetEventsForBlockIDs(context, req)
+		h.log(LocalApiService, "GetEventsForBlockIDs", err)
+		return res, err
+	}
+
+	res, err := h.upstream.GetEventsForBlockIDs(context, req)
+	h.log(UpstreamApiService, "GetEventsForBlockIDs", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetNetworkParameters(context context.Context, req *access.GetNetworkParametersRequest) (*access.GetNetworkParametersResponse, error) {
-	res, err := h.Observer.GetNetworkParameters(context, req)
-	h.log("observer", "GetNetworkParameters", err)
+	res, err := h.local.GetNetworkParameters(context, req)
+	h.log(LocalApiService, "GetNetworkParameters", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetLatestProtocolStateSnapshot(context context.Context, req *access.GetLatestProtocolStateSnapshotRequest) (*access.ProtocolStateSnapshotResponse, error) {
-	res, err := h.Observer.GetLatestProtocolStateSnapshot(context, req)
-	h.log("observer", "GetLatestProtocolStateSnapshot", err)
+	res, err := h.local.GetLatestProtocolStateSnapshot(context, req)
+	h.log(LocalApiService, "GetLatestProtocolStateSnapshot", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetProtocolStateSnapshotByBlockID(context context.Context, req *access.GetProtocolStateSnapshotByBlockIDRequest) (*access.ProtocolStateSnapshotResponse, error) {
-	res, err := h.Observer.GetProtocolStateSnapshotByBlockID(context, req)
-	h.log("observer", "GetProtocolStateSnapshotByBlockID", err)
+	res, err := h.local.GetProtocolStateSnapshotByBlockID(context, req)
+	h.log(LocalApiService, "GetProtocolStateSnapshotByBlockID", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetProtocolStateSnapshotByHeight(context context.Context, req *access.GetProtocolStateSnapshotByHeightRequest) (*access.ProtocolStateSnapshotResponse, error) {
-	res, err := h.Observer.GetProtocolStateSnapshotByHeight(context, req)
-	h.log("observer", "GetProtocolStateSnapshotByHeight", err)
+	res, err := h.local.GetProtocolStateSnapshotByHeight(context, req)
+	h.log(LocalApiService, "GetProtocolStateSnapshotByHeight", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetExecutionResultForBlockID(context context.Context, req *access.GetExecutionResultForBlockIDRequest) (*access.ExecutionResultForBlockIDResponse, error) {
-	res, err := h.Upstream.GetExecutionResultForBlockID(context, req)
-	h.log("upstream", "GetExecutionResultForBlockID", err)
+	res, err := h.upstream.GetExecutionResultForBlockID(context, req)
+	h.log(UpstreamApiService, "GetExecutionResultForBlockID", err)
 	return res, err
 }
 
 func (h *FlowAccessAPIRouter) GetExecutionResultByID(context context.Context, req *access.GetExecutionResultByIDRequest) (*access.ExecutionResultByIDResponse, error) {
-	res, err := h.Upstream.GetExecutionResultByID(context, req)
-	h.log("upstream", "GetExecutionResultByID", err)
+	if h.useIndex {
+		res, err := h.local.GetExecutionResultByID(context, req)
+		h.log(LocalApiService, "GetExecutionResultByID", err)
+		return res, err
+	}
+
+	res, err := h.upstream.GetExecutionResultByID(context, req)
+	h.log(UpstreamApiService, "GetExecutionResultByID", err)
 	return res, err
 }
 
+func (h *FlowAccessAPIRouter) SubscribeBlocksFromStartBlockID(req *access.SubscribeBlocksFromStartBlockIDRequest, server access.AccessAPI_SubscribeBlocksFromStartBlockIDServer) error {
+	err := h.local.SubscribeBlocksFromStartBlockID(req, server)
+	h.log(LocalApiService, "SubscribeBlocksFromStartBlockID", err)
+	return err
+}
+
+func (h *FlowAccessAPIRouter) SubscribeBlocksFromStartHeight(req *access.SubscribeBlocksFromStartHeightRequest, server access.AccessAPI_SubscribeBlocksFromStartHeightServer) error {
+	err := h.local.SubscribeBlocksFromStartHeight(req, server)
+	h.log(LocalApiService, "SubscribeBlocksFromStartHeight", err)
+	return err
+}
+
+func (h *FlowAccessAPIRouter) SubscribeBlocksFromLatest(req *access.SubscribeBlocksFromLatestRequest, server access.AccessAPI_SubscribeBlocksFromLatestServer) error {
+	err := h.local.SubscribeBlocksFromLatest(req, server)
+	h.log(LocalApiService, "SubscribeBlocksFromLatest", err)
+	return err
+}
+
+func (h *FlowAccessAPIRouter) SubscribeBlockHeadersFromStartBlockID(req *access.SubscribeBlockHeadersFromStartBlockIDRequest, server access.AccessAPI_SubscribeBlockHeadersFromStartBlockIDServer) error {
+	err := h.local.SubscribeBlockHeadersFromStartBlockID(req, server)
+	h.log(LocalApiService, "SubscribeBlockHeadersFromStartBlockID", err)
+	return err
+}
+
+func (h *FlowAccessAPIRouter) SubscribeBlockHeadersFromStartHeight(req *access.SubscribeBlockHeadersFromStartHeightRequest, server access.AccessAPI_SubscribeBlockHeadersFromStartHeightServer) error {
+	err := h.local.SubscribeBlockHeadersFromStartHeight(req, server)
+	h.log(LocalApiService, "SubscribeBlockHeadersFromStartHeight", err)
+	return err
+}
+
+func (h *FlowAccessAPIRouter) SubscribeBlockHeadersFromLatest(req *access.SubscribeBlockHeadersFromLatestRequest, server access.AccessAPI_SubscribeBlockHeadersFromLatestServer) error {
+	err := h.local.SubscribeBlockHeadersFromLatest(req, server)
+	h.log(LocalApiService, "SubscribeBlockHeadersFromLatest", err)
+	return err
+}
+
+func (h *FlowAccessAPIRouter) SubscribeBlockDigestsFromStartBlockID(req *access.SubscribeBlockDigestsFromStartBlockIDRequest, server access.AccessAPI_SubscribeBlockDigestsFromStartBlockIDServer) error {
+	err := h.local.SubscribeBlockDigestsFromStartBlockID(req, server)
+	h.log(LocalApiService, "SubscribeBlockDigestsFromStartBlockID", err)
+	return err
+}
+
+func (h *FlowAccessAPIRouter) SubscribeBlockDigestsFromStartHeight(req *access.SubscribeBlockDigestsFromStartHeightRequest, server access.AccessAPI_SubscribeBlockDigestsFromStartHeightServer) error {
+	err := h.local.SubscribeBlockDigestsFromStartHeight(req, server)
+	h.log(LocalApiService, "SubscribeBlockDigestsFromStartHeight", err)
+	return err
+}
+
+func (h *FlowAccessAPIRouter) SubscribeBlockDigestsFromLatest(req *access.SubscribeBlockDigestsFromLatestRequest, server access.AccessAPI_SubscribeBlockDigestsFromLatestServer) error {
+	err := h.local.SubscribeBlockDigestsFromLatest(req, server)
+	h.log(LocalApiService, "SubscribeBlockDigestsFromLatest", err)
+	return err
+}
+
+func (h *FlowAccessAPIRouter) SendAndSubscribeTransactionStatuses(req *access.SendAndSubscribeTransactionStatusesRequest, server access.AccessAPI_SendAndSubscribeTransactionStatusesServer) error {
+	//SendAndSubscribeTransactionStatuses is not implemented for observer yet
+	return status.Errorf(codes.Unimplemented, "method SendAndSubscribeTransactionStatuses not implemented")
+}
+
 // FlowAccessAPIForwarder forwards all requests to a set of upstream access nodes or observers
 type FlowAccessAPIForwarder struct {
 	*forwarder.Forwarder
 }
 
-func NewFlowAccessAPIForwarder(identities flow.IdentityList, connectionFactory connection.ConnectionFactory) (*FlowAccessAPIForwarder, error) {
+func NewFlowAccessAPIForwarder(identities flow.IdentitySkeletonList, connectionFactory connection.ConnectionFactory) (*FlowAccessAPIForwarder, error) {
 	forwarder, err := forwarder.NewForwarder(identities, connectionFactory)
 	if err != nil {
 		return nil, err
diff --git a/engine/access/apiproxy/access_api_proxy_test.go b/engine/access/apiproxy/access_api_proxy_test.go
index f1ebd601557..a4c27896f08 100644
--- a/engine/access/apiproxy/access_api_proxy_test.go
+++ b/engine/access/apiproxy/access_api_proxy_test.go
@@ -152,9 +152,9 @@ func TestNewFlowCachedAccessAPIProxy(t *testing.T) {
 		AccessMetrics:             metrics,
 		CollectionNodeGRPCTimeout: time.Second,
 		Manager: connection.NewManager(
-			nil,
 			unittest.Logger(),
 			metrics,
+			nil,
 			grpcutils.DefaultMaxMsgSize,
 			connection.CircuitBreakerConfig{},
 			grpcutils.NoCompressor,
@@ -162,7 +162,7 @@ func TestNewFlowCachedAccessAPIProxy(t *testing.T) {
 	}
 
 	// Prepare a proxy that fails due to the second connection being idle
-	l := flow.IdentityList{{Address: unittest.IPPort("11634")}, {Address: unittest.IPPort("11635")}}
+	l := flow.IdentitySkeletonList{{Address: unittest.IPPort("11634")}, {Address: unittest.IPPort("11635")}}
 	c := FlowAccessAPIForwarder{}
 	c.Forwarder, err = forwarder.NewForwarder(l, connectionFactory)
 	if err != nil {
diff --git a/engine/access/handle_irrecoverable_state_test.go b/engine/access/handle_irrecoverable_state_test.go
index 9848fed0424..f68e15805b1 100644
--- a/engine/access/handle_irrecoverable_state_test.go
+++ b/engine/access/handle_irrecoverable_state_test.go
@@ -157,6 +157,7 @@ func (suite *IrrecoverableStateTestSuite) SetupTest() {
 		Log:                  suite.log,
 		SnapshotHistoryLimit: 0,
 		Communicator:         backend.NewNodeCommunicator(false),
+		BlockTracker:         nil,
 	})
 	suite.Require().NoError(err)
 
diff --git a/engine/access/index/event_index_test.go b/engine/access/index/event_index_test.go
new file mode 100644
index 00000000000..bb8dd9c51d9
--- /dev/null
+++ b/engine/access/index/event_index_test.go
@@ -0,0 +1,82 @@
+package index
+
+import (
+	"bytes"
+	"math"
+	"sort"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/model/flow"
+	storagemock "github.com/onflow/flow-go/storage/mock"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+// TestGetEvents tests that GetEvents returns the events in the correct order
+func TestGetEvents(t *testing.T) {
+	expectedEvents := make(flow.EventsList, 0, 6)
+	expectedEvents = append(expectedEvents, generateTxEvents(unittest.IdentifierFixture(), 0, 1)...)
+	expectedEvents = append(expectedEvents, generateTxEvents(unittest.IdentifierFixture(), 1, 3)...)
+	expectedEvents = append(expectedEvents, generateTxEvents(unittest.IdentifierFixture(), 2, 2)...)
+
+	storedEvents := make([]flow.Event, len(expectedEvents))
+	copy(storedEvents, expectedEvents)
+
+	// sort events in storage order (by tx ID)
+	sort.Slice(storedEvents, func(i, j int) bool {
+		cmp := bytes.Compare(storedEvents[i].TransactionID[:], storedEvents[j].TransactionID[:])
+		if cmp == 0 {
+			if storedEvents[i].TransactionIndex == storedEvents[j].TransactionIndex {
+				return storedEvents[i].EventIndex < storedEvents[j].EventIndex
+			}
+			return storedEvents[i].TransactionIndex < storedEvents[j].TransactionIndex
+		}
+		return cmp < 0
+	})
+
+	events := storagemock.NewEvents(t)
+	header := unittest.BlockHeaderFixture()
+
+	events.On("ByBlockID", mock.Anything).Return(func(blockID flow.Identifier) ([]flow.Event, error) {
+		return storedEvents, nil
+	})
+
+	eventsIndex := NewEventsIndex(events)
+	err := eventsIndex.Initialize(&mockIndexReporter{})
+	require.NoError(t, err)
+
+	actualEvents, err := eventsIndex.ByBlockID(header.ID(), header.Height)
+	require.NoError(t, err)
+
+	// output events should be in the same order as the expected events
+	assert.Len(t, actualEvents, len(expectedEvents))
+	for i, event := range actualEvents {
+		assert.Equal(t, expectedEvents[i], event)
+	}
+}
+
+func generateTxEvents(txID flow.Identifier, txIndex uint32, count int) flow.EventsList {
+	events := make(flow.EventsList, count)
+	for i := 0; i < count; i++ {
+		events[i] = flow.Event{
+			Type:             unittest.EventTypeFixture(flow.Localnet),
+			TransactionID:    txID,
+			TransactionIndex: txIndex,
+			EventIndex:       uint32(i),
+		}
+	}
+	return events
+}
+
+type mockIndexReporter struct{}
+
+func (r *mockIndexReporter) LowestIndexedHeight() (uint64, error) {
+	return 0, nil
+}
+
+func (r *mockIndexReporter) HighestIndexedHeight() (uint64, error) {
+	return math.MaxUint64, nil
+}
diff --git a/engine/access/index/events_index.go b/engine/access/index/events_index.go
new file mode 100644
index 00000000000..c0e9b50507c
--- /dev/null
+++ b/engine/access/index/events_index.go
@@ -0,0 +1,162 @@
+package index
+
+import (
+	"fmt"
+	"sort"
+
+	"go.uber.org/atomic"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/state_synchronization"
+	"github.com/onflow/flow-go/module/state_synchronization/indexer"
+	"github.com/onflow/flow-go/storage"
+)
+
+var _ state_synchronization.IndexReporter = (*EventsIndex)(nil)
+
+// EventsIndex implements a wrapper around `storage.Events` ensuring that needed data has been synced and is available to the client.
+// Note: `EventsIndex` is created with empty report due to the next reasoning:
+// When the index is initially bootstrapped, the indexer needs to load an execution state checkpoint from
+// disk and index all the data. This process can take more than 1 hour on some systems. Consequently, the Initialize
+// pattern is implemented to enable the Access API to start up and serve queries before the index is fully ready. During
+// the initialization phase, all calls to retrieve data from this struct should return indexer.ErrIndexNotInitialized.
+// The caller is responsible for handling this error appropriately for the method.
+type EventsIndex struct {
+	events   storage.Events
+	reporter *atomic.Pointer[state_synchronization.IndexReporter]
+}
+
+func NewEventsIndex(events storage.Events) *EventsIndex {
+	return &EventsIndex{
+		events:   events,
+		reporter: atomic.NewPointer[state_synchronization.IndexReporter](nil),
+	}
+}
+
+// Initialize replaces a previously non-initialized reporter. Can be called once.
+// No errors are expected during normal operations.
+func (e *EventsIndex) Initialize(indexReporter state_synchronization.IndexReporter) error {
+	if e.reporter.CompareAndSwap(nil, &indexReporter) {
+		return nil
+	}
+	return fmt.Errorf("index reporter already initialized")
+}
+
+// ByBlockID checks data availability and returns events for a block
+// Expected errors:
+//   - indexer.ErrIndexNotInitialized if the `EventsIndex` has not been initialized
+//   - storage.ErrHeightNotIndexed when data is unavailable
+//   - codes.NotFound if result cannot be provided by storage due to the absence of data.
+func (e *EventsIndex) ByBlockID(blockID flow.Identifier, height uint64) ([]flow.Event, error) {
+	if err := e.checkDataAvailability(height); err != nil {
+		return nil, err
+	}
+
+	events, err := e.events.ByBlockID(blockID)
+	if err != nil {
+		return nil, err
+	}
+
+	// events are keyed/sorted by [blockID, txID, txIndex, eventIndex]
+	// we need to resort them by tx index then event index so the output is in execution order
+	sort.Slice(events, func(i, j int) bool {
+		if events[i].TransactionIndex == events[j].TransactionIndex {
+			return events[i].EventIndex < events[j].EventIndex
+		}
+		return events[i].TransactionIndex < events[j].TransactionIndex
+	})
+
+	return events, nil
+}
+
+// ByBlockIDTransactionID checks data availability and return events for the given block ID and transaction ID
+// Expected errors:
+//   - indexer.ErrIndexNotInitialized if the `EventsIndex` has not been initialized
+//   - storage.ErrHeightNotIndexed when data is unavailable
+//   - codes.NotFound if result cannot be provided by storage due to the absence of data.
+func (e *EventsIndex) ByBlockIDTransactionID(blockID flow.Identifier, height uint64, transactionID flow.Identifier) ([]flow.Event, error) {
+	if err := e.checkDataAvailability(height); err != nil {
+		return nil, err
+	}
+
+	return e.events.ByBlockIDTransactionID(blockID, transactionID)
+}
+
+// ByBlockIDTransactionIndex checks data availability and return events for the transaction at given index in a given block
+// Expected errors:
+//   - indexer.ErrIndexNotInitialized if the `EventsIndex` has not been initialized
+//   - storage.ErrHeightNotIndexed when data is unavailable
+//   - codes.NotFound if result cannot be provided by storage due to the absence of data.
+func (e *EventsIndex) ByBlockIDTransactionIndex(blockID flow.Identifier, height uint64, txIndex uint32) ([]flow.Event, error) {
+	if err := e.checkDataAvailability(height); err != nil {
+		return nil, err
+	}
+
+	return e.events.ByBlockIDTransactionIndex(blockID, txIndex)
+}
+
+// LowestIndexedHeight returns the lowest height indexed by the execution state indexer.
+// Expected errors:
+// - indexer.ErrIndexNotInitialized if the EventsIndex has not been initialized
+func (e *EventsIndex) LowestIndexedHeight() (uint64, error) {
+	reporter, err := e.getReporter()
+	if err != nil {
+		return 0, err
+	}
+
+	return reporter.LowestIndexedHeight()
+}
+
+// HighestIndexedHeight returns the highest height indexed by the execution state indexer.
+// Expected errors:
+// - indexer.ErrIndexNotInitialized if the EventsIndex has not been initialized
+func (e *EventsIndex) HighestIndexedHeight() (uint64, error) {
+	reporter, err := e.getReporter()
+	if err != nil {
+		return 0, err
+	}
+
+	return reporter.HighestIndexedHeight()
+}
+
+// checkDataAvailability checks the availability of data at the given height by comparing it with the highest and lowest
+// indexed heights. If the height is beyond the indexed range, an error is returned.
+// Expected errors:
+//   - indexer.ErrIndexNotInitialized if the `TransactionResultsIndex` has not been initialized
+//   - storage.ErrHeightNotIndexed if the block at the provided height is not indexed yet
+//   - fmt.Errorf with custom message if the highest or lowest indexed heights cannot be retrieved from the reporter
+func (e *EventsIndex) checkDataAvailability(height uint64) error {
+	reporter, err := e.getReporter()
+	if err != nil {
+		return err
+	}
+
+	highestHeight, err := reporter.HighestIndexedHeight()
+	if err != nil {
+		return fmt.Errorf("could not get highest indexed height: %w", err)
+	}
+	if height > highestHeight {
+		return fmt.Errorf("%w: block not indexed yet", storage.ErrHeightNotIndexed)
+	}
+
+	lowestHeight, err := reporter.LowestIndexedHeight()
+	if err != nil {
+		return fmt.Errorf("could not get lowest indexed height: %w", err)
+	}
+	if height < lowestHeight {
+		return fmt.Errorf("%w: block is before lowest indexed height", storage.ErrHeightNotIndexed)
+	}
+
+	return nil
+}
+
+// getReporter retrieves the current index reporter instance from the atomic pointer.
+// Expected errors:
+//   - indexer.ErrIndexNotInitialized if the reporter is not initialized
+func (e *EventsIndex) getReporter() (state_synchronization.IndexReporter, error) {
+	reporter := e.reporter.Load()
+	if reporter == nil {
+		return nil, indexer.ErrIndexNotInitialized
+	}
+	return *reporter, nil
+}
diff --git a/engine/access/index/transaction_results_indexer.go b/engine/access/index/transaction_results_indexer.go
new file mode 100644
index 00000000000..fd9e0f85bcf
--- /dev/null
+++ b/engine/access/index/transaction_results_indexer.go
@@ -0,0 +1,147 @@
+package index
+
+import (
+	"fmt"
+
+	"go.uber.org/atomic"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/state_synchronization"
+	"github.com/onflow/flow-go/module/state_synchronization/indexer"
+	"github.com/onflow/flow-go/storage"
+)
+
+// TransactionResultsIndex implements a wrapper around `storage.LightTransactionResult` ensuring that needed data has been synced and is available to the client.
+// Note: `TransactionResultsIndex` is created with empty report due to the next reasoning:
+// When the index is initially bootstrapped, the indexer needs to load an execution state checkpoint from
+// disk and index all the data. This process can take more than 1 hour on some systems. Consequently, the Initialize
+// pattern is implemented to enable the Access API to start up and serve queries before the index is fully ready. During
+// the initialization phase, all calls to retrieve data from this struct should return indexer.ErrIndexNotInitialized.
+// The caller is responsible for handling this error appropriately for the method.
+type TransactionResultsIndex struct {
+	results  storage.LightTransactionResults
+	reporter *atomic.Pointer[state_synchronization.IndexReporter]
+}
+
+var _ state_synchronization.IndexReporter = (*TransactionResultsIndex)(nil)
+
+func NewTransactionResultsIndex(results storage.LightTransactionResults) *TransactionResultsIndex {
+	return &TransactionResultsIndex{
+		results:  results,
+		reporter: atomic.NewPointer[state_synchronization.IndexReporter](nil),
+	}
+}
+
+// Initialize replaces a previously non-initialized reporter. Can be called once.
+// No errors are expected during normal operations.
+func (t *TransactionResultsIndex) Initialize(indexReporter state_synchronization.IndexReporter) error {
+	if t.reporter.CompareAndSwap(nil, &indexReporter) {
+		return nil
+	}
+	return fmt.Errorf("index reporter already initialized")
+}
+
+// ByBlockID checks data availability and returns all transaction results for a block
+// Expected errors:
+//   - indexer.ErrIndexNotInitialized if the `TransactionResultsIndex` has not been initialized
+//   - storage.ErrHeightNotIndexed when data is unavailable
+//   - codes.NotFound if result cannot be provided by storage due to the absence of data.
+func (t *TransactionResultsIndex) ByBlockID(blockID flow.Identifier, height uint64) ([]flow.LightTransactionResult, error) {
+	if err := t.checkDataAvailability(height); err != nil {
+		return nil, err
+	}
+
+	return t.results.ByBlockID(blockID)
+}
+
+// ByBlockIDTransactionID checks data availability and return the transaction result for the given block ID and transaction ID
+// Expected errors:
+//   - indexer.ErrIndexNotInitialized if the `TransactionResultsIndex` has not been initialized
+//   - storage.ErrHeightNotIndexed when data is unavailable
+//   - codes.NotFound if result cannot be provided by storage due to the absence of data.
+func (t *TransactionResultsIndex) ByBlockIDTransactionID(blockID flow.Identifier, height uint64, txID flow.Identifier) (*flow.LightTransactionResult, error) {
+	if err := t.checkDataAvailability(height); err != nil {
+		return nil, err
+	}
+
+	return t.results.ByBlockIDTransactionID(blockID, txID)
+}
+
+// ByBlockIDTransactionIndex checks data availability and return the transaction result for the given blockID and transaction index
+// Expected errors:
+//   - indexer.ErrIndexNotInitialized if the `TransactionResultsIndex` has not been initialized
+//   - storage.ErrHeightNotIndexed when data is unavailable
+//   - codes.NotFound when result cannot be provided by storage due to the absence of data.
+func (t *TransactionResultsIndex) ByBlockIDTransactionIndex(blockID flow.Identifier, height uint64, index uint32) (*flow.LightTransactionResult, error) {
+	if err := t.checkDataAvailability(height); err != nil {
+		return nil, err
+	}
+
+	return t.results.ByBlockIDTransactionIndex(blockID, index)
+}
+
+// LowestIndexedHeight returns the lowest height indexed by the execution state indexer.
+// Expected errors:
+// - indexer.ErrIndexNotInitialized if the `TransactionResultsIndex` has not been initialized
+func (t *TransactionResultsIndex) LowestIndexedHeight() (uint64, error) {
+	reporter, err := t.getReporter()
+	if err != nil {
+		return 0, err
+	}
+
+	return reporter.LowestIndexedHeight()
+}
+
+// HighestIndexedHeight returns the highest height indexed by the execution state indexer.
+// Expected errors:
+// - indexer.ErrIndexNotInitialized if the `TransactionResultsIndex` has not been initialized
+func (t *TransactionResultsIndex) HighestIndexedHeight() (uint64, error) {
+	reporter, err := t.getReporter()
+	if err != nil {
+		return 0, err
+	}
+
+	return reporter.HighestIndexedHeight()
+}
+
+// checkDataAvailability checks the availability of data at the given height by comparing it with the highest and lowest
+// indexed heights. If the height is beyond the indexed range, an error is returned.
+// Expected errors:
+//   - indexer.ErrIndexNotInitialized if the `TransactionResultsIndex` has not been initialized
+//   - storage.ErrHeightNotIndexed if the block at the provided height is not indexed yet
+//   - fmt.Errorf if the highest or lowest indexed heights cannot be retrieved from the reporter
+func (t *TransactionResultsIndex) checkDataAvailability(height uint64) error {
+	reporter, err := t.getReporter()
+	if err != nil {
+		return err
+	}
+
+	highestHeight, err := reporter.HighestIndexedHeight()
+	if err != nil {
+		return fmt.Errorf("could not get highest indexed height: %w", err)
+	}
+	if height > highestHeight {
+		return fmt.Errorf("%w: block not indexed yet", storage.ErrHeightNotIndexed)
+	}
+
+	lowestHeight, err := reporter.LowestIndexedHeight()
+	if err != nil {
+		return fmt.Errorf("could not get lowest indexed height: %w", err)
+	}
+	if height < lowestHeight {
+		return fmt.Errorf("%w: block is before lowest indexed height", storage.ErrHeightNotIndexed)
+	}
+
+	return nil
+}
+
+// getReporter retrieves the current index reporter instance from the atomic pointer.
+// Expected errors:
+//   - indexer.ErrIndexNotInitialized if the reporter is not initialized
+func (t *TransactionResultsIndex) getReporter() (state_synchronization.IndexReporter, error) {
+	reporter := t.reporter.Load()
+	if reporter == nil {
+		return nil, indexer.ErrIndexNotInitialized
+	}
+	return *reporter, nil
+}
diff --git a/engine/access/ingestion/engine.go b/engine/access/ingestion/engine.go
index d2349487eec..3d1c10c9cc4 100644
--- a/engine/access/ingestion/engine.go
+++ b/engine/access/ingestion/engine.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package ingestion
 
 import (
@@ -18,12 +16,11 @@ import (
 	"github.com/onflow/flow-go/module"
 	"github.com/onflow/flow-go/module/component"
 	"github.com/onflow/flow-go/module/irrecoverable"
-	"github.com/onflow/flow-go/module/mempool/stdmap"
+	"github.com/onflow/flow-go/module/state_synchronization/indexer"
 	"github.com/onflow/flow-go/network"
 	"github.com/onflow/flow-go/network/channels"
 	"github.com/onflow/flow-go/state/protocol"
 	"github.com/onflow/flow-go/storage"
-	"github.com/onflow/flow-go/utils/logging"
 )
 
 const (
@@ -86,10 +83,7 @@ type Engine struct {
 	executionResults  storage.ExecutionResults
 
 	// metrics
-	metrics                    module.AccessMetrics
-	collectionsToMarkFinalized *stdmap.Times
-	collectionsToMarkExecuted  *stdmap.Times
-	blocksToMarkExecuted       *stdmap.Times
+	collectionExecutedMetric module.CollectionExecutedMetric
 }
 
 // New creates a new access ingestion engine
@@ -105,10 +99,7 @@ func New(
 	transactions storage.Transactions,
 	executionResults storage.ExecutionResults,
 	executionReceipts storage.ExecutionReceipts,
-	accessMetrics module.AccessMetrics,
-	collectionsToMarkFinalized *stdmap.Times,
-	collectionsToMarkExecuted *stdmap.Times,
-	blocksToMarkExecuted *stdmap.Times,
+	collectionExecutedMetric module.CollectionExecutedMetric,
 ) (*Engine, error) {
 	executionReceiptsRawQueue, err := fifoqueue.NewFifoQueue(defaultQueueCapacity)
 	if err != nil {
@@ -145,21 +136,18 @@ func New(
 
 	// initialize the propagation engine with its dependencies
 	e := &Engine{
-		log:                        log.With().Str("engine", "ingestion").Logger(),
-		state:                      state,
-		me:                         me,
-		request:                    request,
-		blocks:                     blocks,
-		headers:                    headers,
-		collections:                collections,
-		transactions:               transactions,
-		executionResults:           executionResults,
-		executionReceipts:          executionReceipts,
-		maxReceiptHeight:           0,
-		metrics:                    accessMetrics,
-		collectionsToMarkFinalized: collectionsToMarkFinalized,
-		collectionsToMarkExecuted:  collectionsToMarkExecuted,
-		blocksToMarkExecuted:       blocksToMarkExecuted,
+		log:                      log.With().Str("engine", "ingestion").Logger(),
+		state:                    state,
+		me:                       me,
+		request:                  request,
+		blocks:                   blocks,
+		headers:                  headers,
+		collections:              collections,
+		transactions:             transactions,
+		executionResults:         executionResults,
+		executionReceipts:        executionReceipts,
+		maxReceiptHeight:         0,
+		collectionExecutedMetric: collectionExecutedMetric,
 
 		// queue / notifier for execution receipts
 		executionReceiptsNotifier: engine.NewNotifier(),
@@ -204,13 +192,8 @@ func (e *Engine) Start(parent irrecoverable.SignalerContext) {
 // If the index has already been initialized, this is a no-op.
 // No errors are expected during normal operation.
 func (e *Engine) initLastFullBlockHeightIndex() error {
-	rootBlock, err := e.state.Params().FinalizedRoot()
-	if err != nil {
-		return fmt.Errorf("failed to get root block: %w", err)
-	}
-
-	// insert is a noop if the index has already been initialized and no error is returned
-	err = e.blocks.InsertLastFullBlockHeightIfNotExists(rootBlock.Height)
+	rootBlock := e.state.Params().FinalizedRoot()
+	err := e.blocks.InsertLastFullBlockHeightIfNotExists(rootBlock.Height)
 	if err != nil {
 		return fmt.Errorf("failed to update last full block height during ingestion engine startup: %w", err)
 	}
@@ -220,7 +203,7 @@ func (e *Engine) initLastFullBlockHeightIndex() error {
 		return fmt.Errorf("failed to get last full block height during ingestion engine startup: %w", err)
 	}
 
-	e.metrics.UpdateLastFullBlockHeight(lastFullHeight)
+	e.collectionExecutedMetric.UpdateLastFullBlockHeight(lastFullHeight)
 
 	return nil
 }
@@ -444,41 +427,11 @@ func (e *Engine) processFinalizedBlock(blockID flow.Identifier) error {
 	// queue requesting each of the collections from the collection node
 	e.requestCollectionsInFinalizedBlock(block.Payload.Guarantees)
 
-	e.trackFinalizedMetricForBlock(block)
+	e.collectionExecutedMetric.BlockFinalized(block)
 
 	return nil
 }
 
-func (e *Engine) trackFinalizedMetricForBlock(block *flow.Block) {
-	// TODO: lookup actual finalization time by looking at the block finalizing `b`
-	now := time.Now().UTC()
-	blockID := block.ID()
-
-	// mark all transactions as finalized
-	// TODO: sample to reduce performance overhead
-	for _, g := range block.Payload.Guarantees {
-		l, err := e.collections.LightByID(g.CollectionID)
-		if errors.Is(err, storage.ErrNotFound) {
-			e.collectionsToMarkFinalized.Add(g.CollectionID, now)
-			continue
-		} else if err != nil {
-			e.log.Warn().Err(err).Str("collection_id", g.CollectionID.String()).
-				Msg("could not track tx finalized metric: finalized collection not found locally")
-			continue
-		}
-
-		for _, t := range l.Transactions {
-			e.metrics.TransactionFinalized(t, now)
-		}
-	}
-
-	if ti, found := e.blocksToMarkExecuted.ByID(blockID); found {
-		e.trackExecutedMetricForBlock(block, ti)
-		e.metrics.UpdateExecutionReceiptMaxHeight(block.Header.Height)
-		e.blocksToMarkExecuted.Remove(blockID)
-	}
-}
-
 func (e *Engine) handleExecutionReceipt(_ flow.Identifier, r *flow.ExecutionReceipt) error {
 	// persist the execution receipt locally, storing will also index the receipt
 	err := e.executionReceipts.Store(r)
@@ -486,112 +439,20 @@ func (e *Engine) handleExecutionReceipt(_ flow.Identifier, r *flow.ExecutionRece
 		return fmt.Errorf("failed to store execution receipt: %w", err)
 	}
 
-	e.trackExecutionReceiptMetrics(r)
+	e.collectionExecutedMetric.ExecutionReceiptReceived(r)
 	return nil
 }
 
-func (e *Engine) trackExecutionReceiptMetrics(r *flow.ExecutionReceipt) {
-	// TODO add actual execution time to execution receipt?
-	now := time.Now().UTC()
-
-	// retrieve the block
-	// TODO: consider using storage.Index.ByBlockID, the index contains collection id and seals ID
-	b, err := e.blocks.ByID(r.ExecutionResult.BlockID)
-
-	if errors.Is(err, storage.ErrNotFound) {
-		e.blocksToMarkExecuted.Add(r.ExecutionResult.BlockID, now)
-		return
-	}
-
-	if err != nil {
-		e.log.Warn().Err(err).Msg("could not track tx executed metric: executed block not found locally")
-		return
-	}
-
-	e.metrics.UpdateExecutionReceiptMaxHeight(b.Header.Height)
-
-	e.trackExecutedMetricForBlock(b, now)
-}
-
-func (e *Engine) trackExecutedMetricForBlock(block *flow.Block, ti time.Time) {
-	// mark all transactions as executed
-	// TODO: sample to reduce performance overhead
-	for _, g := range block.Payload.Guarantees {
-		l, err := e.collections.LightByID(g.CollectionID)
-		if errors.Is(err, storage.ErrNotFound) {
-			e.collectionsToMarkExecuted.Add(g.CollectionID, ti)
-			continue
-		} else if err != nil {
-			e.log.Warn().Err(err).Str("collection_id", g.CollectionID.String()).
-				Msg("could not track tx executed metric: executed collection not found locally")
-			continue
-		}
-
-		for _, t := range l.Transactions {
-			e.metrics.TransactionExecuted(t, ti)
-		}
-	}
-}
-
-func (e *Engine) trackExecutedMetricForCollection(light *flow.LightCollection) {
-	if ti, found := e.collectionsToMarkFinalized.ByID(light.ID()); found {
-		for _, t := range light.Transactions {
-			e.metrics.TransactionFinalized(t, ti)
-		}
-		e.collectionsToMarkFinalized.Remove(light.ID())
-	}
-
-	if ti, found := e.collectionsToMarkExecuted.ByID(light.ID()); found {
-		for _, t := range light.Transactions {
-			e.metrics.TransactionExecuted(t, ti)
-		}
-		e.collectionsToMarkExecuted.Remove(light.ID())
-	}
-}
-
-// handleCollection handles the response of the a collection request made earlier when a block was received
-func (e *Engine) handleCollection(_ flow.Identifier, entity flow.Entity) error {
-
-	// convert the entity to a strictly typed collection
+// OnCollection handles the response of the a collection request made earlier when a block was received.
+// No errors expected during normal operations.
+func (e *Engine) OnCollection(originID flow.Identifier, entity flow.Entity) {
 	collection, ok := entity.(*flow.Collection)
 	if !ok {
-		return fmt.Errorf("invalid entity type (%T)", entity)
-	}
-
-	light := collection.Light()
-
-	e.trackExecutedMetricForCollection(&light)
-
-	// FIX: we can't index guarantees here, as we might have more than one block
-	// with the same collection as long as it is not finalized
-
-	// store the light collection (collection minus the transaction body - those are stored separately)
-	// and add transaction ids as index
-	err := e.collections.StoreLightAndIndexByTransaction(&light)
-	if err != nil {
-		// ignore collection if already seen
-		if errors.Is(err, storage.ErrAlreadyExists) {
-			e.log.Debug().
-				Hex("collection_id", logging.Entity(light)).
-				Msg("collection is already seen")
-			return nil
-		}
-		return err
-	}
-
-	// now store each of the transaction body
-	for _, tx := range collection.Transactions {
-		err := e.transactions.Store(tx)
-		if err != nil {
-			return fmt.Errorf("could not store transaction (%x): %w", tx.ID(), err)
-		}
+		e.log.Error().Msgf("invalid entity type (%T)", entity)
+		return
 	}
 
-	return nil
-}
-
-func (e *Engine) OnCollection(originID flow.Identifier, entity flow.Entity) {
-	err := e.handleCollection(originID, entity)
+	err := indexer.HandleCollection(collection, e.collections, e.transactions, e.log, e.collectionExecutedMetric)
 	if err != nil {
 		e.log.Error().Err(err).Msg("could not handle collection")
 		return
@@ -727,7 +588,7 @@ func (e *Engine) updateLastFullBlockReceivedIndex() error {
 			return fmt.Errorf("failed to update last full block height")
 		}
 
-		e.metrics.UpdateLastFullBlockHeight(newLastFullHeight)
+		e.collectionExecutedMetric.UpdateLastFullBlockHeight(newLastFullHeight)
 
 		e.log.Debug().
 			Uint64("last_full_block_height", newLastFullHeight).
@@ -852,6 +713,6 @@ func (e *Engine) requestCollectionsInFinalizedBlock(missingColls []*flow.Collect
 			// failed to find guarantors for guarantees contained in a finalized block is fatal error
 			e.log.Fatal().Err(err).Msgf("could not find guarantors for guarantee %v", cg.ID())
 		}
-		e.request.EntityByID(cg.ID(), filter.HasNodeID(guarantors...))
+		e.request.EntityByID(cg.ID(), filter.HasNodeID[flow.Identity](guarantors...))
 	}
 }
diff --git a/engine/access/ingestion/engine_test.go b/engine/access/ingestion/engine_test.go
index b6753ecb144..8a844a7b49b 100644
--- a/engine/access/ingestion/engine_test.go
+++ b/engine/access/ingestion/engine_test.go
@@ -24,6 +24,7 @@ import (
 	"github.com/onflow/flow-go/module/metrics"
 	module "github.com/onflow/flow-go/module/mock"
 	"github.com/onflow/flow-go/module/signature"
+	"github.com/onflow/flow-go/module/state_synchronization/indexer"
 	"github.com/onflow/flow-go/network/channels"
 	"github.com/onflow/flow-go/network/mocknetwork"
 	protocol "github.com/onflow/flow-go/state/protocol/mock"
@@ -55,6 +56,9 @@ type Suite struct {
 	downloader     *downloadermock.Downloader
 	sealedBlock    *flow.Header
 	finalizedBlock *flow.Header
+	log            zerolog.Logger
+
+	collectionExecutedMetric *indexer.CollectionExecutedMetricImpl
 
 	eng    *Engine
 	cancel context.CancelFunc
@@ -69,7 +73,7 @@ func (s *Suite) TearDownTest() {
 }
 
 func (s *Suite) SetupTest() {
-	log := zerolog.New(os.Stderr)
+	s.log = zerolog.New(os.Stderr)
 	ctx, cancel := context.WithCancel(context.Background())
 	s.cancel = cancel
 
@@ -114,9 +118,19 @@ func (s *Suite) SetupTest() {
 	blocksToMarkExecuted, err := stdmap.NewTimes(100)
 	require.NoError(s.T(), err)
 
-	eng, err := New(log, net, s.proto.state, s.me, s.request, s.blocks, s.headers, s.collections,
-		s.transactions, s.results, s.receipts, metrics.NewNoopCollector(), collectionsToMarkFinalized, collectionsToMarkExecuted,
-		blocksToMarkExecuted)
+	s.collectionExecutedMetric, err = indexer.NewCollectionExecutedMetricImpl(
+		s.log,
+		metrics.NewNoopCollector(),
+		collectionsToMarkFinalized,
+		collectionsToMarkExecuted,
+		blocksToMarkExecuted,
+		s.collections,
+		s.blocks,
+	)
+	require.NoError(s.T(), err)
+
+	eng, err := New(s.log, net, s.proto.state, s.me, s.request, s.blocks, s.headers, s.collections,
+		s.transactions, s.results, s.receipts, s.collectionExecutedMetric)
 	require.NoError(s.T(), err)
 
 	s.blocks.On("GetLastFullBlockHeight").Once().Return(uint64(0), errors.New("do nothing"))
@@ -139,7 +153,7 @@ func (s *Suite) TestOnFinalizedBlock() {
 	))
 
 	// prepare cluster committee members
-	clusterCommittee := unittest.IdentityListFixture(32 * 4).Filter(filter.HasRole(flow.RoleCollection))
+	clusterCommittee := unittest.IdentityListFixture(32 * 4).Filter(filter.HasRole[flow.Identity](flow.RoleCollection)).ToSkeleton()
 	refBlockID := unittest.IdentifierFixture()
 	for _, guarantee := range block.Payload.Guarantees {
 		guarantee.ReferenceBlockID = refBlockID
@@ -210,7 +224,6 @@ func (s *Suite) TestOnFinalizedBlock() {
 
 // TestOnCollection checks that when a Collection is received, it is persisted
 func (s *Suite) TestOnCollection() {
-	originID := unittest.IdentifierFixture()
 	collection := unittest.CollectionFixture(5)
 	light := collection.Light()
 
@@ -230,8 +243,8 @@ func (s *Suite) TestOnCollection() {
 		},
 	)
 
-	// process the block through the collection callback
-	s.eng.OnCollection(originID, &collection)
+	err := indexer.HandleCollection(&collection, s.collections, s.transactions, s.log, s.collectionExecutedMetric)
+	require.NoError(s.T(), err)
 
 	// check that the collection was stored and indexed, and we stored all transactions
 	s.collections.AssertExpectations(s.T())
@@ -285,11 +298,9 @@ func (s *Suite) TestExecutionReceiptsAreIndexed() {
 	s.receipts.AssertExpectations(s.T())
 }
 
-// TestOnCollection checks that when a duplicate collection is received, the node doesn't
+// TestOnCollectionDuplicate checks that when a duplicate collection is received, the node doesn't
 // crash but just ignores its transactions.
 func (s *Suite) TestOnCollectionDuplicate() {
-
-	originID := unittest.IdentifierFixture()
 	collection := unittest.CollectionFixture(5)
 	light := collection.Light()
 
@@ -309,8 +320,8 @@ func (s *Suite) TestOnCollectionDuplicate() {
 		},
 	)
 
-	// process the block through the collection callback
-	s.eng.OnCollection(originID, &collection)
+	err := indexer.HandleCollection(&collection, s.collections, s.transactions, s.log, s.collectionExecutedMetric)
+	require.NoError(s.T(), err)
 
 	// check that the collection was stored and indexed, and we stored all transactions
 	s.collections.AssertExpectations(s.T())
@@ -326,7 +337,7 @@ func (s *Suite) TestRequestMissingCollections() {
 	heightMap := make(map[uint64]*flow.Block, blkCnt)
 
 	// prepare cluster committee members
-	clusterCommittee := unittest.IdentityListFixture(32 * 4).Filter(filter.HasRole(flow.RoleCollection))
+	clusterCommittee := unittest.IdentityListFixture(32 * 4).Filter(filter.HasRole[flow.Identity](flow.RoleCollection)).ToSkeleton()
 
 	// generate the test blocks and collections
 	var collIDs []flow.Identifier
@@ -469,7 +480,7 @@ func (s *Suite) TestProcessBackgroundCalls() {
 	collMap := make(map[flow.Identifier]*flow.LightCollection, blkCnt*collPerBlk)
 
 	// prepare cluster committee members
-	clusterCommittee := unittest.IdentityListFixture(32 * 4).Filter(filter.HasRole(flow.RoleCollection))
+	clusterCommittee := unittest.IdentityListFixture(32 * 4).Filter(filter.HasRole[flow.Identity](flow.RoleCollection)).ToSkeleton()
 
 	refBlockID := unittest.IdentifierFixture()
 	// generate the test blocks, cgs and collections
diff --git a/engine/access/integration_unsecure_grpc_server_test.go b/engine/access/integration_unsecure_grpc_server_test.go
index 674a9ad4d1e..2f70655bfca 100644
--- a/engine/access/integration_unsecure_grpc_server_test.go
+++ b/engine/access/integration_unsecure_grpc_server_test.go
@@ -19,11 +19,13 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 
 	"github.com/onflow/flow-go/engine"
+	"github.com/onflow/flow-go/engine/access/index"
 	accessmock "github.com/onflow/flow-go/engine/access/mock"
 	"github.com/onflow/flow-go/engine/access/rpc"
 	"github.com/onflow/flow-go/engine/access/rpc/backend"
 	"github.com/onflow/flow-go/engine/access/state_stream"
 	statestreambackend "github.com/onflow/flow-go/engine/access/state_stream/backend"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/blobs"
 	"github.com/onflow/flow-go/module/execution"
@@ -46,19 +48,20 @@ import (
 // on the same port
 type SameGRPCPortTestSuite struct {
 	suite.Suite
-	state          *protocol.State
-	snapshot       *protocol.Snapshot
-	epochQuery     *protocol.EpochQuery
-	log            zerolog.Logger
-	net            *network.EngineRegistry
-	request        *module.Requester
-	collClient     *accessmock.AccessAPIClient
-	execClient     *accessmock.ExecutionAPIClient
-	me             *module.Local
-	chainID        flow.ChainID
-	metrics        *metrics.NoopCollector
-	rpcEng         *rpc.Engine
-	stateStreamEng *statestreambackend.Engine
+	state                *protocol.State
+	snapshot             *protocol.Snapshot
+	epochQuery           *protocol.EpochQuery
+	log                  zerolog.Logger
+	net                  *network.EngineRegistry
+	request              *module.Requester
+	collClient           *accessmock.AccessAPIClient
+	execClient           *accessmock.ExecutionAPIClient
+	me                   *module.Local
+	chainID              flow.ChainID
+	metrics              *metrics.NoopCollector
+	rpcEng               *rpc.Engine
+	stateStreamEng       *statestreambackend.Engine
+	executionDataTracker subscription.ExecutionDataTracker
 
 	// storage
 	blocks       *storagemock.Blocks
@@ -120,7 +123,7 @@ func (suite *SameGRPCPortTestSuite) SetupTest() {
 
 	suite.broadcaster = engine.NewBroadcaster()
 
-	suite.execDataHeroCache = herocache.NewBlockExecutionData(state_stream.DefaultCacheSize, suite.log, metrics.NewNoopCollector())
+	suite.execDataHeroCache = herocache.NewBlockExecutionData(subscription.DefaultCacheSize, suite.log, metrics.NewNoopCollector())
 	suite.execDataCache = cache.NewExecutionDataCache(suite.eds, suite.headers, suite.seals, suite.results, suite.execDataHeroCache)
 
 	accessIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleAccess))
@@ -234,25 +237,45 @@ func (suite *SameGRPCPortTestSuite) SetupTest() {
 	).Maybe()
 
 	conf := statestreambackend.Config{
-		ClientSendTimeout:    state_stream.DefaultSendTimeout,
-		ClientSendBufferSize: state_stream.DefaultSendBufferSize,
+		ClientSendTimeout:    subscription.DefaultSendTimeout,
+		ClientSendBufferSize: subscription.DefaultSendBufferSize,
 	}
 
+	subscriptionHandler := subscription.NewSubscriptionHandler(
+		suite.log,
+		suite.broadcaster,
+		subscription.DefaultSendTimeout,
+		subscription.DefaultResponseLimit,
+		subscription.DefaultSendBufferSize,
+	)
+
+	eventIndexer := index.NewEventsIndex(suite.events)
+
+	suite.executionDataTracker = subscription.NewExecutionDataTracker(
+		suite.log,
+		suite.state,
+		rootBlock.Header.Height,
+		suite.headers,
+		nil,
+		rootBlock.Header.Height,
+		eventIndexer,
+		false,
+	)
+
 	stateStreamBackend, err := statestreambackend.New(
 		suite.log,
-		conf,
 		suite.state,
 		suite.headers,
-		suite.events,
 		suite.seals,
 		suite.results,
 		nil,
 		suite.execDataCache,
-		nil,
-		rootBlock.Header.Height,
-		rootBlock.Header.Height,
 		suite.registers,
+		eventIndexer,
 		false,
+		state_stream.DefaultRegisterIDsRequestLimit,
+		subscriptionHandler,
+		suite.executionDataTracker,
 	)
 	assert.NoError(suite.T(), err)
 
@@ -265,7 +288,6 @@ func (suite *SameGRPCPortTestSuite) SetupTest() {
 		suite.chainID,
 		suite.unsecureGrpcServer,
 		stateStreamBackend,
-		nil,
 	)
 	assert.NoError(suite.T(), err)
 
@@ -310,11 +332,11 @@ func (suite *SameGRPCPortTestSuite) TestEnginesOnTheSameGrpcPort() {
 	})
 
 	suite.Run("happy path - grpc execution data api client can connect successfully", func() {
-		req := &executiondataproto.SubscribeEventsRequest{}
+		req := &executiondataproto.SubscribeEventsFromLatestRequest{}
 
 		client := suite.unsecureExecutionDataAPIClient(conn)
 
-		_, err := client.SubscribeEvents(ctx, req)
+		_, err := client.SubscribeEventsFromLatest(ctx, req)
 		assert.NoError(suite.T(), err, "failed to subscribe events")
 	})
 	defer closer.Close()
diff --git a/engine/access/mock/access_api_client.go b/engine/access/mock/access_api_client.go
index 496ee06b58c..17630b8367a 100644
--- a/engine/access/mock/access_api_client.go
+++ b/engine/access/mock/access_api_client.go
@@ -1007,6 +1007,39 @@ func (_m *AccessAPIClient) Ping(ctx context.Context, in *access.PingRequest, opt
 	return r0, r1
 }
 
+// SendAndSubscribeTransactionStatuses provides a mock function with given fields: ctx, in, opts
+func (_m *AccessAPIClient) SendAndSubscribeTransactionStatuses(ctx context.Context, in *access.SendAndSubscribeTransactionStatusesRequest, opts ...grpc.CallOption) (access.AccessAPI_SendAndSubscribeTransactionStatusesClient, error) {
+	_va := make([]interface{}, len(opts))
+	for _i := range opts {
+		_va[_i] = opts[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx, in)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 access.AccessAPI_SendAndSubscribeTransactionStatusesClient
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SendAndSubscribeTransactionStatusesRequest, ...grpc.CallOption) (access.AccessAPI_SendAndSubscribeTransactionStatusesClient, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SendAndSubscribeTransactionStatusesRequest, ...grpc.CallOption) access.AccessAPI_SendAndSubscribeTransactionStatusesClient); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(access.AccessAPI_SendAndSubscribeTransactionStatusesClient)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *access.SendAndSubscribeTransactionStatusesRequest, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // SendTransaction provides a mock function with given fields: ctx, in, opts
 func (_m *AccessAPIClient) SendTransaction(ctx context.Context, in *access.SendTransactionRequest, opts ...grpc.CallOption) (*access.SendTransactionResponse, error) {
 	_va := make([]interface{}, len(opts))
@@ -1040,6 +1073,303 @@ func (_m *AccessAPIClient) SendTransaction(ctx context.Context, in *access.SendT
 	return r0, r1
 }
 
+// SubscribeBlockDigestsFromLatest provides a mock function with given fields: ctx, in, opts
+func (_m *AccessAPIClient) SubscribeBlockDigestsFromLatest(ctx context.Context, in *access.SubscribeBlockDigestsFromLatestRequest, opts ...grpc.CallOption) (access.AccessAPI_SubscribeBlockDigestsFromLatestClient, error) {
+	_va := make([]interface{}, len(opts))
+	for _i := range opts {
+		_va[_i] = opts[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx, in)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 access.AccessAPI_SubscribeBlockDigestsFromLatestClient
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlockDigestsFromLatestRequest, ...grpc.CallOption) (access.AccessAPI_SubscribeBlockDigestsFromLatestClient, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlockDigestsFromLatestRequest, ...grpc.CallOption) access.AccessAPI_SubscribeBlockDigestsFromLatestClient); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(access.AccessAPI_SubscribeBlockDigestsFromLatestClient)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *access.SubscribeBlockDigestsFromLatestRequest, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// SubscribeBlockDigestsFromStartBlockID provides a mock function with given fields: ctx, in, opts
+func (_m *AccessAPIClient) SubscribeBlockDigestsFromStartBlockID(ctx context.Context, in *access.SubscribeBlockDigestsFromStartBlockIDRequest, opts ...grpc.CallOption) (access.AccessAPI_SubscribeBlockDigestsFromStartBlockIDClient, error) {
+	_va := make([]interface{}, len(opts))
+	for _i := range opts {
+		_va[_i] = opts[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx, in)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 access.AccessAPI_SubscribeBlockDigestsFromStartBlockIDClient
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlockDigestsFromStartBlockIDRequest, ...grpc.CallOption) (access.AccessAPI_SubscribeBlockDigestsFromStartBlockIDClient, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlockDigestsFromStartBlockIDRequest, ...grpc.CallOption) access.AccessAPI_SubscribeBlockDigestsFromStartBlockIDClient); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(access.AccessAPI_SubscribeBlockDigestsFromStartBlockIDClient)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *access.SubscribeBlockDigestsFromStartBlockIDRequest, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// SubscribeBlockDigestsFromStartHeight provides a mock function with given fields: ctx, in, opts
+func (_m *AccessAPIClient) SubscribeBlockDigestsFromStartHeight(ctx context.Context, in *access.SubscribeBlockDigestsFromStartHeightRequest, opts ...grpc.CallOption) (access.AccessAPI_SubscribeBlockDigestsFromStartHeightClient, error) {
+	_va := make([]interface{}, len(opts))
+	for _i := range opts {
+		_va[_i] = opts[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx, in)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 access.AccessAPI_SubscribeBlockDigestsFromStartHeightClient
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlockDigestsFromStartHeightRequest, ...grpc.CallOption) (access.AccessAPI_SubscribeBlockDigestsFromStartHeightClient, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlockDigestsFromStartHeightRequest, ...grpc.CallOption) access.AccessAPI_SubscribeBlockDigestsFromStartHeightClient); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(access.AccessAPI_SubscribeBlockDigestsFromStartHeightClient)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *access.SubscribeBlockDigestsFromStartHeightRequest, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// SubscribeBlockHeadersFromLatest provides a mock function with given fields: ctx, in, opts
+func (_m *AccessAPIClient) SubscribeBlockHeadersFromLatest(ctx context.Context, in *access.SubscribeBlockHeadersFromLatestRequest, opts ...grpc.CallOption) (access.AccessAPI_SubscribeBlockHeadersFromLatestClient, error) {
+	_va := make([]interface{}, len(opts))
+	for _i := range opts {
+		_va[_i] = opts[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx, in)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 access.AccessAPI_SubscribeBlockHeadersFromLatestClient
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlockHeadersFromLatestRequest, ...grpc.CallOption) (access.AccessAPI_SubscribeBlockHeadersFromLatestClient, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlockHeadersFromLatestRequest, ...grpc.CallOption) access.AccessAPI_SubscribeBlockHeadersFromLatestClient); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(access.AccessAPI_SubscribeBlockHeadersFromLatestClient)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *access.SubscribeBlockHeadersFromLatestRequest, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// SubscribeBlockHeadersFromStartBlockID provides a mock function with given fields: ctx, in, opts
+func (_m *AccessAPIClient) SubscribeBlockHeadersFromStartBlockID(ctx context.Context, in *access.SubscribeBlockHeadersFromStartBlockIDRequest, opts ...grpc.CallOption) (access.AccessAPI_SubscribeBlockHeadersFromStartBlockIDClient, error) {
+	_va := make([]interface{}, len(opts))
+	for _i := range opts {
+		_va[_i] = opts[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx, in)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 access.AccessAPI_SubscribeBlockHeadersFromStartBlockIDClient
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlockHeadersFromStartBlockIDRequest, ...grpc.CallOption) (access.AccessAPI_SubscribeBlockHeadersFromStartBlockIDClient, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlockHeadersFromStartBlockIDRequest, ...grpc.CallOption) access.AccessAPI_SubscribeBlockHeadersFromStartBlockIDClient); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(access.AccessAPI_SubscribeBlockHeadersFromStartBlockIDClient)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *access.SubscribeBlockHeadersFromStartBlockIDRequest, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// SubscribeBlockHeadersFromStartHeight provides a mock function with given fields: ctx, in, opts
+func (_m *AccessAPIClient) SubscribeBlockHeadersFromStartHeight(ctx context.Context, in *access.SubscribeBlockHeadersFromStartHeightRequest, opts ...grpc.CallOption) (access.AccessAPI_SubscribeBlockHeadersFromStartHeightClient, error) {
+	_va := make([]interface{}, len(opts))
+	for _i := range opts {
+		_va[_i] = opts[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx, in)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 access.AccessAPI_SubscribeBlockHeadersFromStartHeightClient
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlockHeadersFromStartHeightRequest, ...grpc.CallOption) (access.AccessAPI_SubscribeBlockHeadersFromStartHeightClient, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlockHeadersFromStartHeightRequest, ...grpc.CallOption) access.AccessAPI_SubscribeBlockHeadersFromStartHeightClient); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(access.AccessAPI_SubscribeBlockHeadersFromStartHeightClient)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *access.SubscribeBlockHeadersFromStartHeightRequest, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// SubscribeBlocksFromLatest provides a mock function with given fields: ctx, in, opts
+func (_m *AccessAPIClient) SubscribeBlocksFromLatest(ctx context.Context, in *access.SubscribeBlocksFromLatestRequest, opts ...grpc.CallOption) (access.AccessAPI_SubscribeBlocksFromLatestClient, error) {
+	_va := make([]interface{}, len(opts))
+	for _i := range opts {
+		_va[_i] = opts[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx, in)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 access.AccessAPI_SubscribeBlocksFromLatestClient
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlocksFromLatestRequest, ...grpc.CallOption) (access.AccessAPI_SubscribeBlocksFromLatestClient, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlocksFromLatestRequest, ...grpc.CallOption) access.AccessAPI_SubscribeBlocksFromLatestClient); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(access.AccessAPI_SubscribeBlocksFromLatestClient)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *access.SubscribeBlocksFromLatestRequest, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// SubscribeBlocksFromStartBlockID provides a mock function with given fields: ctx, in, opts
+func (_m *AccessAPIClient) SubscribeBlocksFromStartBlockID(ctx context.Context, in *access.SubscribeBlocksFromStartBlockIDRequest, opts ...grpc.CallOption) (access.AccessAPI_SubscribeBlocksFromStartBlockIDClient, error) {
+	_va := make([]interface{}, len(opts))
+	for _i := range opts {
+		_va[_i] = opts[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx, in)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 access.AccessAPI_SubscribeBlocksFromStartBlockIDClient
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlocksFromStartBlockIDRequest, ...grpc.CallOption) (access.AccessAPI_SubscribeBlocksFromStartBlockIDClient, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlocksFromStartBlockIDRequest, ...grpc.CallOption) access.AccessAPI_SubscribeBlocksFromStartBlockIDClient); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(access.AccessAPI_SubscribeBlocksFromStartBlockIDClient)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *access.SubscribeBlocksFromStartBlockIDRequest, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// SubscribeBlocksFromStartHeight provides a mock function with given fields: ctx, in, opts
+func (_m *AccessAPIClient) SubscribeBlocksFromStartHeight(ctx context.Context, in *access.SubscribeBlocksFromStartHeightRequest, opts ...grpc.CallOption) (access.AccessAPI_SubscribeBlocksFromStartHeightClient, error) {
+	_va := make([]interface{}, len(opts))
+	for _i := range opts {
+		_va[_i] = opts[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, ctx, in)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	var r0 access.AccessAPI_SubscribeBlocksFromStartHeightClient
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlocksFromStartHeightRequest, ...grpc.CallOption) (access.AccessAPI_SubscribeBlocksFromStartHeightClient, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *access.SubscribeBlocksFromStartHeightRequest, ...grpc.CallOption) access.AccessAPI_SubscribeBlocksFromStartHeightClient); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(access.AccessAPI_SubscribeBlocksFromStartHeightClient)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *access.SubscribeBlocksFromStartHeightRequest, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 type mockConstructorTestingTNewAccessAPIClient interface {
 	mock.TestingT
 	Cleanup(func())
diff --git a/engine/access/mock/access_api_server.go b/engine/access/mock/access_api_server.go
index c9545b26450..dcb9e571200 100644
--- a/engine/access/mock/access_api_server.go
+++ b/engine/access/mock/access_api_server.go
@@ -795,6 +795,20 @@ func (_m *AccessAPIServer) Ping(_a0 context.Context, _a1 *access.PingRequest) (*
 	return r0, r1
 }
 
+// SendAndSubscribeTransactionStatuses provides a mock function with given fields: _a0, _a1
+func (_m *AccessAPIServer) SendAndSubscribeTransactionStatuses(_a0 *access.SendAndSubscribeTransactionStatusesRequest, _a1 access.AccessAPI_SendAndSubscribeTransactionStatusesServer) error {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(*access.SendAndSubscribeTransactionStatusesRequest, access.AccessAPI_SendAndSubscribeTransactionStatusesServer) error); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
 // SendTransaction provides a mock function with given fields: _a0, _a1
 func (_m *AccessAPIServer) SendTransaction(_a0 context.Context, _a1 *access.SendTransactionRequest) (*access.SendTransactionResponse, error) {
 	ret := _m.Called(_a0, _a1)
@@ -821,6 +835,132 @@ func (_m *AccessAPIServer) SendTransaction(_a0 context.Context, _a1 *access.Send
 	return r0, r1
 }
 
+// SubscribeBlockDigestsFromLatest provides a mock function with given fields: _a0, _a1
+func (_m *AccessAPIServer) SubscribeBlockDigestsFromLatest(_a0 *access.SubscribeBlockDigestsFromLatestRequest, _a1 access.AccessAPI_SubscribeBlockDigestsFromLatestServer) error {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(*access.SubscribeBlockDigestsFromLatestRequest, access.AccessAPI_SubscribeBlockDigestsFromLatestServer) error); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// SubscribeBlockDigestsFromStartBlockID provides a mock function with given fields: _a0, _a1
+func (_m *AccessAPIServer) SubscribeBlockDigestsFromStartBlockID(_a0 *access.SubscribeBlockDigestsFromStartBlockIDRequest, _a1 access.AccessAPI_SubscribeBlockDigestsFromStartBlockIDServer) error {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(*access.SubscribeBlockDigestsFromStartBlockIDRequest, access.AccessAPI_SubscribeBlockDigestsFromStartBlockIDServer) error); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// SubscribeBlockDigestsFromStartHeight provides a mock function with given fields: _a0, _a1
+func (_m *AccessAPIServer) SubscribeBlockDigestsFromStartHeight(_a0 *access.SubscribeBlockDigestsFromStartHeightRequest, _a1 access.AccessAPI_SubscribeBlockDigestsFromStartHeightServer) error {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(*access.SubscribeBlockDigestsFromStartHeightRequest, access.AccessAPI_SubscribeBlockDigestsFromStartHeightServer) error); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// SubscribeBlockHeadersFromLatest provides a mock function with given fields: _a0, _a1
+func (_m *AccessAPIServer) SubscribeBlockHeadersFromLatest(_a0 *access.SubscribeBlockHeadersFromLatestRequest, _a1 access.AccessAPI_SubscribeBlockHeadersFromLatestServer) error {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(*access.SubscribeBlockHeadersFromLatestRequest, access.AccessAPI_SubscribeBlockHeadersFromLatestServer) error); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// SubscribeBlockHeadersFromStartBlockID provides a mock function with given fields: _a0, _a1
+func (_m *AccessAPIServer) SubscribeBlockHeadersFromStartBlockID(_a0 *access.SubscribeBlockHeadersFromStartBlockIDRequest, _a1 access.AccessAPI_SubscribeBlockHeadersFromStartBlockIDServer) error {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(*access.SubscribeBlockHeadersFromStartBlockIDRequest, access.AccessAPI_SubscribeBlockHeadersFromStartBlockIDServer) error); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// SubscribeBlockHeadersFromStartHeight provides a mock function with given fields: _a0, _a1
+func (_m *AccessAPIServer) SubscribeBlockHeadersFromStartHeight(_a0 *access.SubscribeBlockHeadersFromStartHeightRequest, _a1 access.AccessAPI_SubscribeBlockHeadersFromStartHeightServer) error {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(*access.SubscribeBlockHeadersFromStartHeightRequest, access.AccessAPI_SubscribeBlockHeadersFromStartHeightServer) error); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// SubscribeBlocksFromLatest provides a mock function with given fields: _a0, _a1
+func (_m *AccessAPIServer) SubscribeBlocksFromLatest(_a0 *access.SubscribeBlocksFromLatestRequest, _a1 access.AccessAPI_SubscribeBlocksFromLatestServer) error {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(*access.SubscribeBlocksFromLatestRequest, access.AccessAPI_SubscribeBlocksFromLatestServer) error); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// SubscribeBlocksFromStartBlockID provides a mock function with given fields: _a0, _a1
+func (_m *AccessAPIServer) SubscribeBlocksFromStartBlockID(_a0 *access.SubscribeBlocksFromStartBlockIDRequest, _a1 access.AccessAPI_SubscribeBlocksFromStartBlockIDServer) error {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(*access.SubscribeBlocksFromStartBlockIDRequest, access.AccessAPI_SubscribeBlocksFromStartBlockIDServer) error); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// SubscribeBlocksFromStartHeight provides a mock function with given fields: _a0, _a1
+func (_m *AccessAPIServer) SubscribeBlocksFromStartHeight(_a0 *access.SubscribeBlocksFromStartHeightRequest, _a1 access.AccessAPI_SubscribeBlocksFromStartHeightServer) error {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(*access.SubscribeBlocksFromStartHeightRequest, access.AccessAPI_SubscribeBlocksFromStartHeightServer) error); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
 type mockConstructorTestingTNewAccessAPIServer interface {
 	mock.TestingT
 	Cleanup(func())
diff --git a/engine/access/ping/engine.go b/engine/access/ping/engine.go
index e85128fccdb..898efad3cc4 100644
--- a/engine/access/ping/engine.go
+++ b/engine/access/ping/engine.go
@@ -93,7 +93,7 @@ func (e *Engine) Done() <-chan struct{} {
 func (e *Engine) startPing() {
 
 	e.unit.LaunchPeriodically(func() {
-		peers := e.idProvider.Identities(filter.Not(filter.HasNodeID(e.me.NodeID())))
+		peers := e.idProvider.Identities(filter.Not(filter.HasNodeID[flow.Identity](e.me.NodeID())))
 
 		// for each peer, send a ping every ping interval
 		for _, peer := range peers {
diff --git a/engine/access/rest/apiproxy/rest_proxy_handler.go b/engine/access/rest/apiproxy/rest_proxy_handler.go
index c589d3a5b79..5bd4c34c48e 100644
--- a/engine/access/rest/apiproxy/rest_proxy_handler.go
+++ b/engine/access/rest/apiproxy/rest_proxy_handler.go
@@ -32,7 +32,7 @@ type RestProxyHandler struct {
 // NewRestProxyHandler returns a new rest proxy handler for observer node.
 func NewRestProxyHandler(
 	api access.API,
-	identities flow.IdentityList,
+	identities flow.IdentitySkeletonList,
 	connectionFactory connection.ConnectionFactory,
 	log zerolog.Logger,
 	metrics metrics.ObserverMetrics,
diff --git a/engine/access/rest/routes/subscribe_events.go b/engine/access/rest/routes/subscribe_events.go
index a087961cd71..e1aca3bb316 100644
--- a/engine/access/rest/routes/subscribe_events.go
+++ b/engine/access/rest/routes/subscribe_events.go
@@ -6,6 +6,7 @@ import (
 	"github.com/onflow/flow-go/engine/access/rest/models"
 	"github.com/onflow/flow-go/engine/access/rest/request"
 	"github.com/onflow/flow-go/engine/access/state_stream"
+	"github.com/onflow/flow-go/engine/access/subscription"
 )
 
 // SubscribeEvents create websocket connection and write to it requested events.
@@ -13,7 +14,7 @@ func SubscribeEvents(
 	ctx context.Context,
 	request *request.Request,
 	wsController *WebsocketController,
-) (state_stream.Subscription, error) {
+) (subscription.Subscription, error) {
 	req, err := request.SubscribeEventsRequest()
 	if err != nil {
 		return nil, models.NewBadRequestError(err)
diff --git a/engine/access/rest/routes/subscribe_events_test.go b/engine/access/rest/routes/subscribe_events_test.go
index 6d5b731d6b7..6eb56032abf 100644
--- a/engine/access/rest/routes/subscribe_events_test.go
+++ b/engine/access/rest/routes/subscribe_events_test.go
@@ -203,15 +203,17 @@ func (s *SubscribeEventsSuite) TestSubscribeEvents() {
 						}
 						if len(expectedEvents) > 0 || (i+1)%int(test.heartbeatInterval) == 0 {
 							expectedEventsResponses = append(expectedEventsResponses, &backend.EventsResponse{
-								Height:  block.Header.Height,
-								BlockID: blockID,
-								Events:  expectedEvents,
+								Height:         block.Header.Height,
+								BlockID:        blockID,
+								Events:         expectedEvents,
+								BlockTimestamp: block.Header.Timestamp,
 							})
 						}
 						subscriptionEventsResponses = append(subscriptionEventsResponses, &backend.EventsResponse{
-							Height:  block.Header.Height,
-							BlockID: blockID,
-							Events:  subscriptionEvents,
+							Height:         block.Header.Height,
+							BlockID:        blockID,
+							Events:         subscriptionEvents,
+							BlockTimestamp: block.Header.Timestamp,
 						})
 					}
 				}
@@ -395,7 +397,7 @@ func requireError(t *testing.T, recorder *testHijackResponseRecorder, expected s
 	require.Contains(t, recorder.responseBuff.String(), expected)
 }
 
-// requireResponse validates that the response received from WebSocket communication matches the expected EventsResponses.
+// requireResponse validates that the response received from WebSocket communication matches the expected EventsResponse.
 // This function compares the BlockID, Events count, and individual event properties for each expected and actual
 // EventsResponse. It ensures that the response received from WebSocket matches the expected structure and content.
 func requireResponse(t *testing.T, recorder *testHijackResponseRecorder, expected []*backend.EventsResponse) {
@@ -403,7 +405,7 @@ func requireResponse(t *testing.T, recorder *testHijackResponseRecorder, expecte
 	// Convert the actual response from respRecorder to JSON bytes
 	actualJSON := recorder.responseBuff.Bytes()
 	// Define a regular expression pattern to match JSON objects
-	pattern := `\{"BlockID":".*?","Height":\d+,"Events":\[(\{.*?})*\]\}`
+	pattern := `\{"BlockID":".*?","Height":\d+,"Events":\[(\{.*?})*\],"BlockTimestamp":".*?"\}`
 	matches := regexp.MustCompile(pattern).FindAll(actualJSON, -1)
 
 	// Unmarshal each matched JSON into []state_stream.EventsResponse
diff --git a/engine/access/rest/routes/test_helpers.go b/engine/access/rest/routes/test_helpers.go
index ebe40fa48df..feae66f5bf9 100644
--- a/engine/access/rest/routes/test_helpers.go
+++ b/engine/access/rest/routes/test_helpers.go
@@ -18,6 +18,7 @@ import (
 	"github.com/onflow/flow-go/access/mock"
 	"github.com/onflow/flow-go/engine/access/state_stream"
 	"github.com/onflow/flow-go/engine/access/state_stream/backend"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/metrics"
 	"github.com/onflow/flow-go/utils/unittest"
@@ -94,8 +95,8 @@ var _ http.Hijacker = (*testHijackResponseRecorder)(nil)
 // Hijack implements the http.Hijacker interface by returning a fakeNetConn and a bufio.ReadWriter
 // that simulate a hijacked connection.
 func (w *testHijackResponseRecorder) Hijack() (net.Conn, *bufio.ReadWriter, error) {
-	br := bufio.NewReaderSize(strings.NewReader(""), state_stream.DefaultSendBufferSize)
-	bw := bufio.NewWriterSize(&bytes.Buffer{}, state_stream.DefaultSendBufferSize)
+	br := bufio.NewReaderSize(strings.NewReader(""), subscription.DefaultSendBufferSize)
+	bw := bufio.NewWriterSize(&bytes.Buffer{}, subscription.DefaultSendBufferSize)
 	w.responseBuff = bytes.NewBuffer(make([]byte, 0))
 	w.closed = make(chan struct{}, 1)
 
@@ -137,8 +138,8 @@ func executeWsRequest(req *http.Request, stateStreamApi state_stream.API, respon
 
 	config := backend.Config{
 		EventFilterConfig: state_stream.DefaultEventFilterConfig,
-		MaxGlobalStreams:  state_stream.DefaultMaxGlobalStreams,
-		HeartbeatInterval: state_stream.DefaultHeartbeatInterval,
+		MaxGlobalStreams:  subscription.DefaultMaxGlobalStreams,
+		HeartbeatInterval: subscription.DefaultHeartbeatInterval,
 	}
 
 	router := NewRouterBuilder(unittest.Logger(), restCollector).AddWsRoutes(
diff --git a/engine/access/rest/routes/websocket_handler.go b/engine/access/rest/routes/websocket_handler.go
index 221a18ea7b0..f2261baa76f 100644
--- a/engine/access/rest/routes/websocket_handler.go
+++ b/engine/access/rest/routes/websocket_handler.go
@@ -15,6 +15,7 @@ import (
 	"github.com/onflow/flow-go/engine/access/rest/request"
 	"github.com/onflow/flow-go/engine/access/state_stream"
 	"github.com/onflow/flow-go/engine/access/state_stream/backend"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
 	"github.com/onflow/flow-go/model/flow"
 )
@@ -110,7 +111,7 @@ func (wsController *WebsocketController) wsErrorHandler(err error) {
 // It listens to the subscription's channel for events and writes them to the WebSocket connection.
 // If an error occurs or the subscription channel is closed, it handles the error or termination accordingly.
 // The function uses a ticker to periodically send ping messages to the client to maintain the connection.
-func (wsController *WebsocketController) writeEvents(sub state_stream.Subscription) {
+func (wsController *WebsocketController) writeEvents(sub subscription.Subscription) {
 	ticker := time.NewTicker(pingPeriod)
 	defer ticker.Stop()
 
@@ -229,7 +230,7 @@ type SubscribeHandlerFunc func(
 	ctx context.Context,
 	request *request.Request,
 	wsController *WebsocketController,
-) (state_stream.Subscription, error)
+) (subscription.Subscription, error)
 
 // WSHandler is websocket handler implementing custom websocket handler function and allows easier handling of errors and
 // responses as it wraps functionality for handling error and responses outside of endpoint handling.
diff --git a/engine/access/rpc/backend/backend.go b/engine/access/rpc/backend/backend.go
index d082277cd8d..5c27d1e9577 100644
--- a/engine/access/rpc/backend/backend.go
+++ b/engine/access/rpc/backend/backend.go
@@ -12,8 +12,11 @@ import (
 
 	"github.com/onflow/flow-go/access"
 	"github.com/onflow/flow-go/cmd/build"
+	"github.com/onflow/flow-go/engine/access/index"
 	"github.com/onflow/flow-go/engine/access/rpc/connection"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/engine/common/rpc"
+	"github.com/onflow/flow-go/fvm/blueprints"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/flow/filter"
 	"github.com/onflow/flow-go/module"
@@ -42,8 +45,10 @@ const DefaultLoggedScriptsCacheSize = 1_000_000
 // DefaultConnectionPoolSize is the default size for the connection pool to collection and execution nodes
 const DefaultConnectionPoolSize = 250
 
-var preferredENIdentifiers flow.IdentifierList
-var fixedENIdentifiers flow.IdentifierList
+var (
+	preferredENIdentifiers flow.IdentifierList
+	fixedENIdentifiers     flow.IdentifierList
+)
 
 // Backend implements the Access API.
 //
@@ -66,6 +71,8 @@ type Backend struct {
 	backendAccounts
 	backendExecutionResults
 	backendNetwork
+	backendSubscribeBlocks
+	backendSubscribeTransactions
 
 	state             protocol.State
 	chainID           flow.ChainID
@@ -74,7 +81,8 @@ type Backend struct {
 	connFactory       connection.ConnectionFactory
 
 	// cache the response to GetNodeVersionInfo since it doesn't change
-	nodeInfo *access.NodeVersionInfo
+	nodeInfo     *access.NodeVersionInfo
+	BlockTracker subscription.BlockTracker
 }
 
 type Params struct {
@@ -83,12 +91,10 @@ type Params struct {
 	HistoricalAccessNodes     []accessproto.AccessAPIClient
 	Blocks                    storage.Blocks
 	Headers                   storage.Headers
-	Events                    storage.Events
 	Collections               storage.Collections
 	Transactions              storage.Transactions
 	ExecutionReceipts         storage.ExecutionReceipts
 	ExecutionResults          storage.ExecutionResults
-	LightTransactionResults   storage.LightTransactionResults
 	ChainID                   flow.ChainID
 	AccessMetrics             module.AccessMetrics
 	ConnFactory               connection.ConnectionFactory
@@ -104,8 +110,16 @@ type Params struct {
 	ScriptExecutor            execution.ScriptExecutor
 	ScriptExecutionMode       IndexQueryMode
 	EventQueryMode            IndexQueryMode
+	BlockTracker              subscription.BlockTracker
+	SubscriptionHandler       *subscription.SubscriptionHandler
+
+	EventsIndex       *index.EventsIndex
+	TxResultQueryMode IndexQueryMode
+	TxResultsIndex    *index.TransactionResultsIndex
 }
 
+var _ TransactionErrorMessage = (*Backend)(nil)
+
 // New creates backend instance
 func New(params Params) (*Backend, error) {
 	retry := newRetry(params.Log)
@@ -138,14 +152,28 @@ func New(params Params) (*Backend, error) {
 		}
 	}
 
-	// initialize node version info
-	nodeInfo, err := getNodeVersionInfo(params.State.Params())
+	// the system tx is hardcoded and never changes during runtime
+	systemTx, err := blueprints.SystemChunkTransaction(params.ChainID.Chain())
 	if err != nil {
-		return nil, fmt.Errorf("failed to initialize node version info: %w", err)
+		return nil, fmt.Errorf("failed to create system chunk transaction: %w", err)
+	}
+	systemTxID := systemTx.ID()
+
+	// initialize node version info
+	nodeInfo := getNodeVersionInfo(params.State.Params())
+
+	transactionsLocalDataProvider := &TransactionsLocalDataProvider{
+		state:          params.State,
+		collections:    params.Collections,
+		blocks:         params.Blocks,
+		eventsIndex:    params.EventsIndex,
+		txResultsIndex: params.TxResultsIndex,
+		systemTxID:     systemTxID,
 	}
 
 	b := &Backend{
-		state: params.State,
+		state:        params.State,
+		BlockTracker: params.BlockTracker,
 		// create the sub-backends
 		backendScripts: backendScripts{
 			log:               params.Log,
@@ -160,35 +188,35 @@ func New(params Params) (*Backend, error) {
 			scriptExecMode:    params.ScriptExecutionMode,
 		},
 		backendTransactions: backendTransactions{
-			log:                  params.Log,
-			staticCollectionRPC:  params.CollectionRPC,
-			state:                params.State,
-			chainID:              params.ChainID,
-			collections:          params.Collections,
-			blocks:               params.Blocks,
-			transactions:         params.Transactions,
-			results:              params.LightTransactionResults,
-			executionReceipts:    params.ExecutionReceipts,
-			transactionValidator: configureTransactionValidator(params.State, params.ChainID),
-			transactionMetrics:   params.AccessMetrics,
-			retry:                retry,
-			connFactory:          params.ConnFactory,
-			previousAccessNodes:  params.HistoricalAccessNodes,
-			nodeCommunicator:     params.Communicator,
-			txResultCache:        txResCache,
-			txErrorMessagesCache: txErrorMessagesCache,
+			TransactionsLocalDataProvider: transactionsLocalDataProvider,
+			log:                           params.Log,
+			staticCollectionRPC:           params.CollectionRPC,
+			chainID:                       params.ChainID,
+			transactions:                  params.Transactions,
+			executionReceipts:             params.ExecutionReceipts,
+			transactionValidator:          configureTransactionValidator(params.State, params.ChainID),
+			transactionMetrics:            params.AccessMetrics,
+			retry:                         retry,
+			connFactory:                   params.ConnFactory,
+			previousAccessNodes:           params.HistoricalAccessNodes,
+			nodeCommunicator:              params.Communicator,
+			txResultCache:                 txResCache,
+			txErrorMessagesCache:          txErrorMessagesCache,
+			txResultQueryMode:             params.TxResultQueryMode,
+			systemTx:                      systemTx,
+			systemTxID:                    systemTxID,
 		},
 		backendEvents: backendEvents{
 			log:               params.Log,
 			chain:             params.ChainID.Chain(),
 			state:             params.State,
 			headers:           params.Headers,
-			events:            params.Events,
 			executionReceipts: params.ExecutionReceipts,
 			connFactory:       params.ConnFactory,
 			maxHeightRange:    params.MaxHeightRange,
 			nodeCommunicator:  params.Communicator,
 			queryMode:         params.EventQueryMode,
+			eventsIndex:       params.EventsIndex,
 		},
 		backendBlockHeaders: backendBlockHeaders{
 			headers: params.Headers,
@@ -217,6 +245,21 @@ func New(params Params) (*Backend, error) {
 			headers:              params.Headers,
 			snapshotHistoryLimit: params.SnapshotHistoryLimit,
 		},
+		backendSubscribeBlocks: backendSubscribeBlocks{
+			log:                 params.Log,
+			state:               params.State,
+			headers:             params.Headers,
+			blocks:              params.Blocks,
+			subscriptionHandler: params.SubscriptionHandler,
+			blockTracker:        params.BlockTracker,
+		},
+		backendSubscribeTransactions: backendSubscribeTransactions{
+			txLocalDataProvider: transactionsLocalDataProvider,
+			log:                 params.Log,
+			executionResults:    params.ExecutionResults,
+			subscriptionHandler: params.SubscriptionHandler,
+			blockTracker:        params.BlockTracker,
+		},
 		collections:       params.Collections,
 		executionReceipts: params.ExecutionReceipts,
 		connFactory:       params.ConnFactory,
@@ -224,6 +267,8 @@ func New(params Params) (*Backend, error) {
 		nodeInfo:          nodeInfo,
 	}
 
+	b.backendTransactions.txErrorMessages = b
+
 	retry.SetBackend(b)
 
 	preferredENIdentifiers, err = identifierList(params.PreferredExecutionNodeIDs)
@@ -239,27 +284,6 @@ func New(params Params) (*Backend, error) {
 	return b, nil
 }
 
-// NewCache constructs cache for storing connections to other nodes.
-// No errors are expected during normal operations.
-func NewCache(
-	log zerolog.Logger,
-	metrics module.AccessMetrics,
-	connectionPoolSize int,
-) (*lru.Cache[string, *connection.CachedClient], error) {
-	cache, err := lru.NewWithEvict(connectionPoolSize, func(_ string, client *connection.CachedClient) {
-		go client.Close() // close is blocking, so run in a goroutine
-
-		log.Debug().Str("grpc_conn_evicted", client.Address).Msg("closing grpc connection evicted from pool")
-		metrics.ConnectionFromPoolEvicted()
-	})
-
-	if err != nil {
-		return nil, fmt.Errorf("could not initialize connection pool cache: %w", err)
-	}
-
-	return cache, nil
-}
-
 func identifierList(ids []string) (flow.IdentifierList, error) {
 	idList := make(flow.IdentifierList, len(ids))
 	for i, idStr := range ids {
@@ -291,7 +315,6 @@ func configureTransactionValidator(state protocol.State, chainID flow.ChainID) *
 
 // Ping responds to requests when the server is up.
 func (b *Backend) Ping(ctx context.Context) error {
-
 	// staticCollectionRPC is only set if a collection node address was provided at startup
 	if b.staticCollectionRPC != nil {
 		_, err := b.staticCollectionRPC.Ping(ctx, &accessproto.PingRequest{})
@@ -310,26 +333,12 @@ func (b *Backend) GetNodeVersionInfo(_ context.Context) (*access.NodeVersionInfo
 
 // getNodeVersionInfo returns the NodeVersionInfo for the node.
 // Since these values are static while the node is running, it is safe to cache.
-func getNodeVersionInfo(stateParams protocol.Params) (*access.NodeVersionInfo, error) {
-	sporkID, err := stateParams.SporkID()
-	if err != nil {
-		return nil, fmt.Errorf("failed to read spork ID: %v", err)
-	}
-
-	protocolVersion, err := stateParams.ProtocolVersion()
-	if err != nil {
-		return nil, fmt.Errorf("failed to read protocol version: %v", err)
-	}
+func getNodeVersionInfo(stateParams protocol.Params) *access.NodeVersionInfo {
+	sporkID := stateParams.SporkID()
+	protocolVersion := stateParams.ProtocolVersion()
+	sporkRootBlockHeight := stateParams.SporkRootBlockHeight()
 
-	sporkRootBlockHeight, err := stateParams.SporkRootBlockHeight()
-	if err != nil {
-		return nil, fmt.Errorf("failed to read spork root block height: %w", err)
-	}
-
-	nodeRootBlockHeader, err := stateParams.SealedRoot()
-	if err != nil {
-		return nil, fmt.Errorf("failed to read node root block: %w", err)
-	}
+	nodeRootBlockHeader := stateParams.SealedRoot()
 
 	nodeInfo := &access.NodeVersionInfo{
 		Semver:               build.Version(),
@@ -340,7 +349,7 @@ func getNodeVersionInfo(stateParams protocol.Params) (*access.NodeVersionInfo, e
 		NodeRootBlockHeight:  nodeRootBlockHeader.Height,
 	}
 
-	return nodeInfo, nil
+	return nodeInfo
 }
 
 func (b *Backend) GetCollectionByID(_ context.Context, colID flow.Identifier) (*flow.LightCollection, error) {
@@ -373,19 +382,18 @@ func executionNodesForBlockID(
 	executionReceipts storage.ExecutionReceipts,
 	state protocol.State,
 	log zerolog.Logger,
-) (flow.IdentityList, error) {
-
-	var executorIDs flow.IdentifierList
+) (flow.IdentitySkeletonList, error) {
+	var (
+		executorIDs flow.IdentifierList
+		err         error
+	)
 
 	// check if the block ID is of the root block. If it is then don't look for execution receipts since they
 	// will not be present for the root block.
-	rootBlock, err := state.Params().FinalizedRoot()
-	if err != nil {
-		return nil, fmt.Errorf("failed to retreive execution IDs for block ID %v: %w", blockID, err)
-	}
+	rootBlock := state.Params().FinalizedRoot()
 
 	if rootBlock.ID() == blockID {
-		executorIdentities, err := state.Final().Identities(filter.HasRole(flow.RoleExecution))
+		executorIdentities, err := state.Final().Identities(filter.HasRole[flow.Identity](flow.RoleExecution))
 		if err != nil {
 			return nil, fmt.Errorf("failed to retreive execution IDs for block ID %v: %w", blockID, err)
 		}
@@ -415,14 +423,14 @@ func executionNodesForBlockID(
 			case <-ctx.Done():
 				return nil, ctx.Err()
 			case <-time.After(100 * time.Millisecond << time.Duration(attempt)):
-				//retry after an exponential backoff
+				// retry after an exponential backoff
 			}
 		}
 
 		receiptCnt := len(executorIDs)
 		// if less than minExecutionNodesCnt execution receipts have been received so far, then return random ENs
 		if receiptCnt < minExecutionNodesCnt {
-			newExecutorIDs, err := state.AtBlockID(blockID).Identities(filter.HasRole(flow.RoleExecution))
+			newExecutorIDs, err := state.AtBlockID(blockID).Identities(filter.HasRole[flow.Identity](flow.RoleExecution))
 			if err != nil {
 				return nil, fmt.Errorf("failed to retreive execution IDs for block ID %v: %w", blockID, err)
 			}
@@ -450,7 +458,6 @@ func findAllExecutionNodes(
 	executionReceipts storage.ExecutionReceipts,
 	log zerolog.Logger,
 ) (flow.IdentifierList, error) {
-
 	// lookup the receipt's storage with the block ID
 	allReceipts, err := executionReceipts.ByBlockID(blockID)
 	if err != nil {
@@ -506,9 +513,8 @@ func findAllExecutionNodes(
 // If neither preferred nor fixed nodes are defined, then all execution node matching the executor IDs are returned.
 // e.g. If execution nodes in identity table are {1,2,3,4}, preferred ENs are defined as {2,3,4}
 // and the executor IDs is {1,2,3}, then {2, 3} is returned as the chosen subset of ENs
-func chooseExecutionNodes(state protocol.State, executorIDs flow.IdentifierList) (flow.IdentityList, error) {
-
-	allENs, err := state.Final().Identities(filter.HasRole(flow.RoleExecution))
+func chooseExecutionNodes(state protocol.State, executorIDs flow.IdentifierList) (flow.IdentitySkeletonList, error) {
+	allENs, err := state.Final().Identities(filter.HasRole[flow.Identity](flow.RoleExecution))
 	if err != nil {
 		return nil, fmt.Errorf("failed to retreive all execution IDs: %w", err)
 	}
@@ -517,25 +523,27 @@ func chooseExecutionNodes(state protocol.State, executorIDs flow.IdentifierList)
 	var chosenIDs flow.IdentityList
 	if len(preferredENIdentifiers) > 0 {
 		// find the preferred execution node IDs which have executed the transaction
-		chosenIDs = allENs.Filter(filter.And(filter.HasNodeID(preferredENIdentifiers...),
-			filter.HasNodeID(executorIDs...)))
+		chosenIDs = allENs.Filter(filter.And(filter.HasNodeID[flow.Identity](preferredENIdentifiers...),
+			filter.HasNodeID[flow.Identity](executorIDs...)))
 		if len(chosenIDs) > 0 {
-			return chosenIDs, nil
+			return chosenIDs.ToSkeleton(), nil
 		}
 	}
 
 	// if no preferred EN ID is found, then choose from the fixed EN IDs
 	if len(fixedENIdentifiers) > 0 {
 		// choose fixed ENs which have executed the transaction
-		chosenIDs = allENs.Filter(filter.And(filter.HasNodeID(fixedENIdentifiers...), filter.HasNodeID(executorIDs...)))
+		chosenIDs = allENs.Filter(filter.And(
+			filter.HasNodeID[flow.Identity](fixedENIdentifiers...),
+			filter.HasNodeID[flow.Identity](executorIDs...)))
 		if len(chosenIDs) > 0 {
-			return chosenIDs, nil
+			return chosenIDs.ToSkeleton(), nil
 		}
 		// if no such ENs are found then just choose all fixed ENs
-		chosenIDs = allENs.Filter(filter.HasNodeID(fixedENIdentifiers...))
-		return chosenIDs, nil
+		chosenIDs = allENs.Filter(filter.HasNodeID[flow.Identity](fixedENIdentifiers...))
+		return chosenIDs.ToSkeleton(), nil
 	}
 
 	// If no preferred or fixed ENs have been specified, then return all executor IDs i.e. no preference at all
-	return allENs.Filter(filter.HasNodeID(executorIDs...)), nil
+	return allENs.Filter(filter.HasNodeID[flow.Identity](executorIDs...)).ToSkeleton(), nil
 }
diff --git a/engine/access/rpc/backend/backend_accounts.go b/engine/access/rpc/backend/backend_accounts.go
index 2e58b904a48..9f73d30a545 100644
--- a/engine/access/rpc/backend/backend_accounts.go
+++ b/engine/access/rpc/backend/backend_accounts.go
@@ -162,7 +162,7 @@ func (b *backendAccounts) getAccountFromAnyExeNode(
 	var resp *execproto.GetAccountAtBlockIDResponse
 	errToReturn := b.nodeCommunicator.CallAvailableNode(
 		execNodes,
-		func(node *flow.Identity) error {
+		func(node *flow.IdentitySkeleton) error {
 			var err error
 			start := time.Now()
 
@@ -203,7 +203,7 @@ func (b *backendAccounts) getAccountFromAnyExeNode(
 // tryGetAccount attempts to get the account from the given execution node.
 func (b *backendAccounts) tryGetAccount(
 	ctx context.Context,
-	execNode *flow.Identity,
+	execNode *flow.IdentitySkeleton,
 	req *execproto.GetAccountAtBlockIDRequest,
 ) (*execproto.GetAccountAtBlockIDResponse, error) {
 	execRPCClient, closer, err := b.connFactory.GetExecutionAPIClient(execNode.Address)
@@ -353,5 +353,5 @@ func convertAccountError(err error, address flow.Address, height uint64) error {
 		return status.Errorf(codes.NotFound, "account not found")
 	}
 
-	return convertIndexError(err, height, "failed to get account")
+	return rpc.ConvertIndexError(err, height, "failed to get account")
 }
diff --git a/engine/access/rpc/backend/backend_accounts_test.go b/engine/access/rpc/backend/backend_accounts_test.go
index d8428022228..18ad68c52d0 100644
--- a/engine/access/rpc/backend/backend_accounts_test.go
+++ b/engine/access/rpc/backend/backend_accounts_test.go
@@ -15,7 +15,6 @@ import (
 	connectionmock "github.com/onflow/flow-go/engine/access/rpc/connection/mock"
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
 	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/module/execution"
 	execmock "github.com/onflow/flow-go/module/execution/mock"
 	"github.com/onflow/flow-go/module/irrecoverable"
 	protocol "github.com/onflow/flow-go/state/protocol/mock"
@@ -222,7 +221,7 @@ func (s *BackendAccountsSuite) TestGetAccountFromStorage_Fails() {
 		statusCode codes.Code
 	}{
 		{
-			err:        execution.ErrDataNotAvailable,
+			err:        storage.ErrHeightNotIndexed,
 			statusCode: codes.OutOfRange,
 		},
 		{
@@ -267,7 +266,7 @@ func (s *BackendAccountsSuite) TestGetAccountFromFailover_HappyPath() {
 	backend.scriptExecMode = IndexQueryModeFailover
 	backend.scriptExecutor = scriptExecutor
 
-	for _, errToReturn := range []error{execution.ErrDataNotAvailable, storage.ErrNotFound} {
+	for _, errToReturn := range []error{storage.ErrHeightNotIndexed, storage.ErrNotFound} {
 		scriptExecutor.On("GetAccountAtBlockHeight", mock.Anything, s.account.Address, s.block.Header.Height).
 			Return(nil, errToReturn).Times(3)
 
@@ -299,7 +298,7 @@ func (s *BackendAccountsSuite) TestGetAccountFromFailover_ReturnsENErrors() {
 
 	scriptExecutor := execmock.NewScriptExecutor(s.T())
 	scriptExecutor.On("GetAccountAtBlockHeight", mock.Anything, s.failingAddress, s.block.Header.Height).
-		Return(nil, execution.ErrDataNotAvailable)
+		Return(nil, storage.ErrHeightNotIndexed)
 
 	backend := s.defaultBackend()
 	backend.scriptExecMode = IndexQueryModeFailover
diff --git a/engine/access/rpc/backend/backend_events.go b/engine/access/rpc/backend/backend_events.go
index e35442ca966..2928e22aa7a 100644
--- a/engine/access/rpc/backend/backend_events.go
+++ b/engine/access/rpc/backend/backend_events.go
@@ -15,19 +15,20 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
+	"github.com/onflow/flow-go/engine/access/index"
 	"github.com/onflow/flow-go/engine/access/rpc/connection"
 	"github.com/onflow/flow-go/engine/common/rpc"
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
 	"github.com/onflow/flow-go/model/events"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/irrecoverable"
+	"github.com/onflow/flow-go/module/state_synchronization/indexer"
 	"github.com/onflow/flow-go/state/protocol"
 	"github.com/onflow/flow-go/storage"
 )
 
 type backendEvents struct {
 	headers           storage.Headers
-	events            storage.Events
 	executionReceipts storage.ExecutionReceipts
 	state             protocol.State
 	chain             flow.Chain
@@ -36,6 +37,7 @@ type backendEvents struct {
 	maxHeightRange    uint
 	nodeCommunicator  Communicator
 	queryMode         IndexQueryMode
+	eventsIndex       *index.EventsIndex
 }
 
 // blockMetadata is used to capture information about requested blocks to avoid repeated blockID
@@ -226,15 +228,17 @@ func (b *backendEvents) getBlockEventsFromStorage(
 ) ([]flow.BlockEvents, []blockMetadata, error) {
 	missing := make([]blockMetadata, 0)
 	resp := make([]flow.BlockEvents, 0)
+
 	for _, blockInfo := range blockInfos {
 		if ctx.Err() != nil {
 			return nil, nil, rpc.ConvertError(ctx.Err(), "failed to get events from storage", codes.Canceled)
 		}
 
-		events, err := b.events.ByBlockID(blockInfo.ID)
+		events, err := b.eventsIndex.ByBlockID(blockInfo.ID, blockInfo.Height)
 		if err != nil {
-			// Note: if there are no events for a block, an empty slice is returned
-			if errors.Is(err, storage.ErrNotFound) {
+			if errors.Is(err, storage.ErrNotFound) ||
+				errors.Is(err, storage.ErrHeightNotIndexed) ||
+				errors.Is(err, indexer.ErrIndexNotInitialized) {
 				missing = append(missing, blockInfo)
 				continue
 			}
@@ -305,7 +309,7 @@ func (b *backendEvents) getBlockEventsFromExecutionNode(
 	}
 
 	var resp *execproto.GetEventsForBlockIDsResponse
-	var successfulNode *flow.Identity
+	var successfulNode *flow.IdentitySkeleton
 	resp, successfulNode, err = b.getEventsFromAnyExeNode(ctx, execNodes, req)
 	if err != nil {
 		return nil, rpc.ConvertError(err, "failed to retrieve events from execution nodes", codes.Internal)
@@ -381,14 +385,13 @@ func verifyAndConvertToAccessEvents(
 // other ENs are logged and swallowed. If all ENs fail to return a valid response, then an
 // error aggregating all failures is returned.
 func (b *backendEvents) getEventsFromAnyExeNode(ctx context.Context,
-	execNodes flow.IdentityList,
-	req *execproto.GetEventsForBlockIDsRequest,
-) (*execproto.GetEventsForBlockIDsResponse, *flow.Identity, error) {
+	execNodes flow.IdentitySkeletonList,
+	req *execproto.GetEventsForBlockIDsRequest) (*execproto.GetEventsForBlockIDsResponse, *flow.IdentitySkeleton, error) {
 	var resp *execproto.GetEventsForBlockIDsResponse
-	var execNode *flow.Identity
+	var execNode *flow.IdentitySkeleton
 	errToReturn := b.nodeCommunicator.CallAvailableNode(
 		execNodes,
-		func(node *flow.Identity) error {
+		func(node *flow.IdentitySkeleton) error {
 			var err error
 			start := time.Now()
 			resp, err = b.tryGetEvents(ctx, node, req)
@@ -418,9 +421,8 @@ func (b *backendEvents) getEventsFromAnyExeNode(ctx context.Context,
 }
 
 func (b *backendEvents) tryGetEvents(ctx context.Context,
-	execNode *flow.Identity,
-	req *execproto.GetEventsForBlockIDsRequest,
-) (*execproto.GetEventsForBlockIDsResponse, error) {
+	execNode *flow.IdentitySkeleton,
+	req *execproto.GetEventsForBlockIDsRequest) (*execproto.GetEventsForBlockIDsResponse, error) {
 	execRPCClient, closer, err := b.connFactory.GetExecutionAPIClient(execNode.Address)
 	if err != nil {
 		return nil, err
diff --git a/engine/access/rpc/backend/backend_events_test.go b/engine/access/rpc/backend/backend_events_test.go
index 10306a304aa..9c30e6d5353 100644
--- a/engine/access/rpc/backend/backend_events_test.go
+++ b/engine/access/rpc/backend/backend_events_test.go
@@ -1,8 +1,10 @@
 package backend
 
 import (
+	"bytes"
 	"context"
 	"fmt"
+	"sort"
 	"testing"
 
 	"github.com/rs/zerolog"
@@ -16,11 +18,13 @@ import (
 	"github.com/onflow/flow/protobuf/go/flow/entities"
 	execproto "github.com/onflow/flow/protobuf/go/flow/execution"
 
+	"github.com/onflow/flow-go/engine/access/index"
 	access "github.com/onflow/flow-go/engine/access/mock"
 	connectionmock "github.com/onflow/flow-go/engine/access/rpc/connection/mock"
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/irrecoverable"
+	syncmock "github.com/onflow/flow-go/module/state_synchronization/mock"
 	protocol "github.com/onflow/flow-go/state/protocol/mock"
 	"github.com/onflow/flow-go/storage"
 	storagemock "github.com/onflow/flow-go/storage/mock"
@@ -44,6 +48,7 @@ type BackendEventsSuite struct {
 	params     *protocol.Params
 	rootHeader *flow.Header
 
+	eventsIndex       *index.EventsIndex
 	events            *storagemock.Events
 	headers           *storagemock.Headers
 	receipts          *storagemock.ExecutionReceipts
@@ -79,6 +84,7 @@ func (s *BackendEventsSuite) SetupTest() {
 
 	s.execClient = access.NewExecutionAPIClient(s.T())
 	s.executionNodes = unittest.IdentityListFixture(2, unittest.WithRole(flow.RoleExecution))
+	s.eventsIndex = index.NewEventsIndex(s.events)
 
 	blockCount := 5
 	s.blocks = make([]*flow.Block, blockCount)
@@ -112,10 +118,19 @@ func (s *BackendEventsSuite) SetupTest() {
 	s.blockEvents = generator.GetEventsWithEncoding(10, entities.EventEncodingVersion_CCF_V0)
 	targetEvent = string(s.blockEvents[0].Type)
 
+	// events returned from the db are sorted by txID, txIndex, then eventIndex.
+	// reproduce that here to ensure output order works as expected
+	returnBlockEvents := make([]flow.Event, len(s.blockEvents))
+	copy(returnBlockEvents, s.blockEvents)
+
+	sort.Slice(returnBlockEvents, func(i, j int) bool {
+		return bytes.Compare(returnBlockEvents[i].TransactionID[:], returnBlockEvents[j].TransactionID[:]) < 0
+	})
+
 	s.events.On("ByBlockID", mock.Anything).Return(func(blockID flow.Identifier) ([]flow.Event, error) {
 		for _, headerID := range s.blockIDs {
 			if blockID == headerID {
-				return s.blockEvents, nil
+				return returnBlockEvents, nil
 			}
 		}
 		return nil, storage.ErrNotFound
@@ -163,13 +178,13 @@ func (s *BackendEventsSuite) defaultBackend() *backendEvents {
 		log:               s.log,
 		chain:             s.chainID.Chain(),
 		state:             s.state,
-		events:            s.events,
 		headers:           s.headers,
 		executionReceipts: s.receipts,
 		connFactory:       s.connectionFactory,
 		nodeCommunicator:  NewNodeCommunicator(false),
 		maxHeightRange:    DefaultMaxHeightRange,
 		queryMode:         IndexQueryModeExecutionNodesOnly,
+		eventsIndex:       s.eventsIndex,
 	}
 }
 
@@ -250,6 +265,12 @@ func (s *BackendEventsSuite) TestGetEvents_HappyPaths() {
 	startHeight := s.blocks[0].Header.Height
 	endHeight := s.sealedHead.Height
 
+	reporter := syncmock.NewIndexReporter(s.T())
+	reporter.On("LowestIndexedHeight").Return(startHeight, nil)
+	reporter.On("HighestIndexedHeight").Return(endHeight+10, nil)
+	err := s.eventsIndex.Initialize(reporter)
+	s.Require().NoError(err)
+
 	s.state.On("Sealed").Return(s.snapshot)
 	s.snapshot.On("Head").Return(s.sealedHead, nil)
 
@@ -289,6 +310,7 @@ func (s *BackendEventsSuite) TestGetEvents_HappyPaths() {
 
 		s.Run(fmt.Sprintf("all from en - %s - %s", tt.encoding.String(), tt.queryMode), func() {
 			events := storagemock.NewEvents(s.T())
+			eventsIndex := index.NewEventsIndex(events)
 
 			switch tt.queryMode {
 			case IndexQueryModeLocalOnly:
@@ -298,12 +320,12 @@ func (s *BackendEventsSuite) TestGetEvents_HappyPaths() {
 				// only calls to EN, no calls to storage
 			case IndexQueryModeFailover:
 				// all calls to storage fail
-				events.On("ByBlockID", mock.Anything).Return(nil, storage.ErrNotFound)
+				// simulated by not initializing the eventIndex so all calls return ErrIndexNotInitialized
 			}
 
 			backend := s.defaultBackend()
 			backend.queryMode = tt.queryMode
-			backend.events = events
+			backend.eventsIndex = eventsIndex
 
 			s.setupENSuccessResponse(targetEvent, s.blocks)
 
@@ -318,6 +340,7 @@ func (s *BackendEventsSuite) TestGetEvents_HappyPaths() {
 
 		s.Run(fmt.Sprintf("mixed storage & en - %s - %s", tt.encoding.String(), tt.queryMode), func() {
 			events := storagemock.NewEvents(s.T())
+			eventsIndex := index.NewEventsIndex(events)
 
 			switch tt.queryMode {
 			case IndexQueryModeLocalOnly, IndexQueryModeExecutionNodesOnly:
@@ -325,19 +348,24 @@ func (s *BackendEventsSuite) TestGetEvents_HappyPaths() {
 				return
 			case IndexQueryModeFailover:
 				// only failing blocks queried from EN
-				s.setupENSuccessResponse(targetEvent, s.blocks[0:2])
+				s.setupENSuccessResponse(targetEvent, []*flow.Block{s.blocks[0], s.blocks[4]})
 			}
 
-			// the first 2 blocks are not available from storage, and should be fetched from the EN
-			events.On("ByBlockID", s.blockIDs[0]).Return(nil, storage.ErrNotFound)
-			events.On("ByBlockID", s.blockIDs[1]).Return(nil, storage.ErrNotFound)
+			// the first and last blocks are not available from storage, and should be fetched from the EN
+			reporter := syncmock.NewIndexReporter(s.T())
+			reporter.On("LowestIndexedHeight").Return(s.blocks[1].Header.Height, nil)
+			reporter.On("HighestIndexedHeight").Return(s.blocks[3].Header.Height, nil)
+
+			events.On("ByBlockID", s.blockIDs[1]).Return(s.blockEvents, nil)
 			events.On("ByBlockID", s.blockIDs[2]).Return(s.blockEvents, nil)
 			events.On("ByBlockID", s.blockIDs[3]).Return(s.blockEvents, nil)
-			events.On("ByBlockID", s.blockIDs[4]).Return(s.blockEvents, nil)
+
+			err := eventsIndex.Initialize(reporter)
+			s.Require().NoError(err)
 
 			backend := s.defaultBackend()
 			backend.queryMode = tt.queryMode
-			backend.events = events
+			backend.eventsIndex = eventsIndex
 
 			response, err := backend.GetEventsForBlockIDs(ctx, targetEvent, s.blockIDs, tt.encoding)
 			s.Require().NoError(err)
diff --git a/engine/access/rpc/backend/backend_network.go b/engine/access/rpc/backend/backend_network.go
index 8405d03200a..1a1c87722be 100644
--- a/engine/access/rpc/backend/backend_network.go
+++ b/engine/access/rpc/backend/backend_network.go
@@ -3,7 +3,6 @@ package backend
 import (
 	"context"
 	"errors"
-	"fmt"
 
 	"github.com/onflow/flow-go/state"
 
@@ -15,11 +14,10 @@ import (
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/state/protocol/snapshots"
 	"github.com/onflow/flow-go/storage"
 )
 
-var SnapshotHistoryLimitErr = fmt.Errorf("reached the snapshot history limit")
-
 type backendNetwork struct {
 	state                protocol.State
 	chainID              flow.ChainID
@@ -54,17 +52,10 @@ func (b *backendNetwork) GetNetworkParameters(_ context.Context) access.NetworkP
 	}
 }
 
-func (b *backendNetwork) GetNodeVersionInfo(ctx context.Context) (*access.NodeVersionInfo, error) {
+func (b *backendNetwork) GetNodeVersionInfo(_ context.Context) (*access.NodeVersionInfo, error) {
 	stateParams := b.state.Params()
-	sporkId, err := stateParams.SporkID()
-	if err != nil {
-		return nil, status.Errorf(codes.Internal, "failed to read spork ID: %v", err)
-	}
-
-	protocolVersion, err := stateParams.ProtocolVersion()
-	if err != nil {
-		return nil, status.Errorf(codes.Internal, "failed to read protocol version: %v", err)
-	}
+	sporkId := stateParams.SporkID()
+	protocolVersion := stateParams.ProtocolVersion()
 
 	return &access.NodeVersionInfo{
 		Semver:          build.Version(),
@@ -78,7 +69,7 @@ func (b *backendNetwork) GetNodeVersionInfo(ctx context.Context) (*access.NodeVe
 func (b *backendNetwork) GetLatestProtocolStateSnapshot(_ context.Context) ([]byte, error) {
 	snapshot := b.state.Final()
 
-	validSnapshot, err := b.getValidSnapshot(snapshot, 0, true)
+	validSnapshot, err := snapshots.GetClosestDynamicBootstrapSnapshot(b.state, snapshot, b.snapshotHistoryLimit)
 	if err != nil {
 		return nil, err
 	}
@@ -133,9 +124,9 @@ func (b *backendNetwork) GetProtocolStateSnapshotByBlockID(_ context.Context, bl
 			"failed to retrieve snapshot for block: block not finalized and is below finalized height")
 	}
 
-	validSnapshot, err := b.getValidSnapshot(snapshot, 0, false)
+	validSnapshot, err := snapshots.GetDynamicBootstrapSnapshot(b.state, snapshot)
 	if err != nil {
-		if errors.Is(err, ErrSnapshotPhaseMismatch) {
+		if errors.Is(err, snapshots.ErrSnapshotPhaseMismatch) {
 			return nil, status.Errorf(codes.InvalidArgument,
 				"failed to retrieve snapshot for block, try again with different block: "+
 					"%v", err)
@@ -169,9 +160,9 @@ func (b *backendNetwork) GetProtocolStateSnapshotByHeight(_ context.Context, blo
 		return nil, status.Errorf(codes.Internal, "failed to get a valid snapshot: %v", err)
 	}
 
-	validSnapshot, err := b.getValidSnapshot(snapshot, 0, false)
+	validSnapshot, err := snapshots.GetDynamicBootstrapSnapshot(b.state, snapshot)
 	if err != nil {
-		if errors.Is(err, ErrSnapshotPhaseMismatch) {
+		if errors.Is(err, snapshots.ErrSnapshotPhaseMismatch) {
 			return nil, status.Errorf(codes.InvalidArgument,
 				"failed to retrieve snapshot for block, try again with different block: "+
 					"%v", err)
@@ -186,84 +177,3 @@ func (b *backendNetwork) GetProtocolStateSnapshotByHeight(_ context.Context, blo
 
 	return data, nil
 }
-
-func (b *backendNetwork) isEpochOrPhaseDifferent(counter1, counter2 uint64, phase1, phase2 flow.EpochPhase) bool {
-	return counter1 != counter2 || phase1 != phase2
-}
-
-// getValidSnapshot will return a valid snapshot that has a sealing segment which
-// 1. does not contain any blocks that span an epoch transition
-// 2. does not contain any blocks that span an epoch phase transition
-// If a snapshot does contain an invalid sealing segment query the state
-// by height of each block in the segment and return a snapshot at the point
-// where the transition happens.
-// Expected error returns during normal operations:
-// * ErrSnapshotPhaseMismatch - snapshot does not contain a valid sealing segment
-// All other errors should be treated as exceptions.
-func (b *backendNetwork) getValidSnapshot(snapshot protocol.Snapshot, blocksVisited int, findNextValidSnapshot bool) (protocol.Snapshot, error) {
-	segment, err := snapshot.SealingSegment()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get sealing segment: %w", err)
-	}
-
-	counterAtHighest, phaseAtHighest, err := b.getCounterAndPhase(segment.Highest().Header.Height)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get counter and phase at highest block in the segment: %w", err)
-	}
-
-	counterAtLowest, phaseAtLowest, err := b.getCounterAndPhase(segment.Sealed().Header.Height)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get counter and phase at lowest block in the segment: %w", err)
-	}
-
-	// Check if the counters and phase are different this indicates that the sealing segment
-	// of the snapshot requested spans either an epoch transition or phase transition.
-	if b.isEpochOrPhaseDifferent(counterAtHighest, counterAtLowest, phaseAtHighest, phaseAtLowest) {
-		if !findNextValidSnapshot {
-			return nil, ErrSnapshotPhaseMismatch
-		}
-
-		// Visit each node in strict order of decreasing height starting at head
-		// to find the block that straddles the transition boundary.
-		for i := len(segment.Blocks) - 1; i >= 0; i-- {
-			blocksVisited++
-
-			// NOTE: Check if we have reached our history limit, in edge cases
-			// where the sealing segment is abnormally long we want to short circuit
-			// the recursive calls and return an error. The API caller can retry.
-			if blocksVisited > b.snapshotHistoryLimit {
-				return nil, fmt.Errorf("%w: (%d)", SnapshotHistoryLimitErr, b.snapshotHistoryLimit)
-			}
-
-			counterAtBlock, phaseAtBlock, err := b.getCounterAndPhase(segment.Blocks[i].Header.Height)
-			if err != nil {
-				return nil, fmt.Errorf("failed to get epoch counter and phase for snapshot at block %s: %w", segment.Blocks[i].ID(), err)
-			}
-
-			// Check if this block straddles the transition boundary, if it does return the snapshot
-			// at that block height.
-			if b.isEpochOrPhaseDifferent(counterAtHighest, counterAtBlock, phaseAtHighest, phaseAtBlock) {
-				return b.getValidSnapshot(b.state.AtHeight(segment.Blocks[i].Header.Height), blocksVisited, true)
-			}
-		}
-	}
-
-	return snapshot, nil
-}
-
-// getCounterAndPhase will return the epoch counter and phase at the specified height in state
-func (b *backendNetwork) getCounterAndPhase(height uint64) (uint64, flow.EpochPhase, error) {
-	snapshot := b.state.AtHeight(height)
-
-	counter, err := snapshot.Epochs().Current().Counter()
-	if err != nil {
-		return 0, 0, fmt.Errorf("failed to get counter for block (height=%d): %w", height, err)
-	}
-
-	phase, err := snapshot.Phase()
-	if err != nil {
-		return 0, 0, fmt.Errorf("failed to get phase for block (height=%d): %w", height, err)
-	}
-
-	return counter, phase, nil
-}
diff --git a/engine/access/rpc/backend/backend_scripts.go b/engine/access/rpc/backend/backend_scripts.go
index 3158575e098..c52f05724e6 100644
--- a/engine/access/rpc/backend/backend_scripts.go
+++ b/engine/access/rpc/backend/backend_scripts.go
@@ -3,7 +3,6 @@ package backend
 import (
 	"context"
 	"crypto/md5" //nolint:gosec
-	"errors"
 	"time"
 
 	lru "github.com/hashicorp/golang-lru/v2"
@@ -237,7 +236,7 @@ func (b *backendScripts) executeScriptOnAvailableExecutionNodes(
 	var execDuration time.Duration
 	errToReturn := b.nodeCommunicator.CallAvailableNode(
 		executors,
-		func(node *flow.Identity) error {
+		func(node *flow.IdentitySkeleton) error {
 			execStartTime := time.Now()
 
 			result, err = b.tryExecuteScriptOnExecutionNode(ctx, node.Address, r)
@@ -265,7 +264,7 @@ func (b *backendScripts) executeScriptOnAvailableExecutionNodes(
 
 			return nil
 		},
-		func(node *flow.Identity, err error) bool {
+		func(node *flow.IdentitySkeleton, err error) bool {
 			if status.Code(err) == codes.InvalidArgument {
 				lg.Debug().Err(err).
 					Str("script_executor_addr", node.Address).
@@ -332,13 +331,14 @@ func convertScriptExecutionError(err error, height uint64) error {
 		return nil
 	}
 
+	var failure fvmerrors.CodedFailure
+	if fvmerrors.As(err, &failure) {
+		return rpc.ConvertError(err, "failed to execute script", codes.Internal)
+	}
+
+	// general FVM/ledger errors
 	var coded fvmerrors.CodedError
 	if fvmerrors.As(err, &coded) {
-		// general FVM/ledger errors
-		if coded.Code().IsFailure() {
-			return rpc.ConvertError(err, "failed to execute script", codes.Internal)
-		}
-
 		switch coded.Code() {
 		case fvmerrors.ErrCodeScriptExecutionCancelledError:
 			return status.Errorf(codes.Canceled, "script execution canceled: %v", err)
@@ -352,22 +352,5 @@ func convertScriptExecutionError(err error, height uint64) error {
 		}
 	}
 
-	return convertIndexError(err, height, "failed to execute script")
-}
-
-// convertIndexError converts errors related to index to a gRPC error
-func convertIndexError(err error, height uint64, defaultMsg string) error {
-	if err == nil {
-		return nil
-	}
-
-	if errors.Is(err, execution.ErrDataNotAvailable) {
-		return status.Errorf(codes.OutOfRange, "data for block height %d is not available", height)
-	}
-
-	if errors.Is(err, storage.ErrNotFound) {
-		return status.Errorf(codes.NotFound, "data not found: %v", err)
-	}
-
-	return rpc.ConvertError(err, defaultMsg, codes.Internal)
+	return rpc.ConvertIndexError(err, height, "failed to execute script")
 }
diff --git a/engine/access/rpc/backend/backend_scripts_test.go b/engine/access/rpc/backend/backend_scripts_test.go
index 0ea927820d0..2daf3857e97 100644
--- a/engine/access/rpc/backend/backend_scripts_test.go
+++ b/engine/access/rpc/backend/backend_scripts_test.go
@@ -20,7 +20,6 @@ import (
 	connectionmock "github.com/onflow/flow-go/engine/access/rpc/connection/mock"
 	fvmerrors "github.com/onflow/flow-go/fvm/errors"
 	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/module/execution"
 	execmock "github.com/onflow/flow-go/module/execution/mock"
 	"github.com/onflow/flow-go/module/irrecoverable"
 	"github.com/onflow/flow-go/module/metrics"
@@ -34,7 +33,7 @@ var (
 	expectedResponse = []byte("response_data")
 
 	cadenceErr    = fvmerrors.NewCodedError(fvmerrors.ErrCodeCadenceRunTimeError, "cadence error")
-	fvmFailureErr = fvmerrors.NewCodedError(fvmerrors.FailureCodeBlockFinderFailure, "fvm error")
+	fvmFailureErr = fvmerrors.NewCodedFailure(fvmerrors.FailureCodeBlockFinderFailure, "fvm error")
 	ctxCancelErr  = fvmerrors.NewCodedError(fvmerrors.ErrCodeScriptExecutionCancelledError, "context canceled error")
 	timeoutErr    = fvmerrors.NewCodedError(fvmerrors.ErrCodeScriptExecutionTimedOutError, "timeout error")
 )
@@ -243,7 +242,7 @@ func (s *BackendScriptsSuite) TestExecuteScriptFromStorage_Fails() {
 		statusCode codes.Code
 	}{
 		{
-			err:        execution.ErrDataNotAvailable,
+			err:        storage.ErrHeightNotIndexed,
 			statusCode: codes.OutOfRange,
 		},
 		{
@@ -288,7 +287,7 @@ func (s *BackendScriptsSuite) TestExecuteScriptWithFailover_HappyPath() {
 	ctx := context.Background()
 
 	errors := []error{
-		execution.ErrDataNotAvailable,
+		storage.ErrHeightNotIndexed,
 		storage.ErrNotFound,
 		fmt.Errorf("system error"),
 		fvmFailureErr,
@@ -383,7 +382,7 @@ func (s *BackendScriptsSuite) TestExecuteScriptWithFailover_ReturnsENErrors() {
 	// configure local script executor to fail
 	scriptExecutor := execmock.NewScriptExecutor(s.T())
 	scriptExecutor.On("ExecuteAtBlockHeight", mock.Anything, mock.Anything, mock.Anything, s.block.Header.Height).
-		Return(nil, execution.ErrDataNotAvailable)
+		Return(nil, storage.ErrHeightNotIndexed)
 
 	backend := s.defaultBackend()
 	backend.scriptExecMode = IndexQueryModeFailover
@@ -438,7 +437,7 @@ func (s *BackendScriptsSuite) testExecuteScriptAtLatestBlock(ctx context.Context
 	} else {
 		actual, err := backend.ExecuteScriptAtLatestBlock(ctx, s.failingScript, s.arguments)
 		s.Require().Error(err)
-		s.Require().Equal(statusCode, status.Code(err))
+		s.Require().Equal(statusCode, status.Code(err), "error code mismatch: expected %d, got %d: %s", statusCode, status.Code(err), err)
 		s.Require().Nil(actual)
 	}
 }
@@ -454,7 +453,7 @@ func (s *BackendScriptsSuite) testExecuteScriptAtBlockID(ctx context.Context, ba
 	} else {
 		actual, err := backend.ExecuteScriptAtBlockID(ctx, blockID, s.failingScript, s.arguments)
 		s.Require().Error(err)
-		s.Require().Equal(statusCode, status.Code(err))
+		s.Require().Equal(statusCode, status.Code(err), "error code mismatch: expected %d, got %d: %s", statusCode, status.Code(err), err)
 		s.Require().Nil(actual)
 	}
 }
@@ -470,7 +469,7 @@ func (s *BackendScriptsSuite) testExecuteScriptAtBlockHeight(ctx context.Context
 	} else {
 		actual, err := backend.ExecuteScriptAtBlockHeight(ctx, height, s.failingScript, s.arguments)
 		s.Require().Error(err)
-		s.Require().Equal(statusCode, status.Code(err))
+		s.Require().Equalf(statusCode, status.Code(err), "error code mismatch: expected %d, got %d: %s", statusCode, status.Code(err), err)
 		s.Require().Nil(actual)
 	}
 }
diff --git a/engine/access/rpc/backend/backend_stream_block_digests_test.go b/engine/access/rpc/backend/backend_stream_block_digests_test.go
new file mode 100644
index 00000000000..e6df4ddb824
--- /dev/null
+++ b/engine/access/rpc/backend/backend_stream_block_digests_test.go
@@ -0,0 +1,148 @@
+package backend
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/onflow/flow-go/engine/access/subscription"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+type BackendBlockDigestSuite struct {
+	BackendBlocksSuite
+}
+
+func TestBackendBlockDigestSuite(t *testing.T) {
+	suite.Run(t, new(BackendBlockDigestSuite))
+}
+
+// SetupTest initializes the test suite with required dependencies.
+func (s *BackendBlockDigestSuite) SetupTest() {
+	s.BackendBlocksSuite.SetupTest()
+}
+
+// TestSubscribeBlockDigestsFromStartBlockID tests the SubscribeBlockDigestsFromStartBlockID method.
+func (s *BackendBlockDigestSuite) TestSubscribeBlockDigestsFromStartBlockID() {
+	s.blockTracker.On(
+		"GetStartHeightFromBlockID",
+		mock.AnythingOfType("flow.Identifier"),
+	).Return(func(startBlockID flow.Identifier) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromBlockID(startBlockID)
+	}, nil)
+
+	call := func(ctx context.Context, startValue interface{}, blockStatus flow.BlockStatus) subscription.Subscription {
+		return s.backend.SubscribeBlockDigestsFromStartBlockID(ctx, startValue.(flow.Identifier), blockStatus)
+	}
+
+	s.subscribe(call, s.requireBlockDigests, s.subscribeFromStartBlockIdTestCases())
+}
+
+// TestSubscribeBlockDigestsFromStartHeight tests the SubscribeBlockDigestsFromStartHeight method.
+func (s *BackendBlockDigestSuite) TestSubscribeBlockDigestsFromStartHeight() {
+	s.blockTracker.On(
+		"GetStartHeightFromHeight",
+		mock.AnythingOfType("uint64"),
+	).Return(func(startHeight uint64) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromHeight(startHeight)
+	}, nil)
+
+	call := func(ctx context.Context, startValue interface{}, blockStatus flow.BlockStatus) subscription.Subscription {
+		return s.backend.SubscribeBlockDigestsFromStartHeight(ctx, startValue.(uint64), blockStatus)
+	}
+
+	s.subscribe(call, s.requireBlockDigests, s.subscribeFromStartHeightTestCases())
+}
+
+// TestSubscribeBlockDigestsFromLatest tests the SubscribeBlockDigestsFromLatest method.
+func (s *BackendBlockDigestSuite) TestSubscribeBlockDigestsFromLatest() {
+	s.blockTracker.On(
+		"GetStartHeightFromLatest",
+		mock.Anything,
+	).Return(func(ctx context.Context) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromLatest(ctx)
+	}, nil)
+
+	call := func(ctx context.Context, startValue interface{}, blockStatus flow.BlockStatus) subscription.Subscription {
+		return s.backend.SubscribeBlockDigestsFromLatest(ctx, blockStatus)
+	}
+
+	s.subscribe(call, s.requireBlockDigests, s.subscribeFromLatestTestCases())
+}
+
+// requireBlockDigests ensures that the received block digest information matches the expected data.
+func (s *BackendBlockDigestSuite) requireBlockDigests(v interface{}, expectedBlock *flow.Block) {
+	actualBlock, ok := v.(*flow.BlockDigest)
+	require.True(s.T(), ok, "unexpected response type: %T", v)
+
+	s.Require().Equal(expectedBlock.Header.ID(), actualBlock.ID())
+	s.Require().Equal(expectedBlock.Header.Height, actualBlock.Height)
+	s.Require().Equal(expectedBlock.Header.Timestamp, actualBlock.Timestamp)
+}
+
+// TestSubscribeBlockDigestsHandlesErrors tests error handling scenarios for the SubscribeBlockDigestsFromStartBlockID and SubscribeBlockDigestsFromStartHeight methods in the Backend.
+// It ensures that the method correctly returns errors for various invalid input cases.
+//
+// Test Cases:
+//
+// 1. Returns error for unindexed start block id:
+//   - Tests that subscribing to block headers with an unindexed start block ID results in a NotFound error.
+//
+// 2. Returns error for start height before root height:
+//   - Validates that attempting to subscribe to block headers with a start height before the root height results in an InvalidArgument error.
+//
+// 3. Returns error for unindexed start height:
+//   - Tests that subscribing to block headers with an unindexed start height results in a NotFound error.
+//
+// Each test case checks for specific error conditions and ensures that the methods responds appropriately.
+func (s *BackendBlockDigestSuite) TestSubscribeBlockDigestsHandlesErrors() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	// mock block tracker for GetStartHeightFromBlockID
+	s.blockTracker.On(
+		"GetStartHeightFromBlockID",
+		mock.AnythingOfType("flow.Identifier"),
+	).Return(func(startBlockID flow.Identifier) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromBlockID(startBlockID)
+	}, nil)
+
+	s.Run("returns error if unknown start block id is provided", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeBlockDigestsFromStartBlockID(subCtx, unittest.IdentifierFixture(), flow.BlockStatusFinalized)
+		assert.Equal(s.T(), codes.NotFound, status.Code(sub.Err()), "expected %s, got %v: %v", codes.NotFound, status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	// mock block tracker for GetStartHeightFromHeight
+	s.blockTracker.On(
+		"GetStartHeightFromHeight",
+		mock.AnythingOfType("uint64"),
+	).Return(func(startHeight uint64) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromHeight(startHeight)
+	}, nil)
+
+	s.Run("returns error for start height before root height", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeBlockDigestsFromStartHeight(subCtx, s.rootBlock.Header.Height-1, flow.BlockStatusFinalized)
+		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()), "expected %s, got %v: %v", codes.InvalidArgument, status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	s.Run("returns error if unknown start height is provided", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeBlockDigestsFromStartHeight(subCtx, s.blocksArray[len(s.blocksArray)-1].Header.Height+10, flow.BlockStatusFinalized)
+		assert.Equal(s.T(), codes.NotFound, status.Code(sub.Err()), "expected %s, got %v: %v", codes.NotFound, status.Code(sub.Err()).String(), sub.Err())
+	})
+}
diff --git a/engine/access/rpc/backend/backend_stream_block_headers_test.go b/engine/access/rpc/backend/backend_stream_block_headers_test.go
new file mode 100644
index 00000000000..764187a7fc9
--- /dev/null
+++ b/engine/access/rpc/backend/backend_stream_block_headers_test.go
@@ -0,0 +1,148 @@
+package backend
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/onflow/flow-go/engine/access/subscription"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+type BackendBlockHeadersSuite struct {
+	BackendBlocksSuite
+}
+
+func TestBackendBlockHeadersSuite(t *testing.T) {
+	suite.Run(t, new(BackendBlockHeadersSuite))
+}
+
+// SetupTest initializes the test suite with required dependencies.
+func (s *BackendBlockHeadersSuite) SetupTest() {
+	s.BackendBlocksSuite.SetupTest()
+}
+
+// TestSubscribeBlockHeadersFromStartBlockID tests the SubscribeBlockHeadersFromStartBlockID method.
+func (s *BackendBlockHeadersSuite) TestSubscribeBlockHeadersFromStartBlockID() {
+	s.blockTracker.On(
+		"GetStartHeightFromBlockID",
+		mock.AnythingOfType("flow.Identifier"),
+	).Return(func(startBlockID flow.Identifier) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromBlockID(startBlockID)
+	}, nil)
+
+	call := func(ctx context.Context, startValue interface{}, blockStatus flow.BlockStatus) subscription.Subscription {
+		return s.backend.SubscribeBlockHeadersFromStartBlockID(ctx, startValue.(flow.Identifier), blockStatus)
+	}
+
+	s.subscribe(call, s.requireBlockHeaders, s.subscribeFromStartBlockIdTestCases())
+}
+
+// TestSubscribeBlockHeadersFromStartHeight tests the SubscribeBlockHeadersFromStartHeight method.
+func (s *BackendBlockHeadersSuite) TestSubscribeBlockHeadersFromStartHeight() {
+	s.blockTracker.On(
+		"GetStartHeightFromHeight",
+		mock.AnythingOfType("uint64"),
+	).Return(func(startHeight uint64) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromHeight(startHeight)
+	}, nil)
+
+	call := func(ctx context.Context, startValue interface{}, blockStatus flow.BlockStatus) subscription.Subscription {
+		return s.backend.SubscribeBlockHeadersFromStartHeight(ctx, startValue.(uint64), blockStatus)
+	}
+
+	s.subscribe(call, s.requireBlockHeaders, s.subscribeFromStartHeightTestCases())
+}
+
+// TestSubscribeBlockHeadersFromLatest tests the SubscribeBlockHeadersFromLatest method.
+func (s *BackendBlockHeadersSuite) TestSubscribeBlockHeadersFromLatest() {
+	s.blockTracker.On(
+		"GetStartHeightFromLatest",
+		mock.Anything,
+	).Return(func(ctx context.Context) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromLatest(ctx)
+	}, nil)
+
+	call := func(ctx context.Context, startValue interface{}, blockStatus flow.BlockStatus) subscription.Subscription {
+		return s.backend.SubscribeBlockHeadersFromLatest(ctx, blockStatus)
+	}
+
+	s.subscribe(call, s.requireBlockHeaders, s.subscribeFromLatestTestCases())
+}
+
+// requireBlockHeaders ensures that the received block header information matches the expected data.
+func (s *BackendBlockHeadersSuite) requireBlockHeaders(v interface{}, expectedBlock *flow.Block) {
+	actualHeader, ok := v.(*flow.Header)
+	require.True(s.T(), ok, "unexpected response type: %T", v)
+
+	s.Require().Equal(expectedBlock.Header.Height, actualHeader.Height)
+	s.Require().Equal(expectedBlock.Header.ID(), actualHeader.ID())
+	s.Require().Equal(*expectedBlock.Header, *actualHeader)
+}
+
+// TestSubscribeBlockHeadersHandlesErrors tests error handling scenarios for the SubscribeBlockHeadersFromStartBlockID and SubscribeBlockHeadersFromStartHeight methods in the Backend.
+// It ensures that the method correctly returns errors for various invalid input cases.
+//
+// Test Cases:
+//
+// 1. Returns error for unindexed start block id:
+//   - Tests that subscribing to block headers with an unindexed start block ID results in a NotFound error.
+//
+// 2. Returns error for start height before root height:
+//   - Validates that attempting to subscribe to block headers with a start height before the root height results in an InvalidArgument error.
+//
+// 3. Returns error for unindexed start height:
+//   - Tests that subscribing to block headers with an unindexed start height results in a NotFound error.
+//
+// Each test case checks for specific error conditions and ensures that the methods responds appropriately.
+func (s *BackendBlockHeadersSuite) TestSubscribeBlockHeadersHandlesErrors() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	// mock block tracker for GetStartHeightFromBlockID
+	s.blockTracker.On(
+		"GetStartHeightFromBlockID",
+		mock.AnythingOfType("flow.Identifier"),
+	).Return(func(startBlockID flow.Identifier) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromBlockID(startBlockID)
+	}, nil)
+
+	s.Run("returns error for unknown start block id is provided", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeBlockHeadersFromStartBlockID(subCtx, unittest.IdentifierFixture(), flow.BlockStatusFinalized)
+		assert.Equal(s.T(), codes.NotFound, status.Code(sub.Err()), "expected %s, got %v: %v", codes.NotFound, status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	// mock block tracker for GetStartHeightFromHeight
+	s.blockTracker.On(
+		"GetStartHeightFromHeight",
+		mock.AnythingOfType("uint64"),
+	).Return(func(startHeight uint64) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromHeight(startHeight)
+	}, nil)
+
+	s.Run("returns error if start height before root height", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeBlockHeadersFromStartHeight(subCtx, s.rootBlock.Header.Height-1, flow.BlockStatusFinalized)
+		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()), "expected %s, got %v: %v", codes.InvalidArgument, status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	s.Run("returns error for unknown start height is provided", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeBlockHeadersFromStartHeight(subCtx, s.blocksArray[len(s.blocksArray)-1].Header.Height+10, flow.BlockStatusFinalized)
+		assert.Equal(s.T(), codes.NotFound, status.Code(sub.Err()), "expected %s, got %v: %v", codes.NotFound, status.Code(sub.Err()).String(), sub.Err())
+	})
+}
diff --git a/engine/access/rpc/backend/backend_stream_blocks.go b/engine/access/rpc/backend/backend_stream_blocks.go
new file mode 100644
index 00000000000..b6523377df3
--- /dev/null
+++ b/engine/access/rpc/backend/backend_stream_blocks.go
@@ -0,0 +1,337 @@
+package backend
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/engine/access/subscription"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/storage"
+	"github.com/onflow/flow-go/utils/logging"
+)
+
+// backendSubscribeBlocks is a struct representing a backend implementation for subscribing to blocks.
+type backendSubscribeBlocks struct {
+	log     zerolog.Logger
+	state   protocol.State
+	blocks  storage.Blocks
+	headers storage.Headers
+
+	subscriptionHandler *subscription.SubscriptionHandler
+	blockTracker        subscription.BlockTracker
+}
+
+// SubscribeBlocksFromStartBlockID subscribes to the finalized or sealed blocks starting at the requested
+// start block id, up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+//
+// Each block is filtered by the provided block status, and only
+// those blocks that match the status are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - startBlockID: The identifier of the starting block.
+// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+//
+// If invalid parameters will be supplied SubscribeBlocksFromStartBlockID will return a failed subscription.
+func (b *backendSubscribeBlocks) SubscribeBlocksFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, blockStatus flow.BlockStatus) subscription.Subscription {
+	return b.subscribeFromStartBlockID(ctx, startBlockID, b.getBlockResponse(blockStatus))
+}
+
+// SubscribeBlocksFromStartHeight subscribes to the finalized or sealed blocks starting at the requested
+// start block height, up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+//
+// Each block is filtered by the provided block status, and only
+// those blocks that match the status are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - startHeight: The height of the starting block.
+// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+//
+// If invalid parameters will be supplied SubscribeBlocksFromStartHeight will return a failed subscription.
+func (b *backendSubscribeBlocks) SubscribeBlocksFromStartHeight(ctx context.Context, startHeight uint64, blockStatus flow.BlockStatus) subscription.Subscription {
+	return b.subscribeFromStartHeight(ctx, startHeight, b.getBlockResponse(blockStatus))
+}
+
+// SubscribeBlocksFromLatest subscribes to the finalized or sealed blocks starting at the latest sealed block,
+// up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+//
+// Each block is filtered by the provided block status, and only
+// those blocks that match the status are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+//
+// If invalid parameters will be supplied SubscribeBlocksFromLatest will return a failed subscription.
+func (b *backendSubscribeBlocks) SubscribeBlocksFromLatest(ctx context.Context, blockStatus flow.BlockStatus) subscription.Subscription {
+	return b.subscribeFromLatest(ctx, b.getBlockResponse(blockStatus))
+}
+
+// SubscribeBlockHeadersFromStartBlockID streams finalized or sealed block headers starting at the requested
+// start block id, up until the latest available block header. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block header as it becomes available.
+//
+// Each block header are filtered by the provided block status, and only
+// those block headers that match the status are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - startBlockID: The identifier of the starting block.
+// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+//
+// If invalid parameters will be supplied SubscribeBlockHeadersFromStartBlockID will return a failed subscription.
+func (b *backendSubscribeBlocks) SubscribeBlockHeadersFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, blockStatus flow.BlockStatus) subscription.Subscription {
+	return b.subscribeFromStartBlockID(ctx, startBlockID, b.getBlockHeaderResponse(blockStatus))
+}
+
+// SubscribeBlockHeadersFromStartHeight streams finalized or sealed block headers starting at the requested
+// start block height, up until the latest available block header. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block header as it becomes available.
+//
+// Each block header are filtered by the provided block status, and only
+// those block headers that match the status are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - startHeight: The height of the starting block.
+// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+//
+// If invalid parameters will be supplied SubscribeBlockHeadersFromStartHeight will return a failed subscription.
+func (b *backendSubscribeBlocks) SubscribeBlockHeadersFromStartHeight(ctx context.Context, startHeight uint64, blockStatus flow.BlockStatus) subscription.Subscription {
+	return b.subscribeFromStartHeight(ctx, startHeight, b.getBlockHeaderResponse(blockStatus))
+}
+
+// SubscribeBlockHeadersFromLatest streams finalized or sealed block headers starting at the latest sealed block,
+// up until the latest available block header. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block header as it becomes available.
+//
+// Each block header are filtered by the provided block status, and only
+// those block headers that match the status are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+//
+// If invalid parameters will be supplied SubscribeBlockHeadersFromLatest will return a failed subscription.
+func (b *backendSubscribeBlocks) SubscribeBlockHeadersFromLatest(ctx context.Context, blockStatus flow.BlockStatus) subscription.Subscription {
+	return b.subscribeFromLatest(ctx, b.getBlockHeaderResponse(blockStatus))
+}
+
+// SubscribeBlockDigestsFromStartBlockID streams finalized or sealed lightweight block starting at the requested
+// start block id, up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+//
+// Each lightweight block are filtered by the provided block status, and only
+// those blocks that match the status are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - startBlockID: The identifier of the starting block.
+// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+//
+// If invalid parameters will be supplied SubscribeBlockDigestsFromStartBlockID will return a failed subscription.
+func (b *backendSubscribeBlocks) SubscribeBlockDigestsFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, blockStatus flow.BlockStatus) subscription.Subscription {
+	return b.subscribeFromStartBlockID(ctx, startBlockID, b.getBlockDigestResponse(blockStatus))
+}
+
+// SubscribeBlockDigestsFromStartHeight streams finalized or sealed lightweight block starting at the requested
+// start block height, up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+//
+// Each lightweight block are filtered by the provided block status, and only
+// those blocks that match the status are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - startHeight: The height of the starting block.
+// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+//
+// If invalid parameters will be supplied SubscribeBlockDigestsFromStartHeight will return a failed subscription.
+func (b *backendSubscribeBlocks) SubscribeBlockDigestsFromStartHeight(ctx context.Context, startHeight uint64, blockStatus flow.BlockStatus) subscription.Subscription {
+	return b.subscribeFromStartHeight(ctx, startHeight, b.getBlockDigestResponse(blockStatus))
+}
+
+// SubscribeBlockDigestsFromLatest streams finalized or sealed lightweight block starting at the latest sealed block,
+// up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+//
+// Each lightweight block are filtered by the provided block status, and only
+// those blocks that match the status are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - blockStatus: The status of the block, which could be only BlockStatusSealed or BlockStatusFinalized.
+//
+// If invalid parameters will be supplied SubscribeBlockDigestsFromLatest will return a failed subscription.
+func (b *backendSubscribeBlocks) SubscribeBlockDigestsFromLatest(ctx context.Context, blockStatus flow.BlockStatus) subscription.Subscription {
+	return b.subscribeFromLatest(ctx, b.getBlockDigestResponse(blockStatus))
+}
+
+// subscribeFromStartBlockID is common method that allows clients to subscribe starting at the requested start block id.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - startBlockID: The identifier of the starting block.
+// - getData: The callback used by subscriptions to retrieve data information for the specified height and block status.
+//
+// If invalid parameters are supplied, subscribeFromStartBlockID will return a failed subscription.
+func (b *backendSubscribeBlocks) subscribeFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, getData subscription.GetDataByHeightFunc) subscription.Subscription {
+	nextHeight, err := b.blockTracker.GetStartHeightFromBlockID(startBlockID)
+	if err != nil {
+		return subscription.NewFailedSubscription(err, "could not get start height from block id")
+	}
+	return b.subscriptionHandler.Subscribe(ctx, nextHeight, getData)
+}
+
+// subscribeFromStartHeight is common method that allows clients to subscribe starting at the requested start block height.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - startHeight: The height of the starting block.
+// - getData: The callback used by subscriptions to retrieve data information for the specified height and block status.
+//
+// If invalid parameters are supplied, subscribeFromStartHeight will return a failed subscription.
+func (b *backendSubscribeBlocks) subscribeFromStartHeight(ctx context.Context, startHeight uint64, getData subscription.GetDataByHeightFunc) subscription.Subscription {
+	nextHeight, err := b.blockTracker.GetStartHeightFromHeight(startHeight)
+	if err != nil {
+		return subscription.NewFailedSubscription(err, "could not get start height from block height")
+	}
+	return b.subscriptionHandler.Subscribe(ctx, nextHeight, getData)
+}
+
+// subscribeFromLatest is common method that allows clients to subscribe starting at the latest sealed block.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - getData: The callback used by subscriptions to retrieve data information for the specified height and block status.
+//
+// No errors are expected during normal operation.
+func (b *backendSubscribeBlocks) subscribeFromLatest(ctx context.Context, getData subscription.GetDataByHeightFunc) subscription.Subscription {
+	nextHeight, err := b.blockTracker.GetStartHeightFromLatest(ctx)
+	if err != nil {
+		return subscription.NewFailedSubscription(err, "could not get start height from latest")
+	}
+	return b.subscriptionHandler.Subscribe(ctx, nextHeight, getData)
+}
+
+// getBlockResponse returns a GetDataByHeightFunc that retrieves block information for the specified height.
+func (b *backendSubscribeBlocks) getBlockResponse(blockStatus flow.BlockStatus) subscription.GetDataByHeightFunc {
+	return func(_ context.Context, height uint64) (interface{}, error) {
+		block, err := b.getBlock(height, blockStatus)
+		if err != nil {
+			return nil, err
+		}
+
+		b.log.Trace().
+			Hex("block_id", logging.ID(block.ID())).
+			Uint64("height", height).
+			Msgf("sending block info")
+
+		return block, nil
+	}
+}
+
+// getBlockHeaderResponse returns a GetDataByHeightFunc that retrieves block header information for the specified height.
+func (b *backendSubscribeBlocks) getBlockHeaderResponse(blockStatus flow.BlockStatus) subscription.GetDataByHeightFunc {
+	return func(_ context.Context, height uint64) (interface{}, error) {
+		header, err := b.getBlockHeader(height, blockStatus)
+		if err != nil {
+			return nil, err
+		}
+
+		b.log.Trace().
+			Hex("block_id", logging.ID(header.ID())).
+			Uint64("height", height).
+			Msgf("sending block header info")
+
+		return header, nil
+	}
+}
+
+// getBlockDigestResponse returns a GetDataByHeightFunc that retrieves lightweight block information for the specified height.
+func (b *backendSubscribeBlocks) getBlockDigestResponse(blockStatus flow.BlockStatus) subscription.GetDataByHeightFunc {
+	return func(_ context.Context, height uint64) (interface{}, error) {
+		header, err := b.getBlockHeader(height, blockStatus)
+		if err != nil {
+			return nil, err
+		}
+
+		b.log.Trace().
+			Hex("block_id", logging.ID(header.ID())).
+			Uint64("height", height).
+			Msgf("sending lightweight block info")
+
+		return flow.NewBlockDigest(header.ID(), header.Height, header.Timestamp), nil
+	}
+}
+
+// getBlockHeader returns the block header for the given block height.
+// Expected errors during normal operation:
+// - storage.ErrNotFound: block for the given block height is not available.
+func (b *backendSubscribeBlocks) getBlockHeader(height uint64, expectedBlockStatus flow.BlockStatus) (*flow.Header, error) {
+	err := b.validateHeight(height, expectedBlockStatus)
+	if err != nil {
+		return nil, err
+	}
+
+	// since we are querying a finalized or sealed block header, we can use the height index and save an ID computation
+	header, err := b.headers.ByHeight(height)
+	if err != nil {
+		return nil, err
+	}
+
+	return header, nil
+}
+
+// getBlock returns the block for the given block height.
+// Expected errors during normal operation:
+// - storage.ErrNotFound: block for the given block height is not available.
+func (b *backendSubscribeBlocks) getBlock(height uint64, expectedBlockStatus flow.BlockStatus) (*flow.Block, error) {
+	err := b.validateHeight(height, expectedBlockStatus)
+	if err != nil {
+		return nil, err
+	}
+
+	// since we are querying a finalized or sealed block, we can use the height index and save an ID computation
+	block, err := b.blocks.ByHeight(height)
+	if err != nil {
+		return nil, err
+	}
+
+	return block, nil
+}
+
+// validateHeight checks if the given block height is valid and available based on the expected block status.
+// Expected errors during normal operation:
+// - storage.ErrNotFound: block for the given block height is not available.
+func (b *backendSubscribeBlocks) validateHeight(height uint64, expectedBlockStatus flow.BlockStatus) error {
+	highestHeight, err := b.blockTracker.GetHighestHeight(expectedBlockStatus)
+	if err != nil {
+		return fmt.Errorf("could not get highest available height: %w", err)
+	}
+
+	// fail early if no notification has been received for the given block height.
+	// note: it's possible for the data to exist in the data store before the notification is
+	// received. this ensures a consistent view is available to all streams.
+	if height > highestHeight {
+		return fmt.Errorf("block %d is not available yet: %w", height, storage.ErrNotFound)
+	}
+
+	return nil
+}
diff --git a/engine/access/rpc/backend/backend_stream_blocks_test.go b/engine/access/rpc/backend/backend_stream_blocks_test.go
new file mode 100644
index 00000000000..69aa9e67823
--- /dev/null
+++ b/engine/access/rpc/backend/backend_stream_blocks_test.go
@@ -0,0 +1,502 @@
+package backend
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/onflow/flow-go/engine"
+	connectionmock "github.com/onflow/flow-go/engine/access/rpc/connection/mock"
+	"github.com/onflow/flow-go/engine/access/subscription"
+	subscriptionmock "github.com/onflow/flow-go/engine/access/subscription/mock"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/metrics"
+	protocol "github.com/onflow/flow-go/state/protocol/mock"
+	"github.com/onflow/flow-go/storage"
+	storagemock "github.com/onflow/flow-go/storage/mock"
+	"github.com/onflow/flow-go/utils/unittest"
+	"github.com/onflow/flow-go/utils/unittest/mocks"
+)
+
+// BackendBlocksSuite is a test suite for the backendBlocks functionality related to blocks subscription.
+// It utilizes the suite to organize and structure test code.
+type BackendBlocksSuite struct {
+	suite.Suite
+
+	state    *protocol.State
+	snapshot *protocol.Snapshot
+	log      zerolog.Logger
+
+	blocks           *storagemock.Blocks
+	headers          *storagemock.Headers
+	blockTracker     *subscriptionmock.BlockTracker
+	blockTrackerReal subscription.BlockTracker
+
+	connectionFactory *connectionmock.ConnectionFactory
+
+	chainID flow.ChainID
+
+	broadcaster *engine.Broadcaster
+	blocksArray []*flow.Block
+	blockMap    map[uint64]*flow.Block
+	rootBlock   flow.Block
+
+	backend *Backend
+}
+
+// testType represents a test scenario for subscribing
+type testType struct {
+	name            string
+	highestBackfill int
+	startValue      interface{}
+	blockStatus     flow.BlockStatus
+}
+
+func TestBackendBlocksSuite(t *testing.T) {
+	suite.Run(t, new(BackendBlocksSuite))
+}
+
+// SetupTest initializes the test suite with required dependencies.
+func (s *BackendBlocksSuite) SetupTest() {
+	s.log = zerolog.New(zerolog.NewConsoleWriter())
+	s.state = new(protocol.State)
+	s.snapshot = new(protocol.Snapshot)
+	header := unittest.BlockHeaderFixture()
+
+	params := new(protocol.Params)
+	params.On("SporkID").Return(unittest.IdentifierFixture(), nil)
+	params.On("ProtocolVersion").Return(uint(unittest.Uint64InRange(10, 30)), nil)
+	params.On("SporkRootBlockHeight").Return(header.Height, nil)
+	params.On("SealedRoot").Return(header, nil)
+	s.state.On("Params").Return(params)
+
+	s.blocks = new(storagemock.Blocks)
+	s.headers = new(storagemock.Headers)
+	s.chainID = flow.Testnet
+	s.connectionFactory = connectionmock.NewConnectionFactory(s.T())
+	s.blockTracker = subscriptionmock.NewBlockTracker(s.T())
+
+	s.broadcaster = engine.NewBroadcaster()
+
+	blockCount := 5
+	s.blockMap = make(map[uint64]*flow.Block, blockCount)
+	s.blocksArray = make([]*flow.Block, 0, blockCount)
+
+	// generate blockCount consecutive blocks with associated seal, result and execution data
+	s.rootBlock = unittest.BlockFixture()
+	parent := s.rootBlock.Header
+	s.blockMap[s.rootBlock.Header.Height] = &s.rootBlock
+
+	for i := 0; i < blockCount; i++ {
+		block := unittest.BlockWithParentFixture(parent)
+		// update for next iteration
+		parent = block.Header
+
+		s.blocksArray = append(s.blocksArray, block)
+		s.blockMap[block.Header.Height] = block
+	}
+
+	s.headers.On("ByBlockID", mock.AnythingOfType("flow.Identifier")).Return(
+		func(blockID flow.Identifier) (*flow.Header, error) {
+			for _, block := range s.blockMap {
+				if block.ID() == blockID {
+					return block.Header, nil
+				}
+			}
+			return nil, storage.ErrNotFound
+		},
+	).Maybe()
+
+	s.headers.On("ByHeight", mock.AnythingOfType("uint64")).Return(
+		mocks.ConvertStorageOutput(
+			mocks.StorageMapGetter(s.blockMap),
+			func(block *flow.Block) *flow.Header { return block.Header },
+		),
+	).Maybe()
+
+	s.blocks.On("ByHeight", mock.AnythingOfType("uint64")).Return(
+		mocks.StorageMapGetter(s.blockMap),
+	).Maybe()
+
+	s.snapshot.On("Head").Return(s.rootBlock.Header, nil).Twice()
+	s.state.On("Final").Return(s.snapshot, nil).Maybe()
+	s.state.On("Sealed").Return(s.snapshot, nil).Maybe()
+
+	var err error
+	s.backend, err = New(s.backendParams())
+	require.NoError(s.T(), err)
+
+	// create real block tracker to use GetStartHeight from it, instead of mocking
+	s.blockTrackerReal, err = subscription.NewBlockTracker(
+		s.state,
+		s.rootBlock.Header.Height,
+		s.headers,
+		s.broadcaster,
+	)
+	require.NoError(s.T(), err)
+}
+
+// backendParams returns the Params configuration for the backend.
+func (s *BackendBlocksSuite) backendParams() Params {
+	return Params{
+		State:                    s.state,
+		Blocks:                   s.blocks,
+		Headers:                  s.headers,
+		ChainID:                  s.chainID,
+		MaxHeightRange:           DefaultMaxHeightRange,
+		SnapshotHistoryLimit:     DefaultSnapshotHistoryLimit,
+		AccessMetrics:            metrics.NewNoopCollector(),
+		Log:                      s.log,
+		TxErrorMessagesCacheSize: 1000,
+		SubscriptionHandler: subscription.NewSubscriptionHandler(
+			s.log,
+			s.broadcaster,
+			subscription.DefaultSendTimeout,
+			subscription.DefaultResponseLimit,
+			subscription.DefaultSendBufferSize,
+		),
+		BlockTracker: s.blockTracker,
+	}
+}
+
+// subscribeFromStartBlockIdTestCases generates variations of testType scenarios for subscriptions
+// starting from a specified block ID. It is designed to test the subscription functionality when the subscription
+// starts from a custom block ID, either sealed or finalized.
+func (s *BackendBlocksSuite) subscribeFromStartBlockIdTestCases() []testType {
+	baseTests := []testType{
+		{
+			name:            "happy path - all new blocks",
+			highestBackfill: -1, // no backfill
+			startValue:      s.rootBlock.ID(),
+		},
+		{
+			name:            "happy path - partial backfill",
+			highestBackfill: 2, // backfill the first 3 blocks
+			startValue:      s.blocksArray[0].ID(),
+		},
+		{
+			name:            "happy path - complete backfill",
+			highestBackfill: len(s.blocksArray) - 1, // backfill all blocks
+			startValue:      s.blocksArray[0].ID(),
+		},
+		{
+			name:            "happy path - start from root block by id",
+			highestBackfill: len(s.blocksArray) - 1, // backfill all blocks
+			startValue:      s.rootBlock.ID(),       // start from root block
+		},
+	}
+
+	return s.setupBlockStatusesForTestCases(baseTests)
+}
+
+// subscribeFromStartHeightTestCases generates variations of testType scenarios for subscriptions
+// starting from a specified block height. It is designed to test the subscription functionality when the subscription
+// starts from a custom height, either sealed or finalized.
+func (s *BackendBlocksSuite) subscribeFromStartHeightTestCases() []testType {
+	baseTests := []testType{
+		{
+			name:            "happy path - all new blocks",
+			highestBackfill: -1, // no backfill
+			startValue:      s.rootBlock.Header.Height,
+		},
+		{
+			name:            "happy path - partial backfill",
+			highestBackfill: 2, // backfill the first 3 blocks
+			startValue:      s.blocksArray[0].Header.Height,
+		},
+		{
+			name:            "happy path - complete backfill",
+			highestBackfill: len(s.blocksArray) - 1, // backfill all blocks
+			startValue:      s.blocksArray[0].Header.Height,
+		},
+		{
+			name:            "happy path - start from root block by id",
+			highestBackfill: len(s.blocksArray) - 1,    // backfill all blocks
+			startValue:      s.rootBlock.Header.Height, // start from root block
+		},
+	}
+
+	return s.setupBlockStatusesForTestCases(baseTests)
+}
+
+// subscribeFromLatestTestCases generates variations of testType scenarios for subscriptions
+// starting from the latest sealed block. It is designed to test the subscription functionality when the subscription
+// starts from the latest available block, either sealed or finalized.
+func (s *BackendBlocksSuite) subscribeFromLatestTestCases() []testType {
+	baseTests := []testType{
+		{
+			name:            "happy path - all new blocks",
+			highestBackfill: -1, // no backfill
+		},
+		{
+			name:            "happy path - partial backfill",
+			highestBackfill: 2, // backfill the first 3 blocks
+		},
+		{
+			name:            "happy path - complete backfill",
+			highestBackfill: len(s.blocksArray) - 1, // backfill all blocks
+		},
+	}
+
+	return s.setupBlockStatusesForTestCases(baseTests)
+}
+
+// setupBlockStatusesForTestCases sets up variations for each of the base test cases.
+// The function performs the following actions:
+//
+//  1. Creates variations for each of the provided base test scenarios.
+//  2. For each base test, it generates two variations: one for Sealed blocks and one for Finalized blocks.
+//  3. Returns a slice of testType containing all variations of test scenarios.
+//
+// Parameters:
+//   - baseTests: A slice of testType representing base test scenarios.
+func (s *BackendBlocksSuite) setupBlockStatusesForTestCases(baseTests []testType) []testType {
+	// create variations for each of the base test
+	tests := make([]testType, 0, len(baseTests)*2)
+	for _, test := range baseTests {
+		t1 := test
+		t1.name = fmt.Sprintf("%s - finalized blocks", test.name)
+		t1.blockStatus = flow.BlockStatusFinalized
+		tests = append(tests, t1)
+
+		t2 := test
+		t2.name = fmt.Sprintf("%s - sealed blocks", test.name)
+		t2.blockStatus = flow.BlockStatusSealed
+		tests = append(tests, t2)
+	}
+
+	return tests
+}
+
+// setupBlockTrackerMock configures a mock for the block tracker based on the provided parameters.
+//
+// Parameters:
+//   - blockStatus: The status of the blocks being tracked (Sealed or Finalized).
+//   - highestHeader: The highest header that the block tracker should report.
+func (s *BackendBlocksSuite) setupBlockTrackerMock(blockStatus flow.BlockStatus, highestHeader *flow.Header) {
+	s.blockTracker.On("GetHighestHeight", mock.Anything).Unset()
+	s.blockTracker.On("GetHighestHeight", blockStatus).Return(highestHeader.Height, nil)
+
+	if blockStatus == flow.BlockStatusSealed {
+		s.snapshot.On("Head").Unset()
+		s.snapshot.On("Head").Return(highestHeader, nil)
+	}
+}
+
+// TestSubscribeBlocksFromStartBlockID tests the SubscribeBlocksFromStartBlockID method.
+func (s *BackendBlocksSuite) TestSubscribeBlocksFromStartBlockID() {
+	s.blockTracker.On(
+		"GetStartHeightFromBlockID",
+		mock.AnythingOfType("flow.Identifier"),
+	).Return(func(startBlockID flow.Identifier) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromBlockID(startBlockID)
+	}, nil)
+
+	call := func(ctx context.Context, startValue interface{}, blockStatus flow.BlockStatus) subscription.Subscription {
+		return s.backend.SubscribeBlocksFromStartBlockID(ctx, startValue.(flow.Identifier), blockStatus)
+	}
+
+	s.subscribe(call, s.requireBlocks, s.subscribeFromStartBlockIdTestCases())
+}
+
+// TestSubscribeBlocksFromStartHeight tests the SubscribeBlocksFromStartHeight method.
+func (s *BackendBlocksSuite) TestSubscribeBlocksFromStartHeight() {
+	s.blockTracker.On(
+		"GetStartHeightFromHeight",
+		mock.AnythingOfType("uint64"),
+	).Return(func(startHeight uint64) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromHeight(startHeight)
+	}, nil)
+
+	call := func(ctx context.Context, startValue interface{}, blockStatus flow.BlockStatus) subscription.Subscription {
+		return s.backend.SubscribeBlocksFromStartHeight(ctx, startValue.(uint64), blockStatus)
+	}
+
+	s.subscribe(call, s.requireBlocks, s.subscribeFromStartHeightTestCases())
+}
+
+// TestSubscribeBlocksFromLatest tests the SubscribeBlocksFromLatest method.
+func (s *BackendBlocksSuite) TestSubscribeBlocksFromLatest() {
+	s.blockTracker.On(
+		"GetStartHeightFromLatest",
+		mock.Anything,
+	).Return(func(ctx context.Context) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromLatest(ctx)
+	}, nil)
+
+	call := func(ctx context.Context, startValue interface{}, blockStatus flow.BlockStatus) subscription.Subscription {
+		return s.backend.SubscribeBlocksFromLatest(ctx, blockStatus)
+	}
+
+	s.subscribe(call, s.requireBlocks, s.subscribeFromLatestTestCases())
+}
+
+// subscribe is the common method with tests the functionality of the subscribe methods in the Backend.
+// It covers various scenarios for subscribing, handling backfill, and receiving block updates.
+// The test cases include scenarios for both finalized and sealed blocks.
+//
+// Parameters:
+//
+//   - subscribeFn: A function representing the subscription method to be tested.
+//     It takes a context, startValue, and blockStatus as parameters
+//     and returns a subscription.Subscription.
+//
+//   - requireFn: A function responsible for validating that the received information
+//     matches the expected data. It takes an actual interface{} and an expected *flow.Block as parameters.
+//
+//   - tests: A slice of testType representing different test scenarios for subscriptions.
+//
+// The function performs the following steps for each test case:
+//
+//  1. Initializes the test context and cancellation function.
+//  2. Iterates through the provided test cases.
+//  3. For each test case, sets up a block tracker mock if there are blocks to backfill.
+//  4. Mocks the latest sealed block if no start value is provided.
+//  5. Subscribes using the provided subscription function.
+//  6. Simulates the reception of new blocks and consumes them from the subscription channel.
+//  7. Ensures that there are no new messages waiting after all blocks have been processed.
+//  8. Cancels the subscription and ensures it shuts down gracefully.
+func (s *BackendBlocksSuite) subscribe(
+	subscribeFn func(ctx context.Context, startValue interface{}, blockStatus flow.BlockStatus) subscription.Subscription,
+	requireFn func(interface{}, *flow.Block),
+	tests []testType,
+) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	for _, test := range tests {
+		s.Run(test.name, func() {
+			// add "backfill" block - blocks that are already in the database before the test starts
+			// this simulates a subscription on a past block
+			if test.highestBackfill > 0 {
+				s.setupBlockTrackerMock(test.blockStatus, s.blocksArray[test.highestBackfill].Header)
+			}
+
+			subCtx, subCancel := context.WithCancel(ctx)
+
+			// mock latest sealed if no start value provided
+			if test.startValue == nil {
+				s.snapshot.On("Head").Unset()
+				s.snapshot.On("Head").Return(s.rootBlock.Header, nil).Once()
+			}
+
+			sub := subscribeFn(subCtx, test.startValue, test.blockStatus)
+
+			// loop over all blocks
+			for i, b := range s.blocksArray {
+				s.T().Logf("checking block %d %v %d", i, b.ID(), b.Header.Height)
+
+				// simulate new block received.
+				// all blocks with index <= highestBackfill were already received
+				if i > test.highestBackfill {
+					s.setupBlockTrackerMock(test.blockStatus, b.Header)
+
+					s.broadcaster.Publish()
+				}
+
+				// consume block from subscription
+				unittest.RequireReturnsBefore(s.T(), func() {
+					v, ok := <-sub.Channel()
+					require.True(s.T(), ok, "channel closed while waiting for exec data for block %x %v: err: %v", b.Header.Height, b.ID(), sub.Err())
+
+					requireFn(v, b)
+				}, time.Second, fmt.Sprintf("timed out waiting for block %d %v", b.Header.Height, b.ID()))
+			}
+
+			// make sure there are no new messages waiting. the channel should be opened with nothing waiting
+			unittest.RequireNeverReturnBefore(s.T(), func() {
+				<-sub.Channel()
+			}, 100*time.Millisecond, "timed out waiting for subscription to shutdown")
+
+			// stop the subscription
+			subCancel()
+
+			// ensure subscription shuts down gracefully
+			unittest.RequireReturnsBefore(s.T(), func() {
+				v, ok := <-sub.Channel()
+				assert.Nil(s.T(), v)
+				assert.False(s.T(), ok)
+				assert.ErrorIs(s.T(), sub.Err(), context.Canceled)
+			}, 100*time.Millisecond, "timed out waiting for subscription to shutdown")
+		})
+	}
+}
+
+// requireBlocks ensures that the received block information matches the expected data.
+func (s *BackendBlocksSuite) requireBlocks(v interface{}, expectedBlock *flow.Block) {
+	actualBlock, ok := v.(*flow.Block)
+	require.True(s.T(), ok, "unexpected response type: %T", v)
+
+	s.Require().Equal(expectedBlock.Header.Height, actualBlock.Header.Height)
+	s.Require().Equal(expectedBlock.Header.ID(), actualBlock.Header.ID())
+	s.Require().Equal(*expectedBlock, *actualBlock)
+}
+
+// TestSubscribeBlocksHandlesErrors tests error handling scenarios for the SubscribeBlocksFromStartBlockID and SubscribeBlocksFromStartHeight methods in the Backend.
+// It ensures that the method correctly returns errors for various invalid input cases.
+//
+// Test Cases:
+//
+// 1. Returns error for unindexed start block id:
+//   - Tests that subscribing to block headers with an unindexed start block ID results in a NotFound error.
+//
+// 2. Returns error for start height before root height:
+//   - Validates that attempting to subscribe to block headers with a start height before the root height results in an InvalidArgument error.
+//
+// 3. Returns error for unindexed start height:
+//   - Tests that subscribing to block headers with an unindexed start height results in a NotFound error.
+//
+// Each test case checks for specific error conditions and ensures that the methods responds appropriately.
+func (s *BackendBlocksSuite) TestSubscribeBlocksHandlesErrors() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	// mock block tracker for SubscribeBlocksFromStartBlockID
+	s.blockTracker.On(
+		"GetStartHeightFromBlockID",
+		mock.AnythingOfType("flow.Identifier"),
+	).Return(func(startBlockID flow.Identifier) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromBlockID(startBlockID)
+	}, nil)
+
+	s.Run("returns error if unknown start block id is provided", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeBlocksFromStartBlockID(subCtx, unittest.IdentifierFixture(), flow.BlockStatusFinalized)
+		assert.Equal(s.T(), codes.NotFound, status.Code(sub.Err()), "expected %s, got %v: %v", codes.NotFound, status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	// mock block tracker for GetStartHeightFromHeight
+	s.blockTracker.On(
+		"GetStartHeightFromHeight",
+		mock.AnythingOfType("uint64"),
+	).Return(func(startHeight uint64) (uint64, error) {
+		return s.blockTrackerReal.GetStartHeightFromHeight(startHeight)
+	}, nil)
+
+	s.Run("returns error for start height before root height", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeBlocksFromStartHeight(subCtx, s.rootBlock.Header.Height-1, flow.BlockStatusFinalized)
+		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()), "expected %s, got %v: %v", codes.InvalidArgument, status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	s.Run("returns error if unknown start height is provided", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeBlocksFromStartHeight(subCtx, s.blocksArray[len(s.blocksArray)-1].Header.Height+10, flow.BlockStatusFinalized)
+		assert.Equal(s.T(), codes.NotFound, status.Code(sub.Err()), "expected %s, got %v: %v", codes.NotFound, status.Code(sub.Err()).String(), sub.Err())
+	})
+}
diff --git a/engine/access/rpc/backend/backend_stream_transactions.go b/engine/access/rpc/backend/backend_stream_transactions.go
new file mode 100644
index 00000000000..c01dd2db3d8
--- /dev/null
+++ b/engine/access/rpc/backend/backend_stream_transactions.go
@@ -0,0 +1,182 @@
+package backend
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/onflow/flow-go/module/irrecoverable"
+	"github.com/onflow/flow-go/state"
+
+	"github.com/onflow/flow-go/engine/common/rpc/convert"
+	"github.com/onflow/flow-go/module/counters"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/engine/access/subscription"
+	"github.com/onflow/flow-go/engine/common/rpc"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/storage"
+)
+
+// backendSubscribeTransactions handles transaction subscriptions.
+type backendSubscribeTransactions struct {
+	txLocalDataProvider *TransactionsLocalDataProvider
+	executionResults    storage.ExecutionResults
+	log                 zerolog.Logger
+
+	subscriptionHandler *subscription.SubscriptionHandler
+	blockTracker        subscription.BlockTracker
+}
+
+// TransactionSubscriptionMetadata holds data representing the status state for each transaction subscription.
+type TransactionSubscriptionMetadata struct {
+	txID               flow.Identifier
+	txReferenceBlockID flow.Identifier
+	messageIndex       counters.StrictMonotonousCounter
+	blockWithTx        *flow.Header
+	blockID            flow.Identifier
+	txExecuted         bool
+	lastTxStatus       flow.TransactionStatus
+}
+
+// SubscribeTransactionStatuses subscribes to transaction status changes starting from the transaction reference block ID.
+// If invalid tx parameters will be supplied SubscribeTransactionStatuses will return a failed subscription.
+func (b *backendSubscribeTransactions) SubscribeTransactionStatuses(ctx context.Context, tx *flow.TransactionBody) subscription.Subscription {
+	nextHeight, err := b.blockTracker.GetStartHeightFromBlockID(tx.ReferenceBlockID)
+	if err != nil {
+		return subscription.NewFailedSubscription(err, "could not get start height")
+	}
+
+	txInfo := TransactionSubscriptionMetadata{
+		txID:               tx.ID(),
+		txReferenceBlockID: tx.ReferenceBlockID,
+		messageIndex:       counters.NewMonotonousCounter(0),
+		blockWithTx:        nil,
+		blockID:            flow.ZeroID,
+		lastTxStatus:       flow.TransactionStatusUnknown,
+	}
+
+	return b.subscriptionHandler.Subscribe(ctx, nextHeight, b.getTransactionStatusResponse(&txInfo))
+}
+
+// getTransactionStatusResponse returns a callback function that produces transaction status
+// subscription responses based on new blocks.
+func (b *backendSubscribeTransactions) getTransactionStatusResponse(txInfo *TransactionSubscriptionMetadata) func(context.Context, uint64) (interface{}, error) {
+	return func(ctx context.Context, height uint64) (interface{}, error) {
+		highestHeight, err := b.blockTracker.GetHighestHeight(flow.BlockStatusFinalized)
+		if err != nil {
+			return nil, fmt.Errorf("could not get highest height for block %d: %w", height, err)
+		}
+
+		// Fail early if no block finalized notification has been received for the given height.
+		// Note: It's possible that the block is locally finalized before the notification is
+		// received. This ensures a consistent view is available to all streams.
+		if height > highestHeight {
+			return nil, fmt.Errorf("block %d is not available yet: %w", height, subscription.ErrBlockNotReady)
+		}
+
+		if txInfo.lastTxStatus == flow.TransactionStatusSealed || txInfo.lastTxStatus == flow.TransactionStatusExpired {
+			return nil, fmt.Errorf("transaction final status %s was already reported: %w", txInfo.lastTxStatus.String(), subscription.ErrEndOfData)
+		}
+
+		if txInfo.blockWithTx == nil {
+			// Check if block contains transaction.
+			txInfo.blockWithTx, txInfo.blockID, err = b.searchForTransactionBlock(height, txInfo)
+			if err != nil {
+				if errors.Is(err, storage.ErrNotFound) {
+					return nil, fmt.Errorf("could not find block %d in storage: %w", height, subscription.ErrBlockNotReady)
+				}
+
+				if !errors.Is(err, ErrTransactionNotInBlock) {
+					return nil, status.Errorf(codes.Internal, "could not get block %d: %v", height, err)
+				}
+			}
+		}
+
+		// Find the transaction status.
+		var txStatus flow.TransactionStatus
+		if txInfo.blockWithTx == nil {
+			txStatus, err = b.txLocalDataProvider.DeriveUnknownTransactionStatus(txInfo.txReferenceBlockID)
+		} else {
+			if !txInfo.txExecuted {
+				// Check if transaction was executed.
+				txInfo.txExecuted, err = b.searchForExecutionResult(txInfo.blockID)
+				if err != nil {
+					return nil, status.Errorf(codes.Internal, "failed to get execution result for block %s: %v", txInfo.blockID, err)
+				}
+			}
+
+			txStatus, err = b.txLocalDataProvider.DeriveTransactionStatus(txInfo.blockID, txInfo.blockWithTx.Height, txInfo.txExecuted)
+		}
+		if err != nil {
+			if !errors.Is(err, state.ErrUnknownSnapshotReference) {
+				irrecoverable.Throw(ctx, err)
+			}
+			return nil, rpc.ConvertStorageError(err)
+		}
+
+		// The same transaction status should not be reported, so return here with no response
+		if txInfo.lastTxStatus == txStatus {
+			return nil, nil
+		}
+		txInfo.lastTxStatus = txStatus
+
+		messageIndex := txInfo.messageIndex.Value()
+		if ok := txInfo.messageIndex.Set(messageIndex + 1); !ok {
+			return nil, status.Errorf(codes.Internal, "the message index has already been incremented to %d", txInfo.messageIndex.Value())
+		}
+
+		return &convert.TransactionSubscribeInfo{
+			ID:           txInfo.txID,
+			Status:       txInfo.lastTxStatus,
+			MessageIndex: messageIndex,
+		}, nil
+	}
+}
+
+// searchForTransactionBlock searches for the block containing the specified transaction.
+// It retrieves the block at the given height and checks if the transaction is included in that block.
+// Expected errors:
+// - subscription.ErrBlockNotReady when unable to retrieve the block or collection ID
+// - codes.Internal when other errors occur during block or collection lookup
+func (b *backendSubscribeTransactions) searchForTransactionBlock(
+	height uint64,
+	txInfo *TransactionSubscriptionMetadata,
+) (*flow.Header, flow.Identifier, error) {
+	block, err := b.txLocalDataProvider.blocks.ByHeight(height)
+	if err != nil {
+		return nil, flow.ZeroID, fmt.Errorf("error looking up block: %w", err)
+	}
+
+	collectionID, err := b.txLocalDataProvider.LookupCollectionIDInBlock(block, txInfo.txID)
+	if err != nil {
+		return nil, flow.ZeroID, fmt.Errorf("error looking up transaction in block: %w", err)
+	}
+
+	if collectionID != flow.ZeroID {
+		return block.Header, block.ID(), nil
+	}
+
+	return nil, flow.ZeroID, nil
+}
+
+// searchForExecutionResult searches for the execution result of a block. It retrieves the execution result for the specified block ID.
+// Expected errors:
+// - codes.Internal if an internal error occurs while retrieving execution result.
+func (b *backendSubscribeTransactions) searchForExecutionResult(
+	blockID flow.Identifier,
+) (bool, error) {
+	_, err := b.executionResults.ByBlockID(blockID)
+	if err != nil {
+		if errors.Is(err, storage.ErrNotFound) {
+			return false, nil
+		}
+		return false, fmt.Errorf("failed to get execution result for block %s: %w", blockID, err)
+	}
+
+	return true, nil
+}
diff --git a/engine/access/rpc/backend/backend_stream_transactions_test.go b/engine/access/rpc/backend/backend_stream_transactions_test.go
new file mode 100644
index 00000000000..cf7438bf605
--- /dev/null
+++ b/engine/access/rpc/backend/backend_stream_transactions_test.go
@@ -0,0 +1,367 @@
+package backend
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	protocolint "github.com/onflow/flow-go/state/protocol"
+
+	"github.com/onflow/flow-go/engine/access/index"
+
+	"github.com/onflow/flow-go/utils/unittest/mocks"
+
+	syncmock "github.com/onflow/flow-go/module/state_synchronization/mock"
+
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/onflow/flow-go/engine"
+	access "github.com/onflow/flow-go/engine/access/mock"
+	backendmock "github.com/onflow/flow-go/engine/access/rpc/backend/mock"
+	connectionmock "github.com/onflow/flow-go/engine/access/rpc/connection/mock"
+	"github.com/onflow/flow-go/engine/access/subscription"
+	subscriptionmock "github.com/onflow/flow-go/engine/access/subscription/mock"
+	"github.com/onflow/flow-go/engine/common/rpc/convert"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/counters"
+	"github.com/onflow/flow-go/module/metrics"
+	protocol "github.com/onflow/flow-go/state/protocol/mock"
+	storagemock "github.com/onflow/flow-go/storage/mock"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+type TransactionStatusSuite struct {
+	suite.Suite
+
+	state          *protocol.State
+	sealedSnapshot *protocol.Snapshot
+	finalSnapshot  *protocol.Snapshot
+	tempSnapshot   *protocol.Snapshot
+	log            zerolog.Logger
+
+	blocks             *storagemock.Blocks
+	headers            *storagemock.Headers
+	collections        *storagemock.Collections
+	transactions       *storagemock.Transactions
+	receipts           *storagemock.ExecutionReceipts
+	results            *storagemock.ExecutionResults
+	transactionResults *storagemock.LightTransactionResults
+	events             *storagemock.Events
+	seals              *storagemock.Seals
+
+	colClient              *access.AccessAPIClient
+	execClient             *access.ExecutionAPIClient
+	historicalAccessClient *access.AccessAPIClient
+	archiveClient          *access.AccessAPIClient
+
+	connectionFactory *connectionmock.ConnectionFactory
+	communicator      *backendmock.Communicator
+	blockTracker      *subscriptionmock.BlockTracker
+	reporter          *syncmock.IndexReporter
+
+	chainID flow.ChainID
+
+	broadcaster    *engine.Broadcaster
+	rootBlock      flow.Block
+	sealedBlock    *flow.Block
+	finalizedBlock *flow.Block
+
+	blockMap   map[uint64]*flow.Block
+	resultsMap map[flow.Identifier]*flow.ExecutionResult
+
+	backend *Backend
+}
+
+func TestTransactionStatusSuite(t *testing.T) {
+	suite.Run(t, new(TransactionStatusSuite))
+}
+
+// SetupTest initializes the test suite with required dependencies.
+func (s *TransactionStatusSuite) SetupTest() {
+	s.log = zerolog.New(zerolog.NewConsoleWriter())
+	s.state = protocol.NewState(s.T())
+	s.sealedSnapshot = protocol.NewSnapshot(s.T())
+	s.finalSnapshot = protocol.NewSnapshot(s.T())
+	s.tempSnapshot = &protocol.Snapshot{}
+
+	header := unittest.BlockHeaderFixture()
+
+	params := protocol.NewParams(s.T())
+	params.On("SporkID").Return(unittest.IdentifierFixture(), nil)
+	params.On("ProtocolVersion").Return(uint(unittest.Uint64InRange(10, 30)), nil)
+	params.On("SporkRootBlockHeight").Return(header.Height, nil)
+	params.On("SealedRoot").Return(header, nil)
+	s.state.On("Params").Return(params)
+
+	s.blocks = storagemock.NewBlocks(s.T())
+	s.headers = storagemock.NewHeaders(s.T())
+	s.transactions = storagemock.NewTransactions(s.T())
+	s.collections = storagemock.NewCollections(s.T())
+	s.receipts = storagemock.NewExecutionReceipts(s.T())
+	s.results = storagemock.NewExecutionResults(s.T())
+	s.seals = storagemock.NewSeals(s.T())
+	s.colClient = access.NewAccessAPIClient(s.T())
+	s.archiveClient = access.NewAccessAPIClient(s.T())
+	s.execClient = access.NewExecutionAPIClient(s.T())
+	s.transactionResults = storagemock.NewLightTransactionResults(s.T())
+	s.events = storagemock.NewEvents(s.T())
+	s.chainID = flow.Testnet
+	s.historicalAccessClient = access.NewAccessAPIClient(s.T())
+	s.connectionFactory = connectionmock.NewConnectionFactory(s.T())
+	s.communicator = backendmock.NewCommunicator(s.T())
+	s.broadcaster = engine.NewBroadcaster()
+	s.blockTracker = subscriptionmock.NewBlockTracker(s.T())
+	s.resultsMap = map[flow.Identifier]*flow.ExecutionResult{}
+
+	// generate blockCount consecutive blocks with associated seal, result and execution data
+	s.rootBlock = unittest.BlockFixture()
+	rootResult := unittest.ExecutionResultFixture(unittest.WithBlock(&s.rootBlock))
+	s.resultsMap[s.rootBlock.ID()] = rootResult
+
+	s.sealedBlock = &s.rootBlock
+	s.finalizedBlock = unittest.BlockWithParentFixture(s.sealedBlock.Header)
+	finalizedResult := unittest.ExecutionResultFixture(unittest.WithBlock(s.finalizedBlock))
+	s.resultsMap[s.finalizedBlock.ID()] = finalizedResult
+	s.blockMap = map[uint64]*flow.Block{
+		s.sealedBlock.Header.Height:    s.sealedBlock,
+		s.finalizedBlock.Header.Height: s.finalizedBlock,
+	}
+
+	s.reporter = syncmock.NewIndexReporter(s.T())
+
+	s.blocks.On("ByHeight", mock.AnythingOfType("uint64")).Return(mocks.StorageMapGetter(s.blockMap))
+
+	s.state.On("Final").Return(s.finalSnapshot, nil)
+	s.state.On("AtBlockID", mock.AnythingOfType("flow.Identifier")).Return(func(blockID flow.Identifier) protocolint.Snapshot {
+		s.tempSnapshot.On("Head").Unset()
+		s.tempSnapshot.On("Head").Return(func() *flow.Header {
+			for _, block := range s.blockMap {
+				if block.ID() == blockID {
+					return block.Header
+				}
+			}
+
+			return nil
+		}, nil)
+
+		return s.tempSnapshot
+	}, nil)
+
+	s.finalSnapshot.On("Head").Return(func() *flow.Header {
+		finalizedHeader := s.finalizedBlock.Header
+		return finalizedHeader
+	}, nil)
+
+	s.blockTracker.On("GetStartHeightFromBlockID", mock.Anything).Return(func(_ flow.Identifier) (uint64, error) {
+		finalizedHeader := s.finalizedBlock.Header
+		return finalizedHeader.Height, nil
+	}, nil)
+	s.blockTracker.On("GetHighestHeight", flow.BlockStatusFinalized).Return(func(_ flow.BlockStatus) (uint64, error) {
+		finalizedHeader := s.finalizedBlock.Header
+		return finalizedHeader.Height, nil
+	}, nil)
+
+	backendParams := s.backendParams()
+	err := backendParams.TxResultsIndex.Initialize(s.reporter)
+	require.NoError(s.T(), err)
+
+	s.backend, err = New(backendParams)
+	require.NoError(s.T(), err)
+
+}
+
+// backendParams returns the Params configuration for the backend.
+func (s *TransactionStatusSuite) backendParams() Params {
+	return Params{
+		State:                    s.state,
+		Blocks:                   s.blocks,
+		Headers:                  s.headers,
+		Collections:              s.collections,
+		Transactions:             s.transactions,
+		ExecutionReceipts:        s.receipts,
+		ExecutionResults:         s.results,
+		ChainID:                  s.chainID,
+		CollectionRPC:            s.colClient,
+		MaxHeightRange:           DefaultMaxHeightRange,
+		SnapshotHistoryLimit:     DefaultSnapshotHistoryLimit,
+		Communicator:             NewNodeCommunicator(false),
+		AccessMetrics:            metrics.NewNoopCollector(),
+		Log:                      s.log,
+		TxErrorMessagesCacheSize: 1000,
+		BlockTracker:             s.blockTracker,
+		SubscriptionHandler: subscription.NewSubscriptionHandler(
+			s.log,
+			s.broadcaster,
+			subscription.DefaultSendTimeout,
+			subscription.DefaultResponseLimit,
+			subscription.DefaultSendBufferSize,
+		),
+		TxResultsIndex: index.NewTransactionResultsIndex(s.transactionResults),
+		EventsIndex:    index.NewEventsIndex(s.events),
+	}
+}
+
+func (s *TransactionStatusSuite) addNewFinalizedBlock(parent *flow.Header, notify bool, options ...func(*flow.Block)) {
+	s.finalizedBlock = unittest.BlockWithParentFixture(parent)
+	for _, option := range options {
+		option(s.finalizedBlock)
+	}
+
+	s.blockMap[s.finalizedBlock.Header.Height] = s.finalizedBlock
+
+	if notify {
+		s.broadcaster.Publish()
+	}
+}
+
+// TestSubscribeTransactionStatusHappyCase tests the functionality of the SubscribeTransactionStatuses method in the Backend.
+// It covers the emulation of transaction stages from pending to sealed, and receiving status updates.
+func (s *TransactionStatusSuite) TestSubscribeTransactionStatusHappyCase() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	s.sealedSnapshot.On("Head").Return(func() *flow.Header {
+		return s.sealedBlock.Header
+	}, nil)
+	s.state.On("Sealed").Return(s.sealedSnapshot, nil)
+	s.results.On("ByBlockID", mock.AnythingOfType("flow.Identifier")).Return(mocks.StorageMapGetter(s.resultsMap))
+
+	// Generate sent transaction with ref block of the current finalized block
+	transaction := unittest.TransactionFixture()
+	transaction.SetReferenceBlockID(s.finalizedBlock.ID())
+	col := flow.CollectionFromTransactions([]*flow.Transaction{&transaction})
+	guarantee := col.Guarantee()
+	light := col.Light()
+	txId := transaction.ID()
+
+	expectedMsgIndexCounter := counters.NewMonotonousCounter(0)
+
+	// Create a special common function to read subscription messages from the channel and check converting it to transaction info
+	// and check results for correctness
+	checkNewSubscriptionMessage := func(sub subscription.Subscription, expectedTxStatus flow.TransactionStatus) {
+		unittest.RequireReturnsBefore(s.T(), func() {
+			v, ok := <-sub.Channel()
+			require.True(s.T(), ok,
+				"channel closed while waiting for transaction info:\n\t- txID %x\n\t- blockID: %x \n\t- err: %v",
+				txId, s.finalizedBlock.ID(), sub.Err())
+
+			txInfo, ok := v.(*convert.TransactionSubscribeInfo)
+			require.True(s.T(), ok, "unexpected response type: %T", v)
+
+			assert.Equal(s.T(), txId, txInfo.ID)
+			assert.Equal(s.T(), expectedTxStatus, txInfo.Status)
+
+			expectedMsgIndex := expectedMsgIndexCounter.Value()
+			assert.Equal(s.T(), expectedMsgIndex, txInfo.MessageIndex)
+			wasSet := expectedMsgIndexCounter.Set(expectedMsgIndex + 1)
+			require.True(s.T(), wasSet)
+		}, time.Second, fmt.Sprintf("timed out waiting for transaction info:\n\t- txID: %x\n\t- blockID: %x", txId, s.finalizedBlock.ID()))
+	}
+
+	// 1. Subscribe to transaction status and receive the first message with pending status
+	sub := s.backend.SubscribeTransactionStatuses(ctx, &transaction.TransactionBody)
+	checkNewSubscriptionMessage(sub, flow.TransactionStatusPending)
+
+	// 2. Make transaction reference block sealed, and add a new finalized block that includes the transaction
+	s.sealedBlock = s.finalizedBlock
+	s.addNewFinalizedBlock(s.sealedBlock.Header, true, func(block *flow.Block) {
+		block.SetPayload(unittest.PayloadFixture(unittest.WithGuarantees(&guarantee)))
+		s.collections.On("LightByID", mock.AnythingOfType("flow.Identifier")).Return(&light, nil).Maybe()
+	})
+	checkNewSubscriptionMessage(sub, flow.TransactionStatusFinalized)
+
+	// 3. Add one more finalized block on top of the transaction block and add execution results to storage
+	finalizedResult := unittest.ExecutionResultFixture(unittest.WithBlock(s.finalizedBlock))
+	s.resultsMap[s.finalizedBlock.ID()] = finalizedResult
+
+	s.addNewFinalizedBlock(s.finalizedBlock.Header, true)
+	checkNewSubscriptionMessage(sub, flow.TransactionStatusExecuted)
+
+	// 4. Make the transaction block sealed, and add a new finalized block
+	s.sealedBlock = s.finalizedBlock
+	s.addNewFinalizedBlock(s.sealedBlock.Header, true)
+	checkNewSubscriptionMessage(sub, flow.TransactionStatusSealed)
+
+	//// 5. Stop subscription
+	s.sealedBlock = s.finalizedBlock
+	s.addNewFinalizedBlock(s.sealedBlock.Header, true)
+
+	// Ensure subscription shuts down gracefully
+	unittest.RequireReturnsBefore(s.T(), func() {
+		v, ok := <-sub.Channel()
+		assert.Nil(s.T(), v)
+		assert.False(s.T(), ok)
+		assert.NoError(s.T(), sub.Err())
+	}, 100*time.Millisecond, "timed out waiting for subscription to shutdown")
+}
+
+// TestSubscribeTransactionStatusExpired tests the functionality of the SubscribeTransactionStatuses method in the Backend
+// when transaction become expired
+func (s *TransactionStatusSuite) TestSubscribeTransactionStatusExpired() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	s.blocks.On("GetLastFullBlockHeight").Return(func() (uint64, error) {
+		return s.sealedBlock.Header.Height, nil
+	}, nil)
+
+	// Generate sent transaction with ref block of the current finalized block
+	transaction := unittest.TransactionFixture()
+	transaction.SetReferenceBlockID(s.finalizedBlock.ID())
+	txId := transaction.ID()
+
+	expectedMsgIndexCounter := counters.NewMonotonousCounter(0)
+
+	// Create a special common function to read subscription messages from the channel and check converting it to transaction info
+	// and check results for correctness
+	checkNewSubscriptionMessage := func(sub subscription.Subscription, expectedTxStatus flow.TransactionStatus) {
+		unittest.RequireReturnsBefore(s.T(), func() {
+			v, ok := <-sub.Channel()
+			require.True(s.T(), ok,
+				"channel closed while waiting for transaction info:\n\t- txID %x\n\t- blockID: %x \n\t- err: %v",
+				txId, s.finalizedBlock.ID(), sub.Err())
+
+			txInfo, ok := v.(*convert.TransactionSubscribeInfo)
+			require.True(s.T(), ok, "unexpected response type: %T", v)
+
+			assert.Equal(s.T(), txId, txInfo.ID)
+			assert.Equal(s.T(), expectedTxStatus, txInfo.Status)
+
+			expectedMsgIndex := expectedMsgIndexCounter.Value()
+			assert.Equal(s.T(), expectedMsgIndex, txInfo.MessageIndex)
+			wasSet := expectedMsgIndexCounter.Set(expectedMsgIndex + 1)
+			require.True(s.T(), wasSet)
+		}, time.Second, fmt.Sprintf("timed out waiting for transaction info:\n\t- txID: %x\n\t- blockID: %x", txId, s.finalizedBlock.ID()))
+	}
+
+	// Subscribe to transaction status and receive the first message with pending status
+	sub := s.backend.SubscribeTransactionStatuses(ctx, &transaction.TransactionBody)
+	checkNewSubscriptionMessage(sub, flow.TransactionStatusPending)
+
+	// Generate 600 blocks without transaction included and check, that transaction still pending
+	startHeight := s.finalizedBlock.Header.Height + 1
+	lastHeight := startHeight + flow.DefaultTransactionExpiry
+
+	for i := startHeight; i <= lastHeight; i++ {
+		s.sealedBlock = s.finalizedBlock
+		s.addNewFinalizedBlock(s.sealedBlock.Header, false)
+	}
+
+	// Generate final blocks and check transaction expired
+	s.sealedBlock = s.finalizedBlock
+	s.addNewFinalizedBlock(s.sealedBlock.Header, true)
+	checkNewSubscriptionMessage(sub, flow.TransactionStatusExpired)
+
+	// Ensure subscription shuts down gracefully
+	unittest.RequireReturnsBefore(s.T(), func() {
+		v, ok := <-sub.Channel()
+		assert.Nil(s.T(), v)
+		assert.False(s.T(), ok)
+		assert.NoError(s.T(), sub.Err())
+	}, 100*time.Millisecond, "timed out waiting for subscription to shutdown")
+}
diff --git a/engine/access/rpc/backend/backend_test.go b/engine/access/rpc/backend/backend_test.go
index 0647e3e9119..caa27a8bdfd 100644
--- a/engine/access/rpc/backend/backend_test.go
+++ b/engine/access/rpc/backend/backend_test.go
@@ -27,13 +27,16 @@ import (
 	"github.com/onflow/flow-go/engine/access/rpc/connection"
 	connectionmock "github.com/onflow/flow-go/engine/access/rpc/connection/mock"
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
+	"github.com/onflow/flow-go/fvm/blueprints"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/irrecoverable"
 	"github.com/onflow/flow-go/module/metrics"
 	realstate "github.com/onflow/flow-go/state"
+	realprotocol "github.com/onflow/flow-go/state/protocol"
 	bprotocol "github.com/onflow/flow-go/state/protocol/badger"
 	"github.com/onflow/flow-go/state/protocol/invalid"
 	protocol "github.com/onflow/flow-go/state/protocol/mock"
+	"github.com/onflow/flow-go/state/protocol/snapshots"
 	"github.com/onflow/flow-go/state/protocol/util"
 	"github.com/onflow/flow-go/storage"
 	storagemock "github.com/onflow/flow-go/storage/mock"
@@ -62,6 +65,7 @@ type Suite struct {
 	receipts           *storagemock.ExecutionReceipts
 	results            *storagemock.ExecutionResults
 	transactionResults *storagemock.LightTransactionResults
+	events             *storagemock.Events
 
 	colClient              *access.AccessAPIClient
 	execClient             *access.ExecutionAPIClient
@@ -70,7 +74,8 @@ type Suite struct {
 	connectionFactory *connectionmock.ConnectionFactory
 	communicator      *backendmock.Communicator
 
-	chainID flow.ChainID
+	chainID  flow.ChainID
+	systemTx *flow.TransactionBody
 }
 
 func TestHandler(t *testing.T) {
@@ -99,11 +104,16 @@ func (suite *Suite) SetupTest() {
 	suite.colClient = new(access.AccessAPIClient)
 	suite.execClient = new(access.ExecutionAPIClient)
 	suite.transactionResults = storagemock.NewLightTransactionResults(suite.T())
+	suite.events = storagemock.NewEvents(suite.T())
 	suite.chainID = flow.Testnet
 	suite.historicalAccessClient = new(access.AccessAPIClient)
 	suite.connectionFactory = connectionmock.NewConnectionFactory(suite.T())
 
 	suite.communicator = new(backendmock.Communicator)
+
+	var err error
+	suite.systemTx, err = blueprints.SystemChunkTransaction(flow.Testnet.Chain())
+	suite.Require().NoError(err)
 }
 
 func (suite *Suite) TestPing() {
@@ -156,8 +166,8 @@ func (suite *Suite) TestGetLatestFinalizedBlockHeader() {
 func (suite *Suite) TestGetLatestProtocolStateSnapshot_NoTransitionSpan() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
-	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
-		epochBuilder := unittest.NewEpochBuilder(suite.T(), state)
+	util.RunWithFullProtocolStateAndMutator(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
+		epochBuilder := unittest.NewEpochBuilder(suite.T(), mutableState, state)
 		// build epoch 1
 		// Blocks in current State
 		// P <- A(S_P-1) <- B(S_P) <- C(S_A) <- D(S_B) |setup| <- E(S_C) <- F(S_D) |commit|
@@ -203,8 +213,8 @@ func (suite *Suite) TestGetLatestProtocolStateSnapshot_NoTransitionSpan() {
 func (suite *Suite) TestGetLatestProtocolStateSnapshot_TransitionSpans() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
-	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
-		epochBuilder := unittest.NewEpochBuilder(suite.T(), state)
+	util.RunWithFullProtocolStateAndMutator(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
+		epochBuilder := unittest.NewEpochBuilder(suite.T(), mutableState, state)
 
 		// building 2 epochs allows us to take a snapshot at a point in time where
 		// an epoch transition happens
@@ -259,8 +269,8 @@ func (suite *Suite) TestGetLatestProtocolStateSnapshot_TransitionSpans() {
 func (suite *Suite) TestGetLatestProtocolStateSnapshot_PhaseTransitionSpan() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
-	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
-		epochBuilder := unittest.NewEpochBuilder(suite.T(), state)
+	util.RunWithFullProtocolStateAndMutator(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
+		epochBuilder := unittest.NewEpochBuilder(suite.T(), mutableState, state)
 		// build epoch 1
 		// Blocks in current State
 		// P <- A(S_P-1) <- B(S_P) <- C(S_A) <- D(S_B) |setup| <- E(S_C) <- F(S_D) |commit|
@@ -307,8 +317,8 @@ func (suite *Suite) TestGetLatestProtocolStateSnapshot_PhaseTransitionSpan() {
 func (suite *Suite) TestGetLatestProtocolStateSnapshot_EpochTransitionSpan() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
-	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
-		epochBuilder := unittest.NewEpochBuilder(suite.T(), state)
+	util.RunWithFullProtocolStateAndMutator(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
+		epochBuilder := unittest.NewEpochBuilder(suite.T(), mutableState, state)
 		// build epoch 1
 		// Blocks in current State
 		// P <- A(S_P-1) <- B(S_P) <- C(S_A) <- D(S_B) |setup| <- E(S_C) <- F(S_D) |commit|
@@ -367,8 +377,8 @@ func (suite *Suite) TestGetLatestProtocolStateSnapshot_EpochTransitionSpan() {
 func (suite *Suite) TestGetLatestProtocolStateSnapshot_HistoryLimit() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
-	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
-		epochBuilder := unittest.NewEpochBuilder(suite.T(), state).BuildEpoch().CompleteEpoch()
+	util.RunWithFullProtocolStateAndMutator(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
+		epochBuilder := unittest.NewEpochBuilder(suite.T(), mutableState, state).BuildEpoch().CompleteEpoch()
 
 		// get heights of each phase in built epochs
 		epoch1, ok := epochBuilder.EpochHeights(1)
@@ -395,7 +405,7 @@ func (suite *Suite) TestGetLatestProtocolStateSnapshot_HistoryLimit() {
 
 		// the handler should return a snapshot history limit error
 		_, err = backend.GetLatestProtocolStateSnapshot(context.Background())
-		suite.Require().ErrorIs(err, SnapshotHistoryLimitErr)
+		suite.Require().ErrorIs(err, snapshots.ErrSnapshotHistoryLimit)
 	})
 }
 
@@ -403,8 +413,8 @@ func (suite *Suite) TestGetLatestProtocolStateSnapshot_HistoryLimit() {
 func (suite *Suite) TestGetProtocolStateSnapshotByBlockID() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
-	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
-		epochBuilder := unittest.NewEpochBuilder(suite.T(), state)
+	util.RunWithFullProtocolStateAndMutator(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
+		epochBuilder := unittest.NewEpochBuilder(suite.T(), mutableState, state)
 		// build epoch 1
 		// Blocks in current State
 		// P <- A(S_P-1) <- B(S_P) <- C(S_A) <- D(S_B) |setup| <- E(S_C) <- F(S_D) |commit|
@@ -514,6 +524,9 @@ func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_AtBlockIDInternalError
 func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_BlockNotFinalizedAtHeight() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
+	rootProtocolState, err := rootSnapshot.ProtocolState()
+	require.NoError(suite.T(), err)
+	rootProtocolStateID := rootProtocolState.Entry().ID()
 	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
 		rootBlock, err := rootSnapshot.Head()
 		suite.Require().NoError(err)
@@ -526,6 +539,7 @@ func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_BlockNotFinalizedAtHei
 
 		// create a new block with root block as parent
 		newBlock := unittest.BlockWithParentFixture(rootBlock)
+		newBlock.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		ctx := context.Background()
 		// add new block to the chain state
 		err = state.Extend(ctx, newBlock)
@@ -549,6 +563,9 @@ func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_BlockNotFinalizedAtHei
 func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_DifferentBlockFinalizedAtHeight() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
+	rootProtocolState, err := rootSnapshot.ProtocolState()
+	require.NoError(suite.T(), err)
+	rootProtocolStateID := rootProtocolState.Entry().ID()
 	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
 		rootBlock, err := rootSnapshot.Head()
 		suite.Require().NoError(err)
@@ -561,7 +578,9 @@ func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_DifferentBlockFinalize
 
 		// create a new block with root block as parent
 		finalizedBlock := unittest.BlockWithParentFixture(rootBlock)
+		finalizedBlock.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		orphanBlock := unittest.BlockWithParentFixture(rootBlock)
+		orphanBlock.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		ctx := context.Background()
 
 		// add new block to the chain state
@@ -595,6 +614,9 @@ func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_DifferentBlockFinalize
 func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_UnexpectedErrorBlockIDByHeight() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
+	rootProtocolState, err := rootSnapshot.ProtocolState()
+	require.NoError(suite.T(), err)
+	rootProtocolStateID := rootProtocolState.Entry().ID()
 	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
 		rootBlock, err := rootSnapshot.Head()
 		suite.Require().NoError(err)
@@ -607,6 +629,7 @@ func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_UnexpectedErrorBlockID
 
 		// create a new block with root block as parent
 		newBlock := unittest.BlockWithParentFixture(rootBlock)
+		newBlock.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		ctx := context.Background()
 		// add new block to the chain state
 		err = state.Extend(ctx, newBlock)
@@ -632,8 +655,8 @@ func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_UnexpectedErrorBlockID
 func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_InvalidSegment() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
-	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
-		epochBuilder := unittest.NewEpochBuilder(suite.T(), state)
+	util.RunWithFullProtocolStateAndMutator(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
+		epochBuilder := unittest.NewEpochBuilder(suite.T(), mutableState, state)
 		// build epoch 1
 		// Blocks in current State
 		// P <- A(S_P-1) <- B(S_P) <- C(S_A) <- D(S_B) |setup| <- E(S_C) <- F(S_D) |commit|
@@ -669,7 +692,7 @@ func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_InvalidSegment() {
 			suite.Require().Error(err)
 			suite.Require().Empty(bytes)
 			suite.Require().Equal(status.Errorf(codes.InvalidArgument, "failed to retrieve snapshot for block, try again with different block: %v",
-				ErrSnapshotPhaseMismatch).Error(),
+				snapshots.ErrSnapshotPhaseMismatch).Error(),
 				err.Error())
 		})
 
@@ -690,7 +713,7 @@ func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_InvalidSegment() {
 			suite.Require().Error(err)
 			suite.Require().Empty(bytes)
 			suite.Require().Equal(status.Errorf(codes.InvalidArgument, "failed to retrieve snapshot for block, try again with different block: %v",
-				ErrSnapshotPhaseMismatch).Error(),
+				snapshots.ErrSnapshotPhaseMismatch).Error(),
 				err.Error())
 		})
 	})
@@ -701,8 +724,8 @@ func (suite *Suite) TestGetProtocolStateSnapshotByBlockID_InvalidSegment() {
 func (suite *Suite) TestGetProtocolStateSnapshotByHeight() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
-	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
-		epochBuilder := unittest.NewEpochBuilder(suite.T(), state)
+	util.RunWithFullProtocolStateAndMutator(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
+		epochBuilder := unittest.NewEpochBuilder(suite.T(), mutableState, state)
 		// build epoch 1
 		// Blocks in current State
 		// P <- A(S_P-1) <- B(S_P) <- C(S_A) <- D(S_B) |setup| <- E(S_C) <- F(S_D) |commit|
@@ -744,11 +767,15 @@ func (suite *Suite) TestGetProtocolStateSnapshotByHeight() {
 func (suite *Suite) TestGetProtocolStateSnapshotByHeight_NonFinalizedBlocks() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
+	rootProtocolState, err := rootSnapshot.ProtocolState()
+	require.NoError(suite.T(), err)
+	rootProtocolStateID := rootProtocolState.Entry().ID()
 	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
 		rootBlock, err := rootSnapshot.Head()
 		suite.Require().NoError(err)
 		// create a new block with root block as parent
 		newBlock := unittest.BlockWithParentFixture(rootBlock)
+		newBlock.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		ctx := context.Background()
 		// add new block to the chain state
 		err = state.Extend(ctx, newBlock)
@@ -779,8 +806,8 @@ func (suite *Suite) TestGetProtocolStateSnapshotByHeight_NonFinalizedBlocks() {
 func (suite *Suite) TestGetProtocolStateSnapshotByHeight_InvalidSegment() {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
-	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
-		epochBuilder := unittest.NewEpochBuilder(suite.T(), state)
+	util.RunWithFullProtocolStateAndMutator(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
+		epochBuilder := unittest.NewEpochBuilder(suite.T(), mutableState, state)
 		// build epoch 1
 		// Blocks in current State
 		// P <- A(S_P-1) <- B(S_P) <- C(S_A) <- D(S_B) |setup| <- E(S_C) <- F(S_D) |commit|
@@ -807,7 +834,7 @@ func (suite *Suite) TestGetProtocolStateSnapshotByHeight_InvalidSegment() {
 		suite.Require().Error(err)
 		suite.Require().Equal(status.Errorf(codes.InvalidArgument, "failed to retrieve snapshot for block, try "+
 			"again with different block: %v",
-			ErrSnapshotPhaseMismatch).Error(),
+			snapshots.ErrSnapshotPhaseMismatch).Error(),
 			err.Error())
 	})
 }
@@ -979,8 +1006,7 @@ func (suite *Suite) TestGetTransactionResultsByBlockID() {
 	params := suite.defaultBackendParams()
 
 	block := unittest.BlockFixture()
-	sporkRootBlockHeight, err := suite.state.Params().SporkRootBlockHeight()
-	suite.Require().NoError(err)
+	sporkRootBlockHeight := suite.state.Params().SporkRootBlockHeight()
 	block.Header.Height = sporkRootBlockHeight + 1
 	blockId := block.ID()
 
@@ -1264,7 +1290,6 @@ func (suite *Suite) TestTransactionExpiredStatusTransition() {
 
 // TestTransactionPendingToFinalizedStatusTransition tests that the status of transaction changes from Finalized to Expired
 func (suite *Suite) TestTransactionPendingToFinalizedStatusTransition() {
-
 	ctx := context.Background()
 	collection := unittest.CollectionFixture(1)
 	transactionBody := collection.Transactions[0]
@@ -1630,72 +1655,6 @@ func (suite *Suite) TestGetNodeVersionInfo() {
 
 		suite.Require().Equal(expected, actual)
 	})
-
-	suite.Run("backend construct fails when SporkID lookup fails", func() {
-		stateParams := protocol.NewParams(suite.T())
-		stateParams.On("SporkID").Return(flow.ZeroID, fmt.Errorf("fail"))
-
-		state := protocol.NewState(suite.T())
-		state.On("Params").Return(stateParams, nil).Maybe()
-
-		params := suite.defaultBackendParams()
-		params.State = state
-
-		backend, err := New(params)
-		suite.Require().Error(err)
-		suite.Require().Nil(backend)
-	})
-
-	suite.Run("backend construct fails when ProtocolVersion lookup fails", func() {
-		stateParams := protocol.NewParams(suite.T())
-		stateParams.On("SporkID").Return(sporkID, nil)
-		stateParams.On("ProtocolVersion").Return(uint(0), fmt.Errorf("fail"))
-
-		state := protocol.NewState(suite.T())
-		state.On("Params").Return(stateParams, nil).Maybe()
-
-		params := suite.defaultBackendParams()
-		params.State = state
-
-		backend, err := New(params)
-		suite.Require().Error(err)
-		suite.Require().Nil(backend)
-	})
-
-	suite.Run("backend construct fails when SporkRootBlockHeight lookup fails", func() {
-		stateParams := protocol.NewParams(suite.T())
-		stateParams.On("SporkID").Return(sporkID, nil)
-		stateParams.On("ProtocolVersion").Return(protocolVersion, nil)
-		stateParams.On("SporkRootBlockHeight").Return(uint64(0), fmt.Errorf("fail"))
-
-		state := protocol.NewState(suite.T())
-		state.On("Params").Return(stateParams, nil).Maybe()
-
-		params := suite.defaultBackendParams()
-		params.State = state
-
-		backend, err := New(params)
-		suite.Require().Error(err)
-		suite.Require().Nil(backend)
-	})
-
-	suite.Run("backend construct fails when SealedRoot lookup fails", func() {
-		stateParams := protocol.NewParams(suite.T())
-		stateParams.On("SporkID").Return(sporkID, nil)
-		stateParams.On("ProtocolVersion").Return(protocolVersion, nil)
-		stateParams.On("SporkRootBlockHeight").Return(sporkRootBlock.Height, nil)
-		stateParams.On("SealedRoot").Return(nil, fmt.Errorf("fail"))
-
-		state := protocol.NewState(suite.T())
-		state.On("Params").Return(stateParams, nil).Maybe()
-
-		params := suite.defaultBackendParams()
-		params.State = state
-
-		backend, err := New(params)
-		suite.Require().Error(err)
-		suite.Require().Nil(backend)
-	})
 }
 
 func (suite *Suite) TestGetNetworkParameters() {
@@ -1760,11 +1719,11 @@ func (suite *Suite) TestExecutionNodesForBlockID() {
 		func(id flow.Identifier) error { return nil })
 
 	suite.snapshot.On("Identities", mock.Anything).Return(
-		func(filter flow.IdentityFilter) flow.IdentityList {
+		func(filter flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			// apply the filter passed in to the list of all the execution nodes
 			return allExecutionNodes.Filter(filter)
 		},
-		func(flow.IdentityFilter) error { return nil })
+		func(flow.IdentityFilter[flow.Identity]) error { return nil })
 	suite.state.On("Final").Return(suite.snapshot, nil).Maybe()
 
 	testExecutionNodesForBlockID := func(preferredENs, fixedENs, expectedENs flow.IdentityList) {
@@ -1787,17 +1746,20 @@ func (suite *Suite) TestExecutionNodesForBlockID() {
 		execSelector, err := execNodeSelectorFactory.SelectNodes(allExecNodes)
 		require.NoError(suite.T(), err)
 
-		actualList := flow.IdentityList{}
+		actualList := flow.IdentitySkeletonList{}
 		for actual := execSelector.Next(); actual != nil; actual = execSelector.Next() {
 			actualList = append(actualList, actual)
 		}
 
-		if len(expectedENs) > maxNodesCnt {
-			for _, actual := range actualList {
-				require.Contains(suite.T(), expectedENs, actual)
+		{
+			expectedENs := expectedENs.ToSkeleton()
+			if len(expectedENs) > maxNodesCnt {
+				for _, actual := range actualList {
+					require.Contains(suite.T(), expectedENs, actual)
+				}
+			} else {
+				require.ElementsMatch(suite.T(), actualList, expectedENs)
 			}
-		} else {
-			require.ElementsMatch(suite.T(), actualList, expectedENs)
 		}
 	}
 	// if we don't find sufficient receipts, executionNodesForBlockID should return a list of random ENs
@@ -1815,7 +1777,7 @@ func (suite *Suite) TestExecutionNodesForBlockID() {
 		execSelector, err := execNodeSelectorFactory.SelectNodes(allExecNodes)
 		require.NoError(suite.T(), err)
 
-		actualList := flow.IdentityList{}
+		actualList := flow.IdentitySkeletonList{}
 		for actual := execSelector.Next(); actual != nil; actual = execSelector.Next() {
 			actualList = append(actualList, actual)
 		}
@@ -2184,7 +2146,6 @@ func (suite *Suite) defaultBackendParams() Params {
 		Transactions:             suite.transactions,
 		ExecutionReceipts:        suite.receipts,
 		ExecutionResults:         suite.results,
-		LightTransactionResults:  suite.transactionResults,
 		ChainID:                  suite.chainID,
 		CollectionRPC:            suite.colClient,
 		MaxHeightRange:           DefaultMaxHeightRange,
@@ -2193,5 +2154,7 @@ func (suite *Suite) defaultBackendParams() Params {
 		AccessMetrics:            metrics.NewNoopCollector(),
 		Log:                      suite.log,
 		TxErrorMessagesCacheSize: 1000,
+		BlockTracker:             nil,
+		TxResultQueryMode:        IndexQueryModeExecutionNodesOnly,
 	}
 }
diff --git a/engine/access/rpc/backend/backend_transactions.go b/engine/access/rpc/backend/backend_transactions.go
index 6d0303d5ed8..831a5efa404 100644
--- a/engine/access/rpc/backend/backend_transactions.go
+++ b/engine/access/rpc/backend/backend_transactions.go
@@ -18,23 +18,18 @@ import (
 	"github.com/onflow/flow-go/engine/access/rpc/connection"
 	"github.com/onflow/flow-go/engine/common/rpc"
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
-	"github.com/onflow/flow-go/fvm/blueprints"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module"
 	"github.com/onflow/flow-go/module/irrecoverable"
 	"github.com/onflow/flow-go/state"
-	"github.com/onflow/flow-go/state/protocol"
 	"github.com/onflow/flow-go/storage"
 )
 
 type backendTransactions struct {
+	*TransactionsLocalDataProvider
 	staticCollectionRPC  accessproto.AccessAPIClient // rpc client tied to a fixed collection node
 	transactions         storage.Transactions
 	executionReceipts    storage.ExecutionReceipts
-	collections          storage.Collections
-	blocks               storage.Blocks
-	results              storage.LightTransactionResults
-	state                protocol.State
 	chainID              flow.ChainID
 	transactionMetrics   module.TransactionMetrics
 	transactionValidator *access.TransactionValidator
@@ -46,8 +41,14 @@ type backendTransactions struct {
 	nodeCommunicator     Communicator
 	txResultCache        *lru.Cache[flow.Identifier, *access.TransactionResult]
 	txErrorMessagesCache *lru.Cache[flow.Identifier, string] // cache for transactions error messages, indexed by hash(block_id, tx_id).
+	txResultQueryMode    IndexQueryMode
+
+	systemTxID flow.Identifier
+	systemTx   *flow.TransactionBody
 }
 
+var _ TransactionErrorMessage = (*backendTransactions)(nil)
+
 // SendTransaction forwards the transaction to the collection node
 func (b *backendTransactions) SendTransaction(
 	ctx context.Context,
@@ -84,7 +85,6 @@ func (b *backendTransactions) SendTransaction(
 
 // trySendTransaction tries to transaction to a collection node
 func (b *backendTransactions) trySendTransaction(ctx context.Context, tx *flow.TransactionBody) error {
-
 	// if a collection node rpc client was provided at startup, just use that
 	if b.staticCollectionRPC != nil {
 		return b.grpcTxSend(ctx, b.staticCollectionRPC, tx)
@@ -107,7 +107,7 @@ func (b *backendTransactions) trySendTransaction(ctx context.Context, tx *flow.T
 	// try sending the transaction to one of the chosen collection nodes
 	sendError = b.nodeCommunicator.CallAvailableNode(
 		collNodes,
-		func(node *flow.Identity) error {
+		func(node *flow.IdentitySkeleton) error {
 			err = b.sendTransactionToCollector(ctx, tx, node.Address)
 			if err != nil {
 				return err
@@ -122,8 +122,7 @@ func (b *backendTransactions) trySendTransaction(ctx context.Context, tx *flow.T
 
 // chooseCollectionNodes finds a random subset of size sampleSize of collection node addresses from the
 // collection node cluster responsible for the given tx
-func (b *backendTransactions) chooseCollectionNodes(txID flow.Identifier) (flow.IdentityList, error) {
-
+func (b *backendTransactions) chooseCollectionNodes(txID flow.Identifier) (flow.IdentitySkeletonList, error) {
 	// retrieve the set of collector clusters
 	clusters, err := b.state.Final().Epochs().Current().Clustering()
 	if err != nil {
@@ -145,7 +144,6 @@ func (b *backendTransactions) sendTransactionToCollector(
 	tx *flow.TransactionBody,
 	collectionNodeAddr string,
 ) error {
-
 	collectionRPC, closer, err := b.connFactory.GetAccessAPIClient(collectionNodeAddr, nil)
 	if err != nil {
 		return fmt.Errorf("failed to connect to collection node at %s: %w", collectionNodeAddr, err)
@@ -177,7 +175,6 @@ func (b *backendTransactions) SendRawTransaction(
 	ctx context.Context,
 	tx *flow.TransactionBody,
 ) error {
-
 	// send the transaction to the collection node
 	return b.trySendTransaction(ctx, tx)
 }
@@ -219,12 +216,7 @@ func (b *backendTransactions) GetTransactionsByBlockID(
 		transactions = append(transactions, collection.Transactions...)
 	}
 
-	systemTx, err := blueprints.SystemChunkTransaction(b.chainID.Chain())
-	if err != nil {
-		return nil, status.Errorf(codes.Internal, "could not get system chunk transaction: %v", err)
-	}
-
-	transactions = append(transactions, systemTx)
+	transactions = append(transactions, b.systemTx)
 
 	return transactions, nil
 }
@@ -276,7 +268,6 @@ func (b *backendTransactions) GetTransactionResult(
 	}
 
 	block, err := b.retrieveBlock(blockID, collectionID, txID)
-
 	// an error occurred looking up the block or the requested block or collection was not found.
 	// If looking up the block based solely on the txID returns not found, then no error is
 	// returned since the block may not be finalized yet.
@@ -284,22 +275,17 @@ func (b *backendTransactions) GetTransactionResult(
 		return nil, rpc.ConvertStorageError(err)
 	}
 
-	var transactionWasExecuted bool
-	var events []flow.Event
-	var txError string
-	var statusCode uint32
 	var blockHeight uint64
-
+	var txResult *access.TransactionResult
 	// access node may not have the block if it hasn't yet been finalized, hence block can be nil at this point
 	if block != nil {
-		foundBlockID := block.ID()
-		transactionWasExecuted, events, statusCode, txError, err = b.lookupTransactionResult(ctx, txID, foundBlockID, requiredEventEncodingVersion)
+		txResult, err = b.lookupTransactionResult(ctx, txID, block, requiredEventEncodingVersion)
 		if err != nil {
-			return nil, rpc.ConvertError(err, "failed to retrieve result from any execution node", codes.Internal)
+			return nil, rpc.ConvertError(err, "failed to retrieve result", codes.Internal)
 		}
 
 		// an additional check to ensure the correctness of the collection ID.
-		expectedCollectionID, err := b.lookupCollectionIDInBlock(block, txID)
+		expectedCollectionID, err := b.LookupCollectionIDInBlock(block, txID)
 		if err != nil {
 			// if the collection has not been indexed yet, the lookup will return a not found error.
 			// if the request included a blockID or collectionID in its the search criteria, not found
@@ -316,52 +302,41 @@ func (b *backendTransactions) GetTransactionResult(
 			return nil, status.Error(codes.InvalidArgument, "transaction not found in provided collection")
 		}
 
-		blockID = foundBlockID
+		blockID = block.ID()
 		blockHeight = block.Header.Height
 	}
 
-	// derive status of the transaction
-	txStatus, err := b.deriveTransactionStatus(tx, transactionWasExecuted, block)
-	if err != nil {
-		if !errors.Is(err, state.ErrUnknownSnapshotReference) {
-			irrecoverable.Throw(ctx, err)
+	// If there is still no transaction result, provide one based on available information.
+	if txResult == nil {
+		var txStatus flow.TransactionStatus
+		// Derive the status of the transaction.
+		if block == nil {
+			txStatus, err = b.DeriveUnknownTransactionStatus(tx.ReferenceBlockID)
+		} else {
+			txStatus, err = b.DeriveTransactionStatus(blockID, blockHeight, false)
 		}
-		return nil, rpc.ConvertStorageError(err)
-	}
-
-	b.transactionMetrics.TransactionResultFetched(time.Since(start), len(tx.Script))
 
-	return &access.TransactionResult{
-		Status:        txStatus,
-		StatusCode:    uint(statusCode),
-		Events:        events,
-		ErrorMessage:  txError,
-		BlockID:       blockID,
-		TransactionID: txID,
-		CollectionID:  collectionID,
-		BlockHeight:   blockHeight,
-	}, nil
-}
-
-// lookupCollectionIDInBlock returns the collection ID based on the transaction ID. The lookup is performed in block
-// collections.
-func (b *backendTransactions) lookupCollectionIDInBlock(
-	block *flow.Block,
-	txID flow.Identifier,
-) (flow.Identifier, error) {
-	for _, guarantee := range block.Payload.Guarantees {
-		collection, err := b.collections.LightByID(guarantee.ID())
 		if err != nil {
-			return flow.ZeroID, err
+			if !errors.Is(err, state.ErrUnknownSnapshotReference) {
+				irrecoverable.Throw(ctx, err)
+			}
+			return nil, rpc.ConvertStorageError(err)
 		}
 
-		for _, collectionTxID := range collection.Transactions {
-			if collectionTxID == txID {
-				return collection.ID(), nil
-			}
+		txResult = &access.TransactionResult{
+			BlockID:       blockID,
+			BlockHeight:   blockHeight,
+			TransactionID: txID,
+			Status:        txStatus,
+			CollectionID:  collectionID,
 		}
+	} else {
+		txResult.CollectionID = collectionID
 	}
-	return flow.ZeroID, status.Error(codes.NotFound, "transaction not found in block")
+
+	b.transactionMetrics.TransactionResultFetched(time.Since(start), len(tx.Script))
+
+	return txResult, nil
 }
 
 // retrieveBlock function returns a block based on the input argument. The block ID lookup has the highest priority,
@@ -402,6 +377,30 @@ func (b *backendTransactions) GetTransactionResultsByBlockID(
 		return nil, rpc.ConvertStorageError(err)
 	}
 
+	switch b.txResultQueryMode {
+	case IndexQueryModeExecutionNodesOnly:
+		return b.getTransactionResultsByBlockIDFromExecutionNode(ctx, block, requiredEventEncodingVersion)
+	case IndexQueryModeLocalOnly:
+		return b.GetTransactionResultsByBlockIDFromStorage(ctx, block, requiredEventEncodingVersion)
+	case IndexQueryModeFailover:
+		results, err := b.GetTransactionResultsByBlockIDFromStorage(ctx, block, requiredEventEncodingVersion)
+		if err == nil {
+			return results, nil
+		}
+
+		// If any error occurs with local storage - request transaction result from EN
+		return b.getTransactionResultsByBlockIDFromExecutionNode(ctx, block, requiredEventEncodingVersion)
+	default:
+		return nil, status.Errorf(codes.Internal, "unknown transaction result query mode: %v", b.txResultQueryMode)
+	}
+}
+
+func (b *backendTransactions) getTransactionResultsByBlockIDFromExecutionNode(
+	ctx context.Context,
+	block *flow.Block,
+	requiredEventEncodingVersion entities.EventEncodingVersion,
+) ([]*access.TransactionResult, error) {
+	blockID := block.ID()
 	req := &execproto.GetTransactionsByBlockIDRequest{
 		BlockId: blockID[:],
 	}
@@ -440,7 +439,7 @@ func (b *backendTransactions) GetTransactionResultsByBlockID(
 			txResult := resp.TransactionResults[i]
 
 			// tx body is irrelevant to status if it's in an executed block
-			txStatus, err := b.deriveTransactionStatus(nil, true, block)
+			txStatus, err := b.DeriveTransactionStatus(blockID, block.Header.Height, true)
 			if err != nil {
 				if !errors.Is(err, state.ErrUnknownSnapshotReference) {
 					irrecoverable.Throw(ctx, err)
@@ -471,11 +470,7 @@ func (b *backendTransactions) GetTransactionResultsByBlockID(
 	// after iterating through all transactions  in each collection, i equals the total number of
 	// user transactions  in the block
 	txCount := i
-
-	sporkRootBlockHeight, err := b.state.Params().SporkRootBlockHeight()
-	if err != nil {
-		return nil, status.Errorf(codes.Internal, "failed to retrieve root block: %v", err)
-	}
+	sporkRootBlockHeight := b.state.Params().SporkRootBlockHeight()
 
 	// root block has no system transaction result
 	if block.Header.Height > sporkRootBlockHeight {
@@ -492,12 +487,8 @@ func (b *backendTransactions) GetTransactionResultsByBlockID(
 			return nil, status.Errorf(codes.Internal, "number of transaction results returned by execution node is more than the number of transactions  in the block")
 		}
 
-		systemTx, err := blueprints.SystemChunkTransaction(b.chainID.Chain())
-		if err != nil {
-			return nil, status.Errorf(codes.Internal, "could not get system chunk transaction: %v", err)
-		}
 		systemTxResult := resp.TransactionResults[len(resp.TransactionResults)-1]
-		systemTxStatus, err := b.deriveTransactionStatus(systemTx, true, block)
+		systemTxStatus, err := b.DeriveTransactionStatus(blockID, block.Header.Height, true)
 		if err != nil {
 			if !errors.Is(err, state.ErrUnknownSnapshotReference) {
 				irrecoverable.Throw(ctx, err)
@@ -516,11 +507,10 @@ func (b *backendTransactions) GetTransactionResultsByBlockID(
 			Events:        events,
 			ErrorMessage:  systemTxResult.GetErrorMessage(),
 			BlockID:       blockID,
-			TransactionID: systemTx.ID(),
+			TransactionID: b.systemTxID,
 			BlockHeight:   block.Header.Height,
 		})
 	}
-
 	return results, nil
 }
 
@@ -538,6 +528,31 @@ func (b *backendTransactions) GetTransactionResultByIndex(
 		return nil, rpc.ConvertStorageError(err)
 	}
 
+	switch b.txResultQueryMode {
+	case IndexQueryModeExecutionNodesOnly:
+		return b.getTransactionResultByIndexFromExecutionNode(ctx, block, index, requiredEventEncodingVersion)
+	case IndexQueryModeLocalOnly:
+		return b.GetTransactionResultByIndexFromStorage(ctx, block, index, requiredEventEncodingVersion)
+	case IndexQueryModeFailover:
+		result, err := b.GetTransactionResultByIndexFromStorage(ctx, block, index, requiredEventEncodingVersion)
+		if err == nil {
+			return result, nil
+		}
+
+		// If any error occurs with local storage - request transaction result from EN
+		return b.getTransactionResultByIndexFromExecutionNode(ctx, block, index, requiredEventEncodingVersion)
+	default:
+		return nil, status.Errorf(codes.Internal, "unknown transaction result query mode: %v", b.txResultQueryMode)
+	}
+}
+
+func (b *backendTransactions) getTransactionResultByIndexFromExecutionNode(
+	ctx context.Context,
+	block *flow.Block,
+	index uint32,
+	requiredEventEncodingVersion entities.EventEncodingVersion,
+) (*access.TransactionResult, error) {
+	blockID := block.ID()
 	// create request and forward to EN
 	req := &execproto.GetTransactionByIndexRequest{
 		BlockId: blockID[:],
@@ -558,7 +573,7 @@ func (b *backendTransactions) GetTransactionResultByIndex(
 	}
 
 	// tx body is irrelevant to status if it's in an executed block
-	txStatus, err := b.deriveTransactionStatus(nil, true, block)
+	txStatus, err := b.DeriveTransactionStatus(blockID, block.Header.Height, true)
 	if err != nil {
 		if !errors.Is(err, state.ErrUnknownSnapshotReference) {
 			irrecoverable.Throw(ctx, err)
@@ -584,12 +599,7 @@ func (b *backendTransactions) GetTransactionResultByIndex(
 
 // GetSystemTransaction returns system transaction
 func (b *backendTransactions) GetSystemTransaction(ctx context.Context, _ flow.Identifier) (*flow.TransactionBody, error) {
-	systemTx, err := blueprints.SystemChunkTransaction(b.chainID.Chain())
-	if err != nil {
-		return nil, status.Errorf(codes.Internal, "could not get system chunk transaction: %v", err)
-	}
-
-	return systemTx, nil
+	return b.systemTx, nil
 }
 
 // GetSystemTransactionResult returns system transaction result
@@ -615,13 +625,8 @@ func (b *backendTransactions) GetSystemTransactionResult(ctx context.Context, bl
 		return nil, rpc.ConvertError(err, "failed to retrieve result from execution node", codes.Internal)
 	}
 
-	systemTx, err := blueprints.SystemChunkTransaction(b.chainID.Chain())
-	if err != nil {
-		return nil, status.Errorf(codes.Internal, "could not get system chunk transaction: %v", err)
-	}
-
 	systemTxResult := resp.TransactionResults[len(resp.TransactionResults)-1]
-	systemTxStatus, err := b.deriveTransactionStatus(systemTx, true, block)
+	systemTxStatus, err := b.DeriveTransactionStatus(blockID, block.Header.Height, true)
 	if err != nil {
 		return nil, rpc.ConvertStorageError(err)
 	}
@@ -637,100 +642,15 @@ func (b *backendTransactions) GetSystemTransactionResult(ctx context.Context, bl
 		Events:        events,
 		ErrorMessage:  systemTxResult.GetErrorMessage(),
 		BlockID:       blockID,
-		TransactionID: systemTx.ID(),
+		TransactionID: b.systemTxID,
 		BlockHeight:   block.Header.Height,
 	}, nil
 }
 
-// deriveTransactionStatus derives the transaction status based on current protocol state
-// Error returns:
-//   - state.ErrUnknownSnapshotReference - block referenced by transaction has not been found.
-//   - all other errors are unexpected and potentially symptoms of internal implementation bugs or state corruption (fatal).
-func (b *backendTransactions) deriveTransactionStatus(
-	tx *flow.TransactionBody,
-	executed bool,
-	block *flow.Block,
-) (flow.TransactionStatus, error) {
-	if block == nil {
-		// Not in a block, let's see if it's expired
-		referenceBlock, err := b.state.AtBlockID(tx.ReferenceBlockID).Head()
-		if err != nil {
-			return flow.TransactionStatusUnknown, err
-		}
-		refHeight := referenceBlock.Height
-		// get the latest finalized block from the state
-		finalized, err := b.state.Final().Head()
-		if err != nil {
-			return flow.TransactionStatusUnknown, irrecoverable.NewExceptionf("failed to lookup final header: %w", err)
-		}
-		finalizedHeight := finalized.Height
-
-		// if we haven't seen the expiry block for this transaction, it's not expired
-		if !b.isExpired(refHeight, finalizedHeight) {
-			return flow.TransactionStatusPending, nil
-		}
-
-		// At this point, we have seen the expiry block for the transaction.
-		// This means that, if no collections  prior to the expiry block contain
-		// the transaction, it can never be included and is expired.
-		//
-		// To ensure this, we need to have received all collections  up to the
-		// expiry block to ensure the transaction did not appear in any.
-
-		// the last full height is the height where we have received all
-		// collections  for all blocks with a lower height
-		fullHeight, err := b.blocks.GetLastFullBlockHeight()
-		if err != nil {
-			return flow.TransactionStatusUnknown, err
-		}
-
-		// if we have received collections  for all blocks up to the expiry block, the transaction is expired
-		if b.isExpired(refHeight, fullHeight) {
-			return flow.TransactionStatusExpired, nil
-		}
-
-		// tx found in transaction storage and collection storage but not in block storage
-		// However, this will not happen as of now since the ingestion engine doesn't subscribe
-		// for collections
-		return flow.TransactionStatusPending, nil
-	}
-
-	if !executed {
-		// If we've gotten here, but the block has not yet been executed, report it as only been finalized
-		return flow.TransactionStatusFinalized, nil
-	}
-
-	// From this point on, we know for sure this transaction has at least been executed
-
-	// get the latest sealed block from the State
-	sealed, err := b.state.Sealed().Head()
-	if err != nil {
-		return flow.TransactionStatusUnknown, irrecoverable.NewExceptionf("failed to lookup sealed header: %w", err)
-	}
-
-	if block.Header.Height > sealed.Height {
-		// The block is not yet sealed, so we'll report it as only executed
-		return flow.TransactionStatusExecuted, nil
-	}
-
-	// otherwise, this block has been executed, and sealed, so report as sealed
-	return flow.TransactionStatusSealed, nil
-}
-
-// isExpired checks whether a transaction is expired given the height of the
-// transaction's reference block and the height to compare against.
-func (b *backendTransactions) isExpired(refHeight, compareToHeight uint64) bool {
-	if compareToHeight <= refHeight {
-		return false
-	}
-	return compareToHeight-refHeight > flow.DefaultTransactionExpiry
-}
-
 // Error returns:
 //   - `storage.ErrNotFound` - collection referenced by transaction or block by a collection has not been found.
 //   - all other errors are unexpected and potentially symptoms of internal implementation bugs or state corruption (fatal).
 func (b *backendTransactions) lookupBlock(txID flow.Identifier) (*flow.Block, error) {
-
 	collection, err := b.collections.LightByTransactionID(txID)
 	if err != nil {
 		return nil, err
@@ -747,22 +667,38 @@ func (b *backendTransactions) lookupBlock(txID flow.Identifier) (*flow.Block, er
 func (b *backendTransactions) lookupTransactionResult(
 	ctx context.Context,
 	txID flow.Identifier,
-	blockID flow.Identifier,
+	block *flow.Block,
 	requiredEventEncodingVersion entities.EventEncodingVersion,
-) (bool, []flow.Event, uint32, string, error) {
-	events, txStatus, message, err := b.getTransactionResultFromExecutionNode(ctx, blockID, txID[:], requiredEventEncodingVersion)
+) (*access.TransactionResult, error) {
+	var txResult *access.TransactionResult
+	var err error
+	switch b.txResultQueryMode {
+	case IndexQueryModeExecutionNodesOnly:
+		txResult, err = b.getTransactionResultFromExecutionNode(ctx, block, txID, requiredEventEncodingVersion)
+	case IndexQueryModeLocalOnly:
+		txResult, err = b.GetTransactionResultFromStorage(ctx, block, txID, requiredEventEncodingVersion)
+	case IndexQueryModeFailover:
+		txResult, err = b.GetTransactionResultFromStorage(ctx, block, txID, requiredEventEncodingVersion)
+		if err != nil {
+			// If any error occurs with local storage - request transaction result from EN
+			txResult, err = b.getTransactionResultFromExecutionNode(ctx, block, txID, requiredEventEncodingVersion)
+		}
+	default:
+		return nil, status.Errorf(codes.Internal, "unknown transaction result query mode: %v", b.txResultQueryMode)
+	}
+
 	if err != nil {
-		// if either the execution node reported no results or the execution node could not be chosen
+		// if either the storage or execution node reported no results or there were not enough execution results
 		if status.Code(err) == codes.NotFound {
 			// No result yet, indicate that it has not been executed
-			return false, nil, 0, "", nil
+			return nil, nil
 		}
 		// Other Error trying to retrieve the result, return with err
-		return false, nil, 0, "", err
+		return nil, err
 	}
 
 	// considered executed as long as some result is returned, even if it's an error message
-	return true, events, txStatus, message, nil
+	return txResult, nil
 }
 
 func (b *backendTransactions) getHistoricalTransaction(
@@ -831,37 +767,54 @@ func (b *backendTransactions) registerTransactionForRetry(tx *flow.TransactionBo
 
 func (b *backendTransactions) getTransactionResultFromExecutionNode(
 	ctx context.Context,
-	blockID flow.Identifier,
-	transactionID []byte,
+	block *flow.Block,
+	transactionID flow.Identifier,
 	requiredEventEncodingVersion entities.EventEncodingVersion,
-) ([]flow.Event, uint32, string, error) {
-
+) (*access.TransactionResult, error) {
+	blockID := block.ID()
 	// create an execution API request for events at blockID and transactionID
 	req := &execproto.GetTransactionResultRequest{
 		BlockId:       blockID[:],
-		TransactionId: transactionID,
+		TransactionId: transactionID[:],
 	}
 
 	execNodes, err := executionNodesForBlockID(ctx, blockID, b.executionReceipts, b.state, b.log)
 	if err != nil {
 		// if no execution receipt were found, return a NotFound GRPC error
 		if IsInsufficientExecutionReceipts(err) {
-			return nil, 0, "", status.Errorf(codes.NotFound, err.Error())
+			return nil, status.Errorf(codes.NotFound, err.Error())
 		}
-		return nil, 0, "", err
+		return nil, err
 	}
 
 	resp, err := b.getTransactionResultFromAnyExeNode(ctx, execNodes, req)
 	if err != nil {
-		return nil, 0, "", err
+		return nil, err
+	}
+
+	// tx body is irrelevant to status if it's in an executed block
+	txStatus, err := b.DeriveTransactionStatus(blockID, block.Header.Height, true)
+	if err != nil {
+		if !errors.Is(err, state.ErrUnknownSnapshotReference) {
+			irrecoverable.Throw(ctx, err)
+		}
+		return nil, rpc.ConvertStorageError(err)
 	}
 
 	events, err := convert.MessagesToEventsWithEncodingConversion(resp.GetEvents(), resp.GetEventEncodingVersion(), requiredEventEncodingVersion)
 	if err != nil {
-		return nil, 0, "", rpc.ConvertError(err, "failed to convert events to message", codes.Internal)
+		return nil, rpc.ConvertError(err, "failed to convert events to message", codes.Internal)
 	}
 
-	return events, resp.GetStatusCode(), resp.GetErrorMessage(), nil
+	return &access.TransactionResult{
+		TransactionID: transactionID,
+		Status:        txStatus,
+		StatusCode:    uint(resp.GetStatusCode()),
+		Events:        events,
+		ErrorMessage:  resp.GetErrorMessage(),
+		BlockID:       blockID,
+		BlockHeight:   block.Header.Height,
+	}, nil
 }
 
 // ATTENTION: might be a source of problems in future. We run this code on finalization gorotuine,
@@ -875,7 +828,7 @@ func (b *backendTransactions) ProcessFinalizedBlockHeight(height uint64) error {
 
 func (b *backendTransactions) getTransactionResultFromAnyExeNode(
 	ctx context.Context,
-	execNodes flow.IdentityList,
+	execNodes flow.IdentitySkeletonList,
 	req *execproto.GetTransactionResultRequest,
 ) (*execproto.GetTransactionResultResponse, error) {
 	var errToReturn error
@@ -889,7 +842,7 @@ func (b *backendTransactions) getTransactionResultFromAnyExeNode(
 	var resp *execproto.GetTransactionResultResponse
 	errToReturn = b.nodeCommunicator.CallAvailableNode(
 		execNodes,
-		func(node *flow.Identity) error {
+		func(node *flow.IdentitySkeleton) error {
 			var err error
 			resp, err = b.tryGetTransactionResult(ctx, node, req)
 			if err == nil {
@@ -910,7 +863,7 @@ func (b *backendTransactions) getTransactionResultFromAnyExeNode(
 
 func (b *backendTransactions) tryGetTransactionResult(
 	ctx context.Context,
-	execNode *flow.Identity,
+	execNode *flow.IdentitySkeleton,
 	req *execproto.GetTransactionResultRequest,
 ) (*execproto.GetTransactionResultResponse, error) {
 	execRPCClient, closer, err := b.connFactory.GetExecutionAPIClient(execNode.Address)
@@ -929,7 +882,7 @@ func (b *backendTransactions) tryGetTransactionResult(
 
 func (b *backendTransactions) getTransactionResultsByBlockIDFromAnyExeNode(
 	ctx context.Context,
-	execNodes flow.IdentityList,
+	execNodes flow.IdentitySkeletonList,
 	req *execproto.GetTransactionsByBlockIDRequest,
 ) (*execproto.GetTransactionResultsResponse, error) {
 	var errToReturn error
@@ -949,7 +902,7 @@ func (b *backendTransactions) getTransactionResultsByBlockIDFromAnyExeNode(
 	var resp *execproto.GetTransactionResultsResponse
 	errToReturn = b.nodeCommunicator.CallAvailableNode(
 		execNodes,
-		func(node *flow.Identity) error {
+		func(node *flow.IdentitySkeleton) error {
 			var err error
 			resp, err = b.tryGetTransactionResultsByBlockID(ctx, node, req)
 			if err == nil {
@@ -969,7 +922,7 @@ func (b *backendTransactions) getTransactionResultsByBlockIDFromAnyExeNode(
 
 func (b *backendTransactions) tryGetTransactionResultsByBlockID(
 	ctx context.Context,
-	execNode *flow.Identity,
+	execNode *flow.IdentitySkeleton,
 	req *execproto.GetTransactionsByBlockIDRequest,
 ) (*execproto.GetTransactionResultsResponse, error) {
 	execRPCClient, closer, err := b.connFactory.GetExecutionAPIClient(execNode.Address)
@@ -988,7 +941,7 @@ func (b *backendTransactions) tryGetTransactionResultsByBlockID(
 
 func (b *backendTransactions) getTransactionResultByIndexFromAnyExeNode(
 	ctx context.Context,
-	execNodes flow.IdentityList,
+	execNodes flow.IdentitySkeletonList,
 	req *execproto.GetTransactionByIndexRequest,
 ) (*execproto.GetTransactionResultResponse, error) {
 	var errToReturn error
@@ -1005,7 +958,7 @@ func (b *backendTransactions) getTransactionResultByIndexFromAnyExeNode(
 	var resp *execproto.GetTransactionResultResponse
 	errToReturn = b.nodeCommunicator.CallAvailableNode(
 		execNodes,
-		func(node *flow.Identity) error {
+		func(node *flow.IdentitySkeleton) error {
 			var err error
 			resp, err = b.tryGetTransactionResultByIndex(ctx, node, req)
 			if err == nil {
@@ -1026,7 +979,7 @@ func (b *backendTransactions) getTransactionResultByIndexFromAnyExeNode(
 
 func (b *backendTransactions) tryGetTransactionResultByIndex(
 	ctx context.Context,
-	execNode *flow.Identity,
+	execNode *flow.IdentitySkeleton,
 	req *execproto.GetTransactionByIndexRequest,
 ) (*execproto.GetTransactionResultResponse, error) {
 	execRPCClient, closer, err := b.connFactory.GetExecutionAPIClient(execNode.Address)
@@ -1043,13 +996,13 @@ func (b *backendTransactions) tryGetTransactionResultByIndex(
 	return resp, nil
 }
 
-// lookupTransactionErrorMessage returns transaction error message for specified transaction.
+// LookupErrorMessageByTransactionID returns transaction error message for specified transaction.
 // If an error message for transaction can be found in the cache then it will be used to serve the request, otherwise
 // an RPC call will be made to the EN to fetch that error message, fetched value will be cached in the LRU cache.
 // Expected errors during normal operation:
 //   - InsufficientExecutionReceipts - found insufficient receipts for given block ID.
 //   - status.Error - remote GRPC call to EN has failed.
-func (b *backendTransactions) lookupTransactionErrorMessage(
+func (b *backendTransactions) LookupErrorMessageByTransactionID(
 	ctx context.Context,
 	blockID flow.Identifier,
 	transactionID flow.Identifier,
@@ -1090,19 +1043,20 @@ func (b *backendTransactions) lookupTransactionErrorMessage(
 	return value, nil
 }
 
-// lookupTransactionErrorMessageByIndex returns transaction error message for specified transaction using its index.
+// LookupErrorMessageByIndex returns transaction error message for specified transaction using its index.
 // If an error message for transaction can be found in cache then it will be used to serve the request, otherwise
 // an RPC call will be made to the EN to fetch that error message, fetched value will be cached in the LRU cache.
 // Expected errors during normal operation:
 //   - status.Error[codes.NotFound] - transaction result for given block ID and tx index is not available.
 //   - InsufficientExecutionReceipts - found insufficient receipts for given block ID.
 //   - status.Error - remote GRPC call to EN has failed.
-func (b *backendTransactions) lookupTransactionErrorMessageByIndex(
+func (b *backendTransactions) LookupErrorMessageByIndex(
 	ctx context.Context,
 	blockID flow.Identifier,
+	height uint64,
 	index uint32,
 ) (string, error) {
-	txResult, err := b.results.ByBlockIDTransactionIndex(blockID, index)
+	txResult, err := b.txResultsIndex.ByBlockIDTransactionIndex(blockID, height, index)
 	if err != nil {
 		return "", rpc.ConvertStorageError(err)
 	}
@@ -1143,17 +1097,18 @@ func (b *backendTransactions) lookupTransactionErrorMessageByIndex(
 	return value, nil
 }
 
-// lookupTransactionErrorMessagesByBlockID returns all error messages for failed transactions by blockID.
+// LookupErrorMessagesByBlockID returns all error messages for failed transactions by blockID.
 // An RPC call will be made to the EN to fetch missing errors messages, fetched value will be cached in the LRU cache.
 // Expected errors during normal operation:
 //   - status.Error[codes.NotFound] - transaction results for given block ID are not available.
 //   - InsufficientExecutionReceipts - found insufficient receipts for given block ID.
 //   - status.Error - remote GRPC call to EN has failed.
-func (b *backendTransactions) lookupTransactionErrorMessagesByBlockID(
+func (b *backendTransactions) LookupErrorMessagesByBlockID(
 	ctx context.Context,
 	blockID flow.Identifier,
+	height uint64,
 ) (map[flow.Identifier]string, error) {
-	txResults, err := b.results.ByBlockID(blockID)
+	txResults, err := b.txResultsIndex.ByBlockID(blockID, height)
 	if err != nil {
 		return nil, rpc.ConvertStorageError(err)
 	}
@@ -1212,7 +1167,7 @@ func (b *backendTransactions) lookupTransactionErrorMessagesByBlockID(
 //   - codes.Unavailable - remote node is not unavailable.
 func (b *backendTransactions) getTransactionErrorMessageFromAnyEN(
 	ctx context.Context,
-	execNodes flow.IdentityList,
+	execNodes flow.IdentitySkeletonList,
 	req *execproto.GetTransactionErrorMessageRequest,
 ) (*execproto.GetTransactionErrorMessageResponse, error) {
 	// if we were passed 0 execution nodes add a specific error
@@ -1223,7 +1178,7 @@ func (b *backendTransactions) getTransactionErrorMessageFromAnyEN(
 	var resp *execproto.GetTransactionErrorMessageResponse
 	errToReturn := b.nodeCommunicator.CallAvailableNode(
 		execNodes,
-		func(node *flow.Identity) error {
+		func(node *flow.IdentitySkeleton) error {
 			var err error
 			resp, err = b.tryGetTransactionErrorMessageFromEN(ctx, node, req)
 			if err == nil {
@@ -1255,7 +1210,7 @@ func (b *backendTransactions) getTransactionErrorMessageFromAnyEN(
 //   - codes.Unavailable - remote node is not unavailable.
 func (b *backendTransactions) getTransactionErrorMessageByIndexFromAnyEN(
 	ctx context.Context,
-	execNodes flow.IdentityList,
+	execNodes flow.IdentitySkeletonList,
 	req *execproto.GetTransactionErrorMessageByIndexRequest,
 ) (*execproto.GetTransactionErrorMessageResponse, error) {
 	// if we were passed 0 execution nodes add a specific error
@@ -1266,7 +1221,7 @@ func (b *backendTransactions) getTransactionErrorMessageByIndexFromAnyEN(
 	var resp *execproto.GetTransactionErrorMessageResponse
 	errToReturn := b.nodeCommunicator.CallAvailableNode(
 		execNodes,
-		func(node *flow.Identity) error {
+		func(node *flow.IdentitySkeleton) error {
 			var err error
 			resp, err = b.tryGetTransactionErrorMessageByIndexFromEN(ctx, node, req)
 			if err == nil {
@@ -1296,7 +1251,7 @@ func (b *backendTransactions) getTransactionErrorMessageByIndexFromAnyEN(
 //   - codes.Unavailable - remote node is not unavailable.
 func (b *backendTransactions) getTransactionErrorMessagesFromAnyEN(
 	ctx context.Context,
-	execNodes flow.IdentityList,
+	execNodes flow.IdentitySkeletonList,
 	req *execproto.GetTransactionErrorMessagesByBlockIDRequest,
 ) ([]*execproto.GetTransactionErrorMessagesResponse_Result, error) {
 	// if we were passed 0 execution nodes add a specific error
@@ -1307,7 +1262,7 @@ func (b *backendTransactions) getTransactionErrorMessagesFromAnyEN(
 	var resp *execproto.GetTransactionErrorMessagesResponse
 	errToReturn := b.nodeCommunicator.CallAvailableNode(
 		execNodes,
-		func(node *flow.Identity) error {
+		func(node *flow.IdentitySkeleton) error {
 			var err error
 			resp, err = b.tryGetTransactionErrorMessagesByBlockIDFromEN(ctx, node, req)
 			if err == nil {
@@ -1333,13 +1288,13 @@ func (b *backendTransactions) getTransactionErrorMessagesFromAnyEN(
 
 // Expected errors during normal operation:
 //   - status.Error - GRPC call failed, some of possible codes are:
-//      - codes.NotFound - request cannot be served by EN because of absence of data.
-//      - codes.Unavailable - remote node is not unavailable.
+//   - codes.NotFound - request cannot be served by EN because of absence of data.
+//   - codes.Unavailable - remote node is not unavailable.
+//
 // tryGetTransactionErrorMessageFromEN performs a grpc call to the specified execution node and returns response.
-
 func (b *backendTransactions) tryGetTransactionErrorMessageFromEN(
 	ctx context.Context,
-	execNode *flow.Identity,
+	execNode *flow.IdentitySkeleton,
 	req *execproto.GetTransactionErrorMessageRequest,
 ) (*execproto.GetTransactionErrorMessageResponse, error) {
 	execRPCClient, closer, err := b.connFactory.GetExecutionAPIClient(execNode.Address)
@@ -1357,7 +1312,7 @@ func (b *backendTransactions) tryGetTransactionErrorMessageFromEN(
 //   - codes.Unavailable - remote node is not unavailable.
 func (b *backendTransactions) tryGetTransactionErrorMessageByIndexFromEN(
 	ctx context.Context,
-	execNode *flow.Identity,
+	execNode *flow.IdentitySkeleton,
 	req *execproto.GetTransactionErrorMessageByIndexRequest,
 ) (*execproto.GetTransactionErrorMessageResponse, error) {
 	execRPCClient, closer, err := b.connFactory.GetExecutionAPIClient(execNode.Address)
@@ -1375,7 +1330,7 @@ func (b *backendTransactions) tryGetTransactionErrorMessageByIndexFromEN(
 //   - codes.Unavailable - remote node is not unavailable.
 func (b *backendTransactions) tryGetTransactionErrorMessagesByBlockIDFromEN(
 	ctx context.Context,
-	execNode *flow.Identity,
+	execNode *flow.IdentitySkeleton,
 	req *execproto.GetTransactionErrorMessagesByBlockIDRequest,
 ) (*execproto.GetTransactionErrorMessagesResponse, error) {
 	execRPCClient, closer, err := b.connFactory.GetExecutionAPIClient(execNode.Address)
diff --git a/engine/access/rpc/backend/backend_transactions_test.go b/engine/access/rpc/backend/backend_transactions_test.go
index ab553e0d4be..e379e905002 100644
--- a/engine/access/rpc/backend/backend_transactions_test.go
+++ b/engine/access/rpc/backend/backend_transactions_test.go
@@ -16,11 +16,13 @@ import (
 	"google.golang.org/grpc/status"
 
 	acc "github.com/onflow/flow-go/access"
+	"github.com/onflow/flow-go/engine/access/index"
 	connectionmock "github.com/onflow/flow-go/engine/access/rpc/connection/mock"
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
 	"github.com/onflow/flow-go/fvm/blueprints"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/flow/filter"
+	syncmock "github.com/onflow/flow-go/module/state_synchronization/mock"
 	"github.com/onflow/flow-go/state/protocol"
 	bprotocol "github.com/onflow/flow-go/state/protocol/badger"
 	"github.com/onflow/flow-go/state/protocol/util"
@@ -29,11 +31,13 @@ import (
 	"github.com/onflow/flow-go/utils/unittest/generator"
 )
 
+const expectedErrorMsg = "expected test error"
+
 func (suite *Suite) withPreConfiguredState(f func(snap protocol.Snapshot)) {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
-	util.RunWithFullProtocolState(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
-		epochBuilder := unittest.NewEpochBuilder(suite.T(), state)
+	util.RunWithFullProtocolStateAndMutator(suite.T(), rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState protocol.MutableProtocolState) {
+		epochBuilder := unittest.NewEpochBuilder(suite.T(), mutableState, state)
 
 		epochBuilder.
 			BuildEpoch().
@@ -58,7 +62,6 @@ func (suite *Suite) withPreConfiguredState(f func(snap protocol.Snapshot)) {
 
 		f(snap)
 	})
-
 }
 
 // TestGetTransactionResultReturnsUnknown returns unknown result when tx not found
@@ -129,7 +132,6 @@ func (suite *Suite) TestGetTransactionResultReturnsTransactionError() {
 			entities.EventEncodingVersion_JSON_CDC_V0,
 		)
 		suite.Require().Equal(err, status.Errorf(codes.Internal, "failed to find: %v", fmt.Errorf("some other error")))
-
 	})
 }
 
@@ -246,7 +248,6 @@ func (suite *Suite) TestGetTransactionResultFromCache() {
 // TestGetTransactionResultCacheNonExistent tests caches non existing result
 func (suite *Suite) TestGetTransactionResultCacheNonExistent() {
 	suite.withGetTransactionCachingTestSetup(func(block *flow.Block, tx *flow.Transaction) {
-
 		suite.historicalAccessClient.
 			On("GetTransactionResult", mock.AnythingOfType("*context.emptyCtx"), mock.AnythingOfType("*access.GetTransactionRequest")).
 			Return(nil, status.Errorf(codes.NotFound, "no known transaction with ID %s", tx.ID())).Once()
@@ -376,13 +377,13 @@ func (suite *Suite) TestLookupTransactionErrorMessage_HappyPath() {
 
 	suite.execClient.On("GetTransactionErrorMessage", mock.Anything, exeEventReq).Return(exeEventResp, nil).Once()
 
-	errMsg, err := backend.lookupTransactionErrorMessage(context.Background(), blockId, failedTxId)
+	errMsg, err := backend.LookupErrorMessageByTransactionID(context.Background(), blockId, failedTxId)
 	suite.Require().NoError(err)
 	suite.Require().Equal(expectedErrorMsg, errMsg)
 
 	// ensure the transaction error message is cached after retrieval; we do this by mocking the grpc call
 	// only once
-	errMsg, err = backend.lookupTransactionErrorMessage(context.Background(), blockId, failedTxId)
+	errMsg, err = backend.LookupErrorMessageByTransactionID(context.Background(), blockId, failedTxId)
 	suite.Require().NoError(err)
 	suite.Require().Equal(expectedErrorMsg, errMsg)
 	suite.assertAllExpectations()
@@ -416,7 +417,7 @@ func (suite *Suite) TestLookupTransactionErrorMessage_FailedToFetch() {
 	suite.execClient.On("GetTransactionErrorMessage", mock.Anything, mock.Anything).Return(nil,
 		status.Error(codes.Unavailable, "")).Twice()
 
-	errMsg, err := backend.lookupTransactionErrorMessage(context.Background(), blockId, failedTxId)
+	errMsg, err := backend.LookupErrorMessageByTransactionID(context.Background(), blockId, failedTxId)
 	suite.Require().Error(err)
 	suite.Require().Equal(codes.Unavailable, status.Code(err))
 	suite.Require().Empty(errMsg)
@@ -449,11 +450,21 @@ func (suite *Suite) TestLookupTransactionErrorMessageByIndex_HappyPath() {
 	connFactory := connectionmock.NewConnectionFactory(suite.T())
 	connFactory.On("GetExecutionAPIClient", mock.Anything).Return(suite.execClient, &mockCloser{}, nil)
 
+	// create a mock index reporter
+	reporter := syncmock.NewIndexReporter(suite.T())
+	reporter.On("LowestIndexedHeight").Return(block.Header.Height, nil)
+	reporter.On("HighestIndexedHeight").Return(block.Header.Height+10, nil)
+
 	params := suite.defaultBackendParams()
+
 	// the connection factory should be used to get the execution node client
 	params.ConnFactory = connFactory
 	params.FixedExecutionNodeIDs = fixedENIDs.NodeIDs().Strings()
 
+	params.TxResultsIndex = index.NewTransactionResultsIndex(suite.transactionResults)
+	err := params.TxResultsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
 	backend, err := New(params)
 	suite.Require().NoError(err)
 
@@ -471,13 +482,13 @@ func (suite *Suite) TestLookupTransactionErrorMessageByIndex_HappyPath() {
 
 	suite.execClient.On("GetTransactionErrorMessageByIndex", mock.Anything, exeEventReq).Return(exeEventResp, nil).Once()
 
-	errMsg, err := backend.lookupTransactionErrorMessageByIndex(context.Background(), blockId, failedTxIndex)
+	errMsg, err := backend.LookupErrorMessageByIndex(context.Background(), blockId, block.Header.Height, failedTxIndex)
 	suite.Require().NoError(err)
 	suite.Require().Equal(expectedErrorMsg, errMsg)
 
 	// ensure the transaction error message is cached after retrieval; we do this by mocking the grpc call
 	// only once
-	errMsg, err = backend.lookupTransactionErrorMessageByIndex(context.Background(), blockId, failedTxIndex)
+	errMsg, err = backend.LookupErrorMessageByIndex(context.Background(), blockId, block.Header.Height, failedTxIndex)
 	suite.Require().NoError(err)
 	suite.Require().Equal(expectedErrorMsg, errMsg)
 	suite.assertAllExpectations()
@@ -493,11 +504,21 @@ func (suite *Suite) TestLookupTransactionErrorMessageByIndex_UnknownTransaction(
 	suite.transactionResults.On("ByBlockIDTransactionIndex", blockId, failedTxIndex).
 		Return(nil, storage.ErrNotFound).Once()
 
+	// create a mock index reporter
+	reporter := syncmock.NewIndexReporter(suite.T())
+	reporter.On("LowestIndexedHeight").Return(block.Header.Height, nil)
+	reporter.On("HighestIndexedHeight").Return(block.Header.Height+10, nil)
+
 	params := suite.defaultBackendParams()
+
+	params.TxResultsIndex = index.NewTransactionResultsIndex(suite.transactionResults)
+	err := params.TxResultsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
 	backend, err := New(params)
 	suite.Require().NoError(err)
 
-	errMsg, err := backend.lookupTransactionErrorMessageByIndex(context.Background(), blockId, failedTxIndex)
+	errMsg, err := backend.LookupErrorMessageByIndex(context.Background(), blockId, block.Header.Height, failedTxIndex)
 	suite.Require().Error(err)
 	suite.Require().Equal(codes.NotFound, status.Code(err))
 	suite.Require().Empty(errMsg)
@@ -529,11 +550,20 @@ func (suite *Suite) TestLookupTransactionErrorMessageByIndex_FailedToFetch() {
 	connFactory := connectionmock.NewConnectionFactory(suite.T())
 	connFactory.On("GetExecutionAPIClient", mock.Anything).Return(suite.execClient, &mockCloser{}, nil)
 
+	// create a mock index reporter
+	reporter := syncmock.NewIndexReporter(suite.T())
+	reporter.On("LowestIndexedHeight").Return(block.Header.Height, nil)
+	reporter.On("HighestIndexedHeight").Return(block.Header.Height+10, nil)
+
 	params := suite.defaultBackendParams()
 	// the connection factory should be used to get the execution node client
 	params.ConnFactory = connFactory
 	params.FixedExecutionNodeIDs = fixedENIDs.NodeIDs().Strings()
 
+	params.TxResultsIndex = index.NewTransactionResultsIndex(suite.transactionResults)
+	err := params.TxResultsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
 	backend, err := New(params)
 	suite.Require().NoError(err)
 
@@ -541,7 +571,7 @@ func (suite *Suite) TestLookupTransactionErrorMessageByIndex_FailedToFetch() {
 	suite.execClient.On("GetTransactionErrorMessageByIndex", mock.Anything, mock.Anything).Return(nil,
 		status.Error(codes.Unavailable, "")).Twice()
 
-	errMsg, err := backend.lookupTransactionErrorMessageByIndex(context.Background(), blockId, failedTxIndex)
+	errMsg, err := backend.LookupErrorMessageByIndex(context.Background(), blockId, block.Header.Height, failedTxIndex)
 	suite.Require().Error(err)
 	suite.Require().Equal(codes.Unavailable, status.Code(err))
 	suite.Require().Empty(errMsg)
@@ -576,11 +606,21 @@ func (suite *Suite) TestLookupTransactionErrorMessages_HappyPath() {
 	connFactory := connectionmock.NewConnectionFactory(suite.T())
 	connFactory.On("GetExecutionAPIClient", mock.Anything).Return(suite.execClient, &mockCloser{}, nil)
 
+	// create a mock index reporter
+	reporter := syncmock.NewIndexReporter(suite.T())
+	reporter.On("LowestIndexedHeight").Return(block.Header.Height, nil)
+	reporter.On("HighestIndexedHeight").Return(block.Header.Height+10, nil)
+
 	params := suite.defaultBackendParams()
+
 	// the connection factory should be used to get the execution node client
 	params.ConnFactory = connFactory
 	params.FixedExecutionNodeIDs = fixedENIDs.NodeIDs().Strings()
 
+	params.TxResultsIndex = index.NewTransactionResultsIndex(suite.transactionResults)
+	err := params.TxResultsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
 	backend, err := New(params)
 	suite.Require().NoError(err)
 
@@ -606,7 +646,7 @@ func (suite *Suite) TestLookupTransactionErrorMessages_HappyPath() {
 		Return(exeEventResp, nil).
 		Once()
 
-	errMessages, err := backend.lookupTransactionErrorMessagesByBlockID(context.Background(), blockId)
+	errMessages, err := backend.LookupErrorMessagesByBlockID(context.Background(), blockId, block.Header.Height)
 	suite.Require().NoError(err)
 	suite.Require().Len(errMessages, len(exeEventResp.Results))
 	for _, expectedResult := range exeEventResp.Results {
@@ -617,7 +657,7 @@ func (suite *Suite) TestLookupTransactionErrorMessages_HappyPath() {
 
 	// ensure the transaction error message is cached after retrieval; we do this by mocking the grpc call
 	// only once
-	errMessages, err = backend.lookupTransactionErrorMessagesByBlockID(context.Background(), blockId)
+	errMessages, err = backend.LookupErrorMessagesByBlockID(context.Background(), blockId, block.Header.Height)
 	suite.Require().NoError(err)
 	suite.Require().Len(errMessages, len(exeEventResp.Results))
 	for _, expectedResult := range exeEventResp.Results {
@@ -650,12 +690,21 @@ func (suite *Suite) TestLookupTransactionErrorMessages_HappyPath_NoFailedTxns()
 	suite.transactionResults.On("ByBlockID", blockId).
 		Return(resultsByBlockID, nil).Once()
 
+	// create a mock index reporter
+	reporter := syncmock.NewIndexReporter(suite.T())
+	reporter.On("LowestIndexedHeight").Return(block.Header.Height, nil)
+	reporter.On("HighestIndexedHeight").Return(block.Header.Height+10, nil)
+
 	params := suite.defaultBackendParams()
 
+	params.TxResultsIndex = index.NewTransactionResultsIndex(suite.transactionResults)
+	err := params.TxResultsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
 	backend, err := New(params)
 	suite.Require().NoError(err)
 
-	errMessages, err := backend.lookupTransactionErrorMessagesByBlockID(context.Background(), blockId)
+	errMessages, err := backend.LookupErrorMessagesByBlockID(context.Background(), blockId, block.Header.Height)
 	suite.Require().NoError(err)
 	suite.Require().Empty(errMessages)
 	suite.assertAllExpectations()
@@ -670,11 +719,21 @@ func (suite *Suite) TestLookupTransactionErrorMessages_UnknownTransaction() {
 	suite.transactionResults.On("ByBlockID", blockId).
 		Return(nil, storage.ErrNotFound).Once()
 
+	// create a mock index reporter
+	reporter := syncmock.NewIndexReporter(suite.T())
+	reporter.On("LowestIndexedHeight").Return(block.Header.Height, nil)
+	reporter.On("HighestIndexedHeight").Return(block.Header.Height+10, nil)
+
 	params := suite.defaultBackendParams()
+
+	params.TxResultsIndex = index.NewTransactionResultsIndex(suite.transactionResults)
+	err := params.TxResultsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
 	backend, err := New(params)
 	suite.Require().NoError(err)
 
-	errMsg, err := backend.lookupTransactionErrorMessagesByBlockID(context.Background(), blockId)
+	errMsg, err := backend.LookupErrorMessagesByBlockID(context.Background(), blockId, block.Header.Height)
 	suite.Require().Error(err)
 	suite.Require().Equal(codes.NotFound, status.Code(err))
 	suite.Require().Empty(errMsg)
@@ -712,11 +771,20 @@ func (suite *Suite) TestLookupTransactionErrorMessages_FailedToFetch() {
 	connFactory := connectionmock.NewConnectionFactory(suite.T())
 	connFactory.On("GetExecutionAPIClient", mock.Anything).Return(suite.execClient, &mockCloser{}, nil)
 
+	// create a mock index reporter
+	reporter := syncmock.NewIndexReporter(suite.T())
+	reporter.On("LowestIndexedHeight").Return(block.Header.Height, nil)
+	reporter.On("HighestIndexedHeight").Return(block.Header.Height+10, nil)
+
 	params := suite.defaultBackendParams()
 	// the connection factory should be used to get the execution node client
 	params.ConnFactory = connFactory
 	params.FixedExecutionNodeIDs = fixedENIDs.NodeIDs().Strings()
 
+	params.TxResultsIndex = index.NewTransactionResultsIndex(suite.transactionResults)
+	err := params.TxResultsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
 	backend, err := New(params)
 	suite.Require().NoError(err)
 
@@ -726,7 +794,7 @@ func (suite *Suite) TestLookupTransactionErrorMessages_FailedToFetch() {
 	suite.execClient.On("GetTransactionErrorMessagesByBlockID", mock.Anything, mock.Anything).Return(nil,
 		status.Error(codes.Unavailable, "")).Twice()
 
-	errMsg, err := backend.lookupTransactionErrorMessagesByBlockID(context.Background(), blockId)
+	errMsg, err := backend.LookupErrorMessagesByBlockID(context.Background(), blockId, block.Header.Height)
 	suite.Require().Error(err)
 	suite.Require().Equal(codes.Unavailable, status.Code(err))
 	suite.Require().Empty(errMsg)
@@ -956,3 +1024,329 @@ func (suite *Suite) TestGetSystemTransactionResult_FailedEncodingConversion() {
 			fmt.Errorf("conversion from format JSON_CDC_V0 to CCF_V0 is not supported")))
 	})
 }
+
+func (suite *Suite) assertTransactionResultResponse(
+	err error,
+	response *acc.TransactionResult,
+	block flow.Block,
+	txId flow.Identifier,
+	txFailed bool,
+	eventsForTx []flow.Event,
+) {
+	suite.Require().NoError(err)
+	suite.Assert().Equal(block.ID(), response.BlockID)
+	suite.Assert().Equal(block.Header.Height, response.BlockHeight)
+	suite.Assert().Equal(txId, response.TransactionID)
+	if txId == suite.systemTx.ID() {
+		suite.Assert().Equal(flow.ZeroID, response.CollectionID)
+	} else {
+		suite.Assert().Equal(block.Payload.Guarantees[0].CollectionID, response.CollectionID)
+	}
+	suite.Assert().Equal(len(eventsForTx), len(response.Events))
+	// When there are error messages occurred in the transaction, the status should be 1
+	if txFailed {
+		suite.Assert().Equal(uint(1), response.StatusCode)
+		suite.Assert().Equal(expectedErrorMsg, response.ErrorMessage)
+	} else {
+		suite.Assert().Equal(uint(0), response.StatusCode)
+		suite.Assert().Equal("", response.ErrorMessage)
+	}
+	suite.Assert().Equal(flow.TransactionStatusSealed, response.Status)
+}
+
+// TestTransactionResultFromStorage tests the retrieval of a transaction result (flow.TransactionResult) from storage
+// instead of requesting it from the Execution Node.
+func (suite *Suite) TestTransactionResultFromStorage() {
+	// Create fixtures for block, transaction, and collection
+	block := unittest.BlockFixture()
+	transaction := unittest.TransactionFixture()
+	col := flow.CollectionFromTransactions([]*flow.Transaction{&transaction})
+	guarantee := col.Guarantee()
+	block.SetPayload(unittest.PayloadFixture(unittest.WithGuarantees(&guarantee)))
+	txId := transaction.ID()
+	blockId := block.ID()
+
+	// Mock the behavior of the blocks and transactionResults objects
+	suite.blocks.
+		On("ByID", blockId).
+		Return(&block, nil)
+
+	suite.transactionResults.On("ByBlockIDTransactionID", blockId, txId).
+		Return(&flow.LightTransactionResult{
+			TransactionID:   txId,
+			Failed:          true,
+			ComputationUsed: 0,
+		}, nil)
+
+	suite.transactions.
+		On("ByID", txId).
+		Return(&transaction.TransactionBody, nil)
+
+	// Set up the light collection and mock the behavior of the collections object
+	lightCol := col.Light()
+	suite.collections.On("LightByID", col.ID()).Return(&lightCol, nil)
+
+	// Set up the events storage mock
+	totalEvents := 5
+	eventsForTx := unittest.EventsFixture(totalEvents, flow.EventAccountCreated)
+	eventMessages := make([]*entities.Event, totalEvents)
+	for j, event := range eventsForTx {
+		eventMessages[j] = convert.EventToMessage(event)
+	}
+
+	// expect a call to lookup events by block ID and transaction ID
+	suite.events.On("ByBlockIDTransactionID", blockId, txId).Return(eventsForTx, nil)
+
+	// Set up the state and snapshot mocks
+	_, fixedENIDs := suite.setupReceipts(&block)
+	suite.state.On("Final").Return(suite.snapshot, nil).Maybe()
+	suite.state.On("Sealed").Return(suite.snapshot, nil).Maybe()
+	suite.snapshot.On("Identities", mock.Anything).Return(fixedENIDs, nil)
+	suite.snapshot.On("Head", mock.Anything).Return(block.Header, nil)
+
+	// create a mock connection factory
+	connFactory := connectionmock.NewConnectionFactory(suite.T())
+	connFactory.On("GetExecutionAPIClient", mock.Anything).Return(suite.execClient, &mockCloser{}, nil)
+
+	// create a mock index reporter
+	reporter := syncmock.NewIndexReporter(suite.T())
+	reporter.On("LowestIndexedHeight").Return(block.Header.Height, nil)
+	reporter.On("HighestIndexedHeight").Return(block.Header.Height+10, nil)
+
+	// Set up the backend parameters and the backend instance
+	params := suite.defaultBackendParams()
+	// the connection factory should be used to get the execution node client
+	params.ConnFactory = connFactory
+	params.FixedExecutionNodeIDs = fixedENIDs.NodeIDs().Strings()
+	params.TxResultQueryMode = IndexQueryModeLocalOnly
+
+	params.EventsIndex = index.NewEventsIndex(suite.events)
+	err := params.EventsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
+	params.TxResultsIndex = index.NewTransactionResultsIndex(suite.transactionResults)
+	err = params.TxResultsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
+	backend, err := New(params)
+	suite.Require().NoError(err)
+
+	// Set up the expected error message for the execution node response
+
+	exeEventReq := &execproto.GetTransactionErrorMessageRequest{
+		BlockId:       blockId[:],
+		TransactionId: txId[:],
+	}
+
+	exeEventResp := &execproto.GetTransactionErrorMessageResponse{
+		TransactionId: txId[:],
+		ErrorMessage:  expectedErrorMsg,
+	}
+
+	suite.execClient.On("GetTransactionErrorMessage", mock.Anything, exeEventReq).Return(exeEventResp, nil).Once()
+
+	response, err := backend.GetTransactionResult(context.Background(), txId, blockId, flow.ZeroID, entities.EventEncodingVersion_JSON_CDC_V0)
+	suite.assertTransactionResultResponse(err, response, block, txId, true, eventsForTx)
+}
+
+// TestTransactionByIndexFromStorage tests the retrieval of a transaction result (flow.TransactionResult) by index
+// and returns it from storage instead of requesting from the Execution Node.
+func (suite *Suite) TestTransactionByIndexFromStorage() {
+	// Create fixtures for block, transaction, and collection
+	block := unittest.BlockFixture()
+	transaction := unittest.TransactionFixture()
+	col := flow.CollectionFromTransactions([]*flow.Transaction{&transaction})
+	guarantee := col.Guarantee()
+	block.SetPayload(unittest.PayloadFixture(unittest.WithGuarantees(&guarantee)))
+	blockId := block.ID()
+	txId := transaction.ID()
+	txIndex := rand.Uint32()
+
+	// Set up the light collection and mock the behavior of the collections object
+	lightCol := col.Light()
+	suite.collections.On("LightByID", col.ID()).Return(&lightCol, nil)
+
+	// Mock the behavior of the blocks and transactionResults objects
+	suite.blocks.
+		On("ByID", blockId).
+		Return(&block, nil)
+
+	suite.transactionResults.On("ByBlockIDTransactionIndex", blockId, txIndex).
+		Return(&flow.LightTransactionResult{
+			TransactionID:   txId,
+			Failed:          true,
+			ComputationUsed: 0,
+		}, nil)
+
+	// Set up the events storage mock
+	totalEvents := 5
+	eventsForTx := unittest.EventsFixture(totalEvents, flow.EventAccountCreated)
+	eventMessages := make([]*entities.Event, totalEvents)
+	for j, event := range eventsForTx {
+		eventMessages[j] = convert.EventToMessage(event)
+	}
+
+	// expect a call to lookup events by block ID and transaction ID
+	suite.events.On("ByBlockIDTransactionIndex", blockId, txIndex).Return(eventsForTx, nil)
+
+	// Set up the state and snapshot mocks
+	_, fixedENIDs := suite.setupReceipts(&block)
+	suite.state.On("Final").Return(suite.snapshot, nil).Maybe()
+	suite.state.On("Sealed").Return(suite.snapshot, nil).Maybe()
+	suite.snapshot.On("Identities", mock.Anything).Return(fixedENIDs, nil)
+	suite.snapshot.On("Head", mock.Anything).Return(block.Header, nil)
+
+	// Create a mock connection factory
+	connFactory := connectionmock.NewConnectionFactory(suite.T())
+	connFactory.On("GetExecutionAPIClient", mock.Anything).Return(suite.execClient, &mockCloser{}, nil)
+
+	// create a mock index reporter
+	reporter := syncmock.NewIndexReporter(suite.T())
+	reporter.On("LowestIndexedHeight").Return(block.Header.Height, nil)
+	reporter.On("HighestIndexedHeight").Return(block.Header.Height+10, nil)
+
+	// Set up the backend parameters and the backend instance
+	params := suite.defaultBackendParams()
+	// the connection factory should be used to get the execution node client
+	params.ConnFactory = connFactory
+	params.FixedExecutionNodeIDs = fixedENIDs.NodeIDs().Strings()
+	params.TxResultQueryMode = IndexQueryModeLocalOnly
+
+	params.EventsIndex = index.NewEventsIndex(suite.events)
+	err := params.EventsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
+	params.TxResultsIndex = index.NewTransactionResultsIndex(suite.transactionResults)
+	err = params.TxResultsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
+	backend, err := New(params)
+	suite.Require().NoError(err)
+
+	// Set up the expected error message for the execution node response
+	exeEventReq := &execproto.GetTransactionErrorMessageByIndexRequest{
+		BlockId: blockId[:],
+		Index:   txIndex,
+	}
+
+	exeEventResp := &execproto.GetTransactionErrorMessageResponse{
+		TransactionId: txId[:],
+		ErrorMessage:  expectedErrorMsg,
+	}
+
+	suite.execClient.On("GetTransactionErrorMessageByIndex", mock.Anything, exeEventReq).Return(exeEventResp, nil).Once()
+
+	response, err := backend.GetTransactionResultByIndex(context.Background(), blockId, txIndex, entities.EventEncodingVersion_JSON_CDC_V0)
+	suite.assertTransactionResultResponse(err, response, block, txId, true, eventsForTx)
+}
+
+// TestTransactionResultsByBlockIDFromStorage tests the retrieval of transaction results ([]flow.TransactionResult)
+// by block ID from storage instead of requesting from the Execution Node.
+func (suite *Suite) TestTransactionResultsByBlockIDFromStorage() {
+	// Create fixtures for the block and collection
+	block := unittest.BlockFixture()
+	col := unittest.CollectionFixture(2)
+	guarantee := col.Guarantee()
+	block.SetPayload(unittest.PayloadFixture(unittest.WithGuarantees(&guarantee)))
+	blockId := block.ID()
+
+	// Mock the behavior of the blocks, collections and light transaction results objects
+	suite.blocks.
+		On("ByID", blockId).
+		Return(&block, nil)
+	lightCol := col.Light()
+	suite.collections.On("LightByID", mock.Anything).Return(&lightCol, nil)
+
+	lightTxResults := make([]flow.LightTransactionResult, len(lightCol.Transactions))
+	for i, txID := range lightCol.Transactions {
+		lightTxResults[i] = flow.LightTransactionResult{
+			TransactionID:   txID,
+			Failed:          false,
+			ComputationUsed: 0,
+		}
+	}
+	// simulate the system tx
+	lightTxResults = append(lightTxResults, flow.LightTransactionResult{
+		TransactionID:   suite.systemTx.ID(),
+		Failed:          false,
+		ComputationUsed: 10,
+	})
+
+	// Mark the first transaction as failed
+	lightTxResults[0].Failed = true
+	suite.transactionResults.On("ByBlockID", blockId).Return(lightTxResults, nil)
+
+	// Set up the events storage mock
+	totalEvents := 5
+	eventsForTx := unittest.EventsFixture(totalEvents, flow.EventAccountCreated)
+	eventMessages := make([]*entities.Event, totalEvents)
+	for j, event := range eventsForTx {
+		eventMessages[j] = convert.EventToMessage(event)
+	}
+
+	// expect a call to lookup events by block ID and transaction ID
+	suite.events.On("ByBlockIDTransactionID", blockId, mock.Anything).Return(eventsForTx, nil)
+
+	// Set up the state and snapshot mocks
+	_, fixedENIDs := suite.setupReceipts(&block)
+	suite.state.On("Final").Return(suite.snapshot, nil).Maybe()
+	suite.state.On("Sealed").Return(suite.snapshot, nil).Maybe()
+	suite.snapshot.On("Identities", mock.Anything).Return(fixedENIDs, nil)
+	suite.snapshot.On("Head", mock.Anything).Return(block.Header, nil)
+
+	// create a mock connection factory
+	connFactory := connectionmock.NewConnectionFactory(suite.T())
+	connFactory.On("GetExecutionAPIClient", mock.Anything).Return(suite.execClient, &mockCloser{}, nil)
+
+	// create a mock index reporter
+	reporter := syncmock.NewIndexReporter(suite.T())
+	reporter.On("LowestIndexedHeight").Return(block.Header.Height, nil)
+	reporter.On("HighestIndexedHeight").Return(block.Header.Height+10, nil)
+
+	// Set up the state and snapshot mocks and the backend instance
+	params := suite.defaultBackendParams()
+	// the connection factory should be used to get the execution node client
+	params.ConnFactory = connFactory
+	params.FixedExecutionNodeIDs = fixedENIDs.NodeIDs().Strings()
+
+	params.EventsIndex = index.NewEventsIndex(suite.events)
+	err := params.EventsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
+	params.TxResultsIndex = index.NewTransactionResultsIndex(suite.transactionResults)
+	err = params.TxResultsIndex.Initialize(reporter)
+	suite.Require().NoError(err)
+
+	params.TxResultQueryMode = IndexQueryModeLocalOnly
+
+	backend, err := New(params)
+	suite.Require().NoError(err)
+
+	// Set up the expected error message for the execution node response
+	exeEventReq := &execproto.GetTransactionErrorMessagesByBlockIDRequest{
+		BlockId: blockId[:],
+	}
+
+	res := &execproto.GetTransactionErrorMessagesResponse_Result{
+		TransactionId: lightTxResults[0].TransactionID[:],
+		ErrorMessage:  expectedErrorMsg,
+		Index:         1,
+	}
+	exeEventResp := &execproto.GetTransactionErrorMessagesResponse{
+		Results: []*execproto.GetTransactionErrorMessagesResponse_Result{
+			res,
+		},
+	}
+
+	suite.execClient.On("GetTransactionErrorMessagesByBlockID", mock.Anything, exeEventReq).Return(exeEventResp, nil).Once()
+
+	response, err := backend.GetTransactionResultsByBlockID(context.Background(), blockId, entities.EventEncodingVersion_JSON_CDC_V0)
+	suite.Require().NoError(err)
+	suite.Assert().Equal(len(lightTxResults), len(response))
+
+	// Assertions for each transaction result in the response
+	for i, responseResult := range response {
+		lightTx := lightTxResults[i]
+		suite.assertTransactionResultResponse(err, responseResult, block, lightTx.TransactionID, lightTx.Failed, eventsForTx)
+	}
+}
diff --git a/engine/access/rpc/backend/config.go b/engine/access/rpc/backend/config.go
index 2cdbe3bb8cc..086af0035a7 100644
--- a/engine/access/rpc/backend/config.go
+++ b/engine/access/rpc/backend/config.go
@@ -18,6 +18,7 @@ type Config struct {
 	CircuitBreakerConfig      connection.CircuitBreakerConfig // the configuration for circuit breaker
 	ScriptExecutionMode       string                          // the mode in which scripts are executed
 	EventQueryMode            string                          // the mode in which events are queried
+	TxResultQueryMode         string                          // the mode in which tx results are queried
 }
 
 type IndexQueryMode int
diff --git a/engine/access/rpc/backend/errors.go b/engine/access/rpc/backend/errors.go
index 38a9f84aec7..4752c6563ce 100644
--- a/engine/access/rpc/backend/errors.go
+++ b/engine/access/rpc/backend/errors.go
@@ -7,10 +7,6 @@ import (
 	"github.com/onflow/flow-go/model/flow"
 )
 
-// ErrSnapshotPhaseMismatch indicates that a valid sealing segment cannot be build for a snapshot because
-// the snapshot requested spans either an epoch transition or phase transition.
-var ErrSnapshotPhaseMismatch = errors.New("snapshot does not contain a valid sealing segment")
-
 // InsufficientExecutionReceipts indicates that no execution receipt were found for a given block ID
 type InsufficientExecutionReceipts struct {
 	blockID      flow.Identifier
diff --git a/engine/access/rpc/backend/mock/communicator.go b/engine/access/rpc/backend/mock/communicator.go
index ab7498ac8f8..5544bd426ef 100644
--- a/engine/access/rpc/backend/mock/communicator.go
+++ b/engine/access/rpc/backend/mock/communicator.go
@@ -13,11 +13,11 @@ type Communicator struct {
 }
 
 // CallAvailableNode provides a mock function with given fields: nodes, call, shouldTerminateOnError
-func (_m *Communicator) CallAvailableNode(nodes flow.IdentityList, call func(*flow.Identity) error, shouldTerminateOnError func(*flow.Identity, error) bool) error {
+func (_m *Communicator) CallAvailableNode(nodes flow.GenericIdentityList[flow.IdentitySkeleton], call func(*flow.IdentitySkeleton) error, shouldTerminateOnError func(*flow.IdentitySkeleton, error) bool) error {
 	ret := _m.Called(nodes, call, shouldTerminateOnError)
 
 	var r0 error
-	if rf, ok := ret.Get(0).(func(flow.IdentityList, func(*flow.Identity) error, func(*flow.Identity, error) bool) error); ok {
+	if rf, ok := ret.Get(0).(func(flow.GenericIdentityList[flow.IdentitySkeleton], func(*flow.IdentitySkeleton) error, func(*flow.IdentitySkeleton, error) bool) error); ok {
 		r0 = rf(nodes, call, shouldTerminateOnError)
 	} else {
 		r0 = ret.Error(0)
diff --git a/engine/access/rpc/backend/node_communicator.go b/engine/access/rpc/backend/node_communicator.go
index d8177a6a176..34b75dddab0 100644
--- a/engine/access/rpc/backend/node_communicator.go
+++ b/engine/access/rpc/backend/node_communicator.go
@@ -15,13 +15,13 @@ const maxFailedRequestCount = 3
 type Communicator interface {
 	CallAvailableNode(
 		//List of node identifiers to execute callback on
-		nodes flow.IdentityList,
+		nodes flow.IdentitySkeletonList,
 		//Callback function that represents an action to be performed on a node.
 		//It takes a node as input and returns an error indicating the result of the action.
-		call func(node *flow.Identity) error,
+		call func(node *flow.IdentitySkeleton) error,
 		// Callback function that determines whether an error should terminate further execution.
 		// It takes an error as input and returns a boolean value indicating whether the error should be considered terminal.
-		shouldTerminateOnError func(node *flow.Identity, err error) bool,
+		shouldTerminateOnError func(node *flow.IdentitySkeleton, err error) bool,
 	) error
 }
 
@@ -46,13 +46,13 @@ func NewNodeCommunicator(circuitBreakerEnabled bool) *NodeCommunicator {
 // If the maximum failed request count is reached, it returns the accumulated errors.
 func (b *NodeCommunicator) CallAvailableNode(
 	//List of node identifiers to execute callback on
-	nodes flow.IdentityList,
+	nodes flow.IdentitySkeletonList,
 	//Callback function that determines whether an error should terminate further execution.
 	// It takes an error as input and returns a boolean value indicating whether the error should be considered terminal.
-	call func(id *flow.Identity) error,
+	call func(id *flow.IdentitySkeleton) error,
 	// Callback function that determines whether an error should terminate further execution.
 	// It takes an error as input and returns a boolean value indicating whether the error should be considered terminal.
-	shouldTerminateOnError func(node *flow.Identity, err error) bool,
+	shouldTerminateOnError func(node *flow.IdentitySkeleton, err error) bool,
 ) error {
 	var errs *multierror.Error
 	nodeSelector, err := b.nodeSelectorFactory.SelectNodes(nodes)
diff --git a/engine/access/rpc/backend/node_selector.go b/engine/access/rpc/backend/node_selector.go
index f90f8271b2d..c7d2ada5fb4 100644
--- a/engine/access/rpc/backend/node_selector.go
+++ b/engine/access/rpc/backend/node_selector.go
@@ -14,7 +14,7 @@ const maxNodesCnt = 3
 // of nodes. Implementations of this interface should define the Next method, which returns the next node identity to be
 // selected. HasNext checks if there is next node available.
 type NodeSelector interface {
-	Next() *flow.Identity
+	Next() *flow.IdentitySkeleton
 	HasNext() bool
 }
 
@@ -28,7 +28,7 @@ type NodeSelectorFactory struct {
 
 // SelectNodes selects the configured number of node identities from the provided list of nodes
 // and returns the node selector to iterate through them.
-func (n *NodeSelectorFactory) SelectNodes(nodes flow.IdentityList) (NodeSelector, error) {
+func (n *NodeSelectorFactory) SelectNodes(nodes flow.IdentitySkeletonList) (NodeSelector, error) {
 	var err error
 	// If the circuit breaker is disabled, the legacy logic should be used, which selects only a specified number of nodes.
 	if !n.circuitBreakerEnabled {
@@ -44,13 +44,13 @@ func (n *NodeSelectorFactory) SelectNodes(nodes flow.IdentityList) (NodeSelector
 // MainNodeSelector is a specific implementation of the node selector.
 // Which performs in-order node selection using fixed list of pre-defined nodes.
 type MainNodeSelector struct {
-	nodes flow.IdentityList
+	nodes flow.IdentitySkeletonList
 	index int
 }
 
 var _ NodeSelector = (*MainNodeSelector)(nil)
 
-func NewMainNodeSelector(nodes flow.IdentityList) *MainNodeSelector {
+func NewMainNodeSelector(nodes flow.IdentitySkeletonList) *MainNodeSelector {
 	return &MainNodeSelector{nodes: nodes, index: 0}
 }
 
@@ -60,7 +60,7 @@ func (e *MainNodeSelector) HasNext() bool {
 }
 
 // Next returns the next node in the selector.
-func (e *MainNodeSelector) Next() *flow.Identity {
+func (e *MainNodeSelector) Next() *flow.IdentitySkeleton {
 	if e.index < len(e.nodes) {
 		next := e.nodes[e.index]
 		e.index++
diff --git a/engine/access/rpc/backend/retry.go b/engine/access/rpc/backend/retry.go
index bd6e6744ae9..27697319a14 100644
--- a/engine/access/rpc/backend/retry.go
+++ b/engine/access/rpc/backend/retry.go
@@ -121,7 +121,13 @@ func (r *Retry) retryTxsAtHeight(heightToRetry uint64) error {
 		}
 
 		// find the transaction status
-		status, err := r.backend.deriveTransactionStatus(tx, false, block)
+		var status flow.TransactionStatus
+		if block == nil {
+			status, err = r.backend.DeriveUnknownTransactionStatus(tx.ReferenceBlockID)
+		} else {
+			status, err = r.backend.DeriveTransactionStatus(block.ID(), block.Header.Height, false)
+		}
+
 		if err != nil {
 			if !errors.Is(err, state.ErrUnknownSnapshotReference) {
 				return err
diff --git a/engine/access/rpc/backend/script_executor.go b/engine/access/rpc/backend/script_executor.go
index 12d64a0daa9..f38fdbcc8e8 100644
--- a/engine/access/rpc/backend/script_executor.go
+++ b/engine/access/rpc/backend/script_executor.go
@@ -2,16 +2,20 @@ package backend
 
 import (
 	"context"
-	"sync"
+	"fmt"
 
+	"github.com/rs/zerolog"
 	"go.uber.org/atomic"
 
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/execution"
 	"github.com/onflow/flow-go/module/state_synchronization"
+	"github.com/onflow/flow-go/storage"
 )
 
 type ScriptExecutor struct {
+	log zerolog.Logger
+
 	// scriptExecutor is used to interact with execution state
 	scriptExecutor *execution.Scripts
 
@@ -21,36 +25,64 @@ type ScriptExecutor struct {
 	// initialized is used to signal that the index and executor are ready
 	initialized *atomic.Bool
 
-	// init is used to ensure that the object is initialized only once
-	init sync.Once
+	// minCompatibleHeight and maxCompatibleHeight are used to limit the block range that can be queried using local execution
+	// to ensure only blocks that are compatible with the node's current software version are allowed.
+	// Note: this is a temporary solution for cadence/fvm upgrades while version beacon support is added
+	minCompatibleHeight *atomic.Uint64
+	maxCompatibleHeight *atomic.Uint64
 }
 
-func NewScriptExecutor() *ScriptExecutor {
+func NewScriptExecutor(log zerolog.Logger, minHeight, maxHeight uint64) *ScriptExecutor {
+	logger := log.With().Str("component", "script-executor").Logger()
+	logger.Info().
+		Uint64("min_height", minHeight).
+		Uint64("max_height", maxHeight).
+		Msg("script executor created")
+
 	return &ScriptExecutor{
-		initialized: atomic.NewBool(false),
+		log:                 logger,
+		initialized:         atomic.NewBool(false),
+		minCompatibleHeight: atomic.NewUint64(minHeight),
+		maxCompatibleHeight: atomic.NewUint64(maxHeight),
 	}
 }
 
-// InitReporter initializes the indexReporter and script executor
+// SetMinCompatibleHeight sets the lowest block height (inclusive) that can be queried using local execution
+// Use this to limit the executable block range supported by the node's current software version.
+func (s *ScriptExecutor) SetMinCompatibleHeight(height uint64) {
+	s.minCompatibleHeight.Store(height)
+	s.log.Info().Uint64("height", height).Msg("minimum compatible height set")
+}
+
+// SetMaxCompatibleHeight sets the highest block height (inclusive) that can be queried using local execution
+// Use this to limit the executable block range supported by the node's current software version.
+func (s *ScriptExecutor) SetMaxCompatibleHeight(height uint64) {
+	s.maxCompatibleHeight.Store(height)
+	s.log.Info().Uint64("height", height).Msg("maximum compatible height set")
+}
+
+// Initialize initializes the indexReporter and script executor
 // This method can be called at any time after the ScriptExecutor object is created. Any requests
-// made to the other methods will return execution.ErrDataNotAvailable until this method is called.
-func (s *ScriptExecutor) InitReporter(indexReporter state_synchronization.IndexReporter, scriptExecutor *execution.Scripts) {
-	s.init.Do(func() {
-		defer s.initialized.Store(true)
+// made to the other methods will return storage.ErrHeightNotIndexed until this method is called.
+func (s *ScriptExecutor) Initialize(indexReporter state_synchronization.IndexReporter, scriptExecutor *execution.Scripts) error {
+	if s.initialized.CompareAndSwap(false, true) {
+		s.log.Info().Msg("script executor initialized")
 		s.indexReporter = indexReporter
 		s.scriptExecutor = scriptExecutor
-	})
+		return nil
+	}
+	return fmt.Errorf("script executor already initialized")
 }
 
 // ExecuteAtBlockHeight executes provided script at the provided block height against a local execution state.
 //
 // Expected errors:
 //   - storage.ErrNotFound if the register or block height is not found
-//   - execution.ErrDataNotAvailable if the data for the block height is not available. this could be because
+//   - storage.ErrHeightNotIndexed if the data for the block height is not available. this could be because
 //     the height is not within the index block range, or the index is not ready.
 func (s *ScriptExecutor) ExecuteAtBlockHeight(ctx context.Context, script []byte, arguments [][]byte, height uint64) ([]byte, error) {
-	if !s.isDataAvailable(height) {
-		return nil, execution.ErrDataNotAvailable
+	if err := s.checkDataAvailable(height); err != nil {
+		return nil, err
 	}
 
 	return s.scriptExecutor.ExecuteAtBlockHeight(ctx, script, arguments, height)
@@ -60,16 +92,40 @@ func (s *ScriptExecutor) ExecuteAtBlockHeight(ctx context.Context, script []byte
 //
 // Expected errors:
 //   - storage.ErrNotFound if the account or block height is not found
-//   - execution.ErrDataNotAvailable if the data for the block height is not available. this could be because
+//   - storage.ErrHeightNotIndexed if the data for the block height is not available. this could be because
 //     the height is not within the index block range, or the index is not ready.
 func (s *ScriptExecutor) GetAccountAtBlockHeight(ctx context.Context, address flow.Address, height uint64) (*flow.Account, error) {
-	if !s.isDataAvailable(height) {
-		return nil, execution.ErrDataNotAvailable
+	if err := s.checkDataAvailable(height); err != nil {
+		return nil, err
 	}
 
 	return s.scriptExecutor.GetAccountAtBlockHeight(ctx, address, height)
 }
 
-func (s *ScriptExecutor) isDataAvailable(height uint64) bool {
-	return s.initialized.Load() && height <= s.indexReporter.HighestIndexedHeight() && height >= s.indexReporter.LowestIndexedHeight()
+func (s *ScriptExecutor) checkDataAvailable(height uint64) error {
+	if !s.initialized.Load() {
+		return fmt.Errorf("%w: script executor not initialized", storage.ErrHeightNotIndexed)
+	}
+
+	highestHeight, err := s.indexReporter.HighestIndexedHeight()
+	if err != nil {
+		return fmt.Errorf("could not get highest indexed height: %w", err)
+	}
+	if height > highestHeight {
+		return fmt.Errorf("%w: block not indexed yet", storage.ErrHeightNotIndexed)
+	}
+
+	lowestHeight, err := s.indexReporter.LowestIndexedHeight()
+	if err != nil {
+		return fmt.Errorf("could not get lowest indexed height: %w", err)
+	}
+	if height < lowestHeight {
+		return fmt.Errorf("%w: block is before lowest indexed height", storage.ErrHeightNotIndexed)
+	}
+
+	if height > s.maxCompatibleHeight.Load() || height < s.minCompatibleHeight.Load() {
+		return fmt.Errorf("%w: node software is not compatible with version required to executed block", storage.ErrHeightNotIndexed)
+	}
+
+	return nil
 }
diff --git a/engine/access/rpc/backend/transactions_local_data_provider.go b/engine/access/rpc/backend/transactions_local_data_provider.go
new file mode 100644
index 00000000000..dcde825a2f0
--- /dev/null
+++ b/engine/access/rpc/backend/transactions_local_data_provider.go
@@ -0,0 +1,414 @@
+package backend
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"google.golang.org/grpc/status"
+
+	"github.com/onflow/flow/protobuf/go/flow/entities"
+	"google.golang.org/grpc/codes"
+
+	"github.com/onflow/flow-go/access"
+	"github.com/onflow/flow-go/engine/access/index"
+	"github.com/onflow/flow-go/engine/common/rpc"
+	"github.com/onflow/flow-go/engine/common/rpc/convert"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/irrecoverable"
+	"github.com/onflow/flow-go/state"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/storage"
+)
+
+// ErrTransactionNotInBlock represents an error indicating that the transaction is not found in the block.
+var ErrTransactionNotInBlock = errors.New("transaction not in block")
+
+// TransactionErrorMessage declares the lookup transaction error methods by different input parameters.
+type TransactionErrorMessage interface {
+	// LookupErrorMessageByTransactionID is a function type for getting transaction error message by block ID and transaction ID.
+	// Expected errors during normal operation:
+	//   - InsufficientExecutionReceipts - found insufficient receipts for given block ID.
+	//   - status.Error - remote GRPC call to EN has failed.
+	LookupErrorMessageByTransactionID(ctx context.Context, blockID flow.Identifier, transactionID flow.Identifier) (string, error)
+
+	// LookupErrorMessageByIndex is a function type for getting transaction error message by index.
+	// Expected errors during normal operation:
+	//   - status.Error[codes.NotFound] - transaction result for given block ID and tx index is not available.
+	//   - InsufficientExecutionReceipts - found insufficient receipts for given block ID.
+	//   - status.Error - remote GRPC call to EN has failed.
+	LookupErrorMessageByIndex(ctx context.Context, blockID flow.Identifier, height uint64, index uint32) (string, error)
+
+	// LookupErrorMessagesByBlockID is a function type for getting transaction error messages by block ID.
+	// Expected errors during normal operation:
+	//   - status.Error[codes.NotFound] - transaction results for given block ID are not available.
+	//   - InsufficientExecutionReceipts - found insufficient receipts for given block ID.
+	//   - status.Error - remote GRPC call to EN has failed.
+	LookupErrorMessagesByBlockID(ctx context.Context, blockID flow.Identifier, height uint64) (map[flow.Identifier]string, error)
+}
+
+// TransactionsLocalDataProvider provides functionality for retrieving transaction results and error messages from local storages
+type TransactionsLocalDataProvider struct {
+	state           protocol.State
+	collections     storage.Collections
+	blocks          storage.Blocks
+	eventsIndex     *index.EventsIndex
+	txResultsIndex  *index.TransactionResultsIndex
+	txErrorMessages TransactionErrorMessage
+	systemTxID      flow.Identifier
+}
+
+// GetTransactionResultFromStorage retrieves a transaction result from storage by block ID and transaction ID.
+// Expected errors during normal operation:
+//   - codes.NotFound when result cannot be provided by storage due to the absence of data.
+//   - codes.Internal if event payload conversion failed.
+//   - indexer.ErrIndexNotInitialized when txResultsIndex not initialized
+//   - storage.ErrHeightNotIndexed when data is unavailable
+//
+// All other errors are considered as state corruption (fatal) or internal errors in the transaction error message
+// getter or when deriving transaction status.
+func (t *TransactionsLocalDataProvider) GetTransactionResultFromStorage(
+	ctx context.Context,
+	block *flow.Block,
+	transactionID flow.Identifier,
+	requiredEventEncodingVersion entities.EventEncodingVersion,
+) (*access.TransactionResult, error) {
+	blockID := block.ID()
+	txResult, err := t.txResultsIndex.ByBlockIDTransactionID(blockID, block.Header.Height, transactionID)
+	if err != nil {
+		return nil, rpc.ConvertIndexError(err, block.Header.Height, "failed to get transaction result")
+	}
+
+	var txErrorMessage string
+	var txStatusCode uint = 0
+	if txResult.Failed {
+		txErrorMessage, err = t.txErrorMessages.LookupErrorMessageByTransactionID(ctx, blockID, transactionID)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(txErrorMessage) == 0 {
+			return nil, status.Errorf(codes.Internal, "transaction failed but error message is empty for tx ID: %s block ID: %s", txResult.TransactionID, blockID)
+		}
+
+		txStatusCode = 1 // statusCode of 1 indicates an error and 0 indicates no error, the same as on EN
+	}
+
+	txStatus, err := t.DeriveTransactionStatus(blockID, block.Header.Height, true)
+	if err != nil {
+		if !errors.Is(err, state.ErrUnknownSnapshotReference) {
+			irrecoverable.Throw(ctx, err)
+		}
+		return nil, rpc.ConvertStorageError(err)
+	}
+
+	events, err := t.eventsIndex.ByBlockIDTransactionID(blockID, block.Header.Height, transactionID)
+	if err != nil {
+		return nil, rpc.ConvertIndexError(err, block.Header.Height, "failed to get events")
+	}
+
+	// events are encoded in CCF format in storage. convert to JSON-CDC if requested
+	if requiredEventEncodingVersion == entities.EventEncodingVersion_JSON_CDC_V0 {
+		events, err = convert.CcfEventsToJsonEvents(events)
+		if err != nil {
+			return nil, rpc.ConvertError(err, "failed to convert event payload", codes.Internal)
+		}
+	}
+
+	return &access.TransactionResult{
+		TransactionID: txResult.TransactionID,
+		Status:        txStatus,
+		StatusCode:    txStatusCode,
+		Events:        events,
+		ErrorMessage:  txErrorMessage,
+		BlockID:       blockID,
+		BlockHeight:   block.Header.Height,
+	}, nil
+}
+
+// GetTransactionResultsByBlockIDFromStorage retrieves transaction results by block ID from storage
+// Expected errors during normal operation:
+//   - codes.NotFound if result cannot be provided by storage due to the absence of data.
+//   - codes.Internal when event payload conversion failed.
+//   - indexer.ErrIndexNotInitialized when txResultsIndex not initialized
+//   - storage.ErrHeightNotIndexed when data is unavailable
+//
+// All other errors are considered as state corruption (fatal) or internal errors in the transaction error message
+// getter or when deriving transaction status.
+func (t *TransactionsLocalDataProvider) GetTransactionResultsByBlockIDFromStorage(
+	ctx context.Context,
+	block *flow.Block,
+	requiredEventEncodingVersion entities.EventEncodingVersion,
+) ([]*access.TransactionResult, error) {
+	blockID := block.ID()
+	txResults, err := t.txResultsIndex.ByBlockID(blockID, block.Header.Height)
+	if err != nil {
+		return nil, rpc.ConvertIndexError(err, block.Header.Height, "failed to get transaction result")
+	}
+
+	txErrors, err := t.txErrorMessages.LookupErrorMessagesByBlockID(ctx, blockID, block.Header.Height)
+	if err != nil {
+		return nil, err
+	}
+
+	numberOfTxResults := len(txResults)
+	results := make([]*access.TransactionResult, 0, numberOfTxResults)
+
+	// cache the tx to collectionID mapping to avoid repeated lookups
+	txToCollectionID, err := t.buildTxIDToCollectionIDMapping(block)
+	if err != nil {
+		// this indicates that one or more of the collections for the block are not indexed. Since
+		// lookups are gated on the indexer signaling it has finished processing all data for the
+		// block, all data must be available in storage, otherwise there is an inconsistency in the
+		// state.
+		irrecoverable.Throw(ctx, fmt.Errorf("inconsistent index state: %w", err))
+		return nil, status.Errorf(codes.Internal, "failed to map tx to collection ID: %v", err)
+	}
+
+	for _, txResult := range txResults {
+		txID := txResult.TransactionID
+
+		var txErrorMessage string
+		var txStatusCode uint = 0
+		if txResult.Failed {
+			txErrorMessage = txErrors[txResult.TransactionID]
+			if len(txErrorMessage) == 0 {
+				return nil, status.Errorf(codes.Internal, "transaction failed but error message is empty for tx ID: %s block ID: %s", txID, blockID)
+			}
+			txStatusCode = 1
+		}
+
+		txStatus, err := t.DeriveTransactionStatus(blockID, block.Header.Height, true)
+		if err != nil {
+			if !errors.Is(err, state.ErrUnknownSnapshotReference) {
+				irrecoverable.Throw(ctx, err)
+			}
+			return nil, rpc.ConvertStorageError(err)
+		}
+
+		events, err := t.eventsIndex.ByBlockIDTransactionID(blockID, block.Header.Height, txResult.TransactionID)
+		if err != nil {
+			return nil, rpc.ConvertIndexError(err, block.Header.Height, "failed to get events")
+		}
+
+		// events are encoded in CCF format in storage. convert to JSON-CDC if requested
+		if requiredEventEncodingVersion == entities.EventEncodingVersion_JSON_CDC_V0 {
+			events, err = convert.CcfEventsToJsonEvents(events)
+			if err != nil {
+				return nil, rpc.ConvertError(err, "failed to convert event payload", codes.Internal)
+			}
+		}
+
+		collectionID, ok := txToCollectionID[txID]
+		if !ok {
+			return nil, status.Errorf(codes.Internal, "transaction %s not found in block %s", txID, blockID)
+		}
+
+		results = append(results, &access.TransactionResult{
+			Status:        txStatus,
+			StatusCode:    txStatusCode,
+			Events:        events,
+			ErrorMessage:  txErrorMessage,
+			BlockID:       blockID,
+			TransactionID: txID,
+			CollectionID:  collectionID,
+			BlockHeight:   block.Header.Height,
+		})
+	}
+
+	return results, nil
+}
+
+// GetTransactionResultByIndexFromStorage retrieves a transaction result by index from storage.
+// Expected errors during normal operation:
+//   - codes.NotFound if result cannot be provided by storage due to the absence of data.
+//   - codes.Internal when event payload conversion failed.
+//   - indexer.ErrIndexNotInitialized when txResultsIndex not initialized
+//   - storage.ErrHeightNotIndexed when data is unavailable
+//
+// All other errors are considered as state corruption (fatal) or internal errors in the transaction error message
+// getter or when deriving transaction status.
+func (t *TransactionsLocalDataProvider) GetTransactionResultByIndexFromStorage(
+	ctx context.Context,
+	block *flow.Block,
+	index uint32,
+	requiredEventEncodingVersion entities.EventEncodingVersion,
+) (*access.TransactionResult, error) {
+	blockID := block.ID()
+	txResult, err := t.txResultsIndex.ByBlockIDTransactionIndex(blockID, block.Header.Height, index)
+	if err != nil {
+		return nil, rpc.ConvertIndexError(err, block.Header.Height, "failed to get transaction result")
+	}
+
+	var txErrorMessage string
+	var txStatusCode uint = 0
+	if txResult.Failed {
+		txErrorMessage, err = t.txErrorMessages.LookupErrorMessageByIndex(ctx, blockID, block.Header.Height, index)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(txErrorMessage) == 0 {
+			return nil, status.Errorf(codes.Internal, "transaction failed but error message is empty for tx ID: %s block ID: %s", txResult.TransactionID, blockID)
+		}
+
+		txStatusCode = 1 // statusCode of 1 indicates an error and 0 indicates no error, the same as on EN
+	}
+
+	txStatus, err := t.DeriveTransactionStatus(blockID, block.Header.Height, true)
+	if err != nil {
+		if !errors.Is(err, state.ErrUnknownSnapshotReference) {
+			irrecoverable.Throw(ctx, err)
+		}
+		return nil, rpc.ConvertStorageError(err)
+	}
+
+	events, err := t.eventsIndex.ByBlockIDTransactionIndex(blockID, block.Header.Height, index)
+	if err != nil {
+		return nil, rpc.ConvertIndexError(err, block.Header.Height, "failed to get events")
+	}
+
+	// events are encoded in CCF format in storage. convert to JSON-CDC if requested
+	if requiredEventEncodingVersion == entities.EventEncodingVersion_JSON_CDC_V0 {
+		events, err = convert.CcfEventsToJsonEvents(events)
+		if err != nil {
+			return nil, rpc.ConvertError(err, "failed to convert event payload", codes.Internal)
+		}
+	}
+
+	collectionID, err := t.LookupCollectionIDInBlock(block, txResult.TransactionID)
+	if err != nil {
+		return nil, err
+	}
+
+	return &access.TransactionResult{
+		TransactionID: txResult.TransactionID,
+		Status:        txStatus,
+		StatusCode:    txStatusCode,
+		Events:        events,
+		ErrorMessage:  txErrorMessage,
+		BlockID:       blockID,
+		BlockHeight:   block.Header.Height,
+		CollectionID:  collectionID,
+	}, nil
+}
+
+// DeriveUnknownTransactionStatus is used to determine the status of transaction
+// that are not in a block yet based on the provided reference block ID.
+func (t *TransactionsLocalDataProvider) DeriveUnknownTransactionStatus(refBlockID flow.Identifier) (flow.TransactionStatus, error) {
+	referenceBlock, err := t.state.AtBlockID(refBlockID).Head()
+	if err != nil {
+		return flow.TransactionStatusUnknown, err
+	}
+	refHeight := referenceBlock.Height
+	// get the latest finalized block from the state
+	finalized, err := t.state.Final().Head()
+	if err != nil {
+		return flow.TransactionStatusUnknown, irrecoverable.NewExceptionf("failed to lookup final header: %w", err)
+	}
+	finalizedHeight := finalized.Height
+
+	// if we haven't seen the expiry block for this transaction, it's not expired
+	if !isExpired(refHeight, finalizedHeight) {
+		return flow.TransactionStatusPending, nil
+	}
+
+	// At this point, we have seen the expiry block for the transaction.
+	// This means that, if no collections  prior to the expiry block contain
+	// the transaction, it can never be included and is expired.
+	//
+	// To ensure this, we need to have received all collections  up to the
+	// expiry block to ensure the transaction did not appear in any.
+
+	// the last full height is the height where we have received all
+	// collections  for all blocks with a lower height
+	fullHeight, err := t.blocks.GetLastFullBlockHeight()
+	if err != nil {
+		return flow.TransactionStatusUnknown, err
+	}
+
+	// if we have received collections  for all blocks up to the expiry block, the transaction is expired
+	if isExpired(refHeight, fullHeight) {
+		return flow.TransactionStatusExpired, nil
+	}
+
+	// tx found in transaction storage and collection storage but not in block storage
+	// However, this will not happen as of now since the ingestion engine doesn't subscribe
+	// for collections
+	return flow.TransactionStatusPending, nil
+}
+
+// DeriveTransactionStatus is used to determine the status of a transaction based on the provided block ID, block height, and execution status.
+// No errors expected during normal operations.
+func (t *TransactionsLocalDataProvider) DeriveTransactionStatus(blockID flow.Identifier, blockHeight uint64, executed bool) (flow.TransactionStatus, error) {
+	if !executed {
+		// If we've gotten here, but the block has not yet been executed, report it as only been finalized
+		return flow.TransactionStatusFinalized, nil
+	}
+
+	// From this point on, we know for sure this transaction has at least been executed
+
+	// get the latest sealed block from the State
+	sealed, err := t.state.Sealed().Head()
+	if err != nil {
+		return flow.TransactionStatusUnknown, irrecoverable.NewExceptionf("failed to lookup sealed header: %w", err)
+	}
+
+	if blockHeight > sealed.Height {
+		// The block is not yet sealed, so we'll report it as only executed
+		return flow.TransactionStatusExecuted, nil
+	}
+
+	// otherwise, this block has been executed, and sealed, so report as sealed
+	return flow.TransactionStatusSealed, nil
+}
+
+// isExpired checks whether a transaction is expired given the height of the
+// transaction's reference block and the height to compare against.
+func isExpired(refHeight, compareToHeight uint64) bool {
+	if compareToHeight <= refHeight {
+		return false
+	}
+	return compareToHeight-refHeight > flow.DefaultTransactionExpiry
+}
+
+// LookupCollectionIDInBlock returns the collection ID based on the transaction ID. The lookup is performed in block
+// collections.
+func (t *TransactionsLocalDataProvider) LookupCollectionIDInBlock(
+	block *flow.Block,
+	txID flow.Identifier,
+) (flow.Identifier, error) {
+	for _, guarantee := range block.Payload.Guarantees {
+		collection, err := t.collections.LightByID(guarantee.ID())
+		if err != nil {
+			return flow.ZeroID, fmt.Errorf("failed to get collection %s in indexed block: %w", guarantee.ID(), err)
+		}
+
+		for _, collectionTxID := range collection.Transactions {
+			if collectionTxID == txID {
+				return guarantee.ID(), nil
+			}
+		}
+	}
+	return flow.ZeroID, ErrTransactionNotInBlock
+}
+
+// buildTxIDToCollectionIDMapping returns a map of transaction ID to collection ID based on the provided block.
+// No errors expected during normal operations.
+func (t *TransactionsLocalDataProvider) buildTxIDToCollectionIDMapping(block *flow.Block) (map[flow.Identifier]flow.Identifier, error) {
+	txToCollectionID := make(map[flow.Identifier]flow.Identifier)
+	for _, guarantee := range block.Payload.Guarantees {
+		collection, err := t.collections.LightByID(guarantee.ID())
+		if err != nil {
+			// if the tx result is in storage, the collection must be too.
+			return nil, fmt.Errorf("failed to get collection %s in indexed block: %w", guarantee.ID(), err)
+		}
+		for _, txID := range collection.Transactions {
+			txToCollectionID[txID] = guarantee.ID()
+		}
+	}
+
+	txToCollectionID[t.systemTxID] = flow.ZeroID
+
+	return txToCollectionID, nil
+}
diff --git a/engine/access/rpc/connection/cache.go b/engine/access/rpc/connection/cache.go
index 1b12deb6f17..ba0231fe452 100644
--- a/engine/access/rpc/connection/cache.go
+++ b/engine/access/rpc/connection/cache.go
@@ -1,22 +1,62 @@
 package connection
 
 import (
+	"fmt"
 	"sync"
 	"time"
 
 	lru "github.com/hashicorp/golang-lru/v2"
+	"github.com/onflow/crypto"
+	"github.com/rs/zerolog"
 	"go.uber.org/atomic"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/connectivity"
+
+	"github.com/onflow/flow-go/module"
 )
 
 // CachedClient represents a gRPC client connection that is cached for reuse.
 type CachedClient struct {
-	ClientConn     *grpc.ClientConn
-	Address        string
-	timeout        time.Duration
+	conn    *grpc.ClientConn
+	address string
+	timeout time.Duration
+
+	cache          *Cache
 	closeRequested *atomic.Bool
 	wg             sync.WaitGroup
-	mu             sync.Mutex
+	mu             sync.RWMutex
+}
+
+// ClientConn returns the underlying gRPC client connection.
+func (cc *CachedClient) ClientConn() *grpc.ClientConn {
+	cc.mu.RLock()
+	defer cc.mu.RUnlock()
+	return cc.conn
+}
+
+// Address returns the address of the remote server.
+func (cc *CachedClient) Address() string {
+	return cc.address
+}
+
+// CloseRequested returns true if the CachedClient has been marked for closure.
+func (cc *CachedClient) CloseRequested() bool {
+	return cc.closeRequested.Load()
+}
+
+// AddRequest increments the in-flight request counter for the CachedClient.
+// It returns a function that should be called when the request completes to decrement the counter
+func (cc *CachedClient) AddRequest() func() {
+	cc.wg.Add(1)
+	return cc.wg.Done
+}
+
+// Invalidate removes the CachedClient from the cache and closes the connection.
+func (cc *CachedClient) Invalidate() {
+	cc.cache.invalidate(cc.address)
+
+	// Close the connection asynchronously to avoid blocking requests
+	go cc.Close()
 }
 
 // Close closes the CachedClient connection. It marks the connection for closure and waits asynchronously for ongoing
@@ -28,16 +68,17 @@ func (cc *CachedClient) Close() {
 	}
 
 	// Obtain the lock to ensure that any connection attempts have completed
-	cc.mu.Lock()
-	conn := cc.ClientConn
-	cc.mu.Unlock()
+	cc.mu.RLock()
+	conn := cc.conn
+	cc.mu.RUnlock()
 
-	// If the initial connection attempt failed, ClientConn will be nil
+	// If the initial connection attempt failed, conn will be nil
 	if conn == nil {
 		return
 	}
 
 	// If there are ongoing requests, wait for them to complete asynchronously
+	// this avoids tearing down the connection while requests are in-flight resulting in errors
 	cc.wg.Wait()
 
 	// Close the connection
@@ -46,59 +87,95 @@ func (cc *CachedClient) Close() {
 
 // Cache represents a cache of CachedClient instances with a given maximum size.
 type Cache struct {
-	cache *lru.Cache[string, *CachedClient]
-	size  int
+	cache   *lru.Cache[string, *CachedClient]
+	maxSize int
+
+	logger  zerolog.Logger
+	metrics module.GRPCConnectionPoolMetrics
 }
 
 // NewCache creates a new Cache with the specified maximum size and the underlying LRU cache.
-func NewCache(cache *lru.Cache[string, *CachedClient], size int) *Cache {
-	return &Cache{
-		cache: cache,
-		size:  size,
+func NewCache(
+	log zerolog.Logger,
+	metrics module.GRPCConnectionPoolMetrics,
+	maxSize int,
+) (*Cache, error) {
+	cache, err := lru.NewWithEvict(maxSize, func(_ string, client *CachedClient) {
+		go client.Close() // close is blocking, so run in a goroutine
+
+		log.Debug().Str("grpc_conn_evicted", client.address).Msg("closing grpc connection evicted from pool")
+		metrics.ConnectionFromPoolEvicted()
+	})
+
+	if err != nil {
+		return nil, fmt.Errorf("could not initialize connection pool cache: %w", err)
 	}
-}
 
-// Get retrieves the CachedClient for the given address from the cache.
-// It returns the CachedClient and a boolean indicating whether the entry exists in the cache.
-func (c *Cache) Get(address string) (*CachedClient, bool) {
-	val, ok := c.cache.Get(address)
-	if !ok {
-		return nil, false
-	}
-	return val, true
+	return &Cache{
+		cache:   cache,
+		maxSize: maxSize,
+		logger:  log,
+		metrics: metrics,
+	}, nil
 }
 
-// GetOrAdd atomically gets the CachedClient for the given address from the cache, or adds a new one
-// if none existed.
-// New entries are added to the cache with their mutex locked. This ensures that the caller gets
-// priority when working with the new client, allowing it to create the underlying connection.
-// Clients retrieved from the cache are returned without modifying their lock.
-func (c *Cache) GetOrAdd(address string, timeout time.Duration) (*CachedClient, bool) {
-	client := &CachedClient{}
-	client.mu.Lock()
+// GetConnected returns a CachedClient for the given address that has an active connection.
+// If the address is not in the cache, it creates a new entry and connects.
+func (c *Cache) GetConnected(
+	address string,
+	timeout time.Duration,
+	networkPubKey crypto.PublicKey,
+	connectFn func(string, time.Duration, crypto.PublicKey, *CachedClient) (*grpc.ClientConn, error),
+) (*CachedClient, error) {
+	client := &CachedClient{
+		address:        address,
+		timeout:        timeout,
+		closeRequested: atomic.NewBool(false),
+		cache:          c,
+	}
 
+	// Note: PeekOrAdd does not "visit" the existing entry, so we need to call Get explicitly
+	// to mark the entry as "visited" and update the LRU order. Unfortunately, the lru library
+	// doesn't have a GetOrAdd method, so this is the simplest way to achieve atomic get-or-add
 	val, existed, _ := c.cache.PeekOrAdd(address, client)
 	if existed {
-		return val, true
+		client = val
+		_, _ = c.cache.Get(address)
+		c.metrics.ConnectionFromPoolReused()
+	} else {
+		c.metrics.ConnectionAddedToPool()
 	}
 
-	client.Address = address
-	client.timeout = timeout
-	client.closeRequested = atomic.NewBool(false)
+	client.mu.Lock()
+	defer client.mu.Unlock()
 
-	return client, false
-}
+	// after getting the lock, check if the connection is still active
+	if client.conn != nil && client.conn.GetState() != connectivity.Shutdown {
+		return client, nil
+	}
 
-// Add adds a CachedClient to the cache with the given address.
-// It returns a boolean indicating whether an existing entry was evicted.
-func (c *Cache) Add(address string, client *CachedClient) (evicted bool) {
-	return c.cache.Add(address, client)
+	// if the connection is not setup yet or closed, create a new connection and cache it
+	conn, err := connectFn(client.address, client.timeout, networkPubKey, client)
+	if err != nil {
+		return nil, err
+	}
+
+	c.metrics.NewConnectionEstablished()
+	c.metrics.TotalConnectionsInPool(uint(c.Len()), uint(c.MaxSize()))
+
+	client.conn = conn
+	return client, nil
 }
 
-// Remove removes the CachedClient entry from the cache with the given address.
-// It returns a boolean indicating whether the entry was present and removed.
-func (c *Cache) Remove(address string) (present bool) {
-	return c.cache.Remove(address)
+// invalidate removes the CachedClient entry from the cache with the given address, and shuts
+// down the connection.
+func (c *Cache) invalidate(address string) {
+	if !c.cache.Remove(address) {
+		return
+	}
+
+	c.logger.Debug().Str("cached_client_invalidated", address).Msg("invalidating cached client")
+	c.metrics.ConnectionFromPoolInvalidated()
 }
 
 // Len returns the number of CachedClient entries in the cache.
@@ -108,11 +185,5 @@ func (c *Cache) Len() int {
 
 // MaxSize returns the maximum size of the cache.
 func (c *Cache) MaxSize() int {
-	return c.size
-}
-
-// Contains checks if the cache contains an entry with the given address.
-// It returns a boolean indicating whether the address is present in the cache.
-func (c *Cache) Contains(address string) (containKey bool) {
-	return c.cache.Contains(address)
+	return c.maxSize
 }
diff --git a/engine/access/rpc/connection/cache_test.go b/engine/access/rpc/connection/cache_test.go
new file mode 100644
index 00000000000..5dd07c3fe7f
--- /dev/null
+++ b/engine/access/rpc/connection/cache_test.go
@@ -0,0 +1,212 @@
+package connection
+
+import (
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/onflow/crypto"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/atomic"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/onflow/flow-go/module/metrics"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+func TestCachedClientShutdown(t *testing.T) {
+	// Test that a completely uninitialized client can be closed without panics
+	t.Run("uninitialized client", func(t *testing.T) {
+		client := &CachedClient{
+			closeRequested: atomic.NewBool(false),
+		}
+		client.Close()
+		assert.True(t, client.closeRequested.Load())
+	})
+
+	// Test closing a client with no outstanding requests
+	// Close() should return quickly
+	t.Run("with no outstanding requests", func(t *testing.T) {
+		client := &CachedClient{
+			closeRequested: atomic.NewBool(false),
+			conn:           setupGRPCServer(t),
+		}
+
+		unittest.RequireReturnsBefore(t, func() {
+			client.Close()
+		}, 100*time.Millisecond, "client timed out closing connection")
+
+		assert.True(t, client.closeRequested.Load())
+	})
+
+	// Test closing a client with outstanding requests waits for requests to complete
+	// Close() should block until the request completes
+	t.Run("with some outstanding requests", func(t *testing.T) {
+		client := &CachedClient{
+			closeRequested: atomic.NewBool(false),
+			conn:           setupGRPCServer(t),
+		}
+		done := client.AddRequest()
+
+		doneCalled := atomic.NewBool(false)
+		go func() {
+			defer done()
+			time.Sleep(50 * time.Millisecond)
+			doneCalled.Store(true)
+		}()
+
+		unittest.RequireReturnsBefore(t, func() {
+			client.Close()
+		}, 100*time.Millisecond, "client timed out closing connection")
+
+		assert.True(t, client.closeRequested.Load())
+		assert.True(t, doneCalled.Load())
+	})
+
+	// Test closing a client that is already closing does not block
+	// Close() should return immediately
+	t.Run("already closing", func(t *testing.T) {
+		client := &CachedClient{
+			closeRequested: atomic.NewBool(true), // close already requested
+			conn:           setupGRPCServer(t),
+		}
+		done := client.AddRequest()
+
+		doneCalled := atomic.NewBool(false)
+		go func() {
+			defer done()
+
+			// use a long delay and require Close() to complete faster
+			time.Sleep(5 * time.Second)
+			doneCalled.Store(true)
+		}()
+
+		// should return immediately
+		unittest.RequireReturnsBefore(t, func() {
+			client.Close()
+		}, 10*time.Millisecond, "client timed out closing connection")
+
+		assert.True(t, client.closeRequested.Load())
+		assert.False(t, doneCalled.Load())
+	})
+
+	// Test closing a client that is locked during connection setup
+	// Close() should wait for the lock before shutting down
+	t.Run("connection setting up", func(t *testing.T) {
+		client := &CachedClient{
+			closeRequested: atomic.NewBool(false),
+		}
+
+		// simulate an in-progress connection setup
+		client.mu.Lock()
+
+		go func() {
+			// unlock after setting up the connection
+			defer client.mu.Unlock()
+
+			// pause before setting the connection to cause client.Close() to block
+			time.Sleep(100 * time.Millisecond)
+			client.conn = setupGRPCServer(t)
+		}()
+
+		// should wait at least 100 milliseconds before returning
+		unittest.RequireReturnsBefore(t, func() {
+			client.Close()
+		}, 500*time.Millisecond, "client timed out closing connection")
+
+		assert.True(t, client.closeRequested.Load())
+		assert.NotNil(t, client.conn)
+	})
+}
+
+// Test that rapid connections and disconnects do not cause a panic.
+func TestConcurrentConnectionsAndDisconnects(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
+
+	cache, err := NewCache(logger, metrics, 1)
+	require.NoError(t, err)
+
+	connectionCount := 100_000
+	conn := setupGRPCServer(t)
+
+	t.Run("test concurrent connections", func(t *testing.T) {
+		wg := sync.WaitGroup{}
+		wg.Add(connectionCount)
+		callCount := atomic.NewInt32(0)
+		for i := 0; i < connectionCount; i++ {
+			go func() {
+				defer wg.Done()
+				cachedConn, err := cache.GetConnected("foo", DefaultClientTimeout, nil, func(string, time.Duration, crypto.PublicKey, *CachedClient) (*grpc.ClientConn, error) {
+					callCount.Inc()
+					return conn, nil
+				})
+				require.NoError(t, err)
+
+				done := cachedConn.AddRequest()
+				time.Sleep(1 * time.Millisecond)
+				done()
+			}()
+		}
+		unittest.RequireReturnsBefore(t, wg.Wait, time.Second, "timed out waiting for connections to finish")
+
+		// the client should be cached, so only a single connection is created
+		assert.Equal(t, int32(1), callCount.Load())
+	})
+
+	t.Run("test rapid connections and invalidations", func(t *testing.T) {
+		wg := sync.WaitGroup{}
+		wg.Add(connectionCount)
+		callCount := atomic.NewInt32(0)
+		for i := 0; i < connectionCount; i++ {
+			go func() {
+				defer wg.Done()
+				cachedConn, err := cache.GetConnected("foo", DefaultClientTimeout, nil, func(string, time.Duration, crypto.PublicKey, *CachedClient) (*grpc.ClientConn, error) {
+					callCount.Inc()
+					return conn, nil
+				})
+				require.NoError(t, err)
+
+				done := cachedConn.AddRequest()
+				time.Sleep(1 * time.Millisecond)
+				cachedConn.Invalidate()
+				done()
+			}()
+		}
+		wg.Wait()
+
+		// since all connections are invalidated, the cache should be empty at the end
+		require.Eventually(t, func() bool {
+			return cache.Len() == 0
+		}, time.Second, 20*time.Millisecond, "cache should be empty")
+
+		// Many connections should be created, but some will be shared
+		assert.Greater(t, callCount.Load(), int32(1))
+		assert.LessOrEqual(t, callCount.Load(), int32(connectionCount))
+	})
+}
+
+// setupGRPCServer starts a dummy grpc server for connection tests
+func setupGRPCServer(t *testing.T) *grpc.ClientConn {
+	l, err := net.Listen("tcp", net.JoinHostPort("localhost", "0"))
+	require.NoError(t, err)
+
+	server := grpc.NewServer()
+
+	t.Cleanup(func() {
+		server.Stop()
+	})
+
+	go func() {
+		err = server.Serve(l)
+		require.NoError(t, err)
+	}()
+
+	conn, err := grpc.Dial(l.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	require.NoError(t, err)
+
+	return conn
+}
diff --git a/engine/access/rpc/connection/connection.go b/engine/access/rpc/connection/connection.go
index 161aa2949d2..c9533f945bc 100644
--- a/engine/access/rpc/connection/connection.go
+++ b/engine/access/rpc/connection/connection.go
@@ -75,7 +75,7 @@ func (cf *ConnectionFactoryImpl) GetAccessAPIClient(address string, networkPubKe
 // The networkPubKey is the public key used for secure gRPC connection. Can be nil for an unsecured connection.
 // The returned io.Closer should close the connection after the call if no error occurred during client creation.
 func (cf *ConnectionFactoryImpl) GetAccessAPIClientWithPort(address string, networkPubKey crypto.PublicKey) (access.AccessAPIClient, io.Closer, error) {
-	conn, closer, err := cf.Manager.GetConnection(address, cf.CollectionNodeGRPCTimeout, AccessClient, networkPubKey)
+	conn, closer, err := cf.Manager.GetConnection(address, cf.CollectionNodeGRPCTimeout, networkPubKey)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -91,7 +91,7 @@ func (cf *ConnectionFactoryImpl) GetExecutionAPIClient(address string) (executio
 		return nil, nil, err
 	}
 
-	conn, closer, err := cf.Manager.GetConnection(grpcAddress, cf.ExecutionNodeGRPCTimeout, ExecutionClient, nil)
+	conn, closer, err := cf.Manager.GetConnection(grpcAddress, cf.ExecutionNodeGRPCTimeout, nil)
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/engine/access/rpc/connection/connection_test.go b/engine/access/rpc/connection/connection_test.go
index 4f024105a95..4ef7d9a978b 100644
--- a/engine/access/rpc/connection/connection_test.go
+++ b/engine/access/rpc/connection/connection_test.go
@@ -2,7 +2,9 @@ package connection
 
 import (
 	"context"
+	"crypto/rand"
 	"fmt"
+	"math/big"
 	"net"
 	"sync"
 	"testing"
@@ -19,7 +21,6 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/connectivity"
-	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/status"
 	"pgregory.net/rapid"
 
@@ -29,6 +30,9 @@ import (
 )
 
 func TestProxyAccessAPI(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
+
 	// create a collection node
 	cn := new(collectionNode)
 	cn.start(t)
@@ -43,11 +47,11 @@ func TestProxyAccessAPI(t *testing.T) {
 	// set the collection grpc port
 	connectionFactory.CollectionGRPCPort = cn.port
 	// set metrics reporting
-	connectionFactory.AccessMetrics = metrics.NewNoopCollector()
+	connectionFactory.AccessMetrics = metrics
 	connectionFactory.Manager = NewManager(
-		nil,
-		unittest.Logger(),
+		logger,
 		connectionFactory.AccessMetrics,
+		nil,
 		0,
 		CircuitBreakerConfig{},
 		grpcutils.NoCompressor,
@@ -70,15 +74,10 @@ func TestProxyAccessAPI(t *testing.T) {
 	assert.Equal(t, resp, expected)
 }
 
-func getCache(t *testing.T, cacheSize int) *lru.Cache[string, *CachedClient] {
-	cache, err := lru.NewWithEvict[string, *CachedClient](cacheSize, func(_ string, client *CachedClient) {
-		client.Close()
-	})
-	require.NoError(t, err)
-	return cache
-}
-
 func TestProxyExecutionAPI(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
+
 	// create an execution node
 	en := new(executionNode)
 	en.start(t)
@@ -94,11 +93,11 @@ func TestProxyExecutionAPI(t *testing.T) {
 	connectionFactory.ExecutionGRPCPort = en.port
 
 	// set metrics reporting
-	connectionFactory.AccessMetrics = metrics.NewNoopCollector()
+	connectionFactory.AccessMetrics = metrics
 	connectionFactory.Manager = NewManager(
-		nil,
-		unittest.Logger(),
+		logger,
 		connectionFactory.AccessMetrics,
+		nil,
 		0,
 		CircuitBreakerConfig{},
 		grpcutils.NoCompressor,
@@ -121,6 +120,9 @@ func TestProxyExecutionAPI(t *testing.T) {
 }
 
 func TestProxyAccessAPIConnectionReuse(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
+
 	// create a collection node
 	cn := new(collectionNode)
 	cn.start(t)
@@ -134,16 +136,18 @@ func TestProxyAccessAPIConnectionReuse(t *testing.T) {
 	connectionFactory := new(ConnectionFactoryImpl)
 	// set the collection grpc port
 	connectionFactory.CollectionGRPCPort = cn.port
+
 	// set the connection pool cache size
 	cacheSize := 1
-	connectionCache := NewCache(getCache(t, cacheSize), cacheSize)
+	connectionCache, err := NewCache(logger, metrics, cacheSize)
+	require.NoError(t, err)
 
 	// set metrics reporting
-	connectionFactory.AccessMetrics = metrics.NewNoopCollector()
+	connectionFactory.AccessMetrics = metrics
 	connectionFactory.Manager = NewManager(
-		connectionCache,
-		unittest.Logger(),
+		logger,
 		connectionFactory.AccessMetrics,
+		connectionCache,
 		0,
 		CircuitBreakerConfig{},
 		grpcutils.NoCompressor,
@@ -161,9 +165,9 @@ func TestProxyAccessAPIConnectionReuse(t *testing.T) {
 	assert.Nil(t, closer.Close())
 
 	var conn *grpc.ClientConn
-	res, ok := connectionCache.Get(proxyConnectionFactory.targetAddress)
+	res, ok := connectionCache.cache.Get(proxyConnectionFactory.targetAddress)
 	assert.True(t, ok)
-	conn = res.ClientConn
+	conn = res.ClientConn()
 
 	// check if api client can be rebuilt with retrieved connection
 	accessAPIClient := access.NewAccessAPIClient(conn)
@@ -174,6 +178,9 @@ func TestProxyAccessAPIConnectionReuse(t *testing.T) {
 }
 
 func TestProxyExecutionAPIConnectionReuse(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
+
 	// create an execution node
 	en := new(executionNode)
 	en.start(t)
@@ -187,15 +194,18 @@ func TestProxyExecutionAPIConnectionReuse(t *testing.T) {
 	connectionFactory := new(ConnectionFactoryImpl)
 	// set the execution grpc port
 	connectionFactory.ExecutionGRPCPort = en.port
+
 	// set the connection pool cache size
 	cacheSize := 5
-	connectionCache := NewCache(getCache(t, cacheSize), cacheSize)
+	connectionCache, err := NewCache(logger, metrics, cacheSize)
+	require.NoError(t, err)
+
 	// set metrics reporting
-	connectionFactory.AccessMetrics = metrics.NewNoopCollector()
+	connectionFactory.AccessMetrics = metrics
 	connectionFactory.Manager = NewManager(
-		connectionCache,
-		unittest.Logger(),
+		logger,
 		connectionFactory.AccessMetrics,
+		connectionCache,
 		0,
 		CircuitBreakerConfig{},
 		grpcutils.NoCompressor,
@@ -213,9 +223,9 @@ func TestProxyExecutionAPIConnectionReuse(t *testing.T) {
 	assert.Nil(t, closer.Close())
 
 	var conn *grpc.ClientConn
-	res, ok := connectionCache.Get(proxyConnectionFactory.targetAddress)
+	res, ok := connectionCache.cache.Get(proxyConnectionFactory.targetAddress)
 	assert.True(t, ok)
-	conn = res.ClientConn
+	conn = res.ClientConn()
 
 	// check if api client can be rebuilt with retrieved connection
 	executionAPIClient := execution.NewExecutionAPIClient(conn)
@@ -227,6 +237,8 @@ func TestProxyExecutionAPIConnectionReuse(t *testing.T) {
 
 // TestExecutionNodeClientTimeout tests that the execution API client times out after the timeout duration
 func TestExecutionNodeClientTimeout(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
 
 	timeout := 10 * time.Millisecond
 
@@ -246,15 +258,18 @@ func TestExecutionNodeClientTimeout(t *testing.T) {
 	connectionFactory.ExecutionGRPCPort = en.port
 	// set the execution grpc client timeout
 	connectionFactory.ExecutionNodeGRPCTimeout = timeout
+
 	// set the connection pool cache size
 	cacheSize := 5
-	connectionCache := NewCache(getCache(t, cacheSize), cacheSize)
+	connectionCache, err := NewCache(logger, metrics, cacheSize)
+	require.NoError(t, err)
+
 	// set metrics reporting
-	connectionFactory.AccessMetrics = metrics.NewNoopCollector()
+	connectionFactory.AccessMetrics = metrics
 	connectionFactory.Manager = NewManager(
-		connectionCache,
-		unittest.Logger(),
+		logger,
 		connectionFactory.AccessMetrics,
+		connectionCache,
 		0,
 		CircuitBreakerConfig{},
 		grpcutils.NoCompressor,
@@ -274,6 +289,8 @@ func TestExecutionNodeClientTimeout(t *testing.T) {
 
 // TestCollectionNodeClientTimeout tests that the collection API client times out after the timeout duration
 func TestCollectionNodeClientTimeout(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
 
 	timeout := 10 * time.Millisecond
 
@@ -293,15 +310,18 @@ func TestCollectionNodeClientTimeout(t *testing.T) {
 	connectionFactory.CollectionGRPCPort = cn.port
 	// set the collection grpc client timeout
 	connectionFactory.CollectionNodeGRPCTimeout = timeout
+
 	// set the connection pool cache size
 	cacheSize := 5
-	connectionCache := NewCache(getCache(t, cacheSize), cacheSize)
+	connectionCache, err := NewCache(logger, metrics, cacheSize)
+	require.NoError(t, err)
+
 	// set metrics reporting
-	connectionFactory.AccessMetrics = metrics.NewNoopCollector()
+	connectionFactory.AccessMetrics = metrics
 	connectionFactory.Manager = NewManager(
-		connectionCache,
-		unittest.Logger(),
+		logger,
 		connectionFactory.AccessMetrics,
+		connectionCache,
 		0,
 		CircuitBreakerConfig{},
 		grpcutils.NoCompressor,
@@ -321,6 +341,9 @@ func TestCollectionNodeClientTimeout(t *testing.T) {
 
 // TestConnectionPoolFull tests that the LRU cache replaces connections when full
 func TestConnectionPoolFull(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
+
 	// create a collection node
 	cn1, cn2, cn3 := new(collectionNode), new(collectionNode), new(collectionNode)
 	cn1.start(t)
@@ -340,16 +363,18 @@ func TestConnectionPoolFull(t *testing.T) {
 	connectionFactory := new(ConnectionFactoryImpl)
 	// set the collection grpc port
 	connectionFactory.CollectionGRPCPort = cn1.port
+
 	// set the connection pool cache size
 	cacheSize := 2
-	connectionCache := NewCache(getCache(t, cacheSize), cacheSize)
+	connectionCache, err := NewCache(logger, metrics, cacheSize)
+	require.NoError(t, err)
 
 	// set metrics reporting
-	connectionFactory.AccessMetrics = metrics.NewNoopCollector()
+	connectionFactory.AccessMetrics = metrics
 	connectionFactory.Manager = NewManager(
-		connectionCache,
-		unittest.Logger(),
+		logger,
 		connectionFactory.AccessMetrics,
+		connectionCache,
 		0,
 		CircuitBreakerConfig{},
 		grpcutils.NoCompressor,
@@ -361,7 +386,7 @@ func TestConnectionPoolFull(t *testing.T) {
 
 	// get a collection API client
 	// Create and add first client to cache
-	_, _, err := connectionFactory.GetAccessAPIClient(cn1Address, nil)
+	_, _, err = connectionFactory.GetAccessAPIClient(cn1Address, nil)
 	assert.Equal(t, connectionCache.Len(), 1)
 	assert.NoError(t, err)
 
@@ -370,38 +395,40 @@ func TestConnectionPoolFull(t *testing.T) {
 	assert.Equal(t, connectionCache.Len(), 2)
 	assert.NoError(t, err)
 
-	// Peek first client from cache. "recently used"-ness will not be updated, so it will be wiped out first.
+	// Get the first client from cache.
 	_, _, err = connectionFactory.GetAccessAPIClient(cn1Address, nil)
 	assert.Equal(t, connectionCache.Len(), 2)
 	assert.NoError(t, err)
 
-	// Create and add third client to cache, firs client will be removed from cache
+	// Create and add third client to cache, second client will be removed from cache
 	_, _, err = connectionFactory.GetAccessAPIClient(cn3Address, nil)
 	assert.Equal(t, connectionCache.Len(), 2)
 	assert.NoError(t, err)
 
 	var hostnameOrIP string
+
 	hostnameOrIP, _, err = net.SplitHostPort(cn1Address)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	grpcAddress1 := fmt.Sprintf("%s:%d", hostnameOrIP, connectionFactory.CollectionGRPCPort)
+
 	hostnameOrIP, _, err = net.SplitHostPort(cn2Address)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	grpcAddress2 := fmt.Sprintf("%s:%d", hostnameOrIP, connectionFactory.CollectionGRPCPort)
+
 	hostnameOrIP, _, err = net.SplitHostPort(cn3Address)
-	assert.NoError(t, err)
+	require.NoError(t, err)
 	grpcAddress3 := fmt.Sprintf("%s:%d", hostnameOrIP, connectionFactory.CollectionGRPCPort)
 
-	contains1 := connectionCache.Contains(grpcAddress1)
-	contains2 := connectionCache.Contains(grpcAddress2)
-	contains3 := connectionCache.Contains(grpcAddress3)
-
-	assert.False(t, contains1)
-	assert.True(t, contains2)
-	assert.True(t, contains3)
+	assert.True(t, connectionCache.cache.Contains(grpcAddress1))
+	assert.False(t, connectionCache.cache.Contains(grpcAddress2))
+	assert.True(t, connectionCache.cache.Contains(grpcAddress3))
 }
 
 // TestConnectionPoolStale tests that a new connection will be established if the old one cached is stale
 func TestConnectionPoolStale(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
+
 	// create a collection node
 	cn := new(collectionNode)
 	cn.start(t)
@@ -415,16 +442,18 @@ func TestConnectionPoolStale(t *testing.T) {
 	connectionFactory := new(ConnectionFactoryImpl)
 	// set the collection grpc port
 	connectionFactory.CollectionGRPCPort = cn.port
+
 	// set the connection pool cache size
 	cacheSize := 5
-	connectionCache := NewCache(getCache(t, cacheSize), cacheSize)
+	connectionCache, err := NewCache(logger, metrics, cacheSize)
+	require.NoError(t, err)
 
 	// set metrics reporting
-	connectionFactory.AccessMetrics = metrics.NewNoopCollector()
+	connectionFactory.AccessMetrics = metrics
 	connectionFactory.Manager = NewManager(
-		connectionCache,
-		unittest.Logger(),
+		logger,
 		connectionFactory.AccessMetrics,
+		connectionCache,
 		0,
 		CircuitBreakerConfig{},
 		grpcutils.NoCompressor,
@@ -440,10 +469,10 @@ func TestConnectionPoolStale(t *testing.T) {
 	assert.Equal(t, connectionCache.Len(), 1)
 	assert.NoError(t, err)
 	// close connection to simulate something "going wrong" with our stored connection
-	res, _ := connectionCache.Get(proxyConnectionFactory.targetAddress)
+	cachedClient, _ := connectionCache.cache.Get(proxyConnectionFactory.targetAddress)
 
-	connectionCache.Remove(proxyConnectionFactory.targetAddress)
-	res.Close()
+	cachedClient.Invalidate()
+	cachedClient.Close()
 
 	ctx := context.Background()
 	// make the call to the collection node (should fail, connection closed)
@@ -455,9 +484,9 @@ func TestConnectionPoolStale(t *testing.T) {
 	assert.Equal(t, connectionCache.Len(), 1)
 
 	var conn *grpc.ClientConn
-	res, ok := connectionCache.Get(proxyConnectionFactory.targetAddress)
+	res, ok := connectionCache.cache.Get(proxyConnectionFactory.targetAddress)
 	assert.True(t, ok)
-	conn = res.ClientConn
+	conn = res.ClientConn()
 
 	// check if api client can be rebuilt with retrieved connection
 	accessAPIClient := access.NewAccessAPIClient(conn)
@@ -475,6 +504,9 @@ func TestConnectionPoolStale(t *testing.T) {
 // - Wait for all goroutines to finish.
 // - Verify that the number of completed requests matches the number of sent responses.
 func TestExecutionNodeClientClosedGracefully(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
+
 	// Add createExecNode function to recreate it each time for rapid test
 	createExecNode := func() (*executionNode, func()) {
 		en := new(executionNode)
@@ -503,16 +535,18 @@ func TestExecutionNodeClientClosedGracefully(t *testing.T) {
 		connectionFactory.ExecutionGRPCPort = en.port
 		// set the execution grpc client timeout
 		connectionFactory.ExecutionNodeGRPCTimeout = time.Second
+
 		// set the connection pool cache size
 		cacheSize := 1
-		connectionCache := NewCache(getCache(t, cacheSize), cacheSize)
+		connectionCache, err := NewCache(logger, metrics, cacheSize)
+		require.NoError(t, err)
 
 		// set metrics reporting
-		connectionFactory.AccessMetrics = metrics.NewNoopCollector()
+		connectionFactory.AccessMetrics = metrics
 		connectionFactory.Manager = NewManager(
-			connectionCache,
-			unittest.Logger(),
+			logger,
 			connectionFactory.AccessMetrics,
+			connectionCache,
 			0,
 			CircuitBreakerConfig{},
 			grpcutils.NoCompressor,
@@ -526,7 +560,7 @@ func TestExecutionNodeClientClosedGracefully(t *testing.T) {
 		ctx := context.Background()
 
 		// Generate random number of requests
-		nofRequests := rapid.IntRange(10, 100).Draw(tt, "nofRequests").(int)
+		nofRequests := rapid.IntRange(10, 100).Draw(tt, "nofRequests")
 		reqCompleted := atomic.NewUint64(0)
 
 		var waitGroup sync.WaitGroup
@@ -548,7 +582,7 @@ func TestExecutionNodeClientClosedGracefully(t *testing.T) {
 		}
 
 		// Close connection
-		connectionFactory.Manager.Remove(clientAddress)
+		// connectionFactory.Manager.Remove(clientAddress)
 
 		waitGroup.Wait()
 
@@ -566,6 +600,9 @@ func TestExecutionNodeClientClosedGracefully(t *testing.T) {
 //     error response.
 //   - Wait for the client state to change from "Ready" to "Shutdown", indicating that the client connection was closed.
 func TestEvictingCacheClients(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
+
 	// Create a new collection node for testing
 	cn := new(collectionNode)
 	cn.start(t)
@@ -600,19 +637,21 @@ func TestEvictingCacheClients(t *testing.T) {
 	// Set the connection pool cache size
 	cacheSize := 1
 
+	connectionCache, err := NewCache(logger, metrics, cacheSize)
+	require.NoError(t, err)
+
 	// create a non-blocking cache
-	cache, err := lru.NewWithEvict[string, *CachedClient](cacheSize, func(_ string, client *CachedClient) {
+	connectionCache.cache, err = lru.NewWithEvict[string, *CachedClient](cacheSize, func(_ string, client *CachedClient) {
 		go client.Close()
 	})
 	require.NoError(t, err)
 
-	connectionCache := NewCache(cache, cacheSize)
 	// set metrics reporting
-	connectionFactory.AccessMetrics = metrics.NewNoopCollector()
+	connectionFactory.AccessMetrics = metrics
 	connectionFactory.Manager = NewManager(
-		connectionCache,
-		unittest.Logger(),
+		logger,
 		connectionFactory.AccessMetrics,
+		connectionCache,
 		0,
 		CircuitBreakerConfig{},
 		grpcutils.NoCompressor,
@@ -626,12 +665,12 @@ func TestEvictingCacheClients(t *testing.T) {
 	ctx := context.Background()
 
 	// Retrieve the cached client from the cache
-	cachedClient, ok := connectionCache.Get(clientAddress)
+	cachedClient, ok := connectionCache.cache.Get(clientAddress)
 	require.True(t, ok)
 
 	// wait until the client connection is ready
 	require.Eventually(t, func() bool {
-		return cachedClient.ClientConn.GetState() == connectivity.Ready
+		return cachedClient.ClientConn().GetState() == connectivity.Ready
 	}, 100*time.Millisecond, 10*time.Millisecond, "client timed out before ready")
 
 	// Schedule the invalidation of the access API client while the Ping call is in progress
@@ -643,9 +682,9 @@ func TestEvictingCacheClients(t *testing.T) {
 		<-startPing // wait until Ping is called
 
 		// Invalidate the access API client
-		connectionFactory.Manager.Remove(clientAddress)
+		cachedClient.Invalidate()
 
-		// Remove marks the connection for closure asynchronously, so give it some time to run
+		// Invalidate marks the connection for closure asynchronously, so give it some time to run
 		require.Eventually(t, func() bool {
 			return cachedClient.closeRequested.Load()
 		}, 100*time.Millisecond, 10*time.Millisecond, "client timed out closing connection")
@@ -666,140 +705,116 @@ func TestEvictingCacheClients(t *testing.T) {
 
 	// Wait for the client connection to change state from "Ready" to "Shutdown" as connection was closed.
 	require.Eventually(t, func() bool {
-		return cachedClient.ClientConn.WaitForStateChange(ctx, connectivity.Ready)
+		return cachedClient.ClientConn().WaitForStateChange(ctx, connectivity.Ready)
 	}, 100*time.Millisecond, 10*time.Millisecond, "client timed out transitioning state")
 
-	assert.Equal(t, connectivity.Shutdown, cachedClient.ClientConn.GetState())
+	assert.Equal(t, connectivity.Shutdown, cachedClient.ClientConn().GetState())
 	assert.Equal(t, 0, connectionCache.Len())
 
 	wg.Wait() // wait until the move test routine is done
 }
 
-func TestCachedClientShutdown(t *testing.T) {
-	// Test that a completely uninitialized client can be closed without panics
-	t.Run("uninitialized client", func(t *testing.T) {
-		client := &CachedClient{
-			closeRequested: atomic.NewBool(false),
-		}
-		client.Close()
-		assert.True(t, client.closeRequested.Load())
-	})
+func TestConcurrentConnections(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
 
-	// Test closing a client with no outstanding requests
-	// Close() should return quickly
-	t.Run("with no outstanding requests", func(t *testing.T) {
-		client := &CachedClient{
-			closeRequested: atomic.NewBool(false),
-			ClientConn:     setupGRPCServer(t),
-		}
-
-		unittest.RequireReturnsBefore(t, func() {
-			client.Close()
-		}, 100*time.Millisecond, "client timed out closing connection")
-
-		assert.True(t, client.closeRequested.Load())
-	})
-
-	// Test closing a client with outstanding requests waits for requests to complete
-	// Close() should block until the request completes
-	t.Run("with some outstanding requests", func(t *testing.T) {
-		client := &CachedClient{
-			closeRequested: atomic.NewBool(false),
-			ClientConn:     setupGRPCServer(t),
+	// Add createExecNode function to recreate it each time for rapid test
+	createExecNode := func() (*executionNode, func()) {
+		en := new(executionNode)
+		en.start(t)
+		return en, func() {
+			en.stop(t)
 		}
-		client.wg.Add(1)
-
-		done := atomic.NewBool(false)
-		go func() {
-			defer client.wg.Done()
-			time.Sleep(50 * time.Millisecond)
-			done.Store(true)
-		}()
+	}
 
-		unittest.RequireReturnsBefore(t, func() {
-			client.Close()
-		}, 100*time.Millisecond, "client timed out closing connection")
+	// setup the handler mock
+	req := &execution.PingRequest{}
+	resp := &execution.PingResponse{}
 
-		assert.True(t, client.closeRequested.Load())
-		assert.True(t, done.Load())
-	})
+	// Note: rapid will randomly fail with an error: "group did not use any data from bitstream"
+	// See https://github.com/flyingmutant/rapid/issues/65
+	rapid.Check(t, func(tt *rapid.T) {
+		en, closer := createExecNode()
+		defer closer()
 
-	// Test closing a client that is already closing does not block
-	// Close() should return immediately
-	t.Run("already closing", func(t *testing.T) {
-		client := &CachedClient{
-			closeRequested: atomic.NewBool(true), // close already requested
-			ClientConn:     setupGRPCServer(t),
+		// Note: rapid does not support concurrent calls to Draw for a given T, so they must be serialized
+		mu := sync.Mutex{}
+		getSleep := func() time.Duration {
+			mu.Lock()
+			defer mu.Unlock()
+			return time.Duration(rapid.Int64Range(100, 10_000).Draw(tt, "s"))
 		}
-		client.wg.Add(1)
 
-		done := atomic.NewBool(false)
-		go func() {
-			defer client.wg.Done()
+		requestCount := rapid.IntRange(50, 1000).Draw(tt, "r")
+		responsesSent := atomic.NewInt32(0)
+		en.handler.
+			On("Ping", testifymock.Anything, req).
+			Return(func(_ context.Context, _ *execution.PingRequest) (*execution.PingResponse, error) {
+				time.Sleep(getSleep() * time.Microsecond)
 
-			// use a long delay and require Close() to complete faster
-			time.Sleep(5 * time.Second)
-			done.Store(true)
-		}()
+				// randomly fail ~25% of the time to test that client connection and reuse logic
+				// handles concurrent connect/disconnects
+				fail, err := rand.Int(rand.Reader, big.NewInt(4))
+				require.NoError(tt, err)
 
-		// should return immediately
-		unittest.RequireReturnsBefore(t, func() {
-			client.Close()
-		}, 10*time.Millisecond, "client timed out closing connection")
-
-		assert.True(t, client.closeRequested.Load())
-		assert.False(t, done.Load())
-	})
+				if fail.Uint64()%4 == 0 {
+					err = status.Errorf(codes.Unavailable, "random error")
+				}
 
-	// Test closing a client that is locked during connection setup
-	// Close() should wait for the lock before shutting down
-	t.Run("connection setting up", func(t *testing.T) {
-		client := &CachedClient{
-			closeRequested: atomic.NewBool(false),
+				responsesSent.Inc()
+				return resp, err
+			})
+
+		connectionCache, err := NewCache(logger, metrics, 1)
+		require.NoError(tt, err)
+
+		connectionFactory := &ConnectionFactoryImpl{
+			ExecutionGRPCPort:        en.port,
+			ExecutionNodeGRPCTimeout: time.Second,
+			AccessMetrics:            metrics,
+			Manager: NewManager(
+				logger,
+				metrics,
+				connectionCache,
+				0,
+				CircuitBreakerConfig{},
+				grpcutils.NoCompressor,
+			),
 		}
 
-		// simulate an in-progress connection setup
-		client.mu.Lock()
+		clientAddress := en.listener.Addr().String()
 
-		go func() {
-			// unlock after setting up the connection
-			defer client.mu.Unlock()
+		ctx := context.Background()
 
-			// pause before setting the connection to cause client.Close() to block
-			time.Sleep(100 * time.Millisecond)
-			client.ClientConn = setupGRPCServer(t)
-		}()
+		// Generate random number of requests
+		var wg sync.WaitGroup
+		wg.Add(requestCount)
 
-		// should wait at least 100 milliseconds before returning
-		unittest.RequireReturnsBefore(t, func() {
-			client.Close()
-		}, 500*time.Millisecond, "client timed out closing connection")
+		for i := 0; i < requestCount; i++ {
+			go func() {
+				defer wg.Done()
 
-		assert.True(t, client.closeRequested.Load())
-		assert.NotNil(t, client.ClientConn)
-	})
-}
+				client, _, err := connectionFactory.GetExecutionAPIClient(clientAddress)
+				require.NoError(tt, err)
 
-// setupGRPCServer starts a dummy grpc server for connection tests
-func setupGRPCServer(t *testing.T) *grpc.ClientConn {
-	l, err := net.Listen("tcp", net.JoinHostPort("localhost", "0"))
-	require.NoError(t, err)
+				_, err = client.Ping(ctx, req)
 
-	server := grpc.NewServer()
+				if err != nil {
+					// Note: for some reason, when Unavailable is returned, the error message is
+					// changed to "the connection to 127.0.0.1:57753 was closed". Other error codes
+					// preserve the message.
+					require.Equalf(tt, codes.Unavailable, status.Code(err), "unexpected error: %v", err)
+				}
+			}()
+		}
+		wg.Wait()
 
-	t.Cleanup(func() {
-		server.Stop()
+		// the grpc client seems to throttle requests to servers that return Unavailable, so not
+		// all of the requests make it through to the backend every test. Requiring that at least 1
+		// request is handled for these cases, but all should be handled in most runs.
+		assert.LessOrEqual(tt, responsesSent.Load(), int32(requestCount))
+		assert.Greater(tt, responsesSent.Load(), int32(0))
 	})
-
-	go func() {
-		err = server.Serve(l)
-		require.NoError(t, err)
-	}()
-
-	conn, err := grpc.Dial(l.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
-	require.NoError(t, err)
-
-	return conn
 }
 
 var successCodes = []codes.Code{
@@ -812,6 +827,9 @@ var successCodes = []codes.Code{
 
 // TestCircuitBreakerExecutionNode tests the circuit breaker for execution nodes.
 func TestCircuitBreakerExecutionNode(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
+
 	requestTimeout := 500 * time.Millisecond
 	circuitBreakerRestoreTimeout := 1500 * time.Millisecond
 
@@ -831,13 +849,13 @@ func TestCircuitBreakerExecutionNode(t *testing.T) {
 
 	// Set the connection pool cache size.
 	cacheSize := 1
-	connectionCache, err := lru.New[string, *CachedClient](cacheSize)
+	connectionCache, err := NewCache(logger, metrics, cacheSize)
 	require.NoError(t, err)
 
 	connectionFactory.Manager = NewManager(
-		NewCache(connectionCache, cacheSize),
-		unittest.Logger(),
+		logger,
 		connectionFactory.AccessMetrics,
+		connectionCache,
 		0,
 		CircuitBreakerConfig{
 			Enabled:        true,
@@ -849,7 +867,7 @@ func TestCircuitBreakerExecutionNode(t *testing.T) {
 	)
 
 	// Set metrics reporting.
-	connectionFactory.AccessMetrics = metrics.NewNoopCollector()
+	connectionFactory.AccessMetrics = metrics
 
 	// Create the execution API client.
 	client, _, err := connectionFactory.GetExecutionAPIClient(en.listener.Addr().String())
@@ -915,6 +933,9 @@ func TestCircuitBreakerExecutionNode(t *testing.T) {
 
 // TestCircuitBreakerCollectionNode tests the circuit breaker for collection nodes.
 func TestCircuitBreakerCollectionNode(t *testing.T) {
+	logger := unittest.Logger()
+	metrics := metrics.NewNoopCollector()
+
 	requestTimeout := 500 * time.Millisecond
 	circuitBreakerRestoreTimeout := 1500 * time.Millisecond
 
@@ -934,13 +955,13 @@ func TestCircuitBreakerCollectionNode(t *testing.T) {
 
 	// Set the connection pool cache size.
 	cacheSize := 1
-	connectionCache, err := lru.New[string, *CachedClient](cacheSize)
+	connectionCache, err := NewCache(logger, metrics, cacheSize)
 	require.NoError(t, err)
 
 	connectionFactory.Manager = NewManager(
-		NewCache(connectionCache, cacheSize),
-		unittest.Logger(),
+		logger,
 		connectionFactory.AccessMetrics,
+		connectionCache,
 		0,
 		CircuitBreakerConfig{
 			Enabled:        true,
@@ -952,7 +973,7 @@ func TestCircuitBreakerCollectionNode(t *testing.T) {
 	)
 
 	// Set metrics reporting.
-	connectionFactory.AccessMetrics = metrics.NewNoopCollector()
+	connectionFactory.AccessMetrics = metrics
 
 	// Create the collection API client.
 	client, _, err := connectionFactory.GetAccessAPIClient(cn.listener.Addr().String(), nil)
diff --git a/engine/access/rpc/connection/grpc_compression_benchmark_test.go b/engine/access/rpc/connection/grpc_compression_benchmark_test.go
index 1854d845d72..6ab86fa39a4 100644
--- a/engine/access/rpc/connection/grpc_compression_benchmark_test.go
+++ b/engine/access/rpc/connection/grpc_compression_benchmark_test.go
@@ -75,9 +75,9 @@ func runBenchmark(b *testing.B, compressorName string) {
 	// set metrics reporting
 	connectionFactory.AccessMetrics = metrics.NewNoopCollector()
 	connectionFactory.Manager = NewManager(
-		nil,
 		unittest.Logger(),
 		connectionFactory.AccessMetrics,
+		nil,
 		grpcutils.DefaultMaxMsgSize,
 		CircuitBreakerConfig{},
 		compressorName,
diff --git a/engine/access/rpc/connection/manager.go b/engine/access/rpc/connection/manager.go
index add02afb4ca..356fbef1b0c 100644
--- a/engine/access/rpc/connection/manager.go
+++ b/engine/access/rpc/connection/manager.go
@@ -11,7 +11,6 @@ import (
 	"github.com/sony/gobreaker"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/connectivity"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 	_ "google.golang.org/grpc/encoding/gzip" //required for gRPC compression
@@ -24,17 +23,9 @@ import (
 	"github.com/onflow/flow-go/utils/grpcutils"
 )
 
-// DefaultClientTimeout is used when making a GRPC request to a collection node or an execution node.
+// DefaultClientTimeout is used when making a GRPC request to a collection or execution node.
 const DefaultClientTimeout = 3 * time.Second
 
-// clientType is an enumeration type used to differentiate between different types of gRPC clients.
-type clientType int
-
-const (
-	AccessClient clientType = iota
-	ExecutionClient
-)
-
 type noopCloser struct{}
 
 func (c *noopCloser) Close() error {
@@ -43,9 +34,9 @@ func (c *noopCloser) Close() error {
 
 // Manager provides methods for getting and managing gRPC client connections.
 type Manager struct {
-	cache                *Cache
 	logger               zerolog.Logger
 	metrics              module.AccessMetrics
+	cache                *Cache
 	maxMsgSize           uint
 	circuitBreakerConfig CircuitBreakerConfig
 	compressorName       string
@@ -67,9 +58,9 @@ type CircuitBreakerConfig struct {
 
 // NewManager creates a new Manager with the specified parameters.
 func NewManager(
-	cache *Cache,
 	logger zerolog.Logger,
 	metrics module.AccessMetrics,
+	cache *Cache,
 	maxMsgSize uint,
 	circuitBreakerConfig CircuitBreakerConfig,
 	compressorName string,
@@ -91,18 +82,18 @@ func NewManager(
 func (m *Manager) GetConnection(
 	grpcAddress string,
 	timeout time.Duration,
-	clientType clientType,
 	networkPubKey crypto.PublicKey,
 ) (*grpc.ClientConn, io.Closer, error) {
 	if m.cache != nil {
-		conn, err := m.retrieveConnection(grpcAddress, timeout, clientType, networkPubKey)
+		client, err := m.cache.GetConnected(grpcAddress, timeout, networkPubKey, m.createConnection)
 		if err != nil {
 			return nil, nil, err
 		}
-		return conn, &noopCloser{}, nil
+
+		return client.ClientConn(), &noopCloser{}, nil
 	}
 
-	conn, err := m.createConnection(grpcAddress, timeout, nil, clientType, networkPubKey)
+	conn, err := m.createConnection(grpcAddress, timeout, networkPubKey, nil)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -110,80 +101,6 @@ func (m *Manager) GetConnection(
 	return conn, io.Closer(conn), nil
 }
 
-// Remove removes the gRPC client connection associated with the given grpcAddress from the cache.
-// It returns true if the connection was removed successfully, false otherwise.
-func (m *Manager) Remove(grpcAddress string) bool {
-	if m.cache == nil {
-		return false
-	}
-
-	client, ok := m.cache.Get(grpcAddress)
-	if !ok {
-		return false
-	}
-
-	// First, remove the client from the cache to ensure other callers create a new entry
-	// Remove is done atomically, so only the first caller will succeed
-	if !m.cache.Remove(grpcAddress) {
-		return false
-	}
-
-	// Close the connection asynchronously to avoid blocking requests
-	go client.Close()
-
-	return true
-}
-
-// HasCache returns true if the Manager has a cache, false otherwise.
-func (m *Manager) HasCache() bool {
-	return m.cache != nil
-}
-
-// retrieveConnection retrieves the CachedClient for the given grpcAddress from the cache or adds a new one if not present.
-// If the connection is already cached, it waits for the lock and returns the connection from the cache.
-// Otherwise, it creates a new connection and caches it.
-// The networkPubKey is the public key used for retrieving secure gRPC connection. Can be nil for an unsecured connection.
-func (m *Manager) retrieveConnection(
-	grpcAddress string,
-	timeout time.Duration,
-	clientType clientType,
-	networkPubKey crypto.PublicKey,
-) (*grpc.ClientConn, error) {
-	client, ok := m.cache.GetOrAdd(grpcAddress, timeout)
-	if ok {
-		// The client was retrieved from the cache, wait for the lock
-		client.mu.Lock()
-		if m.metrics != nil {
-			m.metrics.ConnectionFromPoolReused()
-		}
-	} else {
-		// The client is new, lock is already held
-		if m.metrics != nil {
-			m.metrics.ConnectionAddedToPool()
-		}
-	}
-	defer client.mu.Unlock()
-
-	if client.ClientConn != nil && client.ClientConn.GetState() != connectivity.Shutdown {
-		// Return the client connection from the cache
-		return client.ClientConn, nil
-	}
-
-	// The connection is not cached or is closed, create a new connection and cache it
-	conn, err := m.createConnection(grpcAddress, timeout, client, clientType, networkPubKey)
-	if err != nil {
-		return nil, err
-	}
-
-	client.ClientConn = conn
-	if m.metrics != nil {
-		m.metrics.NewConnectionEstablished()
-		m.metrics.TotalConnectionsInPool(uint(m.cache.Len()), uint(m.cache.MaxSize()))
-	}
-
-	return client.ClientConn, nil
-}
-
 // createConnection creates a new gRPC connection to the remote node at the given address with the specified timeout.
 // If the cachedClient is not nil, it means a new entry in the cache is being created, so it's locked to give priority
 // to the caller working with the new client, allowing it to create the underlying connection.
@@ -192,9 +109,8 @@ func (m *Manager) retrieveConnection(
 func (m *Manager) createConnection(
 	address string,
 	timeout time.Duration,
-	cachedClient *CachedClient,
-	clientType clientType,
 	networkPubKey crypto.PublicKey,
+	cachedClient *CachedClient,
 ) (*grpc.ClientConn, error) {
 	if timeout == 0 {
 		timeout = DefaultClientTimeout
@@ -210,8 +126,8 @@ func (m *Manager) createConnection(
 	// https://grpc.io/blog/grpc-web-interceptor/#binding-interceptors
 	var connInterceptors []grpc.UnaryClientInterceptor
 
-	if !m.circuitBreakerConfig.Enabled {
-		connInterceptors = append(connInterceptors, m.createClientInvalidationInterceptor(address, clientType))
+	if !m.circuitBreakerConfig.Enabled && cachedClient != nil {
+		connInterceptors = append(connInterceptors, m.createClientInvalidationInterceptor(cachedClient))
 	}
 
 	connInterceptors = append(connInterceptors, createClientTimeoutInterceptor(timeout))
@@ -272,13 +188,13 @@ func createRequestWatcherInterceptor(cachedClient *CachedClient) grpc.UnaryClien
 		opts ...grpc.CallOption,
 	) error {
 		// Prevent new requests from being sent if the connection is marked for closure.
-		if cachedClient.closeRequested.Load() {
-			return status.Errorf(codes.Unavailable, "the connection to %s was closed", cachedClient.Address)
+		if cachedClient.CloseRequested() {
+			return status.Errorf(codes.Unavailable, "the connection to %s was closed", cachedClient.Address())
 		}
 
 		// Increment the request counter to track ongoing requests, then decrement the request counter before returning.
-		cachedClient.wg.Add(1)
-		defer cachedClient.wg.Done()
+		done := cachedClient.AddRequest()
+		defer done()
 
 		// Invoke the actual RPC method.
 		return invoker(ctx, method, req, reply, cc, opts...)
@@ -320,49 +236,23 @@ func createClientTimeoutInterceptor(timeout time.Duration) grpc.UnaryClientInter
 // createClientInvalidationInterceptor creates a client interceptor for client invalidation. It should only be created
 // if the circuit breaker is disabled. If the response from the server indicates an unavailable status, it invalidates
 // the corresponding client.
-func (m *Manager) createClientInvalidationInterceptor(
-	address string,
-	clientType clientType,
-) grpc.UnaryClientInterceptor {
-	if !m.circuitBreakerConfig.Enabled {
-		clientInvalidationInterceptor := func(
-			ctx context.Context,
-			method string,
-			req interface{},
-			reply interface{},
-			cc *grpc.ClientConn,
-			invoker grpc.UnaryInvoker,
-			opts ...grpc.CallOption,
-		) error {
-			err := invoker(ctx, method, req, reply, cc, opts...)
-			if status.Code(err) == codes.Unavailable {
-				switch clientType {
-				case AccessClient:
-					if m.Remove(address) {
-						m.logger.Debug().Str("cached_access_client_invalidated", address).Msg("invalidating cached access client")
-						if m.metrics != nil {
-							m.metrics.ConnectionFromPoolInvalidated()
-						}
-					}
-				case ExecutionClient:
-					if m.Remove(address) {
-						m.logger.Debug().Str("cached_execution_client_invalidated", address).Msg("invalidating cached execution client")
-						if m.metrics != nil {
-							m.metrics.ConnectionFromPoolInvalidated()
-						}
-					}
-				default:
-					m.logger.Info().Str("client_invalidation_interceptor", address).Msg(fmt.Sprintf("unexpected client type: %d", clientType))
-				}
-			}
-
-			return err
+func (m *Manager) createClientInvalidationInterceptor(cachedClient *CachedClient) grpc.UnaryClientInterceptor {
+	return func(
+		ctx context.Context,
+		method string,
+		req interface{},
+		reply interface{},
+		cc *grpc.ClientConn,
+		invoker grpc.UnaryInvoker,
+		opts ...grpc.CallOption,
+	) error {
+		err := invoker(ctx, method, req, reply, cc, opts...)
+		if status.Code(err) == codes.Unavailable {
+			cachedClient.Invalidate()
 		}
 
-		return clientInvalidationInterceptor
+		return err
 	}
-
-	return nil
 }
 
 // The simplified representation and description of circuit breaker pattern, that used to handle node connectivity:
diff --git a/engine/access/rpc/engine.go b/engine/access/rpc/engine.go
index 4137a1ad976..17f38304dce 100644
--- a/engine/access/rpc/engine.go
+++ b/engine/access/rpc/engine.go
@@ -177,7 +177,22 @@ func (e *Engine) OnFinalizedBlock(block *model.Block) {
 // No errors expected during normal operations.
 func (e *Engine) processOnFinalizedBlock(_ *model.Block) error {
 	finalizedHeader := e.finalizedHeaderCache.Get()
-	return e.backend.ProcessFinalizedBlockHeight(finalizedHeader.Height)
+
+	var err error
+	// NOTE: The BlockTracker is currently only used by the access node and not by the observer node.
+	if e.backend.BlockTracker != nil {
+		err = e.backend.BlockTracker.ProcessOnFinalizedBlock()
+		if err != nil {
+			return err
+		}
+	}
+
+	err = e.backend.ProcessFinalizedBlockHeight(finalizedHeader.Height)
+	if err != nil {
+		return fmt.Errorf("could not process finalized block height %d: %w", finalizedHeader.Height, err)
+	}
+
+	return nil
 }
 
 // RestApiAddress returns the listen address of the REST API server.
diff --git a/engine/access/rpc/engine_builder.go b/engine/access/rpc/engine_builder.go
index 370f3d0fff4..718cd61db36 100644
--- a/engine/access/rpc/engine_builder.go
+++ b/engine/access/rpc/engine_builder.go
@@ -78,6 +78,14 @@ func (builder *RPCEngineBuilder) WithLegacy() *RPCEngineBuilder {
 	return builder
 }
 
+func (builder *RPCEngineBuilder) DefaultHandler(signerIndicesDecoder hotstuff.BlockSignerDecoder) *access.Handler {
+	if signerIndicesDecoder == nil {
+		return access.NewHandler(builder.Engine.backend, builder.Engine.chain, builder.finalizedHeaderCache, builder.me, builder.stateStreamConfig.MaxGlobalStreams)
+	} else {
+		return access.NewHandler(builder.Engine.backend, builder.Engine.chain, builder.finalizedHeaderCache, builder.me, builder.stateStreamConfig.MaxGlobalStreams, access.WithBlockSignerDecoder(signerIndicesDecoder))
+	}
+}
+
 // WithMetrics specifies the metrics should be collected.
 // Returns self-reference for chaining.
 func (builder *RPCEngineBuilder) WithMetrics() *RPCEngineBuilder {
@@ -94,11 +102,7 @@ func (builder *RPCEngineBuilder) Build() (*Engine, error) {
 	}
 	rpcHandler := builder.rpcHandler
 	if rpcHandler == nil {
-		if builder.signerIndicesDecoder == nil {
-			rpcHandler = access.NewHandler(builder.Engine.backend, builder.Engine.chain, builder.finalizedHeaderCache, builder.me)
-		} else {
-			rpcHandler = access.NewHandler(builder.Engine.backend, builder.Engine.chain, builder.finalizedHeaderCache, builder.me, access.WithBlockSignerDecoder(builder.signerIndicesDecoder))
-		}
+		rpcHandler = builder.DefaultHandler(builder.signerIndicesDecoder)
 	}
 	accessproto.RegisterAccessAPIServer(builder.unsecureGrpcServer.Server, rpcHandler)
 	accessproto.RegisterAccessAPIServer(builder.secureGrpcServer.Server, rpcHandler)
diff --git a/engine/access/state_stream/account_status_filter.go b/engine/access/state_stream/account_status_filter.go
new file mode 100644
index 00000000000..b1150df584d
--- /dev/null
+++ b/engine/access/state_stream/account_status_filter.go
@@ -0,0 +1,226 @@
+package state_stream
+
+import (
+	"fmt"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/model/flow"
+)
+
+// Core event types based on documentation https://cadence-lang.org/docs/language/core-events
+const (
+	// CoreEventAccountCreated is emitted when a new account gets created
+	CoreEventAccountCreated = "flow.AccountCreated"
+
+	// CoreEventAccountKeyAdded is emitted when a key gets added to an account
+	CoreEventAccountKeyAdded = "flow.AccountKeyAdded"
+
+	// CoreEventAccountKeyRemoved is emitted when a key gets removed from an account
+	CoreEventAccountKeyRemoved = "flow.AccountKeyRemoved"
+
+	// CoreEventAccountContractAdded is emitted when a contract gets deployed to an account
+	CoreEventAccountContractAdded = "flow.AccountContractAdded"
+
+	// CoreEventAccountContractUpdated is emitted when a contract gets updated on an account
+	CoreEventAccountContractUpdated = "flow.AccountContractUpdated"
+
+	// CoreEventAccountContractRemoved is emitted when a contract gets removed from an account
+	CoreEventAccountContractRemoved = "flow.AccountContractRemoved"
+
+	// CoreEventInboxValuePublished is emitted when a Capability is published from an account
+	CoreEventInboxValuePublished = "flow.InboxValuePublished"
+
+	// CoreEventInboxValueUnpublished is emitted when a Capability is unpublished from an account
+	CoreEventInboxValueUnpublished = "flow.InboxValueUnpublished"
+
+	// CoreEventInboxValueClaimed is emitted when a Capability is claimed by an account
+	CoreEventInboxValueClaimed = "flow.InboxValueClaimed"
+)
+
+var defaultCoreEventsMap map[string]map[string]struct{}
+
+func init() {
+	defaultCoreEventsMap = make(map[string]map[string]struct{}, len(DefaultCoreEvents))
+
+	addFilter := func(eventType, field string) {
+		if _, ok := defaultCoreEventsMap[eventType]; !ok {
+			defaultCoreEventsMap[eventType] = make(map[string]struct{})
+		}
+		defaultCoreEventsMap[eventType][field] = struct{}{}
+	}
+
+	for _, eventType := range DefaultCoreEvents {
+		switch eventType {
+		case CoreEventAccountCreated,
+			CoreEventAccountKeyAdded,
+			CoreEventAccountKeyRemoved,
+			CoreEventAccountContractAdded,
+			CoreEventAccountContractUpdated,
+			CoreEventAccountContractRemoved:
+			addFilter(eventType, "address")
+		case CoreEventInboxValuePublished,
+			CoreEventInboxValueClaimed:
+			addFilter(eventType, "provider")
+			addFilter(eventType, "recipient")
+		case CoreEventInboxValueUnpublished:
+			addFilter(eventType, "provider")
+		default:
+			panic(fmt.Errorf("unsupported event type: %s", eventType))
+		}
+	}
+}
+
+// DefaultCoreEvents is an array containing all default core event types.
+var DefaultCoreEvents = []string{
+	CoreEventAccountCreated,
+	CoreEventAccountKeyAdded,
+	CoreEventAccountKeyRemoved,
+	CoreEventAccountContractAdded,
+	CoreEventAccountContractUpdated,
+	CoreEventAccountContractRemoved,
+	CoreEventInboxValuePublished,
+	CoreEventInboxValueUnpublished,
+	CoreEventInboxValueClaimed,
+}
+
+// AccountStatusFilter defines a specific filter for account statuses.
+// It embeds the EventFilter type to inherit its functionality.
+type AccountStatusFilter struct {
+	*EventFilter
+}
+
+// NewAccountStatusFilter creates a new AccountStatusFilter based on the provided configuration.
+// Expected errors:
+// - error: An error, if any, encountered during core event type validating, check for max account addresses
+// or validating account addresses.
+func NewAccountStatusFilter(
+	config EventFilterConfig,
+	chain flow.Chain,
+	eventTypes []string,
+	accountAddresses []string,
+) (AccountStatusFilter, error) {
+	if len(accountAddresses) == 0 {
+		// If `accountAddresses` is empty, the validation on `addCoreEventFieldFilter` would not happen.
+		// Therefore, event types are validated with `validateCoreEventTypes` to fail at the beginning of filter creation.
+		err := validateCoreEventTypes(eventTypes)
+		if err != nil {
+			return AccountStatusFilter{}, err
+		}
+	} else if len(accountAddresses) > DefaultMaxAccountAddresses {
+		// If `accountAddresses` exceeds the `DefaultAccountAddressesLimit`, it returns an error.
+		return AccountStatusFilter{}, fmt.Errorf("account limit exceeds, the limit is %d", DefaultMaxAccountAddresses)
+	}
+
+	// If `eventTypes` is empty, the filter returns all core events for any accounts.
+	if len(eventTypes) == 0 {
+		eventTypes = DefaultCoreEvents
+	}
+
+	//  It's important to only set eventTypes if there are no addresses passed.
+	var filterEventTypes []string
+	if len(accountAddresses) == 0 {
+		filterEventTypes = eventTypes
+	}
+
+	// Creates an `EventFilter` with the provided `eventTypes`.
+	filter, err := NewEventFilter(config, chain, filterEventTypes, []string{}, []string{})
+	if err != nil {
+		return AccountStatusFilter{}, err
+	}
+
+	accountStatusFilter := AccountStatusFilter{
+		EventFilter: &filter,
+	}
+
+	for _, address := range accountAddresses {
+		// Validate account address
+		addr := flow.HexToAddress(address)
+		if err := validateAddress(addr, chain); err != nil {
+			return AccountStatusFilter{}, err
+		}
+
+		// If there are non-core event types at this stage, it returns an error from `addCoreEventFieldFilter`.
+		for _, eventType := range eventTypes {
+			// use the hex with prefix address to make sure it will match the cadence address
+			err = accountStatusFilter.addCoreEventFieldFilter(flow.EventType(eventType), addr.HexWithPrefix())
+			if err != nil {
+				return AccountStatusFilter{}, err
+			}
+		}
+	}
+
+	// We need to set hasFilters here if filterEventTypes was empty
+	accountStatusFilter.hasFilters = len(accountStatusFilter.EventFieldFilters) > 0 || len(eventTypes) > 0
+
+	return accountStatusFilter, nil
+}
+
+// GroupCoreEventsByAccountAddress extracts account-related core events from the provided list of events.
+// It filters events based on the account field specified by the event type and organizes them by account address.
+// Parameters:
+// - events: The list of events to extract account-related core events from.
+// - log: The logger to log errors encountered during event decoding and processing.
+// Returns:
+//   - A map[string]flow.EventsList: A map where the key is the account address and the value is a list of
+//     account-related core events associated with that address.
+func (f *AccountStatusFilter) GroupCoreEventsByAccountAddress(events flow.EventsList, log zerolog.Logger) map[string]flow.EventsList {
+	allAccountProtocolEvents := make(map[string]flow.EventsList)
+
+	for _, event := range events {
+		fields, fieldValues, err := getEventFields(&event)
+		if err != nil {
+			log.Info().Err(err).Msg("could not get event fields")
+			continue
+		}
+
+		//accountField := f.EventFieldFilters[event.Type]
+		accountField := defaultCoreEventsMap[string(event.Type)]
+		for i, field := range fields {
+			_, ok := accountField[field.Identifier]
+			if ok {
+				address := fieldValues[i].String()
+				allAccountProtocolEvents[address] = append(allAccountProtocolEvents[address], event)
+			}
+		}
+	}
+
+	return allAccountProtocolEvents
+}
+
+// addCoreEventFieldFilter adds a field filter for each core event type
+func (f *AccountStatusFilter) addCoreEventFieldFilter(eventType flow.EventType, address string) error {
+	// Get the field associated with the event type from the defaultCoreEventsMap
+	fields, ok := defaultCoreEventsMap[string(eventType)]
+	if !ok {
+		return fmt.Errorf("unsupported event type: %s", eventType)
+	}
+
+	// Add the field filter for each field associated with the event type
+	for field := range fields {
+		if _, ok := f.EventFieldFilters[eventType]; !ok {
+			f.EventFieldFilters[eventType] = make(FieldFilter)
+		}
+		if _, ok := f.EventFieldFilters[eventType][field]; !ok {
+			f.EventFieldFilters[eventType][field] = make(map[string]struct{})
+		}
+		f.EventFieldFilters[eventType][field][address] = struct{}{}
+	}
+
+	return nil
+}
+
+// validateCoreEventTypes validates the provided event types against the default core event types.
+// It returns an error if any of the provided event types are not in the default core event types list. Note, an empty
+// event types array is also valid.
+func validateCoreEventTypes(eventTypes []string) error {
+	for _, eventType := range eventTypes {
+		_, ok := defaultCoreEventsMap[eventType]
+		// If the provided event type does not match any of the default core event types, return an error
+		if !ok {
+			return fmt.Errorf("invalid provided event types for filter")
+		}
+	}
+
+	return nil // All provided event types are valid core event types or event types are empty
+}
diff --git a/engine/access/state_stream/account_status_filter_test.go b/engine/access/state_stream/account_status_filter_test.go
new file mode 100644
index 00000000000..0186f0b5239
--- /dev/null
+++ b/engine/access/state_stream/account_status_filter_test.go
@@ -0,0 +1,152 @@
+package state_stream_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/utils/unittest"
+	"github.com/onflow/flow-go/utils/unittest/generator"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/onflow/flow-go/engine/access/state_stream"
+	"github.com/onflow/flow-go/model/flow"
+)
+
+// TestAccountStatusFilterConstructor tests the constructor of the AccountStatusFilter with different scenarios.
+func TestAccountStatusFilterConstructor(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name             string
+		eventTypes       []string
+		accountAddresses []string
+		err              bool
+	}{
+		{
+			name: "no filters, no addresses",
+		},
+		{
+			name:       "valid filters, no addresses",
+			eventTypes: []string{state_stream.CoreEventAccountCreated, state_stream.CoreEventAccountContractAdded, state_stream.CoreEventInboxValueClaimed},
+		},
+		{
+			name:       "invalid filters, no addresses",
+			eventTypes: []string{state_stream.CoreEventAccountCreated, "A.0000000000000001.Contract1.EventA"},
+			err:        true,
+		},
+		{
+			name:             "no filters, valid addresses",
+			accountAddresses: []string{"0x0000000000000001", "0x0000000000000002", "0x0000000000000003"},
+		},
+		{
+			name:             "valid filters, valid addresses",
+			eventTypes:       []string{state_stream.CoreEventAccountCreated, state_stream.CoreEventAccountContractAdded, state_stream.CoreEventInboxValueClaimed},
+			accountAddresses: []string{"0x0000000000000001", "0x0000000000000002", "0x0000000000000003"},
+		},
+		{
+			name:             "invalid filters, valid addresses",
+			eventTypes:       []string{state_stream.CoreEventAccountCreated, "A.0000000000000001.Contract1.EventA"},
+			accountAddresses: []string{"0x0000000000000001", "0x0000000000000002", "0x0000000000000003"},
+			err:              true,
+		},
+		{
+			name:             "valid filters, invalid addresses",
+			eventTypes:       []string{state_stream.CoreEventAccountCreated, state_stream.CoreEventAccountContractAdded, state_stream.CoreEventInboxValueClaimed},
+			accountAddresses: []string{"invalid"},
+			err:              true,
+		},
+	}
+
+	chain := flow.MonotonicEmulator.Chain()
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			filter, err := state_stream.NewAccountStatusFilter(state_stream.DefaultEventFilterConfig, chain, test.eventTypes, test.accountAddresses)
+
+			if test.err {
+				assert.Error(t, err)
+				assert.Equal(t, filter, state_stream.AccountStatusFilter{})
+			} else {
+				assert.NoError(t, err)
+
+				if len(test.eventTypes) == 0 {
+					if len(test.accountAddresses) > 0 {
+						assert.Equal(t, 0, len(filter.EventTypes))
+					} else {
+						assert.Equal(t, len(state_stream.DefaultCoreEvents), len(filter.EventTypes))
+					}
+				}
+
+				for key := range filter.EventTypes {
+					switch key {
+					case state_stream.CoreEventAccountCreated,
+						state_stream.CoreEventAccountContractAdded:
+						actualAccountValues := filter.EventFieldFilters[key]["address"]
+						assert.Equal(t, len(test.accountAddresses), len(actualAccountValues))
+						for _, address := range test.accountAddresses {
+							_, ok := actualAccountValues[address]
+							assert.True(t, ok)
+						}
+					case state_stream.CoreEventInboxValueClaimed:
+						actualAccountValues := filter.EventFieldFilters[key]["provider"]
+						assert.Equal(t, len(test.accountAddresses), len(actualAccountValues))
+						for _, address := range test.accountAddresses {
+							_, ok := actualAccountValues[address]
+							assert.True(t, ok)
+						}
+					}
+				}
+			}
+		})
+	}
+}
+
+// TestAccountStatusFilterFiltering tests the filtering mechanism of the AccountStatusFilter.
+// It verifies that the filter correctly filters the events based on the provided event types and account addresses.
+func TestAccountStatusFilterFiltering(t *testing.T) {
+	chain := flow.MonotonicEmulator.Chain()
+
+	filterEventTypes := []string{state_stream.CoreEventAccountCreated, state_stream.CoreEventAccountContractAdded}
+
+	addressGenerator := chain.NewAddressGenerator()
+	addressAccountCreate, err := addressGenerator.NextAddress()
+	require.NoError(t, err)
+
+	accountContractAddedAddress, err := addressGenerator.NextAddress()
+	require.NoError(t, err)
+
+	filter, err := state_stream.NewAccountStatusFilter(
+		state_stream.DefaultEventFilterConfig,
+		chain,
+		filterEventTypes,
+		[]string{addressAccountCreate.HexWithPrefix(), accountContractAddedAddress.HexWithPrefix()},
+	)
+	require.NoError(t, err)
+
+	accountCreateEvent := generator.GenerateAccountCreateEvent(t, addressAccountCreate)
+	accountContractAdded := generator.GenerateAccountContractEvent(t, "AccountContractAdded", accountContractAddedAddress)
+
+	events := flow.EventsList{
+		unittest.EventFixture("A.0000000000000001.Contract1.EventA", 0, 0, unittest.IdentifierFixture(), 0),
+		accountCreateEvent,
+		unittest.EventFixture("A.0000000000000001.Contract2.EventA", 0, 0, unittest.IdentifierFixture(), 0),
+		accountContractAdded,
+	}
+
+	matched := filter.Filter(events)
+	matchedByAddress := filter.GroupCoreEventsByAccountAddress(matched, unittest.Logger())
+
+	assert.Len(t, matched, 2)
+
+	assert.Equal(t, events[1], matched[0])
+	matchAccCreated, ok := matchedByAddress[addressAccountCreate.HexWithPrefix()]
+	require.True(t, ok)
+	assert.Equal(t, flow.EventsList{accountCreateEvent}, matchAccCreated)
+
+	assert.Equal(t, events[3], matched[1])
+	matchContractAdded, ok := matchedByAddress[accountContractAddedAddress.HexWithPrefix()]
+	require.True(t, ok)
+	assert.Equal(t, flow.EventsList{accountContractAdded}, matchContractAdded)
+}
diff --git a/engine/access/state_stream/backend/backend.go b/engine/access/state_stream/backend/backend.go
index f2a35ebe97d..bfa7659cd70 100644
--- a/engine/access/state_stream/backend/backend.go
+++ b/engine/access/state_stream/backend/backend.go
@@ -9,12 +9,11 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	"github.com/onflow/flow-go/engine"
+	"github.com/onflow/flow-go/engine/access/index"
 	"github.com/onflow/flow-go/engine/access/state_stream"
-	"github.com/onflow/flow-go/engine/common/rpc"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/fvm/errors"
 	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/module/counters"
 	"github.com/onflow/flow-go/module/execution"
 	"github.com/onflow/flow-go/module/executiondatasync/execution_data"
 	"github.com/onflow/flow-go/module/executiondatasync/execution_data/cache"
@@ -61,11 +60,13 @@ type Config struct {
 }
 
 type GetExecutionDataFunc func(context.Context, uint64) (*execution_data.BlockExecutionDataEntity, error)
-type GetStartHeightFunc func(flow.Identifier, uint64) (uint64, error)
 
 type StateStreamBackend struct {
+	subscription.ExecutionDataTracker
+
 	ExecutionDataBackend
 	EventsBackend
+	AccountStatusesBackend
 
 	log                  zerolog.Logger
 	state                protocol.State
@@ -74,42 +75,29 @@ type StateStreamBackend struct {
 	results              storage.ExecutionResults
 	execDataStore        execution_data.ExecutionDataStore
 	execDataCache        *cache.ExecutionDataCache
-	broadcaster          *engine.Broadcaster
-	rootBlockHeight      uint64
-	rootBlockID          flow.Identifier
 	registers            *execution.RegistersAsyncStore
 	registerRequestLimit int
-
-	// highestHeight contains the highest consecutive block height for which we have received a
-	// new Execution Data notification.
-	highestHeight counters.StrictMonotonousCounter
 }
 
 func New(
 	log zerolog.Logger,
-	config Config,
 	state protocol.State,
 	headers storage.Headers,
-	events storage.Events,
 	seals storage.Seals,
 	results storage.ExecutionResults,
 	execDataStore execution_data.ExecutionDataStore,
 	execDataCache *cache.ExecutionDataCache,
-	broadcaster *engine.Broadcaster,
-	rootHeight uint64,
-	highestAvailableHeight uint64,
 	registers *execution.RegistersAsyncStore,
+	eventsIndex *index.EventsIndex,
 	useEventsIndex bool,
+	registerIDsRequestLimit int,
+	subscriptionHandler *subscription.SubscriptionHandler,
+	executionDataTracker subscription.ExecutionDataTracker,
 ) (*StateStreamBackend, error) {
 	logger := log.With().Str("module", "state_stream_api").Logger()
 
-	// cache the root block height and ID for runtime lookups.
-	rootBlockID, err := headers.BlockIDByHeight(rootHeight)
-	if err != nil {
-		return nil, fmt.Errorf("could not get root block ID: %w", err)
-	}
-
 	b := &StateStreamBackend{
+		ExecutionDataTracker: executionDataTracker,
 		log:                  logger,
 		state:                state,
 		headers:              headers,
@@ -117,36 +105,38 @@ func New(
 		results:              results,
 		execDataStore:        execDataStore,
 		execDataCache:        execDataCache,
-		broadcaster:          broadcaster,
-		rootBlockHeight:      rootHeight,
-		rootBlockID:          rootBlockID,
 		registers:            registers,
-		registerRequestLimit: int(config.RegisterIDsRequestLimit),
-		highestHeight:        counters.NewMonotonousCounter(highestAvailableHeight),
+		registerRequestLimit: registerIDsRequestLimit,
 	}
 
 	b.ExecutionDataBackend = ExecutionDataBackend{
+		log:                  logger,
+		headers:              headers,
+		subscriptionHandler:  subscriptionHandler,
+		getExecutionData:     b.getExecutionData,
+		executionDataTracker: executionDataTracker,
+	}
+
+	eventsRetriever := EventsRetriever{
 		log:              logger,
 		headers:          headers,
-		broadcaster:      broadcaster,
-		sendTimeout:      config.ClientSendTimeout,
-		responseLimit:    config.ResponseLimit,
-		sendBufferSize:   int(config.ClientSendBufferSize),
 		getExecutionData: b.getExecutionData,
-		getStartHeight:   b.getStartHeight,
+		useEventsIndex:   useEventsIndex,
+		eventsIndex:      eventsIndex,
 	}
 
 	b.EventsBackend = EventsBackend{
-		log:              logger,
-		events:           events,
-		headers:          headers,
-		broadcaster:      broadcaster,
-		sendTimeout:      config.ClientSendTimeout,
-		responseLimit:    config.ResponseLimit,
-		sendBufferSize:   int(config.ClientSendBufferSize),
-		getExecutionData: b.getExecutionData,
-		getStartHeight:   b.getStartHeight,
-		useIndex:         useEventsIndex,
+		log:                  logger,
+		subscriptionHandler:  subscriptionHandler,
+		executionDataTracker: executionDataTracker,
+		eventsRetriever:      eventsRetriever,
+	}
+
+	b.AccountStatusesBackend = AccountStatusesBackend{
+		log:                  logger,
+		subscriptionHandler:  subscriptionHandler,
+		executionDataTracker: b.ExecutionDataTracker,
+		eventsRetriever:      eventsRetriever,
 	}
 
 	return b, nil
@@ -156,10 +146,11 @@ func New(
 // Expected errors during normal operation:
 // - storage.ErrNotFound or execution_data.BlobNotFoundError: execution data for the given block height is not available.
 func (b *StateStreamBackend) getExecutionData(ctx context.Context, height uint64) (*execution_data.BlockExecutionDataEntity, error) {
+	highestHeight := b.ExecutionDataTracker.GetHighestHeight()
 	// fail early if no notification has been received for the given block height.
 	// note: it's possible for the data to exist in the data store before the notification is
 	// received. this ensures a consistent view is available to all streams.
-	if height > b.highestHeight.Value() {
+	if height > highestHeight {
 		return nil, fmt.Errorf("execution data for block %d is not available yet: %w", height, storage.ErrNotFound)
 	}
 
@@ -171,63 +162,6 @@ func (b *StateStreamBackend) getExecutionData(ctx context.Context, height uint64
 	return execData, nil
 }
 
-// getStartHeight returns the start height to use when searching.
-// Only one of startBlockID and startHeight may be set. Otherwise, an InvalidArgument error is returned.
-// If a block is provided and does not exist, a NotFound error is returned.
-// If neither startBlockID nor startHeight is provided, the latest sealed block is used.
-func (b *StateStreamBackend) getStartHeight(startBlockID flow.Identifier, startHeight uint64) (uint64, error) {
-	// make sure only one of start block ID and start height is provided
-	if startBlockID != flow.ZeroID && startHeight > 0 {
-		return 0, status.Errorf(codes.InvalidArgument, "only one of start block ID and start height may be provided")
-	}
-
-	// if the start block is the root block, there will not be an execution data. skip it and
-	// begin from the next block.
-	// Note: we can skip the block lookup since it was already done in the constructor
-	if startBlockID == b.rootBlockID ||
-		// Note: there is a corner case when rootBlockHeight == 0:
-		// since the default value of an uint64 is 0, when checking if startHeight matches the root block
-		// we also need to check that startBlockID is unset, otherwise we may incorrectly set the start height
-		// for non-matching startBlockIDs.
-		(startHeight == b.rootBlockHeight && startBlockID == flow.ZeroID) {
-		return b.rootBlockHeight + 1, nil
-	}
-
-	// invalid or missing block IDs will result in an error
-	if startBlockID != flow.ZeroID {
-		header, err := b.headers.ByBlockID(startBlockID)
-		if err != nil {
-			return 0, rpc.ConvertStorageError(fmt.Errorf("could not get header for block %v: %w", startBlockID, err))
-		}
-		return header.Height, nil
-	}
-
-	// heights that have not been indexed yet will result in an error
-	if startHeight > 0 {
-		if startHeight < b.rootBlockHeight {
-			return 0, status.Errorf(codes.InvalidArgument, "start height must be greater than or equal to the root height %d", b.rootBlockHeight)
-		}
-
-		header, err := b.headers.ByHeight(startHeight)
-		if err != nil {
-			return 0, rpc.ConvertStorageError(fmt.Errorf("could not get header for height %d: %w", startHeight, err))
-		}
-		return header.Height, nil
-	}
-
-	// if no start block was provided, use the latest sealed block
-	header, err := b.state.Sealed().Head()
-	if err != nil {
-		return 0, status.Errorf(codes.Internal, "could not get latest sealed block: %v", err)
-	}
-	return header.Height, nil
-}
-
-// setHighestHeight sets the highest height for which execution data is available.
-func (b *StateStreamBackend) setHighestHeight(height uint64) bool {
-	return b.highestHeight.Set(height)
-}
-
 // GetRegisterValues returns the register values for the given register IDs at the given block height.
 func (b *StateStreamBackend) GetRegisterValues(ids flow.RegisterIDs, height uint64) ([]flow.RegisterValue, error) {
 	if len(ids) > b.registerRequestLimit {
diff --git a/engine/access/state_stream/backend/backend_account_statuses.go b/engine/access/state_stream/backend/backend_account_statuses.go
new file mode 100644
index 00000000000..3e408f02f96
--- /dev/null
+++ b/engine/access/state_stream/backend/backend_account_statuses.go
@@ -0,0 +1,104 @@
+package backend
+
+import (
+	"context"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/engine/access/state_stream"
+	"github.com/onflow/flow-go/engine/access/subscription"
+	"github.com/onflow/flow-go/model/flow"
+)
+
+type AccountStatusesResponse struct {
+	BlockID       flow.Identifier
+	Height        uint64
+	AccountEvents map[string]flow.EventsList
+}
+
+// AccountStatusesBackend is a struct representing a backend implementation for subscribing to account statuses changes.
+type AccountStatusesBackend struct {
+	log                 zerolog.Logger
+	subscriptionHandler *subscription.SubscriptionHandler
+
+	executionDataTracker subscription.ExecutionDataTracker
+	eventsRetriever      EventsRetriever
+}
+
+// subscribe creates and returns a subscription to receive account status updates starting from the specified height.
+func (b *AccountStatusesBackend) subscribe(
+	ctx context.Context,
+	nextHeight uint64,
+	filter state_stream.AccountStatusFilter,
+) subscription.Subscription {
+	return b.subscriptionHandler.Subscribe(ctx, nextHeight, b.getAccountStatusResponseFactory(filter))
+}
+
+// SubscribeAccountStatusesFromStartBlockID subscribes to the streaming of account status changes starting from
+// a specific block ID with an optional status filter.
+// Errors:
+// - codes.ErrNotFound if could not get block by start blockID.
+// - codes.Internal if there is an internal error.
+func (b *AccountStatusesBackend) SubscribeAccountStatusesFromStartBlockID(
+	ctx context.Context,
+	startBlockID flow.Identifier,
+	filter state_stream.AccountStatusFilter,
+) subscription.Subscription {
+	nextHeight, err := b.executionDataTracker.GetStartHeightFromBlockID(startBlockID)
+	if err != nil {
+		return subscription.NewFailedSubscription(err, "could not get start height from block id")
+	}
+	return b.subscribe(ctx, nextHeight, filter)
+}
+
+// SubscribeAccountStatusesFromStartHeight subscribes to the streaming of account status changes starting from
+// a specific block height, with an optional status filter.
+// Errors:
+// - codes.ErrNotFound if could not get block by  start height.
+// - codes.Internal if there is an internal error.
+func (b *AccountStatusesBackend) SubscribeAccountStatusesFromStartHeight(
+	ctx context.Context,
+	startHeight uint64,
+	filter state_stream.AccountStatusFilter,
+) subscription.Subscription {
+	nextHeight, err := b.executionDataTracker.GetStartHeightFromHeight(startHeight)
+	if err != nil {
+		return subscription.NewFailedSubscription(err, "could not get start height from block height")
+	}
+	return b.subscribe(ctx, nextHeight, filter)
+}
+
+// SubscribeAccountStatusesFromLatestBlock subscribes to the streaming of account status changes starting from a
+// latest sealed block, with an optional status filter.
+//
+// No errors are expected during normal operation.
+func (b *AccountStatusesBackend) SubscribeAccountStatusesFromLatestBlock(
+	ctx context.Context,
+	filter state_stream.AccountStatusFilter,
+) subscription.Subscription {
+	nextHeight, err := b.executionDataTracker.GetStartHeightFromLatest(ctx)
+	if err != nil {
+		return subscription.NewFailedSubscription(err, "could not get start height from latest")
+	}
+	return b.subscribe(ctx, nextHeight, filter)
+}
+
+// getAccountStatusResponseFactory returns a function that returns the account statuses response for a given height.
+func (b *AccountStatusesBackend) getAccountStatusResponseFactory(
+	filter state_stream.AccountStatusFilter,
+) subscription.GetDataByHeightFunc {
+	return func(ctx context.Context, height uint64) (interface{}, error) {
+		eventsResponse, err := b.eventsRetriever.GetAllEventsResponse(ctx, height)
+		if err != nil {
+			return nil, err
+		}
+		filteredProtocolEvents := filter.Filter(eventsResponse.Events)
+		allAccountProtocolEvents := filter.GroupCoreEventsByAccountAddress(filteredProtocolEvents, b.log)
+
+		return &AccountStatusesResponse{
+			BlockID:       eventsResponse.BlockID,
+			Height:        eventsResponse.Height,
+			AccountEvents: allAccountProtocolEvents,
+		}, nil
+	}
+}
diff --git a/engine/access/state_stream/backend/backend_account_statuses_test.go b/engine/access/state_stream/backend/backend_account_statuses_test.go
new file mode 100644
index 00000000000..b48cda79f75
--- /dev/null
+++ b/engine/access/state_stream/backend/backend_account_statuses_test.go
@@ -0,0 +1,456 @@
+package backend
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/onflow/flow-go/engine/access/state_stream"
+	"github.com/onflow/flow-go/engine/access/subscription"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/executiondatasync/execution_data"
+	"github.com/onflow/flow-go/utils/unittest"
+	"github.com/onflow/flow-go/utils/unittest/generator"
+)
+
+var testProtocolEventTypes = []flow.EventType{
+	state_stream.CoreEventAccountCreated,
+	state_stream.CoreEventAccountContractAdded,
+	state_stream.CoreEventAccountContractUpdated,
+}
+
+// Define the test type struct
+// The struct is used for testing different test cases of each endpoint from AccountStatusesBackend.
+type testType struct {
+	name            string // Test case name
+	highestBackfill int    // Highest backfill index
+	startValue      interface{}
+	filters         state_stream.AccountStatusFilter // Event filters
+}
+
+// BackendAccountStatusesSuite is a test suite for the AccountStatusesBackend functionality.
+// It is used to test the endpoints which enables users to subscribe to the streaming of account status changes.
+// It verified that each of endpoints works properly with expected data being returned. Also the suite tests
+// handling of expected errors in the SubscribeAccountStatuses.
+type BackendAccountStatusesSuite struct {
+	BackendExecutionDataSuite
+	accountCreatedAddress  flow.Address
+	accountContractAdded   flow.Address
+	accountContractUpdated flow.Address
+}
+
+func TestBackendAccountStatusesSuite(t *testing.T) {
+	suite.Run(t, new(BackendAccountStatusesSuite))
+}
+
+// generateProtocolMockEvents generates a set of mock events.
+func (s *BackendAccountStatusesSuite) generateProtocolMockEvents() flow.EventsList {
+	events := make([]flow.Event, 4)
+	events = append(events, unittest.EventFixture(testEventTypes[0], 0, 0, unittest.IdentifierFixture(), 0))
+
+	accountCreateEvent := generator.GenerateAccountCreateEvent(s.T(), s.accountCreatedAddress)
+	accountCreateEvent.TransactionIndex = 1
+	events = append(events, accountCreateEvent)
+
+	accountContractAdded := generator.GenerateAccountContractEvent(s.T(), "AccountContractAdded", s.accountContractAdded)
+	accountContractAdded.TransactionIndex = 2
+	events = append(events, accountContractAdded)
+
+	accountContractUpdated := generator.GenerateAccountContractEvent(s.T(), "AccountContractUpdated", s.accountContractUpdated)
+	accountContractUpdated.TransactionIndex = 3
+	events = append(events, accountContractUpdated)
+
+	return events
+}
+
+// SetupTest initializes the test suite.
+func (s *BackendAccountStatusesSuite) SetupTest() {
+	blockCount := 5
+	var err error
+	s.SetupTestSuite(blockCount)
+
+	addressGenerator := chainID.Chain().NewAddressGenerator()
+	s.accountCreatedAddress, err = addressGenerator.NextAddress()
+	require.NoError(s.T(), err)
+	s.accountContractAdded, err = addressGenerator.NextAddress()
+	require.NoError(s.T(), err)
+	s.accountContractUpdated, err = addressGenerator.NextAddress()
+	require.NoError(s.T(), err)
+
+	parent := s.rootBlock.Header
+	events := s.generateProtocolMockEvents()
+
+	for i := 0; i < blockCount; i++ {
+		block := unittest.BlockWithParentFixture(parent)
+		// update for next iteration
+		parent = block.Header
+
+		seal := unittest.BlockSealsFixture(1)[0]
+		result := unittest.ExecutionResultFixture()
+
+		chunkDatas := []*execution_data.ChunkExecutionData{
+			unittest.ChunkExecutionDataFixture(s.T(), execution_data.DefaultMaxBlobSize/5, unittest.WithChunkEvents(events)),
+		}
+
+		execData := unittest.BlockExecutionDataFixture(
+			unittest.WithBlockExecutionDataBlockID(block.ID()),
+			unittest.WithChunkExecutionDatas(chunkDatas...),
+		)
+
+		result.ExecutionDataID, err = s.eds.Add(context.TODO(), execData)
+		assert.NoError(s.T(), err)
+
+		s.blocks = append(s.blocks, block)
+		s.execDataMap[block.ID()] = execution_data.NewBlockExecutionDataEntity(result.ExecutionDataID, execData)
+		s.blockEvents[block.ID()] = events
+		s.blockMap[block.Header.Height] = block
+		s.sealMap[block.ID()] = seal
+		s.resultMap[seal.ResultID] = result
+
+		s.T().Logf("adding exec data for block %d %d %v => %v", i, block.Header.Height, block.ID(), result.ExecutionDataID)
+	}
+
+	s.SetupTestMocks()
+}
+
+// subscribeFromStartBlockIdTestCases generates test cases for subscribing from a start block ID.
+func (s *BackendAccountStatusesSuite) subscribeFromStartBlockIdTestCases() []testType {
+	baseTests := []testType{
+		{
+			name:            "happy path - all new blocks",
+			highestBackfill: -1, // no backfill
+			startValue:      s.rootBlock.ID(),
+		},
+		{
+			name:            "happy path - partial backfill",
+			highestBackfill: 2, // backfill the first 3 blocks
+			startValue:      s.blocks[0].ID(),
+		},
+		{
+			name:            "happy path - complete backfill",
+			highestBackfill: len(s.blocks) - 1, // backfill all blocks
+			startValue:      s.blocks[0].ID(),
+		},
+		{
+			name:            "happy path - start from root block by id",
+			highestBackfill: len(s.blocks) - 1, // backfill all blocks
+			startValue:      s.rootBlock.ID(),  // start from root block
+		},
+	}
+
+	return s.generateFiltersForTestCases(baseTests)
+}
+
+// subscribeFromStartHeightTestCases generates test cases for subscribing from a start height.
+func (s *BackendAccountStatusesSuite) subscribeFromStartHeightTestCases() []testType {
+	baseTests := []testType{
+		{
+			name:            "happy path - all new blocks",
+			highestBackfill: -1, // no backfill
+			startValue:      s.rootBlock.Header.Height,
+		},
+		{
+			name:            "happy path - partial backfill",
+			highestBackfill: 2, // backfill the first 3 blocks
+			startValue:      s.blocks[0].Header.Height,
+		},
+		{
+			name:            "happy path - complete backfill",
+			highestBackfill: len(s.blocks) - 1, // backfill all blocks
+			startValue:      s.blocks[0].Header.Height,
+		},
+		{
+			name:            "happy path - start from root block by id",
+			highestBackfill: len(s.blocks) - 1,         // backfill all blocks
+			startValue:      s.rootBlock.Header.Height, // start from root block
+		},
+	}
+
+	return s.generateFiltersForTestCases(baseTests)
+}
+
+// subscribeFromLatestTestCases generates test cases for subscribing from the latest block.
+func (s *BackendAccountStatusesSuite) subscribeFromLatestTestCases() []testType {
+	baseTests := []testType{
+		{
+			name:            "happy path - all new blocks",
+			highestBackfill: -1, // no backfill
+		},
+		{
+			name:            "happy path - partial backfill",
+			highestBackfill: 2, // backfill the first 3 blocks
+		},
+		{
+			name:            "happy path - complete backfill",
+			highestBackfill: len(s.blocks) - 1, // backfill all blocks
+		},
+	}
+
+	return s.generateFiltersForTestCases(baseTests)
+}
+
+// generateFiltersForTestCases generates variations of test cases with different event filters.
+//
+// This function takes an array of base testType structs and creates variations for each of them.
+// For each base test case, it generates three variations:
+// - All events: Includes all protocol event types filtered by the provided account address.
+// - Some events: Includes only the first protocol event type filtered by the provided account address.
+// - No events: Includes a custom event type "flow.AccountKeyAdded" filtered by the provided account address.
+func (s *BackendAccountStatusesSuite) generateFiltersForTestCases(baseTests []testType) []testType {
+	// Create variations for each of the base tests
+	tests := make([]testType, 0, len(baseTests)*3)
+	var err error
+	for _, test := range baseTests {
+		t1 := test
+		t1.name = fmt.Sprintf("%s - all events", test.name)
+		t1.filters, err = state_stream.NewAccountStatusFilter(
+			state_stream.DefaultEventFilterConfig,
+			chainID.Chain(),
+			[]string{string(testProtocolEventTypes[0]), string(testProtocolEventTypes[1]), string(testProtocolEventTypes[2])},
+			[]string{s.accountCreatedAddress.HexWithPrefix(), s.accountContractAdded.HexWithPrefix(), s.accountContractUpdated.HexWithPrefix()},
+		)
+		require.NoError(s.T(), err)
+		tests = append(tests, t1)
+
+		t2 := test
+		t2.name = fmt.Sprintf("%s - some events", test.name)
+		t2.filters, err = state_stream.NewAccountStatusFilter(
+			state_stream.DefaultEventFilterConfig,
+			chainID.Chain(),
+			[]string{string(testProtocolEventTypes[0])},
+			[]string{s.accountCreatedAddress.HexWithPrefix(), s.accountContractAdded.HexWithPrefix(), s.accountContractUpdated.HexWithPrefix()},
+		)
+		require.NoError(s.T(), err)
+		tests = append(tests, t2)
+
+		t3 := test
+		t3.name = fmt.Sprintf("%s - no events", test.name)
+		t3.filters, err = state_stream.NewAccountStatusFilter(
+			state_stream.DefaultEventFilterConfig,
+			chainID.Chain(),
+			[]string{"flow.AccountKeyAdded"},
+			[]string{s.accountCreatedAddress.HexWithPrefix(), s.accountContractAdded.HexWithPrefix(), s.accountContractUpdated.HexWithPrefix()},
+		)
+		require.NoError(s.T(), err)
+		tests = append(tests, t3)
+
+		t4 := test
+		t4.name = fmt.Sprintf("%s - no events, no addresses", test.name)
+		t4.filters, err = state_stream.NewAccountStatusFilter(
+			state_stream.DefaultEventFilterConfig,
+			chainID.Chain(),
+			[]string{},
+			[]string{},
+		)
+		require.NoError(s.T(), err)
+		tests = append(tests, t4)
+
+		t5 := test
+		t5.name = fmt.Sprintf("%s - some events, no addresses", test.name)
+		t5.filters, err = state_stream.NewAccountStatusFilter(
+			state_stream.DefaultEventFilterConfig,
+			chainID.Chain(),
+			[]string{"flow.AccountKeyAdded"},
+			[]string{},
+		)
+		require.NoError(s.T(), err)
+		tests = append(tests, t5)
+	}
+
+	return tests
+}
+
+// subscribeToAccountStatuses runs subscription tests for account statuses.
+//
+// This function takes a subscribeFn function, which is a subscription function for account statuses,
+// and an array of testType structs representing the test cases.
+// It iterates over each test case and sets up the necessary context and cancellation for the subscription.
+// For each test case, it simulates backfill blocks and verifies the expected account events for each block.
+// It also ensures that the subscription shuts down gracefully after completing the test cases.
+func (s *BackendAccountStatusesSuite) subscribeToAccountStatuses(
+	subscribeFn func(ctx context.Context, startValue interface{}, filter state_stream.AccountStatusFilter) subscription.Subscription,
+	tests []testType,
+) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	// Iterate over each test case
+	for _, test := range tests {
+		s.Run(test.name, func() {
+			s.T().Logf("len(s.execDataMap) %d", len(s.execDataMap))
+
+			// Add "backfill" block - blocks that are already in the database before the test starts
+			// This simulates a subscription on a past block
+			if test.highestBackfill > 0 {
+				s.highestBlockHeader = s.blocks[test.highestBackfill].Header
+			}
+
+			// Set up subscription context and cancellation
+			subCtx, subCancel := context.WithCancel(ctx)
+
+			sub := subscribeFn(subCtx, test.startValue, test.filters)
+
+			// Loop over all the blocks
+			for i, b := range s.blocks {
+				s.T().Logf("checking block %d %v", i, b.ID())
+
+				// Simulate new exec data received.
+				// Exec data for all blocks with index <= highestBackfill were already received
+				if i > test.highestBackfill {
+					s.highestBlockHeader = b.Header
+
+					s.broadcaster.Publish()
+				}
+
+				expectedEvents := map[string]flow.EventsList{}
+				for _, event := range s.blockEvents[b.ID()] {
+					if test.filters.Match(event) {
+						var address string
+						switch event.Type {
+						case state_stream.CoreEventAccountCreated:
+							address = s.accountCreatedAddress.HexWithPrefix()
+						case state_stream.CoreEventAccountContractAdded:
+							address = s.accountContractAdded.HexWithPrefix()
+						case state_stream.CoreEventAccountContractUpdated:
+							address = s.accountContractUpdated.HexWithPrefix()
+						}
+						expectedEvents[address] = append(expectedEvents[address], event)
+					}
+				}
+
+				// Consume execution data from subscription
+				unittest.RequireReturnsBefore(s.T(), func() {
+					v, ok := <-sub.Channel()
+					require.True(s.T(), ok, "channel closed while waiting for exec data for block %d %v: err: %v", b.Header.Height, b.ID(), sub.Err())
+
+					resp, ok := v.(*AccountStatusesResponse)
+					require.True(s.T(), ok, "unexpected response type: %T", v)
+
+					assert.Equal(s.T(), b.Header.ID(), resp.BlockID)
+					assert.Equal(s.T(), b.Header.Height, resp.Height)
+					assert.Equal(s.T(), expectedEvents, resp.AccountEvents)
+				}, 60*time.Second, fmt.Sprintf("timed out waiting for exec data for block %d %v", b.Header.Height, b.ID()))
+			}
+
+			// Make sure there are no new messages waiting. The channel should be opened with nothing waiting
+			unittest.RequireNeverReturnBefore(s.T(), func() {
+				<-sub.Channel()
+			}, 100*time.Millisecond, "timed out waiting for subscription to shutdown")
+
+			// Stop the subscription
+			subCancel()
+
+			// Ensure subscription shuts down gracefully
+			unittest.RequireReturnsBefore(s.T(), func() {
+				v, ok := <-sub.Channel()
+				assert.Nil(s.T(), v)
+				assert.False(s.T(), ok)
+				assert.ErrorIs(s.T(), sub.Err(), context.Canceled)
+			}, 100*time.Millisecond, "timed out waiting for subscription to shutdown")
+		})
+	}
+}
+
+// TestSubscribeAccountStatusesFromStartBlockID tests the SubscribeAccountStatusesFromStartBlockID method.
+func (s *BackendAccountStatusesSuite) TestSubscribeAccountStatusesFromStartBlockID() {
+	s.executionDataTracker.On(
+		"GetStartHeightFromBlockID",
+		mock.AnythingOfType("flow.Identifier"),
+	).Return(func(startBlockID flow.Identifier) (uint64, error) {
+		return s.executionDataTrackerReal.GetStartHeightFromBlockID(startBlockID)
+	}, nil)
+
+	call := func(ctx context.Context, startValue interface{}, filter state_stream.AccountStatusFilter) subscription.Subscription {
+		return s.backend.SubscribeAccountStatusesFromStartBlockID(ctx, startValue.(flow.Identifier), filter)
+	}
+
+	s.subscribeToAccountStatuses(call, s.subscribeFromStartBlockIdTestCases())
+}
+
+// TestSubscribeAccountStatusesFromStartHeight tests the SubscribeAccountStatusesFromStartHeight method.
+func (s *BackendAccountStatusesSuite) TestSubscribeAccountStatusesFromStartHeight() {
+	s.executionDataTracker.On(
+		"GetStartHeightFromHeight",
+		mock.AnythingOfType("uint64"),
+	).Return(func(startHeight uint64) (uint64, error) {
+		return s.executionDataTrackerReal.GetStartHeightFromHeight(startHeight)
+	}, nil)
+
+	call := func(ctx context.Context, startValue interface{}, filter state_stream.AccountStatusFilter) subscription.Subscription {
+		return s.backend.SubscribeAccountStatusesFromStartHeight(ctx, startValue.(uint64), filter)
+	}
+
+	s.subscribeToAccountStatuses(call, s.subscribeFromStartHeightTestCases())
+}
+
+// TestSubscribeAccountStatusesFromLatestBlock tests the SubscribeAccountStatusesFromLatestBlock method.
+func (s *BackendAccountStatusesSuite) TestSubscribeAccountStatusesFromLatestBlock() {
+	s.executionDataTracker.On(
+		"GetStartHeightFromLatest",
+		mock.Anything,
+	).Return(func(ctx context.Context) (uint64, error) {
+		return s.executionDataTrackerReal.GetStartHeightFromLatest(ctx)
+	}, nil)
+
+	call := func(ctx context.Context, startValue interface{}, filter state_stream.AccountStatusFilter) subscription.Subscription {
+		return s.backend.SubscribeAccountStatusesFromLatestBlock(ctx, filter)
+	}
+
+	s.subscribeToAccountStatuses(call, s.subscribeFromLatestTestCases())
+}
+
+// TestSubscribeAccountStatusesHandlesErrors tests handling of expected errors in the SubscribeAccountStatuses.
+func (s *BackendExecutionDataSuite) TestSubscribeAccountStatusesHandlesErrors() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	// mock block tracker for SubscribeBlocksFromStartBlockID
+	s.executionDataTracker.On(
+		"GetStartHeightFromBlockID",
+		mock.AnythingOfType("flow.Identifier"),
+	).Return(func(startBlockID flow.Identifier) (uint64, error) {
+		return s.executionDataTrackerReal.GetStartHeightFromBlockID(startBlockID)
+	}, nil)
+
+	s.Run("returns error for unindexed start blockID", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeAccountStatusesFromStartBlockID(subCtx, unittest.IdentifierFixture(), state_stream.AccountStatusFilter{})
+		assert.Equal(s.T(), codes.NotFound, status.Code(sub.Err()), "expected NotFound, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	s.executionDataTracker.On(
+		"GetStartHeightFromHeight",
+		mock.AnythingOfType("uint64"),
+	).Return(func(startHeight uint64) (uint64, error) {
+		return s.executionDataTrackerReal.GetStartHeightFromHeight(startHeight)
+	}, nil)
+
+	s.Run("returns error for start height before root height", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeAccountStatusesFromStartHeight(subCtx, s.rootBlock.Header.Height-1, state_stream.AccountStatusFilter{})
+		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()), "expected InvalidArgument, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	// make sure we're starting with a fresh cache
+	s.execDataHeroCache.Clear()
+
+	s.Run("returns error for unindexed start height", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeAccountStatusesFromStartHeight(subCtx, s.blocks[len(s.blocks)-1].Header.Height+10, state_stream.AccountStatusFilter{})
+		assert.Equal(s.T(), codes.NotFound, status.Code(sub.Err()), "expected NotFound, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+}
diff --git a/engine/access/state_stream/backend/backend_events.go b/engine/access/state_stream/backend/backend_events.go
index 303f8e09e32..4c9818402dd 100644
--- a/engine/access/state_stream/backend/backend_events.go
+++ b/engine/access/state_stream/backend/backend_events.go
@@ -2,107 +2,140 @@ package backend
 
 import (
 	"context"
-	"fmt"
-	"time"
 
 	"github.com/rs/zerolog"
 
-	"github.com/onflow/flow-go/engine"
 	"github.com/onflow/flow-go/engine/access/state_stream"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/storage"
-	"github.com/onflow/flow-go/utils/logging"
 )
 
-type EventsResponse struct {
-	BlockID flow.Identifier
-	Height  uint64
-	Events  flow.EventsList
-}
-
 type EventsBackend struct {
-	log            zerolog.Logger
-	events         storage.Events
-	headers        storage.Headers
-	broadcaster    *engine.Broadcaster
-	sendTimeout    time.Duration
-	responseLimit  float64
-	sendBufferSize int
-
-	getExecutionData GetExecutionDataFunc
-	getStartHeight   GetStartHeightFunc
-
-	useIndex bool
+	log zerolog.Logger
+
+	subscriptionHandler  *subscription.SubscriptionHandler
+	executionDataTracker subscription.ExecutionDataTracker
+	eventsRetriever      EventsRetriever
 }
 
-func (b EventsBackend) SubscribeEvents(ctx context.Context, startBlockID flow.Identifier, startHeight uint64, filter state_stream.EventFilter) state_stream.Subscription {
-	nextHeight, err := b.getStartHeight(startBlockID, startHeight)
+// SubscribeEvents is deprecated and will be removed in a future version.
+// Use SubscribeEventsFromStartBlockID, SubscribeEventsFromStartHeight or SubscribeEventsFromLatest.
+//
+// SubscribeEvents streams events for all blocks starting at the specified block ID or block height
+// up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+//
+// Only one of startBlockID and startHeight may be set. If neither startBlockID nor startHeight is provided,
+// the latest sealed block is used.
+//
+// Events within each block are filtered by the provided EventFilter, and only
+// those events that match the filter are returned. If no filter is provided,
+// all events are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - startBlockID: The identifier of the starting block. If provided, startHeight should be 0.
+// - startHeight: The height of the starting block. If provided, startBlockID should be flow.ZeroID.
+// - filter: The event filter used to filter events.
+//
+// If invalid parameters will be supplied SubscribeEvents will return a failed subscription.
+func (b *EventsBackend) SubscribeEvents(ctx context.Context, startBlockID flow.Identifier, startHeight uint64, filter state_stream.EventFilter) subscription.Subscription {
+	nextHeight, err := b.executionDataTracker.GetStartHeight(ctx, startBlockID, startHeight)
 	if err != nil {
-		return NewFailedSubscription(err, "could not get start height")
+		return subscription.NewFailedSubscription(err, "could not get start height")
 	}
 
-	sub := NewHeightBasedSubscription(b.sendBufferSize, nextHeight, b.getResponseFactory(filter))
-
-	go NewStreamer(b.log, b.broadcaster, b.sendTimeout, b.responseLimit, sub).Stream(ctx)
-
-	return sub
+	return b.subscriptionHandler.Subscribe(ctx, nextHeight, b.getResponseFactory(filter))
 }
 
-// getResponseFactory returns a function function that returns the event response for a given height.
-func (b EventsBackend) getResponseFactory(filter state_stream.EventFilter) GetDataByHeightFunc {
-	return func(ctx context.Context, height uint64) (response interface{}, err error) {
-		if b.useIndex {
-			response, err = b.getEventsFromStorage(height, filter)
-		} else {
-			response, err = b.getEventsFromExecutionData(ctx, height, filter)
-		}
-
-		if err == nil && b.log.GetLevel() == zerolog.TraceLevel {
-			eventsResponse := response.(*EventsResponse)
-			b.log.Trace().
-				Hex("block_id", logging.ID(eventsResponse.BlockID)).
-				Uint64("height", height).
-				Int("events", len(eventsResponse.Events)).
-				Msg("sending events")
-		}
-		return
+// SubscribeEventsFromStartBlockID streams events starting at the specified block ID,
+// up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+//
+// Events within each block are filtered by the provided EventFilter, and only
+// those events that match the filter are returned. If no filter is provided,
+// all events are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - startBlockID: The identifier of the starting block.
+// - filter: The event filter used to filter events.
+//
+// If invalid parameters will be supplied SubscribeEventsFromStartBlockID will return a failed subscription.
+func (b *EventsBackend) SubscribeEventsFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, filter state_stream.EventFilter) subscription.Subscription {
+	nextHeight, err := b.executionDataTracker.GetStartHeightFromBlockID(startBlockID)
+	if err != nil {
+		return subscription.NewFailedSubscription(err, "could not get start height from block id")
 	}
+
+	return b.subscriptionHandler.Subscribe(ctx, nextHeight, b.getResponseFactory(filter))
 }
 
-// getEventsFromExecutionData returns the events for a given height extractd from the execution data.
-func (b EventsBackend) getEventsFromExecutionData(ctx context.Context, height uint64, filter state_stream.EventFilter) (*EventsResponse, error) {
-	executionData, err := b.getExecutionData(ctx, height)
+// SubscribeEventsFromStartHeight streams events starting at the specified block height,
+// up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+//
+// Events within each block are filtered by the provided EventFilter, and only
+// those events that match the filter are returned. If no filter is provided,
+// all events are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - startHeight: The height of the starting block.
+// - filter: The event filter used to filter events.
+//
+// If invalid parameters will be supplied SubscribeEventsFromStartHeight will return a failed subscription.
+func (b *EventsBackend) SubscribeEventsFromStartHeight(ctx context.Context, startHeight uint64, filter state_stream.EventFilter) subscription.Subscription {
+	nextHeight, err := b.executionDataTracker.GetStartHeightFromHeight(startHeight)
 	if err != nil {
-		return nil, fmt.Errorf("could not get execution data for block %d: %w", height, err)
+		return subscription.NewFailedSubscription(err, "could not get start height from block height")
 	}
 
-	var events flow.EventsList
-	for _, chunkExecutionData := range executionData.ChunkExecutionDatas {
-		events = append(events, filter.Filter(chunkExecutionData.Events)...)
-	}
-
-	return &EventsResponse{
-		BlockID: executionData.BlockID,
-		Height:  height,
-		Events:  events,
-	}, nil
+	return b.subscriptionHandler.Subscribe(ctx, nextHeight, b.getResponseFactory(filter))
 }
 
-// getEventsFromStorage returns the events for a given height from the index storage.
-func (b EventsBackend) getEventsFromStorage(height uint64, filter state_stream.EventFilter) (*EventsResponse, error) {
-	blockID, err := b.headers.BlockIDByHeight(height)
+// SubscribeEventsFromLatest subscribes to events starting at the latest sealed block,
+// up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+//
+// Events within each block are filtered by the provided EventFilter, and only
+// those events that match the filter are returned. If no filter is provided,
+// all events are returned.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - filter: The event filter used to filter events.
+//
+// If invalid parameters will be supplied SubscribeEventsFromLatest will return a failed subscription.
+func (b *EventsBackend) SubscribeEventsFromLatest(ctx context.Context, filter state_stream.EventFilter) subscription.Subscription {
+	nextHeight, err := b.executionDataTracker.GetStartHeightFromLatest(ctx)
 	if err != nil {
-		return nil, fmt.Errorf("could not get header for height %d: %w", height, err)
+		return subscription.NewFailedSubscription(err, "could not get start height from block height")
 	}
 
-	events, err := b.events.ByBlockID(blockID)
-	if err != nil {
-		return nil, fmt.Errorf("could not get events for block %d: %w", height, err)
-	}
+	return b.subscriptionHandler.Subscribe(ctx, nextHeight, b.getResponseFactory(filter))
+}
 
-	return &EventsResponse{
-		BlockID: blockID,
-		Height:  height,
-		Events:  filter.Filter(events),
-	}, nil
+// getResponseFactory returns a function that retrieves the event response for a given height.
+//
+// Parameters:
+// - filter: The event filter used to filter events.
+//
+// Expected errors during normal operation:
+// - codes.NotFound: If block header for the specified block height is not found, if events for the specified block height are not found.
+func (b *EventsBackend) getResponseFactory(filter state_stream.EventFilter) subscription.GetDataByHeightFunc {
+	return func(ctx context.Context, height uint64) (response interface{}, err error) {
+		eventsResponse, err := b.eventsRetriever.GetAllEventsResponse(ctx, height)
+		if err != nil {
+			return nil, err
+		}
+
+		eventsResponse.Events = filter.Filter(eventsResponse.Events)
+
+		return eventsResponse, nil
+	}
 }
diff --git a/engine/access/state_stream/backend/backend_events_test.go b/engine/access/state_stream/backend/backend_events_test.go
index d01fbbad781..f592de68fdb 100644
--- a/engine/access/state_stream/backend/backend_events_test.go
+++ b/engine/access/state_stream/backend/backend_events_test.go
@@ -1,8 +1,10 @@
 package backend
 
 import (
+	"bytes"
 	"context"
 	"fmt"
+	"sort"
 	"testing"
 	"time"
 
@@ -14,11 +16,42 @@ import (
 	"google.golang.org/grpc/status"
 
 	"github.com/onflow/flow-go/engine/access/state_stream"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/state_synchronization/indexer"
+	syncmock "github.com/onflow/flow-go/module/state_synchronization/mock"
 	"github.com/onflow/flow-go/utils/unittest"
 	"github.com/onflow/flow-go/utils/unittest/mocks"
 )
 
+// eventsTestType represents a test scenario for subscribe events endpoints.
+// The old version of test case is used to test SubscribeEvents as well.
+// After removing SubscribeEvents endpoint testType struct as a test case can be used.
+type eventsTestType struct {
+	name            string
+	highestBackfill int
+	startBlockID    flow.Identifier
+	startHeight     uint64
+	filter          state_stream.EventFilter
+}
+
+// BackendEventsSuite is a test suite for the EventsBackend functionality.
+// It is used to test the endpoints which enable users to subscribe to block events.
+// It verifies that each endpoint works properly with the expected data being returned and tests
+// handling of expected errors.
+//
+// Test cases cover various subscription methods:
+// - Subscribing from a start block ID or start height (SubscribeEvents)
+// - Subscribing from a start block ID (SubscribeEventsFromStartBlockID)
+// - Subscribing from a start height (SubscribeEventsFromStartHeight)
+// - Subscribing from the latest data (SubscribeEventsFromLatest)
+//
+// Each test case covers various scenarios and edge cases, thoroughly assessing the
+// EventsBackend's subscription functionality and its ability to handle different
+// starting points, event sources, and filtering criteria.
+//
+// The suite focuses on events extracted from local storage and extracted from ExecutionData,
+// ensuring proper testing of event retrieval from both sources.
 type BackendEventsSuite struct {
 	BackendExecutionDataSuite
 }
@@ -27,10 +60,81 @@ func TestBackendEventsSuite(t *testing.T) {
 	suite.Run(t, new(BackendEventsSuite))
 }
 
+// SetupTest initializes the test suite.
 func (s *BackendEventsSuite) SetupTest() {
 	s.BackendExecutionDataSuite.SetupTest()
 }
 
+// setupFilterForTestCases sets up variations of test scenarios with different event filters
+//
+// This function takes an array of base testType structs and creates variations for each of them.
+// For each base test case, it generates three variations:
+// - All events: Includes all event types.
+// - Some events: Includes only event types that match the provided filter.
+// - No events: Includes a custom event type "A.0x1.NonExistent.Event".
+func (s *BackendEventsSuite) setupFilterForTestCases(baseTests []eventsTestType) []eventsTestType {
+	// create variations for each of the base test
+	tests := make([]eventsTestType, 0, len(baseTests)*3)
+	var err error
+
+	for _, test := range baseTests {
+		t1 := test
+		t1.name = fmt.Sprintf("%s - all events", test.name)
+		t1.filter = state_stream.EventFilter{}
+		tests = append(tests, t1)
+
+		t2 := test
+		t2.name = fmt.Sprintf("%s - some events", test.name)
+		t2.filter, err = state_stream.NewEventFilter(state_stream.DefaultEventFilterConfig, chainID.Chain(), []string{string(testEventTypes[0])}, nil, nil)
+		require.NoError(s.T(), err)
+		tests = append(tests, t2)
+
+		t3 := test
+		t3.name = fmt.Sprintf("%s - no events", test.name)
+		t3.filter, err = state_stream.NewEventFilter(state_stream.DefaultEventFilterConfig, chainID.Chain(), []string{"A.0x1.NonExistent.Event"}, nil, nil)
+		require.NoError(s.T(), err)
+		tests = append(tests, t3)
+	}
+
+	return tests
+}
+
+// setupLocalStorage prepares local storage for testing
+func (s *BackendEventsSuite) setupLocalStorage() {
+	s.SetupBackend(true)
+
+	// events returned from the db are sorted by txID, txIndex, then eventIndex.
+	// reproduce that here to ensure output order works as expected
+	blockEvents := make(map[flow.Identifier][]flow.Event)
+	for _, b := range s.blocks {
+		events := make([]flow.Event, len(s.blockEvents[b.ID()]))
+		for i, event := range s.blockEvents[b.ID()] {
+			events[i] = event
+		}
+		sort.Slice(events, func(i, j int) bool {
+			cmp := bytes.Compare(events[i].TransactionID[:], events[j].TransactionID[:])
+			if cmp == 0 {
+				if events[i].TransactionIndex == events[j].TransactionIndex {
+					return events[i].EventIndex < events[j].EventIndex
+				}
+				return events[i].TransactionIndex < events[j].TransactionIndex
+			}
+			return cmp < 0
+		})
+		blockEvents[b.ID()] = events
+	}
+
+	s.events.On("ByBlockID", mock.AnythingOfType("flow.Identifier")).Return(
+		mocks.StorageMapGetter(blockEvents),
+	)
+
+	reporter := syncmock.NewIndexReporter(s.T())
+	reporter.On("LowestIndexedHeight").Return(s.blocks[0].Header.Height, nil)
+	reporter.On("HighestIndexedHeight").Return(s.blocks[len(s.blocks)-1].Header.Height, nil)
+	err := s.eventsIndex.Initialize(reporter)
+	s.Require().NoError(err)
+}
+
 // TestSubscribeEventsFromExecutionData tests the SubscribeEvents method happy path for events
 // extracted from ExecutionData
 func (s *BackendEventsSuite) TestSubscribeEventsFromExecutionData() {
@@ -40,29 +144,52 @@ func (s *BackendEventsSuite) TestSubscribeEventsFromExecutionData() {
 // TestSubscribeEventsFromLocalStorage tests the SubscribeEvents method happy path for events
 // extracted from local storage
 func (s *BackendEventsSuite) TestSubscribeEventsFromLocalStorage() {
-	s.backend.useIndex = true
-	s.events.On("ByBlockID", mock.AnythingOfType("flow.Identifier")).Return(
-		mocks.StorageMapGetter(s.blockEvents),
-	)
-
+	s.setupLocalStorage()
 	s.runTestSubscribeEvents()
 }
 
-func (s *BackendEventsSuite) runTestSubscribeEvents() {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
+// TestSubscribeEventsFromStartBlockIDFromExecutionData tests the SubscribeEventsFromStartBlockID method happy path for events
+// extracted from ExecutionData
+func (s *BackendEventsSuite) TestSubscribeEventsFromStartBlockIDFromExecutionData() {
+	s.runTestSubscribeEventsFromStartBlockID()
+}
 
-	var err error
+// TestSubscribeEventsFromStartBlockIDFromLocalStorage tests the SubscribeEventsFromStartBlockID method happy path for events
+// extracted from local storage
+func (s *BackendEventsSuite) TestSubscribeEventsFromStartBlockIDFromLocalStorage() {
+	s.setupLocalStorage()
+	s.runTestSubscribeEventsFromStartBlockID()
+}
 
-	type testType struct {
-		name            string
-		highestBackfill int
-		startBlockID    flow.Identifier
-		startHeight     uint64
-		filters         state_stream.EventFilter
-	}
+// TestSubscribeEventsFromStartHeightFromExecutionData tests the SubscribeEventsFromStartHeight method happy path for events
+// extracted from ExecutionData
+func (s *BackendEventsSuite) TestSubscribeEventsFromStartHeightFromExecutionData() {
+	s.runTestSubscribeEventsFromStartHeight()
+}
 
-	baseTests := []testType{
+// TestSubscribeEventsFromStartHeightFromLocalStorage tests the SubscribeEventsFromStartHeight method happy path for events
+// extracted from local storage
+func (s *BackendEventsSuite) TestSubscribeEventsFromStartHeightFromLocalStorage() {
+	s.setupLocalStorage()
+	s.runTestSubscribeEventsFromStartHeight()
+}
+
+// TestSubscribeEventsFromLatestFromExecutionData tests the SubscribeEventsFromLatest method happy path for events
+// extracted from ExecutionData
+func (s *BackendEventsSuite) TestSubscribeEventsFromLatestFromExecutionData() {
+	s.runTestSubscribeEventsFromLatest()
+}
+
+// TestSubscribeEventsFromLatestFromLocalStorage tests the SubscribeEventsFromLatest method happy path for events
+// extracted from local storage
+func (s *BackendEventsSuite) TestSubscribeEventsFromLatestFromLocalStorage() {
+	s.setupLocalStorage()
+	s.runTestSubscribeEventsFromLatest()
+}
+
+// runTestSubscribeEvents runs the test suite for SubscribeEvents subscription
+func (s *BackendEventsSuite) runTestSubscribeEvents() {
+	tests := []eventsTestType{
 		{
 			name:            "happy path - all new blocks",
 			highestBackfill: -1, // no backfill
@@ -85,81 +212,216 @@ func (s *BackendEventsSuite) runTestSubscribeEvents() {
 			name:            "happy path - start from root block by height",
 			highestBackfill: len(s.blocks) - 1, // backfill all blocks
 			startBlockID:    flow.ZeroID,
-			startHeight:     s.backend.rootBlockHeight, // start from root block
+			startHeight:     s.rootBlock.Header.Height, // start from root block
 		},
 		{
 			name:            "happy path - start from root block by id",
-			highestBackfill: len(s.blocks) - 1,     // backfill all blocks
-			startBlockID:    s.backend.rootBlockID, // start from root block
+			highestBackfill: len(s.blocks) - 1,       // backfill all blocks
+			startBlockID:    s.rootBlock.Header.ID(), // start from root block
 			startHeight:     0,
 		},
 	}
 
-	// create variations for each of the base test
-	tests := make([]testType, 0, len(baseTests)*3)
-	for _, test := range baseTests {
-		t1 := test
-		t1.name = fmt.Sprintf("%s - all events", test.name)
-		t1.filters = state_stream.EventFilter{}
-		tests = append(tests, t1)
+	call := func(ctx context.Context, startBlockID flow.Identifier, startHeight uint64, filter state_stream.EventFilter) subscription.Subscription {
+		return s.backend.SubscribeEvents(ctx, startBlockID, startHeight, filter)
+	}
 
-		t2 := test
-		t2.name = fmt.Sprintf("%s - some events", test.name)
-		t2.filters, err = state_stream.NewEventFilter(state_stream.DefaultEventFilterConfig, chainID.Chain(), []string{string(testEventTypes[0])}, nil, nil)
-		require.NoError(s.T(), err)
-		tests = append(tests, t2)
+	s.subscribe(call, s.requireEventsResponse, s.setupFilterForTestCases(tests))
+}
 
-		t3 := test
-		t3.name = fmt.Sprintf("%s - no events", test.name)
-		t3.filters, err = state_stream.NewEventFilter(state_stream.DefaultEventFilterConfig, chainID.Chain(), []string{"A.0x1.NonExistent.Event"}, nil, nil)
-		require.NoError(s.T(), err)
-		tests = append(tests, t3)
+// runTestSubscribeEventsFromStartBlockID runs the test suite for SubscribeEventsFromStartBlockID subscription
+func (s *BackendEventsSuite) runTestSubscribeEventsFromStartBlockID() {
+	tests := []eventsTestType{
+		{
+			name:            "happy path - all new blocks",
+			highestBackfill: -1, // no backfill
+			startBlockID:    s.rootBlock.ID(),
+		},
+		{
+			name:            "happy path - partial backfill",
+			highestBackfill: 2, // backfill the first 3 blocks
+			startBlockID:    s.blocks[0].ID(),
+		},
+		{
+			name:            "happy path - complete backfill",
+			highestBackfill: len(s.blocks) - 1, // backfill all blocks
+			startBlockID:    s.blocks[0].ID(),
+		},
+		{
+			name:            "happy path - start from root block by id",
+			highestBackfill: len(s.blocks) - 1, // backfill all blocks
+			startBlockID:    s.rootBlock.ID(),  // start from root block
+		},
+	}
+
+	s.executionDataTracker.On(
+		"GetStartHeightFromBlockID",
+		mock.AnythingOfType("flow.Identifier"),
+	).Return(func(startBlockID flow.Identifier) (uint64, error) {
+		return s.executionDataTrackerReal.GetStartHeightFromBlockID(startBlockID)
+	}, nil)
+
+	call := func(ctx context.Context, startBlockID flow.Identifier, _ uint64, filter state_stream.EventFilter) subscription.Subscription {
+		return s.backend.SubscribeEventsFromStartBlockID(ctx, startBlockID, filter)
 	}
 
+	s.subscribe(call, s.requireEventsResponse, s.setupFilterForTestCases(tests))
+}
+
+// runTestSubscribeEventsFromStartHeight runs the test suite for SubscribeEventsFromStartHeight subscription
+func (s *BackendEventsSuite) runTestSubscribeEventsFromStartHeight() {
+	tests := []eventsTestType{
+		{
+			name:            "happy path - all new blocks",
+			highestBackfill: -1, // no backfill
+			startHeight:     s.rootBlock.Header.Height,
+		},
+		{
+			name:            "happy path - partial backfill",
+			highestBackfill: 2, // backfill the first 3 blocks
+			startHeight:     s.blocks[0].Header.Height,
+		},
+		{
+			name:            "happy path - complete backfill",
+			highestBackfill: len(s.blocks) - 1, // backfill all blocks
+			startHeight:     s.blocks[0].Header.Height,
+		},
+		{
+			name:            "happy path - start from root block by id",
+			highestBackfill: len(s.blocks) - 1,         // backfill all blocks
+			startHeight:     s.rootBlock.Header.Height, // start from root block
+		},
+	}
+
+	s.executionDataTracker.On(
+		"GetStartHeightFromHeight",
+		mock.AnythingOfType("uint64"),
+	).Return(func(startHeight uint64) (uint64, error) {
+		return s.executionDataTrackerReal.GetStartHeightFromHeight(startHeight)
+	}, nil)
+
+	call := func(ctx context.Context, _ flow.Identifier, startHeight uint64, filter state_stream.EventFilter) subscription.Subscription {
+		return s.backend.SubscribeEventsFromStartHeight(ctx, startHeight, filter)
+	}
+
+	s.subscribe(call, s.requireEventsResponse, s.setupFilterForTestCases(tests))
+}
+
+// runTestSubscribeEventsFromLatest runs the test suite for SubscribeEventsFromLatest subscription
+func (s *BackendEventsSuite) runTestSubscribeEventsFromLatest() {
+	tests := []eventsTestType{
+		{
+			name:            "happy path - all new blocks",
+			highestBackfill: -1, // no backfill
+		},
+		{
+			name:            "happy path - partial backfill",
+			highestBackfill: 2, // backfill the first 3 blocks
+		},
+		{
+			name:            "happy path - complete backfill",
+			highestBackfill: len(s.blocks) - 1, // backfill all blocks
+		},
+	}
+
+	s.executionDataTracker.On(
+		"GetStartHeightFromLatest",
+		mock.Anything,
+	).Return(func(ctx context.Context) (uint64, error) {
+		return s.executionDataTrackerReal.GetStartHeightFromLatest(ctx)
+	}, nil)
+
+	call := func(ctx context.Context, _ flow.Identifier, _ uint64, filter state_stream.EventFilter) subscription.Subscription {
+		return s.backend.SubscribeEventsFromLatest(ctx, filter)
+	}
+
+	s.subscribe(call, s.requireEventsResponse, s.setupFilterForTestCases(tests))
+}
+
+// subscribe is a helper function to run test scenarios for event subscription in the BackendEventsSuite.
+// It covers various scenarios for subscribing, handling backfill, and receiving block updates.
+// The test cases include scenarios for different event filters.
+//
+// Parameters:
+//
+//   - subscribeFn: A function representing the subscription method to be tested.
+//     It takes a context, startBlockID, startHeight, and filter as parameters
+//     and returns a subscription.Subscription.
+//
+//   - requireFn: A function responsible for validating that the received information
+//     matches the expected data. It takes an actual interface{} and an expected *EventsResponse as parameters.
+//
+//   - tests: A slice of testType representing different test scenarios for subscriptions.
+//
+// The function performs the following steps for each test case:
+//
+//  1. Initializes the test context and cancellation function.
+//  2. Iterates through the provided test cases.
+//  3. For each test case, sets up a executionDataTracker mock if there are blocks to backfill.
+//  4. Mocks the latest sealed block if no startBlockID or startHeight is provided.
+//  5. Subscribes using the provided subscription function.
+//  6. Simulates the reception of new blocks and consumes them from the subscription channel.
+//  7. Ensures that there are no new messages waiting after all blocks have been processed.
+//  8. Cancels the subscription and ensures it shuts down gracefully.
+func (s *BackendEventsSuite) subscribe(
+	subscribeFn func(ctx context.Context, startBlockID flow.Identifier, startHeight uint64, filter state_stream.EventFilter) subscription.Subscription,
+	requireFn func(interface{}, *EventsResponse),
+	tests []eventsTestType,
+) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
 	for _, test := range tests {
 		s.Run(test.name, func() {
-			s.T().Logf("len(s.execDataMap) %d", len(s.execDataMap))
-
 			// add "backfill" block - blocks that are already in the database before the test starts
 			// this simulates a subscription on a past block
-			for i := 0; i <= test.highestBackfill; i++ {
-				s.T().Logf("backfilling block %d", i)
-				s.backend.setHighestHeight(s.blocks[i].Header.Height)
+			if test.highestBackfill > 0 {
+				s.highestBlockHeader = s.blocks[test.highestBackfill].Header
 			}
 
 			subCtx, subCancel := context.WithCancel(ctx)
-			sub := s.backend.SubscribeEvents(subCtx, test.startBlockID, test.startHeight, test.filters)
 
-			// loop over all of the blocks
+			// mock latest sealed if test case no start value provided
+			if test.startBlockID == flow.ZeroID && test.startHeight == 0 {
+				s.snapshot.On("Head").Unset()
+				s.snapshot.On("Head").Return(s.rootBlock.Header, nil).Once()
+			}
+
+			sub := subscribeFn(subCtx, test.startBlockID, test.startHeight, test.filter)
+
+			// loop over all blocks
 			for i, b := range s.blocks {
-				s.T().Logf("checking block %d %v", i, b.ID())
+				s.T().Logf("checking block %d %v %d", i, b.ID(), b.Header.Height)
 
-				// simulate new exec data received.
-				// exec data for all blocks with index <= highestBackfill were already received
+				// simulate new block received.
+				// all blocks with index <= highestBackfill were already received
 				if i > test.highestBackfill {
-					s.backend.setHighestHeight(b.Header.Height)
+					s.highestBlockHeader = b.Header
+
 					s.broadcaster.Publish()
 				}
 
 				var expectedEvents flow.EventsList
 				for _, event := range s.blockEvents[b.ID()] {
-					if test.filters.Match(event) {
+					if test.filter.Match(event) {
 						expectedEvents = append(expectedEvents, event)
 					}
 				}
 
-				// consume execution data from subscription
+				// consume events response from subscription
 				unittest.RequireReturnsBefore(s.T(), func() {
 					v, ok := <-sub.Channel()
-					require.True(s.T(), ok, "channel closed while waiting for exec data for block %d %v: err: %v", b.Header.Height, b.ID(), sub.Err())
+					require.True(s.T(), ok, "channel closed while waiting for exec data for block %x %v: err: %v", b.Header.Height, b.ID(), sub.Err())
 
-					resp, ok := v.(*EventsResponse)
-					require.True(s.T(), ok, "unexpected response type: %T", v)
+					expected := &EventsResponse{
+						BlockID:        b.ID(),
+						Height:         b.Header.Height,
+						Events:         expectedEvents,
+						BlockTimestamp: b.Header.Timestamp,
+					}
+					requireFn(v, expected)
 
-					assert.Equal(s.T(), b.Header.ID(), resp.BlockID)
-					assert.Equal(s.T(), b.Header.Height, resp.Height)
-					assert.Equal(s.T(), expectedEvents, resp.Events)
-				}, time.Second, fmt.Sprintf("timed out waiting for exec data for block %d %v", b.Header.Height, b.ID()))
+				}, time.Second, fmt.Sprintf("timed out waiting for block %d %v", b.Header.Height, b.ID()))
 			}
 
 			// make sure there are no new messages waiting. the channel should be opened with nothing waiting
@@ -181,6 +443,41 @@ func (s *BackendEventsSuite) runTestSubscribeEvents() {
 	}
 }
 
+// requireEventsResponse ensures that the received event information matches the expected data.
+func (s *BackendEventsSuite) requireEventsResponse(v interface{}, expected *EventsResponse) {
+	actual, ok := v.(*EventsResponse)
+	require.True(s.T(), ok, "unexpected response type: %T", v)
+
+	assert.Equal(s.T(), expected.BlockID, actual.BlockID)
+	assert.Equal(s.T(), expected.Height, actual.Height)
+	assert.Equal(s.T(), expected.Events, actual.Events)
+	assert.Equal(s.T(), expected.BlockTimestamp, actual.BlockTimestamp)
+}
+
+// TestSubscribeEventsHandlesErrors tests error handling for SubscribeEvents subscription
+//
+// Test Cases:
+//
+// 1. Returns error if both start blockID and start height are provided:
+//   - Ensures that providing both start blockID and start height results in an InvalidArgument error.
+//
+// 2. Returns error for start height before root height:
+//   - Validates that attempting to subscribe with a start height before the root height results in an InvalidArgument error.
+//
+// 3. Returns error for unindexed start blockID:
+//   - Tests that subscribing with an unindexed start blockID results in a NotFound error.
+//
+// 4. Returns error for unindexed start height:
+//   - Tests that subscribing with an unindexed start height results in a NotFound error.
+//
+// 5. Returns error for uninitialized index:
+//   - Ensures that subscribing with an uninitialized index results in a FailedPrecondition error.
+//
+// 6. Returns error for start below lowest indexed:
+//   - Validates that subscribing with a start height below the lowest indexed height results in an InvalidArgument error.
+//
+// 7. Returns error for start above highest indexed:
+//   - Validates that subscribing with a start height above the highest indexed height results in an InvalidArgument error.
 func (s *BackendExecutionDataSuite) TestSubscribeEventsHandlesErrors() {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -197,7 +494,7 @@ func (s *BackendExecutionDataSuite) TestSubscribeEventsHandlesErrors() {
 		subCtx, subCancel := context.WithCancel(ctx)
 		defer subCancel()
 
-		sub := s.backend.SubscribeEvents(subCtx, flow.ZeroID, s.backend.rootBlockHeight-1, state_stream.EventFilter{})
+		sub := s.backend.SubscribeEvents(subCtx, flow.ZeroID, s.rootBlock.Header.Height-1, state_stream.EventFilter{})
 		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()), "expected InvalidArgument, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
 	})
 
@@ -219,4 +516,208 @@ func (s *BackendExecutionDataSuite) TestSubscribeEventsHandlesErrors() {
 		sub := s.backend.SubscribeEvents(subCtx, flow.ZeroID, s.blocks[len(s.blocks)-1].Header.Height+10, state_stream.EventFilter{})
 		assert.Equal(s.T(), codes.NotFound, status.Code(sub.Err()), "expected NotFound, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
 	})
+
+	// Unset GetStartHeight to mock new behavior instead of default one
+	s.executionDataTracker.On("GetStartHeight", mock.Anything, mock.Anything).Unset()
+
+	s.Run("returns error for uninitialized index", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		s.executionDataTracker.On("GetStartHeight", subCtx, flow.ZeroID, uint64(0)).
+			Return(uint64(0), status.Errorf(codes.FailedPrecondition, "failed to get lowest indexed height: %v", indexer.ErrIndexNotInitialized)).
+			Once()
+
+		// Note: eventIndex.Initialize() is not called in this test
+		sub := s.backend.SubscribeEvents(subCtx, flow.ZeroID, 0, state_stream.EventFilter{})
+		assert.Equal(s.T(), codes.FailedPrecondition, status.Code(sub.Err()), "expected FailedPrecondition, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	s.Run("returns error for start below lowest indexed", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		s.executionDataTracker.On("GetStartHeight", subCtx, flow.ZeroID, s.blocks[0].Header.Height).
+			Return(uint64(0), status.Errorf(codes.InvalidArgument, "start height %d is lower than lowest indexed height %d", s.blocks[0].Header.Height, 0)).
+			Once()
+
+		sub := s.backend.SubscribeEvents(subCtx, flow.ZeroID, s.blocks[0].Header.Height, state_stream.EventFilter{})
+		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()), "expected InvalidArgument, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	s.Run("returns error for start above highest indexed", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		s.executionDataTracker.On("GetStartHeight", subCtx, flow.ZeroID, s.blocks[len(s.blocks)-1].Header.Height).
+			Return(uint64(0), status.Errorf(codes.InvalidArgument, "start height %d is higher than highest indexed height %d", s.blocks[len(s.blocks)-1].Header.Height, s.blocks[0].Header.Height)).
+			Once()
+
+		sub := s.backend.SubscribeEvents(subCtx, flow.ZeroID, s.blocks[len(s.blocks)-1].Header.Height, state_stream.EventFilter{})
+		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()), "expected InvalidArgument, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+}
+
+// TestSubscribeEventsFromStartBlockIDHandlesErrors tests error handling for SubscribeEventsFromStartBlockID subscription
+//
+// Test Cases:
+//
+// 1. Returns error for unindexed start blockID:
+//   - Ensures that subscribing with an unindexed start blockID results in a NotFound error.
+//
+// 2. Returns error for uninitialized index:
+//   - Ensures that subscribing with an uninitialized index results in a FailedPrecondition error.
+//
+// 3. Returns error for start below lowest indexed:
+//   - Validates that subscribing with a start blockID below the lowest indexed height results in an InvalidArgument error.
+//
+// 4. Returns error for start above highest indexed:
+//   - Validates that subscribing with a start blockID above the highest indexed height results in an InvalidArgument error.
+func (s *BackendExecutionDataSuite) TestSubscribeEventsFromStartBlockIDHandlesErrors() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	s.executionDataTracker.On(
+		"GetStartHeightFromBlockID",
+		mock.Anything,
+	).Return(func(startBlockID flow.Identifier) (uint64, error) {
+		return s.executionDataTrackerReal.GetStartHeightFromBlockID(startBlockID)
+	}, nil)
+
+	s.Run("returns error for unindexed start blockID", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeEventsFromStartBlockID(subCtx, unittest.IdentifierFixture(), state_stream.EventFilter{})
+		assert.Equal(s.T(), codes.NotFound, status.Code(sub.Err()), "expected NotFound, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	// Unset GetStartHeightFromBlockID to mock new behavior instead of default one
+	s.executionDataTracker.On("GetStartHeightFromBlockID", mock.Anything).Unset()
+
+	s.Run("returns error for uninitialized index", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		s.executionDataTracker.On("GetStartHeightFromBlockID", flow.ZeroID).
+			Return(uint64(0), status.Errorf(codes.FailedPrecondition, "failed to get lowest indexed height: %v", indexer.ErrIndexNotInitialized)).
+			Once()
+
+		// Note: eventIndex.Initialize() is not called in this test
+		sub := s.backend.SubscribeEventsFromStartBlockID(subCtx, flow.ZeroID, state_stream.EventFilter{})
+		assert.Equal(s.T(), codes.FailedPrecondition, status.Code(sub.Err()), "expected FailedPrecondition, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	s.Run("returns error for start below lowest indexed", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		s.executionDataTracker.On("GetStartHeightFromBlockID", s.blocks[0].ID()).
+			Return(uint64(0), status.Errorf(codes.InvalidArgument, "start height %d is lower than lowest indexed height %d", s.blocks[0].Header.Height, 0)).
+			Once()
+
+		sub := s.backend.SubscribeEventsFromStartBlockID(subCtx, s.blocks[0].ID(), state_stream.EventFilter{})
+		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()), "expected InvalidArgument, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	s.Run("returns error for start above highest indexed", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		s.executionDataTracker.On("GetStartHeightFromBlockID", s.blocks[len(s.blocks)-1].ID()).
+			Return(uint64(0), status.Errorf(codes.InvalidArgument, "start height %d is higher than highest indexed height %d", s.blocks[len(s.blocks)-1].Header.Height, s.blocks[0].Header.Height)).
+			Once()
+
+		sub := s.backend.SubscribeEventsFromStartBlockID(subCtx, s.blocks[len(s.blocks)-1].ID(), state_stream.EventFilter{})
+		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()), "expected InvalidArgument, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+}
+
+// TestSubscribeEventsFromStartHeightHandlesErrors tests error handling for SubscribeEventsFromStartHeight subscription.
+//
+// Test Cases:
+//
+// 1. Returns error for start height before root height:
+//   - Validates that attempting to subscribe with a start height before the root height results in an InvalidArgument error.
+//
+// 2. Returns error for unindexed start height:
+//   - Tests that subscribing with an unindexed start height results in a NotFound error.
+//
+// 3. Returns error for uninitialized index:
+//   - Ensures that subscribing with an uninitialized index results in a FailedPrecondition error.
+//
+// 4. Returns error for start below lowest indexed:
+//   - Validates that subscribing with a start height below the lowest indexed height results in an InvalidArgument error.
+//
+// 5. Returns error for start above highest indexed:
+//   - Validates that subscribing with a start height above the highest indexed height results in an InvalidArgument error.
+func (s *BackendExecutionDataSuite) TestSubscribeEventsFromStartHeightHandlesErrors() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	s.executionDataTracker.On(
+		"GetStartHeightFromHeight",
+		mock.Anything,
+	).Return(func(startHeight uint64) (uint64, error) {
+		return s.executionDataTrackerReal.GetStartHeightFromHeight(startHeight)
+	}, nil)
+
+	s.Run("returns error for start height before root height", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeEventsFromStartHeight(subCtx, s.rootBlock.Header.Height-1, state_stream.EventFilter{})
+		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()), "expected InvalidArgument, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	// make sure we're starting with a fresh cache
+	s.execDataHeroCache.Clear()
+
+	s.Run("returns error for unindexed start height", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		sub := s.backend.SubscribeEventsFromStartHeight(subCtx, s.blocks[len(s.blocks)-1].Header.Height+10, state_stream.EventFilter{})
+		assert.Equal(s.T(), codes.NotFound, status.Code(sub.Err()), "expected NotFound, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	// Unset GetStartHeightFromHeight to mock new behavior instead of default one
+	s.executionDataTracker.On("GetStartHeightFromHeight", mock.Anything).Unset()
+
+	s.Run("returns error for uninitialized index", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		s.executionDataTracker.On("GetStartHeightFromHeight", s.blocks[0].Header.Height).
+			Return(uint64(0), status.Errorf(codes.FailedPrecondition, "failed to get lowest indexed height: %v", indexer.ErrIndexNotInitialized)).
+			Once()
+
+		// Note: eventIndex.Initialize() is not called in this test
+		sub := s.backend.SubscribeEventsFromStartHeight(subCtx, s.blocks[0].Header.Height, state_stream.EventFilter{})
+		assert.Equal(s.T(), codes.FailedPrecondition, status.Code(sub.Err()), "expected FailedPrecondition, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	s.Run("returns error for start below lowest indexed", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		s.executionDataTracker.On("GetStartHeightFromHeight", s.blocks[0].Header.Height).
+			Return(uint64(0), status.Errorf(codes.InvalidArgument, "start height %d is lower than lowest indexed height %d", s.blocks[0].Header.Height, 0)).
+			Once()
+
+		sub := s.backend.SubscribeEventsFromStartHeight(subCtx, s.blocks[0].Header.Height, state_stream.EventFilter{})
+		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()), "expected InvalidArgument, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
+
+	s.Run("returns error for start above highest indexed", func() {
+		subCtx, subCancel := context.WithCancel(ctx)
+		defer subCancel()
+
+		s.executionDataTracker.On("GetStartHeightFromHeight", s.blocks[len(s.blocks)-1].Header.Height).
+			Return(uint64(0), status.Errorf(codes.InvalidArgument, "start height %d is higher than highest indexed height %d", s.blocks[len(s.blocks)-1].Header.Height, s.blocks[0].Header.Height)).
+			Once()
+
+		sub := s.backend.SubscribeEventsFromStartHeight(subCtx, s.blocks[len(s.blocks)-1].Header.Height, state_stream.EventFilter{})
+		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()), "expected InvalidArgument, got %v: %v", status.Code(sub.Err()).String(), sub.Err())
+	})
 }
diff --git a/engine/access/state_stream/backend/backend_executiondata.go b/engine/access/state_stream/backend/backend_executiondata.go
index 4a181d33145..c1821593ffd 100644
--- a/engine/access/state_stream/backend/backend_executiondata.go
+++ b/engine/access/state_stream/backend/backend_executiondata.go
@@ -4,14 +4,12 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"time"
 
 	"github.com/rs/zerolog"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
-	"github.com/onflow/flow-go/engine"
-	"github.com/onflow/flow-go/engine/access/state_stream"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/engine/common/rpc"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/executiondatasync/execution_data"
@@ -24,15 +22,13 @@ type ExecutionDataResponse struct {
 }
 
 type ExecutionDataBackend struct {
-	log            zerolog.Logger
-	headers        storage.Headers
-	broadcaster    *engine.Broadcaster
-	sendTimeout    time.Duration
-	responseLimit  float64
-	sendBufferSize int
+	log     zerolog.Logger
+	headers storage.Headers
 
 	getExecutionData GetExecutionDataFunc
-	getStartHeight   GetStartHeightFunc
+
+	subscriptionHandler  *subscription.SubscriptionHandler
+	executionDataTracker subscription.ExecutionDataTracker
 }
 
 func (b *ExecutionDataBackend) GetExecutionDataByBlockID(ctx context.Context, blockID flow.Identifier) (*execution_data.BlockExecutionData, error) {
@@ -55,17 +51,13 @@ func (b *ExecutionDataBackend) GetExecutionDataByBlockID(ctx context.Context, bl
 	return executionData.BlockExecutionData, nil
 }
 
-func (b *ExecutionDataBackend) SubscribeExecutionData(ctx context.Context, startBlockID flow.Identifier, startHeight uint64) state_stream.Subscription {
-	nextHeight, err := b.getStartHeight(startBlockID, startHeight)
+func (b *ExecutionDataBackend) SubscribeExecutionData(ctx context.Context, startBlockID flow.Identifier, startHeight uint64) subscription.Subscription {
+	nextHeight, err := b.executionDataTracker.GetStartHeight(ctx, startBlockID, startHeight)
 	if err != nil {
-		return NewFailedSubscription(err, "could not get start height")
+		return subscription.NewFailedSubscription(err, "could not get start height")
 	}
 
-	sub := NewHeightBasedSubscription(b.sendBufferSize, nextHeight, b.getResponse)
-
-	go NewStreamer(b.log, b.broadcaster, b.sendTimeout, b.responseLimit, sub).Stream(ctx)
-
-	return sub
+	return b.subscriptionHandler.Subscribe(ctx, nextHeight, b.getResponse)
 }
 
 func (b *ExecutionDataBackend) getResponse(ctx context.Context, height uint64) (interface{}, error) {
diff --git a/engine/access/state_stream/backend/backend_executiondata_test.go b/engine/access/state_stream/backend/backend_executiondata_test.go
index 5b3ba2d5a4b..e27f1d3d229 100644
--- a/engine/access/state_stream/backend/backend_executiondata_test.go
+++ b/engine/access/state_stream/backend/backend_executiondata_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/ipfs/go-datastore"
 	dssync "github.com/ipfs/go-datastore/sync"
+	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
@@ -16,7 +17,10 @@ import (
 	"google.golang.org/grpc/status"
 
 	"github.com/onflow/flow-go/engine"
+	"github.com/onflow/flow-go/engine/access/index"
 	"github.com/onflow/flow-go/engine/access/state_stream"
+	"github.com/onflow/flow-go/engine/access/subscription"
+	subscriptionmock "github.com/onflow/flow-go/engine/access/subscription/mock"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/blobs"
 	"github.com/onflow/flow-go/module/execution"
@@ -31,16 +35,18 @@ import (
 	"github.com/onflow/flow-go/utils/unittest/mocks"
 )
 
-var chainID = flow.MonotonicEmulator
-var testEventTypes = []flow.EventType{
-	unittest.EventTypeFixture(chainID),
-	unittest.EventTypeFixture(chainID),
-	unittest.EventTypeFixture(chainID),
-}
+var (
+	chainID        = flow.MonotonicEmulator
+	testEventTypes = []flow.EventType{
+		unittest.EventTypeFixture(chainID),
+		unittest.EventTypeFixture(chainID),
+		unittest.EventTypeFixture(chainID),
+	}
+)
 
 type BackendExecutionDataSuite struct {
 	suite.Suite
-
+	logger         zerolog.Logger
 	state          *protocolmock.State
 	params         *protocolmock.Params
 	snapshot       *protocolmock.Snapshot
@@ -50,13 +56,16 @@ type BackendExecutionDataSuite struct {
 	results        *storagemock.ExecutionResults
 	registers      *storagemock.RegisterIndex
 	registersAsync *execution.RegistersAsyncStore
+	eventsIndex    *index.EventsIndex
 
-	bs                blobs.Blobstore
-	eds               execution_data.ExecutionDataStore
-	broadcaster       *engine.Broadcaster
-	execDataCache     *cache.ExecutionDataCache
-	execDataHeroCache *herocache.BlockExecutionData
-	backend           *StateStreamBackend
+	bs                       blobs.Blobstore
+	eds                      execution_data.ExecutionDataStore
+	broadcaster              *engine.Broadcaster
+	execDataCache            *cache.ExecutionDataCache
+	execDataHeroCache        *herocache.BlockExecutionData
+	executionDataTracker     *subscriptionmock.ExecutionDataTracker
+	backend                  *StateStreamBackend
+	executionDataTrackerReal subscription.ExecutionDataTracker
 
 	blocks      []*flow.Block
 	blockEvents map[flow.Identifier][]flow.Event
@@ -65,6 +74,9 @@ type BackendExecutionDataSuite struct {
 	sealMap     map[flow.Identifier]*flow.Seal
 	resultMap   map[flow.Identifier]*flow.ExecutionResult
 	registerID  flow.RegisterID
+
+	rootBlock          flow.Block
+	highestBlockHeader *flow.Header
 }
 
 func TestBackendExecutionDataSuite(t *testing.T) {
@@ -72,46 +84,11 @@ func TestBackendExecutionDataSuite(t *testing.T) {
 }
 
 func (s *BackendExecutionDataSuite) SetupTest() {
-	logger := unittest.Logger()
-
-	s.state = protocolmock.NewState(s.T())
-	s.snapshot = protocolmock.NewSnapshot(s.T())
-	s.params = protocolmock.NewParams(s.T())
-	s.headers = storagemock.NewHeaders(s.T())
-	s.events = storagemock.NewEvents(s.T())
-	s.seals = storagemock.NewSeals(s.T())
-	s.results = storagemock.NewExecutionResults(s.T())
-
-	s.bs = blobs.NewBlobstore(dssync.MutexWrap(datastore.NewMapDatastore()))
-	s.eds = execution_data.NewExecutionDataStore(s.bs, execution_data.DefaultSerializer)
-
-	s.broadcaster = engine.NewBroadcaster()
-
-	s.execDataHeroCache = herocache.NewBlockExecutionData(state_stream.DefaultCacheSize, logger, metrics.NewNoopCollector())
-	s.execDataCache = cache.NewExecutionDataCache(s.eds, s.headers, s.seals, s.results, s.execDataHeroCache)
-
-	conf := Config{
-		ClientSendTimeout:       state_stream.DefaultSendTimeout,
-		ClientSendBufferSize:    state_stream.DefaultSendBufferSize,
-		RegisterIDsRequestLimit: state_stream.DefaultRegisterIDsRequestLimit,
-	}
-
-	var err error
-
 	blockCount := 5
-	s.execDataMap = make(map[flow.Identifier]*execution_data.BlockExecutionDataEntity, blockCount)
-	s.blockEvents = make(map[flow.Identifier][]flow.Event, blockCount)
-	s.blockMap = make(map[uint64]*flow.Block, blockCount)
-	s.sealMap = make(map[flow.Identifier]*flow.Seal, blockCount)
-	s.resultMap = make(map[flow.Identifier]*flow.ExecutionResult, blockCount)
-	s.blocks = make([]*flow.Block, 0, blockCount)
+	s.SetupTestSuite(blockCount)
 
-	// generate blockCount consecutive blocks with associated seal, result and execution data
-	rootBlock := unittest.BlockFixture()
-	parent := rootBlock.Header
-	s.blockMap[rootBlock.Header.Height] = &rootBlock
-
-	s.T().Logf("Generating %d blocks, root block: %d %s", blockCount, rootBlock.Header.Height, rootBlock.ID())
+	var err error
+	parent := s.rootBlock.Header
 
 	for i := 0; i < blockCount; i++ {
 		block := unittest.BlockWithParentFixture(parent)
@@ -120,7 +97,7 @@ func (s *BackendExecutionDataSuite) SetupTest() {
 
 		seal := unittest.BlockSealsFixture(1)[0]
 		result := unittest.ExecutionResultFixture()
-		blockEvents := unittest.BlockEventsFixture(block.Header, (i%len(testEventTypes))*3+1, testEventTypes...)
+		blockEvents := generateMockEvents(block.Header, (i%len(testEventTypes))*3+1)
 
 		numChunks := 5
 		chunkDatas := make([]*execution_data.ChunkExecutionData, 0, numChunks)
@@ -154,14 +131,54 @@ func (s *BackendExecutionDataSuite) SetupTest() {
 		s.T().Logf("adding exec data for block %d %d %v => %v", i, block.Header.Height, block.ID(), result.ExecutionDataID)
 	}
 
+	s.SetupTestMocks()
+}
+
+func (s *BackendExecutionDataSuite) SetupTestSuite(blockCount int) {
+	s.logger = unittest.Logger()
+
+	s.state = protocolmock.NewState(s.T())
+	s.snapshot = protocolmock.NewSnapshot(s.T())
+	s.params = protocolmock.NewParams(s.T())
+	s.headers = storagemock.NewHeaders(s.T())
+	s.events = storagemock.NewEvents(s.T())
+	s.seals = storagemock.NewSeals(s.T())
+	s.results = storagemock.NewExecutionResults(s.T())
+
+	s.bs = blobs.NewBlobstore(dssync.MutexWrap(datastore.NewMapDatastore()))
+	s.eds = execution_data.NewExecutionDataStore(s.bs, execution_data.DefaultSerializer)
+
+	s.broadcaster = engine.NewBroadcaster()
+
+	s.execDataHeroCache = herocache.NewBlockExecutionData(subscription.DefaultCacheSize, s.logger, metrics.NewNoopCollector())
+	s.execDataCache = cache.NewExecutionDataCache(s.eds, s.headers, s.seals, s.results, s.execDataHeroCache)
+	s.executionDataTracker = subscriptionmock.NewExecutionDataTracker(s.T())
+
+	s.execDataMap = make(map[flow.Identifier]*execution_data.BlockExecutionDataEntity, blockCount)
+	s.blockEvents = make(map[flow.Identifier][]flow.Event, blockCount)
+	s.blockMap = make(map[uint64]*flow.Block, blockCount)
+	s.sealMap = make(map[flow.Identifier]*flow.Seal, blockCount)
+	s.resultMap = make(map[flow.Identifier]*flow.ExecutionResult, blockCount)
+	s.blocks = make([]*flow.Block, 0, blockCount)
+
+	// generate blockCount consecutive blocks with associated seal, result and execution data
+	s.rootBlock = unittest.BlockFixture()
+	s.blockMap[s.rootBlock.Header.Height] = &s.rootBlock
+	s.highestBlockHeader = s.rootBlock.Header
+
+	s.T().Logf("Generating %d blocks, root block: %d %s", blockCount, s.rootBlock.Header.Height, s.rootBlock.ID())
+}
+
+func (s *BackendExecutionDataSuite) SetupTestMocks() {
 	s.registerID = unittest.RegisterIDFixture()
 
+	s.eventsIndex = index.NewEventsIndex(s.events)
 	s.registersAsync = execution.NewRegistersAsyncStore()
 	s.registers = storagemock.NewRegisterIndex(s.T())
-	err = s.registersAsync.InitDataAvailable(s.registers)
+	err := s.registersAsync.Initialize(s.registers)
 	require.NoError(s.T(), err)
-	s.registers.On("LatestHeight").Return(rootBlock.Header.Height).Maybe()
-	s.registers.On("FirstHeight").Return(rootBlock.Header.Height).Maybe()
+	s.registers.On("LatestHeight").Return(s.rootBlock.Header.Height).Maybe()
+	s.registers.On("FirstHeight").Return(s.rootBlock.Header.Height).Maybe()
 	s.registers.On("Get", mock.AnythingOfType("RegisterID"), mock.AnythingOfType("uint64")).Return(
 		func(id flow.RegisterID, height uint64) (flow.RegisterValue, error) {
 			if id == s.registerID {
@@ -206,23 +223,86 @@ func (s *BackendExecutionDataSuite) SetupTest() {
 		),
 	).Maybe()
 
+	s.SetupBackend(false)
+}
+
+func (s *BackendExecutionDataSuite) SetupBackend(useEventsIndex bool) {
+	var err error
 	s.backend, err = New(
-		logger,
-		conf,
+		s.logger,
 		s.state,
 		s.headers,
-		s.events,
 		s.seals,
 		s.results,
 		s.eds,
 		s.execDataCache,
-		s.broadcaster,
-		rootBlock.Header.Height,
-		rootBlock.Header.Height, // initialize with no downloaded data
 		s.registersAsync,
-		false,
+		s.eventsIndex,
+		useEventsIndex,
+		state_stream.DefaultRegisterIDsRequestLimit,
+		subscription.NewSubscriptionHandler(
+			s.logger,
+			s.broadcaster,
+			subscription.DefaultSendTimeout,
+			subscription.DefaultResponseLimit,
+			subscription.DefaultSendBufferSize,
+		),
+		s.executionDataTracker,
 	)
 	require.NoError(s.T(), err)
+
+	// create real execution data tracker to use GetStartHeight from it, instead of mocking
+	s.executionDataTrackerReal = subscription.NewExecutionDataTracker(
+		s.logger,
+		s.state,
+		s.rootBlock.Header.Height,
+		s.headers,
+		s.broadcaster,
+		s.rootBlock.Header.Height,
+		s.eventsIndex,
+		useEventsIndex,
+	)
+
+	s.executionDataTracker.On(
+		"GetStartHeight",
+		mock.Anything,
+		mock.Anything,
+		mock.Anything,
+	).Return(func(ctx context.Context, startBlockID flow.Identifier, startHeight uint64) (uint64, error) {
+		return s.executionDataTrackerReal.GetStartHeight(ctx, startBlockID, startHeight)
+	}, nil).Maybe()
+
+	s.executionDataTracker.On("GetHighestHeight").Return(func() uint64 {
+		return s.highestBlockHeader.Height
+	}).Maybe()
+}
+
+// generateMockEvents generates a set of mock events for a block split into multiple tx with
+// appropriate indexes set
+func generateMockEvents(header *flow.Header, eventCount int) flow.BlockEvents {
+	txCount := eventCount / 3
+
+	txID := unittest.IdentifierFixture()
+	txIndex := uint32(0)
+	eventIndex := uint32(0)
+
+	events := make([]flow.Event, eventCount)
+	for i := 0; i < eventCount; i++ {
+		if i > 0 && i%txCount == 0 {
+			txIndex++
+			txID = unittest.IdentifierFixture()
+			eventIndex = 0
+		}
+
+		events[i] = unittest.EventFixture(testEventTypes[i%len(testEventTypes)], txIndex, eventIndex, txID, 0)
+	}
+
+	return flow.BlockEvents{
+		BlockID:        header.ID(),
+		BlockHeight:    header.Height,
+		BlockTimestamp: header.Timestamp,
+		Events:         events,
+	}
 }
 
 func (s *BackendExecutionDataSuite) TestGetExecutionDataByBlockID() {
@@ -235,7 +315,7 @@ func (s *BackendExecutionDataSuite) TestGetExecutionDataByBlockID() {
 	execData := s.execDataMap[block.ID()]
 
 	// notify backend block is available
-	s.backend.setHighestHeight(block.Header.Height)
+	s.highestBlockHeader = block.Header
 
 	var err error
 	s.Run("happy path TestGetExecutionDataByBlockID success", func() {
@@ -290,12 +370,12 @@ func (s *BackendExecutionDataSuite) TestSubscribeExecutionData() {
 			name:            "happy path - start from root block by height",
 			highestBackfill: len(s.blocks) - 1, // backfill all blocks
 			startBlockID:    flow.ZeroID,
-			startHeight:     s.backend.rootBlockHeight, // start from root block
+			startHeight:     s.rootBlock.Header.Height, // start from root block
 		},
 		{
 			name:            "happy path - start from root block by id",
-			highestBackfill: len(s.blocks) - 1,     // backfill all blocks
-			startBlockID:    s.backend.rootBlockID, // start from root block
+			highestBackfill: len(s.blocks) - 1,       // backfill all blocks
+			startBlockID:    s.rootBlock.Header.ID(), // start from root block
 			startHeight:     0,
 		},
 	}
@@ -311,21 +391,21 @@ func (s *BackendExecutionDataSuite) TestSubscribeExecutionData() {
 			// this simulates a subscription on a past block
 			for i := 0; i <= test.highestBackfill; i++ {
 				s.T().Logf("backfilling block %d", i)
-				s.backend.setHighestHeight(s.blocks[i].Header.Height)
+				s.highestBlockHeader = s.blocks[i].Header
 			}
 
 			subCtx, subCancel := context.WithCancel(ctx)
 			sub := s.backend.SubscribeExecutionData(subCtx, test.startBlockID, test.startHeight)
 
-			// loop over all of the blocks
+			// loop over of the all blocks
 			for i, b := range s.blocks {
 				execData := s.execDataMap[b.ID()]
-				s.T().Logf("checking block %d %v", i, b.ID())
+				s.T().Logf("checking block %d %v %v", i, b.Header.Height, b.ID())
 
 				// simulate new exec data received.
 				// exec data for all blocks with index <= highestBackfill were already received
 				if i > test.highestBackfill {
-					s.backend.setHighestHeight(b.Header.Height)
+					s.highestBlockHeader = b.Header
 					s.broadcaster.Publish()
 				}
 
@@ -377,7 +457,7 @@ func (s *BackendExecutionDataSuite) TestSubscribeExecutionDataHandlesErrors() {
 		subCtx, subCancel := context.WithCancel(ctx)
 		defer subCancel()
 
-		sub := s.backend.SubscribeExecutionData(subCtx, flow.ZeroID, s.backend.rootBlockHeight-1)
+		sub := s.backend.SubscribeExecutionData(subCtx, flow.ZeroID, s.rootBlock.Header.Height-1)
 		assert.Equal(s.T(), codes.InvalidArgument, status.Code(sub.Err()))
 	})
 
@@ -403,24 +483,27 @@ func (s *BackendExecutionDataSuite) TestSubscribeExecutionDataHandlesErrors() {
 
 func (s *BackendExecutionDataSuite) TestGetRegisterValues() {
 	s.Run("normal case", func() {
-		res, err := s.backend.GetRegisterValues(flow.RegisterIDs{s.registerID}, s.backend.rootBlockHeight)
+		res, err := s.backend.GetRegisterValues(flow.RegisterIDs{s.registerID}, s.rootBlock.Header.Height)
 		require.NoError(s.T(), err)
 		require.NotEmpty(s.T(), res)
 	})
 
 	s.Run("returns error if block height is out of range", func() {
-		_, err := s.backend.GetRegisterValues(flow.RegisterIDs{s.registerID}, s.backend.rootBlockHeight+1)
+		res, err := s.backend.GetRegisterValues(flow.RegisterIDs{s.registerID}, s.rootBlock.Header.Height+1)
+		require.Nil(s.T(), res)
 		require.Equal(s.T(), codes.OutOfRange, status.Code(err))
 	})
 
 	s.Run("returns error if register path is not indexed", func() {
 		falseID := flow.RegisterIDs{flow.RegisterID{Owner: "ha", Key: "ha"}}
-		_, err := s.backend.GetRegisterValues(falseID, s.backend.rootBlockHeight)
+		res, err := s.backend.GetRegisterValues(falseID, s.rootBlock.Header.Height)
+		require.Nil(s.T(), res)
 		require.Equal(s.T(), codes.NotFound, status.Code(err))
 	})
 
 	s.Run("returns error if too many registers are requested", func() {
-		_, err := s.backend.GetRegisterValues(make(flow.RegisterIDs, s.backend.registerRequestLimit+1), s.backend.rootBlockHeight)
+		res, err := s.backend.GetRegisterValues(make(flow.RegisterIDs, s.backend.registerRequestLimit+1), s.rootBlock.Header.Height)
+		require.Nil(s.T(), res)
 		require.Equal(s.T(), codes.InvalidArgument, status.Code(err))
 	})
 }
diff --git a/engine/access/state_stream/backend/engine.go b/engine/access/state_stream/backend/engine.go
index f6a9557862e..fb9196c6703 100644
--- a/engine/access/state_stream/backend/engine.go
+++ b/engine/access/state_stream/backend/engine.go
@@ -5,15 +5,12 @@ import (
 
 	"github.com/onflow/flow/protobuf/go/flow/executiondata"
 
-	"github.com/onflow/flow-go/engine"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/component"
-	"github.com/onflow/flow-go/module/executiondatasync/execution_data"
 	"github.com/onflow/flow-go/module/executiondatasync/execution_data/cache"
 	"github.com/onflow/flow-go/module/grpcserver"
 	"github.com/onflow/flow-go/module/irrecoverable"
 	"github.com/onflow/flow-go/storage"
-	"github.com/onflow/flow-go/utils/logging"
 )
 
 // Engine exposes the server with the state stream API.
@@ -27,9 +24,8 @@ type Engine struct {
 	chain   flow.Chain
 	handler *Handler
 
-	execDataBroadcaster *engine.Broadcaster
-	execDataCache       *cache.ExecutionDataCache
-	headers             storage.Headers
+	execDataCache *cache.ExecutionDataCache
+	headers       storage.Headers
 }
 
 // NewEng returns a new ingress server.
@@ -41,19 +37,17 @@ func NewEng(
 	chainID flow.ChainID,
 	server *grpcserver.GrpcServer,
 	backend *StateStreamBackend,
-	broadcaster *engine.Broadcaster,
 ) (*Engine, error) {
 	logger := log.With().Str("engine", "state_stream_rpc").Logger()
 
 	e := &Engine{
-		log:                 logger,
-		backend:             backend,
-		headers:             headers,
-		chain:               chainID.Chain(),
-		config:              config,
-		handler:             NewHandler(backend, chainID.Chain(), config),
-		execDataBroadcaster: broadcaster,
-		execDataCache:       execDataCache,
+		log:           logger,
+		backend:       backend,
+		headers:       headers,
+		chain:         chainID.Chain(),
+		config:        config,
+		handler:       NewHandler(backend, chainID.Chain(), config),
+		execDataCache: execDataCache,
 	}
 
 	e.ComponentManager = component.NewComponentManagerBuilder().
@@ -67,30 +61,3 @@ func NewEng(
 
 	return e, nil
 }
-
-// OnExecutionData is called to notify the engine when a new execution data is received.
-// The caller must guarantee that execution data is locally available for all blocks with
-// heights between the initialBlockHeight provided during startup and the block height of
-// the execution data provided.
-func (e *Engine) OnExecutionData(executionData *execution_data.BlockExecutionDataEntity) {
-	lg := e.log.With().Hex("block_id", logging.ID(executionData.BlockID)).Logger()
-
-	lg.Trace().Msg("received execution data")
-
-	header, err := e.headers.ByBlockID(executionData.BlockID)
-	if err != nil {
-		// if the execution data is available, the block must be locally finalized
-		lg.Fatal().Err(err).Msg("failed to get header for execution data")
-		return
-	}
-
-	if ok := e.backend.setHighestHeight(header.Height); !ok {
-		// this means that the height was lower than the current highest height
-		// OnExecutionData is guaranteed by the requester to be called in order, but may be called
-		// multiple times for the same block.
-		lg.Debug().Msg("execution data for block already received")
-		return
-	}
-
-	e.execDataBroadcaster.Publish()
-}
diff --git a/engine/access/state_stream/backend/event_retriever.go b/engine/access/state_stream/backend/event_retriever.go
new file mode 100644
index 00000000000..eb1ef29c015
--- /dev/null
+++ b/engine/access/state_stream/backend/event_retriever.go
@@ -0,0 +1,107 @@
+package backend
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/engine/access/index"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/storage"
+	"github.com/onflow/flow-go/utils/logging"
+)
+
+// EventsResponse represents the response containing events for a specific block.
+type EventsResponse struct {
+	BlockID        flow.Identifier
+	Height         uint64
+	Events         flow.EventsList
+	BlockTimestamp time.Time
+}
+
+// EventsRetriever retrieves events by block height. It can be configured to retrieve events from
+// the events indexer(if available) or using a dedicated callback to query it from other sources.
+type EventsRetriever struct {
+	log              zerolog.Logger
+	headers          storage.Headers
+	getExecutionData GetExecutionDataFunc
+	eventsIndex      *index.EventsIndex
+	useEventsIndex   bool
+}
+
+// GetAllEventsResponse returns a function that retrieves the event response for a given block height.
+// Expected errors:
+// - codes.NotFound: If block header for the specified block height is not found.
+// - error: An error, if any, encountered during getting events from storage or execution data.
+func (b *EventsRetriever) GetAllEventsResponse(ctx context.Context, height uint64) (*EventsResponse, error) {
+	var response *EventsResponse
+	var err error
+	if b.useEventsIndex {
+		response, err = b.getEventsFromStorage(height)
+	} else {
+		response, err = b.getEventsFromExecutionData(ctx, height)
+	}
+
+	if err == nil {
+		header, err := b.headers.ByHeight(height)
+		if err != nil {
+			return nil, fmt.Errorf("could not get header for height %d: %w", height, err)
+		}
+		response.BlockTimestamp = header.Timestamp
+
+		if b.log.GetLevel() == zerolog.TraceLevel {
+			b.log.Trace().
+				Hex("block_id", logging.ID(response.BlockID)).
+				Uint64("height", height).
+				Int("events", len(response.Events)).
+				Msg("sending events")
+		}
+	}
+
+	return response, err
+}
+
+// getEventsFromExecutionData returns the events for a given height extract from the execution data.
+// Expected errors:
+// - error: An error indicating issues with getting execution data for block
+func (b *EventsRetriever) getEventsFromExecutionData(ctx context.Context, height uint64) (*EventsResponse, error) {
+	executionData, err := b.getExecutionData(ctx, height)
+	if err != nil {
+		return nil, fmt.Errorf("could not get execution data for block %d: %w", height, err)
+	}
+
+	var events flow.EventsList
+	for _, chunkExecutionData := range executionData.ChunkExecutionDatas {
+		events = append(events, chunkExecutionData.Events...)
+	}
+
+	return &EventsResponse{
+		BlockID: executionData.BlockID,
+		Height:  height,
+		Events:  events,
+	}, nil
+}
+
+// getEventsFromStorage returns the events for a given height from the index storage.
+// Expected errors:
+// - error: An error indicating any issues with the provided block height or
+// an error indicating issue with getting events for a block.
+func (b *EventsRetriever) getEventsFromStorage(height uint64) (*EventsResponse, error) {
+	blockID, err := b.headers.BlockIDByHeight(height)
+	if err != nil {
+		return nil, fmt.Errorf("could not get header for height %d: %w", height, err)
+	}
+
+	events, err := b.eventsIndex.ByBlockID(blockID, height)
+	if err != nil {
+		return nil, fmt.Errorf("could not get events for block %d: %w", height, err)
+	}
+
+	return &EventsResponse{
+		BlockID: blockID,
+		Height:  height,
+		Events:  events,
+	}, nil
+}
diff --git a/engine/access/state_stream/backend/handler.go b/engine/access/state_stream/backend/handler.go
index 6ed22589562..9825567137d 100644
--- a/engine/access/state_stream/backend/handler.go
+++ b/engine/access/state_stream/backend/handler.go
@@ -2,38 +2,44 @@ package backend
 
 import (
 	"context"
-	"sync/atomic"
 
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/onflow/flow/protobuf/go/flow/entities"
 	"github.com/onflow/flow/protobuf/go/flow/executiondata"
 
 	"github.com/onflow/flow-go/engine/access/state_stream"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/engine/common/rpc"
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
 	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/counters"
 )
 
 type Handler struct {
+	subscription.StreamingData
+
 	api   state_stream.API
 	chain flow.Chain
 
-	eventFilterConfig state_stream.EventFilterConfig
-
-	maxStreams               int32
-	streamCount              atomic.Int32
+	eventFilterConfig        state_stream.EventFilterConfig
 	defaultHeartbeatInterval uint64
 }
 
+// sendSubscribeEventsResponseFunc is a callback function used to send
+// SubscribeEventsResponse to the client stream.
+type sendSubscribeEventsResponseFunc func(*executiondata.SubscribeEventsResponse) error
+
+var _ executiondata.ExecutionDataAPIServer = (*Handler)(nil)
+
 func NewHandler(api state_stream.API, chain flow.Chain, config Config) *Handler {
 	h := &Handler{
+		StreamingData:            subscription.NewStreamingData(config.MaxGlobalStreams),
 		api:                      api,
 		chain:                    chain,
 		eventFilterConfig:        config.EventFilterConfig,
-		maxStreams:               int32(config.MaxGlobalStreams),
-		streamCount:              atomic.Int32{},
 		defaultHeartbeatInterval: config.HeartbeatInterval,
 	}
 	return h
@@ -65,11 +71,11 @@ func (h *Handler) GetExecutionDataByBlockID(ctx context.Context, request *execut
 
 func (h *Handler) SubscribeExecutionData(request *executiondata.SubscribeExecutionDataRequest, stream executiondata.ExecutionDataAPI_SubscribeExecutionDataServer) error {
 	// check if the maximum number of streams is reached
-	if h.streamCount.Load() >= h.maxStreams {
+	if h.StreamCount.Load() >= h.MaxStreams {
 		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
 	}
-	h.streamCount.Add(1)
-	defer h.streamCount.Add(-1)
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
 
 	startBlockID := flow.ZeroID
 	if request.GetStartBlockId() != nil {
@@ -116,13 +122,28 @@ func (h *Handler) SubscribeExecutionData(request *executiondata.SubscribeExecuti
 	}
 }
 
+// SubscribeEvents is deprecated and will be removed in a future version.
+// Use SubscribeEventsFromStartBlockID, SubscribeEventsFromStartHeight or SubscribeEventsFromLatest.
+//
+// SubscribeEvents handles subscription requests for events starting at the specified block ID or block height.
+// The handler manages the subscription and sends the subscribed information to the client via the provided stream.
+//
+// Responses are returned for each block containing at least one event that matches the filter. Additionally,
+// heartbeat responses (SubscribeEventsResponse with no events) are returned periodically to allow
+// clients to track which blocks were searched. Clients can use this
+// information to determine which block to start from when reconnecting.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument   - if provided both startBlockID and startHeight, if invalid startBlockID is provided, if invalid event filter is provided.
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal          - could not convert events to entity, if stream encountered an error, if stream got unexpected response or could not send response.
 func (h *Handler) SubscribeEvents(request *executiondata.SubscribeEventsRequest, stream executiondata.ExecutionDataAPI_SubscribeEventsServer) error {
 	// check if the maximum number of streams is reached
-	if h.streamCount.Load() >= h.maxStreams {
+	if h.StreamCount.Load() >= h.MaxStreams {
 		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
 	}
-	h.streamCount.Add(1)
-	defer h.streamCount.Add(-1)
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
 
 	startBlockID := flow.ZeroID
 	if request.GetStartBlockId() != nil {
@@ -133,50 +154,137 @@ func (h *Handler) SubscribeEvents(request *executiondata.SubscribeEventsRequest,
 		startBlockID = blockID
 	}
 
-	filter := state_stream.EventFilter{}
-	if request.GetFilter() != nil {
-		var err error
-		reqFilter := request.GetFilter()
-		filter, err = state_stream.NewEventFilter(
-			h.eventFilterConfig,
-			h.chain,
-			reqFilter.GetEventType(),
-			reqFilter.GetAddress(),
-			reqFilter.GetContract(),
-		)
-		if err != nil {
-			return status.Errorf(codes.InvalidArgument, "invalid event filter: %v", err)
-		}
+	filter, err := h.getEventFilter(request.GetFilter())
+	if err != nil {
+		return err
 	}
 
 	sub := h.api.SubscribeEvents(stream.Context(), startBlockID, request.GetStartBlockHeight(), filter)
 
-	heartbeatInterval := request.HeartbeatInterval
+	return subscription.HandleSubscription(sub, h.handleEventsResponse(stream.Send, request.HeartbeatInterval, request.GetEventEncodingVersion()))
+}
+
+// SubscribeEventsFromStartBlockID handles subscription requests for events starting at the specified block ID.
+// The handler manages the subscription and sends the subscribed information to the client via the provided stream.
+//
+// Responses are returned for each block containing at least one event that matches the filter. Additionally,
+// heartbeat responses (SubscribeEventsResponse with no events) are returned periodically to allow
+// clients to track which blocks were searched. Clients can use this
+// information to determine which block to start from when reconnecting.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument   - if invalid startBlockID is provided, if invalid event filter is provided.
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal          - could not convert events to entity, if stream encountered an error, if stream got unexpected response or could not send response.
+func (h *Handler) SubscribeEventsFromStartBlockID(request *executiondata.SubscribeEventsFromStartBlockIDRequest, stream executiondata.ExecutionDataAPI_SubscribeEventsFromStartBlockIDServer) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	startBlockID, err := convert.BlockID(request.GetStartBlockId())
+	if err != nil {
+		return status.Errorf(codes.InvalidArgument, "could not convert start block ID: %v", err)
+	}
+
+	filter, err := h.getEventFilter(request.GetFilter())
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeEventsFromStartBlockID(stream.Context(), startBlockID, filter)
+
+	return subscription.HandleSubscription(sub, h.handleEventsResponse(stream.Send, request.HeartbeatInterval, request.GetEventEncodingVersion()))
+}
+
+// SubscribeEventsFromStartHeight handles subscription requests for events starting at the specified block height.
+// The handler manages the subscription and sends the subscribed information to the client via the provided stream.
+//
+// Responses are returned for each block containing at least one event that matches the filter. Additionally,
+// heartbeat responses (SubscribeEventsResponse with no events) are returned periodically to allow
+// clients to track which blocks were searched. Clients can use this
+// information to determine which block to start from when reconnecting.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument   - if invalid event filter is provided.
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal          - could not convert events to entity, if stream encountered an error, if stream got unexpected response or could not send response.
+func (h *Handler) SubscribeEventsFromStartHeight(request *executiondata.SubscribeEventsFromStartHeightRequest, stream executiondata.ExecutionDataAPI_SubscribeEventsFromStartHeightServer) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	filter, err := h.getEventFilter(request.GetFilter())
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeEventsFromStartHeight(stream.Context(), request.GetStartBlockHeight(), filter)
+
+	return subscription.HandleSubscription(sub, h.handleEventsResponse(stream.Send, request.HeartbeatInterval, request.GetEventEncodingVersion()))
+}
+
+// SubscribeEventsFromLatest handles subscription requests for events started from latest sealed block..
+// The handler manages the subscription and sends the subscribed information to the client via the provided stream.
+//
+// Responses are returned for each block containing at least one event that matches the filter. Additionally,
+// heartbeat responses (SubscribeEventsResponse with no events) are returned periodically to allow
+// clients to track which blocks were searched. Clients can use this
+// information to determine which block to start from when reconnecting.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument   - if invalid event filter is provided.
+// - codes.ResourceExhausted - if the maximum number of streams is reached.
+// - codes.Internal          - could not convert events to entity, if stream encountered an error, if stream got unexpected response or could not send response.
+func (h *Handler) SubscribeEventsFromLatest(request *executiondata.SubscribeEventsFromLatestRequest, stream executiondata.ExecutionDataAPI_SubscribeEventsFromLatestServer) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	filter, err := h.getEventFilter(request.GetFilter())
+	if err != nil {
+		return err
+	}
+
+	sub := h.api.SubscribeEventsFromLatest(stream.Context(), filter)
+
+	return subscription.HandleSubscription(sub, h.handleEventsResponse(stream.Send, request.HeartbeatInterval, request.GetEventEncodingVersion()))
+}
+
+// handleEventsResponse handles the event subscription and sends subscribed events to the client via the provided stream.
+// This function is designed to be used as a callback for events updates in a subscription.
+// It takes a EventsResponse, processes it, and sends the corresponding response to the client using the provided send function.
+//
+// Parameters:
+// - send: The function responsible for sending events response to the client.
+//
+// Returns a function that can be used as a callback for events updates.
+//
+// Expected errors during normal operation:
+//   - codes.Internal - could not convert events to entity or the stream could not send a response.
+func (h *Handler) handleEventsResponse(send sendSubscribeEventsResponseFunc, heartbeatInterval uint64, eventEncodingVersion entities.EventEncodingVersion) func(*EventsResponse) error {
 	if heartbeatInterval == 0 {
 		heartbeatInterval = h.defaultHeartbeatInterval
 	}
 
 	blocksSinceLastMessage := uint64(0)
-	for {
-		v, ok := <-sub.Channel()
-		if !ok {
-			if sub.Err() != nil {
-				return rpc.ConvertError(sub.Err(), "stream encountered an error", codes.Internal)
-			}
-			return nil
-		}
-
-		resp, ok := v.(*EventsResponse)
-		if !ok {
-			return status.Errorf(codes.Internal, "unexpected response type: %T", v)
-		}
+	messageIndex := counters.NewMonotonousCounter(0)
 
+	return func(resp *EventsResponse) error {
 		// check if there are any events in the response. if not, do not send a message unless the last
 		// response was more than HeartbeatInterval blocks ago
 		if len(resp.Events) == 0 {
 			blocksSinceLastMessage++
 			if blocksSinceLastMessage < heartbeatInterval {
-				continue
+				return nil
 			}
 			blocksSinceLastMessage = 0
 		}
@@ -184,20 +292,58 @@ func (h *Handler) SubscribeEvents(request *executiondata.SubscribeEventsRequest,
 		// BlockExecutionData contains CCF encoded events, and the Access API returns JSON-CDC events.
 		// convert event payload formats.
 		// This is a temporary solution until the Access API supports specifying the encoding in the request
-		events, err := convert.EventsToMessagesWithEncodingConversion(resp.Events, entities.EventEncodingVersion_CCF_V0, request.GetEventEncodingVersion())
+		events, err := convert.EventsToMessagesWithEncodingConversion(resp.Events, entities.EventEncodingVersion_CCF_V0, eventEncodingVersion)
 		if err != nil {
 			return status.Errorf(codes.Internal, "could not convert events to entity: %v", err)
 		}
 
-		err = stream.Send(&executiondata.SubscribeEventsResponse{
-			BlockHeight: resp.Height,
-			BlockId:     convert.IdentifierToMessage(resp.BlockID),
-			Events:      events,
+		index := messageIndex.Value()
+		if ok := messageIndex.Set(index + 1); !ok {
+			return status.Errorf(codes.Internal, "message index already incremented to %d", messageIndex.Value())
+		}
+
+		err = send(&executiondata.SubscribeEventsResponse{
+			BlockHeight:    resp.Height,
+			BlockId:        convert.IdentifierToMessage(resp.BlockID),
+			Events:         events,
+			BlockTimestamp: timestamppb.New(resp.BlockTimestamp),
+			MessageIndex:   index,
 		})
 		if err != nil {
 			return rpc.ConvertError(err, "could not send response", codes.Internal)
 		}
+
+		return nil
+	}
+}
+
+// getEventFilter returns an event filter based on the provided event filter configuration.
+// If the event filter is nil, it returns an empty filter.
+// Otherwise, it initializes a new event filter using the provided filter parameters,
+// including the event type, address, and contract. It then validates the filter configuration
+// and returns the constructed event filter or an error if the filter configuration is invalid.
+// The event filter is used for subscription to events.
+//
+// Parameters:
+// - eventFilter: executiondata.EventFilter object containing filter parameters.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument - if the provided event filter is invalid.
+func (h *Handler) getEventFilter(eventFilter *executiondata.EventFilter) (state_stream.EventFilter, error) {
+	if eventFilter == nil {
+		return state_stream.EventFilter{}, nil
+	}
+	filter, err := state_stream.NewEventFilter(
+		h.eventFilterConfig,
+		h.chain,
+		eventFilter.GetEventType(),
+		eventFilter.GetAddress(),
+		eventFilter.GetContract(),
+	)
+	if err != nil {
+		return filter, status.Errorf(codes.InvalidArgument, "invalid event filter: %v", err)
 	}
+	return filter, nil
 }
 
 func (h *Handler) GetRegisterValues(_ context.Context, request *executiondata.GetRegisterValuesRequest) (*executiondata.GetRegisterValuesResponse, error) {
@@ -215,3 +361,160 @@ func (h *Handler) GetRegisterValues(_ context.Context, request *executiondata.Ge
 
 	return &executiondata.GetRegisterValuesResponse{Values: values}, nil
 }
+
+// convertAccountsStatusesResultsToMessage converts account status responses to the message
+func convertAccountsStatusesResultsToMessage(
+	eventVersion entities.EventEncodingVersion,
+	resp *AccountStatusesResponse,
+) ([]*executiondata.SubscribeAccountStatusesResponse_Result, error) {
+	var results []*executiondata.SubscribeAccountStatusesResponse_Result
+	for address, events := range resp.AccountEvents {
+		convertedEvent, err := convert.EventsToMessagesWithEncodingConversion(events, entities.EventEncodingVersion_CCF_V0, eventVersion)
+		if err != nil {
+			return nil, status.Errorf(codes.Internal, "could not convert events to entity: %v", err)
+		}
+
+		results = append(results, &executiondata.SubscribeAccountStatusesResponse_Result{
+			Address: flow.HexToAddress(address).Bytes(),
+			Events:  convertedEvent,
+		})
+	}
+	return results, nil
+}
+
+// sendSubscribeAccountStatusesResponseFunc defines the function signature for sending account status responses
+type sendSubscribeAccountStatusesResponseFunc func(*executiondata.SubscribeAccountStatusesResponse) error
+
+// handleAccountStatusesResponse handles account status responses by converting them to the message and sending them to the subscriber.
+func (h *Handler) handleAccountStatusesResponse(
+	heartbeatInterval uint64,
+	evenVersion entities.EventEncodingVersion,
+	send sendSubscribeAccountStatusesResponseFunc,
+) func(resp *AccountStatusesResponse) error {
+	if heartbeatInterval == 0 {
+		heartbeatInterval = h.defaultHeartbeatInterval
+	}
+
+	blocksSinceLastMessage := uint64(0)
+	messageIndex := counters.NewMonotonousCounter(0)
+
+	return func(resp *AccountStatusesResponse) error {
+		// check if there are any events in the response. if not, do not send a message unless the last
+		// response was more than HeartbeatInterval blocks ago
+		if len(resp.AccountEvents) == 0 {
+			blocksSinceLastMessage++
+			if blocksSinceLastMessage < heartbeatInterval {
+				return nil
+			}
+			blocksSinceLastMessage = 0
+		}
+
+		results, err := convertAccountsStatusesResultsToMessage(evenVersion, resp)
+		if err != nil {
+			return err
+		}
+
+		index := messageIndex.Value()
+		if ok := messageIndex.Set(index + 1); !ok {
+			return status.Errorf(codes.Internal, "message index already incremented to %d", messageIndex.Value())
+		}
+
+		err = send(&executiondata.SubscribeAccountStatusesResponse{
+			BlockId:      convert.IdentifierToMessage(resp.BlockID),
+			BlockHeight:  resp.Height,
+			Results:      results,
+			MessageIndex: index,
+		})
+		if err != nil {
+			return rpc.ConvertError(err, "could not send response", codes.Internal)
+		}
+
+		return nil
+	}
+}
+
+// SubscribeAccountStatusesFromStartBlockID streams account statuses for all blocks starting at the requested
+// start block ID, up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+func (h *Handler) SubscribeAccountStatusesFromStartBlockID(
+	request *executiondata.SubscribeAccountStatusesFromStartBlockIDRequest,
+	stream executiondata.ExecutionDataAPI_SubscribeAccountStatusesFromStartBlockIDServer,
+) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	startBlockID, err := convert.BlockID(request.GetStartBlockId())
+	if err != nil {
+		return status.Errorf(codes.InvalidArgument, "could not convert start block ID: %v", err)
+	}
+
+	statusFilter := request.GetFilter()
+	filter, err := state_stream.NewAccountStatusFilter(h.eventFilterConfig, h.chain, statusFilter.GetEventType(), statusFilter.GetAddress())
+	if err != nil {
+		return status.Errorf(codes.InvalidArgument, "could not create account status filter: %v", err)
+	}
+
+	sub := h.api.SubscribeAccountStatusesFromStartBlockID(stream.Context(), startBlockID, filter)
+
+	return subscription.HandleSubscription(sub, h.handleAccountStatusesResponse(request.HeartbeatInterval, request.GetEventEncodingVersion(), stream.Send))
+}
+
+// SubscribeAccountStatusesFromStartHeight streams account statuses for all blocks starting at the requested
+// start block height, up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+func (h *Handler) SubscribeAccountStatusesFromStartHeight(
+	request *executiondata.SubscribeAccountStatusesFromStartHeightRequest,
+	stream executiondata.ExecutionDataAPI_SubscribeAccountStatusesFromStartHeightServer,
+) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	statusFilter := request.GetFilter()
+	filter, err := state_stream.NewAccountStatusFilter(h.eventFilterConfig, h.chain, statusFilter.GetEventType(), statusFilter.GetAddress())
+	if err != nil {
+		return status.Errorf(codes.InvalidArgument, "could not create account status filter: %v", err)
+	}
+
+	sub := h.api.SubscribeAccountStatusesFromStartHeight(stream.Context(), request.GetStartBlockHeight(), filter)
+
+	return subscription.HandleSubscription(sub, h.handleAccountStatusesResponse(request.HeartbeatInterval, request.GetEventEncodingVersion(), stream.Send))
+}
+
+// SubscribeAccountStatusesFromLatestBlock streams account statuses for all blocks starting
+// at the last sealed block, up until the latest available block. Once the latest is
+// reached, the stream will remain open and responses are sent for each new
+// block as it becomes available.
+func (h *Handler) SubscribeAccountStatusesFromLatestBlock(
+	request *executiondata.SubscribeAccountStatusesFromLatestBlockRequest,
+	stream executiondata.ExecutionDataAPI_SubscribeAccountStatusesFromLatestBlockServer,
+) error {
+	// check if the maximum number of streams is reached
+	if h.StreamCount.Load() >= h.MaxStreams {
+		return status.Errorf(codes.ResourceExhausted, "maximum number of streams reached")
+	}
+
+	h.StreamCount.Add(1)
+	defer h.StreamCount.Add(-1)
+
+	statusFilter := request.GetFilter()
+	filter, err := state_stream.NewAccountStatusFilter(h.eventFilterConfig, h.chain, statusFilter.GetEventType(), statusFilter.GetAddress())
+	if err != nil {
+		return status.Errorf(codes.InvalidArgument, "could not create account status filter: %v", err)
+	}
+
+	sub := h.api.SubscribeAccountStatusesFromLatestBlock(stream.Context(), filter)
+
+	return subscription.HandleSubscription(sub, h.handleAccountStatusesResponse(request.HeartbeatInterval, request.GetEventEncodingVersion(), stream.Send))
+}
diff --git a/engine/access/state_stream/backend/handler_test.go b/engine/access/state_stream/backend/handler_test.go
index 3cf9d656f8a..42b525815f6 100644
--- a/engine/access/state_stream/backend/handler_test.go
+++ b/engine/access/state_stream/backend/handler_test.go
@@ -24,6 +24,7 @@ import (
 
 	"github.com/onflow/flow-go/engine/access/state_stream"
 	ssmock "github.com/onflow/flow-go/engine/access/state_stream/mock"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/engine/common/rpc/convert"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/storage"
@@ -79,7 +80,7 @@ func (s *HandlerTestSuite) TestHeartbeatResponse() {
 	}
 
 	// notify backend block is available
-	s.backend.setHighestHeight(s.blocks[len(s.blocks)-1].Header.Height)
+	s.highestBlockHeader = s.blocks[len(s.blocks)-1].Header
 
 	s.Run("All events filter", func() {
 		// create empty event filter
@@ -277,7 +278,7 @@ func TestExecutionDataStream(t *testing.T) {
 		request *executiondata.SubscribeExecutionDataRequest,
 		response *ExecutionDataResponse,
 	) {
-		sub := NewSubscription(1)
+		sub := subscription.NewSubscription(1)
 
 		api.On("SubscribeExecutionData", mock.Anything, flow.ZeroID, uint64(0), mock.Anything).Return(sub)
 
@@ -403,7 +404,7 @@ func TestEventStream(t *testing.T) {
 		request *executiondata.SubscribeEventsRequest,
 		response *EventsResponse,
 	) {
-		sub := NewSubscription(1)
+		sub := subscription.NewSubscription(1)
 
 		api.On("SubscribeEvents", mock.Anything, flow.ZeroID, uint64(0), mock.Anything).Return(sub)
 
@@ -615,10 +616,10 @@ func generateEvents(t *testing.T, n int) ([]flow.Event, []flow.Event) {
 func makeConfig(maxGlobalStreams uint32) Config {
 	return Config{
 		EventFilterConfig:    state_stream.DefaultEventFilterConfig,
-		ClientSendTimeout:    state_stream.DefaultSendTimeout,
-		ClientSendBufferSize: state_stream.DefaultSendBufferSize,
+		ClientSendTimeout:    subscription.DefaultSendTimeout,
+		ClientSendBufferSize: subscription.DefaultSendBufferSize,
 		MaxGlobalStreams:     maxGlobalStreams,
-		HeartbeatInterval:    state_stream.DefaultHeartbeatInterval,
+		HeartbeatInterval:    subscription.DefaultHeartbeatInterval,
 	}
 }
 
diff --git a/engine/access/state_stream/filter.go b/engine/access/state_stream/filter.go
index 8936ba49e0a..69a63beec64 100644
--- a/engine/access/state_stream/filter.go
+++ b/engine/access/state_stream/filter.go
@@ -4,6 +4,9 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/onflow/cadence"
+	"github.com/onflow/cadence/encoding/ccf"
+
 	"github.com/onflow/flow-go/model/events"
 	"github.com/onflow/flow-go/model/flow"
 )
@@ -17,28 +20,36 @@ const (
 
 	// DefaultMaxContracts is the default maximum number of contracts that can be specified in a filter
 	DefaultMaxContracts = 1000
+
+	// DefaultMaxAccountAddresses specifies limitation for possible number of accounts that could be used in filter
+	DefaultMaxAccountAddresses = 100
 )
 
 // EventFilterConfig is used to configure the limits for EventFilters
 type EventFilterConfig struct {
-	MaxEventTypes int
-	MaxAddresses  int
-	MaxContracts  int
+	MaxEventTypes     int
+	MaxAddresses      int
+	MaxContracts      int
+	MaxAccountAddress int
 }
 
 // DefaultEventFilterConfig is the default configuration for EventFilters
 var DefaultEventFilterConfig = EventFilterConfig{
-	MaxEventTypes: DefaultMaxEventTypes,
-	MaxAddresses:  DefaultMaxAddresses,
-	MaxContracts:  DefaultMaxContracts,
+	MaxEventTypes:     DefaultMaxEventTypes,
+	MaxAddresses:      DefaultMaxAddresses,
+	MaxContracts:      DefaultMaxContracts,
+	MaxAccountAddress: DefaultMaxAccountAddresses,
 }
 
+type FieldFilter map[string]map[string]struct{}
+
 // EventFilter represents a filter applied to events for a given subscription
 type EventFilter struct {
-	hasFilters bool
-	EventTypes map[flow.EventType]struct{}
-	Addresses  map[string]struct{}
-	Contracts  map[string]struct{}
+	hasFilters        bool
+	EventTypes        map[flow.EventType]struct{}
+	Addresses         map[string]struct{}
+	Contracts         map[string]struct{}
+	EventFieldFilters map[flow.EventType]FieldFilter
 }
 
 func NewEventFilter(
@@ -63,9 +74,10 @@ func NewEventFilter(
 	}
 
 	f := EventFilter{
-		EventTypes: make(map[flow.EventType]struct{}, len(eventTypes)),
-		Addresses:  make(map[string]struct{}, len(addresses)),
-		Contracts:  make(map[string]struct{}, len(contracts)),
+		EventTypes:        make(map[flow.EventType]struct{}, len(eventTypes)),
+		Addresses:         make(map[string]struct{}, len(addresses)),
+		Contracts:         make(map[string]struct{}, len(contracts)),
+		EventFieldFilters: make(map[flow.EventType]FieldFilter),
 	}
 
 	// Check all of the filters to ensure they are correctly formatted. This helps avoid searching
@@ -98,8 +110,7 @@ func NewEventFilter(
 	return f, nil
 }
 
-// Filter applies the all filters on the provided list of events, and returns a list of events that
-// match
+// Filter applies the all filters on the provided list of events, and returns a list of events that match
 func (f *EventFilter) Filter(events flow.EventsList) flow.EventsList {
 	var filteredEvents flow.EventsList
 	for _, event := range events {
@@ -117,6 +128,10 @@ func (f *EventFilter) Match(event flow.Event) bool {
 		return true
 	}
 
+	if fieldFilter, ok := f.EventFieldFilters[event.Type]; ok {
+		return f.matchFieldFilter(&event, fieldFilter)
+	}
+
 	if _, ok := f.EventTypes[event.Type]; ok {
 		return true
 	}
@@ -139,9 +154,63 @@ func (f *EventFilter) Match(event flow.Event) bool {
 	return false
 }
 
+// matchFieldFilter checks if the given event matches the specified field filters.
+// It returns true if the event matches any of the provided field filters, otherwise false.
+func (f *EventFilter) matchFieldFilter(event *flow.Event, fieldFilters FieldFilter) bool {
+	if len(fieldFilters) == 0 {
+		return true // empty list always matches
+	}
+
+	fields, fieldValues, err := getEventFields(event)
+	if err != nil {
+		return false
+	}
+
+	for i, field := range fields {
+		filters, ok := fieldFilters[field.Identifier]
+		if !ok {
+			continue // no filter for this field
+		}
+
+		fieldValue := fieldValues[i].String()
+		if _, ok := filters[fieldValue]; ok {
+			return true
+		}
+	}
+
+	return false
+}
+
+// getEventFields extracts field values and field names from the payload of a flow event.
+// It decodes the event payload into a Cadence event, retrieves the field values and fields, and returns them.
+// Parameters:
+// - event: The Flow event to extract field values and field names from.
+// Returns:
+// - []cadence.Field: A slice containing names for each field extracted from the event payload.
+// - []cadence.Value: A slice containing the values of the fields extracted from the event payload.
+// - error: An error, if any, encountered during event decoding or if the fields are empty.
+func getEventFields(event *flow.Event) ([]cadence.Field, []cadence.Value, error) {
+	data, err := ccf.Decode(nil, event.Payload)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	cdcEvent, ok := data.(cadence.Event)
+	if !ok {
+		return nil, nil, err
+	}
+
+	fieldValues := cdcEvent.GetFieldValues()
+	fields := cdcEvent.GetFields()
+	if fieldValues == nil || fields == nil {
+		return nil, nil, fmt.Errorf("fields are empty")
+	}
+	return fields, fieldValues, nil
+}
+
 // validateEventType ensures that the event type matches the expected format
 func validateEventType(eventType flow.EventType, chain flow.Chain) error {
-	_, err := events.ValidateEvent(flow.EventType(eventType), chain)
+	_, err := events.ValidateEvent(eventType, chain)
 	if err != nil {
 		return fmt.Errorf("invalid event type %s: %w", eventType, err)
 	}
diff --git a/engine/access/state_stream/mock/api.go b/engine/access/state_stream/mock/api.go
index 99203a9f487..5c3ab4fc980 100644
--- a/engine/access/state_stream/mock/api.go
+++ b/engine/access/state_stream/mock/api.go
@@ -11,6 +11,8 @@ import (
 	mock "github.com/stretchr/testify/mock"
 
 	state_stream "github.com/onflow/flow-go/engine/access/state_stream"
+
+	subscription "github.com/onflow/flow-go/engine/access/subscription"
 )
 
 // API is an autogenerated mock type for the API type
@@ -70,16 +72,112 @@ func (_m *API) GetRegisterValues(registerIDs flow.RegisterIDs, height uint64) ([
 	return r0, r1
 }
 
+// SubscribeAccountStatusesFromLatestBlock provides a mock function with given fields: ctx, filter
+func (_m *API) SubscribeAccountStatusesFromLatestBlock(ctx context.Context, filter state_stream.AccountStatusFilter) subscription.Subscription {
+	ret := _m.Called(ctx, filter)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, state_stream.AccountStatusFilter) subscription.Subscription); ok {
+		r0 = rf(ctx, filter)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeAccountStatusesFromStartBlockID provides a mock function with given fields: ctx, startBlockID, filter
+func (_m *API) SubscribeAccountStatusesFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, filter state_stream.AccountStatusFilter) subscription.Subscription {
+	ret := _m.Called(ctx, startBlockID, filter)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, flow.Identifier, state_stream.AccountStatusFilter) subscription.Subscription); ok {
+		r0 = rf(ctx, startBlockID, filter)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeAccountStatusesFromStartHeight provides a mock function with given fields: ctx, startHeight, filter
+func (_m *API) SubscribeAccountStatusesFromStartHeight(ctx context.Context, startHeight uint64, filter state_stream.AccountStatusFilter) subscription.Subscription {
+	ret := _m.Called(ctx, startHeight, filter)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, uint64, state_stream.AccountStatusFilter) subscription.Subscription); ok {
+		r0 = rf(ctx, startHeight, filter)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
 // SubscribeEvents provides a mock function with given fields: ctx, startBlockID, startHeight, filter
-func (_m *API) SubscribeEvents(ctx context.Context, startBlockID flow.Identifier, startHeight uint64, filter state_stream.EventFilter) state_stream.Subscription {
+func (_m *API) SubscribeEvents(ctx context.Context, startBlockID flow.Identifier, startHeight uint64, filter state_stream.EventFilter) subscription.Subscription {
 	ret := _m.Called(ctx, startBlockID, startHeight, filter)
 
-	var r0 state_stream.Subscription
-	if rf, ok := ret.Get(0).(func(context.Context, flow.Identifier, uint64, state_stream.EventFilter) state_stream.Subscription); ok {
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, flow.Identifier, uint64, state_stream.EventFilter) subscription.Subscription); ok {
 		r0 = rf(ctx, startBlockID, startHeight, filter)
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(state_stream.Subscription)
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeEventsFromLatest provides a mock function with given fields: ctx, filter
+func (_m *API) SubscribeEventsFromLatest(ctx context.Context, filter state_stream.EventFilter) subscription.Subscription {
+	ret := _m.Called(ctx, filter)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, state_stream.EventFilter) subscription.Subscription); ok {
+		r0 = rf(ctx, filter)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeEventsFromStartBlockID provides a mock function with given fields: ctx, startBlockID, filter
+func (_m *API) SubscribeEventsFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, filter state_stream.EventFilter) subscription.Subscription {
+	ret := _m.Called(ctx, startBlockID, filter)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, flow.Identifier, state_stream.EventFilter) subscription.Subscription); ok {
+		r0 = rf(ctx, startBlockID, filter)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
+		}
+	}
+
+	return r0
+}
+
+// SubscribeEventsFromStartHeight provides a mock function with given fields: ctx, startHeight, filter
+func (_m *API) SubscribeEventsFromStartHeight(ctx context.Context, startHeight uint64, filter state_stream.EventFilter) subscription.Subscription {
+	ret := _m.Called(ctx, startHeight, filter)
+
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, uint64, state_stream.EventFilter) subscription.Subscription); ok {
+		r0 = rf(ctx, startHeight, filter)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(subscription.Subscription)
 		}
 	}
 
@@ -87,15 +185,15 @@ func (_m *API) SubscribeEvents(ctx context.Context, startBlockID flow.Identifier
 }
 
 // SubscribeExecutionData provides a mock function with given fields: ctx, startBlockID, startBlockHeight
-func (_m *API) SubscribeExecutionData(ctx context.Context, startBlockID flow.Identifier, startBlockHeight uint64) state_stream.Subscription {
+func (_m *API) SubscribeExecutionData(ctx context.Context, startBlockID flow.Identifier, startBlockHeight uint64) subscription.Subscription {
 	ret := _m.Called(ctx, startBlockID, startBlockHeight)
 
-	var r0 state_stream.Subscription
-	if rf, ok := ret.Get(0).(func(context.Context, flow.Identifier, uint64) state_stream.Subscription); ok {
+	var r0 subscription.Subscription
+	if rf, ok := ret.Get(0).(func(context.Context, flow.Identifier, uint64) subscription.Subscription); ok {
 		r0 = rf(ctx, startBlockID, startBlockHeight)
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(state_stream.Subscription)
+			r0 = ret.Get(0).(subscription.Subscription)
 		}
 	}
 
diff --git a/engine/access/state_stream/state_stream.go b/engine/access/state_stream/state_stream.go
index 2d2cca1bbbf..200454f6fca 100644
--- a/engine/access/state_stream/state_stream.go
+++ b/engine/access/state_stream/state_stream.go
@@ -2,35 +2,13 @@ package state_stream
 
 import (
 	"context"
-	"time"
 
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/executiondatasync/execution_data"
 )
 
 const (
-	// DefaultSendBufferSize is the default buffer size for the subscription's send channel.
-	// The size is chosen to balance memory overhead from each subscription with performance when
-	// streaming existing data.
-	DefaultSendBufferSize = 10
-
-	// DefaultMaxGlobalStreams defines the default max number of streams that can be open at the same time.
-	DefaultMaxGlobalStreams = 1000
-
-	// DefaultCacheSize defines the default max number of objects for the execution data cache.
-	DefaultCacheSize = 100
-
-	// DefaultSendTimeout is the default timeout for sending a message to the client. After the timeout
-	// expires, the connection is closed.
-	DefaultSendTimeout = 30 * time.Second
-
-	// DefaultResponseLimit is default max responses per second allowed on a stream. After exceeding
-	// the limit, the stream is paused until more capacity is available.
-	DefaultResponseLimit = float64(0)
-
-	// DefaultHeartbeatInterval specifies the block interval at which heartbeat messages should be sent.
-	DefaultHeartbeatInterval = 1
-
 	// DefaultRegisterIDsRequestLimit defines the default limit of register IDs for a single request to the get register endpoint
 	DefaultRegisterIDsRequestLimit = 100
 )
@@ -40,31 +18,86 @@ type API interface {
 	// GetExecutionDataByBlockID retrieves execution data for a specific block by its block ID.
 	GetExecutionDataByBlockID(ctx context.Context, blockID flow.Identifier) (*execution_data.BlockExecutionData, error)
 	// SubscribeExecutionData subscribes to execution data starting from a specific block ID and block height.
-	SubscribeExecutionData(ctx context.Context, startBlockID flow.Identifier, startBlockHeight uint64) Subscription
-	// SubscribeEvents subscribes to events starting from a specific block ID and block height, with an optional event filter.
-	SubscribeEvents(ctx context.Context, startBlockID flow.Identifier, startHeight uint64, filter EventFilter) Subscription
+	SubscribeExecutionData(ctx context.Context, startBlockID flow.Identifier, startBlockHeight uint64) subscription.Subscription
+	// SubscribeEvents is deprecated and will be removed in a future version.
+	// Use SubscribeEventsFromStartBlockID, SubscribeEventsFromStartHeight or SubscribeEventsFromLatest.
+	//
+	// SubscribeEvents streams events for all blocks starting at the specified block ID or block height
+	// up until the latest available block. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block as it becomes available.
+	//
+	// Only one of startBlockID and startHeight may be set. If neither startBlockID nor startHeight is provided,
+	// the latest sealed block is used.
+	//
+	// Events within each block are filtered by the provided EventFilter, and only
+	// those events that match the filter are returned. If no filter is provided,
+	// all events are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - startBlockID: The identifier of the starting block. If provided, startHeight should be 0.
+	// - startHeight: The height of the starting block. If provided, startBlockID should be flow.ZeroID.
+	// - filter: The event filter used to filter events.
+	//
+	// If invalid parameters will be supplied SubscribeEvents will return a failed subscription.
+	SubscribeEvents(ctx context.Context, startBlockID flow.Identifier, startHeight uint64, filter EventFilter) subscription.Subscription
+	// SubscribeEventsFromStartBlockID streams events starting at the specified block ID,
+	// up until the latest available block. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block as it becomes available.
+	//
+	// Events within each block are filtered by the provided EventFilter, and only
+	// those events that match the filter are returned. If no filter is provided,
+	// all events are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - startBlockID: The identifier of the starting block.
+	// - filter: The event filter used to filter events.
+	//
+	// If invalid parameters will be supplied SubscribeEventsFromStartBlockID will return a failed subscription.
+	SubscribeEventsFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, filter EventFilter) subscription.Subscription
+	// SubscribeEventsFromStartHeight streams events starting at the specified block height,
+	// up until the latest available block. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block as it becomes available.
+	//
+	// Events within each block are filtered by the provided EventFilter, and only
+	// those events that match the filter are returned. If no filter is provided,
+	// all events are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - startHeight: The height of the starting block.
+	// - filter: The event filter used to filter events.
+	//
+	// If invalid parameters will be supplied SubscribeEventsFromStartHeight will return a failed subscription.
+	SubscribeEventsFromStartHeight(ctx context.Context, startHeight uint64, filter EventFilter) subscription.Subscription
+	// SubscribeEventsFromLatest subscribes to events starting at the latest sealed block,
+	// up until the latest available block. Once the latest is
+	// reached, the stream will remain open and responses are sent for each new
+	// block as it becomes available.
+	//
+	// Events within each block are filtered by the provided EventFilter, and only
+	// those events that match the filter are returned. If no filter is provided,
+	// all events are returned.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - filter: The event filter used to filter events.
+	//
+	// If invalid parameters will be supplied SubscribeEventsFromLatest will return a failed subscription.
+	SubscribeEventsFromLatest(ctx context.Context, filter EventFilter) subscription.Subscription
 	// GetRegisterValues returns register values for a set of register IDs at the provided block height.
 	GetRegisterValues(registerIDs flow.RegisterIDs, height uint64) ([]flow.RegisterValue, error)
-}
-
-// Subscription represents a streaming request, and handles the communication between the grpc handler
-// and the backend implementation.
-type Subscription interface {
-	// ID returns the unique identifier for this subscription used for logging
-	ID() string
-
-	// Channel returns the channel from which subscription data can be read
-	Channel() <-chan interface{}
-
-	// Err returns the error that caused the subscription to fail
-	Err() error
-}
-
-// Streamable represents a subscription that can be streamed.
-type Streamable interface {
-	ID() string
-	Close()
-	Fail(error)
-	Send(context.Context, interface{}, time.Duration) error
-	Next(context.Context) (interface{}, error)
+	// SubscribeAccountStatusesFromStartBlockID subscribes to the streaming of account status changes starting from
+	// a specific block ID with an optional status filter.
+	SubscribeAccountStatusesFromStartBlockID(ctx context.Context, startBlockID flow.Identifier, filter AccountStatusFilter) subscription.Subscription
+	// SubscribeAccountStatusesFromStartHeight subscribes to the streaming of account status changes starting from
+	// a specific block height, with an optional status filter.
+	SubscribeAccountStatusesFromStartHeight(ctx context.Context, startHeight uint64, filter AccountStatusFilter) subscription.Subscription
+	// SubscribeAccountStatusesFromLatestBlock subscribes to the streaming of account status changes starting from a
+	// latest sealed block, with an optional status filter.
+	SubscribeAccountStatusesFromLatestBlock(ctx context.Context, filter AccountStatusFilter) subscription.Subscription
 }
diff --git a/engine/access/subscription/base_tracker.go b/engine/access/subscription/base_tracker.go
new file mode 100644
index 00000000000..9d60c606d03
--- /dev/null
+++ b/engine/access/subscription/base_tracker.go
@@ -0,0 +1,190 @@
+package subscription
+
+import (
+	"context"
+	"fmt"
+	"sync/atomic"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/onflow/flow-go/engine/common/rpc"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/irrecoverable"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/storage"
+)
+
+// StreamingData represents common streaming data configuration for access and state_stream handlers.
+type StreamingData struct {
+	MaxStreams  int32
+	StreamCount atomic.Int32
+}
+
+func NewStreamingData(maxStreams uint32) StreamingData {
+	return StreamingData{
+		MaxStreams:  int32(maxStreams),
+		StreamCount: atomic.Int32{},
+	}
+}
+
+// BaseTracker is an interface for a tracker that provides base GetStartHeight method related to both blocks and execution data tracking.
+type BaseTracker interface {
+	// GetStartHeightFromBlockID returns the start height based on the provided starting block ID.
+	// If the start block is the root block, skip it and begin from the next block.
+	//
+	// Parameters:
+	// - startBlockID: The identifier of the starting block.
+	//
+	// Returns:
+	// - uint64: The start height associated with the provided block ID.
+	// - error: An error indicating any issues with retrieving the start height.
+	//
+	// Expected errors during normal operation:
+	// - codes.NotFound - if the block was not found in storage
+	// - codes.Internal - for any other error
+	GetStartHeightFromBlockID(flow.Identifier) (uint64, error)
+	// GetStartHeightFromHeight returns the start height based on the provided starting block height.
+	// If the start block is the root block, skip it and begin from the next block.
+	//
+	// Parameters:
+	// - startHeight: The height of the starting block.
+	//
+	// Returns:
+	// - uint64: The start height associated with the provided block height.
+	// - error: An error indicating any issues with retrieving the start height.
+	//
+	// Expected errors during normal operation:
+	// - codes.InvalidArgument   - if the start height is less than the root block height.
+	// - codes.NotFound  - if the header was not found in storage.
+	GetStartHeightFromHeight(uint64) (uint64, error)
+	// GetStartHeightFromLatest returns the start height based on the latest sealed block.
+	// If the start block is the root block, skip it and begin from the next block.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	//
+	// No errors are expected during normal operation.
+	GetStartHeightFromLatest(context.Context) (uint64, error)
+}
+
+var _ BaseTracker = (*BaseTrackerImpl)(nil)
+
+// BaseTrackerImpl is an implementation of the BaseTracker interface.
+type BaseTrackerImpl struct {
+	rootBlockHeight uint64
+	state           protocol.State
+	headers         storage.Headers
+}
+
+// NewBaseTrackerImpl creates a new instance of BaseTrackerImpl.
+//
+// Parameters:
+// - rootBlockHeight: The root block height, which serves as the baseline for calculating the start height.
+// - state: The protocol state used for retrieving block information.
+// - headers: The storage headers for accessing block headers.
+//
+// Returns:
+// - *BaseTrackerImpl: A new instance of BaseTrackerImpl.
+func NewBaseTrackerImpl(
+	rootBlockHeight uint64,
+	state protocol.State,
+	headers storage.Headers,
+) *BaseTrackerImpl {
+	return &BaseTrackerImpl{
+		rootBlockHeight: rootBlockHeight,
+		state:           state,
+		headers:         headers,
+	}
+}
+
+// GetStartHeightFromBlockID returns the start height based on the provided starting block ID.
+// If the start block is the root block, skip it and begin from the next block.
+//
+// Parameters:
+// - startBlockID: The identifier of the starting block.
+//
+// Returns:
+// - uint64: The start height associated with the provided block ID.
+// - error: An error indicating any issues with retrieving the start height.
+//
+// Expected errors during normal operation:
+// - codes.NotFound - if the block was not found in storage
+// - codes.Internal - for any other error
+func (b *BaseTrackerImpl) GetStartHeightFromBlockID(startBlockID flow.Identifier) (uint64, error) {
+	header, err := b.headers.ByBlockID(startBlockID)
+	if err != nil {
+		return 0, rpc.ConvertStorageError(fmt.Errorf("could not get header for block %v: %w", startBlockID, err))
+	}
+
+	// ensure that the resolved start height is available
+	return b.checkStartHeight(header.Height), nil
+}
+
+// GetStartHeightFromHeight returns the start height based on the provided starting block height.
+// If the start block is the root block, skip it and begin from the next block.
+//
+// Parameters:
+// - startHeight: The height of the starting block.
+//
+// Returns:
+// - uint64: The start height associated with the provided block height.
+// - error: An error indicating any issues with retrieving the start height.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument   - if the start height is less than the root block height.
+// - codes.NotFound  - if the header was not found in storage.
+func (b *BaseTrackerImpl) GetStartHeightFromHeight(startHeight uint64) (uint64, error) {
+	if startHeight < b.rootBlockHeight {
+		return 0, status.Errorf(codes.InvalidArgument, "start height must be greater than or equal to the root height %d", b.rootBlockHeight)
+	}
+
+	header, err := b.headers.ByHeight(startHeight)
+	if err != nil {
+		return 0, rpc.ConvertStorageError(fmt.Errorf("could not get header for height %d: %w", startHeight, err))
+	}
+
+	// ensure that the resolved start height is available
+	return b.checkStartHeight(header.Height), nil
+}
+
+// GetStartHeightFromLatest returns the start height based on the latest sealed block.
+// If the start block is the root block, skip it and begin from the next block.
+//
+// Parameters:
+// - ctx: Context for the operation.
+//
+// No errors are expected during normal operation.
+func (b *BaseTrackerImpl) GetStartHeightFromLatest(ctx context.Context) (uint64, error) {
+	// if no start block was provided, use the latest sealed block
+	header, err := b.state.Sealed().Head()
+	if err != nil {
+		// In the RPC engine, if we encounter an error from the protocol state indicating state corruption,
+		// we should halt processing requests
+		err := irrecoverable.NewExceptionf("failed to lookup sealed header: %w", err)
+		irrecoverable.Throw(ctx, err)
+		return 0, err
+	}
+
+	return b.checkStartHeight(header.Height), nil
+}
+
+// checkStartHeight validates the provided start height and adjusts it if necessary.
+// If the start block is the root block, skip it and begin from the next block.
+//
+// Parameters:
+// - height: The start height to be checked.
+//
+// Returns:
+// - uint64: The adjusted start height.
+//
+// No errors are expected during normal operation.
+func (b *BaseTrackerImpl) checkStartHeight(height uint64) uint64 {
+	// if the start block is the root block, skip it and begin from the next block.
+	if height == b.rootBlockHeight {
+		height = b.rootBlockHeight + 1
+	}
+
+	return height
+}
diff --git a/engine/access/subscription/block_tracker.go b/engine/access/subscription/block_tracker.go
new file mode 100644
index 00000000000..51be3726fbd
--- /dev/null
+++ b/engine/access/subscription/block_tracker.go
@@ -0,0 +1,123 @@
+package subscription
+
+import (
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/onflow/flow-go/engine"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/counters"
+	"github.com/onflow/flow-go/module/irrecoverable"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/storage"
+)
+
+// BlockTracker is an interface for tracking blocks and handling block-related operations.
+type BlockTracker interface {
+	BaseTracker
+	// GetHighestHeight returns the highest height based on the specified block status which could be only BlockStatusSealed
+	// or BlockStatusFinalized.
+	// No errors are expected during normal operation.
+	GetHighestHeight(flow.BlockStatus) (uint64, error)
+	// ProcessOnFinalizedBlock drives the subscription logic when a block is finalized.
+	// The input to this callback is treated as trusted. This method should be executed on
+	// `OnFinalizedBlock` notifications from the node-internal consensus instance.
+	// No errors are expected during normal operation.
+	ProcessOnFinalizedBlock() error
+}
+
+var _ BlockTracker = (*BlockTrackerImpl)(nil)
+
+// BlockTrackerImpl is an implementation of the BlockTracker interface.
+type BlockTrackerImpl struct {
+	BaseTracker
+	state       protocol.State
+	broadcaster *engine.Broadcaster
+
+	// finalizedHighestHeight contains the highest consecutive block height for which we have received a new notification.
+	finalizedHighestHeight counters.StrictMonotonousCounter
+	// sealedHighestHeight contains the highest consecutive block height for which we have received a new notification.
+	sealedHighestHeight counters.StrictMonotonousCounter
+}
+
+// NewBlockTracker creates a new BlockTrackerImpl instance.
+//
+// Parameters:
+// - state: The protocol state used for retrieving block information.
+// - rootHeight: The root block height, serving as the baseline for calculating the start height.
+// - headers: The storage headers for accessing block headers.
+// - broadcaster: The engine broadcaster for publishing notifications.
+//
+// No errors are expected during normal operation.
+func NewBlockTracker(
+	state protocol.State,
+	rootHeight uint64,
+	headers storage.Headers,
+	broadcaster *engine.Broadcaster,
+) (*BlockTrackerImpl, error) {
+	lastFinalized, err := state.Final().Head()
+	if err != nil {
+		// this header MUST exist in the db, otherwise the node likely has inconsistent state.
+		return nil, irrecoverable.NewExceptionf("could not retrieve last finalized block: %w", err)
+	}
+
+	lastSealed, err := state.Sealed().Head()
+	if err != nil {
+		// this header MUST exist in the db, otherwise the node likely has inconsistent state.
+		return nil, irrecoverable.NewExceptionf("could not retrieve last sealed block: %w", err)
+	}
+
+	return &BlockTrackerImpl{
+		BaseTracker:            NewBaseTrackerImpl(rootHeight, state, headers),
+		state:                  state,
+		finalizedHighestHeight: counters.NewMonotonousCounter(lastFinalized.Height),
+		sealedHighestHeight:    counters.NewMonotonousCounter(lastSealed.Height),
+		broadcaster:            broadcaster,
+	}, nil
+}
+
+// GetHighestHeight returns the highest height based on the specified block status.
+//
+// Parameters:
+// - blockStatus: The status of the block. It is expected that blockStatus has already been handled for invalid flow.BlockStatusUnknown.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument    - if block status is flow.BlockStatusUnknown.
+func (b *BlockTrackerImpl) GetHighestHeight(blockStatus flow.BlockStatus) (uint64, error) {
+	switch blockStatus {
+	case flow.BlockStatusFinalized:
+		return b.finalizedHighestHeight.Value(), nil
+	case flow.BlockStatusSealed:
+		return b.sealedHighestHeight.Value(), nil
+	}
+	return 0, status.Errorf(codes.InvalidArgument, "invalid block status: %s", blockStatus)
+}
+
+// ProcessOnFinalizedBlock drives the subscription logic when a block is finalized.
+// The input to this callback is treated as trusted. This method should be executed on
+// `OnFinalizedBlock` notifications from the node-internal consensus instance.
+// No errors are expected during normal operation. Any errors encountered should be
+// treated as an exception.
+func (b *BlockTrackerImpl) ProcessOnFinalizedBlock() error {
+	// get the finalized header from state
+	finalizedHeader, err := b.state.Final().Head()
+	if err != nil {
+		return irrecoverable.NewExceptionf("unable to get latest finalized header: %w", err)
+	}
+
+	if !b.finalizedHighestHeight.Set(finalizedHeader.Height) {
+		return nil
+	}
+
+	// get the latest seal header from state
+	sealedHeader, err := b.state.Sealed().Head()
+	if err != nil {
+		return irrecoverable.NewExceptionf("unable to get latest sealed header: %w", err)
+	}
+
+	_ = b.sealedHighestHeight.Set(sealedHeader.Height)
+	// always publish since there is also a new finalized block.
+	b.broadcaster.Publish()
+
+	return nil
+}
diff --git a/engine/access/subscription/execution_data_tracker.go b/engine/access/subscription/execution_data_tracker.go
new file mode 100644
index 00000000000..db20dfd3d0e
--- /dev/null
+++ b/engine/access/subscription/execution_data_tracker.go
@@ -0,0 +1,304 @@
+package subscription
+
+import (
+	"context"
+
+	"github.com/rs/zerolog"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/onflow/flow-go/engine"
+	"github.com/onflow/flow-go/engine/common/rpc"
+	"github.com/onflow/flow-go/fvm/errors"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/counters"
+	"github.com/onflow/flow-go/module/executiondatasync/execution_data"
+	"github.com/onflow/flow-go/module/state_synchronization"
+	"github.com/onflow/flow-go/module/state_synchronization/indexer"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/storage"
+	"github.com/onflow/flow-go/utils/logging"
+)
+
+// ExecutionDataTracker is an interface for tracking the highest consecutive block height for which we have received a
+// new Execution Data notification
+type ExecutionDataTracker interface {
+	BaseTracker
+	// GetStartHeight returns the start height to use when searching.
+	// Only one of startBlockID and startHeight may be set. Otherwise, an InvalidArgument error is returned.
+	// If a block is provided and does not exist, a NotFound error is returned.
+	// If neither startBlockID nor startHeight is provided, the latest sealed block is used.
+	// If the start block is the root block, skip it and begin from the next block.
+	//
+	// Parameters:
+	// - ctx: Context for the operation.
+	// - startBlockID: The identifier of the starting block. If provided, startHeight should be 0.
+	// - startHeight: The height of the starting block. If provided, startBlockID should be flow.ZeroID.
+	//
+	// Returns:
+	// - uint64: The start height for searching.
+	// - error: An error indicating the result of the operation, if any.
+	//
+	// Expected errors during normal operation:
+	// - codes.InvalidArgument - if both startBlockID and startHeight are provided, if the start height is less than the root block height,
+	// if the start height is out of bounds based on indexed heights (when index is used).
+	// - codes.NotFound   - if a block is provided and does not exist.
+	// - codes.Internal        - if there is an internal error.
+	GetStartHeight(context.Context, flow.Identifier, uint64) (uint64, error)
+	// GetHighestHeight returns the highest height that we have consecutive execution data for.
+	GetHighestHeight() uint64
+	// OnExecutionData is used to notify the tracker when a new execution data is received.
+	OnExecutionData(*execution_data.BlockExecutionDataEntity)
+}
+
+var _ ExecutionDataTracker = (*ExecutionDataTrackerImpl)(nil)
+
+// ExecutionDataTrackerImpl is an implementation of the ExecutionDataTracker interface.
+type ExecutionDataTrackerImpl struct {
+	BaseTracker
+	log           zerolog.Logger
+	headers       storage.Headers
+	broadcaster   *engine.Broadcaster
+	indexReporter state_synchronization.IndexReporter
+	useIndex      bool
+
+	// highestHeight contains the highest consecutive block height that we have consecutive execution data for
+	highestHeight counters.StrictMonotonousCounter
+}
+
+// NewExecutionDataTracker creates a new ExecutionDataTrackerImpl instance.
+//
+// Parameters:
+// - log: The logger to use for logging.
+// - state: The protocol state used for retrieving block information.
+// - rootHeight: The root block height, serving as the baseline for calculating the start height.
+// - headers: The storage headers for accessing block headers.
+// - broadcaster: The engine broadcaster for publishing notifications.
+// - highestAvailableFinalizedHeight: The highest available finalized block height.
+// - indexReporter: The index reporter for checking indexed block heights.
+// - useIndex: A flag indicating whether to use indexed block heights for validation.
+//
+// Returns:
+// - *ExecutionDataTrackerImpl: A new instance of ExecutionDataTrackerImpl.
+func NewExecutionDataTracker(
+	log zerolog.Logger,
+	state protocol.State,
+	rootHeight uint64,
+	headers storage.Headers,
+	broadcaster *engine.Broadcaster,
+	highestAvailableFinalizedHeight uint64,
+	indexReporter state_synchronization.IndexReporter,
+	useIndex bool,
+) *ExecutionDataTrackerImpl {
+	return &ExecutionDataTrackerImpl{
+		BaseTracker:   NewBaseTrackerImpl(rootHeight, state, headers),
+		log:           log,
+		headers:       headers,
+		broadcaster:   broadcaster,
+		highestHeight: counters.NewMonotonousCounter(highestAvailableFinalizedHeight),
+		indexReporter: indexReporter,
+		useIndex:      useIndex,
+	}
+}
+
+// GetStartHeight returns the start height to use when searching.
+// Only one of startBlockID and startHeight may be set. Otherwise, an InvalidArgument error is returned.
+// If a block is provided and does not exist, a NotFound error is returned.
+// If neither startBlockID nor startHeight is provided, the latest sealed block is used.
+// If the start block is the root block, skip it and begin from the next block.
+//
+// Parameters:
+// - ctx: Context for the operation.
+// - startBlockID: The identifier of the starting block. If provided, startHeight should be 0.
+// - startHeight: The height of the starting block. If provided, startBlockID should be flow.ZeroID.
+//
+// Returns:
+// - uint64: The start height for searching.
+// - error: An error indicating the result of the operation, if any.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument - if both startBlockID and startHeight are provided, if the start height is less than the root block height,
+// if the start height is out of bounds based on indexed heights (when index is used).
+// - codes.NotFound        - if a block is provided and does not exist.
+// - codes.Internal        - if there is an internal error.
+func (e *ExecutionDataTrackerImpl) GetStartHeight(ctx context.Context, startBlockID flow.Identifier, startHeight uint64) (uint64, error) {
+	if startBlockID != flow.ZeroID && startHeight > 0 {
+		return 0, status.Errorf(codes.InvalidArgument, "only one of start block ID and start height may be provided")
+	}
+
+	// get the start height based on the provided starting block ID
+	if startBlockID != flow.ZeroID {
+		return e.GetStartHeightFromBlockID(startBlockID)
+	}
+
+	// get start height based on the provided starting block height
+	if startHeight > 0 {
+		return e.GetStartHeightFromHeight(startHeight)
+	}
+
+	return e.GetStartHeightFromLatest(ctx)
+}
+
+// GetStartHeightFromBlockID returns the start height based on the provided starting block ID.
+//
+// Parameters:
+// - startBlockID: The identifier of the starting block.
+//
+// Returns:
+// - uint64: The start height associated with the provided block ID.
+// - error: An error indicating any issues with retrieving the start height.
+//
+// Expected errors during normal operation:
+// - codes.NotFound - if the block was not found in storage
+// - codes.InvalidArgument    - if the start height is out of bounds based on indexed heights.
+// - codes.FailedPrecondition - if the index reporter is not ready yet.
+// - codes.Internal           - for any other error during validation.
+func (e *ExecutionDataTrackerImpl) GetStartHeightFromBlockID(startBlockID flow.Identifier) (uint64, error) {
+	// get start height based on the provided starting block id
+	height, err := e.BaseTracker.GetStartHeightFromBlockID(startBlockID)
+	if err != nil {
+		return 0, err
+	}
+
+	// ensure that the resolved start height is available
+	return e.checkStartHeight(height)
+}
+
+// GetStartHeightFromHeight returns the start height based on the provided starting block height.
+//
+// Parameters:
+// - startHeight: The height of the starting block.
+//
+// Returns:
+// - uint64: The start height associated with the provided block height.
+// - error: An error indicating any issues with retrieving the start height.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument    - if the start height is less than the root block height, if the start height is out of bounds based on indexed heights
+// - codes.NotFound           - if the header was not found in storage.
+// - codes.FailedPrecondition - if the index reporter is not ready yet.
+// - codes.Internal           - for any other error during validation.
+func (e *ExecutionDataTrackerImpl) GetStartHeightFromHeight(startHeight uint64) (uint64, error) {
+	// get start height based on the provided starting block height
+	height, err := e.BaseTracker.GetStartHeightFromHeight(startHeight)
+	if err != nil {
+		return 0, err
+	}
+
+	// ensure that the resolved start height is available
+	return e.checkStartHeight(height)
+}
+
+// GetStartHeightFromLatest returns the start height based on the latest sealed block.
+//
+// Parameters:
+// - ctx: Context for the operation.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument    - if the start height is out of bounds based on indexed heights.
+// - codes.FailedPrecondition - if the index reporter is not ready yet.
+// - codes.Internal           - for any other error during validation.
+func (e *ExecutionDataTrackerImpl) GetStartHeightFromLatest(ctx context.Context) (uint64, error) {
+	// get start height based latest sealed block
+	height, err := e.BaseTracker.GetStartHeightFromLatest(ctx)
+	if err != nil {
+		return 0, err
+	}
+
+	// ensure that the resolved start height is available
+	return e.checkStartHeight(height)
+}
+
+// GetHighestHeight returns the highest height that we have consecutive execution data for.
+func (e *ExecutionDataTrackerImpl) GetHighestHeight() uint64 {
+	return e.highestHeight.Value()
+}
+
+// OnExecutionData is used to notify the tracker when a new execution data is received.
+func (e *ExecutionDataTrackerImpl) OnExecutionData(executionData *execution_data.BlockExecutionDataEntity) {
+	log := e.log.With().Hex("block_id", logging.ID(executionData.BlockID)).Logger()
+
+	log.Trace().Msg("received execution data")
+
+	header, err := e.headers.ByBlockID(executionData.BlockID)
+	if err != nil {
+		// if the execution data is available, the block must be locally finalized
+		log.Fatal().Err(err).Msg("failed to notify of new execution data")
+		return
+	}
+
+	// sets the highest height for which execution data is available.
+	_ = e.highestHeight.Set(header.Height)
+
+	e.broadcaster.Publish()
+}
+
+// checkStartHeight validates the provided start height and adjusts it if necessary based on the tracker's configuration.
+//
+// Parameters:
+// - height: The start height to be checked.
+//
+// Returns:
+// - uint64: The adjusted start height, if validation passes.
+// - error: An error indicating any issues with the provided start height.
+//
+// Validation Steps:
+// 1. If index usage is disabled, return the original height without further checks.
+// 2. Retrieve the lowest and highest indexed block heights.
+// 3. Check if the provided height is within the bounds of indexed heights.
+//   - If below the lowest indexed height, return codes.InvalidArgument error.
+//   - If above the highest indexed height, return codes.InvalidArgument error.
+//
+// 4. If validation passes, return the adjusted start height.
+//
+// Expected errors during normal operation:
+// - codes.InvalidArgument    - if the start height is out of bounds based on indexed heights.
+// - codes.FailedPrecondition - if the index reporter is not ready yet.
+// - codes.Internal           - for any other error during validation.
+func (e *ExecutionDataTrackerImpl) checkStartHeight(height uint64) (uint64, error) {
+	if !e.useIndex {
+		return height, nil
+	}
+
+	lowestHeight, highestHeight, err := e.getIndexedHeightBound()
+	if err != nil {
+		return 0, err
+	}
+
+	if height < lowestHeight {
+		return 0, status.Errorf(codes.InvalidArgument, "start height %d is lower than lowest indexed height %d", height, lowestHeight)
+	}
+
+	if height > highestHeight {
+		return 0, status.Errorf(codes.InvalidArgument, "start height %d is higher than highest indexed height %d", height, highestHeight)
+	}
+
+	return height, nil
+}
+
+// getIndexedHeightBound returns the lowest and highest indexed block heights
+// Expected errors during normal operation:
+// - codes.FailedPrecondition - if the index reporter is not ready yet.
+// - codes.Internal           - if there was any other error getting the heights.
+func (e *ExecutionDataTrackerImpl) getIndexedHeightBound() (uint64, uint64, error) {
+	lowestHeight, err := e.indexReporter.LowestIndexedHeight()
+	if err != nil {
+		if errors.Is(err, storage.ErrHeightNotIndexed) || errors.Is(err, indexer.ErrIndexNotInitialized) {
+			// the index is not ready yet, but likely will be eventually
+			return 0, 0, status.Errorf(codes.FailedPrecondition, "failed to get lowest indexed height: %v", err)
+		}
+		return 0, 0, rpc.ConvertError(err, "failed to get lowest indexed height", codes.Internal)
+	}
+
+	highestHeight, err := e.indexReporter.HighestIndexedHeight()
+	if err != nil {
+		if errors.Is(err, storage.ErrHeightNotIndexed) || errors.Is(err, indexer.ErrIndexNotInitialized) {
+			// the index is not ready yet, but likely will be eventually
+			return 0, 0, status.Errorf(codes.FailedPrecondition, "failed to get highest indexed height: %v", err)
+		}
+		return 0, 0, rpc.ConvertError(err, "failed to get highest indexed height", codes.Internal)
+	}
+
+	return lowestHeight, highestHeight, nil
+}
diff --git a/engine/access/subscription/mock/block_tracker.go b/engine/access/subscription/mock/block_tracker.go
new file mode 100644
index 00000000000..6143ace674a
--- /dev/null
+++ b/engine/access/subscription/mock/block_tracker.go
@@ -0,0 +1,140 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mock
+
+import (
+	context "context"
+
+	flow "github.com/onflow/flow-go/model/flow"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// BlockTracker is an autogenerated mock type for the BlockTracker type
+type BlockTracker struct {
+	mock.Mock
+}
+
+// GetHighestHeight provides a mock function with given fields: _a0
+func (_m *BlockTracker) GetHighestHeight(_a0 flow.BlockStatus) (uint64, error) {
+	ret := _m.Called(_a0)
+
+	var r0 uint64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(flow.BlockStatus) (uint64, error)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(flow.BlockStatus) uint64); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	if rf, ok := ret.Get(1).(func(flow.BlockStatus) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetStartHeightFromBlockID provides a mock function with given fields: _a0
+func (_m *BlockTracker) GetStartHeightFromBlockID(_a0 flow.Identifier) (uint64, error) {
+	ret := _m.Called(_a0)
+
+	var r0 uint64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(flow.Identifier) (uint64, error)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(flow.Identifier) uint64); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	if rf, ok := ret.Get(1).(func(flow.Identifier) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetStartHeightFromHeight provides a mock function with given fields: _a0
+func (_m *BlockTracker) GetStartHeightFromHeight(_a0 uint64) (uint64, error) {
+	ret := _m.Called(_a0)
+
+	var r0 uint64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(uint64) (uint64, error)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(uint64) uint64); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	if rf, ok := ret.Get(1).(func(uint64) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetStartHeightFromLatest provides a mock function with given fields: _a0
+func (_m *BlockTracker) GetStartHeightFromLatest(_a0 context.Context) (uint64, error) {
+	ret := _m.Called(_a0)
+
+	var r0 uint64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) (uint64, error)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) uint64); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// ProcessOnFinalizedBlock provides a mock function with given fields:
+func (_m *BlockTracker) ProcessOnFinalizedBlock() error {
+	ret := _m.Called()
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func() error); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+type mockConstructorTestingTNewBlockTracker interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewBlockTracker creates a new instance of BlockTracker. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewBlockTracker(t mockConstructorTestingTNewBlockTracker) *BlockTracker {
+	mock := &BlockTracker{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/engine/access/subscription/mock/execution_data_tracker.go b/engine/access/subscription/mock/execution_data_tracker.go
new file mode 100644
index 00000000000..fd477e15d9d
--- /dev/null
+++ b/engine/access/subscription/mock/execution_data_tracker.go
@@ -0,0 +1,147 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mock
+
+import (
+	context "context"
+
+	flow "github.com/onflow/flow-go/model/flow"
+	execution_data "github.com/onflow/flow-go/module/executiondatasync/execution_data"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// ExecutionDataTracker is an autogenerated mock type for the ExecutionDataTracker type
+type ExecutionDataTracker struct {
+	mock.Mock
+}
+
+// GetHighestHeight provides a mock function with given fields:
+func (_m *ExecutionDataTracker) GetHighestHeight() uint64 {
+	ret := _m.Called()
+
+	var r0 uint64
+	if rf, ok := ret.Get(0).(func() uint64); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	return r0
+}
+
+// GetStartHeight provides a mock function with given fields: _a0, _a1, _a2
+func (_m *ExecutionDataTracker) GetStartHeight(_a0 context.Context, _a1 flow.Identifier, _a2 uint64) (uint64, error) {
+	ret := _m.Called(_a0, _a1, _a2)
+
+	var r0 uint64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, flow.Identifier, uint64) (uint64, error)); ok {
+		return rf(_a0, _a1, _a2)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, flow.Identifier, uint64) uint64); ok {
+		r0 = rf(_a0, _a1, _a2)
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, flow.Identifier, uint64) error); ok {
+		r1 = rf(_a0, _a1, _a2)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetStartHeightFromBlockID provides a mock function with given fields: _a0
+func (_m *ExecutionDataTracker) GetStartHeightFromBlockID(_a0 flow.Identifier) (uint64, error) {
+	ret := _m.Called(_a0)
+
+	var r0 uint64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(flow.Identifier) (uint64, error)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(flow.Identifier) uint64); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	if rf, ok := ret.Get(1).(func(flow.Identifier) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetStartHeightFromHeight provides a mock function with given fields: _a0
+func (_m *ExecutionDataTracker) GetStartHeightFromHeight(_a0 uint64) (uint64, error) {
+	ret := _m.Called(_a0)
+
+	var r0 uint64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(uint64) (uint64, error)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(uint64) uint64); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	if rf, ok := ret.Get(1).(func(uint64) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetStartHeightFromLatest provides a mock function with given fields: _a0
+func (_m *ExecutionDataTracker) GetStartHeightFromLatest(_a0 context.Context) (uint64, error) {
+	ret := _m.Called(_a0)
+
+	var r0 uint64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context) (uint64, error)); ok {
+		return rf(_a0)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context) uint64); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context) error); ok {
+		r1 = rf(_a0)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// OnExecutionData provides a mock function with given fields: _a0
+func (_m *ExecutionDataTracker) OnExecutionData(_a0 *execution_data.BlockExecutionDataEntity) {
+	_m.Called(_a0)
+}
+
+type mockConstructorTestingTNewExecutionDataTracker interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewExecutionDataTracker creates a new instance of ExecutionDataTracker. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewExecutionDataTracker(t mockConstructorTestingTNewExecutionDataTracker) *ExecutionDataTracker {
+	mock := &ExecutionDataTracker{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/engine/access/state_stream/backend/streamer.go b/engine/access/subscription/streamer.go
similarity index 76%
rename from engine/access/state_stream/backend/streamer.go
rename to engine/access/subscription/streamer.go
index d473b6d4ee3..11531387200 100644
--- a/engine/access/state_stream/backend/streamer.go
+++ b/engine/access/subscription/streamer.go
@@ -1,4 +1,4 @@
-package backend
+package subscription
 
 import (
 	"context"
@@ -10,26 +10,32 @@ import (
 	"golang.org/x/time/rate"
 
 	"github.com/onflow/flow-go/engine"
-	"github.com/onflow/flow-go/engine/access/state_stream"
 	"github.com/onflow/flow-go/module/executiondatasync/execution_data"
 	"github.com/onflow/flow-go/storage"
 )
 
-// Streamer
+// ErrBlockNotReady represents an error indicating that a block is not yet available or ready.
+var ErrBlockNotReady = errors.New("block not ready")
+
+// ErrEndOfData represents an error indicating that no more data available for streaming.
+var ErrEndOfData = errors.New("end of data")
+
+// Streamer represents a streaming subscription that delivers data to clients.
 type Streamer struct {
 	log         zerolog.Logger
-	sub         state_stream.Streamable
+	sub         Streamable
 	broadcaster *engine.Broadcaster
 	sendTimeout time.Duration
 	limiter     *rate.Limiter
 }
 
+// NewStreamer creates a new Streamer instance.
 func NewStreamer(
 	log zerolog.Logger,
 	broadcaster *engine.Broadcaster,
 	sendTimeout time.Duration,
 	limit float64,
-	sub state_stream.Streamable,
+	sub Streamable,
 ) *Streamer {
 	var limiter *rate.Limiter
 	if limit > 0 {
@@ -71,6 +77,12 @@ func (s *Streamer) Stream(ctx context.Context) {
 		err := s.sendAllAvailable(ctx)
 
 		if err != nil {
+			//TODO: The functionality to graceful shutdown on demand should be improved with https://github.com/onflow/flow-go/issues/5561
+			if errors.Is(err, ErrEndOfData) {
+				s.sub.Close()
+				return
+			}
+
 			s.log.Err(err).Msg("error sending response")
 			s.sub.Fail(err)
 			return
@@ -88,8 +100,15 @@ func (s *Streamer) sendAllAvailable(ctx context.Context) error {
 
 		response, err := s.sub.Next(ctx)
 
+		if response == nil && err == nil {
+			continue
+		}
+
 		if err != nil {
-			if errors.Is(err, storage.ErrNotFound) || execution_data.IsBlobNotFoundError(err) {
+			if errors.Is(err, storage.ErrNotFound) ||
+				errors.Is(err, storage.ErrHeightNotIndexed) ||
+				execution_data.IsBlobNotFoundError(err) ||
+				errors.Is(err, ErrBlockNotReady) {
 				// no more available
 				return nil
 			}
diff --git a/engine/access/state_stream/backend/streamer_test.go b/engine/access/subscription/streamer_test.go
similarity index 87%
rename from engine/access/state_stream/backend/streamer_test.go
rename to engine/access/subscription/streamer_test.go
index 8226b5902f4..b3d46867c0d 100644
--- a/engine/access/state_stream/backend/streamer_test.go
+++ b/engine/access/subscription/streamer_test.go
@@ -1,4 +1,4 @@
-package backend_test
+package subscription_test
 
 import (
 	"context"
@@ -11,9 +11,8 @@ import (
 	"github.com/stretchr/testify/mock"
 
 	"github.com/onflow/flow-go/engine"
-	"github.com/onflow/flow-go/engine/access/state_stream"
-	"github.com/onflow/flow-go/engine/access/state_stream/backend"
 	streammock "github.com/onflow/flow-go/engine/access/state_stream/mock"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/utils/unittest"
 )
 
@@ -28,7 +27,7 @@ func TestStream(t *testing.T) {
 	t.Parallel()
 
 	ctx := context.Background()
-	timeout := state_stream.DefaultSendTimeout
+	timeout := subscription.DefaultSendTimeout
 
 	sub := streammock.NewStreamable(t)
 	sub.On("ID").Return(uuid.NewString())
@@ -40,7 +39,7 @@ func TestStream(t *testing.T) {
 	tests = append(tests, testData{"", testErr})
 
 	broadcaster := engine.NewBroadcaster()
-	streamer := backend.NewStreamer(unittest.Logger(), broadcaster, timeout, state_stream.DefaultResponseLimit, sub)
+	streamer := subscription.NewStreamer(unittest.Logger(), broadcaster, timeout, subscription.DefaultResponseLimit, sub)
 
 	for _, d := range tests {
 		sub.On("Next", mock.Anything).Return(d.data, d.err).Once()
@@ -65,7 +64,7 @@ func TestStreamRatelimited(t *testing.T) {
 	t.Parallel()
 
 	ctx := context.Background()
-	timeout := state_stream.DefaultSendTimeout
+	timeout := subscription.DefaultSendTimeout
 	duration := 100 * time.Millisecond
 
 	for _, limit := range []float64{0.2, 3, 20, 500} {
@@ -74,7 +73,7 @@ func TestStreamRatelimited(t *testing.T) {
 			sub.On("ID").Return(uuid.NewString())
 
 			broadcaster := engine.NewBroadcaster()
-			streamer := backend.NewStreamer(unittest.Logger(), broadcaster, timeout, limit, sub)
+			streamer := subscription.NewStreamer(unittest.Logger(), broadcaster, timeout, limit, sub)
 
 			var nextCalls, sendCalls int
 			sub.On("Next", mock.Anything).Return("data", nil).Run(func(args mock.Arguments) {
@@ -116,7 +115,7 @@ func TestLongStreamRatelimited(t *testing.T) {
 	unittest.SkipUnless(t, unittest.TEST_LONG_RUNNING, "skipping long stream rate limit test")
 
 	ctx := context.Background()
-	timeout := state_stream.DefaultSendTimeout
+	timeout := subscription.DefaultSendTimeout
 
 	limit := 5.0
 	duration := 30 * time.Second
@@ -125,7 +124,7 @@ func TestLongStreamRatelimited(t *testing.T) {
 	sub.On("ID").Return(uuid.NewString())
 
 	broadcaster := engine.NewBroadcaster()
-	streamer := backend.NewStreamer(unittest.Logger(), broadcaster, timeout, limit, sub)
+	streamer := subscription.NewStreamer(unittest.Logger(), broadcaster, timeout, limit, sub)
 
 	var nextCalls, sendCalls int
 	sub.On("Next", mock.Anything).Return("data", nil).Run(func(args mock.Arguments) {
diff --git a/engine/access/subscription/subscribe_handler.go b/engine/access/subscription/subscribe_handler.go
new file mode 100644
index 00000000000..7b72dffad8d
--- /dev/null
+++ b/engine/access/subscription/subscribe_handler.go
@@ -0,0 +1,64 @@
+package subscription
+
+import (
+	"context"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/engine"
+)
+
+// SubscriptionHandler represents common streaming data configuration for creating streaming subscription.
+type SubscriptionHandler struct {
+	log zerolog.Logger
+
+	broadcaster *engine.Broadcaster
+
+	sendTimeout    time.Duration
+	responseLimit  float64
+	sendBufferSize int
+}
+
+// NewSubscriptionHandler creates a new SubscriptionHandler instance.
+//
+// Parameters:
+// - log: The logger to use for logging.
+// - broadcaster: The engine broadcaster for publishing notifications.
+// - sendTimeout: The duration after which a send operation will timeout.
+// - responseLimit: The maximum allowed response time for a single stream.
+// - sendBufferSize: The size of the response buffer for sending messages to the client.
+//
+// Returns a new SubscriptionHandler instance.
+func NewSubscriptionHandler(
+	log zerolog.Logger,
+	broadcaster *engine.Broadcaster,
+	sendTimeout time.Duration,
+	responseLimit float64,
+	sendBufferSize uint,
+) *SubscriptionHandler {
+	return &SubscriptionHandler{
+		log:            log,
+		broadcaster:    broadcaster,
+		sendTimeout:    sendTimeout,
+		responseLimit:  responseLimit,
+		sendBufferSize: int(sendBufferSize),
+	}
+}
+
+// Subscribe creates and starts a new subscription.
+//
+// Parameters:
+// - ctx: The context for the operation.
+// - startHeight: The height to start subscription from.
+// - getData: The function to retrieve data by height.
+func (h *SubscriptionHandler) Subscribe(
+	ctx context.Context,
+	startHeight uint64,
+	getData GetDataByHeightFunc,
+) Subscription {
+	sub := NewHeightBasedSubscription(h.sendBufferSize, startHeight, getData)
+	go NewStreamer(h.log, h.broadcaster, h.sendTimeout, h.responseLimit, sub).Stream(ctx)
+
+	return sub
+}
diff --git a/engine/access/state_stream/backend/subscription.go b/engine/access/subscription/subscription.go
similarity index 60%
rename from engine/access/state_stream/backend/subscription.go
rename to engine/access/subscription/subscription.go
index eb568d196db..3c5a12cee31 100644
--- a/engine/access/state_stream/backend/subscription.go
+++ b/engine/access/subscription/subscription.go
@@ -1,4 +1,4 @@
-package backend
+package subscription
 
 import (
 	"context"
@@ -8,8 +8,30 @@ import (
 
 	"github.com/google/uuid"
 	"google.golang.org/grpc/status"
+)
+
+const (
+	// DefaultSendBufferSize is the default buffer size for the subscription's send channel.
+	// The size is chosen to balance memory overhead from each subscription with performance when
+	// streaming existing data.
+	DefaultSendBufferSize = 10
+
+	// DefaultMaxGlobalStreams defines the default max number of streams that can be open at the same time.
+	DefaultMaxGlobalStreams = 1000
+
+	// DefaultCacheSize defines the default max number of objects for the execution data cache.
+	DefaultCacheSize = 100
+
+	// DefaultSendTimeout is the default timeout for sending a message to the client. After the timeout
+	// expires, the connection is closed.
+	DefaultSendTimeout = 30 * time.Second
+
+	// DefaultResponseLimit is default max responses per second allowed on a stream. After exceeding
+	// the limit, the stream is paused until more capacity is available.
+	DefaultResponseLimit = float64(0)
 
-	"github.com/onflow/flow-go/engine/access/state_stream"
+	// DefaultHeartbeatInterval specifies the block interval at which heartbeat messages should be sent.
+	DefaultHeartbeatInterval = 1
 )
 
 // GetDataByHeightFunc is a callback used by subscriptions to retrieve data for a given height.
@@ -19,7 +41,38 @@ import (
 // All other errors are considered exceptions
 type GetDataByHeightFunc func(ctx context.Context, height uint64) (interface{}, error)
 
-var _ state_stream.Subscription = (*SubscriptionImpl)(nil)
+// Subscription represents a streaming request, and handles the communication between the grpc handler
+// and the backend implementation.
+type Subscription interface {
+	// ID returns the unique identifier for this subscription used for logging
+	ID() string
+
+	// Channel returns the channel from which subscription data can be read
+	Channel() <-chan interface{}
+
+	// Err returns the error that caused the subscription to fail
+	Err() error
+}
+
+// Streamable represents a subscription that can be streamed.
+type Streamable interface {
+	// ID returns the subscription ID
+	// Note: this is not a cryptographic hash
+	ID() string
+	// Close is called when a subscription ends gracefully, and closes the subscription channel
+	Close()
+	// Fail registers an error and closes the subscription channel
+	Fail(error)
+	// Send sends a value to the subscription channel or returns an error
+	// Expected errors:
+	// - context.DeadlineExceeded if send timed out
+	// - context.Canceled if the client disconnected
+	Send(context.Context, interface{}, time.Duration) error
+	// Next returns the value for the next height from the subscription
+	Next(context.Context) (interface{}, error)
+}
+
+var _ Subscription = (*SubscriptionImpl)(nil)
 
 type SubscriptionImpl struct {
 	id string
@@ -110,8 +163,8 @@ func NewFailedSubscription(err error, msg string) *SubscriptionImpl {
 	return sub
 }
 
-var _ state_stream.Subscription = (*HeightBasedSubscription)(nil)
-var _ state_stream.Streamable = (*HeightBasedSubscription)(nil)
+var _ Subscription = (*HeightBasedSubscription)(nil)
+var _ Streamable = (*HeightBasedSubscription)(nil)
 
 // HeightBasedSubscription is a subscription that retrieves data sequentially by block height
 type HeightBasedSubscription struct {
diff --git a/engine/access/state_stream/backend/subscription_test.go b/engine/access/subscription/subscription_test.go
similarity index 90%
rename from engine/access/state_stream/backend/subscription_test.go
rename to engine/access/subscription/subscription_test.go
index 2df54ecf570..a86422c17fd 100644
--- a/engine/access/state_stream/backend/subscription_test.go
+++ b/engine/access/subscription/subscription_test.go
@@ -1,4 +1,4 @@
-package backend_test
+package subscription_test
 
 import (
 	"context"
@@ -7,11 +7,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/onflow/flow-go/engine/access/state_stream/backend"
-
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/utils/unittest"
 )
 
@@ -21,7 +20,7 @@ func TestSubscription_SendReceive(t *testing.T) {
 
 	ctx := context.Background()
 
-	sub := backend.NewSubscription(1)
+	sub := subscription.NewSubscription(1)
 
 	assert.NotEmpty(t, sub.ID())
 
@@ -67,7 +66,7 @@ func TestSubscription_Failures(t *testing.T) {
 
 	// make sure closing a subscription twice does not cause a panic
 	t.Run("close only called once", func(t *testing.T) {
-		sub := backend.NewSubscription(1)
+		sub := subscription.NewSubscription(1)
 		sub.Close()
 		sub.Close()
 
@@ -76,7 +75,7 @@ func TestSubscription_Failures(t *testing.T) {
 
 	// make sure failing and closing the same subscription does not cause a panic
 	t.Run("close only called once with fail", func(t *testing.T) {
-		sub := backend.NewSubscription(1)
+		sub := subscription.NewSubscription(1)
 		sub.Fail(testErr)
 		sub.Close()
 
@@ -85,7 +84,7 @@ func TestSubscription_Failures(t *testing.T) {
 
 	// make sure an error is returned when sending on a closed subscription
 	t.Run("send after closed returns an error", func(t *testing.T) {
-		sub := backend.NewSubscription(1)
+		sub := subscription.NewSubscription(1)
 		sub.Fail(testErr)
 
 		err := sub.Send(context.Background(), "test", 10*time.Millisecond)
@@ -118,7 +117,7 @@ func TestHeightBasedSubscription(t *testing.T) {
 	}
 
 	// search from [start, last], checking the correct data is returned
-	sub := backend.NewHeightBasedSubscription(1, start, getData)
+	sub := subscription.NewHeightBasedSubscription(1, start, getData)
 	for i := start; i <= last; i++ {
 		data, err := sub.Next(ctx)
 		if err != nil {
diff --git a/engine/access/subscription/util.go b/engine/access/subscription/util.go
new file mode 100644
index 00000000000..593f3d78499
--- /dev/null
+++ b/engine/access/subscription/util.go
@@ -0,0 +1,39 @@
+package subscription
+
+import (
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/onflow/flow-go/engine/common/rpc"
+)
+
+// HandleSubscription is a generic handler for subscriptions to a specific type. It continuously listens to the subscription channel,
+// handles the received responses, and sends the processed information to the client via the provided stream using handleResponse.
+//
+// Parameters:
+// - sub: The subscription.
+// - handleResponse: The function responsible for handling the response of the subscribed type.
+//
+// Expected errors during normal operation:
+//   - codes.Internal: If the subscription encounters an error or gets an unexpected response.
+func HandleSubscription[T any](sub Subscription, handleResponse func(resp T) error) error {
+	for {
+		v, ok := <-sub.Channel()
+		if !ok {
+			if sub.Err() != nil {
+				return rpc.ConvertError(sub.Err(), "stream encountered an error", codes.Internal)
+			}
+			return nil
+		}
+
+		resp, ok := v.(T)
+		if !ok {
+			return status.Errorf(codes.Internal, "unexpected response type: %T", v)
+		}
+
+		err := handleResponse(resp)
+		if err != nil {
+			return err
+		}
+	}
+}
diff --git a/engine/collection/compliance/core.go b/engine/collection/compliance/core.go
index 2f5d4eab6b3..c341d7cb146 100644
--- a/engine/collection/compliance/core.go
+++ b/engine/collection/compliance/core.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package compliance
 
 import (
diff --git a/engine/collection/compliance/engine_test.go b/engine/collection/compliance/engine_test.go
index 3c760ed05c3..5ad01b19566 100644
--- a/engine/collection/compliance/engine_test.go
+++ b/engine/collection/compliance/engine_test.go
@@ -57,12 +57,12 @@ func (cs *EngineSuite) SetupTest() {
 	// initialize the parameters
 	cs.cluster = unittest.IdentityListFixture(3,
 		unittest.WithRole(flow.RoleCollection),
-		unittest.WithWeight(1000),
+		unittest.WithInitialWeight(1000),
 	)
 	cs.myID = cs.cluster[0].NodeID
 
 	protoEpoch := &protocol.Epoch{}
-	clusters := flow.ClusterList{cs.cluster}
+	clusters := flow.ClusterList{cs.cluster.ToSkeleton()}
 	protoEpoch.On("Clustering").Return(clusters, nil)
 
 	protoQuery := &protocol.EpochQuery{}
@@ -71,7 +71,7 @@ func (cs *EngineSuite) SetupTest() {
 	protoSnapshot := &protocol.Snapshot{}
 	protoSnapshot.On("Epochs").Return(protoQuery)
 	protoSnapshot.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return cs.cluster.Filter(selector)
 		},
 		nil,
diff --git a/engine/collection/epochmgr/engine.go b/engine/collection/epochmgr/engine.go
index 5ce5184e7b1..fa84afbd477 100644
--- a/engine/collection/epochmgr/engine.go
+++ b/engine/collection/epochmgr/engine.go
@@ -532,10 +532,7 @@ func (e *Engine) activeClusterIDs() (flow.ChainIDList, error) {
 	defer e.mu.RUnlock()
 	clusterIDs := make(flow.ChainIDList, 0)
 	for _, epoch := range e.epochs {
-		chainID, err := epoch.state.Params().ChainID() // cached, does not hit database
-		if err != nil {
-			return nil, fmt.Errorf("failed to get active cluster ids: %w", err)
-		}
+		chainID := epoch.state.Params().ChainID() // cached, does not hit database
 		clusterIDs = append(clusterIDs, chainID)
 	}
 	return clusterIDs, nil
diff --git a/engine/collection/epochmgr/factories/sync.go b/engine/collection/epochmgr/factories/sync.go
index 020895ee22d..e3dbe15dca6 100644
--- a/engine/collection/epochmgr/factories/sync.go
+++ b/engine/collection/epochmgr/factories/sync.go
@@ -37,7 +37,7 @@ func NewSyncEngineFactory(
 }
 
 func (f *SyncEngineFactory) Create(
-	participants flow.IdentityList,
+	participants flow.IdentitySkeletonList,
 	state cluster.State,
 	blocks storage.ClusterBlocks,
 	core *chainsync.Core,
diff --git a/engine/collection/ingest/engine.go b/engine/collection/ingest/engine.go
index d635332ba27..81141b65977 100644
--- a/engine/collection/ingest/engine.go
+++ b/engine/collection/ingest/engine.go
@@ -55,11 +55,12 @@ func New(
 	chain flow.Chain,
 	pools *epochs.TransactionPools,
 	config Config,
+	limiter *AddressRateLimiter,
 ) (*Engine, error) {
 
 	logger := log.With().Str("engine", "ingest").Logger()
 
-	transactionValidator := access.NewTransactionValidator(
+	transactionValidator := access.NewTransactionValidatorWithLimiter(
 		access.NewProtocolStateBlocks(state),
 		chain,
 		access.TransactionValidationOptions{
@@ -70,6 +71,7 @@ func New(
 			MaxTransactionByteSize: config.MaxTransactionByteSize,
 			MaxCollectionByteSize:  config.MaxCollectionByteSize,
 		},
+		limiter,
 	)
 
 	// FIFO queue for transactions
@@ -295,7 +297,7 @@ func (e *Engine) onTransaction(originID flow.Identifier, tx *flow.TransactionBod
 //     a member of the reference epoch. This is an expected condition and the transaction
 //     should be discarded.
 //   - other error for any other, unexpected error condition.
-func (e *Engine) getLocalCluster(refEpoch protocol.Epoch) (flow.IdentityList, error) {
+func (e *Engine) getLocalCluster(refEpoch protocol.Epoch) (flow.IdentitySkeletonList, error) {
 	epochCounter, err := refEpoch.Counter()
 	if err != nil {
 		return nil, fmt.Errorf("could not get counter for reference epoch: %w", err)
@@ -370,7 +372,7 @@ func (e *Engine) ingestTransaction(
 
 // propagateTransaction propagates the transaction to a number of the responsible
 // cluster's members. Any unexpected networking errors are logged.
-func (e *Engine) propagateTransaction(log zerolog.Logger, tx *flow.TransactionBody, txCluster flow.IdentityList) {
+func (e *Engine) propagateTransaction(log zerolog.Logger, tx *flow.TransactionBody, txCluster flow.IdentitySkeletonList) {
 	log.Debug().Msg("propagating transaction to cluster")
 
 	err := e.conduit.Multicast(tx, e.config.PropagationRedundancy+1, txCluster.NodeIDs()...)
diff --git a/engine/collection/ingest/engine_test.go b/engine/collection/ingest/engine_test.go
index cdaa33eb7db..7bef24a290a 100644
--- a/engine/collection/ingest/engine_test.go
+++ b/engine/collection/ingest/engine_test.go
@@ -10,6 +10,7 @@ import (
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/suite"
+	"golang.org/x/time/rate"
 
 	"github.com/onflow/flow-go/access"
 	"github.com/onflow/flow-go/engine"
@@ -88,8 +89,8 @@ func (suite *Suite) SetupTest() {
 		return herocache.NewTransactions(1000, log, metrics)
 	})
 
-	assignments := unittest.ClusterAssignment(suite.N_CLUSTERS, collectors)
-	suite.clusters, err = factory.NewClusterList(assignments, collectors)
+	assignments := unittest.ClusterAssignment(suite.N_CLUSTERS, collectors.ToSkeleton())
+	suite.clusters, err = factory.NewClusterList(assignments, collectors.ToSkeleton())
 	suite.Require().NoError(err)
 
 	suite.root = unittest.GenesisFixture()
@@ -125,7 +126,7 @@ func (suite *Suite) SetupTest() {
 
 	suite.conf = DefaultConfig()
 	chain := flow.Testnet.Chain()
-	suite.engine, err = New(log, net, suite.state, metrics, metrics, metrics, suite.me, chain, suite.pools, suite.conf)
+	suite.engine, err = New(log, net, suite.state, metrics, metrics, metrics, suite.me, chain, suite.pools, suite.conf, NewAddressRateLimiter(rate.Limit(1), 1))
 	suite.Require().NoError(err)
 }
 
@@ -352,7 +353,7 @@ func (suite *Suite) TestRoutingToRemoteClusterWithNoNodes() {
 	suite.Require().True(ok)
 
 	// set the next cluster to be empty
-	emptyIdentityList := flow.IdentityList{}
+	emptyIdentityList := flow.IdentitySkeletonList{}
 	nextClusterIndex := (index + 1) % suite.N_CLUSTERS
 	suite.clusters[nextClusterIndex] = emptyIdentityList
 
@@ -384,7 +385,7 @@ func (suite *Suite) TestRoutingLocalClusterFromOtherNode() {
 	suite.Require().True(ok)
 
 	// another node will send us the transaction
-	sender := local.Filter(filter.Not(filter.HasNodeID(suite.me.NodeID())))[0]
+	sender := local.Filter(filter.Not(filter.HasNodeID[flow.IdentitySkeleton](suite.me.NodeID())))[0]
 
 	// get a transaction that will be routed to local cluster
 	tx := unittest.TransactionBodyFixture()
@@ -475,8 +476,8 @@ func (suite *Suite) TestRouting_ClusterAssignmentRemoved() {
 
 	// remove ourselves from the cluster assignment for epoch 2
 	withoutMe := suite.identities.
-		Filter(filter.Not(filter.HasNodeID(suite.me.NodeID()))).
-		Filter(filter.HasRole(flow.RoleCollection))
+		Filter(filter.Not(filter.HasNodeID[flow.Identity](suite.me.NodeID()))).
+		Filter(filter.HasRole[flow.Identity](flow.RoleCollection)).ToSkeleton()
 	epoch2Assignment := unittest.ClusterAssignment(suite.N_CLUSTERS, withoutMe)
 	epoch2Clusters, err := factory.NewClusterList(epoch2Assignment, withoutMe)
 	suite.Require().NoError(err)
@@ -514,8 +515,8 @@ func (suite *Suite) TestRouting_ClusterAssignmentAdded() {
 
 	// remove ourselves from the cluster assignment for epoch 2
 	withoutMe := suite.identities.
-		Filter(filter.Not(filter.HasNodeID(suite.me.NodeID()))).
-		Filter(filter.HasRole(flow.RoleCollection))
+		Filter(filter.Not(filter.HasNodeID[flow.Identity](suite.me.NodeID()))).
+		Filter(filter.HasRole[flow.Identity](flow.RoleCollection)).ToSkeleton()
 	epoch2Assignment := unittest.ClusterAssignment(suite.N_CLUSTERS, withoutMe)
 	epoch2Clusters, err := factory.NewClusterList(epoch2Assignment, withoutMe)
 	suite.Require().NoError(err)
@@ -544,7 +545,7 @@ func (suite *Suite) TestRouting_ClusterAssignmentAdded() {
 	// EPOCH 3:
 
 	// include ourselves in cluster assignment
-	withMe := suite.identities.Filter(filter.HasRole(flow.RoleCollection))
+	withMe := suite.identities.Filter(filter.HasRole[flow.Identity](flow.RoleCollection)).ToSkeleton()
 	epoch3Assignment := unittest.ClusterAssignment(suite.N_CLUSTERS, withMe)
 	epoch3Clusters, err := factory.NewClusterList(epoch3Assignment, withMe)
 	suite.Require().NoError(err)
diff --git a/engine/collection/ingest/rate_limiter.go b/engine/collection/ingest/rate_limiter.go
new file mode 100644
index 00000000000..66733ae03cc
--- /dev/null
+++ b/engine/collection/ingest/rate_limiter.go
@@ -0,0 +1,147 @@
+package ingest
+
+import (
+	"strings"
+	"sync"
+
+	"golang.org/x/time/rate"
+
+	"github.com/onflow/flow-go/model/flow"
+)
+
+// AddressRateLimiter limits the rate of ingested transactions with a given payer address.
+type AddressRateLimiter struct {
+	mu       sync.RWMutex
+	limiters map[flow.Address]*rate.Limiter
+	limit    rate.Limit // X messages allowed per second
+	burst    int        // X messages allowed at one time
+}
+
+// AddressRateLimiter limits the rate of ingested transactions with a given payer address.
+// It allows the given "limit" amount messages per second with a "burst" amount of messages to be sent at once
+//
+// for example,
+// To config 1 message per 100 milliseconds, convert to per second first, which is 10 message per second,
+// so limit is 10 ( rate.Limit(10) ), and burst is 1.
+// Note: rate.Limit(0.1), burst = 1 means 1 message per 10 seconds, instead of 1 message per 100 milliseconds.
+//
+// To config 3 message per minute, the per-second-basis is 0.05 (3/60), so the limit should be rate.Limit(0.05),
+// and burst is 3.
+//
+// Note: The rate limit configured for each node may differ from the effective network-wide rate limit
+// for a given payer. In particular, the number of clusters and the message propagation factor will
+// influence how the individual rate limit translates to a network-wide rate limit.
+// For example, suppose we have 5 collection clusters and configure each Collection Node with a rate
+// limit of 1 message per second. Then, the effective network-wide rate limit for a payer address would
+// be *at least* 5 messages per second.
+func NewAddressRateLimiter(limit rate.Limit, burst int) *AddressRateLimiter {
+	return &AddressRateLimiter{
+		limiters: make(map[flow.Address]*rate.Limiter),
+		limit:    limit,
+		burst:    burst,
+	}
+}
+
+// Allow returns whether the given address should be allowed (not rate limited)
+func (r *AddressRateLimiter) Allow(address flow.Address) bool {
+	return !r.IsRateLimited(address)
+}
+
+// IsRateLimited returns whether the given address should be rate limited
+func (r *AddressRateLimiter) IsRateLimited(address flow.Address) bool {
+	r.mu.RLock()
+	limiter, ok := r.limiters[address]
+	r.mu.RUnlock()
+
+	if !ok {
+		return false
+	}
+
+	rateLimited := !limiter.Allow()
+	return rateLimited
+}
+
+// AddAddress add an address to be rate limited
+func (r *AddressRateLimiter) AddAddress(address flow.Address) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	_, ok := r.limiters[address]
+	if ok {
+		return
+	}
+
+	r.limiters[address] = rate.NewLimiter(r.limit, r.burst)
+}
+
+// RemoveAddress remove an address for being rate limited
+func (r *AddressRateLimiter) RemoveAddress(address flow.Address) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	delete(r.limiters, address)
+}
+
+// GetAddresses get the list of rate limited address
+func (r *AddressRateLimiter) GetAddresses() []flow.Address {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	addresses := make([]flow.Address, 0, len(r.limiters))
+	for address := range r.limiters {
+		addresses = append(addresses, address)
+	}
+
+	return addresses
+}
+
+// GetLimitConfig get the limit config
+func (r *AddressRateLimiter) GetLimitConfig() (rate.Limit, int) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	return r.limit, r.burst
+}
+
+// SetLimitConfig update the limit config
+// Note all the existing limiters will be updated, and reset
+func (r *AddressRateLimiter) SetLimitConfig(limit rate.Limit, burst int) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	for address := range r.limiters {
+		r.limiters[address] = rate.NewLimiter(limit, burst)
+	}
+
+	r.limit = limit
+	r.burst = burst
+}
+
+// Util functions
+func AddAddresses(r *AddressRateLimiter, addresses []flow.Address) {
+	for _, address := range addresses {
+		r.AddAddress(address)
+	}
+}
+
+func RemoveAddresses(r *AddressRateLimiter, addresses []flow.Address) {
+	for _, address := range addresses {
+		r.RemoveAddress(address)
+	}
+}
+
+// parse addresses string into a list of flow addresses
+func ParseAddresses(addresses string) ([]flow.Address, error) {
+	addressList := make([]flow.Address, 0)
+	for _, addr := range strings.Split(addresses, ",") {
+		addr = strings.TrimSpace(addr)
+		if addr == "" {
+			continue
+		}
+		flowAddr, err := flow.StringToAddress(addr)
+		if err != nil {
+			return nil, err
+		}
+		addressList = append(addressList, flowAddr)
+	}
+	return addressList, nil
+}
diff --git a/engine/collection/ingest/rate_limiter_test.go b/engine/collection/ingest/rate_limiter_test.go
new file mode 100644
index 00000000000..20609f59bf6
--- /dev/null
+++ b/engine/collection/ingest/rate_limiter_test.go
@@ -0,0 +1,185 @@
+package ingest_test
+
+import (
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/atomic"
+	"golang.org/x/time/rate"
+
+	"github.com/onflow/flow-go/access"
+	"github.com/onflow/flow-go/engine/collection/ingest"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+var _ access.RateLimiter = (*ingest.AddressRateLimiter)(nil)
+
+func TestLimiterAddRemoveAddress(t *testing.T) {
+	t.Parallel()
+
+	good1 := unittest.RandomAddressFixture()
+	limited1 := unittest.RandomAddressFixture()
+	limited2 := unittest.RandomAddressFixture()
+
+	numPerSec := rate.Limit(1)
+	burst := 1
+	l := ingest.NewAddressRateLimiter(numPerSec, burst)
+
+	require.False(t, l.IsRateLimited(good1))
+	require.False(t, l.IsRateLimited(good1)) // address are not limited
+
+	l.AddAddress(limited1)
+	require.Equal(t, []flow.Address{limited1}, l.GetAddresses())
+
+	require.False(t, l.IsRateLimited(limited1)) // address 1 is not limited on the first call
+	require.True(t, l.IsRateLimited(limited1))  // limited on the second call immediately
+	require.True(t, l.IsRateLimited(limited1))  // limited on the second call immediately
+
+	require.False(t, l.IsRateLimited(good1))
+	require.False(t, l.IsRateLimited(good1)) // address are not limited
+
+	l.AddAddress(limited2)
+	list := l.GetAddresses()
+	require.Len(t, list, 2)
+	require.Contains(t, list, limited1, limited2)
+
+	require.False(t, l.IsRateLimited(limited2)) // address 2 is not limited on the first call
+	require.True(t, l.IsRateLimited(limited2))  // limited on the second call immediately
+	require.True(t, l.IsRateLimited(limited2))  // limited on the second call immediately
+
+	l.RemoveAddress(limited1) // after remove the limit, it no longer limited
+	require.False(t, l.IsRateLimited(limited1))
+	require.False(t, l.IsRateLimited(limited1))
+
+	// but limit2 is still limited
+	require.True(t, l.IsRateLimited(limited2))
+}
+
+func TestLimiterBurst(t *testing.T) {
+	t.Parallel()
+
+	limited1 := unittest.RandomAddressFixture()
+
+	numPerSec := rate.Limit(1)
+	burst := 3
+	l := ingest.NewAddressRateLimiter(numPerSec, burst)
+
+	l.AddAddress(limited1)
+	for i := 0; i < burst; i++ {
+		require.False(t, l.IsRateLimited(limited1), fmt.Sprintf("%v-nth call", i))
+	}
+
+	require.True(t, l.IsRateLimited(limited1)) // limited
+	require.True(t, l.IsRateLimited(limited1)) // limited
+}
+
+// verify that if wait long enough after rate limited
+func TestLimiterWaitLongEnough(t *testing.T) {
+	t.Parallel()
+
+	addr1 := unittest.RandomAddressFixture()
+
+	// with limit set to 10, it means we allow 10 messages per second,
+	// and with burst set to 1, it means we only allow 1 message at a time,
+	// so the limit is 1 message per 100 milliseconds.
+	// Note rate.Limit(0.1) is not to set 1 message per 100 milliseconds, but
+	// 1 message per 10 seconds.
+	numPerSec := rate.Limit(10)
+	burst := 1
+	l := ingest.NewAddressRateLimiter(numPerSec, burst)
+
+	l.AddAddress(addr1)
+	require.False(t, l.IsRateLimited(addr1))
+	require.True(t, l.IsRateLimited(addr1))
+
+	// check every 10 Millisecond then after 100 Millisecond it should be allowed
+	require.Eventually(t, func() bool {
+		return l.Allow(addr1)
+	}, 110*time.Millisecond, 10*time.Millisecond)
+
+	// block again until another 100 ms
+	require.True(t, l.IsRateLimited(addr1))
+
+	// block until another 100 ms
+	require.Eventually(t, func() bool {
+		return l.Allow(addr1)
+	}, 110*time.Millisecond, 10*time.Millisecond)
+}
+
+func TestLimiterConcurrentSafe(t *testing.T) {
+	t.Parallel()
+	good1 := unittest.RandomAddressFixture()
+	limited1 := unittest.RandomAddressFixture()
+
+	numPerSec := rate.Limit(1)
+	burst := 1
+	l := ingest.NewAddressRateLimiter(numPerSec, burst)
+
+	l.AddAddress(limited1)
+
+	wg := sync.WaitGroup{}
+	wg.Add(2)
+
+	succeed := atomic.NewUint64(0)
+	go func(wg *sync.WaitGroup) {
+		defer wg.Done()
+		ok := l.IsRateLimited(limited1)
+		if ok {
+			succeed.Add(1)
+		}
+		require.False(t, l.IsRateLimited(good1)) // never limited
+	}(&wg)
+
+	go func(wg *sync.WaitGroup) {
+		defer wg.Done()
+		ok := l.IsRateLimited(limited1)
+		if ok {
+			succeed.Add(1)
+		}
+		require.False(t, l.IsRateLimited(good1)) // never limited
+	}(&wg)
+
+	wg.Wait()
+	require.Equal(t, uint64(1), succeed.Load()) // should only succeed once
+}
+
+func TestLimiterGetSetConfig(t *testing.T) {
+	t.Parallel()
+
+	addr1 := unittest.RandomAddressFixture()
+
+	// with limit set to 10, it means we allow 10 messages per second,
+	// and with burst set to 1, it means we only allow 1 message at a time,
+	// so the limit is 1 message per 100 milliseconds.
+	// Note rate.Limit(0.1) is not to set 1 message per 100 milliseconds, but
+	// 1 message per 10 seconds.
+	numPerSec := rate.Limit(10)
+	burst := 1
+	l := ingest.NewAddressRateLimiter(numPerSec, burst)
+
+	l.AddAddress(addr1)
+	require.False(t, l.IsRateLimited(addr1))
+	require.True(t, l.IsRateLimited(addr1))
+
+	limitConfig, burstConfig := l.GetLimitConfig()
+	require.Equal(t, numPerSec, limitConfig)
+	require.Equal(t, burst, burstConfig)
+
+	// change from 1 message per 100 ms to 4 messages per 200 ms
+	l.SetLimitConfig(rate.Limit(20), 4)
+
+	// verify the quota is reset, and the new limit is applied
+	for i := 0; i < 4; i++ {
+		require.False(t, l.IsRateLimited(addr1), fmt.Sprintf("fail at %v-th call", i))
+	}
+	require.True(t, l.IsRateLimited(addr1))
+
+	// check every 10 Millisecond then after 100 Millisecond it should be allowed
+	require.Eventually(t, func() bool {
+		return l.Allow(addr1)
+	}, 210*time.Millisecond, 10*time.Millisecond)
+}
diff --git a/engine/collection/message_hub/message_hub.go b/engine/collection/message_hub/message_hub.go
index 6ce3492a7bb..f2241dffb73 100644
--- a/engine/collection/message_hub/message_hub.go
+++ b/engine/collection/message_hub/message_hub.go
@@ -86,7 +86,7 @@ type MessageHub struct {
 	ownOutboundVotes           *fifoqueue.FifoQueue // queue for handling outgoing vote transmissions
 	ownOutboundProposals       *fifoqueue.FifoQueue // queue for handling outgoing proposal transmissions
 	ownOutboundTimeouts        *fifoqueue.FifoQueue // queue for handling outgoing timeout transmissions
-	clusterIdentityFilter      flow.IdentityFilter
+	clusterIdentityFilter      flow.IdentityFilter[flow.Identity]
 
 	// injected dependencies
 	compliance        collection.Compliance      // handler of incoming block proposals
@@ -150,16 +150,13 @@ func NewMessageHub(log zerolog.Logger,
 		ownOutboundProposals:       ownOutboundProposals,
 		ownOutboundTimeouts:        ownOutboundTimeouts,
 		clusterIdentityFilter: filter.And(
-			filter.In(currentCluster),
-			filter.Not(filter.HasNodeID(me.NodeID())),
+			filter.Adapt(filter.In(currentCluster)),
+			filter.Not(filter.HasNodeID[flow.Identity](me.NodeID())),
 		),
 	}
 
 	// register network conduit
-	chainID, err := clusterState.Params().ChainID()
-	if err != nil {
-		return nil, fmt.Errorf("could not get chain ID: %w", err)
-	}
+	chainID := clusterState.Params().ChainID()
 	conduit, err := net.Register(channels.ConsensusCluster(chainID), hub)
 	if err != nil {
 		return nil, fmt.Errorf("could not register engine: %w", err)
diff --git a/engine/collection/message_hub/message_hub_test.go b/engine/collection/message_hub/message_hub_test.go
index 7e60e4d7877..d6032fa8e6f 100644
--- a/engine/collection/message_hub/message_hub_test.go
+++ b/engine/collection/message_hub/message_hub_test.go
@@ -70,7 +70,7 @@ func (s *MessageHubSuite) SetupTest() {
 	// initialize the paramaters
 	s.cluster = unittest.IdentityListFixture(3,
 		unittest.WithRole(flow.RoleCollection),
-		unittest.WithWeight(1000),
+		unittest.WithInitialWeight(1000),
 	)
 	s.myID = s.cluster[0].NodeID
 	s.clusterID = "cluster-id"
@@ -89,7 +89,7 @@ func (s *MessageHubSuite) SetupTest() {
 
 	// set up proto state mock
 	protoEpoch := &protocol.Epoch{}
-	clusters := flow.ClusterList{s.cluster}
+	clusters := flow.ClusterList{s.cluster.ToSkeleton()}
 	protoEpoch.On("Clustering").Return(clusters, nil)
 
 	protoQuery := &protocol.EpochQuery{}
@@ -98,7 +98,7 @@ func (s *MessageHubSuite) SetupTest() {
 	protoSnapshot := &protocol.Snapshot{}
 	protoSnapshot.On("Epochs").Return(protoQuery)
 	protoSnapshot.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return s.cluster.Filter(selector)
 		},
 		nil,
diff --git a/engine/collection/pusher/engine.go b/engine/collection/pusher/engine.go
index 5e09ea7418e..317729108dd 100644
--- a/engine/collection/pusher/engine.go
+++ b/engine/collection/pusher/engine.go
@@ -128,7 +128,7 @@ func (e *Engine) onSubmitCollectionGuarantee(originID flow.Identifier, req *mess
 
 // SubmitCollectionGuarantee submits the collection guarantee to all consensus nodes.
 func (e *Engine) SubmitCollectionGuarantee(guarantee *flow.CollectionGuarantee) error {
-	consensusNodes, err := e.state.Final().Identities(filter.HasRole(flow.RoleConsensus))
+	consensusNodes, err := e.state.Final().Identities(filter.HasRole[flow.Identity](flow.RoleConsensus))
 	if err != nil {
 		return fmt.Errorf("could not get consensus nodes: %w", err)
 	}
diff --git a/engine/collection/pusher/engine_test.go b/engine/collection/pusher/engine_test.go
index fec34346ad9..fde6d9696dc 100644
--- a/engine/collection/pusher/engine_test.go
+++ b/engine/collection/pusher/engine_test.go
@@ -40,13 +40,13 @@ func (suite *Suite) SetupTest() {
 
 	// add some dummy identities so we have one of each role
 	suite.identities = unittest.IdentityListFixture(5, unittest.WithAllRoles())
-	me := suite.identities.Filter(filter.HasRole(flow.RoleCollection))[0]
+	me := suite.identities.Filter(filter.HasRole[flow.Identity](flow.RoleCollection))[0]
 
 	suite.state = new(protocol.State)
 	suite.snapshot = new(protocol.Snapshot)
-	suite.snapshot.On("Identities", mock.Anything).Return(func(filter flow.IdentityFilter) flow.IdentityList {
+	suite.snapshot.On("Identities", mock.Anything).Return(func(filter flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 		return suite.identities.Filter(filter)
-	}, func(filter flow.IdentityFilter) error {
+	}, func(filter flow.IdentityFilter[flow.Identity]) error {
 		return nil
 	})
 	suite.state.On("Final").Return(suite.snapshot)
@@ -86,7 +86,7 @@ func (suite *Suite) TestSubmitCollectionGuarantee() {
 	guarantee := unittest.CollectionGuaranteeFixture()
 
 	// should submit the collection to consensus nodes
-	consensus := suite.identities.Filter(filter.HasRole(flow.RoleConsensus))
+	consensus := suite.identities.Filter(filter.HasRole[flow.Identity](flow.RoleConsensus))
 	suite.conduit.On("Publish", guarantee, consensus[0].NodeID).Return(nil)
 
 	msg := &messages.SubmitCollectionGuarantee{
@@ -104,7 +104,7 @@ func (suite *Suite) TestSubmitCollectionGuaranteeNonLocal() {
 	guarantee := unittest.CollectionGuaranteeFixture()
 
 	// send from a non-allowed role
-	sender := suite.identities.Filter(filter.HasRole(flow.RoleVerification))[0]
+	sender := suite.identities.Filter(filter.HasRole[flow.Identity](flow.RoleVerification))[0]
 
 	msg := &messages.SubmitCollectionGuarantee{
 		Guarantee: *guarantee,
diff --git a/engine/collection/synchronization/engine.go b/engine/collection/synchronization/engine.go
index 622145860af..43d165395d9 100644
--- a/engine/collection/synchronization/engine.go
+++ b/engine/collection/synchronization/engine.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package synchronization
 
 import (
@@ -42,7 +40,7 @@ type Engine struct {
 	log          zerolog.Logger
 	metrics      module.EngineMetrics
 	me           module.Local
-	participants flow.IdentityList
+	participants flow.IdentitySkeletonList
 	con          network.Conduit
 	comp         collection.Compliance // compliance layer engine
 
@@ -64,7 +62,7 @@ func New(
 	metrics module.EngineMetrics,
 	net network.EngineRegistry,
 	me module.Local,
-	participants flow.IdentityList,
+	participants flow.IdentitySkeletonList,
 	state cluster.State,
 	blocks storage.ClusterBlocks,
 	comp collection.Compliance,
@@ -88,7 +86,7 @@ func New(
 		log:          log.With().Str("engine", "cluster_synchronization").Logger(),
 		metrics:      metrics,
 		me:           me,
-		participants: participants.Filter(filter.Not(filter.HasNodeID(me.NodeID()))),
+		participants: participants.Filter(filter.Not(filter.HasNodeID[flow.IdentitySkeleton](me.NodeID()))),
 		comp:         comp,
 		core:         core,
 		pollInterval: opt.PollInterval,
@@ -100,11 +98,7 @@ func New(
 	if err != nil {
 		return nil, fmt.Errorf("could not setup message handler")
 	}
-
-	chainID, err := state.Params().ChainID()
-	if err != nil {
-		return nil, fmt.Errorf("could not get chain ID: %w", err)
-	}
+	chainID := state.Params().ChainID()
 
 	// register the engine with the network layer and store the conduit
 	con, err := net.Register(channels.SyncCluster(chainID), e)
diff --git a/engine/collection/synchronization/engine_test.go b/engine/collection/synchronization/engine_test.go
index a637a9eedec..067119a196e 100644
--- a/engine/collection/synchronization/engine_test.go
+++ b/engine/collection/synchronization/engine_test.go
@@ -116,7 +116,7 @@ func (ss *SyncSuite) SetupTest() {
 		nil,
 	)
 	ss.snapshot.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return ss.participants.Filter(selector)
 		},
 		nil,
@@ -159,7 +159,7 @@ func (ss *SyncSuite) SetupTest() {
 	log := zerolog.New(io.Discard)
 	metrics := metrics.NewNoopCollector()
 
-	e, err := New(log, metrics, ss.net, ss.me, ss.participants, ss.state, ss.blocks, ss.comp, ss.core)
+	e, err := New(log, metrics, ss.net, ss.me, ss.participants.ToSkeleton(), ss.state, ss.blocks, ss.comp, ss.core)
 	require.NoError(ss.T(), err, "should pass engine initialization")
 
 	ss.e = e
@@ -456,7 +456,7 @@ func (ss *SyncSuite) TestOnBlockResponse() {
 func (ss *SyncSuite) TestPollHeight() {
 
 	// check that we send to three nodes from our total list
-	others := ss.participants.Filter(filter.HasNodeID(ss.participants[1:].NodeIDs()...))
+	others := ss.participants.Filter(filter.HasNodeID[flow.Identity](ss.participants[1:].NodeIDs()...))
 	ss.con.On("Multicast", mock.Anything, synccore.DefaultPollNodes, others[0].NodeID, others[1].NodeID).Return(nil).Run(
 		func(args mock.Arguments) {
 			req := args.Get(0).(*messages.SyncRequest)
diff --git a/engine/collection/test/cluster_switchover_test.go b/engine/collection/test/cluster_switchover_test.go
index 15a23823ab3..4d7c719b10c 100644
--- a/engine/collection/test/cluster_switchover_test.go
+++ b/engine/collection/test/cluster_switchover_test.go
@@ -24,6 +24,7 @@ import (
 	bcluster "github.com/onflow/flow-go/state/cluster/badger"
 	"github.com/onflow/flow-go/state/protocol"
 	"github.com/onflow/flow-go/state/protocol/inmem"
+	"github.com/onflow/flow-go/state/protocol/protocol_state"
 	"github.com/onflow/flow-go/utils/unittest"
 )
 
@@ -36,12 +37,12 @@ type ClusterSwitchoverTestCase struct {
 	t    *testing.T
 	conf ClusterSwitchoverTestConf
 
-	identities flow.IdentityList         // identity table
-	hub        *stub.Hub                 // mock network hub
-	root       protocol.Snapshot         // shared root snapshot
-	nodes      []testmock.CollectionNode // collection nodes
-	sn         *mocknetwork.Engine       // fake consensus node engine for receiving guarantees
-	builder    *unittest.EpochBuilder    // utility for building epochs
+	nodeInfos []model.NodeInfo          // identity table
+	hub       *stub.Hub                 // mock network hub
+	root      protocol.Snapshot         // shared root snapshot
+	nodes     []testmock.CollectionNode // collection nodes
+	sn        *mocknetwork.Engine       // fake consensus node engine for receiving guarantees
+	builder   *unittest.EpochBuilder    // utility for building epochs
 
 	// epoch counter -> cluster index -> transaction IDs
 	sentTransactions map[uint64]map[uint]flow.IdentifierList // track submitted transactions
@@ -55,10 +56,12 @@ func NewClusterSwitchoverTestCase(t *testing.T, conf ClusterSwitchoverTestConf)
 		t:    t,
 		conf: conf,
 	}
-
-	nodeInfos := unittest.PrivateNodeInfosFixture(int(conf.collectors), unittest.WithRole(flow.RoleCollection))
-	collectors := model.ToIdentityList(nodeInfos)
-	tc.identities = unittest.CompleteIdentitySet(collectors...)
+	tc.nodeInfos = unittest.PrivateNodeInfosFromIdentityList(
+		unittest.CompleteIdentitySet(
+			unittest.IdentityListFixture(int(conf.collectors), unittest.WithRole(flow.RoleCollection))...),
+	)
+	identities := model.ToIdentityList(tc.nodeInfos)
+	collectors := identities.Filter(filter.HasRole[flow.Identity](flow.RoleCollection)).ToSkeleton()
 	assignment := unittest.ClusterAssignment(tc.conf.clusters, collectors)
 	clusters, err := factory.NewClusterList(assignment, collectors)
 	require.NoError(t, err)
@@ -66,19 +69,18 @@ func NewClusterSwitchoverTestCase(t *testing.T, conf ClusterSwitchoverTestConf)
 	rootClusterQCs := make([]flow.ClusterQCVoteData, len(rootClusterBlocks))
 	for i, cluster := range clusters {
 		signers := make([]model.NodeInfo, 0)
-		signerIDs := make([]flow.Identifier, 0)
-		for _, identity := range nodeInfos {
+		for _, identity := range tc.nodeInfos {
 			if _, inCluster := cluster.ByNodeID(identity.NodeID); inCluster {
 				signers = append(signers, identity)
-				signerIDs = append(signerIDs, identity.NodeID)
 			}
 		}
-		qc, err := run.GenerateClusterRootQC(signers, model.ToIdentityList(signers), rootClusterBlocks[i])
+		signerIdentities := model.ToIdentityList(signers).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
+		qc, err := run.GenerateClusterRootQC(signers, signerIdentities, rootClusterBlocks[i])
 		require.NoError(t, err)
 		rootClusterQCs[i] = flow.ClusterQCVoteDataFromQC(&flow.QuorumCertificateWithSignerIDs{
 			View:      qc.View,
 			BlockID:   qc.BlockID,
-			SignerIDs: signerIDs,
+			SignerIDs: signerIdentities.NodeIDs(),
 			SigData:   qc.SigData,
 		})
 	}
@@ -87,21 +89,29 @@ func NewClusterSwitchoverTestCase(t *testing.T, conf ClusterSwitchoverTestConf)
 	tc.hub = stub.NewNetworkHub()
 
 	// create a root snapshot with the given number of initial clusters
-	root, result, seal := unittest.BootstrapFixture(tc.identities)
+	root, result, seal := unittest.BootstrapFixture(identities)
 	qc := unittest.QuorumCertificateFixture(unittest.QCWithRootBlockID(root.ID()))
 	setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
 	commit := result.ServiceEvents[1].Event.(*flow.EpochCommit)
 
-	setup.Assignments = unittest.ClusterAssignment(tc.conf.clusters, tc.identities)
+	setup.Assignments = unittest.ClusterAssignment(tc.conf.clusters, identities.ToSkeleton())
 	commit.ClusterQCs = rootClusterQCs
 
 	seal.ResultID = result.ID()
+	root.Payload.ProtocolStateID = inmem.ProtocolStateFromEpochServiceEvents(setup, commit).ID()
 	tc.root, err = inmem.SnapshotFromBootstrapState(root, result, seal, qc)
 	require.NoError(t, err)
 
+	// build a lookup table for node infos
+	nodeInfoLookup := make(map[flow.Identifier]model.NodeInfo)
+	for _, nodeInfo := range tc.nodeInfos {
+		nodeInfoLookup[nodeInfo.NodeID] = nodeInfo
+	}
+
 	// create a mock node for each collector identity
-	for _, collector := range nodeInfos {
-		node := testutil.CollectionNode(tc.T(), tc.hub, collector, tc.root)
+	for _, collector := range collectors {
+		nodeInfo := nodeInfoLookup[collector.NodeID]
+		node := testutil.CollectionNode(tc.T(), tc.hub, nodeInfo, tc.root)
 		tc.nodes = append(tc.nodes, node)
 	}
 
@@ -109,7 +119,7 @@ func NewClusterSwitchoverTestCase(t *testing.T, conf ClusterSwitchoverTestConf)
 	consensus := testutil.GenericNode(
 		tc.T(),
 		tc.hub,
-		tc.identities.Filter(filter.HasRole(flow.RoleConsensus))[0],
+		nodeInfoLookup[identities.Filter(filter.HasRole[flow.Identity](flow.RoleConsensus))[0].NodeID],
 		tc.root,
 	)
 	tc.sn = new(mocknetwork.Engine)
@@ -117,16 +127,28 @@ func NewClusterSwitchoverTestCase(t *testing.T, conf ClusterSwitchoverTestConf)
 	require.NoError(tc.T(), err)
 
 	// create an epoch builder hooked to each collector's protocol state
-	states := make([]protocol.FollowerState, 0, len(collectors))
+	states := make([]protocol.FollowerState, 0)
 	for _, node := range tc.nodes {
 		states = append(states, node.State)
 	}
+
+	// take first collection node and use its storage as data source for stateMutator
+	refNode := tc.nodes[0]
+	stateMutator := protocol_state.NewMutableProtocolState(
+		refNode.ProtocolStateSnapshots,
+		refNode.State.Params(),
+		refNode.Headers,
+		refNode.Results,
+		refNode.Setups,
+		refNode.EpochCommits,
+	)
+
 	// when building new epoch we would like to replace fixture cluster QCs with real ones, for that we need
 	// to generate them using node infos
-	tc.builder = unittest.NewEpochBuilder(tc.T(), states...).UsingCommitOpts(func(commit *flow.EpochCommit) {
+	tc.builder = unittest.NewEpochBuilder(tc.T(), stateMutator, states...).UsingCommitOpts(func(commit *flow.EpochCommit) {
 		// build a lookup table for node infos
 		nodeInfoLookup := make(map[flow.Identifier]model.NodeInfo)
-		for _, nodeInfo := range nodeInfos {
+		for _, nodeInfo := range tc.nodeInfos {
 			nodeInfoLookup[nodeInfo.NodeID] = nodeInfo
 		}
 
@@ -140,9 +162,9 @@ func NewClusterSwitchoverTestCase(t *testing.T, conf ClusterSwitchoverTestConf)
 			}
 
 			// generate root cluster block
-			rootClusterBlock := cluster.CanonicalRootBlock(commit.Counter, model.ToIdentityList(signers))
+			rootClusterBlock := cluster.CanonicalRootBlock(commit.Counter, model.ToIdentityList(signers).ToSkeleton())
 			// generate cluster root qc
-			qc, err := run.GenerateClusterRootQC(signers, model.ToIdentityList(signers), rootClusterBlock)
+			qc, err := run.GenerateClusterRootQC(signers, model.ToIdentityList(signers).ToSkeleton(), rootClusterBlock)
 			require.NoError(t, err)
 			signerIDs := toSignerIDs(signers)
 			qcWithSignerIDs := &flow.QuorumCertificateWithSignerIDs{
@@ -360,7 +382,7 @@ func (tc *ClusterSwitchoverTestCase) SubmitTransactionToCluster(
 // cluster) and asserts that only transaction specified by ExpectTransaction are
 // included.
 func (tc *ClusterSwitchoverTestCase) CheckClusterState(
-	identity *flow.Identity,
+	identity *flow.IdentitySkeleton,
 	clusterInfo protocol.Cluster,
 ) {
 	node := tc.Collector(identity.NodeID)
diff --git a/engine/common/follower/integration_test.go b/engine/common/follower/integration_test.go
index 663e195462e..cd103bc4392 100644
--- a/engine/common/follower/integration_test.go
+++ b/engine/common/follower/integration_test.go
@@ -63,7 +63,7 @@ func TestFollowerHappyPath(t *testing.T) {
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
@@ -86,9 +86,12 @@ func TestFollowerHappyPath(t *testing.T) {
 		require.NoError(t, err)
 		rootQC, err := rootSnapshot.QuorumCertificate()
 		require.NoError(t, err)
+		rootProtocolState, err := rootSnapshot.ProtocolState()
+		require.NoError(t, err)
+		rootProtocolStateID := rootProtocolState.Entry().ID()
 
-		// Hack EECC.
-		// Since root snapshot is created with 1000 views for first epoch, we will forcefully enter EECC to avoid errors
+		// Hack EFM.
+		// Since root snapshot is created with 1000 views for first epoch, we will forcefully enter EFM to avoid errors
 		// related to epoch transitions.
 		db.NewTransaction(true)
 		err = db.Update(func(txn *badger.Txn) error {
@@ -163,6 +166,7 @@ func TestFollowerHappyPath(t *testing.T) {
 		// ensure sequential block views - that way we can easily know which block will be finalized after the test
 		for i, block := range flowBlocks {
 			block.Header.View = block.Header.Height
+			block.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			if i > 0 {
 				block.Header.ParentView = flowBlocks[i-1].Header.View
 				block.Header.ParentID = flowBlocks[i-1].Header.ID()
diff --git a/engine/common/grpc/forwarder/forwarder.go b/engine/common/grpc/forwarder/forwarder.go
index 65b1c734ac1..a0af264b55a 100644
--- a/engine/common/grpc/forwarder/forwarder.go
+++ b/engine/common/grpc/forwarder/forwarder.go
@@ -16,7 +16,7 @@ import (
 
 // Upstream is a container for an individual upstream containing the id, client and closer for it
 type Upstream struct {
-	id     *flow.Identity         // the public identity of one network participant (node)
+	id     *flow.IdentitySkeleton // the public identity of one network participant (node)
 	client access.AccessAPIClient // client with gRPC connection
 	closer io.Closer              // closer for client connection, should use to close the connection when done
 }
@@ -29,7 +29,7 @@ type Forwarder struct {
 	connFactory connection.ConnectionFactory
 }
 
-func NewForwarder(identities flow.IdentityList, connectionFactory connection.ConnectionFactory) (*Forwarder, error) {
+func NewForwarder(identities flow.IdentitySkeletonList, connectionFactory connection.ConnectionFactory) (*Forwarder, error) {
 	forwarder := &Forwarder{connFactory: connectionFactory}
 	err := forwarder.setFlowAccessAPI(identities)
 	return forwarder, err
@@ -39,7 +39,7 @@ func NewForwarder(identities flow.IdentityList, connectionFactory connection.Con
 // It is used by Observer services, Blockchain Data Service, etc.
 // Make sure that this is just for observation and not a staked participant in the flow network.
 // This means that observers see a copy of the data but there is no interaction to ensure integrity from the root block.
-func (f *Forwarder) setFlowAccessAPI(accessNodeAddressAndPort flow.IdentityList) error {
+func (f *Forwarder) setFlowAccessAPI(accessNodeAddressAndPort flow.IdentitySkeletonList) error {
 	f.upstream = make([]Upstream, accessNodeAddressAndPort.Count())
 	for i, identity := range accessNodeAddressAndPort {
 		// Store the faultTolerantClient setup parameters such as address, public, key and timeout, so that
diff --git a/engine/common/provider/engine.go b/engine/common/provider/engine.go
index 3b492bd8788..12593b614ef 100644
--- a/engine/common/provider/engine.go
+++ b/engine/common/provider/engine.go
@@ -52,7 +52,7 @@ type Engine struct {
 	channel        channels.Channel
 	requestHandler *engine.MessageHandler
 	requestQueue   engine.MessageStore
-	selector       flow.IdentityFilter
+	selector       flow.IdentityFilter[flow.Identity]
 	retrieve       RetrieveFunc
 	// buffered channel for EntityRequest workers to pick and process.
 	requestChannel chan *internal.EntityRequest
@@ -72,13 +72,13 @@ func New(
 	requestQueue engine.MessageStore,
 	requestWorkers uint,
 	channel channels.Channel,
-	selector flow.IdentityFilter,
+	selector flow.IdentityFilter[flow.Identity],
 	retrieve RetrieveFunc) (*Engine, error) {
 
 	// make sure we don't respond to request sent by self or unauthorized nodes
 	selector = filter.And(
 		selector,
-		filter.Not(filter.HasNodeID(me.NodeID())),
+		filter.Not(filter.HasNodeID[flow.Identity](me.NodeID())),
 	)
 
 	handler := engine.NewMessageHandler(
@@ -198,7 +198,7 @@ func (e *Engine) onEntityRequest(request *internal.EntityRequest) error {
 	// for the handler to make sure the requester is authorized for this resource
 	requesters, err := e.state.Final().Identities(filter.And(
 		e.selector,
-		filter.HasNodeID(request.OriginId)),
+		filter.HasNodeID[flow.Identity](request.OriginId)),
 	)
 	if err != nil {
 		return fmt.Errorf("could not get requesters: %w", err)
diff --git a/engine/common/provider/engine_test.go b/engine/common/provider/engine_test.go
index 8af1c41a18f..58f57c82ef8 100644
--- a/engine/common/provider/engine_test.go
+++ b/engine/common/provider/engine_test.go
@@ -34,7 +34,7 @@ func TestOnEntityRequestFull(t *testing.T) {
 	entities := make(map[flow.Identifier]flow.Entity)
 
 	identities := unittest.IdentityListFixture(8)
-	selector := filter.HasNodeID(identities.NodeIDs()...)
+	selector := filter.HasNodeID[flow.Identity](identities.NodeIDs()...)
 	originID := identities[0].NodeID
 
 	coll1 := unittest.CollectionFixture(1)
@@ -59,7 +59,7 @@ func TestOnEntityRequestFull(t *testing.T) {
 
 	final := protocol.NewSnapshot(t)
 	final.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return identities.Filter(selector)
 		},
 		nil,
@@ -128,7 +128,7 @@ func TestOnEntityRequestPartial(t *testing.T) {
 	entities := make(map[flow.Identifier]flow.Entity)
 
 	identities := unittest.IdentityListFixture(8)
-	selector := filter.HasNodeID(identities.NodeIDs()...)
+	selector := filter.HasNodeID[flow.Identity](identities.NodeIDs()...)
 	originID := identities[0].NodeID
 
 	coll1 := unittest.CollectionFixture(1)
@@ -153,7 +153,7 @@ func TestOnEntityRequestPartial(t *testing.T) {
 
 	final := protocol.NewSnapshot(t)
 	final.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return identities.Filter(selector)
 		},
 		nil,
@@ -220,7 +220,7 @@ func TestOnEntityRequestDuplicates(t *testing.T) {
 	entities := make(map[flow.Identifier]flow.Entity)
 
 	identities := unittest.IdentityListFixture(8)
-	selector := filter.HasNodeID(identities.NodeIDs()...)
+	selector := filter.HasNodeID[flow.Identity](identities.NodeIDs()...)
 	originID := identities[0].NodeID
 
 	coll1 := unittest.CollectionFixture(1)
@@ -241,7 +241,7 @@ func TestOnEntityRequestDuplicates(t *testing.T) {
 
 	final := protocol.NewSnapshot(t)
 	final.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return identities.Filter(selector)
 		},
 		nil,
@@ -307,7 +307,7 @@ func TestOnEntityRequestEmpty(t *testing.T) {
 
 	entities := make(map[flow.Identifier]flow.Entity)
 	identities := unittest.IdentityListFixture(8)
-	selector := filter.HasNodeID(identities.NodeIDs()...)
+	selector := filter.HasNodeID[flow.Identity](identities.NodeIDs()...)
 	originID := identities[0].NodeID
 
 	coll1 := unittest.CollectionFixture(1)
@@ -326,7 +326,7 @@ func TestOnEntityRequestEmpty(t *testing.T) {
 
 	final := protocol.NewSnapshot(t)
 	final.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return identities.Filter(selector)
 		},
 		nil,
@@ -385,7 +385,7 @@ func TestOnEntityRequestInvalidOrigin(t *testing.T) {
 
 	entities := make(map[flow.Identifier]flow.Entity)
 	identities := unittest.IdentityListFixture(8)
-	selector := filter.HasNodeID(identities.NodeIDs()...)
+	selector := filter.HasNodeID[flow.Identity](identities.NodeIDs()...)
 	originID := unittest.IdentifierFixture()
 
 	coll1 := unittest.CollectionFixture(1)
@@ -410,7 +410,7 @@ func TestOnEntityRequestInvalidOrigin(t *testing.T) {
 
 	final := protocol.NewSnapshot(t)
 	final.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			defer cancel()
 			return identities.Filter(selector)
 		},
diff --git a/engine/common/requester/engine.go b/engine/common/requester/engine.go
index 48d8e2bad24..62c4b57d751 100644
--- a/engine/common/requester/engine.go
+++ b/engine/common/requester/engine.go
@@ -43,7 +43,7 @@ type Engine struct {
 	state    protocol.State
 	con      network.Conduit
 	channel  channels.Channel
-	selector flow.IdentityFilter
+	selector flow.IdentityFilter[flow.Identity]
 	create   CreateFunc
 	handle   HandleFunc
 
@@ -57,7 +57,7 @@ type Engine struct {
 // within the set obtained by applying the provided selector filter. The options allow customization of the parameters
 // related to the batch and retry logic.
 func New(log zerolog.Logger, metrics module.EngineMetrics, net network.EngineRegistry, me module.Local, state protocol.State,
-	channel channels.Channel, selector flow.IdentityFilter, create CreateFunc, options ...OptionFunc) (*Engine, error) {
+	channel channels.Channel, selector flow.IdentityFilter[flow.Identity], create CreateFunc, options ...OptionFunc) (*Engine, error) {
 
 	// initialize the default config
 	cfg := Config{
@@ -89,15 +89,16 @@ func New(log zerolog.Logger, metrics module.EngineMetrics, net network.EngineReg
 	// make sure we don't send requests from self
 	selector = filter.And(
 		selector,
-		filter.Not(filter.HasNodeID(me.NodeID())),
-		filter.Not(filter.Ejected),
+		filter.Not(filter.HasNodeID[flow.Identity](me.NodeID())),
+		filter.Not(filter.HasParticipationStatus(flow.EpochParticipationStatusEjected)),
 	)
 
-	// make sure we don't send requests to unauthorized nodes
+	// make sure we only send requests to nodes that are active in the current epoch and have positive weight
 	if cfg.ValidateStaking {
 		selector = filter.And(
 			selector,
-			filter.HasWeight(true),
+			filter.HasInitialWeight[flow.Identity](true),
+			filter.HasParticipationStatus(flow.EpochParticipationStatusActive),
 		)
 	}
 
@@ -201,7 +202,7 @@ func (e *Engine) Process(channel channels.Channel, originID flow.Identifier, mes
 // control over which subset of providers to request a given entity from, such as
 // selection of a collection cluster. Use `filter.Any` if no additional selection
 // is required. Checks integrity of response to make sure that we got entity that we were requesting.
-func (e *Engine) EntityByID(entityID flow.Identifier, selector flow.IdentityFilter) {
+func (e *Engine) EntityByID(entityID flow.Identifier, selector flow.IdentityFilter[flow.Identity]) {
 	e.addEntityRequest(entityID, selector, true)
 }
 
@@ -210,11 +211,11 @@ func (e *Engine) EntityByID(entityID flow.Identifier, selector flow.IdentityFilt
 // of valid providers for the data and allows finer-grained control
 // over which providers to request data from. Doesn't perform integrity check
 // can be used to get entities without knowing their ID.
-func (e *Engine) Query(key flow.Identifier, selector flow.IdentityFilter) {
+func (e *Engine) Query(key flow.Identifier, selector flow.IdentityFilter[flow.Identity]) {
 	e.addEntityRequest(key, selector, false)
 }
 
-func (e *Engine) addEntityRequest(entityID flow.Identifier, selector flow.IdentityFilter, checkIntegrity bool) {
+func (e *Engine) addEntityRequest(entityID flow.Identifier, selector flow.IdentityFilter[flow.Identity], checkIntegrity bool) {
 	e.unit.Lock()
 	defer e.unit.Unlock()
 
@@ -349,7 +350,7 @@ func (e *Engine) dispatchRequest() (bool, error) {
 		// for now, so it will be part of the next batch request
 		if providerID != flow.ZeroID {
 			overlap := providers.Filter(filter.And(
-				filter.HasNodeID(providerID),
+				filter.HasNodeID[flow.Identity](providerID),
 				item.ExtraSelector,
 			))
 			if len(overlap) == 0 {
@@ -486,7 +487,7 @@ func (e *Engine) onEntityResponse(originID flow.Identifier, res *messages.Entity
 		// check that the response comes from a valid provider
 		providers, err := e.state.Final().Identities(filter.And(
 			e.selector,
-			filter.HasNodeID(originID),
+			filter.HasNodeID[flow.Identity](originID),
 		))
 		if err != nil {
 			return fmt.Errorf("could not get providers: %w", err)
diff --git a/engine/common/requester/engine_test.go b/engine/common/requester/engine_test.go
index 553386c85d6..31e3accf448 100644
--- a/engine/common/requester/engine_test.go
+++ b/engine/common/requester/engine_test.go
@@ -54,7 +54,7 @@ func TestDispatchRequestVarious(t *testing.T) {
 
 	final := &protocol.Snapshot{}
 	final.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return identities.Filter(selector)
 		},
 		nil,
@@ -134,7 +134,7 @@ func TestDispatchRequestVarious(t *testing.T) {
 		con:      con,
 		items:    items,
 		requests: make(map[uint64]*messages.EntityRequest),
-		selector: filter.HasNodeID(targetID),
+		selector: filter.HasNodeID[flow.Identity](targetID),
 	}
 	dispatched, err := request.dispatchRequest()
 	require.NoError(t, err)
@@ -163,7 +163,7 @@ func TestDispatchRequestBatchSize(t *testing.T) {
 
 	final := &protocol.Snapshot{}
 	final.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return identities.Filter(selector)
 		},
 		nil,
@@ -226,7 +226,7 @@ func TestOnEntityResponseValid(t *testing.T) {
 
 	final := &protocol.Snapshot{}
 	final.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return identities.Filter(selector)
 		},
 		nil,
@@ -283,7 +283,7 @@ func TestOnEntityResponseValid(t *testing.T) {
 		state:    state,
 		items:    make(map[flow.Identifier]*Item),
 		requests: make(map[uint64]*messages.EntityRequest),
-		selector: filter.HasNodeID(targetID),
+		selector: filter.HasNodeID[flow.Identity](targetID),
 		create:   func() flow.Entity { return &flow.Collection{} },
 		handle: func(flow.Identifier, flow.Entity) {
 			if called.Inc() >= 2 {
@@ -324,7 +324,7 @@ func TestOnEntityIntegrityCheck(t *testing.T) {
 
 	final := &protocol.Snapshot{}
 	final.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return identities.Filter(selector)
 		},
 		nil,
@@ -370,7 +370,7 @@ func TestOnEntityIntegrityCheck(t *testing.T) {
 		state:    state,
 		items:    make(map[flow.Identifier]*Item),
 		requests: make(map[uint64]*messages.EntityRequest),
-		selector: filter.HasNodeID(targetID),
+		selector: filter.HasNodeID[flow.Identity](targetID),
 		create:   func() flow.Entity { return &flow.Collection{} },
 		handle:   func(flow.Identifier, flow.Entity) { close(called) },
 	}
@@ -408,7 +408,7 @@ func TestOriginValidation(t *testing.T) {
 
 	final := &protocol.Snapshot{}
 	final.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return identities.Filter(selector)
 		},
 		nil,
@@ -430,7 +430,7 @@ func TestOriginValidation(t *testing.T) {
 	iwanted := &Item{
 		EntityID:       wanted.ID(),
 		LastRequested:  now,
-		ExtraSelector:  filter.HasNodeID(targetID),
+		ExtraSelector:  filter.HasNodeID[flow.Identity](targetID),
 		checkIntegrity: true,
 	}
 
@@ -458,7 +458,7 @@ func TestOriginValidation(t *testing.T) {
 		me,
 		state,
 		"",
-		filter.HasNodeID(targetID),
+		filter.HasNodeID[flow.Identity](targetID),
 		func() flow.Entity { return &flow.Collection{} },
 	)
 	assert.NoError(t, err)
diff --git a/engine/common/requester/item.go b/engine/common/requester/item.go
index 456a33e881f..06cdf2acb01 100644
--- a/engine/common/requester/item.go
+++ b/engine/common/requester/item.go
@@ -7,10 +7,10 @@ import (
 )
 
 type Item struct {
-	EntityID       flow.Identifier     // ID for the entity to be requested
-	NumAttempts    uint                // number of times the entity was requested
-	LastRequested  time.Time           // approximate timestamp of last request
-	RetryAfter     time.Duration       // interval until request should be retried
-	ExtraSelector  flow.IdentityFilter // additional filters for providers of this entity
-	checkIntegrity bool                // check response integrity using `EntityID`
+	EntityID       flow.Identifier                    // ID for the entity to be requested
+	NumAttempts    uint                               // number of times the entity was requested
+	LastRequested  time.Time                          // approximate timestamp of last request
+	RetryAfter     time.Duration                      // interval until request should be retried
+	ExtraSelector  flow.IdentityFilter[flow.Identity] // additional filters for providers of this entity
+	checkIntegrity bool                               // check response integrity using `EntityID`
 }
diff --git a/engine/common/rpc/convert/blocks.go b/engine/common/rpc/convert/blocks.go
index 2e7f5689515..6e3588090ea 100644
--- a/engine/common/rpc/convert/blocks.go
+++ b/engine/common/rpc/convert/blocks.go
@@ -35,15 +35,16 @@ func BlockToMessage(h *flow.Block, signerIDs flow.IdentifierList) (
 	}
 
 	bh := entities.Block{
-		Id:                       id[:],
+		Id:                       IdentifierToMessage(id),
 		Height:                   h.Header.Height,
-		ParentId:                 parentID[:],
+		ParentId:                 IdentifierToMessage(parentID),
 		Timestamp:                t,
 		CollectionGuarantees:     cg,
 		BlockSeals:               seals,
 		Signatures:               [][]byte{h.Header.ParentVoterSigData},
 		ExecutionReceiptMetaList: ExecutionResultMetaListToMessages(h.Payload.Receipts),
 		ExecutionResultList:      execResults,
+		ProtocolStateId:          IdentifierToMessage(h.Payload.ProtocolStateID),
 		BlockHeader:              blockHeader,
 	}
 
@@ -147,9 +148,23 @@ func PayloadFromMessage(m *entities.Block) (*flow.Payload, error) {
 		return nil, err
 	}
 	return &flow.Payload{
-		Guarantees: cgs,
-		Seals:      seals,
-		Receipts:   receipts,
-		Results:    results,
+		Guarantees:      cgs,
+		Seals:           seals,
+		Receipts:        receipts,
+		Results:         results,
+		ProtocolStateID: MessageToIdentifier(m.ProtocolStateId),
 	}, nil
 }
+
+// MessageToBlockStatus converts a protobuf BlockStatus message to a flow.BlockStatus.
+func MessageToBlockStatus(status entities.BlockStatus) flow.BlockStatus {
+	switch status {
+	case entities.BlockStatus_BLOCK_UNKNOWN:
+		return flow.BlockStatusUnknown
+	case entities.BlockStatus_BLOCK_FINALIZED:
+		return flow.BlockStatusFinalized
+	case entities.BlockStatus_BLOCK_SEALED:
+		return flow.BlockStatusSealed
+	}
+	return flow.BlockStatusUnknown
+}
diff --git a/engine/common/rpc/convert/events.go b/engine/common/rpc/convert/events.go
index 62ec20fd58d..08b24077844 100644
--- a/engine/common/rpc/convert/events.go
+++ b/engine/common/rpc/convert/events.go
@@ -241,6 +241,20 @@ func CcfEventToJsonEvent(e flow.Event) (*flow.Event, error) {
 	}, nil
 }
 
+// CcfEventsToJsonEvents returns a new event with the payload converted from CCF to JSON
+func CcfEventsToJsonEvents(events []flow.Event) ([]flow.Event, error) {
+	convertedEvents := make([]flow.Event, len(events))
+	for i, e := range events {
+		payload, err := CcfPayloadToJsonPayload(e.Payload)
+		if err != nil {
+			return nil, fmt.Errorf("failed to convert event payload for event %d: %w", i, err)
+		}
+		e.Payload = payload
+		convertedEvents[i] = e
+	}
+	return convertedEvents, nil
+}
+
 // MessagesToBlockEvents converts a protobuf EventsResponse_Result messages to a slice of flow.BlockEvents.
 func MessagesToBlockEvents(blocksEvents []*accessproto.EventsResponse_Result) []flow.BlockEvents {
 	evs := make([]flow.BlockEvents, len(blocksEvents))
diff --git a/engine/common/rpc/convert/transactions.go b/engine/common/rpc/convert/transactions.go
index 221f41b0936..6b92f419fdd 100644
--- a/engine/common/rpc/convert/transactions.go
+++ b/engine/common/rpc/convert/transactions.go
@@ -1,11 +1,29 @@
 package convert
 
 import (
+	"github.com/onflow/flow/protobuf/go/flow/access"
 	"github.com/onflow/flow/protobuf/go/flow/entities"
 
 	"github.com/onflow/flow-go/model/flow"
 )
 
+// TransactionSubscribeInfo represents information about a subscribed transaction.
+// It contains the ID of the transaction, its status, and the index of the associated message.
+type TransactionSubscribeInfo struct {
+	ID           flow.Identifier
+	Status       flow.TransactionStatus
+	MessageIndex uint64
+}
+
+// TransactionSubscribeInfoToMessage converts a TransactionSubscribeInfo struct to a protobuf message
+func TransactionSubscribeInfoToMessage(data *TransactionSubscribeInfo) *access.SendAndSubscribeTransactionStatusesResponse {
+	return &access.SendAndSubscribeTransactionStatusesResponse{
+		Id:           data.ID[:],
+		Status:       entities.TransactionStatus(data.Status),
+		MessageIndex: data.MessageIndex,
+	}
+}
+
 // TransactionToMessage converts a flow.TransactionBody to a protobuf message
 func TransactionToMessage(tb flow.TransactionBody) *entities.Transaction {
 	proposalKeyMessage := &entities.Transaction_ProposalKey{
diff --git a/engine/common/rpc/errors.go b/engine/common/rpc/errors.go
index 96201b04a78..dfade3852fd 100644
--- a/engine/common/rpc/errors.go
+++ b/engine/common/rpc/errors.go
@@ -8,6 +8,7 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
+	"github.com/onflow/flow-go/module/state_synchronization/indexer"
 	"github.com/onflow/flow-go/storage"
 )
 
@@ -66,6 +67,29 @@ func ConvertStorageError(err error) error {
 	return status.Errorf(codes.Internal, "failed to find: %v", err)
 }
 
+// ConvertIndexError converts errors related to index and storage to appropriate gRPC status errors.
+// If the error is nil, it returns nil. If the error is not recognized, it falls back to ConvertError
+// with the provided default message and Internal gRPC code.
+func ConvertIndexError(err error, height uint64, defaultMsg string) error {
+	if err == nil {
+		return nil
+	}
+
+	if errors.Is(err, indexer.ErrIndexNotInitialized) {
+		return status.Errorf(codes.FailedPrecondition, "data for block is not available: %v", err)
+	}
+
+	if errors.Is(err, storage.ErrHeightNotIndexed) {
+		return status.Errorf(codes.OutOfRange, "data for block height %d is not available", height)
+	}
+
+	if errors.Is(err, storage.ErrNotFound) {
+		return status.Errorf(codes.NotFound, "data not found: %v", err)
+	}
+
+	return ConvertError(err, defaultMsg, codes.Internal)
+}
+
 // ConvertMultiError converts a multierror to a grpc status error.
 // If the errors have related status codes, the common code is returned, otherwise defaultCode is used.
 func ConvertMultiError(err *multierror.Error, msg string, defaultCode codes.Code) error {
diff --git a/engine/common/synchronization/engine.go b/engine/common/synchronization/engine.go
index 9d16924908c..aeae8eb7a8d 100644
--- a/engine/common/synchronization/engine.go
+++ b/engine/common/synchronization/engine.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package synchronization
 
 import (
diff --git a/engine/common/synchronization/engine_suite_test.go b/engine/common/synchronization/engine_suite_test.go
index ddd9497268e..c89a2349102 100644
--- a/engine/common/synchronization/engine_suite_test.go
+++ b/engine/common/synchronization/engine_suite_test.go
@@ -113,7 +113,7 @@ func (ss *SyncSuite) SetupTest() {
 		nil,
 	)
 	ss.snapshot.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return ss.participants.Filter(selector)
 		},
 		nil,
@@ -164,8 +164,8 @@ func (ss *SyncSuite) SetupTest() {
 	e, err := New(log, metrics, ss.net, ss.me, ss.state, ss.blocks, ss.comp, ss.core,
 		id.NewIdentityFilterIdentifierProvider(
 			filter.And(
-				filter.HasRole(flow.RoleConsensus),
-				filter.Not(filter.HasNodeID(ss.me.NodeID())),
+				filter.HasRole[flow.Identity](flow.RoleConsensus),
+				filter.Not(filter.HasNodeID[flow.Identity](ss.me.NodeID())),
 			),
 			idCache,
 		),
diff --git a/engine/common/synchronization/engine_test.go b/engine/common/synchronization/engine_test.go
index 25b45f11e04..8dd8303f4b9 100644
--- a/engine/common/synchronization/engine_test.go
+++ b/engine/common/synchronization/engine_test.go
@@ -367,7 +367,7 @@ func (ss *SyncSuite) TestOnBlockResponse() {
 func (ss *SyncSuite) TestPollHeight() {
 
 	// check that we send to three nodes from our total list
-	others := ss.participants.Filter(filter.HasNodeID(ss.participants[1:].NodeIDs()...))
+	others := ss.participants.Filter(filter.HasNodeID[flow.Identity](ss.participants[1:].NodeIDs()...))
 	ss.con.On("Multicast", mock.Anything, synccore.DefaultPollNodes, others[0].NodeID, others[1].NodeID).Return(nil).Run(
 		func(args mock.Arguments) {
 			req := args.Get(0).(*messages.SyncRequest)
diff --git a/engine/common/worker/worker_builder.go b/engine/common/worker/worker_builder.go
index cc1c3e7b438..ede7804b665 100644
--- a/engine/common/worker/worker_builder.go
+++ b/engine/common/worker/worker_builder.go
@@ -10,6 +10,11 @@ import (
 	"github.com/onflow/flow-go/module/irrecoverable"
 )
 
+const (
+	QueuedItemProcessingLog = "processing queued work item"
+	QueuedItemProcessedLog  = "finished processing queued work item"
+)
+
 // Pool is a worker pool that can be used by a higher-level component to manage a set of workers.
 // The workers are managed by the higher-level component, but the worker pool provides the logic for
 // submitting work to the workers and for processing the work. The worker pool is responsible for
@@ -126,9 +131,9 @@ func (b *PoolBuilder[T]) workerLogic() component.ComponentWorker {
 						b.logger.Trace().Msg("store is empty, waiting for next notification")
 						break // store is empty; go back to outer for loop
 					}
-					b.logger.Trace().Msg("processing queued work item")
+					b.logger.Trace().Msg(QueuedItemProcessingLog)
 					err := processingFunc(msg.Payload.(T))
-					b.logger.Trace().Msg("finished processing queued work item")
+					b.logger.Trace().Msg(QueuedItemProcessedLog)
 					if err != nil {
 						ctx.Throw(fmt.Errorf("unexpected error processing queued work item: %w", err))
 						return
diff --git a/engine/consensus/approvals/verifying_assignment_collector.go b/engine/consensus/approvals/verifying_assignment_collector.go
index a78131783f5..d32324c8bb8 100644
--- a/engine/consensus/approvals/verifying_assignment_collector.go
+++ b/engine/consensus/approvals/verifying_assignment_collector.go
@@ -396,9 +396,9 @@ func (ac *VerifyingAssignmentCollector) RequestMissingApprovals(observation cons
 func authorizedVerifiersAtBlock(state protocol.State, blockID flow.Identifier) (map[flow.Identifier]*flow.Identity, error) {
 	authorizedVerifierList, err := state.AtBlockID(blockID).Identities(
 		filter.And(
-			filter.HasRole(flow.RoleVerification),
-			filter.HasWeight(true),
-			filter.Not(filter.Ejected),
+			filter.HasRole[flow.Identity](flow.RoleVerification),
+			filter.HasInitialWeight[flow.Identity](true),
+			filter.IsValidCurrentEpochParticipant,
 		))
 	if err != nil {
 		return nil, fmt.Errorf("failed to retrieve Identities for block %v: %w", blockID, err)
diff --git a/engine/consensus/approvals/verifying_assignment_collector_test.go b/engine/consensus/approvals/verifying_assignment_collector_test.go
index 7784c1381f1..e73bdf651d3 100644
--- a/engine/consensus/approvals/verifying_assignment_collector_test.go
+++ b/engine/consensus/approvals/verifying_assignment_collector_test.go
@@ -229,12 +229,10 @@ func (s *AssignmentCollectorTestSuite) TestProcessIncorporatedResult() {
 // TestProcessIncorporatedResult_InvalidIdentity tests a few scenarios where verifier identity is not correct
 // by one or another reason
 func (s *AssignmentCollectorTestSuite) TestProcessIncorporatedResult_InvalidIdentity() {
-
-	s.Run("verifier zero-weight", func() {
-		identity := unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification))
-		identity.Weight = 0 // zero weight
-
-		state := &protocol.State{}
+	// mocks state to return invalid identity and creates assignment collector that will use it
+	// creating assignment collector with invalid identity should result in error
+	assertInvalidIdentity := func(identity *flow.Identity) {
+		state := protocol.NewState(s.T())
 		state.On("AtBlockID", mock.Anything).Return(
 			func(blockID flow.Identifier) realproto.Snapshot {
 				return unittest.StateSnapshotForKnownBlock(
@@ -248,45 +246,41 @@ func (s *AssignmentCollectorTestSuite) TestProcessIncorporatedResult_InvalidIden
 			s.SigHasher, s.Conduit, s.RequestTracker, 1)
 		require.Error(s.T(), err)
 		require.Nil(s.T(), collector)
-	})
+	}
 
+	s.Run("verifier-zero-weight", func() {
+		identity := unittest.IdentityFixture(
+			unittest.WithRole(flow.RoleVerification),
+			unittest.WithParticipationStatus(flow.EpochParticipationStatusActive),
+			unittest.WithInitialWeight(0),
+		)
+		assertInvalidIdentity(identity)
+	})
+	s.Run("verifier-leaving", func() {
+		identity := unittest.IdentityFixture(
+			unittest.WithRole(flow.RoleVerification),
+			unittest.WithParticipationStatus(flow.EpochParticipationStatusLeaving),
+		)
+		assertInvalidIdentity(identity)
+	})
+	s.Run("verifier-joining", func() {
+		identity := unittest.IdentityFixture(
+			unittest.WithRole(flow.RoleVerification),
+			unittest.WithParticipationStatus(flow.EpochParticipationStatusJoining),
+		)
+		assertInvalidIdentity(identity)
+	})
 	s.Run("verifier-ejected", func() {
-		identity := unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification))
-		identity.Ejected = true // node ejected
-
-		state := &protocol.State{}
-		state.On("AtBlockID", mock.Anything).Return(
-			func(blockID flow.Identifier) realproto.Snapshot {
-				return unittest.StateSnapshotForKnownBlock(
-					s.Block,
-					map[flow.Identifier]*flow.Identity{identity.NodeID: identity},
-				)
-			},
+		identity := unittest.IdentityFixture(
+			unittest.WithRole(flow.RoleVerification),
+			unittest.WithParticipationStatus(flow.EpochParticipationStatusEjected),
 		)
-
-		collector, err := newVerifyingAssignmentCollector(unittest.Logger(), s.WorkerPool, s.IncorporatedResult.Result, state, s.Headers, s.Assigner, s.SealsPL,
-			s.SigHasher, s.Conduit, s.RequestTracker, 1)
-		require.Nil(s.T(), collector)
-		require.Error(s.T(), err)
+		assertInvalidIdentity(identity)
 	})
 	s.Run("verifier-invalid-role", func() {
 		// invalid role
 		identity := unittest.IdentityFixture(unittest.WithRole(flow.RoleAccess))
-
-		state := &protocol.State{}
-		state.On("AtBlockID", mock.Anything).Return(
-			func(blockID flow.Identifier) realproto.Snapshot {
-				return unittest.StateSnapshotForKnownBlock(
-					s.Block,
-					map[flow.Identifier]*flow.Identity{identity.NodeID: identity},
-				)
-			},
-		)
-
-		collector, err := newVerifyingAssignmentCollector(unittest.Logger(), s.WorkerPool, s.IncorporatedResult.Result, state, s.Headers, s.Assigner, s.SealsPL,
-			s.SigHasher, s.Conduit, s.RequestTracker, 1)
-		require.Nil(s.T(), collector)
-		require.Error(s.T(), err)
+		assertInvalidIdentity(identity)
 	})
 }
 
diff --git a/engine/consensus/compliance/core.go b/engine/consensus/compliance/core.go
index 0a0e8f1400b..8ed733c8fe9 100644
--- a/engine/consensus/compliance/core.go
+++ b/engine/consensus/compliance/core.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package compliance
 
 import (
diff --git a/engine/consensus/compliance/core_test.go b/engine/consensus/compliance/core_test.go
index 36dddda317d..494d1d0e91d 100644
--- a/engine/consensus/compliance/core_test.go
+++ b/engine/consensus/compliance/core_test.go
@@ -82,7 +82,7 @@ func (cs *CommonSuite) SetupTest() {
 	// initialize the paramaters
 	cs.participants = unittest.IdentityListFixture(3,
 		unittest.WithRole(flow.RoleConsensus),
-		unittest.WithWeight(1000),
+		unittest.WithInitialWeight(1000),
 	)
 	cs.myID = cs.participants[0].NodeID
 	block := unittest.BlockFixture()
@@ -172,7 +172,7 @@ func (cs *CommonSuite) SetupTest() {
 	// set up protocol snapshot mock
 	cs.snapshot = &protocol.Snapshot{}
 	cs.snapshot.On("Identities", mock.Anything).Return(
-		func(filter flow.IdentityFilter) flow.IdentityList {
+		func(filter flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return cs.participants.Filter(filter)
 		},
 		nil,
diff --git a/engine/consensus/dkg/reactor_engine.go b/engine/consensus/dkg/reactor_engine.go
index 23cbc45dd74..2328ea6bced 100644
--- a/engine/consensus/dkg/reactor_engine.go
+++ b/engine/consensus/dkg/reactor_engine.go
@@ -24,7 +24,7 @@ const DefaultPollStep = 10
 
 // dkgInfo consolidates information about the current DKG protocol instance.
 type dkgInfo struct {
-	identities      flow.IdentityList
+	identities      flow.IdentitySkeletonList
 	phase1FinalView uint64
 	phase2FinalView uint64
 	phase3FinalView uint64
@@ -181,7 +181,7 @@ func (e *ReactorEngine) startDKGForEpoch(currentEpochCounter uint64, first *flow
 		log.Fatal().Err(err).Msg("could not retrieve epoch info")
 	}
 
-	committee := curDKGInfo.identities.Filter(filter.IsVotingConsensusCommitteeMember)
+	committee := curDKGInfo.identities.Filter(filter.IsConsensusCommitteeMember)
 
 	log.Info().
 		Uint64("phase1", curDKGInfo.phase1FinalView).
diff --git a/engine/consensus/dkg/reactor_engine_test.go b/engine/consensus/dkg/reactor_engine_test.go
index a0f67f57f88..b484fe503ee 100644
--- a/engine/consensus/dkg/reactor_engine_test.go
+++ b/engine/consensus/dkg/reactor_engine_test.go
@@ -124,7 +124,7 @@ func (suite *ReactorEngineSuite_SetupPhase) SetupTest() {
 	suite.currentEpoch.On("DKGPhase3FinalView").Return(suite.dkgPhase3FinalView, nil)
 	suite.nextEpoch = new(protocol.Epoch)
 	suite.nextEpoch.On("Counter").Return(suite.NextEpochCounter(), nil)
-	suite.nextEpoch.On("InitialIdentities").Return(suite.committee, nil)
+	suite.nextEpoch.On("InitialIdentities").Return(suite.committee.ToSkeleton(), nil)
 
 	suite.epochQuery = mocks.NewEpochQuery(suite.T(), suite.epochCounter)
 	suite.epochQuery.Add(suite.currentEpoch)
@@ -163,7 +163,7 @@ func (suite *ReactorEngineSuite_SetupPhase) SetupTest() {
 	suite.factory = new(module.DKGControllerFactory)
 	suite.factory.On("Create",
 		dkgmodule.CanonicalInstanceID(suite.firstBlock.ChainID, suite.NextEpochCounter()),
-		suite.committee,
+		suite.committee.ToSkeleton(),
 		mock.Anything,
 	).Return(suite.controller, nil)
 
diff --git a/engine/consensus/ingestion/core.go b/engine/consensus/ingestion/core.go
index abe7e1ca420..99a2c076205 100644
--- a/engine/consensus/ingestion/core.go
+++ b/engine/consensus/ingestion/core.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package ingestion
 
 import (
@@ -173,7 +171,7 @@ func (e *Core) validateGuarantors(guarantee *flow.CollectionGuarantee) error {
 	}
 
 	// ensure the guarantors are from the same cluster
-	clusterMembers := cluster.Members()
+	clusterMembers := cluster.Members().ToSkeleton()
 
 	// find guarantors by signer indices
 	guarantors, err := signature.DecodeSignerIndicesToIdentities(clusterMembers, guarantee.SignerIndices)
@@ -187,7 +185,7 @@ func (e *Core) validateGuarantors(guarantee *flow.CollectionGuarantee) error {
 
 	// determine whether signers reach minimally required stake threshold
 	threshold := committees.WeightThresholdToBuildQC(clusterMembers.TotalWeight()) // compute required stake threshold
-	totalStake := flow.IdentityList(guarantors).TotalWeight()
+	totalStake := guarantors.TotalWeight()
 	if totalStake < threshold {
 		return engine.NewInvalidInputErrorf("collection guarantee qc signers have insufficient stake of %d (required=%d)", totalStake, threshold)
 	}
diff --git a/engine/consensus/ingestion/core_test.go b/engine/consensus/ingestion/core_test.go
index 6167f6d55ee..5af03461274 100644
--- a/engine/consensus/ingestion/core_test.go
+++ b/engine/consensus/ingestion/core_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package ingestion
 
 import (
@@ -108,14 +106,14 @@ func (suite *IngestionCoreSuite) SetupTest() {
 		},
 	)
 	final.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return suite.finalIdentities.Filter(selector)
 		},
 		nil,
 	)
 	ref.On("Epochs").Return(suite.query)
 	suite.query.On("Current").Return(suite.epoch)
-	cluster.On("Members").Return(suite.clusterMembers)
+	cluster.On("Members").Return(suite.clusterMembers.ToSkeleton())
 	suite.epoch.On("ClusterByChainID", mock.Anything).Return(
 		func(chainID flow.ChainID) protocol.Cluster {
 			if chainID == suite.clusterID {
@@ -298,12 +296,14 @@ func (suite *IngestionCoreSuite) TestOnGuaranteeInvalidGuarantor() {
 // at this epoch boundary).
 func (suite *IngestionCoreSuite) TestOnGuaranteeEpochEnd() {
 
-	// in the finalized state the collectors has 0 weight but is not ejected
-	// this is what happens when we finalize the final block of the epoch during
+	// The finalized state contains the identity of a collector that:
+	//  * was active in the previous epoch but is leaving as of the current epoch
+	//  * wasn't ejected and has positive initial weight
+	// This happens when we finalize the final block of the epoch during
 	// which this node requested to unstake
 	colID, ok := suite.finalIdentities.ByNodeID(suite.collID)
 	suite.Require().True(ok)
-	colID.Weight = 0
+	colID.EpochParticipationStatus = flow.EpochParticipationStatusLeaving
 
 	guarantee := suite.validGuarantee()
 
diff --git a/engine/consensus/ingestion/engine.go b/engine/consensus/ingestion/engine.go
index 6082f4053d0..e556fc2f766 100644
--- a/engine/consensus/ingestion/engine.go
+++ b/engine/consensus/ingestion/engine.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package ingestion
 
 import (
diff --git a/engine/consensus/ingestion/engine_test.go b/engine/consensus/ingestion/engine_test.go
index a146816bfa9..88b2895a64e 100644
--- a/engine/consensus/ingestion/engine_test.go
+++ b/engine/consensus/ingestion/engine_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package ingestion
 
 import (
diff --git a/engine/consensus/message_hub/message_hub.go b/engine/consensus/message_hub/message_hub.go
index 2deb22a7332..07fe8c3a387 100644
--- a/engine/consensus/message_hub/message_hub.go
+++ b/engine/consensus/message_hub/message_hub.go
@@ -233,12 +233,13 @@ func (h *MessageHub) sendOwnTimeout(timeout *model.TimeoutObject) error {
 	log.Info().Msg("processing timeout broadcast request from hotstuff")
 
 	// Retrieve all consensus nodes (excluding myself).
-	// CAUTION: We must include also nodes with weight zero, because otherwise
+	// CAUTION: We must include consensus nodes that are joining, because otherwise
+	//          TCs might not be constructed at epoch switchover.
 	//          TCs might not be constructed at epoch switchover.
 	recipients, err := h.state.Final().Identities(filter.And(
-		filter.Not(filter.Ejected),
-		filter.HasRole(flow.RoleConsensus),
-		filter.Not(filter.HasNodeID(h.me.NodeID())),
+		filter.IsValidCurrentEpochParticipantOrJoining,
+		filter.HasRole[flow.Identity](flow.RoleConsensus),
+		filter.Not(filter.HasNodeID[flow.Identity](h.me.NodeID())),
 	))
 	if err != nil {
 		return fmt.Errorf("could not get consensus recipients for broadcasting timeout: %w", err)
@@ -322,20 +323,21 @@ func (h *MessageHub) sendOwnProposal(header *flow.Header) error {
 	log.Debug().Msg("processing proposal broadcast request from hotstuff")
 
 	// Retrieve all consensus nodes (excluding myself).
-	// CAUTION: We must include also nodes with weight zero, because otherwise
-	//          new consensus nodes for the next epoch are left out.
+	// CAUTION: We must also include nodes that are joining, because otherwise new consensus
+	//          nodes for the next epoch are left out. As most nodes might be interested in
+	//          new proposals, we simply broadcast to all non-ejected nodes (excluding myself).
 	// Note: retrieving the final state requires a time-intensive database read.
 	//       Therefore, we execute this in a separate routine, because
 	//       `OnOwnTimeout` is directly called by the consensus core logic.
 	allIdentities, err := h.state.AtBlockID(header.ParentID).Identities(filter.And(
-		filter.Not(filter.Ejected),
-		filter.Not(filter.HasNodeID(h.me.NodeID())),
+		filter.Not(filter.HasParticipationStatus(flow.EpochParticipationStatusEjected)),
+		filter.Not(filter.HasNodeID[flow.Identity](h.me.NodeID())),
 	))
 	if err != nil {
 		return fmt.Errorf("could not get identities for broadcasting proposal: %w", err)
 	}
 
-	consRecipients := allIdentities.Filter(filter.HasRole(flow.RoleConsensus))
+	consRecipients := allIdentities.Filter(filter.HasRole[flow.Identity](flow.RoleConsensus))
 
 	// NOTE: some fields are not needed for the message
 	// - proposer ID is conveyed over the network message
@@ -356,7 +358,7 @@ func (h *MessageHub) sendOwnProposal(header *flow.Header) error {
 	log.Info().Msg("block proposal was broadcast")
 
 	// submit proposal to non-consensus nodes
-	h.provideProposal(proposal, allIdentities.Filter(filter.Not(filter.HasRole(flow.RoleConsensus))))
+	h.provideProposal(proposal, allIdentities.Filter(filter.Not(filter.HasRole[flow.Identity](flow.RoleConsensus))))
 	h.engineMetrics.MessageSent(metrics.EngineConsensusMessageHub, metrics.MessageBlockProposal)
 
 	return nil
diff --git a/engine/consensus/message_hub/message_hub_test.go b/engine/consensus/message_hub/message_hub_test.go
index a68ce9eeb7a..68bd1adc59a 100644
--- a/engine/consensus/message_hub/message_hub_test.go
+++ b/engine/consensus/message_hub/message_hub_test.go
@@ -67,7 +67,7 @@ func (s *MessageHubSuite) SetupTest() {
 	// initialize the paramaters
 	s.participants = unittest.IdentityListFixture(3,
 		unittest.WithRole(flow.RoleConsensus),
-		unittest.WithWeight(1000),
+		unittest.WithInitialWeight(1000),
 	)
 	s.myID = s.participants[0].NodeID
 	block := unittest.BlockFixture()
@@ -121,7 +121,7 @@ func (s *MessageHubSuite) SetupTest() {
 	// set up protocol snapshot mock
 	s.snapshot = &protocol.Snapshot{}
 	s.snapshot.On("Identities", mock.Anything).Return(
-		func(filter flow.IdentityFilter) flow.IdentityList {
+		func(filter flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return s.participants.Filter(filter)
 		},
 		nil,
diff --git a/engine/consensus/sealing/core.go b/engine/consensus/sealing/core.go
index fd6b9a04c5a..f40b730d88c 100644
--- a/engine/consensus/sealing/core.go
+++ b/engine/consensus/sealing/core.go
@@ -1,5 +1,3 @@
-// (c) 2021 Dapper Labs - ALL RIGHTS RESERVED
-
 package sealing
 
 import (
@@ -137,10 +135,7 @@ func (c *Core) RepopulateAssignmentCollectorTree(payloads storage.Payloads) erro
 
 	// Get the root block of our local state - we allow references to unknown
 	// blocks below the root height
-	rootHeader, err := c.state.Params().FinalizedRoot()
-	if err != nil {
-		return fmt.Errorf("could not retrieve root header: %w", err)
-	}
+	rootHeader := c.state.Params().FinalizedRoot()
 
 	// Determine the list of unknown blocks referenced within the sealing segment
 	// if we are initializing with a latest sealed block below the root height
diff --git a/engine/consensus/sealing/engine.go b/engine/consensus/sealing/engine.go
index 9786c6aa0b6..cf379a90db5 100644
--- a/engine/consensus/sealing/engine.go
+++ b/engine/consensus/sealing/engine.go
@@ -104,10 +104,7 @@ func NewEngine(log zerolog.Logger,
 	sealsMempool mempool.IncorporatedResultSeals,
 	requiredApprovalsForSealConstructionGetter module.SealingConfigsGetter,
 ) (*Engine, error) {
-	rootHeader, err := state.Params().FinalizedRoot()
-	if err != nil {
-		return nil, fmt.Errorf("could not retrieve root block: %w", err)
-	}
+	rootHeader := state.Params().FinalizedRoot()
 
 	unit := engine.NewUnit()
 	e := &Engine{
@@ -124,7 +121,7 @@ func NewEngine(log zerolog.Logger,
 		rootHeader:    rootHeader,
 	}
 
-	err = e.setupTrustedInboundQueues()
+	err := e.setupTrustedInboundQueues()
 	if err != nil {
 		return nil, fmt.Errorf("initialization of inbound queues for trusted inputs failed: %w", err)
 	}
diff --git a/engine/consensus/sealing/engine_test.go b/engine/consensus/sealing/engine_test.go
index e5adb345460..7815f424157 100644
--- a/engine/consensus/sealing/engine_test.go
+++ b/engine/consensus/sealing/engine_test.go
@@ -1,5 +1,3 @@
-// (c) 2021 Dapper Labs - ALL RIGHTS RESERVED
-
 package sealing
 
 import (
diff --git a/engine/execution/computation/computer/result_collector.go b/engine/execution/computation/computer/result_collector.go
index 636aeb9a4e1..88aeb7d378d 100644
--- a/engine/execution/computation/computer/result_collector.go
+++ b/engine/execution/computation/computer/result_collector.go
@@ -244,6 +244,7 @@ func (collector *resultCollector) processTransactionResult(
 		Uint64("computation_used", output.ComputationUsed).
 		Uint64("memory_used", output.MemoryEstimate).
 		Int64("time_spent_in_ms", timeSpent.Milliseconds()).
+		Float64("normalized_time_per_computation", flow.NormalizedExecutionTimePerComputationUnit(timeSpent, output.ComputationUsed)).
 		Logger()
 
 	if output.Err != nil {
diff --git a/engine/execution/computation/manager.go b/engine/execution/computation/manager.go
index f4d0d2cc748..9baf657c74a 100644
--- a/engine/execution/computation/manager.go
+++ b/engine/execution/computation/manager.go
@@ -35,6 +35,7 @@ type ComputationManager interface {
 		snapshot snapshot.StorageSnapshot,
 	) (
 		[]byte,
+		uint64,
 		error,
 	)
 
@@ -179,10 +180,6 @@ func (e *Manager) ComputeBlock(
 		snapshot,
 		derivedBlockData)
 	if err != nil {
-		e.log.Error().
-			Hex("block_id", logging.Entity(block.Block)).
-			Msg("failed to compute block result")
-
 		return nil, fmt.Errorf("failed to execute block: %w", err)
 	}
 
@@ -199,7 +196,7 @@ func (e *Manager) ExecuteScript(
 	arguments [][]byte,
 	blockHeader *flow.Header,
 	snapshot snapshot.StorageSnapshot,
-) ([]byte, error) {
+) ([]byte, uint64, error) {
 	return e.queryExecutor.ExecuteScript(ctx,
 		code,
 		arguments,
diff --git a/engine/execution/computation/manager_test.go b/engine/execution/computation/manager_test.go
index 30969282e8b..16cb60a9f67 100644
--- a/engine/execution/computation/manager_test.go
+++ b/engine/execution/computation/manager_test.go
@@ -280,7 +280,7 @@ func TestExecuteScript(t *testing.T) {
 	require.NoError(t, err)
 
 	header := unittest.BlockHeaderFixture()
-	_, err = engine.ExecuteScript(
+	_, _, err = engine.ExecuteScript(
 		context.Background(),
 		script,
 		nil,
@@ -347,7 +347,7 @@ func TestExecuteScript_BalanceScriptFailsIfViewIsEmpty(t *testing.T) {
 	require.NoError(t, err)
 
 	header := unittest.BlockHeaderFixture()
-	_, err = engine.ExecuteScript(
+	_, _, err = engine.ExecuteScript(
 		context.Background(),
 		script,
 		nil,
@@ -395,7 +395,7 @@ func TestExecuteScripPanicsAreHandled(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	_, err = manager.ExecuteScript(
+	_, _, err = manager.ExecuteScript(
 		context.Background(),
 		[]byte("whatever"),
 		nil,
@@ -403,7 +403,6 @@ func TestExecuteScripPanicsAreHandled(t *testing.T) {
 		nil)
 
 	require.Error(t, err)
-
 	require.Contains(t, buffer.String(), "Verunsicherung")
 }
 
@@ -449,7 +448,7 @@ func TestExecuteScript_LongScriptsAreLogged(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	_, err = manager.ExecuteScript(
+	_, _, err = manager.ExecuteScript(
 		context.Background(),
 		[]byte("whatever"),
 		nil,
@@ -457,7 +456,6 @@ func TestExecuteScript_LongScriptsAreLogged(t *testing.T) {
 		nil)
 
 	require.NoError(t, err)
-
 	require.Contains(t, buffer.String(), "exceeded threshold")
 }
 
@@ -503,7 +501,7 @@ func TestExecuteScript_ShortScriptsAreNotLogged(t *testing.T) {
 	)
 	require.NoError(t, err)
 
-	_, err = manager.ExecuteScript(
+	_, _, err = manager.ExecuteScript(
 		context.Background(),
 		[]byte("whatever"),
 		nil,
@@ -511,7 +509,6 @@ func TestExecuteScript_ShortScriptsAreNotLogged(t *testing.T) {
 		nil)
 
 	require.NoError(t, err)
-
 	require.NotContains(t, buffer.String(), "exceeded threshold")
 }
 
@@ -680,7 +677,7 @@ func TestExecuteScriptTimeout(t *testing.T) {
 	`)
 
 	header := unittest.BlockHeaderFixture()
-	value, err := manager.ExecuteScript(
+	value, _, err := manager.ExecuteScript(
 		context.Background(),
 		script,
 		nil,
@@ -734,7 +731,7 @@ func TestExecuteScriptCancelled(t *testing.T) {
 	wg.Add(1)
 	go func() {
 		header := unittest.BlockHeaderFixture()
-		value, err = manager.ExecuteScript(
+		value, _, err = manager.ExecuteScript(
 			reqCtx,
 			script,
 			nil,
@@ -950,7 +947,7 @@ func TestScriptStorageMutationsDiscarded(t *testing.T) {
 	`)
 
 	header := unittest.BlockHeaderFixture()
-	_, err = manager.ExecuteScript(
+	_, compUsed, err := manager.ExecuteScript(
 		context.Background(),
 		script,
 		[][]byte{jsoncdc.MustEncode(address)},
@@ -958,6 +955,7 @@ func TestScriptStorageMutationsDiscarded(t *testing.T) {
 		snapshotTree)
 
 	require.NoError(t, err)
+	require.Greater(t, compUsed, uint64(0))
 
 	env := environment.NewScriptEnvironmentFromStorageSnapshot(
 		ctx.EnvironmentParams,
diff --git a/engine/execution/computation/mock/computation_manager.go b/engine/execution/computation/mock/computation_manager.go
index f019caf61bd..39fc3f36018 100644
--- a/engine/execution/computation/mock/computation_manager.go
+++ b/engine/execution/computation/mock/computation_manager.go
@@ -47,12 +47,13 @@ func (_m *ComputationManager) ComputeBlock(ctx context.Context, parentBlockExecu
 }
 
 // ExecuteScript provides a mock function with given fields: ctx, script, arguments, blockHeader, _a4
-func (_m *ComputationManager) ExecuteScript(ctx context.Context, script []byte, arguments [][]byte, blockHeader *flow.Header, _a4 snapshot.StorageSnapshot) ([]byte, error) {
+func (_m *ComputationManager) ExecuteScript(ctx context.Context, script []byte, arguments [][]byte, blockHeader *flow.Header, _a4 snapshot.StorageSnapshot) ([]byte, uint64, error) {
 	ret := _m.Called(ctx, script, arguments, blockHeader, _a4)
 
 	var r0 []byte
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, []byte, [][]byte, *flow.Header, snapshot.StorageSnapshot) ([]byte, error)); ok {
+	var r1 uint64
+	var r2 error
+	if rf, ok := ret.Get(0).(func(context.Context, []byte, [][]byte, *flow.Header, snapshot.StorageSnapshot) ([]byte, uint64, error)); ok {
 		return rf(ctx, script, arguments, blockHeader, _a4)
 	}
 	if rf, ok := ret.Get(0).(func(context.Context, []byte, [][]byte, *flow.Header, snapshot.StorageSnapshot) []byte); ok {
@@ -63,13 +64,19 @@ func (_m *ComputationManager) ExecuteScript(ctx context.Context, script []byte,
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func(context.Context, []byte, [][]byte, *flow.Header, snapshot.StorageSnapshot) error); ok {
+	if rf, ok := ret.Get(1).(func(context.Context, []byte, [][]byte, *flow.Header, snapshot.StorageSnapshot) uint64); ok {
 		r1 = rf(ctx, script, arguments, blockHeader, _a4)
 	} else {
-		r1 = ret.Error(1)
+		r1 = ret.Get(1).(uint64)
 	}
 
-	return r0, r1
+	if rf, ok := ret.Get(2).(func(context.Context, []byte, [][]byte, *flow.Header, snapshot.StorageSnapshot) error); ok {
+		r2 = rf(ctx, script, arguments, blockHeader, _a4)
+	} else {
+		r2 = ret.Error(2)
+	}
+
+	return r0, r1, r2
 }
 
 // GetAccount provides a mock function with given fields: ctx, addr, header, _a3
diff --git a/engine/execution/computation/query/executor.go b/engine/execution/computation/query/executor.go
index 104fa2a9e77..b15ab8bdaf1 100644
--- a/engine/execution/computation/query/executor.go
+++ b/engine/execution/computation/query/executor.go
@@ -37,6 +37,7 @@ type Executor interface {
 		snapshot snapshot.StorageSnapshot,
 	) (
 		[]byte,
+		uint64,
 		error,
 	)
 
@@ -112,6 +113,7 @@ func (e *QueryExecutor) ExecuteScript(
 	snapshot snapshot.StorageSnapshot,
 ) (
 	encodedValue []byte,
+	computationUsed uint64,
 	err error,
 ) {
 
@@ -126,7 +128,7 @@ func (e *QueryExecutor) ExecuteScript(
 		defer e.rngLock.Unlock()
 		trackerID, err := rand.Uint32()
 		if err != nil {
-			return nil, fmt.Errorf("failed to generate trackerID: %w", err)
+			return nil, 0, fmt.Errorf("failed to generate trackerID: %w", err)
 		}
 
 		trackedLogger := e.logger.With().Hex("script_hex", script).Uint32("trackerID", trackerID).Logger()
@@ -178,11 +180,11 @@ func (e *QueryExecutor) ExecuteScript(
 		fvm.NewScriptWithContextAndArgs(script, requestCtx, arguments...),
 		snapshot)
 	if err != nil {
-		return nil, fmt.Errorf("failed to execute script (internal error): %w", err)
+		return nil, 0, fmt.Errorf("failed to execute script (internal error): %w", err)
 	}
 
 	if output.Err != nil {
-		return nil, errors.NewCodedError(
+		return nil, 0, errors.NewCodedError(
 			output.Err.Code(),
 			"failed to execute script at block (%s): %s", blockHeader.ID(),
 			summarizeLog(output.Err.Error(), e.config.MaxErrorMessageSize),
@@ -191,7 +193,7 @@ func (e *QueryExecutor) ExecuteScript(
 
 	encodedValue, err = jsoncdc.Encode(output.Value)
 	if err != nil {
-		return nil, fmt.Errorf("failed to encode runtime value: %w", err)
+		return nil, 0, fmt.Errorf("failed to encode runtime value: %w", err)
 	}
 
 	memAllocAfter := debug.GetHeapAllocsBytes()
@@ -201,7 +203,7 @@ func (e *QueryExecutor) ExecuteScript(
 		memAllocAfter-memAllocBefore,
 		output.MemoryEstimate)
 
-	return encodedValue, nil
+	return encodedValue, output.ComputationUsed, nil
 }
 
 func summarizeLog(log string, limit int) string {
diff --git a/engine/execution/computation/query/mock/executor.go b/engine/execution/computation/query/mock/executor.go
index 4ffc343c6e5..d0755a36621 100644
--- a/engine/execution/computation/query/mock/executor.go
+++ b/engine/execution/computation/query/mock/executor.go
@@ -17,12 +17,13 @@ type Executor struct {
 }
 
 // ExecuteScript provides a mock function with given fields: ctx, script, arguments, blockHeader, _a4
-func (_m *Executor) ExecuteScript(ctx context.Context, script []byte, arguments [][]byte, blockHeader *flow.Header, _a4 snapshot.StorageSnapshot) ([]byte, error) {
+func (_m *Executor) ExecuteScript(ctx context.Context, script []byte, arguments [][]byte, blockHeader *flow.Header, _a4 snapshot.StorageSnapshot) ([]byte, uint64, error) {
 	ret := _m.Called(ctx, script, arguments, blockHeader, _a4)
 
 	var r0 []byte
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, []byte, [][]byte, *flow.Header, snapshot.StorageSnapshot) ([]byte, error)); ok {
+	var r1 uint64
+	var r2 error
+	if rf, ok := ret.Get(0).(func(context.Context, []byte, [][]byte, *flow.Header, snapshot.StorageSnapshot) ([]byte, uint64, error)); ok {
 		return rf(ctx, script, arguments, blockHeader, _a4)
 	}
 	if rf, ok := ret.Get(0).(func(context.Context, []byte, [][]byte, *flow.Header, snapshot.StorageSnapshot) []byte); ok {
@@ -33,13 +34,19 @@ func (_m *Executor) ExecuteScript(ctx context.Context, script []byte, arguments
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func(context.Context, []byte, [][]byte, *flow.Header, snapshot.StorageSnapshot) error); ok {
+	if rf, ok := ret.Get(1).(func(context.Context, []byte, [][]byte, *flow.Header, snapshot.StorageSnapshot) uint64); ok {
 		r1 = rf(ctx, script, arguments, blockHeader, _a4)
 	} else {
-		r1 = ret.Error(1)
+		r1 = ret.Get(1).(uint64)
 	}
 
-	return r0, r1
+	if rf, ok := ret.Get(2).(func(context.Context, []byte, [][]byte, *flow.Header, snapshot.StorageSnapshot) error); ok {
+		r2 = rf(ctx, script, arguments, blockHeader, _a4)
+	} else {
+		r2 = ret.Error(2)
+	}
+
+	return r0, r1, r2
 }
 
 // GetAccount provides a mock function with given fields: ctx, addr, header, _a3
diff --git a/engine/execution/engines.go b/engine/execution/engines.go
index 66d4dbccd57..9e7fa57a9f9 100644
--- a/engine/execution/engines.go
+++ b/engine/execution/engines.go
@@ -10,7 +10,8 @@ import (
 type ScriptExecutor interface {
 
 	// ExecuteScriptAtBlockID executes a script at the given Block id
-	ExecuteScriptAtBlockID(ctx context.Context, script []byte, arguments [][]byte, blockID flow.Identifier) ([]byte, error)
+	// it returns the value, the computation used and the error (if any)
+	ExecuteScriptAtBlockID(ctx context.Context, script []byte, arguments [][]byte, blockID flow.Identifier) ([]byte, uint64, error)
 
 	// GetAccount returns the Account details at the given Block id
 	GetAccount(ctx context.Context, address flow.Address, blockID flow.Identifier) (*flow.Account, error)
diff --git a/engine/execution/execution_test.go b/engine/execution/execution_test.go
index 12a79e90706..e88e118d7f4 100644
--- a/engine/execution/execution_test.go
+++ b/engine/execution/execution_test.go
@@ -42,24 +42,25 @@ func TestExecutionFlow(t *testing.T) {
 
 	chainID := flow.Testnet
 
-	colID := unittest.IdentityFixture(
+	colID := unittest.PrivateNodeInfoFixture(
 		unittest.WithRole(flow.RoleCollection),
 		unittest.WithKeys,
 	)
-	conID := unittest.IdentityFixture(
+	conID := unittest.PrivateNodeInfoFixture(
 		unittest.WithRole(flow.RoleConsensus),
 		unittest.WithKeys,
 	)
-	exeID := unittest.IdentityFixture(
+	exeID := unittest.PrivateNodeInfoFixture(
 		unittest.WithRole(flow.RoleExecution),
 		unittest.WithKeys,
 	)
-	verID := unittest.IdentityFixture(
+	verID := unittest.PrivateNodeInfoFixture(
 		unittest.WithRole(flow.RoleVerification),
 		unittest.WithKeys,
 	)
 
-	identities := unittest.CompleteIdentitySet(colID, conID, exeID, verID).Sort(flow.Canonical)
+	identities := unittest.CompleteIdentitySet(colID.Identity(), conID.Identity(), exeID.Identity(), verID.Identity()).
+		Sort(flow.Canonical[flow.Identity])
 
 	// create execution node
 	exeNode := testutil.ExecutionNode(t, hub, exeID, identities, 21, chainID)
@@ -70,7 +71,7 @@ func TestExecutionFlow(t *testing.T) {
 	}, 1*time.Second, "could not start execution node on time")
 	defer exeNode.Done(cancel)
 
-	genesis, err := exeNode.State.AtHeight(0).Head()
+	genesis, err := exeNode.Blocks.ByHeight(0)
 	require.NoError(t, err)
 
 	tx1 := flow.TransactionBody{
@@ -97,10 +98,10 @@ func TestExecutionFlow(t *testing.T) {
 		col2.ID(): &col2,
 	}
 
-	clusterChainID := cluster.CanonicalClusterID(1, flow.IdentityList{colID}.NodeIDs())
+	clusterChainID := cluster.CanonicalClusterID(1, flow.IdentityList{colID.Identity()}.NodeIDs())
 
 	// signed by the only collector
-	block := unittest.BlockWithParentAndProposerFixture(t, genesis, conID.NodeID)
+	block := unittest.BlockWithParentAndProposerFixture(t, genesis.Header, conID.NodeID)
 	voterIndices, err := signature.EncodeSignersToIndices(
 		[]flow.Identifier{conID.NodeID}, []flow.Identifier{conID.NodeID})
 	require.NoError(t, err)
@@ -123,12 +124,14 @@ func TestExecutionFlow(t *testing.T) {
 				ReferenceBlockID: genesis.ID(),
 			},
 		},
+		ProtocolStateID: genesis.Payload.ProtocolStateID,
 	})
 
 	child := unittest.BlockWithParentAndProposerFixture(t, block.Header, conID.NodeID)
 	// the default signer indices is 2 bytes, but in this test cases
 	// we need 1 byte
 	child.Header.ParentVoterIndices = voterIndices
+	child.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(block.Payload.ProtocolStateID)))
 
 	log.Info().Msgf("child block ID: %v, indices: %x", child.Header.ID(), child.Header.ParentVoterIndices)
 
@@ -235,7 +238,7 @@ func TestExecutionFlow(t *testing.T) {
 	exeNode.AssertBlockIsExecuted(t, block.Header)
 
 	if exeNode.StorehouseEnabled {
-		exeNode.AssertHighestExecutedBlock(t, genesis)
+		exeNode.AssertHighestExecutedBlock(t, genesis.Header)
 	} else {
 		exeNode.AssertHighestExecutedBlock(t, block.Header)
 	}
@@ -250,8 +253,16 @@ func TestExecutionFlow(t *testing.T) {
 	consensusEngine.AssertExpectations(t)
 }
 
-func deployContractBlock(t *testing.T, conID *flow.Identity, colID *flow.Identity, chain flow.Chain, seq uint64, parent *flow.Header, ref *flow.Header) (
-	*flow.TransactionBody, *flow.Collection, flow.Block, *messages.BlockProposal, uint64) {
+func deployContractBlock(
+	t *testing.T,
+	conID *flow.Identity,
+	colID *flow.Identity,
+	chain flow.Chain,
+	seq uint64,
+	parent *flow.Block,
+	ref *flow.Header,
+) (
+	*flow.TransactionBody, *flow.Collection, *flow.Block, *messages.BlockProposal, uint64) {
 	// make tx
 	tx := execTestutil.DeployCounterContractTransaction(chain.ServiceAddress(), chain)
 	err := execTestutil.SignTransactionAsServiceAccount(tx, seq, chain)
@@ -267,7 +278,7 @@ func deployContractBlock(t *testing.T, conID *flow.Identity, colID *flow.Identit
 	clusterChainID := cluster.CanonicalClusterID(1, flow.IdentityList{colID}.NodeIDs())
 
 	// make block
-	block := unittest.BlockWithParentAndProposerFixture(t, parent, conID.NodeID)
+	block := unittest.BlockWithParentAndProposerFixture(t, parent.Header, conID.NodeID)
 	voterIndices, err := signature.EncodeSignersToIndices(
 		[]flow.Identifier{conID.NodeID}, []flow.Identifier{conID.NodeID})
 	require.NoError(t, err)
@@ -281,16 +292,17 @@ func deployContractBlock(t *testing.T, conID *flow.Identity, colID *flow.Identit
 				ReferenceBlockID: ref.ID(),
 			},
 		},
+		ProtocolStateID: parent.Payload.ProtocolStateID,
 	})
 
 	// make proposal
 	proposal := unittest.ProposalFromBlock(&block)
 
-	return tx, col, block, proposal, seq + 1
+	return tx, col, &block, proposal, seq + 1
 }
 
-func makePanicBlock(t *testing.T, conID *flow.Identity, colID *flow.Identity, chain flow.Chain, seq uint64, parent *flow.Header, ref *flow.Header) (
-	*flow.TransactionBody, *flow.Collection, flow.Block, *messages.BlockProposal, uint64) {
+func makePanicBlock(t *testing.T, conID *flow.Identity, colID *flow.Identity, chain flow.Chain, seq uint64, parent *flow.Block, ref *flow.Header) (
+	*flow.TransactionBody, *flow.Collection, *flow.Block, *messages.BlockProposal, uint64) {
 	// make tx
 	tx := execTestutil.CreateCounterPanicTransaction(chain.ServiceAddress(), chain.ServiceAddress())
 	err := execTestutil.SignTransactionAsServiceAccount(tx, seq, chain)
@@ -301,7 +313,7 @@ func makePanicBlock(t *testing.T, conID *flow.Identity, colID *flow.Identity, ch
 
 	clusterChainID := cluster.CanonicalClusterID(1, flow.IdentityList{colID}.NodeIDs())
 	// make block
-	block := unittest.BlockWithParentAndProposerFixture(t, parent, conID.NodeID)
+	block := unittest.BlockWithParentAndProposerFixture(t, parent.Header, conID.NodeID)
 	voterIndices, err := signature.EncodeSignersToIndices(
 		[]flow.Identifier{conID.NodeID}, []flow.Identifier{conID.NodeID})
 	require.NoError(t, err)
@@ -315,15 +327,16 @@ func makePanicBlock(t *testing.T, conID *flow.Identity, colID *flow.Identity, ch
 		Guarantees: []*flow.CollectionGuarantee{
 			{CollectionID: col.ID(), SignerIndices: signerIndices, ChainID: clusterChainID, ReferenceBlockID: ref.ID()},
 		},
+		ProtocolStateID: parent.Payload.ProtocolStateID,
 	})
 
 	proposal := unittest.ProposalFromBlock(&block)
 
-	return tx, col, block, proposal, seq + 1
+	return tx, col, &block, proposal, seq + 1
 }
 
-func makeSuccessBlock(t *testing.T, conID *flow.Identity, colID *flow.Identity, chain flow.Chain, seq uint64, parent *flow.Header, ref *flow.Header) (
-	*flow.TransactionBody, *flow.Collection, flow.Block, *messages.BlockProposal, uint64) {
+func makeSuccessBlock(t *testing.T, conID *flow.Identity, colID *flow.Identity, chain flow.Chain, seq uint64, parent *flow.Block, ref *flow.Header) (
+	*flow.TransactionBody, *flow.Collection, *flow.Block, *messages.BlockProposal, uint64) {
 	tx := execTestutil.AddToCounterTransaction(chain.ServiceAddress(), chain.ServiceAddress())
 	err := execTestutil.SignTransactionAsServiceAccount(tx, seq, chain)
 	require.NoError(t, err)
@@ -334,7 +347,7 @@ func makeSuccessBlock(t *testing.T, conID *flow.Identity, colID *flow.Identity,
 	clusterChainID := cluster.CanonicalClusterID(1, flow.IdentityList{colID}.NodeIDs())
 
 	col := &flow.Collection{Transactions: []*flow.TransactionBody{tx}}
-	block := unittest.BlockWithParentAndProposerFixture(t, parent, conID.NodeID)
+	block := unittest.BlockWithParentAndProposerFixture(t, parent.Header, conID.NodeID)
 	voterIndices, err := signature.EncodeSignersToIndices(
 		[]flow.Identifier{conID.NodeID}, []flow.Identifier{conID.NodeID})
 	require.NoError(t, err)
@@ -343,11 +356,12 @@ func makeSuccessBlock(t *testing.T, conID *flow.Identity, colID *flow.Identity,
 		Guarantees: []*flow.CollectionGuarantee{
 			{CollectionID: col.ID(), SignerIndices: signerIndices, ChainID: clusterChainID, ReferenceBlockID: ref.ID()},
 		},
+		ProtocolStateID: parent.Payload.ProtocolStateID,
 	})
 
 	proposal := unittest.ProposalFromBlock(&block)
 
-	return tx, col, block, proposal, seq + 1
+	return tx, col, &block, proposal, seq + 1
 }
 
 // Test a successful tx should change the statecommitment,
@@ -357,28 +371,32 @@ func TestFailedTxWillNotChangeStateCommitment(t *testing.T) {
 
 	chainID := flow.Emulator
 
-	colID := unittest.IdentityFixture(
+	colNodeInfo := unittest.PrivateNodeInfoFixture(
 		unittest.WithRole(flow.RoleCollection),
 		unittest.WithKeys,
 	)
-	conID := unittest.IdentityFixture(
+	conNodeInfo := unittest.PrivateNodeInfoFixture(
 		unittest.WithRole(flow.RoleConsensus),
 		unittest.WithKeys,
 	)
-	exe1ID := unittest.IdentityFixture(
+	exe1NodeInfo := unittest.PrivateNodeInfoFixture(
 		unittest.WithRole(flow.RoleExecution),
 		unittest.WithKeys,
 	)
 
+	colID := colNodeInfo.Identity()
+	conID := conNodeInfo.Identity()
+	exe1ID := exe1NodeInfo.Identity()
+
 	identities := unittest.CompleteIdentitySet(colID, conID, exe1ID)
 	key := unittest.NetworkingPrivKeyFixture()
 	identities[3].NetworkPubKey = key.PublicKey()
 
-	collectionNode := testutil.GenericNodeFromParticipants(t, hub, colID, identities, chainID)
+	collectionNode := testutil.GenericNodeFromParticipants(t, hub, colNodeInfo, identities, chainID)
 	defer collectionNode.Done()
-	consensusNode := testutil.GenericNodeFromParticipants(t, hub, conID, identities, chainID)
+	consensusNode := testutil.GenericNodeFromParticipants(t, hub, conNodeInfo, identities, chainID)
 	defer consensusNode.Done()
-	exe1Node := testutil.ExecutionNode(t, hub, exe1ID, identities, 27, chainID)
+	exe1Node := testutil.ExecutionNode(t, hub, exe1NodeInfo, identities, 27, chainID)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	unittest.RequireReturnsBefore(t, func() {
@@ -386,7 +404,7 @@ func TestFailedTxWillNotChangeStateCommitment(t *testing.T) {
 	}, 1*time.Second, "could not start execution node on time")
 	defer exe1Node.Done(cancel)
 
-	genesis, err := exe1Node.State.AtHeight(0).Head()
+	genesis, err := exe1Node.Blocks.ByHeight(0)
 	require.NoError(t, err)
 
 	seq := uint64(0)
@@ -395,14 +413,14 @@ func TestFailedTxWillNotChangeStateCommitment(t *testing.T) {
 
 	// transaction that will change state and succeed, used to test that state commitment changes
 	// genesis <- block1 [tx1] <- block2 [tx2] <- block3 [tx3] <- child
-	_, col1, block1, proposal1, seq := deployContractBlock(t, conID, colID, chain, seq, genesis, genesis)
+	_, col1, block1, proposal1, seq := deployContractBlock(t, conID, colID, chain, seq, genesis, genesis.Header)
 
 	// we don't set the proper sequence number of this one
-	_, col2, block2, proposal2, _ := makePanicBlock(t, conID, colID, chain, uint64(0), block1.Header, genesis)
+	_, col2, block2, proposal2, _ := makePanicBlock(t, conID, colID, chain, uint64(0), block1, genesis.Header)
 
-	_, col3, block3, proposal3, seq := makeSuccessBlock(t, conID, colID, chain, seq, block2.Header, genesis)
+	_, col3, block3, proposal3, seq := makeSuccessBlock(t, conID, colID, chain, seq, block2, genesis.Header)
 
-	_, _, _, proposal4, _ := makeSuccessBlock(t, conID, colID, chain, seq, block3.Header, genesis)
+	_, _, _, proposal4, _ := makeSuccessBlock(t, conID, colID, chain, seq, block3, genesis.Header)
 	// seq++
 
 	// setup mocks and assertions
@@ -442,7 +460,7 @@ func TestFailedTxWillNotChangeStateCommitment(t *testing.T) {
 	})
 
 	if exe1Node.StorehouseEnabled {
-		exe1Node.AssertHighestExecutedBlock(t, genesis)
+		exe1Node.AssertHighestExecutedBlock(t, genesis.Header)
 	} else {
 		exe1Node.AssertHighestExecutedBlock(t, block1.Header)
 	}
@@ -517,28 +535,33 @@ func TestBroadcastToMultipleVerificationNodes(t *testing.T) {
 
 	chainID := flow.Emulator
 
-	colID := unittest.IdentityFixture(
+	colID := unittest.PrivateNodeInfoFixture(
 		unittest.WithRole(flow.RoleCollection),
 		unittest.WithKeys,
 	)
-	conID := unittest.IdentityFixture(
+	conID := unittest.PrivateNodeInfoFixture(
 		unittest.WithRole(flow.RoleConsensus),
 		unittest.WithKeys,
 	)
-	exeID := unittest.IdentityFixture(
+	exeID := unittest.PrivateNodeInfoFixture(
 		unittest.WithRole(flow.RoleExecution),
 		unittest.WithKeys,
 	)
-	ver1ID := unittest.IdentityFixture(
+	ver1ID := unittest.PrivateNodeInfoFixture(
 		unittest.WithRole(flow.RoleVerification),
 		unittest.WithKeys,
 	)
-	ver2ID := unittest.IdentityFixture(
+	ver2ID := unittest.PrivateNodeInfoFixture(
 		unittest.WithRole(flow.RoleVerification),
 		unittest.WithKeys,
 	)
 
-	identities := unittest.CompleteIdentitySet(colID, conID, exeID, ver1ID, ver2ID)
+	identities := unittest.CompleteIdentitySet(colID.Identity(),
+		conID.Identity(),
+		exeID.Identity(),
+		ver1ID.Identity(),
+		ver2ID.Identity(),
+	)
 
 	exeNode := testutil.ExecutionNode(t, hub, exeID, identities, 21, chainID)
 	ctx, cancel := context.WithCancel(context.Background())
@@ -553,14 +576,14 @@ func TestBroadcastToMultipleVerificationNodes(t *testing.T) {
 	verification2Node := testutil.GenericNodeFromParticipants(t, hub, ver2ID, identities, chainID)
 	defer verification2Node.Done()
 
-	genesis, err := exeNode.State.AtHeight(0).Head()
+	genesis, err := exeNode.Blocks.ByHeight(0)
 	require.NoError(t, err)
 
-	block := unittest.BlockWithParentAndProposerFixture(t, genesis, conID.NodeID)
+	block := unittest.BlockWithParentAndProposerFixture(t, genesis.Header, conID.NodeID)
 	voterIndices, err := signature.EncodeSignersToIndices([]flow.Identifier{conID.NodeID}, []flow.Identifier{conID.NodeID})
 	require.NoError(t, err)
 	block.Header.ParentVoterIndices = voterIndices
-	block.SetPayload(flow.Payload{})
+	block.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(genesis.Payload.ProtocolStateID)))
 	proposal := unittest.ProposalFromBlock(&block)
 
 	child := unittest.BlockWithParentAndProposerFixture(t, block.Header, conID.NodeID)
diff --git a/engine/execution/ingestion/block_queue/queue.go b/engine/execution/ingestion/block_queue/queue.go
new file mode 100644
index 00000000000..d3ea82b005b
--- /dev/null
+++ b/engine/execution/ingestion/block_queue/queue.go
@@ -0,0 +1,408 @@
+package block_queue
+
+import (
+	"fmt"
+	"sync"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/mempool/entity"
+)
+
+var ErrMissingParent = fmt.Errorf("missing parent block")
+
+// BlockQueue keeps track of state of blocks and determines which blocks are executable
+// A block becomes executable when all the following conditions are met:
+// 1. the block has been validated by consensus algorithm
+// 2. the block's parent has been executed
+// 3. all the collections included in the block have been received
+type BlockQueue struct {
+	sync.Mutex
+	log zerolog.Logger
+
+	// if a block still exists in this map, it means the block has not been executed.
+	// it could either be one of the following cases:
+	// 1) block is not executed due to some of its collection is missing
+	// 2) block is not executed due to its parent block has not been executed
+	// 3) block is ready to execute, but the execution has not been finished yet.
+	// some consistency checks:
+	// 1) since an executed block must have been removed from this map, if a block's
+	// parent block has been executed, then its parent block must have been removed
+	// from this map
+	// 2) if a block's parent block has not been executed, then its parent block must still
+	// exist in this map
+	blocks map[flow.Identifier]*entity.ExecutableBlock
+
+	// a collection could be included in multiple blocks,
+	// when a missing block is received, it might trigger multiple blocks to be executable, which
+	// can be looked up by the map
+	// when a block is executed, its collections should be removed from this map unless a collection
+	// is still referenced by other blocks, which will eventually be removed when those blocks are
+	// executed.
+	collections map[flow.Identifier]*collectionInfo
+
+	// blockIDsByHeight is used to find next executable block.
+	// when a block is executed, the next executable block must be a block with height = current block height + 1
+	// the following map allows us to find the next executable block by height and their parent block ID
+	blockIDsByHeight map[uint64]map[flow.Identifier]*entity.ExecutableBlock
+}
+
+type MissingCollection struct {
+	BlockID   flow.Identifier
+	Height    uint64
+	Guarantee *flow.CollectionGuarantee
+}
+
+func (m *MissingCollection) ID() flow.Identifier {
+	return m.Guarantee.ID()
+}
+
+// collectionInfo is an internal struct used to keep track of the state of a collection,
+// and the blocks that include the collection
+type collectionInfo struct {
+	Collection *entity.CompleteCollection
+	IncludedIn map[flow.Identifier]*entity.ExecutableBlock
+}
+
+func NewBlockQueue(logger zerolog.Logger) *BlockQueue {
+	log := logger.With().Str("module", "block_queue").Logger()
+
+	return &BlockQueue{
+		log:              log,
+		blocks:           make(map[flow.Identifier]*entity.ExecutableBlock),
+		collections:      make(map[flow.Identifier]*collectionInfo),
+		blockIDsByHeight: make(map[uint64]map[flow.Identifier]*entity.ExecutableBlock),
+	}
+}
+
+// HandleBlock is called when a new block is received, the parentFinalState indicates
+// whether its parent block has been executed.
+// Caller must ensure:
+// 1. blocks are passsed in order, i.e. parent block is passed in before its child block
+// 2. if a block's parent is not executed, then the parent block must be passed in first
+// 3. if a block's parent is executed, then the parent's finalState must be passed in
+// It returns (nil, nil, nil) if this block is a duplication
+func (q *BlockQueue) HandleBlock(block *flow.Block, parentFinalState *flow.StateCommitment) (
+	[]*MissingCollection, // missing collections
+	[]*entity.ExecutableBlock, // blocks ready to execute
+	error, // exceptions
+) {
+	q.Lock()
+	defer q.Unlock()
+
+	// check if the block already exists
+	blockID := block.ID()
+	executable, ok := q.blocks[blockID]
+	if ok {
+		// handle the case where the block has seen before
+		return q.handleKnownBlock(executable, parentFinalState)
+	}
+
+	// handling a new block
+
+	// if parentFinalState is not provided, then its parent block must exists in the queue
+	// otherwise it's an exception
+	if parentFinalState == nil {
+		_, parentExists := q.blocks[block.Header.ParentID]
+		if !parentExists {
+			return nil, nil,
+				fmt.Errorf("block %s has no parent commitment, but its parent block %s does not exist in the queue: %w",
+					blockID, block.Header.ParentID, ErrMissingParent)
+		}
+	}
+
+	executable = &entity.ExecutableBlock{
+		Block:      block,
+		StartState: parentFinalState,
+	}
+
+	// add block to blocks
+	q.blocks[blockID] = executable
+
+	// update collection
+	colls := make(map[flow.Identifier]*entity.CompleteCollection, len(block.Payload.Guarantees))
+	executable.CompleteCollections = colls
+
+	// find missing collections and update collection index
+	missingCollections := make([]*MissingCollection, 0, len(block.Payload.Guarantees))
+
+	for _, guarantee := range block.Payload.Guarantees {
+		colID := guarantee.ID()
+		colInfo, ok := q.collections[colID]
+		if ok {
+			// some other block also includes this collection
+			colInfo.IncludedIn[blockID] = executable
+			colls[colID] = colInfo.Collection
+		} else {
+			col := &entity.CompleteCollection{
+				Guarantee: guarantee,
+			}
+			colls[colID] = col
+
+			// add new collection to collections
+			q.collections[colID] = &collectionInfo{
+				Collection: col,
+				IncludedIn: map[flow.Identifier]*entity.ExecutableBlock{
+					blockID: executable,
+				},
+			}
+
+			missingCollections = append(missingCollections, missingCollectionForBlock(executable, guarantee))
+		}
+	}
+
+	// index height
+	blocksAtSameHeight, ok := q.blockIDsByHeight[block.Header.Height]
+	if !ok {
+		blocksAtSameHeight = make(map[flow.Identifier]*entity.ExecutableBlock)
+		q.blockIDsByHeight[block.Header.Height] = blocksAtSameHeight
+	}
+	blocksAtSameHeight[blockID] = executable
+
+	// check if the block is executable
+	var executables []*entity.ExecutableBlock
+	if executable.IsComplete() {
+		// executables might contain other siblings, but won't contain "executable",
+		// which is the block itself, that's because executables are created
+		// from OnBlockExecuted(
+		executables = []*entity.ExecutableBlock{executable}
+	}
+
+	return missingCollections, executables, nil
+}
+
+// HandleCollection is called when a new collection is received
+// It returns a list of executable blocks that contains the collection
+func (q *BlockQueue) HandleCollection(collection *flow.Collection) ([]*entity.ExecutableBlock, error) {
+	q.Lock()
+	defer q.Unlock()
+	// when a collection is received, we find the blocks the collection is included in,
+	// and check if the blocks become executable.
+	// Note a collection could be included in multiple blocks, so receiving a collection
+	// might trigger multiple blocks to be executable.
+
+	// check if the collection is for any block in the queue
+	colID := collection.ID()
+	colInfo, ok := q.collections[colID]
+	if !ok {
+		// no block in the queue includes this collection
+		return nil, nil
+	}
+
+	if colInfo.Collection.IsCompleted() {
+		// the collection is already received, no action needed because an action must
+		// have been returned when the collection is first received.
+		return nil, nil
+	}
+
+	// update collection
+	colInfo.Collection.Transactions = collection.Transactions
+
+	// check if any block, which includes this collection, became executable
+	executables := make([]*entity.ExecutableBlock, 0, len(colInfo.IncludedIn))
+	for _, block := range colInfo.IncludedIn {
+		if !block.IsComplete() {
+			continue
+		}
+		executables = append(executables, block)
+	}
+
+	if len(executables) == 0 {
+		return nil, nil
+	}
+
+	return executables, nil
+}
+
+// OnBlockExecuted is called when a block is executed
+// It returns a list of executable blocks (usually its child blocks)
+// The caller has to ensure OnBlockExecuted is not called in a wrong order, such as
+// OnBlockExecuted(childBlock) being called before OnBlockExecuted(parentBlock).
+func (q *BlockQueue) OnBlockExecuted(
+	blockID flow.Identifier,
+	commit flow.StateCommitment,
+) ([]*entity.ExecutableBlock, error) {
+	q.Lock()
+	defer q.Unlock()
+
+	return q.onBlockExecuted(blockID, commit)
+}
+
+func (q *BlockQueue) handleKnownBlock(executable *entity.ExecutableBlock, parentFinalState *flow.StateCommitment) (
+	[]*MissingCollection, // missing collections
+	[]*entity.ExecutableBlock, // blocks ready to execute
+	error, // exceptions
+) {
+	// we have already received this block, and its parent still has not been executed yet
+	if executable.StartState == nil && parentFinalState == nil {
+		return nil, nil, nil
+	}
+
+	// this is an edge case where parentFinalState is provided, and its parent block exists
+	// in the queue but has not been marked as executed yet (OnBlockExecuted(parent) is not called),
+	// in this case, we will internally call OnBlockExecuted(parentBlockID, parentFinalState).
+	// there is no need to create the executable block again, since it's already created.
+	if executable.StartState == nil && parentFinalState != nil {
+		executables, err := q.onBlockExecuted(executable.Block.Header.ParentID, *parentFinalState)
+		if err != nil {
+			return nil, nil, fmt.Errorf("receiving block %v with parent commitment %v, but parent block %v already exists with no commitment, fail to call mark parent as executed: %w",
+				executable.ID(), *parentFinalState, executable.Block.Header.ParentID, err)
+		}
+
+		// we already have this block, its collection must have been fetched, so we only return the
+		// executables from marking its parent as executed.
+		return nil, executables, nil
+	}
+
+	// this means the caller think it's parent has not been executed, but the queue's internal state
+	// shows the parent has been executed, then it's probably a race condition where the call to
+	// inform the parent block has been executed arrives earlier than this call, which is an edge case
+	// and we can simply ignore this call.
+	if executable.StartState != nil && parentFinalState == nil {
+		q.log.Warn().
+			Str("blockID", executable.ID().String()).
+			Uint64("height", executable.Block.Header.Height).
+			Hex("parentID", executable.Block.Header.ParentID[:]).
+			Msg("edge case: receiving block with no parent commitment, but its parent block actually has been executed")
+		return nil, nil, nil
+	}
+
+	// this is an exception that should not happen
+	if *executable.StartState != *parentFinalState {
+		return nil, nil,
+			fmt.Errorf("block %s has already been executed with a different parent final state, %v != %v",
+				executable.ID(), *executable.StartState, parentFinalState)
+	}
+
+	q.log.Warn().
+		Str("blockID", executable.ID().String()).
+		Uint64("height", executable.Block.Header.Height).
+		Msg("edge case: OnBlockExecuted is called with the same arguments again")
+	return nil, nil, nil
+}
+
+func (q *BlockQueue) onBlockExecuted(
+	blockID flow.Identifier,
+	commit flow.StateCommitment,
+) ([]*entity.ExecutableBlock, error) {
+	// when a block is executed, the child block might become executable
+	// we also remove it from all the indexes
+
+	// remove block
+	block, ok := q.blocks[blockID]
+	if !ok {
+		return nil, nil
+	}
+
+	// sanity check
+	// if a block exists in the queue and is executed, then its parent block
+	// must not exist in the queue, otherwise the state is inconsistent
+	_, parentExists := q.blocks[block.Block.Header.ParentID]
+	if parentExists {
+		return nil, fmt.Errorf("parent block %s of block %s is in the queue",
+			block.Block.Header.ParentID, blockID)
+	}
+
+	delete(q.blocks, blockID)
+
+	// remove height index
+	height := block.Block.Header.Height
+	delete(q.blockIDsByHeight[height], blockID)
+	if len(q.blockIDsByHeight[height]) == 0 {
+		delete(q.blockIDsByHeight, height)
+	}
+
+	// remove colections if no other blocks include it
+	for colID := range block.CompleteCollections {
+		colInfo, ok := q.collections[colID]
+		if !ok {
+			return nil, fmt.Errorf("collection %s not found", colID)
+		}
+
+		delete(colInfo.IncludedIn, blockID)
+		if len(colInfo.IncludedIn) == 0 {
+			// no other blocks includes this collection,
+			// so this collection can be removed from the index
+			delete(q.collections, colID)
+		}
+	}
+
+	return q.checkIfChildBlockBecomeExecutable(block, commit)
+}
+
+func (q *BlockQueue) checkIfChildBlockBecomeExecutable(
+	block *entity.ExecutableBlock,
+	commit flow.StateCommitment,
+) ([]*entity.ExecutableBlock, error) {
+	childHeight := block.Block.Header.Height + 1
+	blocksAtNextHeight, ok := q.blockIDsByHeight[childHeight]
+	if !ok {
+		// no block at next height
+		return nil, nil
+	}
+
+	// find children and update their start state
+	children := make([]*entity.ExecutableBlock, 0, len(blocksAtNextHeight))
+	for _, childBlock := range blocksAtNextHeight {
+		// a child block at the next height must have the same parent ID
+		// as the current block
+		isChild := childBlock.Block.Header.ParentID == block.ID()
+		if !isChild {
+			continue
+		}
+
+		// update child block's start state with current block's end state
+		childBlock.StartState = &commit
+		children = append(children, childBlock)
+	}
+
+	if len(children) == 0 {
+		return nil, nil
+	}
+
+	// check if children are executable
+	executables := make([]*entity.ExecutableBlock, 0, len(children))
+	for _, child := range children {
+		if child.IsComplete() {
+			executables = append(executables, child)
+		}
+	}
+
+	return executables, nil
+}
+
+// GetMissingCollections returns the missing collections and the start state for the given block
+// Useful for debugging what is missing for the next unexecuted block to become executable.
+// It returns an error if the block is not found
+func (q *BlockQueue) GetMissingCollections(blockID flow.Identifier) (
+	[]*MissingCollection,
+	*flow.StateCommitment,
+	error,
+) {
+	q.Lock()
+	defer q.Unlock()
+	block, ok := q.blocks[blockID]
+	if !ok {
+		return nil, nil, fmt.Errorf("block %s not found", blockID)
+	}
+
+	missingCollections := make([]*MissingCollection, 0, len(block.Block.Payload.Guarantees))
+	for _, col := range block.CompleteCollections {
+		// check if the collection is already received
+		if col.IsCompleted() {
+			continue
+		}
+		missingCollections = append(missingCollections, missingCollectionForBlock(block, col.Guarantee))
+	}
+
+	return missingCollections, block.StartState, nil
+}
+
+func missingCollectionForBlock(block *entity.ExecutableBlock, guarantee *flow.CollectionGuarantee) *MissingCollection {
+	return &MissingCollection{
+		BlockID:   block.ID(),
+		Height:    block.Block.Header.Height,
+		Guarantee: guarantee,
+	}
+}
diff --git a/engine/execution/ingestion/block_queue/queue_test.go b/engine/execution/ingestion/block_queue/queue_test.go
new file mode 100644
index 00000000000..baf72c21162
--- /dev/null
+++ b/engine/execution/ingestion/block_queue/queue_test.go
@@ -0,0 +1,541 @@
+package block_queue
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/mempool/entity"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+func TestSingleBlockBecomeReady(t *testing.T) {
+	t.Parallel()
+	// Given a chain
+	// R <- A(C1) <- B(C2,C3) <- C() <- D()
+	// -    ^------- E(C4,C5) <- F(C6)
+	// -             ^-----------G()
+	block, coll, commitFor := makeChainABCDEFG()
+	blockA := block("A")
+	c1, c2 := coll(1), coll(2)
+
+	q := NewBlockQueue(unittest.Logger())
+
+	// verify receving a collection (C1) before its block (A) will be ignored
+	executables, err := q.HandleCollection(c1)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+
+	// verify receving a block (A) will return missing collection (C1)
+	missing, executables, err := q.HandleBlock(blockA, commitFor("R"))
+	require.NoError(t, err)
+	require.Empty(t, executables)
+	requireCollectionHas(t, missing, c1)
+
+	// verify receving a collection (C2) that is not for the block (A) will be ignored
+	executables, err = q.HandleCollection(c2)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+
+	// verify after receiving all collections (C1), block (A) becomes executable
+	executables, err = q.HandleCollection(c1)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockA)
+
+	// verify after the block (A) is executed, no more block is executable and
+	// nothing left in the queue
+	executables, err = q.OnBlockExecuted(blockA.ID(), *commitFor("A"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+	requireQueueIsEmpty(t, q)
+}
+
+func TestMultipleBlockBecomesReady(t *testing.T) {
+	t.Parallel()
+	// Given a chain
+	// R <- A(C1) <- B(C2,C3) <- C() <- D()
+	// -    ^------- E(C4,C5) <- F(C6)
+	// -             ^-----------G()
+	block, coll, commitFor := makeChainABCDEFG()
+	blockA, blockB, blockC, blockD, blockE, blockF, blockG :=
+		block("A"), block("B"), block("C"), block("D"), block("E"), block("F"), block("G")
+	c1, c2, c3, c4, c5, c6 := coll(1), coll(2), coll(3), coll(4), coll(5), coll(6)
+
+	q := NewBlockQueue(unittest.Logger())
+
+	// verify receiving blocks without collections will return missing collections and no executables
+	missing, executables, err := q.HandleBlock(blockA, commitFor("R"))
+	require.NoError(t, err)
+	require.Empty(t, executables)
+	requireCollectionHas(t, missing, c1)
+
+	missing, executables, err = q.HandleBlock(blockB, nil)
+	require.NoError(t, err)
+	require.Empty(t, executables) // because A is not executed
+	requireCollectionHas(t, missing, c2, c3)
+
+	// creating forks
+	missing, executables, err = q.HandleBlock(blockE, nil)
+	require.NoError(t, err)
+	require.Empty(t, executables) // because A is not executed
+	requireCollectionHas(t, missing, c4, c5)
+
+	// creating forks with empty block
+	missing, executables, err = q.HandleBlock(blockG, nil)
+	require.NoError(t, err)
+	require.Empty(t, executables) // because E is not executed
+	requireCollectionHas(t, missing)
+
+	missing, executables, err = q.HandleBlock(blockF, nil)
+	require.NoError(t, err)
+	require.Empty(t, executables) // because E is not executed
+	requireCollectionHas(t, missing, c6)
+
+	missing, executables, err = q.HandleBlock(blockC, nil)
+	require.NoError(t, err)
+	require.Empty(t, executables) // because B is not executed
+	require.Empty(t, missing)
+
+	// verify receiving all collections makes block executable
+	executables, err = q.HandleCollection(c1)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockA)
+
+	// verify receiving partial collections won't make block executable
+	executables, err = q.HandleCollection(c2)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables) // because A is not executed and C3 is not received for B to be executable
+
+	// verify when parent block (A) is executed, the child block (B) will not become executable if
+	// some collection (c3) is still missing
+	executables, err = q.OnBlockExecuted(blockA.ID(), *commitFor("A"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables) // because C3 is not received for B to be executable
+
+	// verify when parent block (A) has been executed, the child block (B) has all the collections
+	// it will become executable
+	executables, err = q.HandleCollection(c3)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockB) // c2, c3 are received, blockB is executable
+
+	executables, err = q.HandleCollection(c5)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables) // c2, c3 are received, blockB is executable
+
+	executables, err = q.HandleCollection(c6)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables) // c2, c3 are received, blockB is executable
+
+	executables, err = q.HandleCollection(c4)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockE) // c2, c3 are received, blockB is executable
+
+	// verify when parent block (E) is executed, all children block (F,G) will become executable if all
+	// collections (C6) have already received
+	executables, err = q.OnBlockExecuted(blockE.ID(), *commitFor("E"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockF, blockG)
+
+	executables, err = q.OnBlockExecuted(blockB.ID(), *commitFor("B"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockC)
+
+	executables, err = q.OnBlockExecuted(blockC.ID(), *commitFor("C"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+
+	// verify receiving a block whose parent was executed before
+	missing, executables, err = q.HandleBlock(blockD, commitFor("C"))
+	require.NoError(t, err)
+	require.Empty(t, missing)
+	requireExecutableHas(t, executables, blockD)
+
+	executables, err = q.OnBlockExecuted(blockD.ID(), *commitFor("D"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+
+	executables, err = q.OnBlockExecuted(blockF.ID(), *commitFor("F"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+
+	executables, err = q.OnBlockExecuted(blockG.ID(), *commitFor("G"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+
+	// verify after all blocks are executed, the queue is empty
+	requireQueueIsEmpty(t, q)
+}
+
+func TestOneReadyAndMultiplePending(t *testing.T) {
+	t.Parallel()
+	// Given a chain
+	// R() <- A() <- B(C1, C2) <- C(C3)
+	// -      ^----- D(C1, C2) <- E(C3)
+	// -      ^----- F(C1, C2, C3)
+	block, coll, commitFor := makeChainABCDEF()
+	blockA, blockB, blockC := block("A"), block("B"), block("C")
+	c1, c2, c3 := coll(1), coll(2), coll(3)
+
+	q := NewBlockQueue(unittest.Logger())
+	_, _, err := q.HandleBlock(blockA, commitFor("R"))
+	require.NoError(t, err)
+
+	// received B when A is not execured
+	missing, executables, err := q.HandleBlock(blockB, nil)
+	require.NoError(t, err)
+	require.Empty(t, executables)
+	requireCollectionHas(t, missing, c1, c2)
+
+	_, err = q.HandleCollection(c1)
+	require.NoError(t, err)
+
+	_, err = q.HandleCollection(c2)
+	require.NoError(t, err)
+
+	// received C when B is not executed
+	_, _, err = q.HandleBlock(blockC, nil)
+	require.NoError(t, err)
+
+	_, err = q.HandleCollection(c3)
+	require.NoError(t, err)
+
+	// A is executed
+	executables, err = q.OnBlockExecuted(blockA.ID(), *commitFor("A"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockB) // B is executable
+
+	// B is executed
+	executables, err = q.OnBlockExecuted(blockB.ID(), *commitFor("B"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockC) // C is executable
+}
+
+func TestOnForksWithSameCollections(t *testing.T) {
+	t.Parallel()
+	// Given a chain
+	// R() <- A() <- B(C1, C2) <- C(C3)
+	// -      ^----- D(C1, C2) <- E(C3)
+	// -      ^----- F(C1, C2, C3)
+	block, coll, commitFor := makeChainABCDEF()
+	blockA, blockB, blockC, blockD, blockE, blockF :=
+		block("A"), block("B"), block("C"), block("D"), block("E"), block("F")
+	c1, c2, c3 := coll(1), coll(2), coll(3)
+
+	q := NewBlockQueue(unittest.Logger())
+
+	missing, executables, err := q.HandleBlock(blockA, commitFor("R"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockA)
+	requireCollectionHas(t, missing)
+
+	// receiving block B and D which have the same collections (C1, C2)
+	missing, executables, err = q.HandleBlock(blockB, nil)
+	require.NoError(t, err)
+	require.Empty(t, executables)
+	requireCollectionHas(t, missing, c1, c2)
+
+	// receiving block F (C1, C2, C3)
+	missing, executables, err = q.HandleBlock(blockF, nil)
+	require.NoError(t, err)
+	require.Empty(t, executables)
+	requireCollectionHas(t, missing, c3) // c1 and c2 are requested before, only c3 is missing
+
+	// verify receiving D will not return any missing collections because
+	// missing collections were returned when receiving B
+	missing, executables, err = q.HandleBlock(blockD, nil)
+	require.NoError(t, err)
+	require.Empty(t, executables)
+	requireCollectionHas(t, missing)
+
+	// verify receiving all collections makes all blocks executable
+	executables, err = q.HandleCollection(c1)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+
+	// A is executed
+	executables, err = q.OnBlockExecuted(blockA.ID(), *commitFor("A"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables) // because C2 is not received
+
+	executables, err = q.HandleCollection(c2)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockB, blockD)
+
+	// verify if 2 blocks (C, E) having the same collections (C3), if all collections are received,
+	// but only one block (C) whose parent (B) is executed, then only that block (C) becomes executable
+	// the other block (E) is not executable
+
+	missing, executables, err = q.HandleBlock(blockC, nil)
+	require.NoError(t, err)
+	require.Empty(t, executables)
+	requireCollectionHas(t, missing) // because C3 is requested when F is received
+
+	missing, executables, err = q.HandleBlock(blockE, nil)
+	require.NoError(t, err)
+	require.Empty(t, executables)
+	requireCollectionHas(t, missing)
+
+	executables, err = q.OnBlockExecuted(blockB.ID(), *commitFor("B"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+
+	// verify C and F are executable, because their parent have been executed
+	// E is not executable, because E's parent (D) is not executed yet.
+	executables, err = q.HandleCollection(c3)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockC, blockF)
+
+	// verify when D is executed, E becomes executable
+	executables, err = q.OnBlockExecuted(blockD.ID(), *commitFor("D"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockE)
+
+	// verify the remaining blocks (C,E,F) are executed, the queue is empty
+	executables, err = q.OnBlockExecuted(blockE.ID(), *commitFor("E"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+
+	executables, err = q.OnBlockExecuted(blockF.ID(), *commitFor("F"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+
+	executables, err = q.OnBlockExecuted(blockC.ID(), *commitFor("C"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+
+	requireQueueIsEmpty(t, q)
+}
+
+func TestOnBlockWithMissingParentCommit(t *testing.T) {
+	t.Parallel()
+	// Given a chain
+	// R <- A(C1) <- B(C2,C3) <- C() <- D()
+	// -    ^------- E(C4,C5) <- F(C6)
+	// -             ^-----------G()
+
+	block, coll, commitFor := makeChainABCDEFG()
+	blockA, blockB := block("A"), block("B")
+	c1, c2, c3 := coll(1), coll(2), coll(3)
+
+	q := NewBlockQueue(unittest.Logger())
+
+	missing, executables, err := q.HandleBlock(blockA, commitFor("R"))
+	require.NoError(t, err)
+	require.Empty(t, executables)
+	requireCollectionHas(t, missing, c1)
+
+	// block A has all the collections and become executable
+	executables, err = q.HandleCollection(c1)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockA)
+
+	// the following two calls create an edge case where A is executed,
+	// and B is received, however, due to race condition, the parent commit
+	// was not saved in the database yet
+	executables, err = q.OnBlockExecuted(blockA.ID(), *commitFor("A"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+	requireQueueIsEmpty(t, q)
+
+	// verify when race condition happens, ErrMissingParent will be returned
+	_, _, err = q.HandleBlock(blockB, nil)
+	require.True(t, errors.Is(err, ErrMissingParent), err)
+
+	// verify if called again with parent commit, it will be successful
+	missing, executables, err = q.HandleBlock(blockB, commitFor("A"))
+	require.NoError(t, err)
+	require.Empty(t, executables)
+	requireCollectionHas(t, missing, c2, c3)
+
+	// verify after receiving all collections, B becomes executable
+	executables, err = q.HandleCollection(c2)
+	require.NoError(t, err)
+	require.Empty(t, executables)
+
+	executables, err = q.HandleCollection(c3)
+	require.NoError(t, err)
+	requireExecutableHas(t, executables, blockB)
+
+	// verify after B is executed, the queue is empty
+	executables, err = q.OnBlockExecuted(blockB.ID(), *commitFor("B"))
+	require.NoError(t, err)
+	requireExecutableHas(t, executables)
+	requireQueueIsEmpty(t, q)
+}
+
+/* ==== Test utils ==== */
+
+// GetBlock("A") => A
+type GetBlock func(name string) *flow.Block
+
+// GetCollection(1) => C1
+type GetCollection func(name int) *flow.Collection
+
+// GetCommit("A") => A_FinalState
+type GetCommit func(name string) *flow.StateCommitment
+
+// R <- A(C1) <- B(C2,C3) <- C() <- D()
+// -    ^------- E(C4,C5) <- F(C6)
+// -             ^-----------G()
+func makeChainABCDEFG() (GetBlock, GetCollection, GetCommit) {
+	cs := unittest.CollectionListFixture(6)
+	c1, c2, c3, c4, c5, c6 :=
+		cs[0], cs[1], cs[2], cs[3], cs[4], cs[5]
+	getCol := func(name int) *flow.Collection {
+		if name < 1 || name > len(cs) {
+			return nil
+		}
+		return cs[name-1]
+	}
+
+	r := unittest.BlockFixture()
+	blockR := &r
+	bs := unittest.ChainBlockFixtureWithRoot(blockR.Header, 4)
+	blockA, blockB, blockC, blockD := bs[0], bs[1], bs[2], bs[3]
+	unittest.AddCollectionsToBlock(blockA, []*flow.Collection{c1})
+	unittest.AddCollectionsToBlock(blockB, []*flow.Collection{c2, c3})
+	unittest.RechainBlocks(bs)
+
+	bs = unittest.ChainBlockFixtureWithRoot(blockA.Header, 2)
+	blockE, blockF := bs[0], bs[1]
+	unittest.AddCollectionsToBlock(blockE, []*flow.Collection{c4, c5})
+	unittest.AddCollectionsToBlock(blockF, []*flow.Collection{c6})
+	unittest.RechainBlocks(bs)
+
+	bs = unittest.ChainBlockFixtureWithRoot(blockE.Header, 1)
+	blockG := bs[0]
+
+	blockLookup := map[string]*flow.Block{
+		"R": blockR,
+		"A": blockA,
+		"B": blockB,
+		"C": blockC,
+		"D": blockD,
+		"E": blockE,
+		"F": blockF,
+		"G": blockG,
+	}
+
+	getBlock := func(name string) *flow.Block {
+		return blockLookup[name]
+	}
+
+	commitLookup := make(map[string]*flow.StateCommitment, len(blockLookup))
+	for name := range blockLookup {
+		commit := unittest.StateCommitmentFixture()
+		commitLookup[name] = &commit
+	}
+
+	getCommit := func(name string) *flow.StateCommitment {
+		commit, ok := commitLookup[name]
+		if !ok {
+			panic("commit not found")
+		}
+		return commit
+	}
+
+	return getBlock, getCol, getCommit
+}
+
+// R() <- A() <- B(C1, C2) <- C(C3)
+// -      ^----- D(C1, C2) <- E(C3)
+// -      ^----- F(C1, C2, C3)
+func makeChainABCDEF() (GetBlock, GetCollection, GetCommit) {
+	cs := unittest.CollectionListFixture(3)
+	c1, c2, c3 := cs[0], cs[1], cs[2]
+	getCol := func(name int) *flow.Collection {
+		if name < 1 || name > len(cs) {
+			return nil
+		}
+		return cs[name-1]
+	}
+
+	r := unittest.BlockFixture()
+	blockR := &r
+	bs := unittest.ChainBlockFixtureWithRoot(blockR.Header, 3)
+	blockA, blockB, blockC := bs[0], bs[1], bs[2]
+	unittest.AddCollectionsToBlock(blockB, []*flow.Collection{c1, c2})
+	unittest.AddCollectionsToBlock(blockC, []*flow.Collection{c3})
+	unittest.RechainBlocks(bs)
+
+	bs = unittest.ChainBlockFixtureWithRoot(blockA.Header, 2)
+	blockD, blockE := bs[0], bs[1]
+	unittest.AddCollectionsToBlock(blockD, []*flow.Collection{c1, c2})
+	unittest.AddCollectionsToBlock(blockE, []*flow.Collection{c3})
+	unittest.RechainBlocks(bs)
+
+	bs = unittest.ChainBlockFixtureWithRoot(blockA.Header, 1)
+	blockF := bs[0]
+	unittest.AddCollectionsToBlock(blockF, []*flow.Collection{c1, c2, c3})
+	unittest.RechainBlocks(bs)
+
+	blockLookup := map[string]*flow.Block{
+		"R": blockR,
+		"A": blockA,
+		"B": blockB,
+		"C": blockC,
+		"D": blockD,
+		"E": blockE,
+		"F": blockF,
+	}
+
+	getBlock := func(name string) *flow.Block {
+		return blockLookup[name]
+	}
+
+	commitLookup := make(map[string]*flow.StateCommitment, len(blockLookup))
+	for name := range blockLookup {
+		commit := unittest.StateCommitmentFixture()
+		commitLookup[name] = &commit
+	}
+
+	getCommit := func(name string) *flow.StateCommitment {
+		commit, ok := commitLookup[name]
+		if !ok {
+			panic("commit not found for " + name)
+		}
+		return commit
+	}
+
+	return getBlock, getCol, getCommit
+}
+
+func requireExecutableHas(t *testing.T, executables []*entity.ExecutableBlock, bs ...*flow.Block) {
+	blocks := make(map[flow.Identifier]*flow.Block, len(bs))
+	for _, b := range bs {
+		blocks[b.ID()] = b
+	}
+
+	for _, e := range executables {
+		_, ok := blocks[e.Block.ID()]
+		require.True(t, ok)
+		delete(blocks, e.Block.ID())
+	}
+
+	require.Equal(t, len(bs), len(executables))
+	require.Equal(t, 0, len(blocks))
+}
+
+func requireCollectionHas(t *testing.T, missing []*MissingCollection, cs ...*flow.Collection) {
+	collections := make(map[flow.Identifier]*flow.Collection, len(cs))
+	for _, c := range cs {
+		collections[c.ID()] = c
+	}
+
+	for _, m := range missing {
+		_, ok := collections[m.Guarantee.CollectionID]
+		require.True(t, ok)
+		delete(collections, m.Guarantee.CollectionID)
+	}
+
+	require.Equal(t, len(cs), len(missing))
+	require.Equal(t, 0, len(collections))
+}
+
+func requireQueueIsEmpty(t *testing.T, q *BlockQueue) {
+	require.Equal(t, 0, len(q.blocks))
+	require.Equal(t, 0, len(q.collections))
+	require.Equal(t, 0, len(q.blockIDsByHeight))
+}
diff --git a/engine/execution/ingestion/core.go b/engine/execution/ingestion/core.go
new file mode 100644
index 00000000000..ae53a0a14ba
--- /dev/null
+++ b/engine/execution/ingestion/core.go
@@ -0,0 +1,444 @@
+package ingestion
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/engine"
+	"github.com/onflow/flow-go/engine/execution"
+	"github.com/onflow/flow-go/engine/execution/ingestion/block_queue"
+	"github.com/onflow/flow-go/engine/execution/ingestion/stop"
+	"github.com/onflow/flow-go/engine/execution/state"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/mempool/entity"
+	"github.com/onflow/flow-go/storage"
+	"github.com/onflow/flow-go/utils/logging"
+)
+
+// Core connects the execution components
+// when it receives blocks and collections, it forwards them to the block queue.
+// when the block queue decides to execute blocks, it forwards to the executor for execution
+// when the block queue decides to fetch missing collections, it forwards to the collection fetcher
+// when a block is executed, it notifies the block queue and forwards to execution state to save them.
+type Core struct {
+	unit *engine.Unit // for async block execution
+
+	log zerolog.Logger
+
+	// state machine
+	blockQueue  *block_queue.BlockQueue
+	throttle    Throttle // for throttling blocks to be added to the block queue
+	execState   state.ExecutionState
+	stopControl *stop.StopControl // decide whether to execute a block or not
+
+	// data storage
+	headers     storage.Headers
+	blocks      storage.Blocks
+	collections storage.Collections
+
+	// computation, data fetching, events
+	executor          BlockExecutor
+	collectionFetcher CollectionFetcher
+	eventConsumer     EventConsumer
+}
+
+type Throttle interface {
+	Init(processables chan<- flow.Identifier) error
+	OnBlock(blockID flow.Identifier) error
+	OnBlockExecuted(blockID flow.Identifier, height uint64) error
+}
+
+type BlockExecutor interface {
+	ExecuteBlock(ctx context.Context, block *entity.ExecutableBlock) (*execution.ComputationResult, error)
+}
+
+type EventConsumer interface {
+	BeforeComputationResultSaved(ctx context.Context, result *execution.ComputationResult)
+	OnComputationResultSaved(ctx context.Context, result *execution.ComputationResult) string
+}
+
+func NewCore(
+	logger zerolog.Logger,
+	throttle Throttle,
+	execState state.ExecutionState,
+	stopControl *stop.StopControl,
+	headers storage.Headers,
+	blocks storage.Blocks,
+	collections storage.Collections,
+	executor BlockExecutor,
+	collectionFetcher CollectionFetcher,
+	eventConsumer EventConsumer,
+) *Core {
+	return &Core{
+		log:               logger.With().Str("engine", "ingestion_core").Logger(),
+		unit:              engine.NewUnit(),
+		throttle:          throttle,
+		execState:         execState,
+		blockQueue:        block_queue.NewBlockQueue(logger),
+		stopControl:       stopControl,
+		headers:           headers,
+		blocks:            blocks,
+		collections:       collections,
+		executor:          executor,
+		collectionFetcher: collectionFetcher,
+		eventConsumer:     eventConsumer,
+	}
+}
+
+func (e *Core) Ready() <-chan struct{} {
+	if e.stopControl.IsExecutionStopped() {
+		return e.unit.Ready()
+	}
+
+	e.launchWorkerToConsumeThrottledBlocks()
+
+	return e.unit.Ready()
+}
+
+func (e *Core) Done() <-chan struct{} {
+	return e.unit.Done()
+}
+
+func (e *Core) OnBlock(header *flow.Header, qc *flow.QuorumCertificate) {
+	// qc.Block is equivalent to header.ID()
+	err := e.throttle.OnBlock(qc.BlockID)
+	if err != nil {
+		e.log.Fatal().Err(err).Msgf("error processing block %v (qc.BlockID: %v, blockID: %v)",
+			header.Height, qc.BlockID, header.ID())
+	}
+}
+
+func (e *Core) OnCollection(col *flow.Collection) {
+	err := e.onCollection(col)
+	if err != nil {
+		e.log.Fatal().Err(err).Msgf("error processing collection: %v", col.ID())
+	}
+}
+
+func (e *Core) launchWorkerToConsumeThrottledBlocks() {
+	// processables are throttled blocks
+	processables := make(chan flow.Identifier, 10000)
+
+	// running worker in the background to consume
+	// processables blocks which are throttled,
+	// and forward them to the block queue for processing
+	e.unit.Launch(func() {
+		e.log.Info().Msgf("starting worker to consume throttled blocks")
+		err := e.forwardProcessableToHandler(processables)
+		if err != nil {
+			e.log.Fatal().Err(err).Msg("fail to process block")
+		}
+	})
+
+	e.log.Info().Msg("initializing throttle engine")
+
+	err := e.throttle.Init(processables)
+	if err != nil {
+		e.log.Fatal().Err(err).Msg("fail to initialize throttle engine")
+	}
+
+	e.log.Info().Msgf("throttle engine initialized")
+}
+
+func (e *Core) forwardProcessableToHandler(
+	processables <-chan flow.Identifier,
+) error {
+	for blockID := range processables {
+		err := e.onProcessableBlock(blockID)
+		if err != nil {
+			return fmt.Errorf("could not process block: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func (e *Core) onProcessableBlock(blockID flow.Identifier) error {
+	header, err := e.headers.ByBlockID(blockID)
+	if err != nil {
+		return fmt.Errorf("could not get block: %w", err)
+	}
+
+	// skip if stopControl tells to skip
+	if !e.stopControl.ShouldExecuteBlock(header) {
+		return nil
+	}
+
+	executed, err := e.execState.IsBlockExecuted(header.Height, blockID)
+	if err != nil {
+		return fmt.Errorf("could not check whether block %v is executed: %w", blockID, err)
+	}
+
+	if executed {
+		e.log.Debug().Msg("block has been executed already")
+		return nil
+	}
+
+	block, err := e.blocks.ByID(blockID)
+	if err != nil {
+		return fmt.Errorf("failed to get block %s: %w", blockID, err)
+	}
+
+	missingColls, executables, err := e.enqueuBlock(block, blockID)
+	if err != nil {
+		return fmt.Errorf("failed to enqueue block %v: %w", blockID, err)
+	}
+
+	e.executeConcurrently(executables)
+
+	err = e.fetch(missingColls)
+	if err != nil {
+		return fmt.Errorf("failed to fetch missing collections: %w", err)
+	}
+
+	return nil
+}
+
+func (e *Core) enqueuBlock(block *flow.Block, blockID flow.Identifier) (
+	[]*block_queue.MissingCollection,
+	[]*entity.ExecutableBlock,
+	error,
+) {
+	lg := e.log.With().
+		Hex("block_id", blockID[:]).
+		Uint64("height", block.Header.Height).
+		Logger()
+
+	lg.Info().Msg("handling new block")
+
+	parentCommitment, err := e.execState.StateCommitmentByBlockID(block.Header.ParentID)
+
+	if err == nil {
+		// the parent block is an executed block.
+		missingColls, executables, err := e.blockQueue.HandleBlock(block, &parentCommitment)
+		if err != nil {
+			return nil, nil, fmt.Errorf("unexpected error while adding block to block queue: %w", err)
+		}
+
+		lg.Info().Bool("parent_is_executed", true).
+			Int("missing_col", len(missingColls)).
+			Int("executables", len(executables)).
+			Msgf("block is enqueued")
+
+		return missingColls, executables, nil
+	}
+
+	// handle exception
+	if !errors.Is(err, storage.ErrNotFound) {
+		return nil, nil, fmt.Errorf("failed to get state commitment for parent block %v of block %v (height: %v): %w",
+			block.Header.ParentID, blockID, block.Header.Height, err)
+	}
+
+	// the parent block is an unexecuted block.
+	// we can enqueue the block without providing the state commitment
+	missingColls, executables, err := e.blockQueue.HandleBlock(block, nil)
+	if err != nil {
+		if !errors.Is(err, block_queue.ErrMissingParent) {
+			return nil, nil, fmt.Errorf("unexpected error while adding block to block queue: %w", err)
+		}
+
+		// if parent is missing, there are two possibilities:
+		// 1) parent was never enqueued to block queue
+		// 2) parent was enqueued, but it has been executed and removed from the block queue
+		// however, actually 1) is not possible 2) is the only possible case here, why?
+		// because forwardProcessableToHandler guarantees we always enqueue a block before its child,
+		// which means when HandleBlock is called with a block, then its parent block must have been
+		// called with HandleBlock already. Therefore, 1) is not possible.
+		// And the reason 2) is possible is because the fact that its parent block is missing
+		// might be outdated since OnBlockExecuted might be called concurrently in a different thread.
+		// it means OnBlockExecuted is called in a different thread after us getting the parent commit
+		// and before HandleBlock was called, therefore, we should re-enqueue the block with the
+		// parent commit. It's necessary to check again whether the parent block is executed after the call.
+		lg.Warn().Msgf(
+			"block is missing parent block, re-enqueueing %v (parent: %v)",
+			blockID, block.Header.ParentID,
+		)
+
+		parentCommitment, err := e.execState.StateCommitmentByBlockID(block.Header.ParentID)
+		if err != nil {
+			return nil, nil, fmt.Errorf("failed to get parent state commitment when re-enqueue block %v (parent: %v): %w",
+				blockID, block.Header.ParentID, err)
+		}
+
+		// now re-enqueue the block with parent commit
+		missing, execs, err := e.blockQueue.HandleBlock(block, &parentCommitment)
+		if err != nil {
+			return nil, nil, fmt.Errorf("unexpected error while reenqueue block to block queue: %w", err)
+		}
+
+		missingColls = flow.Deduplicate(append(missingColls, missing...))
+		executables = flow.Deduplicate(append(executables, execs...))
+	}
+
+	lg.Info().Bool("parent_is_executed", false).
+		Int("missing_col", len(missingColls)).
+		Int("executables", len(executables)).
+		Msgf("block is enqueued")
+
+	return missingColls, executables, nil
+}
+
+func (e *Core) onBlockExecuted(
+	block *entity.ExecutableBlock,
+	computationResult *execution.ComputationResult,
+	startedAt time.Time,
+) error {
+	commit := computationResult.CurrentEndState()
+
+	wg := sync.WaitGroup{}
+	wg.Add(1)
+	defer wg.Wait()
+
+	go func() {
+		defer wg.Done()
+		e.eventConsumer.BeforeComputationResultSaved(e.unit.Ctx(), computationResult)
+	}()
+
+	err := e.execState.SaveExecutionResults(e.unit.Ctx(), computationResult)
+	if err != nil {
+		return fmt.Errorf("cannot persist execution state: %w", err)
+	}
+
+	// must call OnBlockExecuted AFTER saving the execution result to storage
+	// because when enqueuing a block, we rely on execState.StateCommitmentByBlockID
+	// to determine whether a block has been executed or not.
+	executables, err := e.blockQueue.OnBlockExecuted(block.ID(), commit)
+	if err != nil {
+		return fmt.Errorf("unexpected error while marking block as executed: %w", err)
+	}
+
+	e.stopControl.OnBlockExecuted(block.Block.Header)
+
+	// notify event consumer so that the event consumer can do tasks
+	// such as broadcasting or uploading the result
+	logs := e.eventConsumer.OnComputationResultSaved(e.unit.Ctx(), computationResult)
+
+	receipt := computationResult.ExecutionReceipt
+	e.log.Info().
+		Hex("block_id", logging.Entity(block)).
+		Uint64("height", block.Block.Header.Height).
+		Int("collections", len(block.CompleteCollections)).
+		Hex("parent_block", block.Block.Header.ParentID[:]).
+		Int("collections", len(block.Block.Payload.Guarantees)).
+		Hex("start_state", block.StartState[:]).
+		Hex("final_state", commit[:]).
+		Hex("receipt_id", logging.Entity(receipt)).
+		Hex("result_id", logging.Entity(receipt.ExecutionResult)).
+		Hex("execution_data_id", receipt.ExecutionResult.ExecutionDataID[:]).
+		Bool("state_changed", commit != *block.StartState).
+		Uint64("num_txs", nonSystemTransactionCount(receipt.ExecutionResult)).
+		Int64("timeSpentInMS", time.Since(startedAt).Milliseconds()).
+		Str("logs", logs). // broadcasted
+		Msgf("block executed")
+
+	// we ensures that the child blocks are only executed after the execution result of
+	// its parent block has been successfully saved to storage.
+	// this ensures OnBlockExecuted would not be called with blocks in a wrong order, such as
+	// OnBlockExecuted(childBlock) being called before OnBlockExecuted(parentBlock).
+	e.executeConcurrently(executables)
+
+	return nil
+}
+
+func (e *Core) onCollection(col *flow.Collection) error {
+	// EN might request a collection from multiple collection nodes,
+	// therefore might receive multiple copies of the same collection.
+	// we only need to store it once.
+	err := storeCollectionIfMissing(e.collections, col)
+	if err != nil {
+		return fmt.Errorf("failed to store collection %v: %w", col.ID(), err)
+	}
+
+	// if the collection is a duplication, it's still good to add it to the block queue,
+	// because chances are the collection was stored before a restart, and
+	// is not in the queue after the restart.
+	// adding it to the queue ensures we don't miss any collection.
+	// since the queue's state is in memory, processing a duplicated collection should be
+	// a fast no-op, and won't return any executable blocks.
+	executables, err := e.blockQueue.HandleCollection(col)
+	if err != nil {
+		return fmt.Errorf("unexpected error while adding collection to block queue")
+	}
+
+	e.executeConcurrently(executables)
+
+	return nil
+}
+
+func storeCollectionIfMissing(collections storage.Collections, col *flow.Collection) error {
+	_, err := collections.ByID(col.ID())
+	if err != nil {
+		if !errors.Is(err, storage.ErrNotFound) {
+			return fmt.Errorf("failed to get collection %v: %w", col.ID(), err)
+		}
+
+		err := collections.Store(col)
+		if err != nil {
+			return fmt.Errorf("failed to store collection %v: %w", col.ID(), err)
+		}
+	}
+
+	return nil
+}
+
+// execute block concurrently
+func (e *Core) executeConcurrently(executables []*entity.ExecutableBlock) {
+	for _, executable := range executables {
+		func(executable *entity.ExecutableBlock) {
+			e.unit.Launch(func() {
+				e.log.Info().Msgf("starting worker to consume throttled blocks")
+				err := e.execute(executable)
+				if err != nil {
+					e.log.Error().Err(err).Msgf("failed to execute block %v", executable.Block.ID())
+				}
+			})
+		}(executable)
+	}
+}
+
+func (e *Core) execute(executable *entity.ExecutableBlock) error {
+	if !e.stopControl.ShouldExecuteBlock(executable.Block.Header) {
+		return nil
+	}
+
+	e.log.Info().
+		Hex("block_id", logging.Entity(executable)).
+		Uint64("height", executable.Block.Header.Height).
+		Int("collections", len(executable.CompleteCollections)).
+		Msgf("executing block")
+
+	startedAt := time.Now()
+
+	result, err := e.executor.ExecuteBlock(e.unit.Ctx(), executable)
+	if err != nil {
+		return fmt.Errorf("failed to execute block %v: %w", executable.Block.ID(), err)
+	}
+
+	err = e.onBlockExecuted(executable, result, startedAt)
+	if err != nil {
+		return fmt.Errorf("failed to handle execution result of block %v: %w", executable.Block.ID(), err)
+	}
+
+	return nil
+}
+
+func (e *Core) fetch(missingColls []*block_queue.MissingCollection) error {
+	for _, col := range missingColls {
+		err := e.collectionFetcher.FetchCollection(col.BlockID, col.Height, col.Guarantee)
+		if err != nil {
+			return fmt.Errorf("failed to fetch collection %v for block %v (height: %v): %w",
+				col.Guarantee.ID(), col.BlockID, col.Height, err)
+		}
+	}
+
+	if len(missingColls) > 0 {
+		e.collectionFetcher.Force()
+	}
+
+	return nil
+}
diff --git a/engine/execution/ingestion/engine.go b/engine/execution/ingestion/engine.go
index eb73f9ef04f..560e695f8d8 100644
--- a/engine/execution/ingestion/engine.go
+++ b/engine/execution/ingestion/engine.go
@@ -205,7 +205,8 @@ func (e *Engine) BlockProcessable(b *flow.Header, _ *flow.QuorumCertificate) {
 
 	// TODO: this should not be blocking: https://github.com/onflow/flow-go/issues/4400
 
-	// skip if stopControl tells to skip
+	// skip if stopControl tells to skip, so that we can avoid fetching collections
+	// for this block
 	if !e.stopControl.ShouldExecuteBlock(b) {
 		return
 	}
@@ -363,6 +364,12 @@ func (e *Engine) executeBlock(
 	ctx context.Context,
 	executableBlock *entity.ExecutableBlock,
 ) {
+
+	// don't execute the block if the stop control says no
+	if !e.stopControl.ShouldExecuteBlock(executableBlock.Block.Header) {
+		return
+	}
+
 	lg := e.log.With().
 		Hex("block_id", logging.Entity(executableBlock)).
 		Uint64("height", executableBlock.Block.Header.Height).
@@ -445,6 +452,8 @@ func (e *Engine) executeBlock(
 		Int64("timeSpentInMS", time.Since(startedAt).Milliseconds()).
 		Msg("block executed")
 
+	e.stopControl.OnBlockExecuted(executableBlock.Block.Header)
+
 	err = e.onBlockExecuted(executableBlock, finalEndState)
 	if err != nil {
 		lg.Err(err).Msg("failed in process block's children")
@@ -454,8 +463,6 @@ func (e *Engine) executeBlock(
 		e.executionDataPruner.NotifyFulfilledHeight(executableBlock.Height())
 	}
 
-	e.stopControl.OnBlockExecuted(executableBlock.Block.Header)
-
 	e.unit.Ctx()
 
 }
@@ -492,8 +499,6 @@ func (e *Engine) onBlockExecuted(
 	e.metrics.ExecutionStorageStateCommitment(int64(len(finalState)))
 	e.metrics.ExecutionLastExecutedBlockHeight(executed.Block.Header.Height)
 
-	// e.checkStateSyncStop(executed.Block.Header.Height)
-
 	missingCollections := make(map[*entity.ExecutableBlock][]*flow.CollectionGuarantee)
 	err := e.mempool.Run(
 		func(
diff --git a/engine/execution/ingestion/engine_test.go b/engine/execution/ingestion/engine_test.go
index de3e88fec69..b7d5a3665d6 100644
--- a/engine/execution/ingestion/engine_test.go
+++ b/engine/execution/ingestion/engine_test.go
@@ -79,7 +79,7 @@ func runWithEngine(t *testing.T, f func(testingContext)) {
 	var engine *Engine
 
 	defer func() {
-		<-engine.Done()
+		unittest.AssertClosesBefore(t, engine.Done(), 5*time.Second, "expect to stop before timeout")
 		computationManager.AssertExpectations(t)
 		protocolState.AssertExpectations(t)
 		executionState.AssertExpectations(t)
diff --git a/engine/execution/ingestion/fetcher/fetcher.go b/engine/execution/ingestion/fetcher/fetcher.go
index 036784a2bbb..4c525570d14 100644
--- a/engine/execution/ingestion/fetcher/fetcher.go
+++ b/engine/execution/ingestion/fetcher/fetcher.go
@@ -55,8 +55,8 @@ func (e *CollectionFetcher) FetchCollection(blockID flow.Identifier, height uint
 		return fmt.Errorf("could not find guarantors: %w", err)
 	}
 
-	filters := []flow.IdentityFilter{
-		filter.HasNodeID(guarantors...),
+	filters := []flow.IdentityFilter[flow.Identity]{
+		filter.HasNodeID[flow.Identity](guarantors...),
 	}
 
 	// This is included to temporarily work around an issue observed on a small number of ENs.
diff --git a/engine/execution/ingestion/fetcher/fetcher_test.go b/engine/execution/ingestion/fetcher/fetcher_test.go
index 83ad42b66e3..45b075cbe17 100644
--- a/engine/execution/ingestion/fetcher/fetcher_test.go
+++ b/engine/execution/ingestion/fetcher/fetcher_test.go
@@ -30,7 +30,7 @@ func TestFetch(t *testing.T) {
 
 	// mock depedencies
 	cluster := new(statemock.Cluster)
-	cluster.On("Members").Return(nodes)
+	cluster.On("Members").Return(nodes.ToSkeleton())
 	epoch := new(statemock.Epoch)
 	epoch.On("ClusterByChainID", guarantee.ChainID).Return(cluster, nil)
 	epochs := new(statemock.EpochQuery)
@@ -41,10 +41,10 @@ func TestFetch(t *testing.T) {
 	state.On("AtBlockID", guarantee.ReferenceBlockID).Return(snapshot).Times(1)
 
 	request := new(modulemock.Requester)
-	var filter flow.IdentityFilter
-	request.On("EntityByID", guarantee.CollectionID, mock.AnythingOfType("flow.IdentityFilter")).Run(
+	var filter flow.IdentityFilter[flow.Identity]
+	request.On("EntityByID", guarantee.CollectionID, mock.Anything).Run(
 		func(args mock.Arguments) {
-			filter = args.Get(1).(flow.IdentityFilter)
+			filter = args.Get(1).(flow.IdentityFilter[flow.Identity])
 		},
 	).Return().Times(1)
 
diff --git a/engine/execution/ingestion/loader/unexecuted_loader.go b/engine/execution/ingestion/loader/unexecuted_loader.go
index 7d32ba11ec4..6e2dd273452 100644
--- a/engine/execution/ingestion/loader/unexecuted_loader.go
+++ b/engine/execution/ingestion/loader/unexecuted_loader.go
@@ -58,10 +58,7 @@ func (e *UnexecutedLoader) LoadUnexecuted(ctx context.Context) ([]flow.Identifie
 	}
 
 	// don't reload root block
-	rootBlock, err := e.state.Params().SealedRoot()
-	if err != nil {
-		return nil, fmt.Errorf("failed to retrieve root block: %w", err)
-	}
+	rootBlock := e.state.Params().SealedRoot()
 
 	blockIDs := make([]flow.Identifier, 0)
 	isRoot := rootBlock.ID() == last.ID()
@@ -151,10 +148,7 @@ func (e *UnexecutedLoader) finalizedUnexecutedBlocks(ctx context.Context, finali
 
 	// dynamically bootstrapped execution node will reload blocks from
 	// [sealedRoot.Height + 1, finalizedRoot.Height] and execute them on startup.
-	rootBlock, err := e.state.Params().SealedRoot()
-	if err != nil {
-		return nil, fmt.Errorf("failed to retrieve root block: %w", err)
-	}
+	rootBlock := e.state.Params().SealedRoot()
 
 	for ; lastExecuted > rootBlock.Height; lastExecuted-- {
 		finalizedID, err := e.headers.BlockIDByHeight(lastExecuted)
diff --git a/engine/execution/ingestion/stop/stop_control_test.go b/engine/execution/ingestion/stop/stop_control_test.go
index 12900d56dad..759c3de8e9a 100644
--- a/engine/execution/ingestion/stop/stop_control_test.go
+++ b/engine/execution/ingestion/stop/stop_control_test.go
@@ -865,9 +865,11 @@ func Test_StopControlWorkers(t *testing.T) {
 func TestPatchedVersion(t *testing.T) {
 	require.True(t, semver.New("0.31.20").LessThan(*semver.New("0.31.21")))
 	require.True(t, semver.New("0.31.20-patch.1").LessThan(*semver.New("0.31.20"))) // be careful with this one
-	require.True(t, semver.New("0.31.20-without-netgo").LessThan(*semver.New("0.31.20")))
+	require.True(t, semver.New("0.31.20-without-adx").LessThan(*semver.New("0.31.20")))
 
 	// a special build created with "+" would not change the version priority for standard and pre-release versions
-	require.True(t, semver.New("0.31.20+without-netgo").Equal(*semver.New("0.31.20")))
-	require.True(t, semver.New("0.31.20-patch.1+without-netgo").Equal(*semver.New("0.31.20-patch.1")))
+	require.True(t, semver.New("0.31.20+without-adx").Equal(*semver.New("0.31.20")))
+	require.True(t, semver.New("0.31.20-patch.1+without-adx").Equal(*semver.New("0.31.20-patch.1")))
+	require.True(t, semver.New("0.31.20+without-netgo-without-adx").Equal(*semver.New("0.31.20")))
+	require.True(t, semver.New("0.31.20+arm").Equal(*semver.New("0.31.20")))
 }
diff --git a/engine/execution/ingestion/throttle.go b/engine/execution/ingestion/throttle.go
new file mode 100644
index 00000000000..a92566b6660
--- /dev/null
+++ b/engine/execution/ingestion/throttle.go
@@ -0,0 +1,249 @@
+package ingestion
+
+import (
+	"fmt"
+	"sync"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/engine/execution/state"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/storage"
+)
+
+// DefaultCatchUpThreshold is the number of blocks that if the execution is far behind
+// the finalization then we will only lazy load the next unexecuted finalized
+// blocks until the execution has caught up
+const DefaultCatchUpThreshold = 500
+
+// BlockThrottle is a helper struct that helps throttle the unexecuted blocks to be sent
+// to the block queue for execution.
+// It is useful for case when execution is falling far behind the finalization, in which case
+// we want to throttle the blocks to be sent to the block queue for fetching data to execute
+// them. Without throttle, the block queue will be flooded with blocks, and the network
+// will be flooded with requests fetching collections, and the EN might quickly run out of memory.
+type BlockThrottle struct {
+	// config
+	threshold int // catch up threshold
+
+	// state
+	mu        sync.Mutex
+	executed  uint64
+	finalized uint64
+
+	// notifier
+	processables chan<- flow.Identifier
+
+	// dependencies
+	log     zerolog.Logger
+	state   protocol.State
+	headers storage.Headers
+}
+
+func NewBlockThrottle(
+	log zerolog.Logger,
+	state protocol.State,
+	execState state.ExecutionState,
+	headers storage.Headers,
+	catchupThreshold int,
+) (*BlockThrottle, error) {
+	finalizedHead, err := state.Final().Head()
+	if err != nil {
+		return nil, fmt.Errorf("could not get finalized head: %w", err)
+	}
+
+	finalized := finalizedHead.Height
+	// TODO: implement GetHighestFinalizedExecuted for execution state when storehouse
+	// is not used
+	executed := execState.GetHighestFinalizedExecuted()
+
+	if executed > finalized {
+		return nil, fmt.Errorf("executed finalized %v is greater than finalized %v", executed, finalized)
+	}
+
+	return &BlockThrottle{
+		threshold: catchupThreshold,
+		executed:  executed,
+		finalized: finalized,
+
+		log:     log.With().Str("component", "block_throttle").Logger(),
+		state:   state,
+		headers: headers,
+	}, nil
+}
+
+// inited returns true if the throttle has been inited
+func (c *BlockThrottle) inited() bool {
+	return c.processables != nil
+}
+
+func (c *BlockThrottle) Init(processables chan<- flow.Identifier) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.inited() {
+		return fmt.Errorf("throttle already inited")
+	}
+
+	c.processables = processables
+
+	var unexecuted []flow.Identifier
+	var err error
+	if caughtUp(c.executed, c.finalized, c.threshold) {
+		unexecuted, err = findAllUnexecutedBlocks(c.state, c.headers, c.executed, c.finalized)
+		if err != nil {
+			return err
+		}
+		c.log.Info().Msgf("loaded %d unexecuted blocks", len(unexecuted))
+	} else {
+		unexecuted, err = findFinalized(c.state, c.headers, c.executed, c.executed+uint64(c.threshold))
+		if err != nil {
+			return err
+		}
+		c.log.Info().Msgf("loaded %d unexecuted finalized blocks", len(unexecuted))
+	}
+
+	c.log.Info().Msgf("throttle initializing with %d unexecuted blocks", len(unexecuted))
+
+	// the ingestion core engine must have initialized the 'processables' with 10000 (default) buffer size,
+	// and the 'unexecuted' will only contain up to DefaultCatchUpThreshold (500) blocks,
+	// so pushing all the unexecuted to processables won't be blocked.
+	for _, id := range unexecuted {
+		c.processables <- id
+	}
+
+	c.log.Info().Msgf("throttle initialized with %d unexecuted blocks", len(unexecuted))
+
+	return nil
+}
+
+func (c *BlockThrottle) OnBlockExecuted(_ flow.Identifier, executed uint64) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if !c.inited() {
+		return fmt.Errorf("throttle not inited")
+	}
+
+	// we have already caught up, ignore
+	if c.caughtUp() {
+		return nil
+	}
+
+	// the execution is still far behind from finalization
+	c.executed = executed
+	if !c.caughtUp() {
+		return nil
+	}
+
+	c.log.Info().Uint64("executed", executed).Uint64("finalized", c.finalized).
+		Msgf("execution has caught up, processing remaining unexecuted blocks")
+
+	// if the execution have just caught up close enough to the latest finalized blocks,
+	// then process all unexecuted blocks, including finalized unexecuted and pending unexecuted
+	unexecuted, err := findAllUnexecutedBlocks(c.state, c.headers, c.executed, c.finalized)
+	if err != nil {
+		return fmt.Errorf("could not find unexecuted blocks for processing: %w", err)
+	}
+
+	c.log.Info().Int("unexecuted", len(unexecuted)).Msgf("forwarding unexecuted blocks")
+
+	for _, id := range unexecuted {
+		c.processables <- id
+	}
+
+	c.log.Info().Msgf("all unexecuted blocks have been processed")
+
+	return nil
+}
+
+func (c *BlockThrottle) OnBlock(blockID flow.Identifier) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.log.Debug().Msgf("recieved block (%v)", blockID)
+
+	if !c.inited() {
+		return fmt.Errorf("throttle not inited")
+	}
+
+	// ignore the block if has not caught up.
+	if !c.caughtUp() {
+		return nil
+	}
+
+	// if has caught up, then process the block
+	c.processables <- blockID
+	c.log.Debug().Msgf("processed block (%v)", blockID)
+
+	return nil
+}
+
+func (c *BlockThrottle) OnBlockFinalized(lastFinalized *flow.Header) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if !c.inited() {
+		return
+	}
+
+	if c.caughtUp() {
+		return
+	}
+
+	if lastFinalized.Height <= c.finalized {
+		return
+	}
+
+	c.finalized = lastFinalized.Height
+}
+
+func (c *BlockThrottle) caughtUp() bool {
+	return caughtUp(c.executed, c.finalized, c.threshold)
+}
+
+func caughtUp(executed, finalized uint64, threshold int) bool {
+	return finalized <= executed+uint64(threshold)
+}
+
+func findFinalized(state protocol.State, headers storage.Headers, lastExecuted, finalizedHeight uint64) ([]flow.Identifier, error) {
+	// get finalized height
+	finalized := state.AtHeight(finalizedHeight)
+	final, err := finalized.Head()
+	if err != nil {
+		return nil, fmt.Errorf("could not get finalized block: %w", err)
+	}
+
+	// dynamically bootstrapped execution node will have highest finalized executed as sealed root,
+	// which is lower than finalized root. so we will reload blocks from
+	// [sealedRoot.Height + 1, finalizedRoot.Height] and execute them on startup.
+	unexecutedFinalized := make([]flow.Identifier, 0)
+
+	// starting from the first unexecuted block, go through each unexecuted and finalized block
+	// reload its block to execution queues
+	// loading finalized blocks
+	for height := lastExecuted + 1; height <= final.Height; height++ {
+		finalizedID, err := headers.BlockIDByHeight(height)
+		if err != nil {
+			return nil, fmt.Errorf("could not get block ID by height %v: %w", height, err)
+		}
+
+		unexecutedFinalized = append(unexecutedFinalized, finalizedID)
+	}
+
+	return unexecutedFinalized, nil
+}
+
+func findAllUnexecutedBlocks(state protocol.State, headers storage.Headers, lastExecuted, finalizedHeight uint64) ([]flow.Identifier, error) {
+	unexecutedFinalized, err := findFinalized(state, headers, lastExecuted, finalizedHeight)
+	if err != nil {
+		return nil, fmt.Errorf("could not find finalized unexecuted blocks: %w", err)
+	}
+
+	// loaded all pending blocks
+	pendings, err := state.AtHeight(finalizedHeight).Descendants()
+	if err != nil {
+		return nil, fmt.Errorf("could not get descendants of finalized block: %w", err)
+	}
+
+	unexecuted := append(unexecutedFinalized, pendings...)
+	return unexecuted, nil
+}
diff --git a/engine/execution/ingestion/throttle_test.go b/engine/execution/ingestion/throttle_test.go
new file mode 100644
index 00000000000..a2d8911b109
--- /dev/null
+++ b/engine/execution/ingestion/throttle_test.go
@@ -0,0 +1,16 @@
+package ingestion
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCaughtUp(t *testing.T) {
+	require.True(t, caughtUp(100, 200, 500))
+	require.True(t, caughtUp(100, 100, 500))
+	require.True(t, caughtUp(100, 600, 500))
+
+	require.False(t, caughtUp(100, 601, 500))
+	require.False(t, caughtUp(100, 602, 500))
+}
diff --git a/engine/execution/mock/script_executor.go b/engine/execution/mock/script_executor.go
index 658b10db2cb..ddeb77ce3e7 100644
--- a/engine/execution/mock/script_executor.go
+++ b/engine/execution/mock/script_executor.go
@@ -16,12 +16,13 @@ type ScriptExecutor struct {
 }
 
 // ExecuteScriptAtBlockID provides a mock function with given fields: ctx, script, arguments, blockID
-func (_m *ScriptExecutor) ExecuteScriptAtBlockID(ctx context.Context, script []byte, arguments [][]byte, blockID flow.Identifier) ([]byte, error) {
+func (_m *ScriptExecutor) ExecuteScriptAtBlockID(ctx context.Context, script []byte, arguments [][]byte, blockID flow.Identifier) ([]byte, uint64, error) {
 	ret := _m.Called(ctx, script, arguments, blockID)
 
 	var r0 []byte
-	var r1 error
-	if rf, ok := ret.Get(0).(func(context.Context, []byte, [][]byte, flow.Identifier) ([]byte, error)); ok {
+	var r1 uint64
+	var r2 error
+	if rf, ok := ret.Get(0).(func(context.Context, []byte, [][]byte, flow.Identifier) ([]byte, uint64, error)); ok {
 		return rf(ctx, script, arguments, blockID)
 	}
 	if rf, ok := ret.Get(0).(func(context.Context, []byte, [][]byte, flow.Identifier) []byte); ok {
@@ -32,13 +33,19 @@ func (_m *ScriptExecutor) ExecuteScriptAtBlockID(ctx context.Context, script []b
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func(context.Context, []byte, [][]byte, flow.Identifier) error); ok {
+	if rf, ok := ret.Get(1).(func(context.Context, []byte, [][]byte, flow.Identifier) uint64); ok {
 		r1 = rf(ctx, script, arguments, blockID)
 	} else {
-		r1 = ret.Error(1)
+		r1 = ret.Get(1).(uint64)
 	}
 
-	return r0, r1
+	if rf, ok := ret.Get(2).(func(context.Context, []byte, [][]byte, flow.Identifier) error); ok {
+		r2 = rf(ctx, script, arguments, blockID)
+	} else {
+		r2 = ret.Error(2)
+	}
+
+	return r0, r1, r2
 }
 
 // GetAccount provides a mock function with given fields: ctx, address, blockID
diff --git a/engine/execution/provider/engine.go b/engine/execution/provider/engine.go
index f70712ba10d..4a428536076 100644
--- a/engine/execution/provider/engine.go
+++ b/engine/execution/provider/engine.go
@@ -29,12 +29,25 @@ import (
 
 type ProviderEngine interface {
 	network.MessageProcessor
+	module.ReadyDoneAware
 	// BroadcastExecutionReceipt broadcasts an execution receipt to all nodes in the network.
 	// It skips broadcasting the receipt if the block is sealed, or the node is not authorized at the block.
 	// It returns true if the receipt is broadcasted, false otherwise.
 	BroadcastExecutionReceipt(context.Context, uint64, *flow.ExecutionReceipt) (bool, error)
 }
 
+type NoopEngine struct {
+	module.NoopReadyDoneAware
+}
+
+func (*NoopEngine) Process(channel channels.Channel, originID flow.Identifier, message interface{}) error {
+	return nil
+}
+
+func (*NoopEngine) BroadcastExecutionReceipt(context.Context, uint64, *flow.ExecutionReceipt) (bool, error) {
+	return false, nil
+}
+
 const (
 	// DefaultChunkDataPackRequestWorker is the default number of concurrent workers processing chunk data pack requests on
 	// execution nodes.
@@ -46,6 +59,8 @@ const (
 	DefaultChunkDataPackDeliveryTimeout = 10 * time.Second
 )
 
+var _ ProviderEngine = (*Engine)(nil)
+
 // An Engine provides means of accessing data about execution state and broadcasts execution receipts to nodes in the network.
 // Also generates and saves execution receipts
 type Engine struct {
@@ -398,7 +413,7 @@ func (e *Engine) BroadcastExecutionReceipt(ctx context.Context, height uint64, r
 		Hex("final_state", finalState[:]).
 		Msg("broadcasting execution receipt")
 
-	identities, err := e.state.Final().Identities(filter.HasRole(flow.RoleAccess, flow.RoleConsensus,
+	identities, err := e.state.Final().Identities(filter.HasRole[flow.Identity](flow.RoleAccess, flow.RoleConsensus,
 		flow.RoleVerification))
 	if err != nil {
 		return false, fmt.Errorf("could not get consensus and verification identities: %w", err)
diff --git a/engine/execution/provider/mock/provider_engine.go b/engine/execution/provider/mock/provider_engine.go
index f81c7e22d15..5271f59c946 100644
--- a/engine/execution/provider/mock/provider_engine.go
+++ b/engine/execution/provider/mock/provider_engine.go
@@ -41,6 +41,22 @@ func (_m *ProviderEngine) BroadcastExecutionReceipt(_a0 context.Context, _a1 uin
 	return r0, r1
 }
 
+// Done provides a mock function with given fields:
+func (_m *ProviderEngine) Done() <-chan struct{} {
+	ret := _m.Called()
+
+	var r0 <-chan struct{}
+	if rf, ok := ret.Get(0).(func() <-chan struct{}); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(<-chan struct{})
+		}
+	}
+
+	return r0
+}
+
 // Process provides a mock function with given fields: channel, originID, message
 func (_m *ProviderEngine) Process(channel channels.Channel, originID flow.Identifier, message interface{}) error {
 	ret := _m.Called(channel, originID, message)
@@ -55,6 +71,22 @@ func (_m *ProviderEngine) Process(channel channels.Channel, originID flow.Identi
 	return r0
 }
 
+// Ready provides a mock function with given fields:
+func (_m *ProviderEngine) Ready() <-chan struct{} {
+	ret := _m.Called()
+
+	var r0 <-chan struct{}
+	if rf, ok := ret.Get(0).(func() <-chan struct{}); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(<-chan struct{})
+		}
+	}
+
+	return r0
+}
+
 type mockConstructorTestingTNewProviderEngine interface {
 	mock.TestingT
 	Cleanup(func())
diff --git a/engine/execution/rpc/engine.go b/engine/execution/rpc/engine.go
index a1015cc18e6..2f9d12c47db 100644
--- a/engine/execution/rpc/engine.go
+++ b/engine/execution/rpc/engine.go
@@ -197,7 +197,7 @@ func (h *handler) ExecuteScriptAtBlockID(
 		return nil, status.Errorf(codes.Internal, "state commitment for block ID %s could not be retrieved", blockID)
 	}
 
-	value, err := h.engine.ExecuteScriptAtBlockID(ctx, req.GetScript(), req.GetArguments(), blockID)
+	value, compUsage, err := h.engine.ExecuteScriptAtBlockID(ctx, req.GetScript(), req.GetArguments(), blockID)
 	if err != nil {
 		// todo check the error code instead
 		// return code 3 as this passes the litmus test in our context
@@ -205,7 +205,8 @@ func (h *handler) ExecuteScriptAtBlockID(
 	}
 
 	res := &execution.ExecuteScriptAtBlockIDResponse{
-		Value: value,
+		Value:            value,
+		ComputationUsage: compUsage,
 	}
 
 	return res, nil
diff --git a/engine/execution/rpc/engine_test.go b/engine/execution/rpc/engine_test.go
index d2f3913123a..d1924560094 100644
--- a/engine/execution/rpc/engine_test.go
+++ b/engine/execution/rpc/engine_test.go
@@ -70,14 +70,16 @@ func (suite *Suite) TestExecuteScriptAtBlockID() {
 		Script:  script,
 	}
 	scriptExecValue := []byte{9, 10, 11}
+	computationUsage := uint64(11)
 	executionResp := execution.ExecuteScriptAtBlockIDResponse{
-		Value: scriptExecValue,
+		Value:            scriptExecValue,
+		ComputationUsage: computationUsage,
 	}
 
 	suite.Run("happy path with successful script execution", func() {
 		suite.commits.On("ByBlockID", mockIdentifier).Return(nil, nil).Once()
 		mockEngine.On("ExecuteScriptAtBlockID", ctx, script, arguments, mockIdentifier).
-			Return(scriptExecValue, nil).Once()
+			Return(scriptExecValue, computationUsage, nil).Once()
 		response, err := handler.ExecuteScriptAtBlockID(ctx, &executionReq)
 		suite.Require().NoError(err)
 		suite.Require().Equal(&executionResp, response)
@@ -94,7 +96,7 @@ func (suite *Suite) TestExecuteScriptAtBlockID() {
 	suite.Run("valid request with script execution failure", func() {
 		suite.commits.On("ByBlockID", mockIdentifier).Return(nil, nil).Once()
 		mockEngine.On("ExecuteScriptAtBlockID", ctx, script, arguments, mockIdentifier).
-			Return(nil, status.Error(codes.InvalidArgument, "")).Once()
+			Return(nil, uint64(0), status.Error(codes.InvalidArgument, "")).Once()
 		_, err := handler.ExecuteScriptAtBlockID(ctx, &executionReq)
 		suite.Require().Error(err)
 		errors.Is(err, status.Error(codes.InvalidArgument, ""))
diff --git a/engine/execution/scripts/engine.go b/engine/execution/scripts/engine.go
index ea46f273d73..409bf23fec8 100644
--- a/engine/execution/scripts/engine.go
+++ b/engine/execution/scripts/engine.go
@@ -48,11 +48,11 @@ func (e *Engine) ExecuteScriptAtBlockID(
 	script []byte,
 	arguments [][]byte,
 	blockID flow.Identifier,
-) ([]byte, error) {
+) ([]byte, uint64, error) {
 
 	blockSnapshot, header, err := e.execState.CreateStorageSnapshot(blockID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create storage snapshot: %w", err)
+		return nil, 0, fmt.Errorf("failed to create storage snapshot: %w", err)
 	}
 
 	return e.queryExecutor.ExecuteScript(
diff --git a/engine/execution/state/bootstrap/bootstrap.go b/engine/execution/state/bootstrap/bootstrap.go
index 97656092d09..324155458a4 100644
--- a/engine/execution/state/bootstrap/bootstrap.go
+++ b/engine/execution/state/bootstrap/bootstrap.go
@@ -51,6 +51,8 @@ func (b *Bootstrapper) BootstrapLedger(
 		fvm.WithLogger(b.logger),
 		fvm.WithMaxStateInteractionSize(ledgerIntractionLimitNeededForBootstrapping),
 		fvm.WithChain(chain),
+		// TODO (JanezP): move this deeper
+		fvm.WithEVMEnabled(true),
 	)
 
 	bootstrap := fvm.Bootstrap(
diff --git a/engine/execution/state/bootstrap/bootstrap_test.go b/engine/execution/state/bootstrap/bootstrap_test.go
index 7ef8bc35d84..68751e41772 100644
--- a/engine/execution/state/bootstrap/bootstrap_test.go
+++ b/engine/execution/state/bootstrap/bootstrap_test.go
@@ -53,7 +53,7 @@ func TestBootstrapLedger(t *testing.T) {
 }
 
 func TestBootstrapLedger_ZeroTokenSupply(t *testing.T) {
-	expectedStateCommitmentBytes, _ := hex.DecodeString("8d9d52a66a832898f6f2416b703759b7ecd1eb390db6d5e727c2daeec001ffc6")
+	expectedStateCommitmentBytes, _ := hex.DecodeString("394b02bd8207a8f8b86d3af0fe428bc2b11228311b652037175db7823446bcbe")
 	expectedStateCommitment, err := flow.ToStateCommitment(expectedStateCommitmentBytes)
 	require.NoError(t, err)
 
diff --git a/engine/execution/state/unittest/fixtures.go b/engine/execution/state/unittest/fixtures.go
index 26bc0584fcb..7a77ea1e616 100644
--- a/engine/execution/state/unittest/fixtures.go
+++ b/engine/execution/state/unittest/fixtures.go
@@ -46,16 +46,19 @@ func ComputationResultForBlockFixture(
 
 	numberOfChunks := len(collections) + 1
 	ceds := make([]*execution_data.ChunkExecutionData, numberOfChunks)
+	startState := *completeBlock.StartState
 	for i := 0; i < numberOfChunks; i++ {
 		ceds[i] = unittest.ChunkExecutionDataFixture(t, 1024)
+		endState := unittest.StateCommitmentFixture()
 		computationResult.CollectionExecutionResultAt(i).UpdateExecutionSnapshot(StateInteractionsFixture())
 		computationResult.AppendCollectionAttestationResult(
-			*completeBlock.StartState,
-			*completeBlock.StartState,
+			startState,
+			endState,
 			nil,
 			unittest.IdentifierFixture(),
 			ceds[i],
 		)
+		startState = endState
 	}
 	bed := unittest.BlockExecutionDataFixture(
 		unittest.WithBlockExecutionDataBlockID(completeBlock.Block.ID()),
diff --git a/engine/testutil/mock/nodes.go b/engine/testutil/mock/nodes.go
index 8c4c57be164..08ddb160fd7 100644
--- a/engine/testutil/mock/nodes.go
+++ b/engine/testutil/mock/nodes.go
@@ -68,24 +68,28 @@ type GenericNode struct {
 	Cancel context.CancelFunc
 	Errs   <-chan error
 
-	Log                zerolog.Logger
-	Metrics            *metrics.NoopCollector
-	Tracer             module.Tracer
-	PublicDB           *badger.DB
-	SecretsDB          *badger.DB
-	Headers            storage.Headers
-	Guarantees         storage.Guarantees
-	Seals              storage.Seals
-	Payloads           storage.Payloads
-	Blocks             storage.Blocks
-	QuorumCertificates storage.QuorumCertificates
-	State              protocol.ParticipantState
-	Index              storage.Index
-	Me                 module.Local
-	Net                *stub.Network
-	DBDir              string
-	ChainID            flow.ChainID
-	ProtocolEvents     *events.Distributor
+	Log                    zerolog.Logger
+	Metrics                *metrics.NoopCollector
+	Tracer                 module.Tracer
+	PublicDB               *badger.DB
+	SecretsDB              *badger.DB
+	Headers                storage.Headers
+	Guarantees             storage.Guarantees
+	Seals                  storage.Seals
+	Payloads               storage.Payloads
+	Blocks                 storage.Blocks
+	QuorumCertificates     storage.QuorumCertificates
+	Results                storage.ExecutionResults
+	Setups                 storage.EpochSetups
+	EpochCommits           storage.EpochCommits
+	ProtocolStateSnapshots storage.ProtocolState
+	State                  protocol.ParticipantState
+	Index                  storage.Index
+	Me                     module.Local
+	Net                    *stub.Network
+	DBDir                  string
+	ChainID                flow.ChainID
+	ProtocolEvents         *events.Distributor
 }
 
 func (g *GenericNode) Done() {
diff --git a/engine/testutil/mocklocal/local.go b/engine/testutil/mocklocal/local.go
index 6e8a0385792..377cd0767eb 100644
--- a/engine/testutil/mocklocal/local.go
+++ b/engine/testutil/mocklocal/local.go
@@ -44,8 +44,8 @@ func (m *MockLocal) MockNodeID(id flow.Identifier) {
 	m.id = id
 }
 
-func (m *MockLocal) NotMeFilter() flow.IdentityFilter {
-	return filter.Not(filter.HasNodeID(m.id))
+func (m *MockLocal) NotMeFilter() flow.IdentityFilter[flow.Identity] {
+	return filter.Not(filter.HasNodeID[flow.Identity](m.id))
 }
 
 func (m *MockLocal) SignFunc(data []byte, hasher hash.Hasher, f func(crypto.PrivateKey, []byte, hash.Hasher) (crypto.Signature,
diff --git a/engine/testutil/nodes.go b/engine/testutil/nodes.go
index cdbd6526181..3815fe9220d 100644
--- a/engine/testutil/nodes.go
+++ b/engine/testutil/nodes.go
@@ -2,7 +2,6 @@ package testutil
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"math"
 	"path/filepath"
@@ -13,11 +12,11 @@ import (
 	"github.com/ipfs/go-datastore"
 	dssync "github.com/ipfs/go-datastore/sync"
 	blockstore "github.com/ipfs/go-ipfs-blockstore"
-	"github.com/onflow/crypto"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/atomic"
+	"golang.org/x/time/rate"
 
 	"github.com/onflow/flow-go/cmd/build"
 	"github.com/onflow/flow-go/consensus"
@@ -30,6 +29,7 @@ import (
 	"github.com/onflow/flow-go/engine"
 	"github.com/onflow/flow-go/engine/collection/epochmgr"
 	"github.com/onflow/flow-go/engine/collection/epochmgr/factories"
+	"github.com/onflow/flow-go/engine/collection/ingest"
 	collectioningest "github.com/onflow/flow-go/engine/collection/ingest"
 	mockcollection "github.com/onflow/flow-go/engine/collection/mock"
 	"github.com/onflow/flow-go/engine/collection/pusher"
@@ -115,7 +115,7 @@ import (
 //
 // CAUTION: Please use GenericNode instead for most use-cases so that multiple nodes
 // may share the same root state snapshot.
-func GenericNodeFromParticipants(t testing.TB, hub *stub.Hub, identity *flow.Identity, participants []*flow.Identity, chainID flow.ChainID,
+func GenericNodeFromParticipants(t testing.TB, hub *stub.Hub, identity bootstrap.NodeInfo, participants []*flow.Identity, chainID flow.ChainID,
 	options ...func(protocol.State)) testmock.GenericNode {
 	var i int
 	var participant *flow.Identity
@@ -149,7 +149,7 @@ func GenericNodeFromParticipants(t testing.TB, hub *stub.Hub, identity *flow.Ide
 func GenericNode(
 	t testing.TB,
 	hub *stub.Hub,
-	identity *flow.Identity,
+	identity bootstrap.NodeInfo,
 	root protocol.Snapshot,
 ) testmock.GenericNode {
 
@@ -172,64 +172,51 @@ func GenericNode(
 func GenericNodeWithStateFixture(t testing.TB,
 	stateFixture *testmock.StateFixture,
 	hub *stub.Hub,
-	identity *flow.Identity,
+	bootstrapInfo bootstrap.NodeInfo,
 	log zerolog.Logger,
 	metrics *metrics.NoopCollector,
 	tracer module.Tracer,
 	chainID flow.ChainID) testmock.GenericNode {
 
-	me := LocalFixture(t, identity)
+	identity := bootstrapInfo.Identity()
+	privateKeys, err := bootstrapInfo.PrivateKeys()
+	require.NoError(t, err)
+	me, err := local.New(identity.IdentitySkeleton, privateKeys.StakingKey)
+	require.NoError(t, err)
 	net := stub.NewNetwork(t, identity.NodeID, hub)
 
 	parentCtx, cancel := context.WithCancel(context.Background())
 	ctx, errs := irrecoverable.WithSignaler(parentCtx)
 
 	return testmock.GenericNode{
-		Ctx:                ctx,
-		Cancel:             cancel,
-		Errs:               errs,
-		Log:                log,
-		Metrics:            metrics,
-		Tracer:             tracer,
-		PublicDB:           stateFixture.PublicDB,
-		SecretsDB:          stateFixture.SecretsDB,
-		State:              stateFixture.State,
-		Headers:            stateFixture.Storage.Headers,
-		Guarantees:         stateFixture.Storage.Guarantees,
-		Seals:              stateFixture.Storage.Seals,
-		Payloads:           stateFixture.Storage.Payloads,
-		Blocks:             stateFixture.Storage.Blocks,
-		QuorumCertificates: stateFixture.Storage.QuorumCertificates,
-		Me:                 me,
-		Net:                net,
-		DBDir:              stateFixture.DBDir,
-		ChainID:            chainID,
-		ProtocolEvents:     stateFixture.ProtocolEvents,
+		Ctx:                    ctx,
+		Cancel:                 cancel,
+		Errs:                   errs,
+		Log:                    log,
+		Metrics:                metrics,
+		Tracer:                 tracer,
+		PublicDB:               stateFixture.PublicDB,
+		SecretsDB:              stateFixture.SecretsDB,
+		Headers:                stateFixture.Storage.Headers,
+		Guarantees:             stateFixture.Storage.Guarantees,
+		Seals:                  stateFixture.Storage.Seals,
+		Payloads:               stateFixture.Storage.Payloads,
+		Blocks:                 stateFixture.Storage.Blocks,
+		QuorumCertificates:     stateFixture.Storage.QuorumCertificates,
+		Results:                stateFixture.Storage.Results,
+		Setups:                 stateFixture.Storage.Setups,
+		EpochCommits:           stateFixture.Storage.EpochCommits,
+		ProtocolStateSnapshots: stateFixture.Storage.ProtocolState,
+		State:                  stateFixture.State,
+		Index:                  stateFixture.Storage.Index,
+		Me:                     me,
+		Net:                    net,
+		DBDir:                  stateFixture.DBDir,
+		ChainID:                chainID,
+		ProtocolEvents:         stateFixture.ProtocolEvents,
 	}
 }
 
-// LocalFixture creates and returns a Local module for given identity.
-func LocalFixture(t testing.TB, identity *flow.Identity) module.Local {
-
-	// Generates test signing oracle for the nodes
-	// Disclaimer: it should not be used for practical applications
-	//
-	// uses identity of node as its seed
-	seed, err := json.Marshal(identity)
-	require.NoError(t, err)
-	// creates signing key of the node
-	sk, err := crypto.GeneratePrivateKey(crypto.BLSBLS12381, seed[:64])
-	require.NoError(t, err)
-
-	// sets staking public key of the node
-	identity.StakingPubKey = sk.PublicKey()
-
-	me, err := local.New(identity, sk)
-	require.NoError(t, err)
-
-	return me
-}
-
 // CompleteStateFixture is a test helper that creates, bootstraps, and returns a StateFixture for sake of unit testing.
 func CompleteStateFixture(
 	t testing.TB,
@@ -257,7 +244,7 @@ func CompleteStateFixture(
 		s.QuorumCertificates,
 		s.Setups,
 		s.EpochCommits,
-		s.Statuses,
+		s.ProtocolState,
 		s.VersionBeacons,
 		rootSnapshot,
 	)
@@ -289,10 +276,10 @@ func CompleteStateFixture(
 // CollectionNode returns a mock collection node.
 func CollectionNode(t *testing.T, hub *stub.Hub, identity bootstrap.NodeInfo, rootSnapshot protocol.Snapshot) testmock.CollectionNode {
 
-	node := GenericNode(t, hub, identity.Identity(), rootSnapshot)
+	node := GenericNode(t, hub, identity, rootSnapshot)
 	privKeys, err := identity.PrivateKeys()
 	require.NoError(t, err)
-	node.Me, err = local.New(identity.Identity(), privKeys.StakingKey)
+	node.Me, err = local.New(identity.Identity().IdentitySkeleton, privKeys.StakingKey)
 	require.NoError(t, err)
 
 	pools := epochs.NewTransactionPools(
@@ -303,10 +290,11 @@ func CollectionNode(t *testing.T, hub *stub.Hub, identity bootstrap.NodeInfo, ro
 	collections := storage.NewCollections(node.PublicDB, transactions)
 	clusterPayloads := storage.NewClusterPayloads(node.Metrics, node.PublicDB)
 
-	ingestionEngine, err := collectioningest.New(node.Log, node.Net, node.State, node.Metrics, node.Metrics, node.Metrics, node.Me, node.ChainID.Chain(), pools, collectioningest.DefaultConfig())
+	ingestionEngine, err := collectioningest.New(node.Log, node.Net, node.State, node.Metrics, node.Metrics, node.Metrics, node.Me, node.ChainID.Chain(), pools, collectioningest.DefaultConfig(),
+		ingest.NewAddressRateLimiter(rate.Limit(1), 10)) // 10 tps
 	require.NoError(t, err)
 
-	selector := filter.HasRole(flow.RoleAccess, flow.RoleVerification)
+	selector := filter.HasRole[flow.Identity](flow.RoleAccess, flow.RoleVerification)
 	retrieve := func(collID flow.Identifier) (flow.Entity, error) {
 		coll, err := collections.ByID(collID)
 		return coll, err
@@ -434,7 +422,7 @@ func CollectionNode(t *testing.T, hub *stub.Hub, identity bootstrap.NodeInfo, ro
 	}
 }
 
-func ConsensusNode(t *testing.T, hub *stub.Hub, identity *flow.Identity, identities []*flow.Identity, chainID flow.ChainID) testmock.ConsensusNode {
+func ConsensusNode(t *testing.T, hub *stub.Hub, identity bootstrap.NodeInfo, identities []*flow.Identity, chainID flow.ChainID) testmock.ConsensusNode {
 
 	node := GenericNodeFromParticipants(t, hub, identity, identities, chainID)
 
@@ -532,30 +520,11 @@ func ConsensusNode(t *testing.T, hub *stub.Hub, identity *flow.Identity, identit
 	}
 }
 
-func ConsensusNodes(t *testing.T, hub *stub.Hub, nNodes int, chainID flow.ChainID) []testmock.ConsensusNode {
-	conIdentities := unittest.IdentityListFixture(nNodes, unittest.WithRole(flow.RoleConsensus))
-	for _, id := range conIdentities {
-		t.Log(id.String())
-	}
-
-	// add some extra dummy identities so we have one of each role
-	others := unittest.IdentityListFixture(5, unittest.WithAllRolesExcept(flow.RoleConsensus))
-
-	identities := append(conIdentities, others...)
-
-	nodes := make([]testmock.ConsensusNode, 0, len(conIdentities))
-	for _, identity := range conIdentities {
-		nodes = append(nodes, ConsensusNode(t, hub, identity, identities, chainID))
-	}
-
-	return nodes
-}
-
 type CheckerMock struct {
 	notifications.NoopConsumer // satisfy the FinalizationConsumer interface
 }
 
-func ExecutionNode(t *testing.T, hub *stub.Hub, identity *flow.Identity, identities []*flow.Identity, syncThreshold int, chainID flow.ChainID) testmock.ExecutionNode {
+func ExecutionNode(t *testing.T, hub *stub.Hub, identity bootstrap.NodeInfo, identities []*flow.Identity, syncThreshold int, chainID flow.ChainID) testmock.ExecutionNode {
 	node := GenericNodeFromParticipants(t, hub, identity, identities, chainID)
 
 	transactionsStorage := storage.NewTransactions(node.Metrics, node.PublicDB)
@@ -604,7 +573,7 @@ func ExecutionNode(t *testing.T, hub *stub.Hub, identity *flow.Identity, identit
 	ls, err := completeLedger.NewLedger(diskWal, capacity, metricsCollector, node.Log.With().Str("compontent", "ledger").Logger(), completeLedger.DefaultPathFinderVersion)
 	require.NoError(t, err)
 
-	compactor, err := completeLedger.NewCompactor(ls, diskWal, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+	compactor, err := completeLedger.NewCompactor(ls, diskWal, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metricsCollector)
 	require.NoError(t, err)
 
 	<-compactor.Ready() // Need to start compactor here because BootstrapLedger() updates ledger state.
@@ -669,7 +638,7 @@ func ExecutionNode(t *testing.T, hub *stub.Hub, identity *flow.Identity, identit
 	requestEngine, err := requester.New(
 		node.Log, node.Metrics, node.Net, node.Me, node.State,
 		channels.RequestCollections,
-		filter.HasRole(flow.RoleCollection),
+		filter.HasRole[flow.Identity](flow.RoleCollection),
 		func() flow.Entity { return &flow.Collection{} },
 	)
 	require.NoError(t, err)
@@ -830,8 +799,8 @@ func ExecutionNode(t *testing.T, hub *stub.Hub, identity *flow.Identity, identit
 		syncCore,
 		id.NewIdentityFilterIdentifierProvider(
 			filter.And(
-				filter.HasRole(flow.RoleConsensus),
-				filter.Not(filter.HasNodeID(node.Me.NodeID())),
+				filter.HasRole[flow.Identity](flow.RoleConsensus),
+				filter.Not(filter.HasNodeID[flow.Identity](node.Me.NodeID())),
 			),
 			idCache,
 		),
@@ -865,10 +834,9 @@ func ExecutionNode(t *testing.T, hub *stub.Hub, identity *flow.Identity, identit
 }
 
 func getRoot(t *testing.T, node *testmock.GenericNode) (*flow.Header, *flow.QuorumCertificate) {
-	rootHead, err := node.State.Params().FinalizedRoot()
-	require.NoError(t, err)
+	rootHead := node.State.Params().FinalizedRoot()
 
-	signers, err := node.State.AtHeight(0).Identities(filter.HasRole(flow.RoleConsensus))
+	signers, err := node.State.AtHeight(0).Identities(filter.HasRole[flow.Identity](flow.RoleConsensus))
 	require.NoError(t, err)
 
 	signerIDs := signers.NodeIDs()
@@ -906,16 +874,16 @@ func (s *RoundRobinLeaderSelection) IdentityByBlock(_ flow.Identifier, participa
 	return id, nil
 }
 
-func (s *RoundRobinLeaderSelection) IdentitiesByEpoch(_ uint64) (flow.IdentityList, error) {
-	return s.identities, nil
+func (s *RoundRobinLeaderSelection) IdentitiesByEpoch(view uint64) (flow.IdentitySkeletonList, error) {
+	return s.identities.ToSkeleton(), nil
 }
 
-func (s *RoundRobinLeaderSelection) IdentityByEpoch(_ uint64, participantID flow.Identifier) (*flow.Identity, error) {
+func (s *RoundRobinLeaderSelection) IdentityByEpoch(view uint64, participantID flow.Identifier) (*flow.IdentitySkeleton, error) {
 	id, found := s.identities.ByNodeID(participantID)
 	if !found {
 		return nil, model.NewInvalidSignerErrorf("unknown participant %x", participantID)
 	}
-	return id, nil
+	return &id.IdentitySkeleton, nil
 }
 
 func (s *RoundRobinLeaderSelection) LeaderForView(view uint64) (flow.Identifier, error) {
@@ -923,11 +891,11 @@ func (s *RoundRobinLeaderSelection) LeaderForView(view uint64) (flow.Identifier,
 }
 
 func (s *RoundRobinLeaderSelection) QuorumThresholdForView(_ uint64) (uint64, error) {
-	return committees.WeightThresholdToBuildQC(s.identities.TotalWeight()), nil
+	return committees.WeightThresholdToBuildQC(s.identities.ToSkeleton().TotalWeight()), nil
 }
 
 func (s *RoundRobinLeaderSelection) TimeoutThresholdForView(_ uint64) (uint64, error) {
-	return committees.WeightThresholdToTimeout(s.identities.TotalWeight()), nil
+	return committees.WeightThresholdToTimeout(s.identities.ToSkeleton().TotalWeight()), nil
 }
 
 func (s *RoundRobinLeaderSelection) Self() flow.Identifier {
@@ -984,7 +952,7 @@ func WithGenericNode(genericNode *testmock.GenericNode) VerificationOpt {
 // (integration) testing.
 func VerificationNode(t testing.TB,
 	hub *stub.Hub,
-	verIdentity *flow.Identity, // identity of this verification node.
+	verIdentity bootstrap.NodeInfo, // identity of this verification node.
 	participants flow.IdentityList, // identity of all nodes in system including this verification node.
 	assigner module.ChunkAssigner,
 	chunksLimit uint,
diff --git a/engine/unit.go b/engine/unit.go
index 3dc6b4fd4c6..caccad20f02 100644
--- a/engine/unit.go
+++ b/engine/unit.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package engine
 
 import (
diff --git a/engine/verification/assigner/blockconsumer/consumer_test.go b/engine/verification/assigner/blockconsumer/consumer_test.go
index 67ea6773194..9a7723b6663 100644
--- a/engine/verification/assigner/blockconsumer/consumer_test.go
+++ b/engine/verification/assigner/blockconsumer/consumer_test.go
@@ -146,11 +146,21 @@ func withConsumer(
 		// blocks (i.e., containing guarantees), and Cs are container blocks for their preceding reference block,
 		// Container blocks only contain receipts of their preceding reference blocks. But they do not
 		// hold any guarantees.
-		root, err := s.State.Params().FinalizedRoot()
+		root, err := s.State.Final().Head()
 		require.NoError(t, err)
-		clusterCommittee := participants.Filter(filter.HasRole(flow.RoleCollection))
+		rootProtocolState, err := s.State.Final().ProtocolState()
+		require.NoError(t, err)
+		rootProtocolStateID := rootProtocolState.Entry().ID()
+		clusterCommittee := participants.Filter(filter.HasRole[flow.Identity](flow.RoleCollection))
 		sources := unittest.RandomSourcesFixture(110)
-		results := vertestutils.CompleteExecutionReceiptChainFixture(t, root, blockCount/2, sources, vertestutils.WithClusterCommittee(clusterCommittee))
+		results := vertestutils.CompleteExecutionReceiptChainFixture(
+			t,
+			root,
+			rootProtocolStateID,
+			blockCount/2,
+			sources,
+			vertestutils.WithClusterCommittee(clusterCommittee),
+		)
 		blocks := vertestutils.ExtendStateWithFinalizedBlocks(t, results, s.State)
 		// makes sure that we generated a block chain of requested length.
 		require.Len(t, blocks, blockCount)
diff --git a/engine/verification/assigner/engine.go b/engine/verification/assigner/engine.go
index c68beba4653..ba2e7d2d1f7 100644
--- a/engine/verification/assigner/engine.go
+++ b/engine/verification/assigner/engine.go
@@ -11,6 +11,7 @@ import (
 	"github.com/onflow/flow-go/engine"
 	"github.com/onflow/flow-go/model/chunks"
 	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/model/flow/filter"
 	"github.com/onflow/flow-go/module"
 	"github.com/onflow/flow-go/module/trace"
 	"github.com/onflow/flow-go/state/protocol"
@@ -274,13 +275,8 @@ func authorizedAsVerification(state protocol.State, blockID flow.Identifier, ide
 		return false, fmt.Errorf("node has an invalid role. expected: %s, got: %s", flow.RoleVerification, identity.Role)
 	}
 
-	// checks identity has not been ejected
-	if identity.Ejected {
-		return false, nil
-	}
-
-	// checks identity has weight
-	if identity.Weight == 0 {
+	// checks identity is an active epoch participant with positive weight
+	if !filter.IsValidCurrentEpochParticipant(identity) || identity.InitialWeight == 0 {
 		return false, nil
 	}
 
diff --git a/engine/verification/assigner/engine_test.go b/engine/verification/assigner/engine_test.go
index b1a4fe4c9e2..19cbcf9221b 100644
--- a/engine/verification/assigner/engine_test.go
+++ b/engine/verification/assigner/engine_test.go
@@ -131,8 +131,8 @@ func TestAssignerEngine(t *testing.T) {
 	t.Run("new block happy path", func(t *testing.T) {
 		newBlockHappyPath(t)
 	})
-	t.Run("new block zero-weight", func(t *testing.T) {
-		newBlockZeroWeight(t)
+	t.Run("new block invalid identity", func(t *testing.T) {
+		newBlockVerifierNotAuthorized(t)
 	})
 	t.Run("new block zero chunk", func(t *testing.T) {
 		newBlockNoChunk(t)
@@ -189,47 +189,71 @@ func newBlockHappyPath(t *testing.T) {
 		s.notifier)
 }
 
-// newBlockZeroWeight evaluates that when verification node has zero weight at a reference block,
-// it drops the corresponding execution receipts for that block without performing any chunk assignment.
+// newBlockVerifierNotAuthorized evaluates that when verification node is not authorized to participate at reference block, it includes next cases:
+// - verification node is joining
+// - verification node is leaving
+// - verification node has zero initial weight.
+// It drops the corresponding execution receipts for that block without performing any chunk assignment.
 // It also evaluates that the chunks queue is never called on any chunks of that receipt's result.
-func newBlockZeroWeight(t *testing.T) {
+func newBlockVerifierNotAuthorized(t *testing.T) {
+
+	assertIdentityAtReferenceBlock := func(identity *flow.Identity) {
+		// creates an assigner engine for non-active verification node.
+		s := SetupTest(WithIdentity(identity))
+		e := NewAssignerEngine(s)
+
+		// creates a container block, with a single receipt, that contains
+		// no assigned chunk to verification node.
+		containerBlock, _ := createContainerBlock(
+			vertestutils.WithChunks( // all chunks assigned to some (random) identifiers, but not this verification node
+				vertestutils.WithAssignee(unittest.IdentifierFixture()),
+				vertestutils.WithAssignee(unittest.IdentifierFixture()),
+				vertestutils.WithAssignee(unittest.IdentifierFixture())))
+		result := containerBlock.Payload.Results[0]
+		s.mockStateAtBlockID(result.BlockID)
+
+		// once assigner engine is done processing the block, it should notify the processing notifier.
+		s.notifier.On("Notify", containerBlock.ID()).Return().Once()
+
+		// sends block containing receipt to assigner engine
+		s.metrics.On("OnFinalizedBlockArrivedAtAssigner", containerBlock.Header.Height).Return().Once()
+		s.metrics.On("OnExecutionResultReceivedAtAssignerEngine").Return().Once()
+		e.ProcessFinalizedBlock(containerBlock)
+
+		// when the node has zero-weight at reference block id, chunk assigner should not be called,
+		// and nothing should be passed to chunks queue, and
+		// job listener should not be notified.
+		s.chunksQueue.AssertNotCalled(t, "StoreChunkLocator")
+		s.newChunkListener.AssertNotCalled(t, "Check")
+		s.assigner.AssertNotCalled(t, "Assign")
+
+		mock.AssertExpectationsForObjects(t,
+			s.metrics,
+			s.assigner,
+			s.notifier)
+	}
 
-	// creates an assigner engine for zero-weight verification node.
-	s := SetupTest(WithIdentity(
-		unittest.IdentityFixture(
+	t.Run("verifier-joining", func(t *testing.T) {
+		identity := unittest.IdentityFixture(
 			unittest.WithRole(flow.RoleVerification),
-			unittest.WithWeight(0))))
-	e := NewAssignerEngine(s)
-
-	// creates a container block, with a single receipt, that contains
-	// no assigned chunk to verification node.
-	containerBlock, _ := createContainerBlock(
-		vertestutils.WithChunks( // all chunks assigned to some (random) identifiers, but not this verification node
-			vertestutils.WithAssignee(unittest.IdentifierFixture()),
-			vertestutils.WithAssignee(unittest.IdentifierFixture()),
-			vertestutils.WithAssignee(unittest.IdentifierFixture())))
-	result := containerBlock.Payload.Results[0]
-	s.mockStateAtBlockID(result.BlockID)
-
-	// once assigner engine is done processing the block, it should notify the processing notifier.
-	s.notifier.On("Notify", containerBlock.ID()).Return().Once()
-
-	// sends block containing receipt to assigner engine
-	s.metrics.On("OnFinalizedBlockArrivedAtAssigner", containerBlock.Header.Height).Return().Once()
-	s.metrics.On("OnExecutionResultReceivedAtAssignerEngine").Return().Once()
-	e.ProcessFinalizedBlock(containerBlock)
-
-	// when the node has zero-weight at reference block id, chunk assigner should not be called,
-	// and nothing should be passed to chunks queue, and
-	// job listener should not be notified.
-	s.chunksQueue.AssertNotCalled(t, "StoreChunkLocator")
-	s.newChunkListener.AssertNotCalled(t, "Check")
-	s.assigner.AssertNotCalled(t, "Assign")
-
-	mock.AssertExpectationsForObjects(t,
-		s.metrics,
-		s.assigner,
-		s.notifier)
+			unittest.WithParticipationStatus(flow.EpochParticipationStatusJoining),
+		)
+		assertIdentityAtReferenceBlock(identity)
+	})
+	t.Run("verifier-leaving", func(t *testing.T) {
+		identity := unittest.IdentityFixture(
+			unittest.WithRole(flow.RoleVerification),
+			unittest.WithParticipationStatus(flow.EpochParticipationStatusLeaving),
+		)
+		assertIdentityAtReferenceBlock(identity)
+	})
+	t.Run("verifier-zero-weight", func(t *testing.T) {
+		identity := unittest.IdentityFixture(
+			unittest.WithRole(flow.RoleVerification),
+			unittest.WithInitialWeight(0),
+		)
+		assertIdentityAtReferenceBlock(identity)
+	})
 }
 
 // newBlockNoChunk evaluates passing a new finalized block to assigner engine that contains
diff --git a/engine/verification/fetcher/engine.go b/engine/verification/fetcher/engine.go
index fd53417b720..20afad04021 100644
--- a/engine/verification/fetcher/engine.go
+++ b/engine/verification/fetcher/engine.go
@@ -587,7 +587,7 @@ func (e *Engine) requestChunkDataPack(chunkIndex uint64, chunkID flow.Identifier
 		return fmt.Errorf("could not get header for block: %x", blockID)
 	}
 
-	allExecutors, err := e.state.AtBlockID(blockID).Identities(filter.HasRole(flow.RoleExecution))
+	allExecutors, err := e.state.AtBlockID(blockID).Identities(filter.HasRole[flow.Identity](flow.RoleExecution))
 	if err != nil {
 		return fmt.Errorf("could not fetch execution node ids at block %x: %w", blockID, err)
 	}
diff --git a/engine/verification/fetcher/engine_test.go b/engine/verification/fetcher/engine_test.go
index 80cd43e905c..b2fb94a94cb 100644
--- a/engine/verification/fetcher/engine_test.go
+++ b/engine/verification/fetcher/engine_test.go
@@ -338,7 +338,27 @@ func TestChunkResponse_InvalidChunkDataPack(t *testing.T) {
 				// we don't alter chunk data pack content
 			},
 			mockStateFunc: func(identity flow.Identity, state *protocol.State, blockID flow.Identifier) {
-				identity.Weight = 0
+				identity.EpochParticipationStatus = flow.EpochParticipationStatusJoining
+				mockStateAtBlockIDForIdentities(state, blockID, flow.IdentityList{&identity})
+			},
+			msg: "participation-status-joining-origin-id",
+		},
+		{
+			alterChunkDataResponse: func(cdp *flow.ChunkDataPack) {
+				// we don't alter chunk data pack content
+			},
+			mockStateFunc: func(identity flow.Identity, state *protocol.State, blockID flow.Identifier) {
+				identity.EpochParticipationStatus = flow.EpochParticipationStatusLeaving
+				mockStateAtBlockIDForIdentities(state, blockID, flow.IdentityList{&identity})
+			},
+			msg: "participation-status-leaving-origin-id",
+		},
+		{
+			alterChunkDataResponse: func(cdp *flow.ChunkDataPack) {
+				// we don't alter chunk data pack content
+			},
+			mockStateFunc: func(identity flow.Identity, state *protocol.State, blockID flow.Identifier) {
+				identity.InitialWeight = 0
 				mockStateAtBlockIDForIdentities(state, blockID, flow.IdentityList{&identity})
 			},
 			msg: "zero-weight-origin-id",
diff --git a/engine/verification/utils/unittest/fixture.go b/engine/verification/utils/unittest/fixture.go
index 57c9916e62d..03973924984 100644
--- a/engine/verification/utils/unittest/fixture.go
+++ b/engine/verification/utils/unittest/fixture.go
@@ -193,6 +193,7 @@ func ExecutionResultFixture(t *testing.T,
 	chunkCount int,
 	chain flow.Chain,
 	refBlkHeader *flow.Header,
+	protocolStateID flow.Identifier,
 	clusterCommittee flow.IdentityList,
 	source []byte,
 ) (*flow.ExecutionResult, *ExecutionReceiptData) {
@@ -330,7 +331,8 @@ func ExecutionResultFixture(t *testing.T,
 		}
 
 		payload := flow.Payload{
-			Guarantees: guarantees,
+			Guarantees:      guarantees,
+			ProtocolStateID: protocolStateID,
 		}
 		referenceBlock = flow.Block{
 			Header: refBlkHeader,
@@ -375,6 +377,7 @@ func ExecutionResultFixture(t *testing.T,
 // It returns a slice of complete execution receipt fixtures that contains a container block as well as all data to verify its contained receipts.
 func CompleteExecutionReceiptChainFixture(t *testing.T,
 	root *flow.Header,
+	rootProtocolStateID flow.Identifier,
 	count int,
 	sources [][]byte,
 	opts ...CompleteExecutionReceiptBuilderOpt,
@@ -404,9 +407,9 @@ func CompleteExecutionReceiptChainFixture(t *testing.T,
 	for i := 0; i < count; i++ {
 		// Generates two blocks as parent <- R <- C where R is a reference block containing guarantees,
 		// and C is a container block containing execution receipt for R.
-		receipts, allData, head := ExecutionReceiptsFromParentBlockFixture(t, parent, builder, sources[sourcesIndex:])
+		receipts, allData, head := ExecutionReceiptsFromParentBlockFixture(t, parent, rootProtocolStateID, builder, sources[sourcesIndex:])
 		sourcesIndex += builder.resultsCount
-		containerBlock := ContainerBlockFixture(head, receipts, sources[sourcesIndex])
+		containerBlock := ContainerBlockFixture(head, rootProtocolStateID, receipts, sources[sourcesIndex])
 		sourcesIndex++
 		completeERs = append(completeERs, &CompleteExecutionReceipt{
 			ContainerBlock: containerBlock,
@@ -427,6 +430,7 @@ func CompleteExecutionReceiptChainFixture(t *testing.T,
 // Each result may appear in more than one receipt depending on the builder parameters.
 func ExecutionReceiptsFromParentBlockFixture(t *testing.T,
 	parent *flow.Header,
+	protocolStateID flow.Identifier,
 	builder *CompleteExecutionReceiptBuilder,
 	sources [][]byte) (
 	[]*flow.ExecutionReceipt,
@@ -436,7 +440,7 @@ func ExecutionReceiptsFromParentBlockFixture(t *testing.T,
 	allReceipts := make([]*flow.ExecutionReceipt, 0, builder.resultsCount*builder.executorCount)
 
 	for i := 0; i < builder.resultsCount; i++ {
-		result, data := ExecutionResultFromParentBlockFixture(t, parent, builder, sources[i:])
+		result, data := ExecutionResultFromParentBlockFixture(t, parent, protocolStateID, builder, sources[i:])
 
 		// makes several copies of the same result
 		for cp := 0; cp < builder.executorCount; cp++ {
@@ -456,21 +460,25 @@ func ExecutionReceiptsFromParentBlockFixture(t *testing.T,
 // ExecutionResultFromParentBlockFixture is a test helper that creates a child (reference) block from the parent, as well as an execution for it.
 func ExecutionResultFromParentBlockFixture(t *testing.T,
 	parent *flow.Header,
+	protocolStateID flow.Identifier,
 	builder *CompleteExecutionReceiptBuilder,
 	sources [][]byte,
 ) (*flow.ExecutionResult, *ExecutionReceiptData) {
 	// create the block header including a QC with source a index `i`
 	refBlkHeader := unittest.BlockHeaderWithParentWithSoRFixture(parent, sources[0])
 	// execute the block with the source a index `i+1` (which will be included later in the child block)
-	return ExecutionResultFixture(t, builder.chunksCount, builder.chain, refBlkHeader, builder.clusterCommittee, sources[1])
+	return ExecutionResultFixture(t, builder.chunksCount, builder.chain, refBlkHeader, protocolStateID, builder.clusterCommittee, sources[1])
 }
 
 // ContainerBlockFixture builds and returns a block that contains input execution receipts.
-func ContainerBlockFixture(parent *flow.Header, receipts []*flow.ExecutionReceipt, source []byte) *flow.Block {
+func ContainerBlockFixture(parent *flow.Header, protocolStateID flow.Identifier, receipts []*flow.ExecutionReceipt, source []byte) *flow.Block {
 	// container block is the block that contains the execution receipt of reference block
 	containerBlock := unittest.BlockWithParentFixture(parent)
 	containerBlock.Header.ParentVoterSigData = unittest.QCSigDataWithSoRFixture(source)
-	containerBlock.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipts...)))
+	containerBlock.SetPayload(unittest.PayloadFixture(
+		unittest.WithReceipts(receipts...),
+		unittest.WithProtocolStateID(protocolStateID),
+	))
 
 	return containerBlock
 }
diff --git a/engine/verification/utils/unittest/helper.go b/engine/verification/utils/unittest/helper.go
index ff837456624..e46d3a87b16 100644
--- a/engine/verification/utils/unittest/helper.go
+++ b/engine/verification/utils/unittest/helper.go
@@ -13,11 +13,13 @@ import (
 	"github.com/stretchr/testify/assert"
 	testifymock "github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/exp/slices"
 
 	"github.com/onflow/flow-go/consensus/hotstuff/model"
 	"github.com/onflow/flow-go/engine/testutil"
 	enginemock "github.com/onflow/flow-go/engine/testutil/mock"
 	"github.com/onflow/flow-go/engine/verification/assigner/blockconsumer"
+	"github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/chunks"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/flow/filter"
@@ -33,6 +35,7 @@ import (
 	"github.com/onflow/flow-go/network/stub"
 	"github.com/onflow/flow-go/state/protocol"
 	mockprotocol "github.com/onflow/flow-go/state/protocol/mock"
+	"github.com/onflow/flow-go/state/protocol/protocol_state"
 	"github.com/onflow/flow-go/utils/logging"
 	"github.com/onflow/flow-go/utils/unittest"
 )
@@ -46,7 +49,7 @@ type MockChunkDataProviderFunc func(*testing.T, CompleteExecutionReceiptList, fl
 // requests should come from a verification node, and should has one of the assigned chunk IDs. Otherwise, it fails the test.
 func SetupChunkDataPackProvider(t *testing.T,
 	hub *stub.Hub,
-	exeIdentity *flow.Identity,
+	exeIdentity bootstrap.NodeInfo,
 	participants flow.IdentityList,
 	chainID flow.ChainID,
 	completeERs CompleteExecutionReceiptList,
@@ -75,7 +78,7 @@ func SetupChunkDataPackProvider(t *testing.T,
 			originID, ok := args[1].(flow.Identifier)
 			require.True(t, ok)
 			// request should be dispatched by a verification node.
-			require.Contains(t, participants.Filter(filter.HasRole(flow.RoleVerification)).NodeIDs(), originID)
+			require.Contains(t, participants.Filter(filter.HasRole[flow.Identity](flow.RoleVerification)).NodeIDs(), originID)
 
 			req, ok := args[2].(*messages.ChunkDataRequest)
 			require.True(t, ok)
@@ -150,7 +153,7 @@ func RespondChunkDataPackRequestAfterNTrials(n int) MockChunkDataProviderFunc {
 func SetupMockConsensusNode(t *testing.T,
 	log zerolog.Logger,
 	hub *stub.Hub,
-	conIdentity *flow.Identity,
+	conIdentity bootstrap.NodeInfo,
 	verIdentities flow.IdentityList,
 	othersIdentity flow.IdentityList,
 	completeERs CompleteExecutionReceiptList,
@@ -478,27 +481,37 @@ func withConsumers(t *testing.T,
 	log := zerolog.Nop()
 
 	// bootstraps system with one node of each role.
-	s, verID, participants := bootstrapSystem(t, log, tracer, authorized)
-	exeID := participants.Filter(filter.HasRole(flow.RoleExecution))[0]
-	conID := participants.Filter(filter.HasRole(flow.RoleConsensus))[0]
+	s, verID, bootstrapNodesInfo := bootstrapSystem(t, log, tracer, authorized)
+
+	participants := bootstrap.ToIdentityList(bootstrapNodesInfo)
+	exeIndex := slices.IndexFunc(bootstrapNodesInfo, func(info bootstrap.NodeInfo) bool {
+		return info.Role == flow.RoleExecution
+	})
+	conIndex := slices.IndexFunc(bootstrapNodesInfo, func(info bootstrap.NodeInfo) bool {
+		return info.Role == flow.RoleConsensus
+	})
 	// generates a chain of blocks in the form of root <- R1 <- C1 <- R2 <- C2 <- ... where Rs are distinct reference
 	// blocks (i.e., containing guarantees), and Cs are container blocks for their preceding reference block,
 	// Container blocks only contain receipts of their preceding reference blocks. But they do not
 	// hold any guarantees.
 	root, err := s.State.Final().Head()
 	require.NoError(t, err)
+	protocolState, err := s.State.Final().ProtocolState()
+	require.NoError(t, err)
+	protocolStateID := protocolState.Entry().ID()
+
 	chainID := root.ChainID
 	ops = append(ops, WithExecutorIDs(
-		participants.Filter(filter.HasRole(flow.RoleExecution)).NodeIDs()), func(builder *CompleteExecutionReceiptBuilder) {
+		participants.Filter(filter.HasRole[flow.Identity](flow.RoleExecution)).NodeIDs()), func(builder *CompleteExecutionReceiptBuilder) {
 		// needed for the guarantees to have the correct chainID and signer indices
-		builder.clusterCommittee = participants.Filter(filter.HasRole(flow.RoleCollection))
+		builder.clusterCommittee = participants.Filter(filter.HasRole[flow.Identity](flow.RoleCollection))
 	})
 
 	// random sources for all blocks:
 	//  - root block (block[0]) is executed with sources[0] (included in QC of child block[1])
 	//  - block[i] is executed with sources[i] (included in QC of child block[i+1])
 	sources := unittest.RandomSourcesFixture(30)
-	completeERs := CompleteExecutionReceiptChainFixture(t, root, blockCount, sources, ops...)
+	completeERs := CompleteExecutionReceiptChainFixture(t, root, protocolStateID, blockCount, sources, ops...)
 	blocks := ExtendStateWithFinalizedBlocks(t, completeERs, s.State)
 
 	// chunk assignment
@@ -507,7 +520,7 @@ func withConsumers(t *testing.T,
 	if authorized {
 		// only authorized verification node has some chunks assigned to it.
 		_, assignedChunkIDs = MockChunkAssignmentFixture(chunkAssigner,
-			flow.IdentityList{verID},
+			flow.IdentityList{verID.Identity()},
 			completeERs,
 			EvenChunkIndexAssigner)
 	}
@@ -527,7 +540,7 @@ func withConsumers(t *testing.T,
 	// execution node
 	exeNode, exeEngine, exeWG := SetupChunkDataPackProvider(t,
 		hub,
-		exeID,
+		bootstrapNodesInfo[exeIndex],
 		participants,
 		chainID,
 		completeERs,
@@ -538,8 +551,8 @@ func withConsumers(t *testing.T,
 	conNode, conEngine, conWG := SetupMockConsensusNode(t,
 		unittest.Logger(),
 		hub,
-		conID,
-		flow.IdentityList{verID},
+		bootstrapNodesInfo[conIndex],
+		flow.IdentityList{verID.Identity()},
 		participants,
 		completeERs,
 		chainID,
@@ -613,13 +626,21 @@ func bootstrapSystem(
 	authorized bool,
 ) (
 	*enginemock.StateFixture,
-	*flow.Identity,
-	flow.IdentityList,
+	bootstrap.NodeInfo,
+	[]bootstrap.NodeInfo,
 ) {
-	// creates identities to bootstrap system with
-	verID := unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification))
-	identities := unittest.CompleteIdentitySet(verID)
-	identities = append(identities, unittest.IdentityFixture(unittest.WithRole(flow.RoleExecution))) // adds extra execution node
+	// creates bootstrapNodesInfo to bootstrap system with
+	bootstrapNodesInfo := make([]bootstrap.NodeInfo, 0)
+	var verID bootstrap.NodeInfo
+	for _, missingRole := range unittest.CompleteIdentitySet() {
+		nodeInfo := unittest.PrivateNodeInfoFixture(unittest.WithRole(missingRole.Role))
+		if nodeInfo.Role == flow.RoleVerification {
+			verID = nodeInfo
+		}
+		bootstrapNodesInfo = append(bootstrapNodesInfo, nodeInfo)
+	}
+	bootstrapNodesInfo = append(bootstrapNodesInfo, unittest.PrivateNodeInfoFixture(unittest.WithRole(flow.RoleExecution))) // adds extra execution node
+	identities := bootstrap.ToIdentityList(bootstrapNodesInfo)
 
 	collector := &metrics.NoopCollector{}
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
@@ -628,14 +649,23 @@ func bootstrapSystem(
 
 	if !authorized {
 		// creates a new verification node identity that is unauthorized for this epoch
-		verID = unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification))
-		identities = identities.Union(flow.IdentityList{verID})
-
-		epochBuilder := unittest.NewEpochBuilder(t, stateFixture.State)
+		verID = unittest.PrivateNodeInfoFixture(unittest.WithRole(flow.RoleVerification))
+		bootstrapNodesInfo = append(bootstrapNodesInfo, verID)
+		identities = append(identities, verID.Identity())
+
+		mutableProtocolState := protocol_state.NewMutableProtocolState(
+			stateFixture.Storage.ProtocolState,
+			stateFixture.State.Params(),
+			stateFixture.Storage.Headers,
+			stateFixture.Storage.Results,
+			stateFixture.Storage.Setups,
+			stateFixture.Storage.EpochCommits,
+		)
+		epochBuilder := unittest.NewEpochBuilder(t, mutableProtocolState, stateFixture.State)
 		epochBuilder.
-			UsingSetupOpts(unittest.WithParticipants(identities)).
+			UsingSetupOpts(unittest.WithParticipants(identities.ToSkeleton())).
 			BuildEpoch()
 	}
 
-	return stateFixture, verID, identities
+	return stateFixture, verID, bootstrapNodesInfo
 }
diff --git a/engine/verification/verifier/engine.go b/engine/verification/verifier/engine.go
index fd7f6571f6e..b2cd1a140fb 100644
--- a/engine/verification/verifier/engine.go
+++ b/engine/verification/verifier/engine.go
@@ -294,7 +294,7 @@ func (e *Engine) verify(ctx context.Context, originID flow.Identifier,
 	// Extracting consensus node ids
 	// TODO state extraction should be done based on block references
 	consensusNodes, err := e.state.Final().
-		Identities(filter.HasRole(flow.RoleConsensus))
+		Identities(filter.HasRole[flow.Identity](flow.RoleConsensus))
 	if err != nil {
 		// TODO this error needs more advance handling after MVP
 		return fmt.Errorf("could not load consensus node IDs: %w", err)
diff --git a/follower/consensus_follower.go b/follower/consensus_follower.go
index 7eecf02300f..35cc77a3965 100644
--- a/follower/consensus_follower.go
+++ b/follower/consensus_follower.go
@@ -103,10 +103,10 @@ type BootstrapNodeInfo struct {
 	NetworkPublicKey crypto.PublicKey // the network public key of the bootstrap peer
 }
 
-func bootstrapIdentities(bootstrapNodes []BootstrapNodeInfo) flow.IdentityList {
-	ids := make(flow.IdentityList, len(bootstrapNodes))
+func bootstrapIdentities(bootstrapNodes []BootstrapNodeInfo) flow.IdentitySkeletonList {
+	ids := make(flow.IdentitySkeletonList, len(bootstrapNodes))
 	for i, b := range bootstrapNodes {
-		ids[i] = &flow.Identity{
+		ids[i] = &flow.IdentitySkeleton{
 			Role:          flow.RoleAccess,
 			NetworkPubKey: b.NetworkPublicKey,
 			Address:       fmt.Sprintf("%s:%d", b.Host, b.Port),
diff --git a/follower/follower_builder.go b/follower/follower_builder.go
index 5e2edd31eb0..2988ee2767e 100644
--- a/follower/follower_builder.go
+++ b/follower/follower_builder.go
@@ -86,8 +86,8 @@ import (
 type FollowerServiceConfig struct {
 	bootstrapNodeAddresses  []string
 	bootstrapNodePublicKeys []string
-	bootstrapIdentities     flow.IdentityList // the identity list of bootstrap peers the node uses to discover other nodes
-	NetworkKey              crypto.PrivateKey // the networking key passed in by the caller when being used as a library
+	bootstrapIdentities     flow.IdentitySkeletonList // the identity list of bootstrap peers the node uses to discover other nodes
+	NetworkKey              crypto.PrivateKey         // the networking key passed in by the caller when being used as a library
 	baseOptions             []cmd.Option
 }
 
@@ -331,7 +331,7 @@ func (builder *FollowerServiceBuilder) BuildConsensusFollower() cmd.NodeBuilder
 
 type FollowerOption func(*FollowerServiceConfig)
 
-func WithBootStrapPeers(bootstrapNodes ...*flow.Identity) FollowerOption {
+func WithBootStrapPeers(bootstrapNodes ...*flow.IdentitySkeleton) FollowerOption {
 	return func(config *FollowerServiceConfig) {
 		config.bootstrapIdentities = bootstrapNodes
 	}
@@ -385,13 +385,13 @@ func publicNetworkMsgValidators(log zerolog.Logger, idProvider module.IdentityPr
 // BootstrapIdentities converts the bootstrap node addresses and keys to a Flow Identity list where
 // each Flow Identity is initialized with the passed address, the networking key
 // and the Node ID set to ZeroID, role set to Access, 0 stake and no staking key.
-func BootstrapIdentities(addresses []string, keys []string) (flow.IdentityList, error) {
+func BootstrapIdentities(addresses []string, keys []string) (flow.IdentitySkeletonList, error) {
 
 	if len(addresses) != len(keys) {
 		return nil, fmt.Errorf("number of addresses and keys provided for the boostrap nodes don't match")
 	}
 
-	ids := make([]*flow.Identity, len(addresses))
+	ids := make(flow.IdentitySkeletonList, len(addresses))
 	for i, address := range addresses {
 		key := keys[i]
 
@@ -409,7 +409,7 @@ func BootstrapIdentities(addresses []string, keys []string) (flow.IdentityList,
 		}
 
 		// create the identity of the peer by setting only the relevant fields
-		ids[i] = &flow.Identity{
+		ids[i] = &flow.IdentitySkeleton{
 			NodeID:        flow.ZeroID, // the NodeID is the hash of the staking key and for the public network it does not apply
 			Address:       address,
 			Role:          flow.RoleAccess, // the upstream node has to be an access node
@@ -621,7 +621,7 @@ func (builder *FollowerServiceBuilder) initPublicLibp2pNode(networkKey crypto.Pr
 func (builder *FollowerServiceBuilder) initObserverLocal() func(node *cmd.NodeConfig) error {
 	return func(node *cmd.NodeConfig) error {
 		// for an observer, set the identity here explicitly since it will not be found in the protocol state
-		self := &flow.Identity{
+		self := flow.IdentitySkeleton{
 			NodeID:        node.NodeID,
 			NetworkPubKey: node.NetworkKey.PublicKey(),
 			StakingPubKey: nil,             // no staking key needed for the observer
diff --git a/fvm/bootstrap.go b/fvm/bootstrap.go
index ea1610a2304..7ce37e0828b 100644
--- a/fvm/bootstrap.go
+++ b/fvm/bootstrap.go
@@ -76,13 +76,7 @@ type BootstrapParams struct {
 	minimumStorageReservation        cadence.UFix64
 	storagePerFlow                   cadence.UFix64
 	restrictedAccountCreationEnabled cadence.Bool
-
-	// `setupEVMEnabled` == true && `evmAbiOnly` == true will enable the ABI-only EVM
-	// `setupEVMEnabled` == true && `evmAbiOnly` == false will enable the full EVM functionality
-	// `setupEVMEnabled` == false will disable EVM
-	// This will allow to quickly disable the ABI-only EVM, in case there's a bug or something.
-	setupEVMEnabled cadence.Bool
-	evmAbiOnly      cadence.Bool
+	setupEVMEnabled                  cadence.Bool
 
 	// versionFreezePeriod is the number of blocks in the future where the version
 	// changes are frozen. The Node version beacon manages the freeze period,
@@ -225,13 +219,6 @@ func WithSetupEVMEnabled(enabled cadence.Bool) BootstrapProcedureOption {
 	}
 }
 
-func WithEVMABIOnly(evmAbiOnly cadence.Bool) BootstrapProcedureOption {
-	return func(bp *BootstrapProcedure) *BootstrapProcedure {
-		bp.evmAbiOnly = evmAbiOnly
-		return bp
-	}
-}
-
 func WithRestrictedContractDeployment(restricted *bool) BootstrapProcedureOption {
 	return func(bp *BootstrapProcedure) *BootstrapProcedure {
 		bp.restrictedContractDeployment = restricted
@@ -329,7 +316,9 @@ func (b *bootstrapExecutor) Preprocess() error {
 }
 
 func (b *bootstrapExecutor) Execute() error {
-	b.rootBlock = flow.Genesis(flow.ChainID(b.ctx.Chain.String())).Header
+	if b.rootBlock == nil {
+		b.rootBlock = flow.Genesis(b.ctx.Chain.ChainID()).Header
+	}
 
 	// initialize the account addressing state
 	b.accountCreator = environment.NewBootstrapAccountCreator(
@@ -828,7 +817,7 @@ func (b *bootstrapExecutor) setupEVM(serviceAddress, fungibleTokenAddress, flowT
 		// deploy the EVM contract to the service account
 		tx := blueprints.DeployContractTransaction(
 			serviceAddress,
-			stdlib.ContractCode(flowTokenAddress, bool(b.evmAbiOnly)),
+			stdlib.ContractCode(flowTokenAddress),
 			stdlib.ContractName,
 		)
 		// WithEVMEnabled should only be used after we create an account for storage
diff --git a/fvm/environment/block_info.go b/fvm/environment/block_info.go
index 9e55a67c649..928859c21f2 100644
--- a/fvm/environment/block_info.go
+++ b/fvm/environment/block_info.go
@@ -142,6 +142,10 @@ func (info *blockInfo) GetBlockAtHeight(
 		return runtimeBlockFromHeader(info.blockHeader), true, nil
 	}
 
+	if height+uint64(flow.DefaultTransactionExpiry) < info.blockHeader.Height {
+		return runtime.Block{}, false, errors.NewBlockHeightOutOfRangeError(height)
+	}
+
 	header, err := info.blocks.ByHeightFrom(height, info.blockHeader)
 	// TODO (ramtin): remove dependency on storage and move this if condition
 	// to blockfinder
diff --git a/fvm/environment/env.go b/fvm/environment/env.go
index 59dc4f83416..031eb460dc4 100644
--- a/fvm/environment/env.go
+++ b/fvm/environment/env.go
@@ -41,6 +41,8 @@ type Environment interface {
 	ConvertedServiceEvents() flow.ServiceEventList
 
 	// SystemContracts
+	ContractFunctionInvoker
+
 	AccountsStorageCapacity(
 		addresses []flow.Address,
 		payer flow.Address,
diff --git a/fvm/environment/invoker.go b/fvm/environment/invoker.go
new file mode 100644
index 00000000000..8041acdb363
--- /dev/null
+++ b/fvm/environment/invoker.go
@@ -0,0 +1,28 @@
+package environment
+
+import (
+	"github.com/onflow/cadence"
+	"github.com/onflow/cadence/runtime/sema"
+
+	"github.com/onflow/flow-go/model/flow"
+)
+
+// ContractFunctionSpec specify all the information, except the function's
+// address and arguments, needed to invoke the contract function.
+type ContractFunctionSpec struct {
+	AddressFromChain func(flow.Chain) flow.Address
+	LocationName     string
+	FunctionName     string
+	ArgumentTypes    []sema.Type
+}
+
+// ContractFunctionInvoker invokes a contract function
+type ContractFunctionInvoker interface {
+	Invoke(
+		spec ContractFunctionSpec,
+		arguments []cadence.Value,
+	) (
+		cadence.Value,
+		error,
+	)
+}
diff --git a/fvm/environment/meter.go b/fvm/environment/meter.go
index 1541ef69740..6e436f971c0 100644
--- a/fvm/environment/meter.go
+++ b/fvm/environment/meter.go
@@ -57,6 +57,17 @@ const (
 	ComputationKindEVMDecodeABI
 )
 
+// MainnetExecutionEffortWeights are the execution effort weights as they are
+// on mainnet from 18.8.2022
+var MainnetExecutionEffortWeights = meter.ExecutionEffortWeights{
+	common.ComputationKindStatement:          1569,
+	common.ComputationKindLoop:               1569,
+	common.ComputationKindFunctionInvocation: 1569,
+	ComputationKindGetValue:                  808,
+	ComputationKindCreateAccount:             2837670,
+	ComputationKindSetValue:                  765,
+}
+
 type Meter interface {
 	MeterComputation(common.ComputationKind, uint) error
 	ComputationUsed() (uint64, error)
diff --git a/fvm/environment/mock/contract_function_invoker.go b/fvm/environment/mock/contract_function_invoker.go
new file mode 100644
index 00000000000..a01c2ac4f4c
--- /dev/null
+++ b/fvm/environment/mock/contract_function_invoker.go
@@ -0,0 +1,55 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mock
+
+import (
+	cadence "github.com/onflow/cadence"
+	environment "github.com/onflow/flow-go/fvm/environment"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// ContractFunctionInvoker is an autogenerated mock type for the ContractFunctionInvoker type
+type ContractFunctionInvoker struct {
+	mock.Mock
+}
+
+// Invoke provides a mock function with given fields: spec, arguments
+func (_m *ContractFunctionInvoker) Invoke(spec environment.ContractFunctionSpec, arguments []cadence.Value) (cadence.Value, error) {
+	ret := _m.Called(spec, arguments)
+
+	var r0 cadence.Value
+	var r1 error
+	if rf, ok := ret.Get(0).(func(environment.ContractFunctionSpec, []cadence.Value) (cadence.Value, error)); ok {
+		return rf(spec, arguments)
+	}
+	if rf, ok := ret.Get(0).(func(environment.ContractFunctionSpec, []cadence.Value) cadence.Value); ok {
+		r0 = rf(spec, arguments)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(cadence.Value)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(environment.ContractFunctionSpec, []cadence.Value) error); ok {
+		r1 = rf(spec, arguments)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+type mockConstructorTestingTNewContractFunctionInvoker interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewContractFunctionInvoker creates a new instance of ContractFunctionInvoker. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewContractFunctionInvoker(t mockConstructorTestingTNewContractFunctionInvoker) *ContractFunctionInvoker {
+	mock := &ContractFunctionInvoker{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/fvm/environment/mock/environment.go b/fvm/environment/mock/environment.go
index 63b52c751a4..aac5cad5d31 100644
--- a/fvm/environment/mock/environment.go
+++ b/fvm/environment/mock/environment.go
@@ -967,6 +967,32 @@ func (_m *Environment) InteractionUsed() (uint64, error) {
 	return r0, r1
 }
 
+// Invoke provides a mock function with given fields: spec, arguments
+func (_m *Environment) Invoke(spec environment.ContractFunctionSpec, arguments []cadence.Value) (cadence.Value, error) {
+	ret := _m.Called(spec, arguments)
+
+	var r0 cadence.Value
+	var r1 error
+	if rf, ok := ret.Get(0).(func(environment.ContractFunctionSpec, []cadence.Value) (cadence.Value, error)); ok {
+		return rf(spec, arguments)
+	}
+	if rf, ok := ret.Get(0).(func(environment.ContractFunctionSpec, []cadence.Value) cadence.Value); ok {
+		r0 = rf(spec, arguments)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(cadence.Value)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(environment.ContractFunctionSpec, []cadence.Value) error); ok {
+		r1 = rf(spec, arguments)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // IsServiceAccountAuthorizer provides a mock function with given fields:
 func (_m *Environment) IsServiceAccountAuthorizer() bool {
 	ret := _m.Called()
diff --git a/fvm/environment/system_contracts.go b/fvm/environment/system_contracts.go
index 52a4ce7312d..402fc5f9b00 100644
--- a/fvm/environment/system_contracts.go
+++ b/fvm/environment/system_contracts.go
@@ -12,15 +12,6 @@ import (
 	"github.com/onflow/flow-go/module/trace"
 )
 
-// ContractFunctionSpec specify all the information, except the function's
-// address and arguments, needed to invoke the contract function.
-type ContractFunctionSpec struct {
-	AddressFromChain func(flow.Chain) flow.Address
-	LocationName     string
-	FunctionName     string
-	ArgumentTypes    []sema.Type
-}
-
 // SystemContracts provides methods for invoking system contract functions as
 // service account.
 type SystemContracts struct {
diff --git a/fvm/errors/codes.go b/fvm/errors/codes.go
index cdbc734bd3d..c4648667e1e 100644
--- a/fvm/errors/codes.go
+++ b/fvm/errors/codes.go
@@ -4,31 +4,31 @@ import "fmt"
 
 type ErrorCode uint16
 
-func (ec ErrorCode) IsFailure() bool {
-	return ec >= FailureCodeUnknownFailure
-}
-
 func (ec ErrorCode) String() string {
-	if ec.IsFailure() {
-		return fmt.Sprintf("[Failure Code: %d]", ec)
-	}
 	return fmt.Sprintf("[Error Code: %d]", ec)
 }
 
+type FailureCode uint16
+
+func (fc FailureCode) String() string {
+	return fmt.Sprintf("[Failure Code: %d]", fc)
+}
+
 const (
-	FailureCodeUnknownFailure     ErrorCode = 2000
-	FailureCodeEncodingFailure    ErrorCode = 2001
-	FailureCodeLedgerFailure      ErrorCode = 2002
-	FailureCodeStateMergeFailure  ErrorCode = 2003
-	FailureCodeBlockFinderFailure ErrorCode = 2004
-	// Deprecated: No longer used.
-	FailureCodeHasherFailure                           ErrorCode = 2005
-	FailureCodeParseRestrictedModeInvalidAccessFailure ErrorCode = 2006
-	FailureCodePayerBalanceCheckFailure                ErrorCode = 2007
-	FailureCodeDerivedDataCacheImplementationFailure   ErrorCode = 2008
-	FailureCodeRandomSourceFailure                     ErrorCode = 2009
-	// Deprecated: No longer used.
-	FailureCodeMetaTransactionFailure ErrorCode = 2100
+	FailureCodeUnknownFailure     FailureCode = 2000
+	FailureCodeEncodingFailure    FailureCode = 2001
+	FailureCodeLedgerFailure      FailureCode = 2002
+	FailureCodeStateMergeFailure  FailureCode = 2003
+	FailureCodeBlockFinderFailure FailureCode = 2004
+	// Deprecated: No longer used.
+	FailureCodeHasherFailure                           FailureCode = 2005
+	FailureCodeParseRestrictedModeInvalidAccessFailure FailureCode = 2006
+	FailureCodePayerBalanceCheckFailure                FailureCode = 2007
+	FailureCodeDerivedDataCacheImplementationFailure   FailureCode = 2008
+	FailureCodeRandomSourceFailure                     FailureCode = 2009
+	FailureCodeEVMFailure                              FailureCode = 2010
+	// Deprecated: No longer used.
+	FailureCodeMetaTransactionFailure FailureCode = 2100
 )
 
 const (
@@ -60,6 +60,7 @@ const (
 	ErrCodeAccountAuthorizationError   ErrorCode = 1055
 	ErrCodeOperationAuthorizationError ErrorCode = 1056
 	ErrCodeOperationNotSupportedError  ErrorCode = 1057
+	ErrCodeBlockHeightOutOfRangeError  ErrorCode = 1058
 
 	// execution errors 1100 - 1200
 	// Deprecated: No longer used.
diff --git a/fvm/errors/errors.go b/fvm/errors/errors.go
index 30c6464b2d4..47997d6feec 100644
--- a/fvm/errors/errors.go
+++ b/fvm/errors/errors.go
@@ -10,9 +10,15 @@ import (
 )
 
 type Unwrappable interface {
+	error
 	Unwrap() error
 }
 
+type UnwrappableErrors interface {
+	error
+	Unwrap() []error
+}
+
 type CodedError interface {
 	Code() ErrorCode
 
@@ -20,6 +26,13 @@ type CodedError interface {
 	error
 }
 
+type CodedFailure interface {
+	Code() FailureCode
+
+	Unwrappable
+	error
+}
+
 // Is is a utility function to call std error lib `Is` function for instance equality checks.
 func Is(err error, target error) bool {
 	return stdErrors.Is(err, target)
@@ -33,15 +46,14 @@ func As(err error, target interface{}) bool {
 	return stdErrors.As(err, target)
 }
 
-// findImportantCodedError recursively unwraps the error to search for important
-// coded error:
+// findRootCodedError recursively unwraps the error to search for the root (deepest) coded error:
 //  1. If err is nil, this returns (nil, false),
 //  2. If err has no error code, this returns (nil, true),
-//  3. If err has a failure error code, this returns
-//     (<the shallowest failure coded error>, false),
-//  4. If err has a non-failure error code, this returns
-//     (<the deepest, aka root cause, non-failure coded error>, false)
-func findImportantCodedError(err error) (CodedError, bool) {
+//  3. If err has an error code, this returns
+//     (<the deepest, aka root cause, coded error>, false)
+//
+// Note: This assumes the caller has already checked if the error contains a CodedFailure.
+func findRootCodedError(err error) (CodedError, bool) {
 	if err == nil {
 		return nil, false
 	}
@@ -52,10 +64,6 @@ func findImportantCodedError(err error) (CodedError, bool) {
 	}
 
 	for {
-		if coded.Code().IsFailure() {
-			return coded, false
-		}
-
 		var nextCoded CodedError
 		if !As(coded.Unwrap(), &nextCoded) {
 			return coded, false
@@ -68,32 +76,45 @@ func findImportantCodedError(err error) (CodedError, bool) {
 // IsFailure returns true if the error is un-coded, or if the error contains
 // a failure code.
 func IsFailure(err error) bool {
+	return AsFailure(err) != nil
+}
+
+func AsFailure(err error) CodedFailure {
 	if err == nil {
-		return false
+		return nil
+	}
+
+	var failure CodedFailure
+	if As(err, &failure) {
+		return failure
 	}
 
-	coded, isUnknown := findImportantCodedError(err)
-	return isUnknown || coded.Code().IsFailure()
+	var coded CodedError
+	if !As(err, &coded) {
+		return NewUnknownFailure(err)
+	}
+
+	return nil
 }
 
 // SplitErrorTypes splits the error into fatal (failures) and non-fatal errors
-func SplitErrorTypes(inp error) (err CodedError, failure CodedError) {
+func SplitErrorTypes(inp error) (err CodedError, failure CodedFailure) {
 	if inp == nil {
 		return nil, nil
 	}
 
-	coded, isUnknown := findImportantCodedError(inp)
-	if isUnknown {
-		return nil, NewUnknownFailure(inp)
-	}
-
-	if coded.Code().IsFailure() {
-		return nil, WrapCodedError(
-			coded.Code(),
+	if failure = AsFailure(inp); failure != nil {
+		return nil, WrapCodedFailure(
+			failure.Code(),
 			inp,
 			"failure caused by")
 	}
 
+	coded, isUnknown := findRootCodedError(inp)
+	if isUnknown {
+		return nil, NewUnknownFailure(inp)
+	}
+
 	return WrapCodedError(
 		coded.Code(),
 		inp,
@@ -118,38 +139,86 @@ func HandleRuntimeError(err error) error {
 	return NewCadenceRuntimeError(runErr)
 }
 
-// This returns true if the error or one of its nested errors matches the
+// HasErrorCode returns true if the error or one of its nested errors matches the
 // specified error code.
 func HasErrorCode(err error, code ErrorCode) bool {
 	return Find(err, code) != nil
 }
 
-// This recursively unwraps the error and returns first CodedError that matches
+// HasFailureCode returns true if the error or one of its nested errors matches the
+// specified failure code.
+func HasFailureCode(err error, code FailureCode) bool {
+	return FindFailure(err, code) != nil
+}
+
+// Find recursively unwraps the error and returns the first CodedError that matches
 // the specified error code.
 func Find(originalErr error, code ErrorCode) CodedError {
 	if originalErr == nil {
 		return nil
 	}
 
-	var unwrappable Unwrappable
-	if !As(originalErr, &unwrappable) {
+	// Handle non-chained errors
+	var unwrappedErrs []error
+	switch err := originalErr.(type) {
+	case *multierror.Error:
+		unwrappedErrs = err.WrappedErrors()
+	case UnwrappableErrors:
+		unwrappedErrs = err.Unwrap()
+
+	// IMPORTANT: this check needs to run after *multierror.Error because multierror does implement
+	// the Unwrappable interface, however its implementation only visits the base errors in the list,
+	// and ignores their descendants.
+	case Unwrappable:
+		coded, ok := err.(CodedError)
+		if ok && coded.Code() == code {
+			return coded
+		}
+		return Find(err.Unwrap(), code)
+	default:
 		return nil
 	}
 
-	coded, ok := unwrappable.(CodedError)
-	if ok && coded.Code() == code {
-		return coded
+	for _, innerErr := range unwrappedErrs {
+		coded := Find(innerErr, code)
+		if coded != nil {
+			return coded
+		}
 	}
 
-	// NOTE: we need to special case multierror.Error since As() will only
-	// inspect the first error within multierror.Error.
-	errors, ok := unwrappable.(*multierror.Error)
-	if !ok {
-		return Find(unwrappable.Unwrap(), code)
+	return nil
+}
+
+// FindFailure recursively unwraps the error and returns the first CodedFailure that matches
+// the specified error code.
+func FindFailure(originalErr error, code FailureCode) CodedFailure {
+	if originalErr == nil {
+		return nil
 	}
 
-	for _, innerErr := range errors.Errors {
-		coded = Find(innerErr, code)
+	// Handle non-chained errors
+	var unwrappedErrs []error
+	switch err := originalErr.(type) {
+	case *multierror.Error:
+		unwrappedErrs = err.WrappedErrors()
+	case UnwrappableErrors:
+		unwrappedErrs = err.Unwrap()
+
+	// IMPORTANT: this check needs to run after *multierror.Error because multierror does implement
+	// the Unwrappable interface, however its implementation only visits the base errors in the list,
+	// and ignores their descendants.
+	case Unwrappable:
+		coded, ok := err.(CodedFailure)
+		if ok && coded.Code() == code {
+			return coded
+		}
+		return FindFailure(err.Unwrap(), code)
+	default:
+		return nil
+	}
+
+	for _, innerErr := range unwrappedErrs {
+		coded := FindFailure(innerErr, code)
 		if coded != nil {
 			return coded
 		}
@@ -158,6 +227,8 @@ func Find(originalErr error, code ErrorCode) CodedError {
 	return nil
 }
 
+var _ CodedError = (*codedError)(nil)
+
 type codedError struct {
 	code ErrorCode
 
@@ -207,6 +278,56 @@ func (err codedError) Code() ErrorCode {
 	return err.code
 }
 
+var _ CodedFailure = (*codedFailure)(nil)
+
+type codedFailure struct {
+	code FailureCode
+	err  error
+}
+
+func newFailure(
+	code FailureCode,
+	rootCause error,
+) codedFailure {
+	return codedFailure{
+		code: code,
+		err:  rootCause,
+	}
+}
+
+func WrapCodedFailure(
+	code FailureCode,
+	err error,
+	prefixMsgFormat string,
+	formatArguments ...interface{},
+) codedFailure {
+	if prefixMsgFormat != "" {
+		msg := fmt.Sprintf(prefixMsgFormat, formatArguments...)
+		err = fmt.Errorf("%s: %w", msg, err)
+	}
+	return newFailure(code, err)
+}
+
+func NewCodedFailure(
+	code FailureCode,
+	format string,
+	formatArguments ...interface{},
+) codedFailure {
+	return newFailure(code, fmt.Errorf(format, formatArguments...))
+}
+
+func (err codedFailure) Unwrap() error {
+	return err.err
+}
+
+func (err codedFailure) Error() string {
+	return fmt.Sprintf("%v %v", err.code, err.err)
+}
+
+func (err codedFailure) Code() FailureCode {
+	return err.code
+}
+
 // NewEventEncodingError construct a new CodedError which indicates
 // that encoding event has failed
 func NewEventEncodingError(err error) CodedError {
@@ -219,6 +340,7 @@ func NewEventEncodingError(err error) CodedError {
 // in order for Cadence to correctly handle the error
 var _ errors.UserError = &(EVMError{})
 
+// EVMError captures any non-fatal EVM error
 type EVMError struct {
 	CodedError
 }
diff --git a/fvm/errors/errors_test.go b/fvm/errors/errors_test.go
index d0a262e0147..b634995b617 100644
--- a/fvm/errors/errors_test.go
+++ b/fvm/errors/errors_test.go
@@ -4,6 +4,11 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/hashicorp/go-multierror"
+	"github.com/onflow/cadence/runtime"
+	cadenceErr "github.com/onflow/cadence/runtime/errors"
+	"github.com/onflow/cadence/runtime/sema"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/model/flow"
@@ -39,7 +44,7 @@ func TestErrorHandling(t *testing.T) {
 		e5 := NewInvalidProposalSignatureError(flow.ProposalKey{}, e4)
 		e6 := fmt.Errorf("wrapped: %w", e5)
 
-		expectedErr := WrapCodedError(
+		expectedErr := WrapCodedFailure(
 			e3.Code(), // The shallowest failure's error code
 			e6,        // All the error message detail.
 			"failure caused by")
@@ -61,3 +66,334 @@ func TestErrorHandling(t *testing.T) {
 		require.True(t, IsFailure(e1))
 	})
 }
+
+func TestHandleRuntimeError(t *testing.T) {
+	baseErr := fmt.Errorf("base error")
+	tests := []struct {
+		name        string
+		err         error
+		errorCode   ErrorCode
+		failureCode FailureCode
+	}{
+		{
+			name: "nil error",
+			err:  nil,
+		},
+		{
+			name:        "unknown error",
+			err:         baseErr,
+			failureCode: FailureCodeUnknownFailure,
+		},
+		{
+			name:      "runtime error",
+			err:       runtime.Error{Err: baseErr},
+			errorCode: ErrCodeCadenceRunTimeError,
+		},
+		{
+			name: "coded error in Unwrappable error",
+			err: runtime.Error{
+				Err: cadenceErr.ExternalError{
+					Recovered: NewScriptExecutionCancelledError(baseErr),
+				},
+			},
+			errorCode: ErrCodeScriptExecutionCancelledError,
+		},
+		{
+			name: "coded error in ParentError error",
+			err: createCheckerErr([]error{
+				fmt.Errorf("first error"),
+				NewScriptExecutionTimedOutError(),
+			}),
+			errorCode: ErrCodeScriptExecutionTimedOutError,
+		},
+		{
+			name: "first coded error returned",
+			err: createCheckerErr([]error{
+				fmt.Errorf("first error"),
+				NewScriptExecutionTimedOutError(),
+				NewScriptExecutionCancelledError(baseErr),
+			}),
+			errorCode: ErrCodeScriptExecutionTimedOutError,
+		},
+		{
+			name: "failure returned",
+			err: createCheckerErr([]error{
+				fmt.Errorf("first error"),
+				NewLedgerFailure(baseErr),
+			}),
+			failureCode: FailureCodeLedgerFailure,
+		},
+		{
+			name: "error before failure returns failure",
+			err: createCheckerErr([]error{
+				fmt.Errorf("first error"),
+				NewScriptExecutionTimedOutError(),
+				NewLedgerFailure(baseErr),
+			}),
+			failureCode: FailureCodeLedgerFailure,
+		},
+		{
+			name: "embedded coded errors return deepest error",
+			err: createCheckerErr([]error{
+				fmt.Errorf("first error"),
+				NewScriptExecutionCancelledError(
+					NewScriptExecutionTimedOutError(),
+				),
+			}),
+			errorCode: ErrCodeScriptExecutionTimedOutError,
+		},
+		{
+			name: "failure with embedded error returns failure",
+			err: createCheckerErr([]error{
+				fmt.Errorf("first error"),
+				NewLedgerFailure(
+					NewScriptExecutionTimedOutError(),
+				),
+			}),
+			failureCode: FailureCodeLedgerFailure,
+		},
+		{
+			name: "coded error with embedded failure returns failure",
+			err: createCheckerErr([]error{
+				fmt.Errorf("first error"),
+				NewScriptExecutionCancelledError(
+					NewLedgerFailure(baseErr),
+				),
+			}),
+			failureCode: FailureCodeLedgerFailure,
+		},
+		{
+			name: "error tree with failure returns failure",
+			err: createCheckerErr([]error{
+				fmt.Errorf("first error"),
+				NewScriptExecutionCancelledError(baseErr),
+				createCheckerErr([]error{
+					fmt.Errorf("first error"),
+					NewScriptExecutionCancelledError(
+						NewLedgerFailure(baseErr),
+					),
+				}),
+			}),
+			failureCode: FailureCodeLedgerFailure,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			actual := HandleRuntimeError(tc.err)
+			if tc.err == nil {
+				assert.NoError(t, actual)
+				return
+			}
+
+			actualCoded, failureCoded := SplitErrorTypes(actual)
+
+			if tc.failureCode != 0 {
+				assert.NoError(t, actualCoded)
+				assert.Equalf(t, tc.failureCode, failureCoded.Code(), "error code mismatch: expected %d, got %d", tc.failureCode, failureCoded.Code())
+			} else {
+				assert.NoError(t, failureCoded)
+				assert.Equalf(t, tc.errorCode, actualCoded.Code(), "error code mismatch: expected %d, got %d", tc.errorCode, actualCoded.Code())
+			}
+		})
+	}
+}
+
+func TestFind(t *testing.T) {
+	targetCode := ErrCodeScriptExecutionCancelledError
+	baseErr := fmt.Errorf("base error")
+
+	tests := []struct {
+		name  string
+		err   error
+		found bool
+	}{
+		{
+			name:  "nil error",
+			err:   nil,
+			found: false,
+		},
+		{
+			name:  "plain error",
+			err:   baseErr,
+			found: false,
+		},
+		{
+			name:  "wrapped plain error",
+			err:   fmt.Errorf("wrapped: %w", baseErr),
+			found: false,
+		},
+		{
+			name:  "coded failure",
+			err:   NewLedgerFailure(baseErr),
+			found: false,
+		},
+		{
+			name:  "incorrect coded error",
+			err:   NewScriptExecutionTimedOutError(),
+			found: false,
+		},
+		{
+			name:  "found",
+			err:   NewScriptExecutionCancelledError(baseErr),
+			found: true,
+		},
+		{
+			name:  "found with embedded errors",
+			err:   NewScriptExecutionCancelledError(NewLedgerFailure(NewScriptExecutionTimedOutError())),
+			found: true,
+		},
+		{
+			name:  "found embedded in error",
+			err:   NewDerivedDataCacheImplementationFailure(NewScriptExecutionCancelledError(baseErr)),
+			found: true,
+		},
+		{
+			name:  "found embedded in failure",
+			err:   NewLedgerFailure(NewScriptExecutionCancelledError(baseErr)),
+			found: true,
+		},
+		{
+			name: "found embedded with multierror",
+			err: &multierror.Error{
+				Errors: []error{
+					baseErr,
+					NewScriptExecutionTimedOutError(),
+					NewLedgerFailure(NewScriptExecutionCancelledError(baseErr)),
+				},
+			},
+			found: true,
+		},
+		{
+			name: "found within embedded error tree",
+			err: createCheckerErr([]error{
+				fmt.Errorf("first error"),
+				NewLedgerFailure(baseErr),
+				createCheckerErr([]error{
+					fmt.Errorf("first error"),
+					NewLedgerFailure(
+						NewScriptExecutionCancelledError(baseErr),
+					),
+				}),
+			}),
+			found: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			actual := Find(tc.err, targetCode)
+			if !tc.found {
+				assert.NoError(t, actual)
+				return
+			}
+
+			require.Error(t, actual, "expected error but none found")
+			assert.Equalf(t, targetCode, actual.Code(), "error code mismatch: expected %d, got %d", targetCode, actual.Code())
+		})
+	}
+}
+
+func TestFindFailure(t *testing.T) {
+	targetCode := FailureCodeLedgerFailure
+	baseErr := fmt.Errorf("base error")
+	tests := []struct {
+		name  string
+		err   error
+		found bool
+	}{
+		{
+			name:  "nil error",
+			err:   nil,
+			found: false,
+		},
+		{
+			name:  "plain error",
+			err:   baseErr,
+			found: false,
+		},
+		{
+			name:  "wrapped plain error",
+			err:   fmt.Errorf("wrapped: %w", baseErr),
+			found: false,
+		},
+		{
+			name:  "coded error",
+			err:   NewScriptExecutionTimedOutError(),
+			found: false,
+		},
+		{
+			name:  "incorrect coded failure",
+			err:   NewStateMergeFailure(baseErr),
+			found: false,
+		},
+		{
+			name:  "found",
+			err:   NewLedgerFailure(baseErr),
+			found: true,
+		},
+		{
+			name:  "found with embedded errors",
+			err:   NewLedgerFailure(NewScriptExecutionCancelledError(NewScriptExecutionTimedOutError())),
+			found: true,
+		},
+		{
+			name:  "found embedded in error",
+			err:   NewDerivedDataCacheImplementationFailure(NewLedgerFailure(baseErr)),
+			found: true,
+		},
+		{
+			name:  "found embedded in failure",
+			err:   NewStateMergeFailure(NewLedgerFailure(baseErr)),
+			found: true,
+		},
+		{
+			name: "found embedded with multierror",
+			err: &multierror.Error{
+				Errors: []error{
+					baseErr,
+					NewScriptExecutionTimedOutError(),
+					NewScriptExecutionCancelledError(NewLedgerFailure(baseErr)),
+				},
+			},
+			found: true,
+		},
+		{
+			name: "found within embedded error tree",
+			err: createCheckerErr([]error{
+				fmt.Errorf("first error"),
+				NewScriptExecutionCancelledError(baseErr),
+				createCheckerErr([]error{
+					fmt.Errorf("first error"),
+					NewScriptExecutionCancelledError(
+						NewLedgerFailure(baseErr),
+					),
+				}),
+			}),
+			found: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			actual := FindFailure(tc.err, targetCode)
+			if !tc.found {
+				assert.NoError(t, actual)
+				return
+			}
+
+			require.Error(t, actual, "expected error but none found")
+			assert.Equalf(t, targetCode, actual.Code(), "error code mismatch: expected %d, got %d", targetCode, actual.Code())
+		})
+	}
+}
+
+func createCheckerErr(errs []error) error {
+	return runtime.Error{
+		Err: cadenceErr.ExternalError{
+			Recovered: sema.CheckerError{
+				Errors: errs,
+			},
+		},
+	}
+}
diff --git a/fvm/errors/execution.go b/fvm/errors/execution.go
index d70e47e6b7c..b484c805f93 100644
--- a/fvm/errors/execution.go
+++ b/fvm/errors/execution.go
@@ -76,8 +76,8 @@ func IsInsufficientPayerBalanceError(err error) bool {
 func NewPayerBalanceCheckFailure(
 	payer flow.Address,
 	err error,
-) CodedError {
-	return WrapCodedError(
+) CodedFailure {
+	return WrapCodedFailure(
 		FailureCodePayerBalanceCheckFailure,
 		err,
 		"failed to check if the payer %s has sufficient balance",
@@ -88,8 +88,8 @@ func NewPayerBalanceCheckFailure(
 // the derived data cache.
 func NewDerivedDataCacheImplementationFailure(
 	err error,
-) CodedError {
-	return WrapCodedError(
+) CodedFailure {
+	return WrapCodedFailure(
 		FailureCodeDerivedDataCacheImplementationFailure,
 		err,
 		"implementation error in derived data cache")
@@ -99,8 +99,8 @@ func NewDerivedDataCacheImplementationFailure(
 // the random source provider.
 func NewRandomSourceFailure(
 	err error,
-) CodedError {
-	return WrapCodedError(
+) CodedFailure {
+	return WrapCodedFailure(
 		FailureCodeRandomSourceFailure,
 		err,
 		"implementation error in random source provider")
@@ -237,6 +237,17 @@ func IsOperationNotSupportedError(err error) bool {
 	return HasErrorCode(err, ErrCodeOperationNotSupportedError)
 }
 
+func NewBlockHeightOutOfRangeError(height uint64) CodedError {
+	return NewCodedError(
+		ErrCodeBlockHeightOutOfRangeError,
+		"block height (%v) is out of queriable range",
+		height)
+}
+
+func IsBlockHeightOutOfRangeError(err error) bool {
+	return HasErrorCode(err, ErrCodeBlockHeightOutOfRangeError)
+}
+
 // NewScriptExecutionCancelledError construct a new CodedError which indicates
 // that Cadence Script execution has been cancelled (e.g. request connection
 // has been droped)
diff --git a/fvm/errors/failures.go b/fvm/errors/failures.go
index 322fd0ac117..df9b2c1104b 100644
--- a/fvm/errors/failures.go
+++ b/fvm/errors/failures.go
@@ -4,8 +4,8 @@ import (
 	"github.com/onflow/flow-go/module/trace"
 )
 
-func NewUnknownFailure(err error) CodedError {
-	return WrapCodedError(
+func NewUnknownFailure(err error) CodedFailure {
+	return WrapCodedFailure(
 		FailureCodeUnknownFailure,
 		err,
 		"unknown failure")
@@ -16,8 +16,8 @@ func NewEncodingFailuref(
 	err error,
 	msg string,
 	args ...interface{},
-) CodedError {
-	return WrapCodedError(
+) CodedFailure {
+	return WrapCodedFailure(
 		FailureCodeEncodingFailure,
 		err,
 		"encoding failed: "+msg,
@@ -26,8 +26,8 @@ func NewEncodingFailuref(
 
 // NewLedgerFailure constructs a new CodedError which captures a fatal error
 // cause by ledger failures.
-func NewLedgerFailure(err error) CodedError {
-	return WrapCodedError(
+func NewLedgerFailure(err error) CodedFailure {
+	return WrapCodedFailure(
 		FailureCodeLedgerFailure,
 		err,
 		"ledger returns unsuccessful")
@@ -36,13 +36,13 @@ func NewLedgerFailure(err error) CodedError {
 // IsLedgerFailure returns true if the error or any of the wrapped errors is
 // a ledger failure
 func IsLedgerFailure(err error) bool {
-	return HasErrorCode(err, FailureCodeLedgerFailure)
+	return HasFailureCode(err, FailureCodeLedgerFailure)
 }
 
 // NewStateMergeFailure constructs a new CodedError which captures a fatal
 // caused by state merge.
-func NewStateMergeFailure(err error) CodedError {
-	return WrapCodedError(
+func NewStateMergeFailure(err error) CodedFailure {
+	return WrapCodedFailure(
 		FailureCodeStateMergeFailure,
 		err,
 		"can not merge the state")
@@ -50,8 +50,8 @@ func NewStateMergeFailure(err error) CodedError {
 
 // NewBlockFinderFailure constructs a new CodedError which captures a fatal
 // caused by block finder.
-func NewBlockFinderFailure(err error) CodedError {
-	return WrapCodedError(
+func NewBlockFinderFailure(err error) CodedFailure {
+	return WrapCodedFailure(
 		FailureCodeBlockFinderFailure,
 		err,
 		"can not retrieve the block")
@@ -62,9 +62,18 @@ func NewBlockFinderFailure(err error) CodedError {
 // operation while it is parsing programs.
 func NewParseRestrictedModeInvalidAccessFailure(
 	spanName trace.SpanName,
-) CodedError {
-	return NewCodedError(
+) CodedFailure {
+	return NewCodedFailure(
 		FailureCodeParseRestrictedModeInvalidAccessFailure,
 		"cannot access %s while cadence is in parse restricted mode",
 		spanName)
 }
+
+// NewEVMFailure constructs a new CodedFailure which captures a fatal
+// caused by the EVM.
+func NewEVMFailure(err error) CodedFailure {
+	return WrapCodedFailure(
+		FailureCodeEVMFailure,
+		err,
+		"evm failure")
+}
diff --git a/fvm/evm/backends/wrappedEnv.go b/fvm/evm/backends/wrappedEnv.go
new file mode 100644
index 00000000000..d22aabc191c
--- /dev/null
+++ b/fvm/evm/backends/wrappedEnv.go
@@ -0,0 +1,158 @@
+package backends
+
+import (
+	"github.com/onflow/atree"
+	"github.com/onflow/cadence"
+	"github.com/onflow/cadence/runtime"
+	"github.com/onflow/cadence/runtime/common"
+
+	"github.com/onflow/flow-go/fvm/environment"
+	"github.com/onflow/flow-go/fvm/errors"
+	"github.com/onflow/flow-go/fvm/evm/types"
+	"github.com/onflow/flow-go/fvm/meter"
+	"github.com/onflow/flow-go/model/flow"
+)
+
+// WrappedEnvironment wraps an FVM environment
+type WrappedEnvironment struct {
+	env environment.Environment
+}
+
+// NewWrappedEnvironment constructs a new wrapped environment
+func NewWrappedEnvironment(env environment.Environment) types.Backend {
+	return &WrappedEnvironment{env}
+}
+
+var _ types.Backend = &WrappedEnvironment{}
+
+func (we *WrappedEnvironment) GetValue(owner, key []byte) ([]byte, error) {
+	val, err := we.env.GetValue(owner, key)
+	return val, handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) SetValue(owner, key, value []byte) error {
+	err := we.env.SetValue(owner, key, value)
+	return handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) ValueExists(owner, key []byte) (bool, error) {
+	b, err := we.env.ValueExists(owner, key)
+	return b, handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) AllocateStorageIndex(owner []byte) (atree.StorageIndex, error) {
+	index, err := we.env.AllocateStorageIndex(owner)
+	return index, handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) MeterComputation(kind common.ComputationKind, intensity uint) error {
+	err := we.env.MeterComputation(kind, intensity)
+	return handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) ComputationUsed() (uint64, error) {
+	val, err := we.env.ComputationUsed()
+	return val, handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) ComputationIntensities() meter.MeteredComputationIntensities {
+	return we.env.ComputationIntensities()
+}
+
+func (we *WrappedEnvironment) ComputationAvailable(kind common.ComputationKind, intensity uint) bool {
+	return we.env.ComputationAvailable(kind, intensity)
+}
+
+func (we *WrappedEnvironment) MeterMemory(usage common.MemoryUsage) error {
+	err := we.env.MeterMemory(usage)
+	return handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) MemoryUsed() (uint64, error) {
+	val, err := we.env.MemoryUsed()
+	return val, handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) MeterEmittedEvent(byteSize uint64) error {
+	err := we.env.MeterEmittedEvent(byteSize)
+	return handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) TotalEmittedEventBytes() uint64 {
+	return we.env.TotalEmittedEventBytes()
+}
+
+func (we *WrappedEnvironment) InteractionUsed() (uint64, error) {
+	val, err := we.env.InteractionUsed()
+	return val, handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) EmitEvent(event cadence.Event) error {
+	err := we.env.EmitEvent(event)
+	return handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) Events() flow.EventsList {
+	return we.env.Events()
+
+}
+
+func (we *WrappedEnvironment) ServiceEvents() flow.EventsList {
+	return we.env.ServiceEvents()
+}
+
+func (we *WrappedEnvironment) ConvertedServiceEvents() flow.ServiceEventList {
+	return we.env.ConvertedServiceEvents()
+}
+
+func (we *WrappedEnvironment) Reset() {
+	we.env.Reset()
+}
+
+func (we *WrappedEnvironment) GetCurrentBlockHeight() (uint64, error) {
+	val, err := we.env.GetCurrentBlockHeight()
+	return val, handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) GetBlockAtHeight(height uint64) (
+	runtime.Block,
+	bool,
+	error,
+) {
+	val, found, err := we.env.GetBlockAtHeight(height)
+	return val, found, handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) ReadRandom(buffer []byte) error {
+	err := we.env.ReadRandom(buffer)
+	return handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) Invoke(
+	spec environment.ContractFunctionSpec,
+	arguments []cadence.Value,
+) (
+	cadence.Value,
+	error,
+) {
+	val, err := we.env.Invoke(spec, arguments)
+	return val, handleEnvironmentError(err)
+}
+
+func (we *WrappedEnvironment) GenerateUUID() (uint64, error) {
+	uuid, err := we.env.GenerateUUID()
+	return uuid, handleEnvironmentError(err)
+}
+
+func handleEnvironmentError(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	// fvm fatal errors
+	if errors.IsFailure(err) {
+		return types.NewFatalError(err)
+	}
+
+	return types.NewBackendError(err)
+}
diff --git a/fvm/evm/emulator/config.go b/fvm/evm/emulator/config.go
index e1bfc0b1375..87185e775cf 100644
--- a/fvm/evm/emulator/config.go
+++ b/fvm/evm/emulator/config.go
@@ -4,20 +4,19 @@ import (
 	"math"
 	"math/big"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethCore "github.com/ethereum/go-ethereum/core"
-	gethVM "github.com/ethereum/go-ethereum/core/vm"
-	gethCrypto "github.com/ethereum/go-ethereum/crypto"
-	gethParams "github.com/ethereum/go-ethereum/params"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethCore "github.com/onflow/go-ethereum/core"
+	gethVM "github.com/onflow/go-ethereum/core/vm"
+	gethParams "github.com/onflow/go-ethereum/params"
 
 	"github.com/onflow/flow-go/fvm/evm/types"
 )
 
 var (
-	FlowEVMTestnetChainID = big.NewInt(666)
-	FlowEVMMainnetChainID = big.NewInt(777)
-	BlockLevelGasLimit    = uint64(math.MaxUint64)
-	zero                  = uint64(0)
+	DefaultBlockLevelGasLimit = uint64(math.MaxUint64)
+	DefaultBaseFee            = big.NewInt(0)
+	zero                      = uint64(0)
+	bigZero                   = big.NewInt(0)
 )
 
 // Config sets the required parameters
@@ -32,8 +31,6 @@ type Config struct {
 	TxContext *gethVM.TxContext
 	// base unit of gas for direct calls
 	DirectCallBaseGasUsage uint64
-	// a set of extra precompiles to be injected
-	ExtraPrecompiles map[gethCommon.Address]gethVM.PrecompiledContract
 }
 
 func (c *Config) ChainRules() gethParams.Rules {
@@ -51,22 +48,22 @@ func (c *Config) ChainRules() gethParams.Rules {
 // and set a proper height for the specific release based on the Flow EVM heights
 // so it could gets activated at a desired time.
 var DefaultChainConfig = &gethParams.ChainConfig{
-	ChainID: FlowEVMTestnetChainID, // default is testnet
+	ChainID: types.FlowEVMPreviewNetChainID,
 
 	// Fork scheduling based on block heights
-	HomesteadBlock:      big.NewInt(0),
-	DAOForkBlock:        big.NewInt(0),
+	HomesteadBlock:      bigZero,
+	DAOForkBlock:        bigZero,
 	DAOForkSupport:      false,
-	EIP150Block:         big.NewInt(0),
-	EIP155Block:         big.NewInt(0),
-	EIP158Block:         big.NewInt(0),
-	ByzantiumBlock:      big.NewInt(0), // already on Byzantium
-	ConstantinopleBlock: big.NewInt(0), // already on Constantinople
-	PetersburgBlock:     big.NewInt(0), // already on Petersburg
-	IstanbulBlock:       big.NewInt(0), // already on Istanbul
-	BerlinBlock:         big.NewInt(0), // already on Berlin
-	LondonBlock:         big.NewInt(0), // already on London
-	MuirGlacierBlock:    big.NewInt(0), // already on MuirGlacier
+	EIP150Block:         bigZero,
+	EIP155Block:         bigZero,
+	EIP158Block:         bigZero,
+	ByzantiumBlock:      bigZero, // already on Byzantium
+	ConstantinopleBlock: bigZero, // already on Constantinople
+	PetersburgBlock:     bigZero, // already on Petersburg
+	IstanbulBlock:       bigZero, // already on Istanbul
+	BerlinBlock:         bigZero, // already on Berlin
+	LondonBlock:         bigZero, // already on London
+	MuirGlacierBlock:    bigZero, // already on MuirGlacier
 
 	// Fork scheduling based on timestamps
 	ShanghaiTime: &zero, // already on Shanghai
@@ -74,10 +71,15 @@ var DefaultChainConfig = &gethParams.ChainConfig{
 	PragueTime:   &zero, // already on Prague
 }
 
+// Default config supports the dynamic fee structure (EIP-1559)
+// so it accepts both legacy transactions with a fixed gas price
+// and dynamic transactions with tip and cap.
+// Yet default config keeps the base fee to zero (no automatic adjustment)
 func defaultConfig() *Config {
 	return &Config{
 		ChainConfig: DefaultChainConfig,
 		EVMConfig: gethVM.Config{
+			// setting this flag let us we force the base fee to zero (coinbase will collect)
 			NoBaseFee: true,
 		},
 		TxContext: &gethVM.TxContext{
@@ -87,11 +89,12 @@ func defaultConfig() *Config {
 		BlockContext: &gethVM.BlockContext{
 			CanTransfer: gethCore.CanTransfer,
 			Transfer:    gethCore.Transfer,
-			GasLimit:    BlockLevelGasLimit, // block gas limit
-			BaseFee:     big.NewInt(0),
-			GetHash: func(n uint64) gethCommon.Hash { // default returns some random hash values
-				return gethCommon.BytesToHash(gethCrypto.Keccak256([]byte(new(big.Int).SetUint64(n).String())))
+			GasLimit:    DefaultBlockLevelGasLimit,
+			BaseFee:     DefaultBaseFee,
+			GetHash: func(n uint64) gethCommon.Hash {
+				return gethCommon.Hash{}
 			},
+			GetPrecompile: gethCore.GetPrecompile,
 		},
 	}
 }
@@ -107,23 +110,14 @@ func NewConfig(opts ...Option) *Config {
 
 type Option func(*Config) *Config
 
-// WithMainnetChainID sets the chain ID to flow evm testnet
-func WithTestnetChainID() Option {
+// WithChainID sets the evm chain ID
+func WithChainID(chainID *big.Int) Option {
 	return func(c *Config) *Config {
-		c.ChainConfig.ChainID = FlowEVMTestnetChainID
+		c.ChainConfig.ChainID = chainID
 		return c
 	}
 }
 
-// WithMainnetChainID sets the chain ID to flow evm mainnet
-func WithMainnetChainID() Option {
-	return func(c *Config) *Config {
-		c.ChainConfig.ChainID = FlowEVMMainnetChainID
-		return c
-	}
-
-}
-
 // WithOrigin sets the origin of the transaction (signer)
 func WithOrigin(origin gethCommon.Address) Option {
 	return func(c *Config) *Config {
@@ -191,12 +185,25 @@ func WithDirectCallBaseGasUsage(gas uint64) Option {
 // WithExtraPrecompiles appends precompile list with extra precompiles
 func WithExtraPrecompiles(precompiles []types.Precompile) Option {
 	return func(c *Config) *Config {
+		extraPreCompMap := make(map[gethCommon.Address]gethVM.PrecompiledContract)
 		for _, pc := range precompiles {
-			if c.ExtraPrecompiles == nil {
-				c.ExtraPrecompiles = make(map[gethCommon.Address]gethVM.PrecompiledContract)
+			extraPreCompMap[pc.Address().ToCommon()] = pc
+		}
+		c.BlockContext.GetPrecompile = func(rules gethParams.Rules, addr gethCommon.Address) (gethVM.PrecompiledContract, bool) {
+			prec, found := extraPreCompMap[addr]
+			if found {
+				return prec, true
 			}
-			c.ExtraPrecompiles[pc.Address().ToCommon()] = pc
+			return gethCore.GetPrecompile(rules, addr)
 		}
 		return c
 	}
 }
+
+// WithRandom sets the block context random field
+func WithRandom(rand *gethCommon.Hash) Option {
+	return func(c *Config) *Config {
+		c.BlockContext.Random = rand
+		return c
+	}
+}
diff --git a/fvm/evm/emulator/emulator.go b/fvm/evm/emulator/emulator.go
index 93561565a59..9e165c05c0b 100644
--- a/fvm/evm/emulator/emulator.go
+++ b/fvm/evm/emulator/emulator.go
@@ -3,12 +3,13 @@ package emulator
 import (
 	"math/big"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethCore "github.com/ethereum/go-ethereum/core"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	gethVM "github.com/ethereum/go-ethereum/core/vm"
-	gethCrypto "github.com/ethereum/go-ethereum/crypto"
 	"github.com/onflow/atree"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethCore "github.com/onflow/go-ethereum/core"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethVM "github.com/onflow/go-ethereum/core/vm"
+	gethCrypto "github.com/onflow/go-ethereum/crypto"
+	gethParams "github.com/onflow/go-ethereum/params"
 
 	"github.com/onflow/flow-go/fvm/evm/emulator/state"
 	"github.com/onflow/flow-go/fvm/evm/types"
@@ -36,10 +37,14 @@ func NewEmulator(
 
 func newConfig(ctx types.BlockContext) *Config {
 	return NewConfig(
+		WithChainID(ctx.ChainID),
 		WithBlockNumber(new(big.Int).SetUint64(ctx.BlockNumber)),
+		WithBlockTime(ctx.BlockTimestamp),
 		WithCoinbase(ctx.GasFeeCollector.ToCommon()),
 		WithDirectCallBaseGasUsage(ctx.DirectCallBaseGasUsage),
 		WithExtraPrecompiles(ctx.ExtraPrecompiles),
+		WithGetBlockHashFunction(ctx.GetHashFunc),
+		WithRandom(&ctx.Random),
 	)
 }
 
@@ -54,7 +59,6 @@ func (em *Emulator) NewReadOnlyBlockView(ctx types.BlockContext) (types.ReadOnly
 // NewBlockView constructs a new block view (mutable)
 func (em *Emulator) NewBlockView(ctx types.BlockContext) (types.BlockView, error) {
 	cfg := newConfig(ctx)
-	SetupPrecompile(cfg)
 	return &BlockView{
 		config:   cfg,
 		rootAddr: em.rootAddr,
@@ -73,14 +77,19 @@ func (bv *ReadOnlyBlockView) BalanceOf(address types.Address) (*big.Int, error)
 	return bv.state.GetBalance(address.ToCommon()), nil
 }
 
+// NonceOf returns the nonce of the given address
+func (bv *ReadOnlyBlockView) NonceOf(address types.Address) (uint64, error) {
+	return bv.state.GetNonce(address.ToCommon()), nil
+}
+
 // CodeOf returns the code of the given address
 func (bv *ReadOnlyBlockView) CodeOf(address types.Address) (types.Code, error) {
 	return bv.state.GetCode(address.ToCommon()), nil
 }
 
-// NonceOf returns the nonce of the given address
-func (bv *ReadOnlyBlockView) NonceOf(address types.Address) (uint64, error) {
-	return bv.state.GetNonce(address.ToCommon()), nil
+// CodeHashOf returns the code hash of the given address
+func (bv *ReadOnlyBlockView) CodeHashOf(address types.Address) ([]byte, error) {
+	return bv.state.GetCodeHash(address.ToCommon()).Bytes(), nil
 }
 
 // BlockView allows mutation of the evm state as part of a block
@@ -99,39 +108,61 @@ func (bl *BlockView) DirectCall(call *types.DirectCall) (*types.Result, error) {
 	if err != nil {
 		return nil, err
 	}
-	var res *types.Result
+	txHash, err := call.Hash()
+	if err != nil {
+		return nil, err
+	}
 	switch call.SubType {
 	case types.DepositCallSubType:
-		res, err = proc.mintTo(call.To, call.Value)
+		return proc.mintTo(call, txHash)
 	case types.WithdrawCallSubType:
-		res, err = proc.withdrawFrom(call.From, call.Value)
+		return proc.withdrawFrom(call, txHash)
+	case types.DeployCallSubType:
+		if !call.EmptyToField() {
+			return proc.deployAt(call.From, call.To, call.Data, call.GasLimit, call.Value, txHash)
+		}
+		fallthrough
 	default:
-		res, err = proc.run(call.Message(), types.DirectCallTxType)
+		// TODO: when we support mutiple calls per block, we need
+		// to update the value zero here for tx index
+		return proc.runDirect(call.Message(), txHash, 0)
 	}
-	return res, err
 }
 
 // RunTransaction runs an evm transaction
 func (bl *BlockView) RunTransaction(
 	tx *gethTypes.Transaction,
 ) (*types.Result, error) {
+	var res *types.Result
 	var err error
 	proc, err := bl.newProcedure()
 	if err != nil {
 		return nil, err
 	}
-
-	msg, err := gethCore.TransactionToMessage(tx, GetSigner(bl.config), proc.config.BlockContext.BaseFee)
+	txHash := tx.Hash()
+	msg, err := gethCore.TransactionToMessage(
+		tx,
+		GetSigner(bl.config),
+		proc.config.BlockContext.BaseFee)
 	if err != nil {
-		// note that this is not a fatal error (e.g. due to bad signature)
+		// this is not a fatal error (e.g. due to bad signature)
 		// not a valid transaction
-		return nil, types.NewEVMValidationError(err)
+		res = &types.Result{
+			TxType: tx.Type(),
+			TxHash: txHash,
+		}
+		res.SetValidationError(err)
+		return res, nil
 	}
 
 	// update tx context origin
 	proc.evm.TxContext.Origin = msg.From
-	res, err := proc.run(msg, tx.Type())
-	return res, err
+	res, err = proc.run(msg, txHash, 0, tx.Type())
+	if err != nil {
+		return nil, err
+	}
+	// all commmit errors (StateDB errors) has to be returned
+	return res, proc.commitAndFinalize()
 }
 
 func (bl *BlockView) newProcedure() (*procedure, error) {
@@ -159,82 +190,234 @@ type procedure struct {
 	state  types.StateDB
 }
 
-// commit commits the changes to the state.
-func (proc *procedure) commit() error {
-	return handleCommitError(proc.state.Commit())
+// commit commits the changes to the state (with finalization)
+func (proc *procedure) commitAndFinalize() error {
+	err := proc.state.Commit(true)
+	if err != nil {
+		// if known types (state errors) don't do anything and return
+		if types.IsAFatalError(err) || types.IsAStateError(err) {
+			return err
+		}
+
+		// else is a new fatal error
+		return types.NewFatalError(err)
+	}
+	return nil
 }
 
-func handleCommitError(err error) error {
-	if err == nil {
-		return nil
+func (proc *procedure) mintTo(
+	call *types.DirectCall,
+	txHash gethCommon.Hash,
+) (*types.Result, error) {
+	bridge := call.From.ToCommon()
+
+	// create bridge account if not exist
+	if !proc.state.Exist(bridge) {
+		proc.state.CreateAccount(bridge)
 	}
-	// if known types (state errors) don't do anything and return
-	if types.IsAFatalError(err) || types.IsAStateError(err) {
-		return err
+
+	// add balance to the bridge account before transfer
+	proc.state.AddBalance(bridge, call.Value)
+
+	msg := call.Message()
+	proc.evm.TxContext.Origin = msg.From
+	// withdraw the amount and move it to the bridge account
+	res, err := proc.run(msg, txHash, 0, types.DirectCallTxType)
+	if err != nil {
+		return res, err
 	}
 
-	// else is a new fatal error
-	return types.NewFatalError(err)
+	// if any error (invalid or vm) on the internal call, revert and don't commit any change
+	// this prevents having cases that we add balance to the bridge but the transfer
+	// fails due to gas, etc.
+	// TODO: in the future we might just return without error and handle everything on higher level
+	if res.Invalid() || res.Failed() {
+		return res, types.ErrInternalDirectCallFailed
+	}
+
+	// all commmit errors (StateDB errors) has to be returned
+	return res, proc.commitAndFinalize()
 }
 
-func (proc *procedure) mintTo(address types.Address, amount *big.Int) (*types.Result, error) {
-	addr := address.ToCommon()
-	res := &types.Result{
-		GasConsumed: proc.config.DirectCallBaseGasUsage,
-		TxType:      types.DirectCallTxType,
+func (proc *procedure) withdrawFrom(
+	call *types.DirectCall,
+	txHash gethCommon.Hash,
+) (*types.Result, error) {
+	bridge := call.To.ToCommon()
+
+	// create bridge account if not exist
+	if !proc.state.Exist(bridge) {
+		proc.state.CreateAccount(bridge)
 	}
 
-	// create account if not exist
-	if !proc.state.Exist(addr) {
-		proc.state.CreateAccount(addr)
+	// withdraw the amount and move it to the bridge account
+	msg := call.Message()
+	proc.evm.TxContext.Origin = msg.From
+	res, err := proc.run(msg, txHash, 0, types.DirectCallTxType)
+	if err != nil {
+		return res, err
 	}
 
-	// add balance
-	proc.state.AddBalance(addr, amount)
+	// if any error (invalid or vm) on the internal call, revert and don't commit any change
+	// TODO: in the future we might just return without error and handle everything on higher level
+	if res.Invalid() || res.Failed() {
+		return res, types.ErrInternalDirectCallFailed
+	}
 
-	// we don't need to increment any nonce, given the origin doesn't exist
-	return res, proc.commit()
+	// now deduct the balance from the bridge
+	proc.state.SubBalance(bridge, call.Value)
+	// all commmit errors (StateDB errors) has to be returned
+	return res, proc.commitAndFinalize()
 }
 
-func (proc *procedure) withdrawFrom(address types.Address, amount *big.Int) (*types.Result, error) {
+// deployAt deploys a contract at the given target address
+// behaviour should be similar to what evm.create internal method does with
+// a few differences, don't need to check for previous forks given this
+// functionality was not available to anyone, we don't need to
+// follow snapshoting, given we do commit/revert style in this code base.
+// in the future we might optimize this method accepting deploy-ready byte codes
+// and skip interpreter call, gas calculations and many checks.
+func (proc *procedure) deployAt(
+	caller types.Address,
+	to types.Address,
+	data types.Code,
+	gasLimit uint64,
+	value *big.Int,
+	txHash gethCommon.Hash,
+) (*types.Result, error) {
+	if value.Sign() < 0 {
+		return nil, types.ErrInvalidBalance
+	}
 
-	addr := address.ToCommon()
 	res := &types.Result{
-		GasConsumed: proc.config.DirectCallBaseGasUsage,
-		TxType:      types.DirectCallTxType,
+		TxType: types.DirectCallTxType,
+		TxHash: txHash,
+	}
+
+	addr := to.ToCommon()
+
+	// precheck 1 - check balance of the source
+	if value.Sign() != 0 &&
+		!proc.evm.Context.CanTransfer(proc.state, caller.ToCommon(), value) {
+		res.SetValidationError(gethCore.ErrInsufficientFundsForTransfer)
+		return res, nil
+	}
+
+	// precheck 2 - ensure there's no existing eoa or contract is deployed at the address
+	contractHash := proc.state.GetCodeHash(addr)
+	if proc.state.GetNonce(addr) != 0 ||
+		(contractHash != (gethCommon.Hash{}) && contractHash != gethTypes.EmptyCodeHash) {
+		res.VMError = gethVM.ErrContractAddressCollision
+		return res, nil
+	}
+
+	callerCommon := caller.ToCommon()
+	// setup caller if doesn't exist
+	if !proc.state.Exist(callerCommon) {
+		proc.state.CreateAccount(callerCommon)
+	}
+	// increment the nonce for the caller
+	proc.state.SetNonce(callerCommon, proc.state.GetNonce(callerCommon)+1)
+
+	// setup account
+	proc.state.CreateAccount(addr)
+	proc.state.SetNonce(addr, 1) // (EIP-158)
+	if value.Sign() > 0 {
+		proc.evm.Context.Transfer( // transfer value
+			proc.state,
+			caller.ToCommon(),
+			addr,
+			value,
+		)
+	}
+
+	// run code through interpreter
+	// this would check for errors and computes the final bytes to be stored under account
+	var err error
+	inter := gethVM.NewEVMInterpreter(proc.evm)
+	contract := gethVM.NewContract(
+		gethVM.AccountRef(caller.ToCommon()),
+		gethVM.AccountRef(addr),
+		value,
+		gasLimit)
+
+	contract.SetCallCode(&addr, gethCrypto.Keccak256Hash(data), data)
+	// update access list (Berlin)
+	proc.state.AddAddressToAccessList(addr)
+
+	ret, err := inter.Run(contract, nil, false)
+	gasCost := uint64(len(ret)) * gethParams.CreateDataGas
+	res.GasConsumed = gasCost
+
+	// handle errors
+	if err != nil {
+		// for all errors except this one consume all the remaining gas (Homestead)
+		if err != gethVM.ErrExecutionReverted {
+			res.GasConsumed = gasLimit
+		}
+		res.VMError = err
+		return res, nil
 	}
 
-	// check if account exists
-	// while this method is only called from bridged accounts
-	// it might be the case that someone creates a bridged account
-	// and never transfer tokens to and call for withdraw
-	// TODO: we might revisit this apporach and
-	// 		return res, types.ErrAccountDoesNotExist
-	// instead
-	if !proc.state.Exist(addr) {
-		proc.state.CreateAccount(addr)
+	// update gas usage
+	if gasCost > gasLimit {
+		// consume all the remaining gas (Homestead)
+		res.GasConsumed = gasLimit
+		res.VMError = gethVM.ErrCodeStoreOutOfGas
+		return res, nil
 	}
 
-	// check the source account balance
-	// if balance is lower than amount needed for withdrawal, error out
-	if proc.state.GetBalance(addr).Cmp(amount) < 0 {
-		return res, types.ErrInsufficientBalance
+	// check max code size (EIP-158)
+	if len(ret) > gethParams.MaxCodeSize {
+		// consume all the remaining gas (Homestead)
+		res.GasConsumed = gasLimit
+		res.VMError = gethVM.ErrMaxCodeSizeExceeded
+		return res, nil
 	}
 
-	// sub balance
-	proc.state.SubBalance(addr, amount)
+	// reject code starting with 0xEF (EIP-3541)
+	if len(ret) >= 1 && ret[0] == 0xEF {
+		// consume all the remaining gas (Homestead)
+		res.GasConsumed = gasLimit
+		res.VMError = gethVM.ErrInvalidCode
+		return res, nil
+	}
 
-	// we increment the nonce for source account cause
-	// withdraw counts as a transaction
-	nonce := proc.state.GetNonce(addr)
-	proc.state.SetNonce(addr, nonce+1)
+	proc.state.SetCode(addr, ret)
+	res.DeployedContractAddress = to
+	return res, proc.commitAndFinalize()
+}
 
-	return res, proc.commit()
+func (proc *procedure) runDirect(
+	msg *gethCore.Message,
+	txHash gethCommon.Hash,
+	txIndex uint,
+) (*types.Result, error) {
+	// set the nonce for the message (needed for some opeartions like deployment)
+	msg.Nonce = proc.state.GetNonce(msg.From)
+	proc.evm.TxContext.Origin = msg.From
+	res, err := proc.run(msg, txHash, txIndex, types.DirectCallTxType)
+	if err != nil {
+		return nil, err
+	}
+	// all commmit errors (StateDB errors) has to be returned
+	return res, proc.commitAndFinalize()
 }
 
-func (proc *procedure) run(msg *gethCore.Message, txType uint8) (*types.Result, error) {
+// run runs a geth core.message and returns the
+// results, any validation or execution errors
+// are captured inside the result, the remaining
+// return errors are errors requires extra handling
+// on upstream (e.g. backend errors).
+func (proc *procedure) run(
+	msg *gethCore.Message,
+	txHash gethCommon.Hash,
+	txIndex uint,
+	txType uint8,
+) (*types.Result, error) {
 	res := types.Result{
 		TxType: txType,
+		TxHash: txHash,
 	}
 
 	gasPool := (*gethCore.GasPool)(&proc.config.BlockContext.GasLimit)
@@ -244,14 +427,15 @@ func (proc *procedure) run(msg *gethCore.Message, txType uint8) (*types.Result,
 		gasPool,
 	).TransitionDb()
 	if err != nil {
-		res.Failed = true
-		// if the error is a fatal error or a non-fatal state error return it
-		if types.IsAFatalError(err) || types.IsAStateError(err) {
-			return &res, err
+		// if the error is a fatal error or a non-fatal state error or a backend err return it
+		// this condition should never happen given all StateDB errors are withheld for the commit time.
+		if types.IsAFatalError(err) || types.IsAStateError(err) || types.IsABackendError(err) {
+			return nil, err
 		}
 		// otherwise is a validation error (pre-check failure)
 		// no state change, wrap the error and return
-		return &res, types.NewEVMValidationError(err)
+		res.SetValidationError(err)
+		return &res, nil
 	}
 
 	// if prechecks are passed, the exec result won't be nil
@@ -263,43 +447,16 @@ func (proc *procedure) run(msg *gethCore.Message, txType uint8) (*types.Result,
 			if msg.To == nil {
 				res.DeployedContractAddress = types.NewAddress(gethCrypto.CreateAddress(msg.From, msg.Nonce))
 			}
+			// replace tx index and tx hash
 			res.Logs = proc.state.Logs(
-				// TODO pass proper hash values
-				gethCommon.Hash{},
 				proc.config.BlockContext.BlockNumber.Uint64(),
-				gethCommon.Hash{},
-				0,
+				txHash,
+				txIndex,
 			)
 		} else {
-			res.Failed = true
-			err = types.NewEVMExecutionError(execResult.Err)
+			// execResult.Err is VM errors (we don't return it as error)
+			res.VMError = execResult.Err
 		}
 	}
-	commitErr := proc.commit()
-	if commitErr != nil {
-		return &res, commitErr
-	}
-	return &res, err
-}
-
-func SetupPrecompile(cfg *Config) {
-	rules := cfg.ChainRules()
-	// captures the pointer to the map that has to be augmented
-	var precompiles map[gethCommon.Address]gethVM.PrecompiledContract
-	switch {
-	case rules.IsCancun:
-		precompiles = gethVM.PrecompiledContractsCancun
-	case rules.IsBerlin:
-		precompiles = gethVM.PrecompiledContractsBerlin
-	case rules.IsIstanbul:
-		precompiles = gethVM.PrecompiledContractsIstanbul
-	case rules.IsByzantium:
-		precompiles = gethVM.PrecompiledContractsByzantium
-	default:
-		precompiles = gethVM.PrecompiledContractsHomestead
-	}
-	for addr, contract := range cfg.ExtraPrecompiles {
-		// we override if exist since we call this method on every block
-		precompiles[addr] = contract
-	}
+	return &res, nil
 }
diff --git a/fvm/evm/emulator/emulator_test.go b/fvm/evm/emulator/emulator_test.go
index a7c5768cca0..e1f7c20b10f 100644
--- a/fvm/evm/emulator/emulator_test.go
+++ b/fvm/evm/emulator/emulator_test.go
@@ -1,13 +1,15 @@
 package emulator_test
 
 import (
+	"fmt"
 	"math"
 	"math/big"
 	"testing"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	gethParams "github.com/ethereum/go-ethereum/params"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethVM "github.com/onflow/go-ethereum/core/vm"
+	gethParams "github.com/onflow/go-ethereum/params"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/fvm/evm/emulator"
@@ -41,13 +43,32 @@ func TestNativeTokenBridging(t *testing.T) {
 		testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
 			originalBalance := big.NewInt(10000)
 			testAccount := types.NewAddressFromString("test")
+			bridgeAccount := types.NewAddressFromString("bridge")
+			nonce := uint64(0)
 
 			t.Run("mint tokens to the first account", func(t *testing.T) {
 				RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
 					RunWithNewBlockView(t, env, func(blk types.BlockView) {
-						res, err := blk.DirectCall(types.NewDepositCall(testAccount, originalBalance))
+						call := types.NewDepositCall(bridgeAccount, testAccount, originalBalance, nonce)
+						res, err := blk.DirectCall(call)
 						require.NoError(t, err)
 						require.Equal(t, defaultCtx.DirectCallBaseGasUsage, res.GasConsumed)
+						expectedHash, err := call.Hash()
+						require.NoError(t, err)
+						require.Equal(t, expectedHash, res.TxHash)
+						nonce += 1
+					})
+				})
+				RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
+					RunWithNewReadOnlyBlockView(t, env, func(blk types.ReadOnlyBlockView) {
+						retBalance, err := blk.BalanceOf(testAccount)
+						require.NoError(t, err)
+						require.Equal(t, originalBalance, retBalance)
+						// check balance of bridgeAccount to be zero
+
+						retBalance, err = blk.BalanceOf(bridgeAccount)
+						require.NoError(t, err)
+						require.Equal(t, big.NewInt(0), retBalance)
 					})
 				})
 			})
@@ -62,9 +83,14 @@ func TestNativeTokenBridging(t *testing.T) {
 				})
 				RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
 					RunWithNewBlockView(t, env, func(blk types.BlockView) {
-						res, err := blk.DirectCall(types.NewWithdrawCall(testAccount, amount))
+						call := types.NewWithdrawCall(bridgeAccount, testAccount, amount, nonce)
+						res, err := blk.DirectCall(call)
 						require.NoError(t, err)
 						require.Equal(t, defaultCtx.DirectCallBaseGasUsage, res.GasConsumed)
+						expectedHash, err := call.Hash()
+						require.NoError(t, err)
+						require.Equal(t, expectedHash, res.TxHash)
+						nonce += 1
 					})
 				})
 				RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
@@ -72,6 +98,11 @@ func TestNativeTokenBridging(t *testing.T) {
 						retBalance, err := blk.BalanceOf(testAccount)
 						require.NoError(t, err)
 						require.Equal(t, amount.Sub(originalBalance, amount), retBalance)
+						// check balance of bridgeAccount to be zero
+
+						retBalance, err = blk.BalanceOf(bridgeAccount)
+						require.NoError(t, err)
+						require.Equal(t, big.NewInt(0), retBalance)
 					})
 				})
 			})
@@ -80,20 +111,25 @@ func TestNativeTokenBridging(t *testing.T) {
 }
 
 func TestContractInteraction(t *testing.T) {
+	t.Parallel()
 	testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
 		testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
 
 			testContract := testutils.GetStorageTestContract(t)
 
 			testAccount := types.NewAddressFromString("test")
+			bridgeAccount := types.NewAddressFromString("bridge")
+			nonce := uint64(0)
+
 			amount := big.NewInt(0).Mul(big.NewInt(1337), big.NewInt(gethParams.Ether))
 			amountToBeTransfered := big.NewInt(0).Mul(big.NewInt(100), big.NewInt(gethParams.Ether))
 
 			// fund test account
 			RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
 				RunWithNewBlockView(t, env, func(blk types.BlockView) {
-					_, err := blk.DirectCall(types.NewDepositCall(testAccount, amount))
+					_, err := blk.DirectCall(types.NewDepositCall(bridgeAccount, testAccount, amount, nonce))
 					require.NoError(t, err)
+					nonce += 1
 				})
 			})
 
@@ -102,15 +138,19 @@ func TestContractInteraction(t *testing.T) {
 			t.Run("deploy contract", func(t *testing.T) {
 				RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
 					RunWithNewBlockView(t, env, func(blk types.BlockView) {
-						res, err := blk.DirectCall(
-							types.NewDeployCall(
-								testAccount,
-								testContract.ByteCode,
-								math.MaxUint64,
-								amountToBeTransfered),
-						)
+						call := types.NewDeployCall(
+							testAccount,
+							testContract.ByteCode,
+							math.MaxUint64,
+							amountToBeTransfered,
+							nonce)
+						res, err := blk.DirectCall(call)
 						require.NoError(t, err)
 						contractAddr = res.DeployedContractAddress
+						expectedHash, err := call.Hash()
+						require.NoError(t, err)
+						require.Equal(t, expectedHash, res.TxHash)
+						nonce += 1
 					})
 					RunWithNewReadOnlyBlockView(t, env, func(blk types.ReadOnlyBlockView) {
 						require.NotNil(t, contractAddr)
@@ -131,7 +171,6 @@ func TestContractInteraction(t *testing.T) {
 
 			t.Run("call contract", func(t *testing.T) {
 				num := big.NewInt(10)
-
 				RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
 					RunWithNewBlockView(t, env, func(blk types.BlockView) {
 						res, err := blk.DirectCall(
@@ -141,10 +180,12 @@ func TestContractInteraction(t *testing.T) {
 								testContract.MakeCallData(t, "store", num),
 								1_000_000,
 								big.NewInt(0), // this should be zero because the contract doesn't have receiver
+								nonce,
 							),
 						)
 						require.NoError(t, err)
 						require.GreaterOrEqual(t, res.GasConsumed, uint64(40_000))
+						nonce += 1
 					})
 				})
 
@@ -157,9 +198,11 @@ func TestContractInteraction(t *testing.T) {
 								testContract.MakeCallData(t, "retrieve"),
 								1_000_000,
 								big.NewInt(0), // this should be zero because the contract doesn't have receiver
+								nonce,
 							),
 						)
 						require.NoError(t, err)
+						nonce += 1
 
 						ret := new(big.Int).SetBytes(res.ReturnedValue)
 						require.Equal(t, num, ret)
@@ -176,15 +219,37 @@ func TestContractInteraction(t *testing.T) {
 								testContract.MakeCallData(t, "blockNumber"),
 								1_000_000,
 								big.NewInt(0), // this should be zero because the contract doesn't have receiver
+								nonce,
 							),
 						)
 						require.NoError(t, err)
+						nonce += 1
 
 						ret := new(big.Int).SetBytes(res.ReturnedValue)
 						require.Equal(t, blockNumber, ret)
 					})
 				})
 
+				RunWithNewEmulator(t, backend, rootAddr, func(em *emulator.Emulator) {
+					ctx := types.NewDefaultBlockContext(blockNumber.Uint64())
+					blk, err := em.NewBlockView(ctx)
+					require.NoError(t, err)
+					res, err := blk.DirectCall(
+						types.NewContractCall(
+							testAccount,
+							contractAddr,
+							testContract.MakeCallData(t, "chainID"),
+							1_000_000,
+							big.NewInt(0), // this should be zero because the contract doesn't have receiver
+							nonce,
+						),
+					)
+					require.NoError(t, err)
+					nonce += 1
+
+					ret := new(big.Int).SetBytes(res.ReturnedValue)
+					require.Equal(t, types.FlowEVMPreviewNetChainID, ret)
+				})
 			})
 
 			t.Run("test sending transactions (happy case)", func(t *testing.T) {
@@ -192,7 +257,7 @@ func TestContractInteraction(t *testing.T) {
 				fAddr := account.Address()
 				RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
 					RunWithNewBlockView(t, env, func(blk types.BlockView) {
-						_, err := blk.DirectCall(types.NewDepositCall(fAddr, amount))
+						_, err := blk.DirectCall(types.NewDepositCall(bridgeAccount, fAddr, amount, account.Nonce()))
 						require.NoError(t, err)
 					})
 				})
@@ -203,7 +268,7 @@ func TestContractInteraction(t *testing.T) {
 					coinbaseOrgBalance := gethCommon.Big1
 					// small amount of money to create account
 					RunWithNewBlockView(t, env, func(blk types.BlockView) {
-						_, err := blk.DirectCall(types.NewDepositCall(ctx.GasFeeCollector, coinbaseOrgBalance))
+						_, err := blk.DirectCall(types.NewDepositCall(bridgeAccount, ctx.GasFeeCollector, coinbaseOrgBalance, 0))
 						require.NoError(t, err)
 					})
 
@@ -218,8 +283,10 @@ func TestContractInteraction(t *testing.T) {
 						gethCommon.Big1,        // gas fee
 
 					)
-					_, err = blk.RunTransaction(tx)
+					res, err := blk.RunTransaction(tx)
 					require.NoError(t, err)
+					require.NoError(t, res.VMError)
+					require.Greater(t, res.GasConsumed, uint64(0))
 
 					// check the balance of coinbase
 					RunWithNewReadOnlyBlockView(t, env, func(blk2 types.ReadOnlyBlockView) {
@@ -234,12 +301,57 @@ func TestContractInteraction(t *testing.T) {
 					})
 				})
 			})
+
+			t.Run("test runing transactions with dynamic fees (happy case)", func(t *testing.T) {
+				account := testutils.GetTestEOAAccount(t, testutils.EOATestAccount1KeyHex)
+				fAddr := account.Address()
+				RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
+					RunWithNewBlockView(t, env, func(blk types.BlockView) {
+						_, err := blk.DirectCall(types.NewDepositCall(bridgeAccount, fAddr, amount, account.Nonce()))
+						require.NoError(t, err)
+					})
+				})
+				account.SetNonce(account.Nonce() + 1)
+
+				RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
+					ctx := types.NewDefaultBlockContext(blockNumber.Uint64())
+					ctx.GasFeeCollector = types.NewAddressFromString("coinbase")
+					coinbaseOrgBalance := gethCommon.Big1
+					// small amount of money to create account
+					RunWithNewBlockView(t, env, func(blk types.BlockView) {
+						_, err := blk.DirectCall(types.NewDepositCall(bridgeAccount, ctx.GasFeeCollector, coinbaseOrgBalance, 1))
+						require.NoError(t, err)
+					})
+
+					blk, err := env.NewBlockView(ctx)
+					require.NoError(t, err)
+					tx := account.SignTx(
+						t,
+						gethTypes.NewTx(&gethTypes.DynamicFeeTx{
+							ChainID:   types.FlowEVMPreviewNetChainID,
+							Nonce:     account.Nonce(),
+							GasTipCap: big.NewInt(2),
+							GasFeeCap: big.NewInt(3),
+							Gas:       gethParams.TxGas,
+							To:        &gethCommon.Address{},
+							Value:     big.NewInt(1),
+						}),
+					)
+					account.SetNonce(account.Nonce() + 1)
+
+					res, err := blk.RunTransaction(tx)
+					require.NoError(t, err)
+					require.NoError(t, res.VMError)
+					require.Greater(t, res.GasConsumed, uint64(0))
+				})
+			})
+
 			t.Run("test sending transactions (invalid nonce)", func(t *testing.T) {
 				account := testutils.GetTestEOAAccount(t, testutils.EOATestAccount1KeyHex)
 				fAddr := account.Address()
 				RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
 					RunWithNewBlockView(t, env, func(blk types.BlockView) {
-						_, err := blk.DirectCall(types.NewDepositCall(fAddr, amount))
+						_, err := blk.DirectCall(types.NewDepositCall(bridgeAccount, fAddr, amount, account.Nonce()))
 						require.NoError(t, err)
 					})
 				})
@@ -258,9 +370,9 @@ func TestContractInteraction(t *testing.T) {
 							nil,                    // data
 						),
 					)
-					_, err = blk.RunTransaction(tx)
-					require.Error(t, err)
-					require.True(t, types.IsEVMValidationError(err))
+					res, err := blk.RunTransaction(tx)
+					require.NoError(t, err)
+					require.Error(t, res.ValidationError)
 				})
 			})
 
@@ -280,12 +392,181 @@ func TestContractInteraction(t *testing.T) {
 						R:        big.NewInt(2),
 						S:        big.NewInt(3),
 					})
-					_, err = blk.RunTransaction(tx)
-					require.Error(t, err)
-					require.True(t, types.IsEVMValidationError(err))
+					res, err := blk.RunTransaction(tx)
+					require.NoError(t, err)
+					require.Error(t, res.ValidationError)
+				})
+			})
+		})
+	})
+}
+
+func TestDeployAtFunctionality(t *testing.T) {
+	testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
+		testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
+			testContract := testutils.GetStorageTestContract(t)
+			testAccount := types.NewAddressFromString("test")
+			bridgeAccount := types.NewAddressFromString("bridge")
+
+			amount := big.NewInt(0).Mul(big.NewInt(1337), big.NewInt(gethParams.Ether))
+			amountToBeTransfered := big.NewInt(0).Mul(big.NewInt(100), big.NewInt(gethParams.Ether))
+
+			// fund test account
+			RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
+				RunWithNewBlockView(t, env, func(blk types.BlockView) {
+					_, err := blk.DirectCall(types.NewDepositCall(bridgeAccount, testAccount, amount, 0))
+					require.NoError(t, err)
+				})
+			})
+
+			t.Run("deploy contract at target address", func(t *testing.T) {
+				RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
+					target := types.Address{1, 2, 3}
+					RunWithNewBlockView(t, env, func(blk types.BlockView) {
+						res, err := blk.DirectCall(
+							types.NewDeployCallWithTargetAddress(
+								testAccount,
+								target,
+								testContract.ByteCode,
+								math.MaxUint64,
+								amountToBeTransfered,
+								0,
+							),
+						)
+						require.NoError(t, err)
+						require.Equal(t, target, res.DeployedContractAddress)
+					})
+					RunWithNewReadOnlyBlockView(t, env, func(blk types.ReadOnlyBlockView) {
+						require.NotNil(t, target)
+						retCode, err := blk.CodeOf(target)
+						require.NoError(t, err)
+						require.NotEmpty(t, retCode)
+
+						retBalance, err := blk.BalanceOf(target)
+						require.NoError(t, err)
+						require.Equal(t, amountToBeTransfered, retBalance)
+
+						retBalance, err = blk.BalanceOf(testAccount)
+						require.NoError(t, err)
+						require.Equal(t, amount.Sub(amount, amountToBeTransfered), retBalance)
+					})
+					// test deployment to an address that is already exist
+					RunWithNewBlockView(t, env, func(blk types.BlockView) {
+						res, err := blk.DirectCall(
+							types.NewDeployCallWithTargetAddress(
+								testAccount,
+								target,
+								testContract.ByteCode,
+								math.MaxUint64,
+								amountToBeTransfered,
+								0),
+						)
+						require.NoError(t, err)
+						require.Equal(t, gethVM.ErrContractAddressCollision, res.VMError)
+					})
+					// test deployment with not enough gas
+					RunWithNewBlockView(t, env, func(blk types.BlockView) {
+						res, err := blk.DirectCall(
+							types.NewDeployCallWithTargetAddress(
+								testAccount,
+								types.Address{3, 4, 5},
+								testContract.ByteCode,
+								100,
+								new(big.Int),
+								0),
+						)
+						require.NoError(t, err)
+						require.Equal(t, fmt.Errorf("out of gas"), res.VMError)
+					})
 				})
 			})
+		})
+	})
+}
+
+// Self destruct test deploys a contract with a selfdestruct function
+// this function is called and we make sure the balance the contract had
+// is returned to the address provided, and the contract data stays according to the
+// EIP 6780 https://eips.ethereum.org/EIPS/eip-6780 in case where the selfdestruct
+// is not caleld in the same transaction as deployment.
+func TestSelfdestruct(t *testing.T) {
+	testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
+		testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
+			testutils.RunWithEOATestAccount(t, backend, rootAddr, func(testAccount *testutils.EOATestAccount) {
+
+				testContract := testutils.GetStorageTestContract(t)
+				testAddress := types.NewAddressFromString("testaddr")
+				bridgeAccount := types.NewAddressFromString("bridge")
+
+				startBalance := big.NewInt(0).Mul(big.NewInt(1000), big.NewInt(gethParams.Ether))
+				deployBalance := big.NewInt(0).Mul(big.NewInt(10), big.NewInt(gethParams.Ether))
+				var contractAddr types.Address
+
+				// setup the test with funded account and deploying a selfdestruct contract.
+				RunWithNewEmulator(t, backend, rootAddr, func(env *emulator.Emulator) {
+					RunWithNewBlockView(t, env, func(blk types.BlockView) {
+						_, err := blk.DirectCall(types.NewDepositCall(bridgeAccount, testAddress, startBalance, 0))
+						require.NoError(t, err)
+					})
+
+					RunWithNewBlockView(t, env, func(blk types.BlockView) {
+						res, err := blk.DirectCall(
+							types.NewDeployCall(
+								testAddress,
+								testContract.ByteCode,
+								math.MaxUint64,
+								deployBalance,
+								0),
+						)
+						require.NoError(t, err)
+						contractAddr = res.DeployedContractAddress
+					})
+
+					RunWithNewReadOnlyBlockView(t, env, func(blk types.ReadOnlyBlockView) {
+						bal, err := blk.BalanceOf(testAddress)
+						require.NoError(t, err)
+						require.Equal(t, big.NewInt(0).Sub(startBalance, deployBalance), bal)
+
+						bal, err = blk.BalanceOf(contractAddr)
+						require.NoError(t, err)
+						require.Equal(t, deployBalance, bal)
+					})
+
+					// call the destroy method which executes selfdestruct call.
+					RunWithNewBlockView(t, env, func(blk types.BlockView) {
+						res, err := blk.DirectCall(&types.DirectCall{
+							Type:     types.DirectCallTxType,
+							From:     testAddress,
+							To:       contractAddr,
+							Data:     testContract.MakeCallData(t, "destroy"),
+							Value:    big.NewInt(0),
+							GasLimit: 100_000,
+						})
+						require.NoError(t, err)
+						require.False(t, res.Failed())
+					})
+
+					// after calling selfdestruct the balance should be returned to the caller and
+					// equal initial funded balance of the caller.
+					RunWithNewReadOnlyBlockView(t, env, func(blk types.ReadOnlyBlockView) {
+						bal, err := blk.BalanceOf(testAddress)
+						require.NoError(t, err)
+						require.Equal(t, startBalance, bal)
+
+						bal, err = blk.BalanceOf(contractAddr)
+						require.NoError(t, err)
+						require.Equal(t, big.NewInt(0), bal)
+
+						nonce, err := blk.NonceOf(contractAddr)
+						require.NoError(t, err)
+						require.Equal(t, uint64(1), nonce)
 
+						code, err := blk.CodeOf(contractAddr)
+						require.NoError(t, err)
+						require.True(t, len(code) > 0)
+					})
+				})
+			})
 		})
 	})
 }
@@ -296,20 +577,21 @@ func TestTransfers(t *testing.T) {
 
 			testAccount1 := types.NewAddressFromString("test1")
 			testAccount2 := types.NewAddressFromString("test2")
+			bridgeAccount := types.NewAddressFromString("bridge")
 
 			amount := big.NewInt(0).Mul(big.NewInt(1337), big.NewInt(gethParams.Ether))
 			amountToBeTransfered := big.NewInt(0).Mul(big.NewInt(100), big.NewInt(gethParams.Ether))
 
 			RunWithNewEmulator(t, backend, rootAddr, func(em *emulator.Emulator) {
 				RunWithNewBlockView(t, em, func(blk types.BlockView) {
-					_, err := blk.DirectCall(types.NewDepositCall(testAccount1, amount))
+					_, err := blk.DirectCall(types.NewDepositCall(bridgeAccount, testAccount1, amount, 0))
 					require.NoError(t, err)
 				})
 			})
 
 			RunWithNewEmulator(t, backend, rootAddr, func(em *emulator.Emulator) {
 				RunWithNewBlockView(t, em, func(blk types.BlockView) {
-					_, err := blk.DirectCall(types.NewTransferCall(testAccount1, testAccount2, amountToBeTransfered))
+					_, err := blk.DirectCall(types.NewTransferCall(testAccount1, testAccount2, amountToBeTransfered, 0))
 					require.NoError(t, err)
 				})
 			})
@@ -335,15 +617,17 @@ func TestStorageNoSideEffect(t *testing.T) {
 			var err error
 			em := emulator.NewEmulator(backend, flowEVMRoot)
 			testAccount := types.NewAddressFromString("test")
+			bridgeAccount := types.NewAddressFromString("bridge")
+
 			amount := big.NewInt(10)
 			RunWithNewBlockView(t, em, func(blk types.BlockView) {
-				_, err = blk.DirectCall(types.NewDepositCall(testAccount, amount))
+				_, err = blk.DirectCall(types.NewDepositCall(bridgeAccount, testAccount, amount, 0))
 				require.NoError(t, err)
 			})
 
 			orgSize := backend.TotalStorageSize()
 			RunWithNewBlockView(t, em, func(blk types.BlockView) {
-				_, err = blk.DirectCall(types.NewDepositCall(testAccount, amount))
+				_, err = blk.DirectCall(types.NewDepositCall(bridgeAccount, testAccount, amount, 0))
 				require.NoError(t, err)
 			})
 			require.Equal(t, orgSize, backend.TotalStorageSize())
@@ -357,9 +641,10 @@ func TestCallingExtraPrecompiles(t *testing.T) {
 			RunWithNewEmulator(t, backend, flowEVMRoot, func(em *emulator.Emulator) {
 
 				testAccount := types.NewAddressFromString("test")
+				bridgeAccount := types.NewAddressFromString("bridge")
 				amount := big.NewInt(10_000_000)
 				RunWithNewBlockView(t, em, func(blk types.BlockView) {
-					_, err := blk.DirectCall(types.NewDepositCall(testAccount, amount))
+					_, err := blk.DirectCall(types.NewDepositCall(bridgeAccount, testAccount, amount, 0))
 					require.NoError(t, err)
 				})
 
@@ -392,6 +677,7 @@ func TestCallingExtraPrecompiles(t *testing.T) {
 						input,
 						1_000_000,
 						big.NewInt(0), // this should be zero because the contract doesn't have receiver
+						0,
 					),
 				)
 				require.NoError(t, err)
diff --git a/fvm/evm/emulator/signer.go b/fvm/evm/emulator/signer.go
index 44b2964f843..06573c34056 100644
--- a/fvm/evm/emulator/signer.go
+++ b/fvm/evm/emulator/signer.go
@@ -3,7 +3,7 @@ package emulator
 import (
 	"math/big"
 
-	"github.com/ethereum/go-ethereum/core/types"
+	"github.com/onflow/go-ethereum/core/types"
 )
 
 var defaultBlockNumberForEVMRules = big.NewInt(1) // anything bigger than 0
diff --git a/fvm/evm/emulator/state/account.go b/fvm/evm/emulator/state/account.go
index 489d944b798..4527232531e 100644
--- a/fvm/evm/emulator/state/account.go
+++ b/fvm/evm/emulator/state/account.go
@@ -3,9 +3,9 @@ package state
 import (
 	"math/big"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	"github.com/ethereum/go-ethereum/rlp"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	"github.com/onflow/go-ethereum/rlp"
 )
 
 // Account holds the metadata of an address and provides (de)serialization functionality
diff --git a/fvm/evm/emulator/state/account_test.go b/fvm/evm/emulator/state/account_test.go
index c3e2fca047e..20b7d3092d2 100644
--- a/fvm/evm/emulator/state/account_test.go
+++ b/fvm/evm/emulator/state/account_test.go
@@ -3,7 +3,7 @@ package state_test
 import (
 	"testing"
 
-	"github.com/ethereum/go-ethereum/common"
+	"github.com/onflow/go-ethereum/common"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/fvm/evm/emulator/state"
diff --git a/fvm/evm/emulator/state/base.go b/fvm/evm/emulator/state/base.go
index c2b83ce9fa3..7cde0e9d607 100644
--- a/fvm/evm/emulator/state/base.go
+++ b/fvm/evm/emulator/state/base.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"math/big"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
 	"github.com/onflow/atree"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
 
 	"github.com/onflow/flow-go/fvm/evm/types"
 	"github.com/onflow/flow-go/model/flow"
diff --git a/fvm/evm/emulator/state/base_test.go b/fvm/evm/emulator/state/base_test.go
index af4696abdfe..cc95fb40149 100644
--- a/fvm/evm/emulator/state/base_test.go
+++ b/fvm/evm/emulator/state/base_test.go
@@ -4,9 +4,9 @@ import (
 	"math/big"
 	"testing"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	gethCrypto "github.com/ethereum/go-ethereum/crypto"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethCrypto "github.com/onflow/go-ethereum/crypto"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/fvm/evm/emulator/state"
diff --git a/fvm/evm/emulator/state/delta.go b/fvm/evm/emulator/state/delta.go
index 50575789d50..7b60fcb4b2b 100644
--- a/fvm/evm/emulator/state/delta.go
+++ b/fvm/evm/emulator/state/delta.go
@@ -4,9 +4,9 @@ import (
 	"fmt"
 	"math/big"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	gethCrypto "github.com/ethereum/go-ethereum/crypto"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethCrypto "github.com/onflow/go-ethereum/crypto"
 
 	"github.com/onflow/flow-go/fvm/evm/types"
 )
diff --git a/fvm/evm/emulator/state/delta_test.go b/fvm/evm/emulator/state/delta_test.go
index 820ba2c2ce1..dffc797d8d9 100644
--- a/fvm/evm/emulator/state/delta_test.go
+++ b/fvm/evm/emulator/state/delta_test.go
@@ -5,9 +5,9 @@ import (
 	"math/big"
 	"testing"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	gethCrypto "github.com/ethereum/go-ethereum/crypto"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethCrypto "github.com/onflow/go-ethereum/crypto"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/fvm/evm/emulator/state"
diff --git a/fvm/evm/emulator/state/stateDB.go b/fvm/evm/emulator/state/stateDB.go
index 3488f26cda0..64eafbeb399 100644
--- a/fvm/evm/emulator/state/stateDB.go
+++ b/fvm/evm/emulator/state/stateDB.go
@@ -7,12 +7,11 @@ import (
 	"math/big"
 	"sort"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	gethParams "github.com/ethereum/go-ethereum/params"
 	"github.com/onflow/atree"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethParams "github.com/onflow/go-ethereum/params"
 
-	"github.com/onflow/flow-go/fvm/errors"
 	"github.com/onflow/flow-go/fvm/evm/types"
 	"github.com/onflow/flow-go/model/flow"
 )
@@ -264,7 +263,6 @@ func (db *StateDB) Snapshot() int {
 // Logs returns the list of logs
 // it also update each log with the block and tx info
 func (db *StateDB) Logs(
-	blockHash gethCommon.Hash,
 	blockNumber uint64,
 	txHash gethCommon.Hash,
 	txIndex uint,
@@ -273,7 +271,6 @@ func (db *StateDB) Logs(
 	for _, view := range db.views {
 		for _, log := range view.Logs() {
 			log.BlockNumber = blockNumber
-			log.BlockHash = blockHash
 			log.TxHash = txHash
 			log.TxIndex = txIndex
 			allLogs = append(allLogs, log)
@@ -294,7 +291,7 @@ func (db *StateDB) Preimages() map[gethCommon.Hash][]byte {
 }
 
 // Commit commits state changes back to the underlying
-func (db *StateDB) Commit() error {
+func (db *StateDB) Commit(finalize bool) error {
 	// return error if any has been acumulated
 	if db.cachedError != nil {
 		return wrapError(db.cachedError)
@@ -391,13 +388,19 @@ func (db *StateDB) Commit() error {
 	}
 
 	// don't purge views yet, people might call the logs etc
-	err = db.baseView.Commit()
-	if err != nil {
-		return wrapError(err)
+	if finalize {
+		return db.Finalize()
 	}
 	return nil
 }
 
+// Finalize flushes all the changes
+// to the permanent storage
+func (db *StateDB) Finalize() error {
+	err := db.baseView.Commit()
+	return wrapError(err)
+}
+
 // Prepare is a highlevel logic that sadly is considered to be part of the
 // stateDB interface and not on the layers above.
 // based on parameters that are passed it updates accesslists
@@ -424,6 +427,14 @@ func (db *StateDB) Prepare(rules gethParams.Rules, sender, coinbase gethCommon.A
 	}
 }
 
+// Reset resets uncommitted changes and transient artifacts such as error, logs,
+// preimages, access lists, ...
+// The method is often called between execution of different transactions
+func (db *StateDB) Reset() {
+	db.views = []*DeltaView{NewDeltaView(db.baseView)}
+	db.cachedError = nil
+}
+
 // Error returns the memorized database failure occurred earlier.
 func (s *StateDB) Error() error {
 	return wrapError(s.cachedError)
@@ -460,9 +471,9 @@ func wrapError(err error) error {
 		return types.NewFatalError(err)
 	}
 
-	// if is fvm fatal error
-	if errors.IsFailure(err) {
-		return types.NewFatalError(err)
+	// if is a fatal error
+	if types.IsAFatalError(err) {
+		return err
 	}
 
 	return types.NewStateError(err)
diff --git a/fvm/evm/emulator/state/stateDB_test.go b/fvm/evm/emulator/state/stateDB_test.go
index 2d45395a72e..5d526fc4ae7 100644
--- a/fvm/evm/emulator/state/stateDB_test.go
+++ b/fvm/evm/emulator/state/stateDB_test.go
@@ -5,10 +5,10 @@ import (
 	"math/big"
 	"testing"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	gethParams "github.com/ethereum/go-ethereum/params"
 	"github.com/onflow/atree"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethParams "github.com/onflow/go-ethereum/params"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/fvm/evm/emulator/state"
@@ -71,7 +71,7 @@ func TestStateDB(t *testing.T) {
 		ret = db.GetCommittedState(addr1, key1)
 		require.Equal(t, gethCommon.Hash{}, ret)
 
-		err = db.Commit()
+		err = db.Commit(true)
 		require.NoError(t, err)
 
 		ret = db.GetCommittedState(addr1, key1)
@@ -170,7 +170,7 @@ func TestStateDB(t *testing.T) {
 		db.AddLog(testutils.GetRandomLogFixture(t))
 		db.RevertToSnapshot(snapshot)
 
-		ret := db.Logs(gethCommon.Hash{}, 1, gethCommon.Hash{}, 1)
+		ret := db.Logs(1, gethCommon.Hash{}, 1)
 		require.Equal(t, ret, logs)
 	})
 
@@ -256,7 +256,7 @@ func TestStateDB(t *testing.T) {
 
 		db.CreateAccount(testutils.RandomCommonAddress(t))
 
-		err = db.Commit()
+		err = db.Commit(true)
 		// ret := db.Error()
 		require.Error(t, err)
 		// check wrapping
@@ -280,7 +280,7 @@ func TestStateDB(t *testing.T) {
 
 		db.CreateAccount(testutils.RandomCommonAddress(t))
 
-		err = db.Commit()
+		err = db.Commit(true)
 		// ret := db.Error()
 		require.Error(t, err)
 		// check wrapping
diff --git a/fvm/evm/emulator/state/state_growth_test.go b/fvm/evm/emulator/state/state_growth_test.go
index b7502728d8b..dd19ce8afc3 100644
--- a/fvm/evm/emulator/state/state_growth_test.go
+++ b/fvm/evm/emulator/state/state_growth_test.go
@@ -10,7 +10,7 @@ import (
 
 	"github.com/onflow/flow-go/utils/io"
 
-	"github.com/ethereum/go-ethereum/common"
+	"github.com/onflow/go-ethereum/common"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/fvm/evm/emulator/state"
@@ -64,7 +64,7 @@ func (s *storageTest) run(runner func(state types.StateDB)) error {
 
 	runner(state)
 
-	err = state.Commit()
+	err = state.Commit(true)
 	if err != nil {
 		return err
 	}
diff --git a/fvm/evm/evm.go b/fvm/evm/evm.go
index 37a9cb07862..a29ab9f67cf 100644
--- a/fvm/evm/evm.go
+++ b/fvm/evm/evm.go
@@ -4,10 +4,11 @@ import (
 	"github.com/onflow/cadence/runtime"
 	"github.com/onflow/cadence/runtime/common"
 
+	"github.com/onflow/flow-go/fvm/environment"
+	"github.com/onflow/flow-go/fvm/evm/backends"
 	evm "github.com/onflow/flow-go/fvm/evm/emulator"
 	"github.com/onflow/flow-go/fvm/evm/handler"
 	"github.com/onflow/flow-go/fvm/evm/stdlib"
-	"github.com/onflow/flow-go/fvm/evm/types"
 	"github.com/onflow/flow-go/fvm/systemcontracts"
 	"github.com/onflow/flow-go/model/flow"
 )
@@ -24,9 +25,8 @@ func StorageAccountAddress(chainID flow.ChainID) (flow.Address, error) {
 
 func SetupEnvironment(
 	chainID flow.ChainID,
-	backend types.Backend,
-	env runtime.Environment,
-	service flow.Address,
+	fvmEnv environment.Environment,
+	runtimeEnv runtime.Environment,
 	flowToken flow.Address,
 ) error {
 	evmStorageAccountAddress, err := StorageAccountAddress(chainID)
@@ -39,21 +39,29 @@ func SetupEnvironment(
 		return err
 	}
 
-	em := evm.NewEmulator(backend, evmStorageAccountAddress)
+	backend := backends.NewWrappedEnvironment(fvmEnv)
 
-	bs, err := handler.NewBlockStore(backend, evmStorageAccountAddress)
-	if err != nil {
-		return err
-	}
+	emulator := evm.NewEmulator(backend, evmStorageAccountAddress)
 
-	aa, err := handler.NewAddressAllocator(backend, evmStorageAccountAddress)
-	if err != nil {
-		return err
-	}
+	blockStore := handler.NewBlockStore(backend, evmStorageAccountAddress)
+
+	addressAllocator := handler.NewAddressAllocator()
 
-	contractHandler := handler.NewContractHandler(common.Address(flowToken), bs, aa, backend, em)
+	contractHandler := handler.NewContractHandler(
+		chainID,
+		evmContractAccountAddress,
+		common.Address(flowToken),
+		blockStore,
+		addressAllocator,
+		backend,
+		emulator,
+	)
 
-	stdlib.SetupEnvironment(env, contractHandler, evmContractAccountAddress)
+	stdlib.SetupEnvironment(
+		runtimeEnv,
+		contractHandler,
+		evmContractAccountAddress,
+	)
 
 	return nil
 }
diff --git a/fvm/evm/evm_test.go b/fvm/evm/evm_test.go
index acd0a3c8289..ecbd3b88133 100644
--- a/fvm/evm/evm_test.go
+++ b/fvm/evm/evm_test.go
@@ -9,10 +9,15 @@ import (
 	"github.com/onflow/cadence/encoding/json"
 	"github.com/stretchr/testify/require"
 
+	"github.com/onflow/flow-go/engine/execution/testutil"
 	"github.com/onflow/flow-go/fvm"
+	"github.com/onflow/flow-go/fvm/crypto"
+	envMock "github.com/onflow/flow-go/fvm/environment/mock"
+	"github.com/onflow/flow-go/fvm/evm"
 	"github.com/onflow/flow-go/fvm/evm/stdlib"
 	"github.com/onflow/flow-go/fvm/evm/testutils"
 	. "github.com/onflow/flow-go/fvm/evm/testutils"
+	"github.com/onflow/flow-go/fvm/evm/types"
 	"github.com/onflow/flow-go/fvm/storage/snapshot"
 	"github.com/onflow/flow-go/fvm/systemcontracts"
 	"github.com/onflow/flow-go/model/flow"
@@ -20,268 +25,1129 @@ import (
 )
 
 func TestEVMRun(t *testing.T) {
-
 	t.Parallel()
 
+	chain := flow.Emulator.Chain()
 	t.Run("testing EVM.run (happy case)", func(t *testing.T) {
-		RunWithTestBackend(t, func(backend *testutils.TestBackend) {
-			RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
-				tc := GetStorageTestContract(t)
-				RunWithDeployedContract(t, tc, backend, rootAddr, func(testContract *TestContract) {
-					RunWithEOATestAccount(t, backend, rootAddr, func(testAccount *EOATestAccount) {
-						num := int64(12)
-						chain := flow.Emulator.Chain()
-
-						RunWithNewTestVM(t, chain, func(ctx fvm.Context, vm fvm.VM, snapshot snapshot.SnapshotTree) {
-							sc := systemcontracts.SystemContractsForChain(chain.ChainID())
-							code := []byte(fmt.Sprintf(
-								`
-                          import EVM from %s
-
-                          access(all)
-                          fun main(tx: [UInt8], coinbaseBytes: [UInt8; 20]) {
-                              let coinbase = EVM.EVMAddress(bytes: coinbaseBytes)
-                              EVM.run(tx: tx, coinbase: coinbase)
-                          }
-                        `,
-								sc.EVMContract.Address.HexWithPrefix(),
-							))
-
-							gasLimit := uint64(100_000)
-
-							txBytes := testAccount.PrepareSignAndEncodeTx(t,
-								testContract.DeployedAt.ToCommon(),
-								testContract.MakeCallData(t, "store", big.NewInt(num)),
-								big.NewInt(0),
-								gasLimit,
-								big.NewInt(0),
-							)
-
-							tx := cadence.NewArray(
-								ConvertToCadence(txBytes),
-							).WithType(stdlib.EVMTransactionBytesCadenceType)
-
-							coinbase := cadence.NewArray(
-								ConvertToCadence(testAccount.Address().Bytes()),
-							).WithType(stdlib.EVMAddressBytesCadenceType)
-
-							script := fvm.Script(code).WithArguments(
-								json.MustEncode(tx),
-								json.MustEncode(coinbase),
-							)
-
-							_, output, err := vm.Run(
-								ctx,
-								script,
-								snapshot)
-							require.NoError(t, err)
-							require.NoError(t, output.Err)
-						})
-					})
-				})
+
+		t.Parallel()
+		RunWithNewEnvironment(t,
+			chain, func(
+				ctx fvm.Context,
+				vm fvm.VM,
+				snapshot snapshot.SnapshotTree,
+				testContract *TestContract,
+				testAccount *EOATestAccount,
+			) {
+				sc := systemcontracts.SystemContractsForChain(chain.ChainID())
+				code := []byte(fmt.Sprintf(
+					`
+					import EVM from %s
+
+					transaction(tx: [UInt8], coinbaseBytes: [UInt8; 20]){
+						prepare(account: AuthAccount) {
+							let coinbase = EVM.EVMAddress(bytes: coinbaseBytes)
+							let res = EVM.run(tx: tx, coinbase: coinbase)
+
+							assert(res.status == EVM.Status.successful, message: "unexpected status")
+							assert(res.errorCode == 0, message: "unexpected error code")
+						}
+					}
+					`,
+					sc.EVMContract.Address.HexWithPrefix(),
+				))
+
+				num := int64(12)
+				innerTxBytes := testAccount.PrepareSignAndEncodeTx(t,
+					testContract.DeployedAt.ToCommon(),
+					testContract.MakeCallData(t, "store", big.NewInt(num)),
+					big.NewInt(0),
+					uint64(100_000),
+					big.NewInt(0),
+				)
+
+				innerTx := cadence.NewArray(
+					ConvertToCadence(innerTxBytes),
+				).WithType(stdlib.EVMTransactionBytesCadenceType)
+
+				coinbase := cadence.NewArray(
+					ConvertToCadence(testAccount.Address().Bytes()),
+				).WithType(stdlib.EVMAddressBytesCadenceType)
+
+				tx := fvm.Transaction(
+					flow.NewTransactionBody().
+						SetScript(code).
+						AddAuthorizer(sc.FlowServiceAccount.Address).
+						AddArgument(json.MustEncode(innerTx)).
+						AddArgument(json.MustEncode(coinbase)),
+					0)
+
+				state, output, err := vm.Run(
+					ctx,
+					tx,
+					snapshot)
+				require.NoError(t, err)
+				require.NoError(t, output.Err)
+				require.NotEmpty(t, state.WriteSet)
+
+				// append the state
+				snapshot = snapshot.Append(state)
+
+				// query the value
+				code = []byte(fmt.Sprintf(
+					`
+					import EVM from %s
+					access(all)
+					fun main(tx: [UInt8], coinbaseBytes: [UInt8; 20]): EVM.Result {
+						let coinbase = EVM.EVMAddress(bytes: coinbaseBytes)
+						return EVM.run(tx: tx, coinbase: coinbase)
+					}
+					`,
+					sc.EVMContract.Address.HexWithPrefix(),
+				))
+
+				innerTxBytes = testAccount.PrepareSignAndEncodeTx(t,
+					testContract.DeployedAt.ToCommon(),
+					testContract.MakeCallData(t, "retrieve"),
+					big.NewInt(0),
+					uint64(100_000),
+					big.NewInt(0),
+				)
+
+				innerTx = cadence.NewArray(
+					ConvertToCadence(innerTxBytes),
+				).WithType(stdlib.EVMTransactionBytesCadenceType)
+
+				script := fvm.Script(code).WithArguments(
+					json.MustEncode(innerTx),
+					json.MustEncode(coinbase),
+				)
+
+				_, output, err = vm.Run(
+					ctx,
+					script,
+					snapshot)
+				require.NoError(t, err)
+				require.NoError(t, output.Err)
+
+				res, err := stdlib.ResultSummaryFromEVMResultValue(output.Value)
+				require.NoError(t, err)
+				require.Equal(t, types.StatusSuccessful, res.Status)
+				require.Equal(t, types.ErrCodeNoError, res.ErrorCode)
+				require.Equal(t, num, new(big.Int).SetBytes(res.ReturnedValue).Int64())
+			})
+	})
+
+	t.Run("testing EVM.run (failed)", func(t *testing.T) {
+		t.Parallel()
+		RunWithNewEnvironment(t,
+			chain, func(
+				ctx fvm.Context,
+				vm fvm.VM,
+				snapshot snapshot.SnapshotTree,
+				testContract *TestContract,
+				testAccount *EOATestAccount,
+			) {
+				sc := systemcontracts.SystemContractsForChain(chain.ChainID())
+				code := []byte(fmt.Sprintf(
+					`
+					import EVM from %s
+
+					transaction(tx: [UInt8], coinbaseBytes: [UInt8; 20]){
+						prepare(account: AuthAccount) {
+							let coinbase = EVM.EVMAddress(bytes: coinbaseBytes)
+							let res = EVM.run(tx: tx, coinbase: coinbase)
+
+							assert(res.status == EVM.Status.failed, message: "unexpected status")
+							// ExecutionErrCodeExecutionReverted
+							assert(res.errorCode == %d, message: "unexpected error code")
+						}
+					}
+					`,
+					sc.EVMContract.Address.HexWithPrefix(),
+					types.ExecutionErrCodeExecutionReverted,
+				))
+
+				num := int64(12)
+				innerTxBytes := testAccount.PrepareSignAndEncodeTx(t,
+					testContract.DeployedAt.ToCommon(),
+					testContract.MakeCallData(t, "storeButRevert", big.NewInt(num)),
+					big.NewInt(0),
+					uint64(100_000),
+					big.NewInt(0),
+				)
+
+				innerTx := cadence.NewArray(
+					ConvertToCadence(innerTxBytes),
+				).WithType(stdlib.EVMTransactionBytesCadenceType)
+
+				coinbase := cadence.NewArray(
+					ConvertToCadence(testAccount.Address().Bytes()),
+				).WithType(stdlib.EVMAddressBytesCadenceType)
+
+				tx := fvm.Transaction(
+					flow.NewTransactionBody().
+						SetScript(code).
+						AddAuthorizer(sc.FlowServiceAccount.Address).
+						AddArgument(json.MustEncode(innerTx)).
+						AddArgument(json.MustEncode(coinbase)),
+					0)
+
+				state, output, err := vm.Run(
+					ctx,
+					tx,
+					snapshot)
+				require.NoError(t, err)
+				require.NoError(t, output.Err)
+				require.NotEmpty(t, state.WriteSet)
+
+				snapshot = snapshot.Append(state)
+
+				// query the value
+				code = []byte(fmt.Sprintf(
+					`
+					import EVM from %s
+					access(all)
+					fun main(tx: [UInt8], coinbaseBytes: [UInt8; 20]): EVM.Result {
+						let coinbase = EVM.EVMAddress(bytes: coinbaseBytes)
+						return EVM.run(tx: tx, coinbase: coinbase)
+					}
+				`,
+					sc.EVMContract.Address.HexWithPrefix(),
+				))
+
+				innerTxBytes = testAccount.PrepareSignAndEncodeTx(t,
+					testContract.DeployedAt.ToCommon(),
+					testContract.MakeCallData(t, "retrieve"),
+					big.NewInt(0),
+					uint64(100_000),
+					big.NewInt(0),
+				)
+
+				innerTx = cadence.NewArray(
+					ConvertToCadence(innerTxBytes),
+				).WithType(stdlib.EVMTransactionBytesCadenceType)
+
+				script := fvm.Script(code).WithArguments(
+					json.MustEncode(innerTx),
+					json.MustEncode(coinbase),
+				)
+
+				_, output, err = vm.Run(
+					ctx,
+					script,
+					snapshot)
+				require.NoError(t, err)
+				require.NoError(t, output.Err)
+
+				res, err := stdlib.ResultSummaryFromEVMResultValue(output.Value)
+				require.NoError(t, err)
+				require.Equal(t, types.StatusSuccessful, res.Status)
+				require.Equal(t, types.ErrCodeNoError, res.ErrorCode)
+				require.Equal(t, int64(0), new(big.Int).SetBytes(res.ReturnedValue).Int64())
 			})
-		})
 	})
 }
 
-func RunWithNewTestVM(t *testing.T, chain flow.Chain, f func(fvm.Context, fvm.VM, snapshot.SnapshotTree)) {
-	opts := []fvm.Option{
-		fvm.WithChain(chain),
-		fvm.WithAuthorizationChecksEnabled(false),
-		fvm.WithSequenceNumberCheckAndIncrementEnabled(false),
-	}
-	ctx := fvm.NewContext(opts...)
+func TestEVMBlockData(t *testing.T) {
+	t.Parallel()
+	chain := flow.Emulator.Chain()
+	sc := systemcontracts.SystemContractsForChain(chain.ChainID())
+	RunWithNewEnvironment(t,
+		chain, func(
+			ctx fvm.Context,
+			vm fvm.VM,
+			snapshot snapshot.SnapshotTree,
+			testContract *TestContract,
+			testAccount *EOATestAccount,
+		) {
 
-	vm := fvm.NewVirtualMachine()
-	snapshotTree := snapshot.NewSnapshotTree(nil)
+			// query the block timestamp
+			code := []byte(fmt.Sprintf(
+				`
+					import EVM from %s
+					access(all)
+					fun main(tx: [UInt8], coinbaseBytes: [UInt8; 20]): EVM.Result {
+						let coinbase = EVM.EVMAddress(bytes: coinbaseBytes)
+						return EVM.run(tx: tx, coinbase: coinbase)
+					}
+				`,
+				sc.EVMContract.Address.HexWithPrefix(),
+			))
 
-	baseBootstrapOpts := []fvm.BootstrapProcedureOption{
-		fvm.WithInitialTokenSupply(unittest.GenesisTokenSupply),
-		fvm.WithSetupEVMEnabled(true),
-	}
+			innerTxBytes := testAccount.PrepareSignAndEncodeTx(t,
+				testContract.DeployedAt.ToCommon(),
+				testContract.MakeCallData(t, "blockTime"),
+				big.NewInt(0),
+				uint64(100_000),
+				big.NewInt(0),
+			)
 
-	executionSnapshot, _, err := vm.Run(
-		ctx,
-		fvm.Bootstrap(unittest.ServiceAccountPublicKey, baseBootstrapOpts...),
-		snapshotTree)
-	require.NoError(t, err)
+			coinbase := cadence.NewArray(
+				ConvertToCadence(testAccount.Address().Bytes()),
+			).WithType(stdlib.EVMAddressBytesCadenceType)
+
+			innerTx := cadence.NewArray(
+				ConvertToCadence(innerTxBytes),
+			).WithType(stdlib.EVMTransactionBytesCadenceType)
 
-	snapshotTree = snapshotTree.Append(executionSnapshot)
+			script := fvm.Script(code).WithArguments(
+				json.MustEncode(innerTx),
+				json.MustEncode(coinbase),
+			)
 
-	f(fvm.NewContextFromParent(ctx, fvm.WithEVMEnabled(true)), vm, snapshotTree)
+			_, output, err := vm.Run(
+				ctx,
+				script,
+				snapshot)
+			require.NoError(t, err)
+			require.NoError(t, output.Err)
+
+			res, err := stdlib.ResultSummaryFromEVMResultValue(output.Value)
+			require.NoError(t, err)
+			require.Equal(t, types.StatusSuccessful, res.Status)
+			require.Equal(t, types.ErrCodeNoError, res.ErrorCode)
+			require.Equal(t, ctx.BlockHeader.Timestamp.Unix(), new(big.Int).SetBytes(res.ReturnedValue).Int64())
+
+		})
 }
 
 func TestEVMAddressDeposit(t *testing.T) {
 
 	t.Parallel()
+	chain := flow.Emulator.Chain()
+	sc := systemcontracts.SystemContractsForChain(chain.ChainID())
+	RunWithNewEnvironment(t,
+		chain, func(
+			ctx fvm.Context,
+			vm fvm.VM,
+			snapshot snapshot.SnapshotTree,
+			testContract *TestContract,
+			testAccount *EOATestAccount,
+		) {
 
-	RunWithTestBackend(t, func(backend *testutils.TestBackend) {
-		RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
-			tc := GetStorageTestContract(t)
-			RunWithDeployedContract(t, tc, backend, rootAddr, func(testContract *TestContract) {
-				RunWithEOATestAccount(t, backend, rootAddr, func(testAccount *EOATestAccount) {
-					chain := flow.Emulator.Chain()
-					sc := systemcontracts.SystemContractsForChain(chain.ChainID())
-
-					RunWithNewTestVM(t, chain, func(ctx fvm.Context, vm fvm.VM, snapshot snapshot.SnapshotTree) {
-
-						code := []byte(fmt.Sprintf(
-							`
-                               import EVM from %s
-                               import FlowToken from %s
-
-                               access(all)
-                               fun main() {
-                                   let admin = getAuthAccount(%s)
-                                       .borrow<&FlowToken.Administrator>(from: /storage/flowTokenAdmin)!
-                                   let minter <- admin.createNewMinter(allowedAmount: 1.23)
-                                   let vault <- minter.mintTokens(amount: 1.23)
-                                   destroy minter
-
-								   let bridgedAccount <- EVM.createBridgedAccount()
-								   bridgedAccount.deposit(from: <-vault)
-								   destroy bridgedAccount
-                               }
-                            `,
-							sc.EVMContract.Address.HexWithPrefix(),
-							sc.FlowToken.Address.HexWithPrefix(),
-							sc.FlowServiceAccount.Address.HexWithPrefix(),
-						))
-
-						script := fvm.Script(code)
-
-						executionSnapshot, output, err := vm.Run(
-							ctx,
-							script,
-							snapshot)
-						require.NoError(t, err)
-						require.NoError(t, output.Err)
-
-						// TODO:
-						_ = executionSnapshot
-					})
-				})
-			})
+			code := []byte(fmt.Sprintf(
+				`
+				import EVM from %s
+				import FlowToken from %s
+
+				transaction(addr: [UInt8; 20]) {
+					prepare(account: AuthAccount) {
+						let admin = account.borrow<&FlowToken.Administrator>(from: /storage/flowTokenAdmin)!
+						let minter <- admin.createNewMinter(allowedAmount: 1.0)
+						let vault <- minter.mintTokens(amount: 1.0)
+						destroy minter
+
+						let address = EVM.EVMAddress(addr)
+						address.deposit(from: <-vault)
+					}
+				}
+			`,
+				sc.EVMContract.Address.HexWithPrefix(),
+				sc.FlowToken.Address.HexWithPrefix(),
+			))
+
+			addr := RandomAddress(t)
+
+			tx := fvm.Transaction(
+				flow.NewTransactionBody().
+					SetScript(code).
+					AddAuthorizer(sc.FlowServiceAccount.Address).
+					AddArgument(json.MustEncode(cadence.NewArray(
+						ConvertToCadence(addr.Bytes()),
+					).WithType(stdlib.EVMAddressBytesCadenceType))),
+				0)
+
+			execSnap, output, err := vm.Run(
+				ctx,
+				tx,
+				snapshot)
+			require.NoError(t, err)
+			require.NoError(t, output.Err)
+
+			snapshot = snapshot.Append(execSnap)
+
+			expectedBalance := types.OneFlowBalance
+			bal := getEVMAccountBalance(t, ctx, vm, snapshot, addr)
+			require.Equal(t, expectedBalance, bal)
 		})
-	})
 }
 
-func TestBridgedAccountWithdraw(t *testing.T) {
+func TestCOAAddressDeposit(t *testing.T) {
+	t.Parallel()
+
+	chain := flow.Emulator.Chain()
+	sc := systemcontracts.SystemContractsForChain(chain.ChainID())
+	RunWithNewEnvironment(t,
+		chain, func(
+			ctx fvm.Context,
+			vm fvm.VM,
+			snapshot snapshot.SnapshotTree,
+			testContract *TestContract,
+			testAccount *EOATestAccount,
+		) {
+			code := []byte(fmt.Sprintf(
+				`
+				import EVM from %s
+				import FlowToken from %s
+
+				access(all)
+				fun main() {
+					let admin = getAuthAccount(%s)
+						.borrow<&FlowToken.Administrator>(from: /storage/flowTokenAdmin)!
+					let minter <- admin.createNewMinter(allowedAmount: 1.23)
+					let vault <- minter.mintTokens(amount: 1.23)
+					destroy minter
+
+					let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+					cadenceOwnedAccount.deposit(from: <-vault)
+					destroy cadenceOwnedAccount
+				}
+                `,
+				sc.EVMContract.Address.HexWithPrefix(),
+				sc.FlowToken.Address.HexWithPrefix(),
+				sc.FlowServiceAccount.Address.HexWithPrefix(),
+			))
 
+			script := fvm.Script(code)
+
+			_, output, err := vm.Run(
+				ctx,
+				script,
+				snapshot)
+			require.NoError(t, err)
+			require.NoError(t, output.Err)
+
+		})
+}
+
+func TestCadenceOwnedAccountFunctionalities(t *testing.T) {
 	t.Parallel()
+	chain := flow.Emulator.Chain()
+	sc := systemcontracts.SystemContractsForChain(chain.ChainID())
+
+	t.Run("test coa setup", func(t *testing.T) {
+		t.Parallel()
+
+		RunWithNewEnvironment(t,
+			chain, func(
+				ctx fvm.Context,
+				vm fvm.VM,
+				snapshot snapshot.SnapshotTree,
+				testContract *TestContract,
+				testAccount *EOATestAccount,
+			) {
+				// create a flow account
+				flowAccount, _, snapshot := createAndFundFlowAccount(
+					t,
+					ctx,
+					vm,
+					snapshot,
+				)
+
+				var coaAddress types.Address
+
+				initNonce := uint64(1)
+				// 10 Flow in UFix64
+				initBalanceInUFix64 := uint64(1_000_000_000)
+				initBalance := types.NewBalanceFromUFix64(cadence.UFix64(initBalanceInUFix64))
+
+				coaAddress, snapshot = setupCOA(
+					t,
+					ctx,
+					vm,
+					snapshot,
+					flowAccount,
+					initBalanceInUFix64)
+
+				bal := getEVMAccountBalance(
+					t,
+					ctx,
+					vm,
+					snapshot,
+					coaAddress)
+				require.Equal(t, initBalance, bal)
 
-	RunWithTestBackend(t, func(backend *testutils.TestBackend) {
-		RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
-			tc := GetStorageTestContract(t)
-			RunWithDeployedContract(t, tc, backend, rootAddr, func(testContract *TestContract) {
-				RunWithEOATestAccount(t, backend, rootAddr, func(testAccount *EOATestAccount) {
-					chain := flow.Emulator.Chain()
-					sc := systemcontracts.SystemContractsForChain(chain.ChainID())
-
-					RunWithNewTestVM(t, chain, func(ctx fvm.Context, vm fvm.VM, snapshot snapshot.SnapshotTree) {
-
-						code := []byte(fmt.Sprintf(
-							`
-                               import EVM from %s
-                               import FlowToken from %s
-
-                               access(all)
-                               fun main(): UFix64 {
-                                   let admin = getAuthAccount(%s)
-                                       .borrow<&FlowToken.Administrator>(from: /storage/flowTokenAdmin)!
-                                   let minter <- admin.createNewMinter(allowedAmount: 2.34)
-                                   let vault <- minter.mintTokens(amount: 2.34)
-                                   destroy minter
-
-                                   let bridgedAccount <- EVM.createBridgedAccount()
-                                   bridgedAccount.deposit(from: <-vault)
-
-                                   let vault2 <- bridgedAccount.withdraw(balance: EVM.Balance(flow: 1.23))
-                                   let balance = vault2.balance
-                                   destroy bridgedAccount
-                                   destroy vault2
-
-                                   return balance
-                               }
-                            `,
-							sc.EVMContract.Address.HexWithPrefix(),
-							sc.FlowToken.Address.HexWithPrefix(),
-							sc.FlowServiceAccount.Address.HexWithPrefix(),
-						))
-
-						script := fvm.Script(code)
-
-						executionSnapshot, output, err := vm.Run(
-							ctx,
-							script,
-							snapshot)
-						require.NoError(t, err)
-						require.NoError(t, output.Err)
-
-						// TODO:
-						_ = executionSnapshot
-					})
-				})
+				nonce := getEVMAccountNonce(
+					t,
+					ctx,
+					vm,
+					snapshot,
+					coaAddress)
+				require.Equal(t, initNonce, nonce)
+			})
+	})
+
+	t.Run("test coa withdraw", func(t *testing.T) {
+		t.Parallel()
+
+		RunWithNewEnvironment(t,
+			chain, func(
+				ctx fvm.Context,
+				vm fvm.VM,
+				snapshot snapshot.SnapshotTree,
+				testContract *TestContract,
+				testAccount *EOATestAccount,
+			) {
+				code := []byte(fmt.Sprintf(
+					`
+				import EVM from %s
+				import FlowToken from %s
+
+				access(all)
+				fun main(): UFix64 {
+					let admin = getAuthAccount(%s)
+						.borrow<&FlowToken.Administrator>(from: /storage/flowTokenAdmin)!
+					let minter <- admin.createNewMinter(allowedAmount: 2.34)
+					let vault <- minter.mintTokens(amount: 2.34)
+					destroy minter
+
+					let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+					cadenceOwnedAccount.deposit(from: <-vault)
+
+					let bal = EVM.Balance(attoflow: 0)
+					bal.setFLOW(flow: 1.23)
+					let vault2 <- cadenceOwnedAccount.withdraw(balance: bal)
+					let balance = vault2.balance
+					destroy cadenceOwnedAccount
+					destroy vault2
+
+					return balance
+				}
+				`,
+					sc.EVMContract.Address.HexWithPrefix(),
+					sc.FlowToken.Address.HexWithPrefix(),
+					sc.FlowServiceAccount.Address.HexWithPrefix(),
+				))
+
+				script := fvm.Script(code)
+
+				_, output, err := vm.Run(
+					ctx,
+					script,
+					snapshot)
+				require.NoError(t, err)
+				require.NoError(t, output.Err)
+			})
+	})
+
+	t.Run("test coa transfer", func(t *testing.T) {
+		t.Parallel()
+
+		RunWithNewEnvironment(t,
+			chain, func(
+				ctx fvm.Context,
+				vm fvm.VM,
+				snapshot snapshot.SnapshotTree,
+				testContract *TestContract,
+				testAccount *EOATestAccount,
+			) {
+				code := []byte(fmt.Sprintf(
+					`
+				import EVM from %s
+				import FlowToken from %s
+
+				access(all)
+				fun main(address: [UInt8; 20]): UFix64 {
+					let admin = getAuthAccount(%s)
+						.borrow<&FlowToken.Administrator>(from: /storage/flowTokenAdmin)!
+					let minter <- admin.createNewMinter(allowedAmount: 2.34)
+					let vault <- minter.mintTokens(amount: 2.34)
+					destroy minter
+
+					let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+					cadenceOwnedAccount.deposit(from: <-vault)
+
+					let bal = EVM.Balance(attoflow: 0)
+					bal.setFLOW(flow: 1.23)
+
+					let recipientEVMAddress = EVM.EVMAddress(bytes: address)
+
+					let res = cadenceOwnedAccount.call(
+						to: recipientEVMAddress,
+						data: [],
+						gasLimit: 100_000,
+						value: bal,
+					)
+
+					assert(res.status == EVM.Status.successful, message: "transfer call was not successful")
+
+					destroy cadenceOwnedAccount
+					return recipientEVMAddress.balance().inFLOW()
+				}
+				`,
+					sc.EVMContract.Address.HexWithPrefix(),
+					sc.FlowToken.Address.HexWithPrefix(),
+					sc.FlowServiceAccount.Address.HexWithPrefix(),
+				))
+
+				addr := cadence.NewArray(
+					ConvertToCadence(testutils.RandomAddress(t).Bytes()),
+				).WithType(stdlib.EVMAddressBytesCadenceType)
+
+				script := fvm.Script(code).WithArguments(
+					json.MustEncode(addr),
+				)
+
+				_, output, err := vm.Run(
+					ctx,
+					script,
+					snapshot)
+				require.NoError(t, err)
+				require.NoError(t, output.Err)
+
+				require.Equal(t, uint64(123000000), uint64(output.Value.(cadence.UFix64)))
+			})
+	})
+
+	t.Run("test coa deposit and withdraw in a single transaction", func(t *testing.T) {
+		RunWithNewEnvironment(t,
+			chain, func(
+				ctx fvm.Context,
+				vm fvm.VM,
+				snapshot snapshot.SnapshotTree,
+				testContract *TestContract,
+				testAccount *EOATestAccount,
+			) {
+				code := []byte(fmt.Sprintf(
+					`
+				import EVM from %s
+				import FlowToken from %s
+
+				access(all)
+				fun main(): UFix64 {
+					let admin = getAuthAccount(%s)
+						.borrow<&FlowToken.Administrator>(from: /storage/flowTokenAdmin)!
+					let minter <- admin.createNewMinter(allowedAmount: 2.34)
+					let vault <- minter.mintTokens(amount: 2.34)
+					destroy minter
+
+					let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+					cadenceOwnedAccount.deposit(from: <-vault)
+
+					let bal = EVM.Balance(attoflow: 0)
+					bal.setFLOW(flow: 1.23)
+					let vault2 <- cadenceOwnedAccount.withdraw(balance: bal)
+					let balance = vault2.balance
+					destroy cadenceOwnedAccount
+					destroy vault2
+
+					return balance
+				}
+				`,
+					sc.EVMContract.Address.HexWithPrefix(),
+					sc.FlowToken.Address.HexWithPrefix(),
+					sc.FlowServiceAccount.Address.HexWithPrefix(),
+				))
+
+				script := fvm.Script(code)
+
+				_, output, err := vm.Run(
+					ctx,
+					script,
+					snapshot)
+				require.NoError(t, err)
+				require.NoError(t, output.Err)
+			})
+	})
+
+	t.Run("test coa deploy", func(t *testing.T) {
+		RunWithNewEnvironment(t,
+			chain, func(
+				ctx fvm.Context,
+				vm fvm.VM,
+				snapshot snapshot.SnapshotTree,
+				testContract *TestContract,
+				testAccount *EOATestAccount,
+			) {
+				code := []byte(fmt.Sprintf(
+					`
+					import EVM from %s
+					import FlowToken from %s
+	
+					access(all)
+					fun main(): [UInt8; 20] {
+						let admin = getAuthAccount(%s)
+							.borrow<&FlowToken.Administrator>(from: /storage/flowTokenAdmin)!
+						let minter <- admin.createNewMinter(allowedAmount: 2.34)
+						let vault <- minter.mintTokens(amount: 2.34)
+						destroy minter
+	
+						let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+						cadenceOwnedAccount.deposit(from: <-vault)
+	
+						let address = cadenceOwnedAccount.deploy(
+							code: [],
+							gasLimit: 53000,
+							value: EVM.Balance(attoflow: 1230000000000000000)
+						)
+						destroy cadenceOwnedAccount
+						return address.bytes
+					}
+					`,
+					sc.EVMContract.Address.HexWithPrefix(),
+					sc.FlowToken.Address.HexWithPrefix(),
+					sc.FlowServiceAccount.Address.HexWithPrefix(),
+				))
+
+				script := fvm.Script(code)
+
+				_, output, err := vm.Run(
+					ctx,
+					script,
+					snapshot)
+				require.NoError(t, err)
+				require.NoError(t, output.Err)
 			})
-		})
 	})
 }
 
-func TestBridgedAccountDeploy(t *testing.T) {
+func TestCadenceArch(t *testing.T) {
 	t.Parallel()
-	RunWithTestBackend(t, func(backend *testutils.TestBackend) {
-		RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
-			tc := GetStorageTestContract(t)
-			RunWithDeployedContract(t, tc, backend, rootAddr, func(testContract *TestContract) {
-				RunWithEOATestAccount(t, backend, rootAddr, func(testAccount *EOATestAccount) {
-					chain := flow.Emulator.Chain()
-					sc := systemcontracts.SystemContractsForChain(chain.ChainID())
-
-					RunWithNewTestVM(t, chain, func(ctx fvm.Context, vm fvm.VM, snapshot snapshot.SnapshotTree) {
-
-						code := []byte(fmt.Sprintf(
-							`
-                               import EVM from %s
-                               import FlowToken from %s
-
-                                access(all)
-                                fun main(): [UInt8; 20] {
-                                   let admin = getAuthAccount(%s)
-                                       .borrow<&FlowToken.Administrator>(from: /storage/flowTokenAdmin)!
-                                   let minter <- admin.createNewMinter(allowedAmount: 2.34)
-                                   let vault <- minter.mintTokens(amount: 2.34)
-                                   destroy minter
-
-                                   let bridgedAccount <- EVM.createBridgedAccount()
-                                   bridgedAccount.deposit(from: <-vault)
-
-                                   let address = bridgedAccount.deploy(
-                                       code: [],
-                                       gasLimit: 53000,
-                                       value: EVM.Balance(flow: 1.23)
-                                   )
-                                   destroy bridgedAccount
-                                   return address.bytes
-                                }
-                            `,
-							sc.EVMContract.Address.HexWithPrefix(),
-							sc.FlowToken.Address.HexWithPrefix(),
-							sc.FlowServiceAccount.Address.HexWithPrefix(),
-						))
-
-						script := fvm.Script(code)
-
-						executionSnapshot, output, err := vm.Run(
-							ctx,
-							script,
-							snapshot)
-						require.NoError(t, err)
-						require.NoError(t, output.Err)
-
-						// TODO:
-						_ = executionSnapshot
-					})
-				})
+
+	t.Run("testing calling Cadence arch - flow block height (happy case)", func(t *testing.T) {
+		chain := flow.Emulator.Chain()
+		sc := systemcontracts.SystemContractsForChain(chain.ChainID())
+		RunWithNewEnvironment(t,
+			chain, func(
+				ctx fvm.Context,
+				vm fvm.VM,
+				snapshot snapshot.SnapshotTree,
+				testContract *TestContract,
+				testAccount *EOATestAccount,
+			) {
+				code := []byte(fmt.Sprintf(
+					`
+					import EVM from %s
+
+					access(all)
+					fun main(tx: [UInt8], coinbaseBytes: [UInt8; 20]) {
+						let coinbase = EVM.EVMAddress(bytes: coinbaseBytes)
+						EVM.run(tx: tx, coinbase: coinbase)
+					}
+                    `,
+					sc.EVMContract.Address.HexWithPrefix(),
+				))
+				innerTxBytes := testAccount.PrepareSignAndEncodeTx(t,
+					testContract.DeployedAt.ToCommon(),
+					testContract.MakeCallData(t, "verifyArchCallToFlowBlockHeight", uint64(ctx.BlockHeader.Height)),
+					big.NewInt(0),
+					uint64(10_000_000),
+					big.NewInt(0),
+				)
+				script := fvm.Script(code).WithArguments(
+					json.MustEncode(
+						cadence.NewArray(
+							ConvertToCadence(innerTxBytes),
+						).WithType(stdlib.EVMTransactionBytesCadenceType),
+					),
+					json.MustEncode(
+						cadence.NewArray(
+							ConvertToCadence(testAccount.Address().Bytes()),
+						).WithType(stdlib.EVMAddressBytesCadenceType),
+					),
+				)
+				_, output, err := vm.Run(
+					ctx,
+					script,
+					snapshot)
+				require.NoError(t, err)
+				require.NoError(t, output.Err)
+			})
+	})
+
+	t.Run("testing calling Cadence arch - COA ownership proof (happy case)", func(t *testing.T) {
+		chain := flow.Emulator.Chain()
+		sc := systemcontracts.SystemContractsForChain(chain.ChainID())
+		RunWithNewEnvironment(t,
+			chain, func(
+				ctx fvm.Context,
+				vm fvm.VM,
+				snapshot snapshot.SnapshotTree,
+				testContract *TestContract,
+				testAccount *EOATestAccount,
+			) {
+				// create a flow account
+				privateKey, err := testutil.GenerateAccountPrivateKey()
+				require.NoError(t, err)
+
+				snapshot, accounts, err := testutil.CreateAccounts(
+					vm,
+					snapshot,
+					[]flow.AccountPrivateKey{privateKey},
+					chain)
+				require.NoError(t, err)
+				flowAccount := accounts[0]
+
+				// create/store/link coa
+				coaAddress, snapshot := setupCOA(
+					t,
+					ctx,
+					vm,
+					snapshot,
+					flowAccount,
+					0,
+				)
+
+				data := RandomCommonHash(t)
+
+				hasher, err := crypto.NewPrefixedHashing(privateKey.HashAlgo, "FLOW-V0.0-user")
+				require.NoError(t, err)
+
+				sig, err := privateKey.PrivateKey.Sign(data.Bytes(), hasher)
+				require.NoError(t, err)
+
+				proof := types.COAOwnershipProof{
+					KeyIndices:     []uint64{0},
+					Address:        types.FlowAddress(flowAccount),
+					CapabilityPath: "coa",
+					Signatures:     []types.Signature{types.Signature(sig)},
+				}
+
+				encodedProof, err := proof.Encode()
+				require.NoError(t, err)
+
+				// create transaction for proof verification
+				code := []byte(fmt.Sprintf(
+					`
+					import EVM from %s
+
+					access(all)
+					fun main(tx: [UInt8], coinbaseBytes: [UInt8; 20]) {
+						let coinbase = EVM.EVMAddress(bytes: coinbaseBytes)
+						EVM.run(tx: tx, coinbase: coinbase)
+					}
+                	`,
+					sc.EVMContract.Address.HexWithPrefix(),
+				))
+				innerTxBytes := testAccount.PrepareSignAndEncodeTx(t,
+					testContract.DeployedAt.ToCommon(),
+					testContract.MakeCallData(t, "verifyArchCallToVerifyCOAOwnershipProof",
+						true,
+						coaAddress.ToCommon(),
+						data,
+						encodedProof),
+					big.NewInt(0),
+					uint64(10_000_000),
+					big.NewInt(0),
+				)
+				verifyScript := fvm.Script(code).WithArguments(
+					json.MustEncode(
+						cadence.NewArray(
+							ConvertToCadence(innerTxBytes),
+						).WithType(
+							stdlib.EVMTransactionBytesCadenceType,
+						)),
+					json.MustEncode(
+						cadence.NewArray(
+							ConvertToCadence(
+								testAccount.Address().Bytes(),
+							),
+						).WithType(
+							stdlib.EVMAddressBytesCadenceType,
+						),
+					),
+				)
+				// run proof transaction
+				_, output, err := vm.Run(
+					ctx,
+					verifyScript,
+					snapshot)
+				require.NoError(t, err)
+				require.NoError(t, output.Err)
+			})
+	})
+}
+
+func createAndFundFlowAccount(
+	t *testing.T,
+	ctx fvm.Context,
+	vm fvm.VM,
+	snapshot snapshot.SnapshotTree,
+) (flow.Address, flow.AccountPrivateKey, snapshot.SnapshotTree) {
+
+	privateKey, err := testutil.GenerateAccountPrivateKey()
+	require.NoError(t, err)
+
+	snapshot, accounts, err := testutil.CreateAccounts(
+		vm,
+		snapshot,
+		[]flow.AccountPrivateKey{privateKey},
+		ctx.Chain)
+	require.NoError(t, err)
+	flowAccount := accounts[0]
+
+	// fund the account with 100 tokens
+	sc := systemcontracts.SystemContractsForChain(ctx.Chain.ChainID())
+	code := []byte(fmt.Sprintf(
+		`
+		import FlowToken from %s
+		import FungibleToken from %s 
+
+		transaction {
+			prepare(account: AuthAccount) {
+			let admin = account.borrow<&FlowToken.Administrator>(from: /storage/flowTokenAdmin)!
+			let minter <- admin.createNewMinter(allowedAmount: 100.0)
+			let vault <- minter.mintTokens(amount: 100.0)
+
+			let receiverRef = getAccount(%s).getCapability(/public/flowTokenReceiver)
+				.borrow<&{FungibleToken.Receiver}>()
+				?? panic("Could not borrow receiver reference to the recipient's Vault")
+			receiverRef.deposit(from: <-vault)
+
+			destroy minter
+			}
+		}
+		`,
+		sc.FlowToken.Address.HexWithPrefix(),
+		sc.FungibleToken.Address.HexWithPrefix(),
+		flowAccount.HexWithPrefix(),
+	))
+
+	tx := fvm.Transaction(
+		flow.NewTransactionBody().
+			SetScript(code).
+			AddAuthorizer(sc.FlowServiceAccount.Address),
+		0)
+
+	es, output, err := vm.Run(ctx, tx, snapshot)
+	require.NoError(t, err)
+	require.NoError(t, output.Err)
+	snapshot = snapshot.Append(es)
+
+	bal := getFlowAccountBalance(
+		t,
+		ctx,
+		vm,
+		snapshot,
+		flowAccount)
+	// 100 flow in ufix64
+	require.Equal(t, uint64(10_000_000_000), bal)
+
+	return flowAccount, privateKey, snapshot
+}
+
+func setupCOA(
+	t *testing.T,
+	ctx fvm.Context,
+	vm fvm.VM,
+	snap snapshot.SnapshotTree,
+	coaOwner flow.Address,
+	initialFund uint64,
+) (types.Address, snapshot.SnapshotTree) {
+
+	sc := systemcontracts.SystemContractsForChain(ctx.Chain.ChainID())
+	// create a COA and store it under flow account
+	script := []byte(fmt.Sprintf(
+		`
+	import EVM from %s
+	import FungibleToken from %s
+	import FlowToken from %s
+
+	transaction(amount: UFix64) {
+		prepare(account: AuthAccount) {
+			let cadenceOwnedAccount1 <- EVM.createCadenceOwnedAccount()
+			
+			let vaultRef = account.borrow<&FlowToken.Vault>(from: /storage/flowTokenVault)
+			?? panic("Could not borrow reference to the owner's Vault!")
+
+			if amount > 0.0 {
+				let vault <- vaultRef.withdraw(amount: amount) as! @FlowToken.Vault
+				cadenceOwnedAccount1.deposit(from: <-vault)
+			}
+
+			account.save<@EVM.CadenceOwnedAccount>(<-cadenceOwnedAccount1,
+												to: /storage/coa)
+			account.link<&EVM.CadenceOwnedAccount{EVM.Addressable}>(/public/coa,
+																target: /storage/coa)
+		}
+	}
+	`,
+		sc.EVMContract.Address.HexWithPrefix(),
+		sc.FungibleToken.Address.HexWithPrefix(),
+		sc.FlowToken.Address.HexWithPrefix(),
+	))
+
+	tx := fvm.Transaction(
+		flow.NewTransactionBody().
+			SetScript(script).
+			AddAuthorizer(coaOwner).
+			AddArgument(json.MustEncode(cadence.UFix64(initialFund))),
+		0)
+	es, output, err := vm.Run(ctx, tx, snap)
+	require.NoError(t, err)
+	require.NoError(t, output.Err)
+	snap = snap.Append(es)
+
+	// 3rd event is the cadence owned account created event
+	coaAddress, err := types.COAAddressFromFlowEvent(sc.EVMContract.Address, output.Events[2])
+	require.NoError(t, err)
+
+	return coaAddress, snap
+}
+
+func getFlowAccountBalance(
+	t *testing.T,
+	ctx fvm.Context,
+	vm fvm.VM,
+	snap snapshot.SnapshotTree,
+	address flow.Address,
+) uint64 {
+	code := []byte(fmt.Sprintf(
+		`
+		access(all) fun main(): UFix64 {
+			return getAccount(%s).balance
+		}
+		`,
+		address.HexWithPrefix(),
+	))
+
+	script := fvm.Script(code)
+	_, output, err := vm.Run(
+		ctx,
+		script,
+		snap)
+	require.NoError(t, err)
+	require.NoError(t, output.Err)
+	val, ok := output.Value.(cadence.UFix64)
+	require.True(t, ok)
+	return uint64(val)
+}
+
+func getEVMAccountBalance(
+	t *testing.T,
+	ctx fvm.Context,
+	vm fvm.VM,
+	snap snapshot.SnapshotTree,
+	address types.Address,
+) types.Balance {
+	code := []byte(fmt.Sprintf(
+		`
+		import EVM from %s
+		access(all)
+		fun main(addr: [UInt8; 20]): UInt {
+			return EVM.EVMAddress(bytes: addr).balance().inAttoFLOW()
+		}
+		`,
+		systemcontracts.SystemContractsForChain(
+			ctx.Chain.ChainID(),
+		).EVMContract.Address.HexWithPrefix(),
+	))
+
+	script := fvm.Script(code).WithArguments(
+		json.MustEncode(
+			cadence.NewArray(
+				ConvertToCadence(address.Bytes()),
+			).WithType(stdlib.EVMAddressBytesCadenceType),
+		),
+	)
+	_, output, err := vm.Run(
+		ctx,
+		script,
+		snap)
+	require.NoError(t, err)
+	require.NoError(t, output.Err)
+	val, ok := output.Value.(cadence.UInt)
+	require.True(t, ok)
+	return val.Big()
+}
+
+func getEVMAccountNonce(
+	t *testing.T,
+	ctx fvm.Context,
+	vm fvm.VM,
+	snap snapshot.SnapshotTree,
+	address types.Address,
+) uint64 {
+	code := []byte(fmt.Sprintf(
+		`
+		import EVM from %s
+		access(all)
+		fun main(addr: [UInt8; 20]): UInt64 {
+			return EVM.EVMAddress(bytes: addr).nonce()
+		}
+		`,
+		systemcontracts.SystemContractsForChain(
+			ctx.Chain.ChainID(),
+		).EVMContract.Address.HexWithPrefix(),
+	))
+
+	script := fvm.Script(code).WithArguments(
+		json.MustEncode(
+			cadence.NewArray(
+				ConvertToCadence(address.Bytes()),
+			).WithType(stdlib.EVMAddressBytesCadenceType),
+		),
+	)
+	_, output, err := vm.Run(
+		ctx,
+		script,
+		snap)
+	require.NoError(t, err)
+	require.NoError(t, output.Err)
+	val, ok := output.Value.(cadence.UInt64)
+	require.True(t, ok)
+	return uint64(val)
+}
+
+func RunWithNewEnvironment(
+	t *testing.T,
+	chain flow.Chain,
+	f func(
+		fvm.Context,
+		fvm.VM,
+		snapshot.SnapshotTree,
+		*TestContract,
+		*EOATestAccount,
+	),
+) {
+	rootAddr, err := evm.StorageAccountAddress(chain.ChainID())
+	require.NoError(t, err)
+
+	RunWithTestBackend(t, func(backend *TestBackend) {
+		RunWithDeployedContract(t, GetStorageTestContract(t), backend, rootAddr, func(testContract *TestContract) {
+			RunWithEOATestAccount(t, backend, rootAddr, func(testAccount *EOATestAccount) {
+
+				blocks := new(envMock.Blocks)
+				block1 := unittest.BlockFixture()
+				blocks.On("ByHeightFrom",
+					block1.Header.Height,
+					block1.Header,
+				).Return(block1.Header, nil)
+
+				opts := []fvm.Option{
+					fvm.WithChain(chain),
+					fvm.WithBlockHeader(block1.Header),
+					fvm.WithAuthorizationChecksEnabled(false),
+					fvm.WithSequenceNumberCheckAndIncrementEnabled(false),
+					fvm.WithEntropyProvider(testutil.EntropyProviderFixture(nil)),
+					fvm.WithBlocks(blocks),
+				}
+				ctx := fvm.NewContext(opts...)
+
+				vm := fvm.NewVirtualMachine()
+				snapshotTree := snapshot.NewSnapshotTree(backend)
+
+				baseBootstrapOpts := []fvm.BootstrapProcedureOption{
+					fvm.WithInitialTokenSupply(unittest.GenesisTokenSupply),
+					fvm.WithSetupEVMEnabled(true),
+				}
+
+				executionSnapshot, _, err := vm.Run(
+					ctx,
+					fvm.Bootstrap(unittest.ServiceAccountPublicKey, baseBootstrapOpts...),
+					snapshotTree)
+				require.NoError(t, err)
+
+				snapshotTree = snapshotTree.Append(executionSnapshot)
+
+				f(
+					fvm.NewContextFromParent(ctx, fvm.WithEVMEnabled(true)),
+					vm,
+					snapshotTree,
+					testContract,
+					testAccount,
+				)
 			})
 		})
 	})
diff --git a/fvm/evm/handler/addressAllocator.go b/fvm/evm/handler/addressAllocator.go
index d1dc8299130..dc468246b15 100644
--- a/fvm/evm/handler/addressAllocator.go
+++ b/fvm/evm/handler/addressAllocator.go
@@ -3,68 +3,46 @@ package handler
 import (
 	"encoding/binary"
 
-	"github.com/onflow/atree"
-
 	"github.com/onflow/flow-go/fvm/evm/types"
-	"github.com/onflow/flow-go/model/flow"
 )
 
 const (
-	ledgerAddressAllocatorKey = "AddressAllocator"
-	uint64ByteSize            = 8
-	addressPrefixLen          = 12
-)
-
-var (
-	// prefixes:
-	// the first 12 bytes of addresses allocation
-	// leading zeros helps with storage and all zero is reserved for the EVM precompiles
-	FlowEVMPrecompileAddressPrefix = [addressPrefixLen]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1}
-	FlowEVMCOAAddressPrefix        = [addressPrefixLen]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2}
+	// `addressIndexMultiplierConstant` is used for mapping address indices
+	// into deterministic random-looking address postfixes.
+	// The constant must be an ODD number.
+	// It is a "nothing-up-my-sleeves" constant, chosen to be big enough so that
+	// the index and its corresponding address look less "related".
+	// Note that the least significant byte was set to "77" instead of "88" to force
+	// the odd parity.
+	// Look at `mapAddressIndex` for more details.
+	addressIndexMultiplierConstant = uint64(0xFFEEDDCCBBAA9977)
 )
 
 type AddressAllocator struct {
-	led         atree.Ledger
-	flexAddress flow.Address
 }
 
 var _ types.AddressAllocator = &AddressAllocator{}
 
 // NewAddressAllocator constructs a new statefull address allocator
-func NewAddressAllocator(led atree.Ledger, flexAddress flow.Address) (*AddressAllocator, error) {
-	return &AddressAllocator{
-		led:         led,
-		flexAddress: flexAddress,
-	}, nil
+func NewAddressAllocator() *AddressAllocator {
+	return &AddressAllocator{}
 }
 
-// AllocateCOAAddress allocates an address for COA
-func (aa *AddressAllocator) AllocateCOAAddress() (types.Address, error) {
-	data, err := aa.led.GetValue(aa.flexAddress[:], []byte(ledgerAddressAllocatorKey))
-	if err != nil {
-		return types.Address{}, err
-	}
-	// default value for uuid is 1
-	uuid := uint64(1)
-	if len(data) > 0 {
-		uuid = binary.BigEndian.Uint64(data)
-	}
-
-	target := MakeCOAAddress(uuid)
+func (aa *AddressAllocator) COAFactoryAddress() types.Address {
+	return MakeCOAAddress(0)
+}
 
-	// store new uuid
-	newData := make([]byte, 8)
-	binary.BigEndian.PutUint64(newData, uuid+1)
-	err = aa.led.SetValue(aa.flexAddress[:], []byte(ledgerAddressAllocatorKey), newData)
-	if err != nil {
-		return types.Address{}, err
-	}
+func (aa *AddressAllocator) NativeTokenBridgeAddress() types.Address {
+	return MakePrecompileAddress(0)
+}
 
-	return target, nil
+// AllocateCOAAddress allocates an address for COA
+func (aa *AddressAllocator) AllocateCOAAddress(uuid uint64) types.Address {
+	return MakeCOAAddress(uuid)
 }
 
 func MakeCOAAddress(index uint64) types.Address {
-	return makePrefixedAddress(index, FlowEVMCOAAddressPrefix)
+	return makePrefixedAddress(mapAddressIndex(index), types.FlowEVMCOAAddressPrefix)
 }
 
 func (aa *AddressAllocator) AllocatePrecompileAddress(index uint64) types.Address {
@@ -73,13 +51,32 @@ func (aa *AddressAllocator) AllocatePrecompileAddress(index uint64) types.Addres
 }
 
 func MakePrecompileAddress(index uint64) types.Address {
-	return makePrefixedAddress(index, FlowEVMPrecompileAddressPrefix)
+	return makePrefixedAddress(index, types.FlowEVMExtendedPrecompileAddressPrefix)
 }
 
-func makePrefixedAddress(index uint64, prefix [addressPrefixLen]byte) types.Address {
+func makePrefixedAddress(
+	index uint64,
+	prefix [types.FlowEVMSpecialAddressPrefixLen]byte,
+) types.Address {
 	var addr types.Address
-	prefixIndex := types.AddressLength - uint64ByteSize
-	copy(addr[:prefixIndex], prefix[:])
-	binary.BigEndian.PutUint64(addr[prefixIndex:], index)
+	copy(addr[:], prefix[:])
+	// only works if `len(addr) - len(prefix)` is exactly 8 bytes
+	binary.BigEndian.PutUint64(addr[len(prefix):], index)
 	return addr
 }
+
+// `mapAddressIndex` maps an index of 64 bits to a deterministic random-looking 64 bits.
+//
+// The mapping function must be an injective mapping (in this case bijective)
+// where every two indices always map to two different results. Multiple injective
+// mappings are possible.
+//
+// The current implementation uses a simple modular multiplication by a constant modulo 2^64.
+// The multiplier constant can be any odd number. Since odd numbers are co-prime with 2^64, they
+// have a multiplicative inverse modulo 2^64.
+// This makes multiplying by an odd number an injective function (and therefore bijective).
+//
+// Multiplying modulo 2^64 is implicitly implemented as a uint64 multiplication with a uin64 result.
+func mapAddressIndex(index uint64) uint64 {
+	return uint64(index * addressIndexMultiplierConstant)
+}
diff --git a/fvm/evm/handler/addressAllocator_test.go b/fvm/evm/handler/addressAllocator_test.go
index 03794baea9a..df6605f9658 100644
--- a/fvm/evm/handler/addressAllocator_test.go
+++ b/fvm/evm/handler/addressAllocator_test.go
@@ -3,39 +3,38 @@ package handler_test
 import (
 	"testing"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
+	gethCommon "github.com/onflow/go-ethereum/common"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/fvm/evm/handler"
-	"github.com/onflow/flow-go/fvm/evm/testutils"
 	"github.com/onflow/flow-go/fvm/evm/types"
-	"github.com/onflow/flow-go/model/flow"
 )
 
 func TestAddressAllocator(t *testing.T) {
-
-	testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
-		testutils.RunWithTestFlowEVMRootAddress(t, backend, func(root flow.Address) {
-			aa, err := handler.NewAddressAllocator(backend, root)
-			require.NoError(t, err)
-
-			adr := aa.AllocatePrecompileAddress(3)
-			expectedAddress := types.NewAddress(gethCommon.HexToAddress("0x0000000000000000000000010000000000000003"))
-			require.Equal(t, expectedAddress, adr)
-
-			// test default value fall back
-			adr, err = aa.AllocateCOAAddress()
-			require.NoError(t, err)
-			expectedAddress = types.NewAddress(gethCommon.HexToAddress("0x0000000000000000000000020000000000000001"))
-			require.Equal(t, expectedAddress, adr)
-
-			// continous allocation logic
-			adr, err = aa.AllocateCOAAddress()
-			require.NoError(t, err)
-			expectedAddress = types.NewAddress(gethCommon.HexToAddress("0x0000000000000000000000020000000000000002"))
-			require.Equal(t, expectedAddress, adr)
-		})
-
-	})
-
+	aa := handler.NewAddressAllocator()
+
+	adr := aa.AllocatePrecompileAddress(3)
+	expectedAddress := types.NewAddress(gethCommon.HexToAddress("0x0000000000000000000000010000000000000003"))
+	require.Equal(t, expectedAddress, adr)
+	// check conforming to types
+	require.False(t, types.IsACOAAddress(adr))
+
+	// test default value fall back
+	adr = aa.AllocateCOAAddress(1)
+	expectedAddress = types.NewAddress(gethCommon.HexToAddress("0x000000000000000000000002ffeeddccbbaa9977"))
+	require.Equal(t, expectedAddress, adr)
+	// check conforming to types
+	require.True(t, types.IsACOAAddress(adr))
+
+	// continous allocation logic
+	adr = aa.AllocateCOAAddress(2)
+	expectedAddress = types.NewAddress(gethCommon.HexToAddress("0x000000000000000000000002ffddbb99775532ee"))
+	require.Equal(t, expectedAddress, adr)
+	// check conforming to types
+	require.True(t, types.IsACOAAddress(adr))
+
+	// factory
+	factory := aa.COAFactoryAddress()
+	expectedAddress = types.NewAddress(gethCommon.HexToAddress("0x0000000000000000000000020000000000000000"))
+	require.Equal(t, expectedAddress, factory)
 }
diff --git a/fvm/evm/handler/blockstore.go b/fvm/evm/handler/blockstore.go
index 2a6ab530d61..32c282a0d84 100644
--- a/fvm/evm/handler/blockstore.go
+++ b/fvm/evm/handler/blockstore.go
@@ -1,29 +1,35 @@
 package handler
 
 import (
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	"github.com/onflow/atree"
+	"fmt"
+	"time"
+
+	gethCommon "github.com/onflow/go-ethereum/common"
 
 	"github.com/onflow/flow-go/fvm/evm/types"
 	"github.com/onflow/flow-go/model/flow"
 )
 
-var FlexLatestBlockKey = "LatestBlock"
+const (
+	BlockHashListCapacity    = 16
+	BlockStoreLatestBlockKey = "LatestBlock"
+	BlockStoreBlockHashesKey = "LatestBlockHashes"
+)
 
 type BlockStore struct {
-	led           atree.Ledger
-	flexAddress   flow.Address
+	backend       types.Backend
+	rootAddress   flow.Address
 	blockProposal *types.Block
 }
 
 var _ types.BlockStore = &BlockStore{}
 
 // NewBlockStore constructs a new block store
-func NewBlockStore(led atree.Ledger, flexAddress flow.Address) (*BlockStore, error) {
+func NewBlockStore(backend types.Backend, rootAddress flow.Address) *BlockStore {
 	return &BlockStore{
-		led:         led,
-		flexAddress: flexAddress,
-	}, nil
+		backend:     backend,
+		rootAddress: rootAddress,
+	}
 }
 
 // BlockProposal returns the block proposal to be updated by the handler
@@ -32,6 +38,19 @@ func (bs *BlockStore) BlockProposal() (*types.Block, error) {
 		return bs.blockProposal, nil
 	}
 
+	cadenceHeight, err := bs.backend.GetCurrentBlockHeight()
+	if err != nil {
+		return nil, err
+	}
+
+	cadenceBlock, found, err := bs.backend.GetBlockAtHeight(cadenceHeight)
+	if err != nil {
+		return nil, err
+	}
+	if !found {
+		return nil, fmt.Errorf("cadence block not found")
+	}
+
 	lastExecutedBlock, err := bs.LatestBlock()
 	if err != nil {
 		return nil, err
@@ -42,12 +61,18 @@ func (bs *BlockStore) BlockProposal() (*types.Block, error) {
 		return nil, err
 	}
 
-	bs.blockProposal = &types.Block{
-		Height:            lastExecutedBlock.Height + 1,
-		ParentBlockHash:   parentHash,
-		TotalSupply:       lastExecutedBlock.TotalSupply,
-		TransactionHashes: make([]gethCommon.Hash, 0),
-	}
+	// cadence block timestamp is unix nanoseconds but evm blocks
+	// expect timestamps in unix seconds so we convert here
+	timestamp := uint64(cadenceBlock.Timestamp / int64(time.Second))
+
+	bs.blockProposal = types.NewBlock(
+		parentHash,
+		lastExecutedBlock.Height+1,
+		timestamp,
+		lastExecutedBlock.TotalSupply,
+		gethCommon.Hash{},
+		make([]gethCommon.Hash, 0),
+	)
 	return bs.blockProposal, nil
 }
 
@@ -63,13 +88,17 @@ func (bs *BlockStore) CommitBlockProposal() error {
 		return types.NewFatalError(err)
 	}
 
-	err = bs.led.SetValue(bs.flexAddress[:], []byte(FlexLatestBlockKey), blockBytes)
+	err = bs.backend.SetValue(bs.rootAddress[:], []byte(BlockStoreLatestBlockKey), blockBytes)
 	if err != nil {
-		return types.NewFatalError(err)
+		return err
 	}
 
-	bs.blockProposal = nil
+	err = bs.updateBlockHashList(bs.blockProposal)
+	if err != nil {
+		return err
+	}
 
+	bs.blockProposal = nil
 	return nil
 }
 
@@ -81,7 +110,7 @@ func (bs *BlockStore) ResetBlockProposal() error {
 
 // LatestBlock returns the latest executed block
 func (bs *BlockStore) LatestBlock() (*types.Block, error) {
-	data, err := bs.led.GetValue(bs.flexAddress[:], []byte(FlexLatestBlockKey))
+	data, err := bs.backend.GetValue(bs.rootAddress[:], []byte(BlockStoreLatestBlockKey))
 	if len(data) == 0 {
 		return types.GenesisBlock, err
 	}
@@ -92,9 +121,47 @@ func (bs *BlockStore) LatestBlock() (*types.Block, error) {
 }
 
 // BlockHash returns the block hash for the last x blocks
-//
-// TODO: implement this properly to keep the last 256 block hashes
-// and connect use it inside the handler to pass as a config to the emulator
-func (bs *BlockStore) BlockHash(height int) (gethCommon.Hash, error) {
-	return gethCommon.Hash{}, nil
+func (bs *BlockStore) BlockHash(height uint64) (gethCommon.Hash, error) {
+	bhl, err := bs.getBlockHashList()
+	if err != nil {
+		return gethCommon.Hash{}, err
+	}
+	_, hash := bhl.BlockHashByHeight(height)
+	return hash, nil
+}
+
+func (bs *BlockStore) getBlockHashList() (*types.BlockHashList, error) {
+	data, err := bs.backend.GetValue(bs.rootAddress[:], []byte(BlockStoreBlockHashesKey))
+	if err != nil {
+		return nil, err
+	}
+	if len(data) == 0 {
+		bhl := types.NewBlockHashList(BlockHashListCapacity)
+		err = bhl.Push(types.GenesisBlock.Height, types.GenesisBlockHash)
+		return bhl, err
+	}
+	return types.NewBlockHashListFromEncoded(data)
+}
+
+func (bs *BlockStore) updateBlockHashList(block *types.Block) error {
+	bhl, err := bs.getBlockHashList()
+	if err != nil {
+		return err
+	}
+	hash, err := block.Hash()
+	if err != nil {
+		return err
+	}
+	err = bhl.Push(block.Height, hash)
+	if err != nil {
+		return err
+	}
+	err = bs.backend.SetValue(
+		bs.rootAddress[:],
+		[]byte(BlockStoreBlockHashesKey),
+		bhl.Encode())
+	if err != nil {
+		return err
+	}
+	return nil
 }
diff --git a/fvm/evm/handler/blockstore_test.go b/fvm/evm/handler/blockstore_test.go
index b198f04c053..1d5904d3808 100644
--- a/fvm/evm/handler/blockstore_test.go
+++ b/fvm/evm/handler/blockstore_test.go
@@ -4,6 +4,7 @@ import (
 	"math/big"
 	"testing"
 
+	gethCommon "github.com/onflow/go-ethereum/common"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/fvm/evm/handler"
@@ -16,13 +17,15 @@ func TestBlockStore(t *testing.T) {
 
 	testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
 		testutils.RunWithTestFlowEVMRootAddress(t, backend, func(root flow.Address) {
-			bs, err := handler.NewBlockStore(backend, root)
-			require.NoError(t, err)
+			bs := handler.NewBlockStore(backend, root)
 
 			// check gensis block
 			b, err := bs.LatestBlock()
 			require.NoError(t, err)
 			require.Equal(t, types.GenesisBlock, b)
+			h, err := bs.BlockHash(0)
+			require.NoError(t, err)
+			require.Equal(t, types.GenesisBlockHash, h)
 
 			// test block proposal from genesis
 			bp, err := bs.BlockProposal()
@@ -44,6 +47,24 @@ func TestBlockStore(t *testing.T) {
 			bp, err = bs.BlockProposal()
 			require.NoError(t, err)
 			require.Equal(t, uint64(2), bp.Height)
+
+			// check block hashes
+			// genesis
+			h, err = bs.BlockHash(0)
+			require.NoError(t, err)
+			require.Equal(t, types.GenesisBlockHash, h)
+
+			// block 1
+			h, err = bs.BlockHash(1)
+			require.NoError(t, err)
+			expected, err := b.Hash()
+			require.NoError(t, err)
+			require.Equal(t, expected, h)
+
+			// block 2
+			h, err = bs.BlockHash(2)
+			require.NoError(t, err)
+			require.Equal(t, gethCommon.Hash{}, h)
 		})
 
 	})
diff --git a/fvm/evm/handler/coa/coa.go b/fvm/evm/handler/coa/coa.go
new file mode 100644
index 00000000000..8be5394cff5
--- /dev/null
+++ b/fvm/evm/handler/coa/coa.go
@@ -0,0 +1,19 @@
+package coa
+
+import (
+	_ "embed"
+	"encoding/hex"
+)
+
+var ContractDeploymentRequiredGas = uint64(723_000)
+
+//go:embed coa_bytes.hex
+var contractBytesInHex string
+
+// ContractBytes is the compiled version of the coa smart contract.
+var ContractBytes, _ = hex.DecodeString(contractBytesInHex)
+
+// ContractABIJSON is the json string of ABI of the coa smart contract.
+//
+//go:embed coa_abi.json
+var ContractABIJSON string
diff --git a/fvm/evm/handler/coa/coa.sol b/fvm/evm/handler/coa/coa.sol
new file mode 100644
index 00000000000..7c35f35c3cf
--- /dev/null
+++ b/fvm/evm/handler/coa/coa.sol
@@ -0,0 +1,126 @@
+// SPDX-License-Identifier: UNLICENSED
+
+pragma solidity >=0.7.0 <0.9.0;
+
+interface IERC165 {
+    function supportsInterface(bytes4 interfaceId) external view returns (bool);
+}
+
+interface ERC721TokenReceiver {
+    function onERC721Received(
+        address _operator,
+        address _from,
+        uint256 _tokenId,
+        bytes calldata _data
+        ) external returns (bytes4);
+}
+
+interface ERC777TokensRecipient {
+    function tokensReceived(
+            address operator,
+            address from,
+            address to,
+            uint256 amount,
+            bytes calldata data,
+            bytes calldata operatorData
+        ) external;
+}
+
+interface ERC1155TokenReceiver {
+
+    function onERC1155Received(
+            address _operator,
+            address _from,
+            uint256 _id,
+            uint256 _value,
+            bytes calldata _data
+        ) external returns (bytes4);
+
+    function onERC1155BatchReceived(
+            address _operator,
+            address _from,
+            uint256[] calldata _ids,
+            uint256[] calldata _values,
+            bytes calldata _data
+        ) external returns (bytes4);
+
+}
+
+contract COA is ERC1155TokenReceiver, ERC777TokensRecipient, ERC721TokenReceiver, IERC165 {
+    address constant public cadenceArch = 0x0000000000000000000000010000000000000001;
+
+    // bytes4(keccak256("onERC721Received(address,address,uint256,bytes)"))
+    bytes4 constant internal ERC721ReceivedIsSupported = 0x150b7a02;
+
+    // bytes4(keccak256("onERC1155Received(address,address,uint256,uint256,bytes)"))
+    bytes4 constant internal ERC1155ReceivedIsSupported = 0xf23a6e61;
+
+    // bytes4(keccak256("onERC1155BatchReceived(address,address,uint256[],uint256[],bytes)"))
+    bytes4 constant internal ERC1155BatchReceivedIsSupported = 0xbc197c81;
+
+    // bytes4(keccak256("isValidSignature(bytes32,bytes)")
+    bytes4 constant internal ValidERC1271Signature = 0x1626ba7e;
+    bytes4 constant internal InvalidERC1271Signature = 0xffffffff;
+
+    receive() external payable  {
+    }
+    function supportsInterface(bytes4 id) external view virtual override returns (bool) {
+        return
+            id == type(ERC1155TokenReceiver).interfaceId ||
+            id == type(ERC721TokenReceiver).interfaceId ||
+            id == type(ERC777TokensRecipient).interfaceId ||
+            id == type(IERC165).interfaceId;
+    }
+
+    function tokensReceived(
+        address,
+        address,
+        address,
+        uint256,
+        bytes calldata,
+        bytes calldata
+    ) external pure override {}
+
+    function onERC721Received(
+        address,
+        address,
+        uint256,
+        bytes calldata
+    ) external pure override returns (bytes4) {
+        return ERC721ReceivedIsSupported;
+    }
+
+    function onERC1155Received(
+        address,
+        address,
+        uint256,
+        uint256,
+        bytes calldata
+    ) external pure override returns (bytes4) {
+        return ERC1155ReceivedIsSupported;
+    }
+
+    function onERC1155BatchReceived(
+        address,
+        address,
+        uint256[] calldata,
+        uint256[] calldata,
+        bytes calldata
+    ) external pure override returns (bytes4) {
+        return ERC1155BatchReceivedIsSupported;
+    }
+
+    // ERC1271 requirement 
+    function isValidSignature(
+        bytes32 _hash,
+        bytes memory _sig
+    ) external view virtual returns (bytes4){
+        (bool ok, bytes memory data) = cadenceArch.staticcall(abi.encodeWithSignature("verifyCOAOwnershipProof(address,bytes32,bytes)", address(this), _hash, _sig));
+        require(ok);
+        bool output = abi.decode(data, (bool));
+        if (output) {
+            return ValidERC1271Signature;
+        }
+        return InvalidERC1271Signature;
+    }
+}
\ No newline at end of file
diff --git a/fvm/evm/handler/coa/coa_abi.json b/fvm/evm/handler/coa/coa_abi.json
new file mode 100644
index 00000000000..3f46c1f4b8f
--- /dev/null
+++ b/fvm/evm/handler/coa/coa_abi.json
@@ -0,0 +1,212 @@
+[
+	{
+		"inputs": [],
+		"name": "cadenceArch",
+		"outputs": [
+			{
+				"internalType": "address",
+				"name": "",
+				"type": "address"
+			}
+		],
+		"stateMutability": "view",
+		"type": "function"
+	},
+	{
+		"inputs": [
+			{
+				"internalType": "bytes32",
+				"name": "_hash",
+				"type": "bytes32"
+			},
+			{
+				"internalType": "bytes",
+				"name": "_sig",
+				"type": "bytes"
+			}
+		],
+		"name": "isValidSignature",
+		"outputs": [
+			{
+				"internalType": "bytes4",
+				"name": "",
+				"type": "bytes4"
+			}
+		],
+		"stateMutability": "view",
+		"type": "function"
+	},
+	{
+		"inputs": [
+			{
+				"internalType": "address",
+				"name": "",
+				"type": "address"
+			},
+			{
+				"internalType": "address",
+				"name": "",
+				"type": "address"
+			},
+			{
+				"internalType": "uint256[]",
+				"name": "",
+				"type": "uint256[]"
+			},
+			{
+				"internalType": "uint256[]",
+				"name": "",
+				"type": "uint256[]"
+			},
+			{
+				"internalType": "bytes",
+				"name": "",
+				"type": "bytes"
+			}
+		],
+		"name": "onERC1155BatchReceived",
+		"outputs": [
+			{
+				"internalType": "bytes4",
+				"name": "",
+				"type": "bytes4"
+			}
+		],
+		"stateMutability": "pure",
+		"type": "function"
+	},
+	{
+		"inputs": [
+			{
+				"internalType": "address",
+				"name": "",
+				"type": "address"
+			},
+			{
+				"internalType": "address",
+				"name": "",
+				"type": "address"
+			},
+			{
+				"internalType": "uint256",
+				"name": "",
+				"type": "uint256"
+			},
+			{
+				"internalType": "uint256",
+				"name": "",
+				"type": "uint256"
+			},
+			{
+				"internalType": "bytes",
+				"name": "",
+				"type": "bytes"
+			}
+		],
+		"name": "onERC1155Received",
+		"outputs": [
+			{
+				"internalType": "bytes4",
+				"name": "",
+				"type": "bytes4"
+			}
+		],
+		"stateMutability": "pure",
+		"type": "function"
+	},
+	{
+		"inputs": [
+			{
+				"internalType": "address",
+				"name": "",
+				"type": "address"
+			},
+			{
+				"internalType": "address",
+				"name": "",
+				"type": "address"
+			},
+			{
+				"internalType": "uint256",
+				"name": "",
+				"type": "uint256"
+			},
+			{
+				"internalType": "bytes",
+				"name": "",
+				"type": "bytes"
+			}
+		],
+		"name": "onERC721Received",
+		"outputs": [
+			{
+				"internalType": "bytes4",
+				"name": "",
+				"type": "bytes4"
+			}
+		],
+		"stateMutability": "pure",
+		"type": "function"
+	},
+	{
+		"inputs": [
+			{
+				"internalType": "bytes4",
+				"name": "id",
+				"type": "bytes4"
+			}
+		],
+		"name": "supportsInterface",
+		"outputs": [
+			{
+				"internalType": "bool",
+				"name": "",
+				"type": "bool"
+			}
+		],
+		"stateMutability": "view",
+		"type": "function"
+	},
+	{
+		"inputs": [
+			{
+				"internalType": "address",
+				"name": "",
+				"type": "address"
+			},
+			{
+				"internalType": "address",
+				"name": "",
+				"type": "address"
+			},
+			{
+				"internalType": "address",
+				"name": "",
+				"type": "address"
+			},
+			{
+				"internalType": "uint256",
+				"name": "",
+				"type": "uint256"
+			},
+			{
+				"internalType": "bytes",
+				"name": "",
+				"type": "bytes"
+			},
+			{
+				"internalType": "bytes",
+				"name": "",
+				"type": "bytes"
+			}
+		],
+		"name": "tokensReceived",
+		"outputs": [],
+		"stateMutability": "pure",
+		"type": "function"
+	},
+	{
+		"stateMutability": "payable",
+		"type": "receive"
+	}
+]
\ No newline at end of file
diff --git a/fvm/evm/handler/coa/coa_bytes.hex b/fvm/evm/handler/coa/coa_bytes.hex
new file mode 100644
index 00000000000..7d63c2389f1
--- /dev/null
+++ b/fvm/evm/handler/coa/coa_bytes.hex
@@ -0,0 +1 @@
+608060405234801561000f575f80fd5b50610db98061001d5f395ff3fe608060405260043610610072575f3560e01c80631626ba7e1161004d5780631626ba7e1461011d578063bc197c8114610159578063d0d250bd14610195578063f23a6e61146101bf57610079565b806223de291461007d57806301ffc9a7146100a5578063150b7a02146100e157610079565b3661007957005b5f80fd5b348015610088575f80fd5b506100a3600480360381019061009e9190610641565b6101fb565b005b3480156100b0575f80fd5b506100cb60048036038101906100c69190610760565b610205565b6040516100d891906107a5565b60405180910390f35b3480156100ec575f80fd5b50610107600480360381019061010291906107be565b6103a5565b6040516101149190610851565b60405180910390f35b348015610128575f80fd5b50610143600480360381019061013e91906109d5565b6103b9565b6040516101509190610851565b60405180910390f35b348015610164575f80fd5b5061017f600480360381019061017a9190610a84565b610509565b60405161018c9190610851565b60405180910390f35b3480156101a0575f80fd5b506101a9610520565b6040516101b69190610b6a565b60405180910390f35b3480156101ca575f80fd5b506101e560048036038101906101e09190610b83565b61052d565b6040516101f29190610851565b60405180910390f35b5050505050505050565b5f7f4e2312e0000000000000000000000000000000000000000000000000000000007bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1916827bffffffffffffffffffffffffffffffffffffffffffffffffffffffff191614806102cf57507f150b7a02000000000000000000000000000000000000000000000000000000007bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1916827bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1916145b8061033657507e23de29000000000000000000000000000000000000000000000000000000007bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1916827bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1916145b8061039e57507f01ffc9a7000000000000000000000000000000000000000000000000000000007bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1916827bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1916145b9050919050565b5f63150b7a0260e01b905095945050505050565b5f805f6801000000000000000173ffffffffffffffffffffffffffffffffffffffff163086866040516024016103f193929190610ca2565b6040516020818303038152906040527f5ee837e7000000000000000000000000000000000000000000000000000000007bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19166020820180517bffffffffffffffffffffffffffffffffffffffffffffffffffffffff838183161783525050505060405161047b9190610d18565b5f60405180830381855afa9150503d805f81146104b3576040519150601f19603f3d011682016040523d82523d5f602084013e6104b8565b606091505b5091509150816104c6575f80fd5b5f818060200190518101906104db9190610d58565b905080156104f557631626ba7e60e01b9350505050610503565b63ffffffff60e01b93505050505b92915050565b5f63bc197c8160e01b905098975050505050505050565b6801000000000000000181565b5f63f23a6e6160e01b90509695505050505050565b5f604051905090565b5f80fd5b5f80fd5b5f73ffffffffffffffffffffffffffffffffffffffff82169050919050565b5f61057c82610553565b9050919050565b61058c81610572565b8114610596575f80fd5b50565b5f813590506105a781610583565b92915050565b5f819050919050565b6105bf816105ad565b81146105c9575f80fd5b50565b5f813590506105da816105b6565b92915050565b5f80fd5b5f80fd5b5f80fd5b5f8083601f840112610601576106006105e0565b5b8235905067ffffffffffffffff81111561061e5761061d6105e4565b5b60208301915083600182028301111561063a576106396105e8565b5b9250929050565b5f805f805f805f8060c0898b03121561065d5761065c61054b565b5b5f61066a8b828c01610599565b985050602061067b8b828c01610599565b975050604061068c8b828c01610599565b965050606061069d8b828c016105cc565b955050608089013567ffffffffffffffff8111156106be576106bd61054f565b5b6106ca8b828c016105ec565b945094505060a089013567ffffffffffffffff8111156106ed576106ec61054f565b5b6106f98b828c016105ec565b92509250509295985092959890939650565b5f7fffffffff0000000000000000000000000000000000000000000000000000000082169050919050565b61073f8161070b565b8114610749575f80fd5b50565b5f8135905061075a81610736565b92915050565b5f602082840312156107755761077461054b565b5b5f6107828482850161074c565b91505092915050565b5f8115159050919050565b61079f8161078b565b82525050565b5f6020820190506107b85f830184610796565b92915050565b5f805f805f608086880312156107d7576107d661054b565b5b5f6107e488828901610599565b95505060206107f588828901610599565b9450506040610806888289016105cc565b935050606086013567ffffffffffffffff8111156108275761082661054f565b5b610833888289016105ec565b92509250509295509295909350565b61084b8161070b565b82525050565b5f6020820190506108645f830184610842565b92915050565b5f819050919050565b61087c8161086a565b8114610886575f80fd5b50565b5f8135905061089781610873565b92915050565b5f80fd5b5f601f19601f8301169050919050565b7f4e487b71000000000000000000000000000000000000000000000000000000005f52604160045260245ffd5b6108e7826108a1565b810181811067ffffffffffffffff82111715610906576109056108b1565b5b80604052505050565b5f610918610542565b905061092482826108de565b919050565b5f67ffffffffffffffff821115610943576109426108b1565b5b61094c826108a1565b9050602081019050919050565b828183375f83830152505050565b5f61097961097484610929565b61090f565b9050828152602081018484840111156109955761099461089d565b5b6109a0848285610959565b509392505050565b5f82601f8301126109bc576109bb6105e0565b5b81356109cc848260208601610967565b91505092915050565b5f80604083850312156109eb576109ea61054b565b5b5f6109f885828601610889565b925050602083013567ffffffffffffffff811115610a1957610a1861054f565b5b610a25858286016109a8565b9150509250929050565b5f8083601f840112610a4457610a436105e0565b5b8235905067ffffffffffffffff811115610a6157610a606105e4565b5b602083019150836020820283011115610a7d57610a7c6105e8565b5b9250929050565b5f805f805f805f8060a0898b031215610aa057610a9f61054b565b5b5f610aad8b828c01610599565b9850506020610abe8b828c01610599565b975050604089013567ffffffffffffffff811115610adf57610ade61054f565b5b610aeb8b828c01610a2f565b9650965050606089013567ffffffffffffffff811115610b0e57610b0d61054f565b5b610b1a8b828c01610a2f565b9450945050608089013567ffffffffffffffff811115610b3d57610b3c61054f565b5b610b498b828c016105ec565b92509250509295985092959890939650565b610b6481610572565b82525050565b5f602082019050610b7d5f830184610b5b565b92915050565b5f805f805f8060a08789031215610b9d57610b9c61054b565b5b5f610baa89828a01610599565b9650506020610bbb89828a01610599565b9550506040610bcc89828a016105cc565b9450506060610bdd89828a016105cc565b935050608087013567ffffffffffffffff811115610bfe57610bfd61054f565b5b610c0a89828a016105ec565b92509250509295509295509295565b610c228161086a565b82525050565b5f81519050919050565b5f82825260208201905092915050565b5f5b83811015610c5f578082015181840152602081019050610c44565b5f8484015250505050565b5f610c7482610c28565b610c7e8185610c32565b9350610c8e818560208601610c42565b610c97816108a1565b840191505092915050565b5f606082019050610cb55f830186610b5b565b610cc26020830185610c19565b8181036040830152610cd48184610c6a565b9050949350505050565b5f81905092915050565b5f610cf282610c28565b610cfc8185610cde565b9350610d0c818560208601610c42565b80840191505092915050565b5f610d238284610ce8565b915081905092915050565b610d378161078b565b8114610d41575f80fd5b50565b5f81519050610d5281610d2e565b92915050565b5f60208284031215610d6d57610d6c61054b565b5b5f610d7a84828501610d44565b9150509291505056fea264697066735822122079a2b495dc3da197ff64bc2f601bc2ea89b1704c035aaebb9e4a19d8e71f691064736f6c63430008160033
\ No newline at end of file
diff --git a/fvm/evm/handler/handler.go b/fvm/evm/handler/handler.go
index 5ff314ddc18..663c71c8c03 100644
--- a/fvm/evm/handler/handler.go
+++ b/fvm/evm/handler/handler.go
@@ -4,160 +4,365 @@ import (
 	"bytes"
 	"math/big"
 
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	"github.com/ethereum/go-ethereum/rlp"
 	"github.com/onflow/cadence/runtime/common"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	"github.com/onflow/go-ethereum/rlp"
 
 	"github.com/onflow/flow-go/fvm/environment"
-	"github.com/onflow/flow-go/fvm/errors"
-	"github.com/onflow/flow-go/fvm/evm/precompiles"
+	fvmErrors "github.com/onflow/flow-go/fvm/errors"
+	"github.com/onflow/flow-go/fvm/evm/handler/coa"
 	"github.com/onflow/flow-go/fvm/evm/types"
+	"github.com/onflow/flow-go/model/flow"
 )
 
 // ContractHandler is responsible for triggering calls to emulator, metering,
 // event emission and updating the block
 type ContractHandler struct {
-	flowTokenAddress common.Address
-	blockstore       types.BlockStore
-	addressAllocator types.AddressAllocator
-	backend          types.Backend
-	emulator         types.Emulator
-	precompiles      []types.Precompile
+	flowChainID        flow.ChainID
+	evmContractAddress flow.Address
+	flowTokenAddress   common.Address
+	blockStore         types.BlockStore
+	addressAllocator   types.AddressAllocator
+	backend            types.Backend
+	emulator           types.Emulator
+	precompiles        []types.Precompile
 }
 
 func (h *ContractHandler) FlowTokenAddress() common.Address {
 	return h.flowTokenAddress
 }
 
+func (h *ContractHandler) EVMContractAddress() common.Address {
+	return common.Address(h.evmContractAddress)
+}
+
 var _ types.ContractHandler = &ContractHandler{}
 
 func NewContractHandler(
+	flowChainID flow.ChainID,
+	evmContractAddress flow.Address,
 	flowTokenAddress common.Address,
-	blockstore types.BlockStore,
+	blockStore types.BlockStore,
 	addressAllocator types.AddressAllocator,
 	backend types.Backend,
 	emulator types.Emulator,
 ) *ContractHandler {
 	return &ContractHandler{
-		flowTokenAddress: flowTokenAddress,
-		blockstore:       blockstore,
-		addressAllocator: addressAllocator,
-		backend:          backend,
-		emulator:         emulator,
-		precompiles:      getPrecompiles(addressAllocator, backend),
+		flowChainID:        flowChainID,
+		evmContractAddress: evmContractAddress,
+		flowTokenAddress:   flowTokenAddress,
+		blockStore:         blockStore,
+		addressAllocator:   addressAllocator,
+		backend:            backend,
+		emulator:           emulator,
+		precompiles:        preparePrecompiles(evmContractAddress, addressAllocator, backend),
 	}
 }
 
-func getPrecompiles(
-	addressAllocator types.AddressAllocator,
-	backend types.Backend,
-) []types.Precompile {
-	archAddress := addressAllocator.AllocatePrecompileAddress(1)
-	archContract := precompiles.ArchContract(
-		archAddress,
-		backend.GetCurrentBlockHeight,
-	)
-	return []types.Precompile{archContract}
+// DeployCOA deploys a cadence-owned-account and returns the address
+func (h *ContractHandler) DeployCOA(uuid uint64) types.Address {
+	res, err := h.deployCOA(uuid)
+	panicOnErrorOrInvalidOrFailedState(res, err)
+	return res.DeployedContractAddress
 }
 
-// AllocateAddress allocates an address to be used by the bridged accounts
-func (h *ContractHandler) AllocateAddress() types.Address {
-	target, err := h.addressAllocator.AllocateCOAAddress()
-	handleError(err)
-	return target
+func (h *ContractHandler) deployCOA(uuid uint64) (*types.Result, error) {
+	target := h.addressAllocator.AllocateCOAAddress(uuid)
+	gaslimit := types.GasLimit(coa.ContractDeploymentRequiredGas)
+	err := h.checkGasLimit(gaslimit)
+	if err != nil {
+		return nil, err
+	}
+
+	factory := h.addressAllocator.COAFactoryAddress()
+	factoryAccount := h.AccountByAddress(factory, false)
+	call := types.NewDeployCallWithTargetAddress(
+		factory,
+		target,
+		coa.ContractBytes,
+		uint64(gaslimit),
+		new(big.Int),
+		factoryAccount.Nonce(),
+	)
+
+	ctx, err := h.getBlockContext()
+	if err != nil {
+		return nil, err
+	}
+	return h.executeAndHandleCall(ctx, call, nil, false)
 }
 
 // AccountByAddress returns the account for the given address,
-// if isAuthorized is set, account is controlled by the FVM (bridged accounts)
+// if isAuthorized is set, account is controlled by the FVM (COAs)
 func (h *ContractHandler) AccountByAddress(addr types.Address, isAuthorized bool) types.Account {
 	return newAccount(h, addr, isAuthorized)
 }
 
 // LastExecutedBlock returns the last executed block
 func (h *ContractHandler) LastExecutedBlock() *types.Block {
-	block, err := h.blockstore.LatestBlock()
-	handleError(err)
+	block, err := h.blockStore.LatestBlock()
+	panicOnError(err)
 	return block
 }
 
-// Run runs an rlpencoded evm transaction and
+// RunOrPanic runs an rlpencoded evm transaction and
 // collects the gas fees and pay it to the coinbase address provided.
-func (h *ContractHandler) Run(rlpEncodedTx []byte, coinbase types.Address) {
+func (h *ContractHandler) RunOrPanic(rlpEncodedTx []byte, coinbase types.Address) {
+	res, err := h.run(rlpEncodedTx, coinbase)
+	panicOnErrorOrInvalidOrFailedState(res, err)
+}
+
+// Run tries to run an rlpencoded evm transaction and
+// collects the gas fees and pay it to the coinbase address provided.
+func (h *ContractHandler) Run(rlpEncodedTx []byte, coinbase types.Address) *types.ResultSummary {
+	res, err := h.run(rlpEncodedTx, coinbase)
+	panicOnError(err)
+	return res.ResultSummary()
+}
+
+func (h *ContractHandler) run(
+	rlpEncodedTx []byte,
+	coinbase types.Address,
+) (*types.Result, error) {
 	// step 1 - transaction decoding
 	encodedLen := uint(len(rlpEncodedTx))
 	err := h.backend.MeterComputation(environment.ComputationKindRLPDecoding, encodedLen)
-	handleError(err)
+	if err != nil {
+		return nil, err
+	}
 
 	tx := gethTypes.Transaction{}
 	err = tx.DecodeRLP(
 		rlp.NewStream(
 			bytes.NewReader(rlpEncodedTx),
 			uint64(encodedLen)))
-	handleError(err)
+	if err != nil {
+		return nil, err
+	}
 
 	// step 2 - run transaction
-	h.checkGasLimit(types.GasLimit(tx.Gas()))
+	err = h.checkGasLimit(types.GasLimit(tx.Gas()))
+	if err != nil {
+		return nil, err
+	}
 
-	ctx := h.getBlockContext()
+	ctx, err := h.getBlockContext()
+	if err != nil {
+		return nil, err
+	}
 	ctx.GasFeeCollector = coinbase
 	blk, err := h.emulator.NewBlockView(ctx)
-	handleError(err)
+	if err != nil {
+		return nil, err
+	}
 
 	res, err := blk.RunTransaction(&tx)
-	h.meterGasUsage(res)
-	handleError(err)
+	if err != nil {
+		return nil, err
+	}
+
+	// saftey check for result
+	if res == nil {
+		return nil, types.ErrUnexpectedEmptyResult
+	}
+
+	// meter gas anyway (even for invalid or failed states)
+	err = h.meterGasUsage(res)
+	if err != nil {
+		return nil, err
+	}
+
+	// if is invalid tx skip the next steps (forming block, ...)
+	if res.Invalid() {
+		return res, nil
+	}
 
 	// step 3 - update block proposal
-	bp, err := h.blockstore.BlockProposal()
-	handleError(err)
+	bp, err := h.blockStore.BlockProposal()
+	if err != nil {
+		return nil, err
+	}
+
+	bp.AppendTxHash(res.TxHash)
 
-	txHash := tx.Hash()
-	bp.AppendTxHash(txHash)
+	// Populate receipt root
+	bp.PopulateReceiptRoot([]types.Result{*res})
+
+	blockHash, err := bp.Hash()
+	if err != nil {
+		return nil, err
+	}
 
 	// step 4 - emit events
-	h.emitEvent(types.NewTransactionExecutedEvent(
+	err = h.emitEvent(types.NewTransactionExecutedEvent(
 		bp.Height,
 		rlpEncodedTx,
-		txHash,
+		blockHash,
+		res.TxHash,
 		res,
 	))
-	h.emitEvent(types.NewBlockExecutedEvent(bp))
+	if err != nil {
+		return nil, err
+	}
+
+	err = h.emitEvent(types.NewBlockExecutedEvent(bp))
+	if err != nil {
+		return nil, err
+	}
 
 	// step 5 - commit block proposal
-	err = h.blockstore.CommitBlockProposal()
-	handleError(err)
+	err = h.blockStore.CommitBlockProposal()
+	if err != nil {
+		return nil, err
+	}
+	return res, nil
 }
 
-func (h *ContractHandler) checkGasLimit(limit types.GasLimit) {
+func (h *ContractHandler) checkGasLimit(limit types.GasLimit) error {
 	// check gas limit against what has been left on the transaction side
 	if !h.backend.ComputationAvailable(environment.ComputationKindEVMGasUsage, uint(limit)) {
-		handleError(types.ErrInsufficientComputation)
+		return types.ErrInsufficientComputation
 	}
+	return nil
 }
 
-func (h *ContractHandler) meterGasUsage(res *types.Result) {
-	if res != nil {
-		err := h.backend.MeterComputation(environment.ComputationKindEVMGasUsage, uint(res.GasConsumed))
-		handleError(err)
-	}
+func (h *ContractHandler) meterGasUsage(res *types.Result) error {
+	return h.backend.MeterComputation(environment.ComputationKindEVMGasUsage, uint(res.GasConsumed))
 }
 
-func (h *ContractHandler) emitEvent(event *types.Event) {
+func (h *ContractHandler) emitEvent(event *types.Event) error {
 	ev, err := event.Payload.CadenceEvent()
-	handleError(err)
-
-	err = h.backend.EmitEvent(ev)
-	handleError(err)
+	if err != nil {
+		return err
+	}
+	return h.backend.EmitEvent(ev)
 }
 
-func (h *ContractHandler) getBlockContext() types.BlockContext {
-	bp, err := h.blockstore.BlockProposal()
-	handleError(err)
+func (h *ContractHandler) getBlockContext() (types.BlockContext, error) {
+	bp, err := h.blockStore.BlockProposal()
+	if err != nil {
+		return types.BlockContext{}, err
+	}
+	rand := gethCommon.Hash{}
+	err = h.backend.ReadRandom(rand[:])
+	if err != nil {
+		return types.BlockContext{}, err
+	}
+
 	return types.BlockContext{
+		ChainID:                types.EVMChainIDFromFlowChainID(h.flowChainID),
 		BlockNumber:            bp.Height,
+		BlockTimestamp:         bp.Timestamp,
 		DirectCallBaseGasUsage: types.DefaultDirectCallBaseGasUsage,
-		ExtraPrecompiles:       h.precompiles,
+		GetHashFunc: func(n uint64) gethCommon.Hash {
+			hash, err := h.blockStore.BlockHash(n)
+			panicOnError(err) // we have to handle it here given we can't continue with it even in try case
+			return hash
+		},
+		ExtraPrecompiles: h.precompiles,
+		Random:           rand,
+	}, nil
+}
+
+func (h *ContractHandler) executeAndHandleCall(
+	ctx types.BlockContext,
+	call *types.DirectCall,
+	totalSupplyDiff *big.Int,
+	deductSupplyDiff bool,
+) (*types.Result, error) {
+	// execute the call
+	blk, err := h.emulator.NewBlockView(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := blk.DirectCall(call)
+	// check backend errors first
+	if err != nil {
+		return nil, err
+	}
+
+	// saftey check for result
+	if res == nil {
+		return nil, types.ErrUnexpectedEmptyResult
+	}
+
+	// gas meter even invalid or failed status
+	err = h.meterGasUsage(res)
+	if err != nil {
+		return nil, err
+	}
+
+	// if is invalid skip the rest of states
+	if res.Invalid() {
+		return res, nil
+	}
+
+	// update block proposal
+	bp, err := h.blockStore.BlockProposal()
+	if err != nil {
+		return nil, err
+	}
+
+	bp.AppendTxHash(res.TxHash)
+
+	// Populate receipt root
+	bp.PopulateReceiptRoot([]types.Result{*res})
+
+	if totalSupplyDiff != nil {
+		if deductSupplyDiff {
+			bp.TotalSupply = new(big.Int).Sub(bp.TotalSupply, totalSupplyDiff)
+			if bp.TotalSupply.Sign() < 0 {
+				return nil, types.ErrInsufficientTotalSupply
+			}
+		} else {
+			bp.TotalSupply = new(big.Int).Add(bp.TotalSupply, totalSupplyDiff)
+		}
+	}
+
+	blockHash, err := bp.Hash()
+	if err != nil {
+		return nil, err
+	}
+
+	// emit events
+	encoded, err := call.Encode()
+	if err != nil {
+		return nil, err
+	}
+
+	err = h.emitEvent(
+		types.NewTransactionExecutedEvent(
+			bp.Height,
+			encoded,
+			blockHash,
+			res.TxHash,
+			res,
+		),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	err = h.emitEvent(types.NewBlockExecutedEvent(bp))
+	if err != nil {
+		return nil, err
 	}
+
+	// commit block proposal
+	err = h.blockStore.CommitBlockProposal()
+	if err != nil {
+		return nil, err
+	}
+
+	return res, nil
+}
+
+func (h *ContractHandler) GenerateResourceUUID() uint64 {
+	uuid, err := h.backend.GenerateUUID()
+	panicOnError(err)
+	return uuid
 }
 
 type Account struct {
@@ -175,186 +380,280 @@ func newAccount(fch *ContractHandler, addr types.Address, isAuthorized bool) *Ac
 	}
 }
 
-// Address returns the address associated with the bridged account
+// Address returns the address associated with the account
 func (a *Account) Address() types.Address {
 	return a.address
 }
 
-// Balance returns the balance of this bridged account
+// Nonce returns the nonce of this account
 //
-// TODO: we might need to meter computation for read only operations as well
-// currently the storage limits is enforced
+// Note: we don't meter any extra computation given reading data
+// from the storage already transalates into computation
+func (a *Account) Nonce() uint64 {
+	nonce, err := a.nonce()
+	panicOnError(err)
+	return nonce
+}
+
+func (a *Account) nonce() (uint64, error) {
+	ctx, err := a.fch.getBlockContext()
+	if err != nil {
+		return 0, err
+	}
+
+	blk, err := a.fch.emulator.NewReadOnlyBlockView(ctx)
+	if err != nil {
+		return 0, err
+	}
+
+	return blk.NonceOf(a.address)
+}
+
+// Balance returns the balance of this account
+//
+// Note: we don't meter any extra computation given reading data
+// from the storage already transalates into computation
 func (a *Account) Balance() types.Balance {
-	ctx := a.fch.getBlockContext()
+	bal, err := a.balance()
+	panicOnError(err)
+	return bal
+}
+
+func (a *Account) balance() (types.Balance, error) {
+	ctx, err := a.fch.getBlockContext()
+	if err != nil {
+		return nil, err
+	}
 
 	blk, err := a.fch.emulator.NewReadOnlyBlockView(ctx)
-	handleError(err)
+	if err != nil {
+		return nil, err
+	}
 
 	bl, err := blk.BalanceOf(a.address)
-	handleError(err)
+	return types.NewBalance(bl), err
+}
 
-	balance, err := types.NewBalanceFromAttoFlow(bl)
-	handleError(err)
-	return balance
+// Code returns the code of this account
+//
+// Note: we don't meter any extra computation given reading data
+// from the storage already transalates into computation
+func (a *Account) Code() types.Code {
+	code, err := a.code()
+	panicOnError(err)
+	return code
+}
+
+func (a *Account) code() (types.Code, error) {
+	ctx, err := a.fch.getBlockContext()
+	if err != nil {
+		return nil, err
+	}
+
+	blk, err := a.fch.emulator.NewReadOnlyBlockView(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return blk.CodeOf(a.address)
+}
+
+// CodeHash returns the code hash of this account
+//
+// Note: we don't meter any extra computation given reading data
+// from the storage already transalates into computation
+func (a *Account) CodeHash() []byte {
+	codeHash, err := a.codeHash()
+	panicOnError(err)
+	return codeHash
+}
+
+func (a *Account) codeHash() ([]byte, error) {
+	ctx, err := a.fch.getBlockContext()
+	if err != nil {
+		return nil, err
+	}
+
+	blk, err := a.fch.emulator.NewReadOnlyBlockView(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return blk.CodeHashOf(a.address)
 }
 
 // Deposit deposits the token from the given vault into the flow evm main vault
 // and update the account balance with the new amount
 func (a *Account) Deposit(v *types.FLOWTokenVault) {
-	cfg := a.fch.getBlockContext()
-	a.fch.checkGasLimit(types.GasLimit(cfg.DirectCallBaseGasUsage))
+	res, err := a.deposit(v)
+	panicOnErrorOrInvalidOrFailedState(res, err)
+}
+
+func (a *Account) deposit(v *types.FLOWTokenVault) (*types.Result, error) {
+	bridge := a.fch.addressAllocator.NativeTokenBridgeAddress()
+	bridgeAccount := a.fch.AccountByAddress(bridge, false)
 
 	call := types.NewDepositCall(
+		bridge,
 		a.address,
-		v.Balance().ToAttoFlow(),
+		v.Balance(),
+		bridgeAccount.Nonce(),
 	)
-	a.executeAndHandleCall(a.fch.getBlockContext(), call, v.Balance().ToAttoFlow(), false)
+	ctx, err := a.precheck(false, types.GasLimit(call.GasLimit))
+	if err != nil {
+		return nil, err
+	}
+
+	return a.fch.executeAndHandleCall(ctx, call, v.Balance(), false)
 }
 
 // Withdraw deducts the balance from the account and
 // withdraw and return flow token from the Flex main vault.
 func (a *Account) Withdraw(b types.Balance) *types.FLOWTokenVault {
-	a.checkAuthorized()
-
-	cfg := a.fch.getBlockContext()
-	a.fch.checkGasLimit(types.GasLimit(cfg.DirectCallBaseGasUsage))
+	res, err := a.withdraw(b)
+	panicOnErrorOrInvalidOrFailedState(res, err)
 
-	// check balance of flex vault
-	bp, err := a.fch.blockstore.BlockProposal()
-	handleError(err)
-	// b > total supply
-	if b.ToAttoFlow().Cmp(bp.TotalSupply) == 1 {
-		handleError(types.ErrInsufficientTotalSupply)
-	}
+	return types.NewFlowTokenVault(b)
+}
 
+func (a *Account) withdraw(b types.Balance) (*types.Result, error) {
 	call := types.NewWithdrawCall(
+		a.fch.addressAllocator.NativeTokenBridgeAddress(),
 		a.address,
-		b.ToAttoFlow(),
+		b,
+		a.Nonce(),
 	)
-	a.executeAndHandleCall(a.fch.getBlockContext(), call, b.ToAttoFlow(), true)
 
-	return types.NewFlowTokenVault(b)
+	ctx, err := a.precheck(true, types.GasLimit(call.GasLimit))
+	if err != nil {
+		return nil, err
+	}
+
+	// Don't allow withdraw for balances that has rounding error
+	if types.BalanceConvertionToUFix64ProneToRoundingError(b) {
+		return nil, types.ErrWithdrawBalanceRounding
+	}
+
+	return a.fch.executeAndHandleCall(ctx, call, b, true)
 }
 
 // Transfer transfers tokens between accounts
 func (a *Account) Transfer(to types.Address, balance types.Balance) {
-	a.checkAuthorized()
-
-	ctx := a.fch.getBlockContext()
-	a.fch.checkGasLimit(types.GasLimit(ctx.DirectCallBaseGasUsage))
+	res, err := a.transfer(to, balance)
+	panicOnErrorOrInvalidOrFailedState(res, err)
+}
 
+func (a *Account) transfer(to types.Address, balance types.Balance) (*types.Result, error) {
 	call := types.NewTransferCall(
 		a.address,
 		to,
-		balance.ToAttoFlow(),
+		balance,
+		a.Nonce(),
 	)
-	a.executeAndHandleCall(ctx, call, nil, false)
+	ctx, err := a.precheck(true, types.GasLimit(call.GasLimit))
+	if err != nil {
+		return nil, err
+	}
+
+	return a.fch.executeAndHandleCall(ctx, call, nil, false)
 }
 
 // Deploy deploys a contract to the EVM environment
 // the new deployed contract would be at the returned address and
 // the contract data is not controlled by the caller accounts
 func (a *Account) Deploy(code types.Code, gaslimit types.GasLimit, balance types.Balance) types.Address {
-	a.checkAuthorized()
-	a.fch.checkGasLimit(gaslimit)
+	res, err := a.deploy(code, gaslimit, balance)
+	panicOnErrorOrInvalidOrFailedState(res, err)
+	return types.Address(res.DeployedContractAddress)
+}
+
+func (a *Account) deploy(code types.Code, gaslimit types.GasLimit, balance types.Balance) (*types.Result, error) {
+	ctx, err := a.precheck(true, gaslimit)
+	if err != nil {
+		return nil, err
+	}
 
 	call := types.NewDeployCall(
 		a.address,
 		code,
 		uint64(gaslimit),
-		balance.ToAttoFlow(),
+		balance,
+		a.Nonce(),
 	)
-	res := a.executeAndHandleCall(a.fch.getBlockContext(), call, nil, false)
-	return types.Address(res.DeployedContractAddress)
+	return a.fch.executeAndHandleCall(ctx, call, nil, false)
 }
 
 // Call calls a smart contract function with the given data
 // it would limit the gas used according to the limit provided
 // given it doesn't goes beyond what Flow transaction allows.
 // the balance would be deducted from the OFA account and would be transferred to the target address
-func (a *Account) Call(to types.Address, data types.Data, gaslimit types.GasLimit, balance types.Balance) types.Data {
-	a.checkAuthorized()
-	a.fch.checkGasLimit(gaslimit)
+func (a *Account) Call(to types.Address, data types.Data, gaslimit types.GasLimit, balance types.Balance) *types.ResultSummary {
+	res, err := a.call(to, data, gaslimit, balance)
+	panicOnError(err)
+	return res.ResultSummary()
+}
+
+func (a *Account) call(to types.Address, data types.Data, gaslimit types.GasLimit, balance types.Balance) (*types.Result, error) {
+	ctx, err := a.precheck(true, gaslimit)
+	if err != nil {
+		return nil, err
+	}
 	call := types.NewContractCall(
 		a.address,
 		to,
 		data,
 		uint64(gaslimit),
-		balance.ToAttoFlow(),
+		balance,
+		a.Nonce(),
 	)
-	res := a.executeAndHandleCall(a.fch.getBlockContext(), call, nil, false)
-	return res.ReturnedValue
-}
-
-func (a *Account) executeAndHandleCall(
-	ctx types.BlockContext,
-	call *types.DirectCall,
-	totalSupplyDiff *big.Int,
-	deductSupplyDiff bool,
-) *types.Result {
-	// execute the call
-	blk, err := a.fch.emulator.NewBlockView(ctx)
-	handleError(err)
 
-	res, err := blk.DirectCall(call)
-	a.fch.meterGasUsage(res)
-	handleError(err)
+	return a.fch.executeAndHandleCall(ctx, call, nil, false)
+}
 
-	// update block proposal
-	callHash, err := call.Hash()
-	if err != nil {
-		err = types.NewFatalError(err)
-		handleError(err)
+func (a *Account) precheck(authroized bool, gaslimit types.GasLimit) (types.BlockContext, error) {
+	// check if account is authorized (i.e. is a COA)
+	if authroized && !a.isAuthorized {
+		return types.BlockContext{}, types.ErrUnAuthroizedMethodCall
 	}
-
-	bp, err := a.fch.blockstore.BlockProposal()
-	handleError(err)
-	bp.AppendTxHash(callHash)
-	if totalSupplyDiff != nil {
-		if deductSupplyDiff {
-			bp.TotalSupply = new(big.Int).Sub(bp.TotalSupply, totalSupplyDiff)
-		} else {
-			bp.TotalSupply = new(big.Int).Add(bp.TotalSupply, totalSupplyDiff)
-		}
-
+	err := a.fch.checkGasLimit(gaslimit)
+	if err != nil {
+		return types.BlockContext{}, err
 	}
 
-	// emit events
-	encoded, err := call.Encode()
-	handleError(err)
+	return a.fch.getBlockContext()
+}
 
-	a.fch.emitEvent(
-		types.NewTransactionExecutedEvent(
-			bp.Height,
-			encoded,
-			callHash,
-			res,
-		),
-	)
-	a.fch.emitEvent(types.NewBlockExecutedEvent(bp))
+func panicOnErrorOrInvalidOrFailedState(res *types.Result, err error) {
 
-	// commit block proposal
-	err = a.fch.blockstore.CommitBlockProposal()
-	handleError(err)
+	if res != nil && res.Invalid() {
+		panic(fvmErrors.NewEVMError(res.ValidationError))
+	}
 
-	return res
-}
+	if res != nil && res.Failed() {
+		panic(fvmErrors.NewEVMError(res.VMError))
+	}
 
-func (a *Account) checkAuthorized() {
-	// check if account is authorized (i.e. is a bridged account)
-	if !a.isAuthorized {
-		handleError(types.ErrUnAuthroizedMethodCall)
+	// this should never happen
+	if err == nil && res == nil {
+		panic(fvmErrors.NewEVMError(types.ErrUnexpectedEmptyResult))
 	}
+
+	panicOnError(err)
 }
 
-func handleError(err error) {
+// panicOnError errors panic on returned errors
+func panicOnError(err error) {
 	if err == nil {
 		return
 	}
 
 	if types.IsAFatalError(err) {
-		// don't wrap it
+		panic(fvmErrors.NewEVMFailure(err))
+	}
+
+	if types.IsABackendError(err) {
+		// backend errors doesn't need wrapping
 		panic(err)
 	}
-	panic(errors.NewEVMError(err))
+
+	// any other returned errors are non-fatal errors
+	panic(fvmErrors.NewEVMError(err))
 }
diff --git a/fvm/evm/handler/handler_benchmark_test.go b/fvm/evm/handler/handler_benchmark_test.go
index 6165b26c29d..8c7ff388706 100644
--- a/fvm/evm/handler/handler_benchmark_test.go
+++ b/fvm/evm/handler/handler_benchmark_test.go
@@ -26,8 +26,8 @@ func benchmarkStorageGrowth(b *testing.B, accountCount, setupKittyCount int) {
 					// setup several of accounts
 					// note that trie growth is the function of number of accounts
 					for i := 0; i < accountCount; i++ {
-						account := handler.AccountByAddress(handler.AllocateAddress(), true)
-						account.Deposit(types.NewFlowTokenVault(types.Balance(100)))
+						account := handler.AccountByAddress(handler.DeployCOA(uint64(i+1)), true)
+						account.Deposit(types.NewFlowTokenVault(types.NewBalanceFromUFix64(100)))
 						accounts[i] = account
 					}
 					backend.DropEvents()
@@ -49,7 +49,7 @@ func benchmarkStorageGrowth(b *testing.B, accountCount, setupKittyCount int) {
 								genes,
 							),
 							300_000_000,
-							types.Balance(0),
+							types.NewBalanceFromUFix64(0),
 						)
 						require.Equal(b, 2, len(backend.Events()))
 						backend.DropEvents() // this would make things lighter
@@ -66,7 +66,7 @@ func benchmarkStorageGrowth(b *testing.B, accountCount, setupKittyCount int) {
 							testutils.RandomBigInt(1000),
 						),
 						300_000_000,
-						types.Balance(0),
+						types.NewBalanceFromUFix64(0),
 					)
 
 					b.ReportMetric(float64(backend.TotalBytesRead()), "bytes_read")
diff --git a/fvm/evm/handler/handler_test.go b/fvm/evm/handler/handler_test.go
index 2d374ef231f..ccbc1ae2d86 100644
--- a/fvm/evm/handler/handler_test.go
+++ b/fvm/evm/handler/handler_test.go
@@ -9,21 +9,21 @@ import (
 	"testing"
 
 	"github.com/onflow/cadence"
-
 	jsoncdc "github.com/onflow/cadence/encoding/json"
-
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	gethParams "github.com/ethereum/go-ethereum/params"
-	"github.com/ethereum/go-ethereum/rlp"
+	"github.com/onflow/cadence/runtime/common"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethCore "github.com/onflow/go-ethereum/core"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethVM "github.com/onflow/go-ethereum/core/vm"
+	gethParams "github.com/onflow/go-ethereum/params"
+	"github.com/onflow/go-ethereum/rlp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/onflow/cadence/runtime/common"
-
 	"github.com/onflow/flow-go/fvm/errors"
 	"github.com/onflow/flow-go/fvm/evm/emulator"
 	"github.com/onflow/flow-go/fvm/evm/handler"
+	"github.com/onflow/flow-go/fvm/evm/handler/coa"
 	"github.com/onflow/flow-go/fvm/evm/precompiles"
 	"github.com/onflow/flow-go/fvm/evm/testutils"
 	"github.com/onflow/flow-go/fvm/evm/types"
@@ -35,21 +35,19 @@ import (
 
 var flowTokenAddress = common.MustBytesToAddress(systemcontracts.SystemContractsForChain(flow.Emulator).FlowToken.Address.Bytes())
 
-func TestHandler_TransactionRun(t *testing.T) {
+func TestHandler_TransactionRunOrPanic(t *testing.T) {
 	t.Parallel()
 
-	t.Run("test - transaction run (happy case)", func(t *testing.T) {
+	t.Run("test RunOrPanic run (happy case)", func(t *testing.T) {
 		t.Parallel()
 
 		testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
 			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
 				testutils.RunWithEOATestAccount(t, backend, rootAddr, func(eoa *testutils.EOATestAccount) {
 
-					bs, err := handler.NewBlockStore(backend, rootAddr)
-					require.NoError(t, err)
+					bs := handler.NewBlockStore(backend, rootAddr)
 
-					aa, err := handler.NewAddressAllocator(backend, rootAddr)
-					require.NoError(t, err)
+					aa := handler.NewAddressAllocator()
 
 					result := &types.Result{
 						DeployedContractAddress: types.Address(testutils.RandomAddress(t)),
@@ -66,7 +64,7 @@ func TestHandler_TransactionRun(t *testing.T) {
 							return result, nil
 						},
 					}
-					handler := handler.NewContractHandler(flowTokenAddress, bs, aa, backend, em)
+					handler := handler.NewContractHandler(flow.Emulator, rootAddr, flowTokenAddress, bs, aa, backend, em)
 
 					coinbase := types.NewAddress(gethCommon.Address{})
 
@@ -79,8 +77,14 @@ func TestHandler_TransactionRun(t *testing.T) {
 						big.NewInt(1),
 					)
 
+					// calculate tx id to match it
+					var evmTx gethTypes.Transaction
+					err := evmTx.UnmarshalBinary(tx)
+					require.NoError(t, err)
+					result.TxHash = evmTx.Hash()
+
 					// successfully run (no-panic)
-					handler.Run(tx, coinbase)
+					handler.RunOrPanic(tx, coinbase)
 
 					// check gas usage
 					// TODO: uncomment and investigate me
@@ -119,32 +123,47 @@ func TestHandler_TransactionRun(t *testing.T) {
 					// check block event
 					event = events[1]
 					assert.Equal(t, event.Type, types.EventTypeBlockExecuted)
-					_, err = jsoncdc.Decode(nil, event.Payload)
+					ev, err = jsoncdc.Decode(nil, event.Payload)
+					require.NoError(t, err)
+
+					// make sure block transaction list references the above transaction id
+					cadenceEvent, ok = ev.(cadence.Event)
+					require.True(t, ok)
+
+					for j, f := range cadenceEvent.GetFields() {
+						if f.Identifier == "transactionHashes" {
+							txsRaw := cadenceEvent.GetFieldValues()[j]
+							txs, ok := txsRaw.(cadence.Array)
+							require.True(t, ok)
+							// we know there's only one tx for now in block
+							eventTxID := txs.Values[0].ToGoValue().(string)
+							// make sure the transaction id included in the block transaction list is the same as tx sumbmitted
+							assert.Equal(t, evmTx.Hash().String(), eventTxID)
+						}
+					}
+
 					require.NoError(t, err)
 				})
 			})
 		})
 	})
 
-	t.Run("test - transaction run (unhappy cases)", func(t *testing.T) {
+	t.Run("test RunOrPanic (unhappy non-fatal cases)", func(t *testing.T) {
 		t.Parallel()
 
 		testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
 			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
 				testutils.RunWithEOATestAccount(t, backend, rootAddr, func(eoa *testutils.EOATestAccount) {
-
-					bs, err := handler.NewBlockStore(backend, rootAddr)
-					require.NoError(t, err)
-
-					aa, err := handler.NewAddressAllocator(backend, rootAddr)
-					require.NoError(t, err)
-
+					bs := handler.NewBlockStore(backend, rootAddr)
+					aa := handler.NewAddressAllocator()
 					em := &testutils.TestEmulator{
 						RunTransactionFunc: func(tx *gethTypes.Transaction) (*types.Result, error) {
-							return &types.Result{}, types.NewEVMExecutionError(fmt.Errorf("some sort of error"))
+							return &types.Result{
+								ValidationError: fmt.Errorf("some sort of validation error"),
+							}, nil
 						},
 					}
-					handler := handler.NewContractHandler(flowTokenAddress, bs, aa, backend, em)
+					handler := handler.NewContractHandler(flow.Testnet, rootAddr, flowTokenAddress, bs, aa, backend, em)
 
 					coinbase := types.NewAddress(gethCommon.Address{})
 
@@ -152,7 +171,7 @@ func TestHandler_TransactionRun(t *testing.T) {
 					assertPanic(t, isNotFatal, func() {
 						// invalid RLP encoding
 						invalidTx := "badencoding"
-						handler.Run([]byte(invalidTx), coinbase)
+						handler.RunOrPanic([]byte(invalidTx), coinbase)
 					})
 
 					// test gas limit (non fatal)
@@ -167,28 +186,59 @@ func TestHandler_TransactionRun(t *testing.T) {
 							big.NewInt(1),
 						)
 
-						handler.Run([]byte(tx), coinbase)
+						handler.RunOrPanic([]byte(tx), coinbase)
 					})
 
-					// tx execution failure
-					tx := eoa.PrepareSignAndEncodeTx(
-						t,
-						gethCommon.Address{},
-						nil,
-						nil,
-						100_000,
-						big.NewInt(1),
-					)
-
+					// tx validation error
 					assertPanic(t, isNotFatal, func() {
-						handler.Run([]byte(tx), coinbase)
+						// tx execution failure
+						tx := eoa.PrepareSignAndEncodeTx(
+							t,
+							gethCommon.Address{},
+							nil,
+							nil,
+							100_000,
+							big.NewInt(1),
+						)
+
+						handler.RunOrPanic([]byte(tx), coinbase)
+					})
+				})
+			})
+		})
+
+		t.Run("test RunOrPanic (fatal cases)", func(t *testing.T) {
+			t.Parallel()
+
+			testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
+				testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
+					testutils.RunWithEOATestAccount(t, backend, rootAddr, func(eoa *testutils.EOATestAccount) {
+						bs := handler.NewBlockStore(backend, rootAddr)
+						aa := handler.NewAddressAllocator()
+						em := &testutils.TestEmulator{
+							RunTransactionFunc: func(tx *gethTypes.Transaction) (*types.Result, error) {
+								return &types.Result{}, types.NewFatalError(fmt.Errorf("Fatal error"))
+							},
+						}
+						handler := handler.NewContractHandler(flow.Testnet, rootAddr, flowTokenAddress, bs, aa, backend, em)
+						assertPanic(t, errors.IsFailure, func() {
+							tx := eoa.PrepareSignAndEncodeTx(
+								t,
+								gethCommon.Address{},
+								nil,
+								nil,
+								100_000,
+								big.NewInt(1),
+							)
+							handler.RunOrPanic([]byte(tx), types.NewAddress(gethCommon.Address{}))
+						})
 					})
 				})
 			})
 		})
 	})
 
-	t.Run("test running transaction (with integrated emulator)", func(t *testing.T) {
+	t.Run("test RunOrPanic (with integrated emulator)", func(t *testing.T) {
 		t.Parallel()
 
 		testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
@@ -198,44 +248,45 @@ func TestHandler_TransactionRun(t *testing.T) {
 				eoa := testutils.GetTestEOAAccount(t, testutils.EOATestAccount1KeyHex)
 
 				// deposit 1 Flow to the foa account
-				addr := handler.AllocateAddress()
-				orgBalance, err := types.NewBalanceFromAttoFlow(types.OneFlowInAttoFlow)
-				require.NoError(t, err)
+				addr := handler.DeployCOA(1)
+				orgBalance := types.NewBalanceFromUFix64(types.OneFlowInUFix64)
 				vault := types.NewFlowTokenVault(orgBalance)
 				foa := handler.AccountByAddress(addr, true)
 				foa.Deposit(vault)
 
 				// transfer 0.1 flow to the non-foa address
-				deduction, err := types.NewBalanceFromAttoFlow(big.NewInt(1e17))
-				require.NoError(t, err)
+				deduction := types.NewBalance(big.NewInt(1e17))
 				foa.Call(eoa.Address(), nil, 400000, deduction)
-				require.Equal(t, orgBalance.Sub(deduction), foa.Balance())
+				expected, err := types.SubBalance(orgBalance, deduction)
+				require.NoError(t, err)
+				require.Equal(t, expected, foa.Balance())
 
 				// transfer 0.01 flow back to the foa through
-				addition, err := types.NewBalanceFromAttoFlow(big.NewInt(1e16))
-				require.NoError(t, err)
+				addition := types.NewBalance(big.NewInt(1e16))
 
 				tx := eoa.PrepareSignAndEncodeTx(
 					t,
 					foa.Address().ToCommon(),
 					nil,
-					addition.ToAttoFlow(),
+					addition,
 					gethParams.TxGas*10,
 					big.NewInt(1e8), // high gas fee to test coinbase collection,
 				)
 
 				// setup coinbase
-				foa2 := handler.AllocateAddress()
+				foa2 := handler.DeployCOA(2)
 				account2 := handler.AccountByAddress(foa2, true)
-				require.Equal(t, types.Balance(0), account2.Balance())
+				require.Equal(t, types.NewBalanceFromUFix64(0), account2.Balance())
 
 				// no panic means success here
-				handler.Run(tx, account2.Address())
-				require.Equal(t, orgBalance.Sub(deduction).Add(addition), foa.Balance())
-
-				// fees has been collected to the coinbase
-				require.NotEqual(t, types.Balance(0), account2.Balance())
+				handler.RunOrPanic(tx, account2.Address())
+				expected, err = types.SubBalance(orgBalance, deduction)
+				require.NoError(t, err)
+				expected, err = types.AddBalance(expected, addition)
+				require.NoError(t, err)
+				require.Equal(t, expected, foa.Balance())
 
+				require.NotEqual(t, types.NewBalanceFromUFix64(0), account2.Balance())
 			})
 		})
 	})
@@ -258,8 +309,7 @@ func TestHandler_OpsWithoutEmulator(t *testing.T) {
 				// do some changes
 				address := testutils.RandomAddress(t)
 				account := handler.AccountByAddress(address, true)
-				bal, err := types.NewBalanceFromAttoFlow(types.OneFlowInAttoFlow)
-				require.NoError(t, err)
+				bal := types.OneFlowBalance
 				account.Deposit(types.NewFlowTokenVault(bal))
 
 				// check if block height has been incremented
@@ -274,83 +324,127 @@ func TestHandler_OpsWithoutEmulator(t *testing.T) {
 
 		testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
 			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
-				blockchain, err := handler.NewBlockStore(backend, rootAddr)
-				require.NoError(t, err)
-
-				aa, err := handler.NewAddressAllocator(backend, rootAddr)
-				require.NoError(t, err)
-
-				h := handler.NewContractHandler(flowTokenAddress, blockchain, aa, backend, nil)
+				h := SetupHandler(t, backend, rootAddr)
 
-				foa := h.AllocateAddress()
-				require.NotNil(t, foa)
+				coa := h.DeployCOA(12)
+				require.NotNil(t, coa)
 
-				expectedAddress := handler.MakeCOAAddress(1)
-				require.Equal(t, expectedAddress, foa)
+				expectedAddress := handler.MakeCOAAddress(12)
+				require.Equal(t, expectedAddress, coa)
 			})
 		})
 	})
 }
 
-func TestHandler_BridgedAccount(t *testing.T) {
-
+func TestHandler_COA(t *testing.T) {
+	t.Parallel()
 	t.Run("test deposit/withdraw (with integrated emulator)", func(t *testing.T) {
-		t.Parallel()
-
 		testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
 			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
 				handler := SetupHandler(t, backend, rootAddr)
 
-				foa := handler.AccountByAddress(handler.AllocateAddress(), true)
+				foa := handler.AccountByAddress(handler.DeployCOA(1), true)
 				require.NotNil(t, foa)
 
-				zeroBalance, err := types.NewBalanceFromAttoFlow(big.NewInt(0))
-				require.NoError(t, err)
+				zeroBalance := types.NewBalance(big.NewInt(0))
 				require.Equal(t, zeroBalance, foa.Balance())
 
-				balance, err := types.NewBalanceFromAttoFlow(types.OneFlowInAttoFlow)
-				require.NoError(t, err)
+				balance := types.OneFlowBalance
 				vault := types.NewFlowTokenVault(balance)
 
 				foa.Deposit(vault)
-				require.NoError(t, err)
 				require.Equal(t, balance, foa.Balance())
 
 				v := foa.Withdraw(balance)
-				require.NoError(t, err)
 				require.Equal(t, balance, v.Balance())
 
-				require.NoError(t, err)
 				require.Equal(t, zeroBalance, foa.Balance())
 
 				events := backend.Events()
-				require.Len(t, events, 4)
+				require.Len(t, events, 6)
+
+				// first two transactions are for COA setup
 
 				// transaction event
-				event := events[0]
+				event := events[2]
 				assert.Equal(t, event.Type, types.EventTypeTransactionExecuted)
 
 				// block event
-				event = events[1]
+				event = events[3]
 				assert.Equal(t, event.Type, types.EventTypeBlockExecuted)
 
 				// transaction event
-				event = events[2]
+				event = events[4]
 				assert.Equal(t, event.Type, types.EventTypeTransactionExecuted)
-				_, err = jsoncdc.Decode(nil, event.Payload)
+				_, err := jsoncdc.Decode(nil, event.Payload)
 				require.NoError(t, err)
 				// TODO: decode encoded tx and check for the amount and value
 				// assert.Equal(t, foa.Address(), ret.Address)
 				// assert.Equal(t, balance, ret.Amount)
 
 				// block event
-				event = events[3]
+				event = events[5]
 				assert.Equal(t, event.Type, types.EventTypeBlockExecuted)
 
 				// check gas usage
 				computationUsed, err := backend.ComputationUsed()
 				require.NoError(t, err)
-				require.Equal(t, types.DefaultDirectCallBaseGasUsage*2, computationUsed)
+				require.Greater(t, computationUsed, types.DefaultDirectCallBaseGasUsage*3)
+
+				// Withdraw with invalid balance
+				assertPanic(t, types.IsWithdrawBalanceRoundingError, func() {
+					// deposit some money
+					foa.Deposit(vault)
+					// then withdraw invalid balance
+					foa.Withdraw(types.NewBalance(big.NewInt(1)))
+				})
+			})
+		})
+	})
+
+	t.Run("test coa deployment", func(t *testing.T) {
+		testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
+			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
+				h := SetupHandler(t, backend, rootAddr)
+
+				coa1 := h.DeployCOA(1)
+				acc := h.AccountByAddress(coa1, true)
+				require.NotEmpty(t, acc.Code())
+
+				// make a second account with some money
+				coa2 := h.DeployCOA(2)
+				acc2 := h.AccountByAddress(coa2, true)
+				acc2.Deposit(types.NewFlowTokenVault(types.MakeABalanceInFlow(100)))
+
+				// transfer money to COA
+				acc2.Transfer(
+					coa1,
+					types.MakeABalanceInFlow(1),
+				)
+
+				// make a call to the contract
+				ret := acc2.Call(
+					coa1,
+					testutils.MakeCallData(t,
+						coa.ContractABIJSON,
+						"onERC721Received",
+						gethCommon.Address{1},
+						gethCommon.Address{1},
+						big.NewInt(0),
+						[]byte{'A'},
+					),
+					types.GasLimit(3_000_000),
+					types.EmptyBalance)
+
+				// 0x150b7a02
+				expected := types.Data([]byte{
+					21, 11, 122, 2, 0, 0, 0, 0,
+					0, 0, 0, 0, 0, 0, 0, 0,
+					0, 0, 0, 0, 0, 0, 0, 0,
+					0, 0, 0, 0, 0, 0, 0, 0,
+				})
+				require.Equal(t, types.StatusSuccessful, ret.Status)
+				require.Equal(t, expected, ret.ReturnedValue)
 			})
 		})
 	})
@@ -359,62 +453,72 @@ func TestHandler_BridgedAccount(t *testing.T) {
 		testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
 			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
 				testutils.RunWithEOATestAccount(t, backend, rootAddr, func(eoa *testutils.EOATestAccount) {
-					bs, err := handler.NewBlockStore(backend, rootAddr)
-					require.NoError(t, err)
-
-					aa, err := handler.NewAddressAllocator(backend, rootAddr)
-					require.NoError(t, err)
+					bs := handler.NewBlockStore(backend, rootAddr)
+					aa := handler.NewAddressAllocator()
 
 					// Withdraw calls are only possible within FOA accounts
 					assertPanic(t, types.IsAUnAuthroizedMethodCallError, func() {
-						em := &testutils.TestEmulator{}
+						em := &testutils.TestEmulator{
+							NonceOfFunc: func(address types.Address) (uint64, error) {
+								return 0, nil
+							},
+						}
 
-						handler := handler.NewContractHandler(flowTokenAddress, bs, aa, backend, em)
+						handler := handler.NewContractHandler(flow.Testnet, rootAddr, flowTokenAddress, bs, aa, backend, em)
 
 						account := handler.AccountByAddress(testutils.RandomAddress(t), false)
-						account.Withdraw(types.Balance(1))
+						account.Withdraw(types.NewBalanceFromUFix64(1))
 					})
 
-					// test insufficient total supply
+					// test insufficient total supply error
 					assertPanic(t, types.IsAInsufficientTotalSupplyError, func() {
 						em := &testutils.TestEmulator{
+							NonceOfFunc: func(address types.Address) (uint64, error) {
+								return 0, nil
+							},
 							DirectCallFunc: func(call *types.DirectCall) (*types.Result, error) {
-								return &types.Result{}, types.NewEVMExecutionError(fmt.Errorf("some sort of error"))
+								return &types.Result{}, nil
 							},
 						}
 
-						handler := handler.NewContractHandler(flowTokenAddress, bs, aa, backend, em)
+						handler := handler.NewContractHandler(flow.Testnet, rootAddr, flowTokenAddress, bs, aa, backend, em)
 						account := handler.AccountByAddress(testutils.RandomAddress(t), true)
 
-						account.Withdraw(types.Balance(1))
+						account.Withdraw(types.NewBalanceFromUFix64(1))
 					})
 
 					// test non fatal error of emulator
-					assertPanic(t, types.IsEVMExecutionError, func() {
+					assertPanic(t, isNotFatal, func() {
 						em := &testutils.TestEmulator{
+							NonceOfFunc: func(address types.Address) (uint64, error) {
+								return 0, nil
+							},
 							DirectCallFunc: func(call *types.DirectCall) (*types.Result, error) {
-								return &types.Result{}, types.NewEVMExecutionError(fmt.Errorf("some sort of error"))
+								return &types.Result{}, fmt.Errorf("some sort of error")
 							},
 						}
 
-						handler := handler.NewContractHandler(flowTokenAddress, bs, aa, backend, em)
+						handler := handler.NewContractHandler(flow.Testnet, rootAddr, flowTokenAddress, bs, aa, backend, em)
 						account := handler.AccountByAddress(testutils.RandomAddress(t), true)
 
-						account.Withdraw(types.Balance(0))
+						account.Withdraw(types.NewBalanceFromUFix64(0))
 					})
 
 					// test fatal error of emulator
 					assertPanic(t, types.IsAFatalError, func() {
 						em := &testutils.TestEmulator{
+							NonceOfFunc: func(address types.Address) (uint64, error) {
+								return 0, nil
+							},
 							DirectCallFunc: func(call *types.DirectCall) (*types.Result, error) {
 								return &types.Result{}, types.NewFatalError(fmt.Errorf("some sort of fatal error"))
 							},
 						}
 
-						handler := handler.NewContractHandler(flowTokenAddress, bs, aa, backend, em)
+						handler := handler.NewContractHandler(flow.Testnet, rootAddr, flowTokenAddress, bs, aa, backend, em)
 						account := handler.AccountByAddress(testutils.RandomAddress(t), true)
 
-						account.Withdraw(types.Balance(0))
+						account.Withdraw(types.NewBalanceFromUFix64(0))
 					})
 				})
 			})
@@ -427,38 +531,41 @@ func TestHandler_BridgedAccount(t *testing.T) {
 		testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
 			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
 				testutils.RunWithEOATestAccount(t, backend, rootAddr, func(eoa *testutils.EOATestAccount) {
-					bs, err := handler.NewBlockStore(backend, rootAddr)
-					require.NoError(t, err)
-
-					aa, err := handler.NewAddressAllocator(backend, rootAddr)
-					require.NoError(t, err)
+					bs := handler.NewBlockStore(backend, rootAddr)
+					aa := handler.NewAddressAllocator()
 
 					// test non fatal error of emulator
-					assertPanic(t, types.IsEVMExecutionError, func() {
+					assertPanic(t, isNotFatal, func() {
 						em := &testutils.TestEmulator{
+							NonceOfFunc: func(address types.Address) (uint64, error) {
+								return 0, nil
+							},
 							DirectCallFunc: func(call *types.DirectCall) (*types.Result, error) {
-								return &types.Result{}, types.NewEVMExecutionError(fmt.Errorf("some sort of error"))
+								return &types.Result{}, fmt.Errorf("some sort of error")
 							},
 						}
 
-						handler := handler.NewContractHandler(flowTokenAddress, bs, aa, backend, em)
+						handler := handler.NewContractHandler(flow.Testnet, rootAddr, flowTokenAddress, bs, aa, backend, em)
 						account := handler.AccountByAddress(testutils.RandomAddress(t), true)
 
-						account.Deposit(types.NewFlowTokenVault(1))
+						account.Deposit(types.NewFlowTokenVault(types.NewBalanceFromUFix64(1)))
 					})
 
 					// test fatal error of emulator
 					assertPanic(t, types.IsAFatalError, func() {
 						em := &testutils.TestEmulator{
+							NonceOfFunc: func(address types.Address) (uint64, error) {
+								return 0, nil
+							},
 							DirectCallFunc: func(call *types.DirectCall) (*types.Result, error) {
 								return &types.Result{}, types.NewFatalError(fmt.Errorf("some sort of fatal error"))
 							},
 						}
 
-						handler := handler.NewContractHandler(flowTokenAddress, bs, aa, backend, em)
+						handler := handler.NewContractHandler(flow.Testnet, rootAddr, flowTokenAddress, bs, aa, backend, em)
 						account := handler.AccountByAddress(testutils.RandomAddress(t), true)
 
-						account.Deposit(types.NewFlowTokenVault(1))
+						account.Deposit(types.NewFlowTokenVault(types.NewBalanceFromUFix64(1)))
 					})
 				})
 			})
@@ -473,32 +580,33 @@ func TestHandler_BridgedAccount(t *testing.T) {
 			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
 				handler := SetupHandler(t, backend, rootAddr)
 
-				foa := handler.AccountByAddress(handler.AllocateAddress(), true)
+				foa := handler.AccountByAddress(handler.DeployCOA(1), true)
 				require.NotNil(t, foa)
 
 				// deposit 10000 flow
-				vault := types.NewFlowTokenVault(testutils.MakeABalanceInFlow(10000))
+				bal := types.MakeABalanceInFlow(10000)
+				vault := types.NewFlowTokenVault(bal)
 				foa.Deposit(vault)
+				require.Equal(t, bal, foa.Balance())
 
 				testContract := testutils.GetStorageTestContract(t)
-				addr := foa.Deploy(testContract.ByteCode, math.MaxUint64, types.Balance(0))
+				addr := foa.Deploy(testContract.ByteCode, math.MaxUint64, types.NewBalanceFromUFix64(0))
 				require.NotNil(t, addr)
 
 				num := big.NewInt(22)
-
 				_ = foa.Call(
 					addr,
 					testContract.MakeCallData(t, "store", num),
 					math.MaxUint64,
-					types.Balance(0))
+					types.NewBalanceFromUFix64(0))
 
-				ret := foa.Call(
+				res := foa.Call(
 					addr,
 					testContract.MakeCallData(t, "retrieve"),
 					math.MaxUint64,
-					types.Balance(0))
+					types.NewBalanceFromUFix64(0))
 
-				require.Equal(t, num, new(big.Int).SetBytes(ret))
+				require.Equal(t, num, new(big.Int).SetBytes(res.ReturnedValue))
 			})
 		})
 	})
@@ -514,16 +622,49 @@ func TestHandler_BridgedAccount(t *testing.T) {
 			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
 				h := SetupHandler(t, backend, rootAddr)
 
-				foa := h.AccountByAddress(h.AllocateAddress(), true)
+				foa := h.AccountByAddress(h.DeployCOA(1), true)
 				require.NotNil(t, foa)
 
-				vault := types.NewFlowTokenVault(testutils.MakeABalanceInFlow(10000))
+				vault := types.NewFlowTokenVault(types.MakeABalanceInFlow(10000))
 				foa.Deposit(vault)
 
 				arch := handler.MakePrecompileAddress(1)
 
-				ret := foa.Call(arch, precompiles.FlowBlockHeightFuncSig[:], math.MaxUint64, types.Balance(0))
-				require.Equal(t, big.NewInt(int64(blockHeight)), new(big.Int).SetBytes(ret))
+				ret := foa.Call(arch, precompiles.FlowBlockHeightFuncSig[:], math.MaxUint64, types.NewBalanceFromUFix64(0))
+				require.Equal(t, big.NewInt(int64(blockHeight)), new(big.Int).SetBytes(ret.ReturnedValue))
+			})
+		})
+	})
+
+	t.Run("test block.random call (with integrated emulator)", func(t *testing.T) {
+		t.Parallel()
+
+		testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
+			random := testutils.RandomCommonHash(t)
+			backend.ReadRandomFunc = func(buffer []byte) error {
+				copy(buffer, random.Bytes())
+				return nil
+			}
+			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
+				handler := SetupHandler(t, backend, rootAddr)
+
+				foa := handler.AccountByAddress(handler.DeployCOA(1), true)
+				require.NotNil(t, foa)
+
+				vault := types.NewFlowTokenVault(types.MakeABalanceInFlow(100))
+				foa.Deposit(vault)
+
+				testContract := testutils.GetStorageTestContract(t)
+				addr := foa.Deploy(testContract.ByteCode, math.MaxUint64, types.EmptyBalance)
+				require.NotNil(t, addr)
+
+				ret := foa.Call(
+					addr,
+					testContract.MakeCallData(t, "random"),
+					math.MaxUint64,
+					types.EmptyBalance)
+
+				require.Equal(t, random.Bytes(), []byte(ret.ReturnedValue))
 			})
 		})
 	})
@@ -531,6 +672,152 @@ func TestHandler_BridgedAccount(t *testing.T) {
 	// TODO add test with test emulator for unhappy cases (emulator)
 }
 
+func TestHandler_TransactionRun(t *testing.T) {
+	t.Parallel()
+
+	t.Run("test - transaction run (success)", func(t *testing.T) {
+		t.Parallel()
+
+		testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
+			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
+				testutils.RunWithEOATestAccount(t, backend, rootAddr, func(eoa *testutils.EOATestAccount) {
+
+					bs := handler.NewBlockStore(backend, rootAddr)
+					aa := handler.NewAddressAllocator()
+
+					result := &types.Result{
+						DeployedContractAddress: types.Address(testutils.RandomAddress(t)),
+						ReturnedValue:           testutils.RandomData(t),
+						GasConsumed:             testutils.RandomGas(1000),
+						Logs: []*gethTypes.Log{
+							testutils.GetRandomLogFixture(t),
+							testutils.GetRandomLogFixture(t),
+						},
+					}
+
+					em := &testutils.TestEmulator{
+						RunTransactionFunc: func(tx *gethTypes.Transaction) (*types.Result, error) {
+							return result, nil
+						},
+					}
+					handler := handler.NewContractHandler(flow.Testnet, rootAddr, flowTokenAddress, bs, aa, backend, em)
+					tx := eoa.PrepareSignAndEncodeTx(
+						t,
+						gethCommon.Address{},
+						nil,
+						nil,
+						100_000,
+						big.NewInt(1),
+					)
+
+					rs := handler.Run(tx, types.NewAddress(gethCommon.Address{}))
+					require.Equal(t, types.StatusSuccessful, rs.Status)
+					require.Equal(t, result.GasConsumed, rs.GasConsumed)
+					require.Equal(t, types.ErrCodeNoError, rs.ErrorCode)
+
+				})
+			})
+		})
+	})
+
+	t.Run("test - transaction run (failed)", func(t *testing.T) {
+		t.Parallel()
+
+		testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
+			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
+				testutils.RunWithEOATestAccount(t, backend, rootAddr, func(eoa *testutils.EOATestAccount) {
+
+					bs := handler.NewBlockStore(backend, rootAddr)
+					aa := handler.NewAddressAllocator()
+
+					result := &types.Result{
+						VMError:                 gethVM.ErrOutOfGas,
+						DeployedContractAddress: types.Address(testutils.RandomAddress(t)),
+						ReturnedValue:           testutils.RandomData(t),
+						GasConsumed:             testutils.RandomGas(1000),
+						Logs: []*gethTypes.Log{
+							testutils.GetRandomLogFixture(t),
+							testutils.GetRandomLogFixture(t),
+						},
+					}
+
+					em := &testutils.TestEmulator{
+						RunTransactionFunc: func(tx *gethTypes.Transaction) (*types.Result, error) {
+							return result, nil
+						},
+					}
+					handler := handler.NewContractHandler(flow.Testnet, rootAddr, flowTokenAddress, bs, aa, backend, em)
+
+					tx := eoa.PrepareSignAndEncodeTx(
+						t,
+						gethCommon.Address{},
+						nil,
+						nil,
+						100_000,
+						big.NewInt(1),
+					)
+
+					rs := handler.Run(tx, types.NewAddress(gethCommon.Address{}))
+					require.Equal(t, types.StatusFailed, rs.Status)
+					require.Equal(t, result.GasConsumed, rs.GasConsumed)
+					require.Equal(t, types.ExecutionErrCodeOutOfGas, rs.ErrorCode)
+
+				})
+			})
+		})
+	})
+
+	t.Run("test - transaction run (unhappy cases)", func(t *testing.T) {
+		t.Parallel()
+
+		testutils.RunWithTestBackend(t, func(backend *testutils.TestBackend) {
+			testutils.RunWithTestFlowEVMRootAddress(t, backend, func(rootAddr flow.Address) {
+				testutils.RunWithEOATestAccount(t, backend, rootAddr, func(eoa *testutils.EOATestAccount) {
+					bs := handler.NewBlockStore(backend, rootAddr)
+					aa := handler.NewAddressAllocator()
+					evmErr := fmt.Errorf("%w: next nonce %v, tx nonce %v", gethCore.ErrNonceTooLow, 1, 0)
+					em := &testutils.TestEmulator{
+						RunTransactionFunc: func(tx *gethTypes.Transaction) (*types.Result, error) {
+							return &types.Result{ValidationError: evmErr}, nil
+						},
+					}
+					handler := handler.NewContractHandler(flow.Testnet, rootAddr, flowTokenAddress, bs, aa, backend, em)
+
+					coinbase := types.NewAddress(gethCommon.Address{})
+
+					gasLimit := uint64(testutils.TestComputationLimit + 1)
+					tx := eoa.PrepareSignAndEncodeTx(
+						t,
+						gethCommon.Address{},
+						nil,
+						nil,
+						gasLimit,
+						big.NewInt(1),
+					)
+
+					assertPanic(t, isNotFatal, func() {
+						rs := handler.Run([]byte(tx), coinbase)
+						require.Equal(t, types.StatusInvalid, rs.Status)
+					})
+
+					tx = eoa.PrepareSignAndEncodeTx(
+						t,
+						gethCommon.Address{},
+						nil,
+						nil,
+						100,
+						big.NewInt(1),
+					)
+
+					rs := handler.Run([]byte(tx), coinbase)
+					require.Equal(t, types.StatusInvalid, rs.Status)
+					require.Equal(t, types.ValidationErrCodeNonceTooLow, rs.ErrorCode)
+				})
+			})
+		})
+	})
+}
+
 // returns true if error passes the checks
 type checkError func(error) bool
 
@@ -554,14 +841,10 @@ func assertPanic(t *testing.T, check checkError, f func()) {
 }
 
 func SetupHandler(t testing.TB, backend types.Backend, rootAddr flow.Address) *handler.ContractHandler {
-	bs, err := handler.NewBlockStore(backend, rootAddr)
-	require.NoError(t, err)
-
-	aa, err := handler.NewAddressAllocator(backend, rootAddr)
-	require.NoError(t, err)
-
+	bs := handler.NewBlockStore(backend, rootAddr)
+	aa := handler.NewAddressAllocator()
 	emulator := emulator.NewEmulator(backend, rootAddr)
 
-	handler := handler.NewContractHandler(flowTokenAddress, bs, aa, backend, emulator)
+	handler := handler.NewContractHandler(flow.Emulator, rootAddr, flowTokenAddress, bs, aa, backend, emulator)
 	return handler
 }
diff --git a/fvm/evm/handler/precompiles.go b/fvm/evm/handler/precompiles.go
new file mode 100644
index 00000000000..9b21ad58648
--- /dev/null
+++ b/fvm/evm/handler/precompiles.go
@@ -0,0 +1,71 @@
+package handler
+
+import (
+	"fmt"
+
+	"github.com/onflow/cadence"
+	"github.com/onflow/cadence/runtime/sema"
+
+	"github.com/onflow/flow-go/fvm/environment"
+	"github.com/onflow/flow-go/fvm/evm/precompiles"
+	"github.com/onflow/flow-go/fvm/evm/types"
+	"github.com/onflow/flow-go/model/flow"
+)
+
+func preparePrecompiles(
+	evmContractAddress flow.Address,
+	addressAllocator types.AddressAllocator,
+	backend types.Backend,
+) []types.Precompile {
+	archAddress := addressAllocator.AllocatePrecompileAddress(1)
+	archContract := precompiles.ArchContract(
+		archAddress,
+		blockHeightProvider(backend),
+		coaOwnershipProofValidator(evmContractAddress, backend),
+	)
+	return []types.Precompile{archContract}
+}
+
+func blockHeightProvider(backend types.Backend) func() (uint64, error) {
+	return func() (uint64, error) {
+		h, err := backend.GetCurrentBlockHeight()
+		if types.IsAFatalError(err) || types.IsABackendError(err) {
+			panic(err)
+		}
+		return h, err
+	}
+}
+
+func coaOwnershipProofValidator(contractAddress flow.Address, backend types.Backend) func(proof *types.COAOwnershipProofInContext) (bool, error) {
+	return func(proof *types.COAOwnershipProofInContext) (bool, error) {
+		value, err := backend.Invoke(
+			environment.ContractFunctionSpec{
+				AddressFromChain: func(_ flow.Chain) flow.Address {
+					return contractAddress
+				},
+				LocationName: "EVM",
+				FunctionName: "validateCOAOwnershipProof",
+				ArgumentTypes: []sema.Type{
+					types.FlowAddressSemaType,
+					types.PublicPathSemaType,
+					types.SignedDataSemaType,
+					types.KeyIndicesSemaType,
+					types.SignaturesSemaType,
+					types.AddressBytesSemaType,
+				},
+			},
+			proof.ToCadenceValues(),
+		)
+		if err != nil {
+			if types.IsAFatalError(err) || types.IsABackendError(err) {
+				panic(err)
+			}
+			return false, err
+		}
+		data, ok := value.(cadence.Struct)
+		if !ok || len(data.Fields) == 0 {
+			return false, fmt.Errorf("invalid output data received from validateCOAOwnershipProof")
+		}
+		return bool(data.Fields[0].(cadence.Bool)), nil
+	}
+}
diff --git a/fvm/evm/precompiles/abi.go b/fvm/evm/precompiles/abi.go
new file mode 100644
index 00000000000..03f13ca4d49
--- /dev/null
+++ b/fvm/evm/precompiles/abi.go
@@ -0,0 +1,231 @@
+package precompiles
+
+import (
+	"encoding/binary"
+	"errors"
+	"math/big"
+
+	gethCommon "github.com/onflow/go-ethereum/common"
+)
+
+// This package provides fast and efficient
+// utilities needed for abi encoding and decoding
+// encodings are mostly used for testing purpose
+// if more complex encoding and decoding is needed please
+// use the abi package and pass the ABIs, though
+// that has a performance overhead.
+const (
+	FixedSizeUnitDataReadSize = 32
+	Bytes4DataReadSize        = 4
+	Bytes8DataReadSize        = 8
+	Bytes32DataReadSize       = 32
+	Uint64ByteSize            = 8
+
+	EncodedBoolSize    = FixedSizeUnitDataReadSize
+	EncodedAddressSize = FixedSizeUnitDataReadSize
+	EncodedBytes32Size = FixedSizeUnitDataReadSize
+	EncodedBytes4Size  = FixedSizeUnitDataReadSize
+	EncodedBytes8Size  = FixedSizeUnitDataReadSize
+	EncodedUint64Size  = FixedSizeUnitDataReadSize
+	EncodedUint256Size = FixedSizeUnitDataReadSize
+)
+
+var ErrInputDataTooSmall = errors.New("input data is too small for decoding")
+var ErrBufferTooSmall = errors.New("buffer too small for encoding")
+var ErrDataTooLarge = errors.New("input data is too large for encoding")
+
+// ReadAddress reads an address from the buffer at index
+func ReadAddress(buffer []byte, index int) (gethCommon.Address, error) {
+	if len(buffer) < index+FixedSizeUnitDataReadSize {
+		return gethCommon.Address{}, ErrInputDataTooSmall
+	}
+	paddedData := buffer[index : index+FixedSizeUnitDataReadSize]
+	// addresses are zero-padded on the left side.
+	addr := gethCommon.BytesToAddress(
+		paddedData[FixedSizeUnitDataReadSize-gethCommon.AddressLength:])
+	return addr, nil
+}
+
+// EncodeAddress encodes the address and add it to the buffer at the index
+func EncodeAddress(address gethCommon.Address, buffer []byte, index int) error {
+	if len(buffer) < index+EncodedAddressSize {
+		return ErrBufferTooSmall
+	}
+	copy(buffer[index:index+EncodedAddressSize],
+		gethCommon.LeftPadBytes(address[:], EncodedAddressSize))
+	return nil
+}
+
+// ReadBool reads a boolean from the buffer at the index
+func ReadBool(buffer []byte, index int) (bool, error) {
+	if len(buffer) < index+EncodedBoolSize {
+		return false, ErrInputDataTooSmall
+	}
+	// bools are zero-padded on the left side
+	// so we only need to read the last byte
+	return uint8(buffer[index+EncodedBoolSize-1]) > 0, nil
+}
+
+// EncodeBool encodes a boolean into fixed size unit of encoded data
+func EncodeBool(bitSet bool, buffer []byte, index int) error {
+	if len(buffer) < index+EncodedBoolSize {
+		return ErrBufferTooSmall
+	}
+	// bit set with left padding
+	for i := 0; i < EncodedBoolSize; i++ {
+		buffer[index+i] = 0
+	}
+	if bitSet {
+		buffer[index+EncodedBoolSize-1] = 1
+	}
+	return nil
+}
+
+// ReadUint64 reads a uint64 from the buffer at index
+func ReadUint64(buffer []byte, index int) (uint64, error) {
+	if len(buffer) < index+EncodedUint64Size {
+		return 0, ErrInputDataTooSmall
+	}
+	// data is expected to be big endian (zero-padded on the left side)
+	return binary.BigEndian.Uint64(
+		buffer[index+EncodedUint64Size-Uint64ByteSize : index+EncodedUint64Size]), nil
+}
+
+// EncodeUint64 encodes a uint64 into fixed size unit of encoded data (zero-padded on the left side)
+func EncodeUint64(inp uint64, buffer []byte, index int) error {
+	if len(buffer) < index+EncodedUint64Size {
+		return ErrBufferTooSmall
+	}
+	encoded := make([]byte, 8)
+	binary.BigEndian.PutUint64(encoded, inp)
+	copy(buffer[index:index+EncodedUint64Size],
+		gethCommon.LeftPadBytes(encoded, EncodedUint64Size),
+	)
+	return nil
+}
+
+// ReadUint256 reads an address from the buffer at index
+func ReadUint256(buffer []byte, index int) (*big.Int, error) {
+	if len(buffer) < index+EncodedUint256Size {
+		return nil, ErrInputDataTooSmall
+	}
+	// data is expected to be big endian (zero-padded on the left side)
+	return new(big.Int).SetBytes(buffer[index : index+EncodedUint256Size]), nil
+}
+
+// ReadBytes4 reads a 4 byte slice from the buffer at index
+func ReadBytes4(buffer []byte, index int) ([]byte, error) {
+	if len(buffer) < index+EncodedBytes4Size {
+		return nil, ErrInputDataTooSmall
+	}
+	// fixed-size byte values are zero-padded on the right side.
+	return buffer[index : index+Bytes4DataReadSize], nil
+}
+
+// ReadBytes8 reads a 8 byte slice from the buffer at index
+func ReadBytes8(buffer []byte, index int) ([]byte, error) {
+	if len(buffer) < index+EncodedBytes8Size {
+		return nil, ErrInputDataTooSmall
+	}
+	// fixed-size byte values are zero-padded on the right side.
+	return buffer[index : index+Bytes8DataReadSize], nil
+}
+
+// ReadBytes32 reads a 32 byte slice from the buffer at index
+func ReadBytes32(buffer []byte, index int) ([]byte, error) {
+	if len(buffer) < index+Bytes32DataReadSize {
+		return nil, ErrInputDataTooSmall
+	}
+	return buffer[index : index+Bytes32DataReadSize], nil
+}
+
+// EncodeBytes32 encodes data into a bytes 32
+func EncodeBytes32(data []byte, buffer []byte, index int) error {
+	if len(data) > EncodedBytes32Size {
+		return ErrDataTooLarge
+	}
+	if len(buffer) < index+EncodedBytes32Size {
+		return ErrBufferTooSmall
+	}
+	copy(buffer[index:index+EncodedBytes32Size],
+		gethCommon.RightPadBytes(data, EncodedBytes32Size),
+	)
+	return nil
+}
+
+// ReadBytes reads a variable length bytes from the buffer
+func ReadBytes(buffer []byte, index int) ([]byte, error) {
+	if len(buffer) < index+EncodedUint64Size {
+		return nil, ErrInputDataTooSmall
+	}
+	// reading offset (we read into uint64) and adjust index
+	offset, err := ReadUint64(buffer, index)
+	if err != nil {
+		return nil, err
+	}
+	index = int(offset)
+	if len(buffer) < index+EncodedUint64Size {
+		return nil, ErrInputDataTooSmall
+	}
+	// reading length of byte slice
+	length, err := ReadUint64(buffer, index)
+	if err != nil {
+		return nil, err
+	}
+	index += EncodedUint64Size
+	if len(buffer) < index+int(length) {
+		return nil, ErrInputDataTooSmall
+	}
+	return buffer[index : index+int(length)], nil
+}
+
+// SizeNeededForBytesEncoding computes the number of bytes needed for bytes encoding
+func SizeNeededForBytesEncoding(data []byte) int {
+	if len(data) == 0 {
+		return EncodedUint64Size + EncodedUint64Size + FixedSizeUnitDataReadSize
+	}
+	paddedSize := (len(data) / FixedSizeUnitDataReadSize)
+	if len(data)%FixedSizeUnitDataReadSize != 0 {
+		paddedSize += 1
+	}
+	return EncodedUint64Size + EncodedUint64Size + paddedSize*FixedSizeUnitDataReadSize
+}
+
+// EncodeBytes encodes the data into the buffer at index and append payload to the
+// end of buffer
+func EncodeBytes(data []byte, buffer []byte, headerIndex, payloadIndex int) error {
+	//// updating offset
+	if len(buffer) < headerIndex+EncodedUint64Size {
+		return ErrBufferTooSmall
+	}
+	dataSize := len(data)
+	// compute padded data size
+	paddedSize := (dataSize / FixedSizeUnitDataReadSize)
+	if dataSize%FixedSizeUnitDataReadSize != 0 {
+		paddedSize += FixedSizeUnitDataReadSize
+	}
+	if len(buffer) < payloadIndex+EncodedUint64Size+paddedSize {
+		return ErrBufferTooSmall
+	}
+
+	err := EncodeUint64(uint64(payloadIndex), buffer, headerIndex)
+	if err != nil {
+		return err
+	}
+
+	//// updating payload
+	// padding data
+	if dataSize%FixedSizeUnitDataReadSize != 0 {
+		data = gethCommon.RightPadBytes(data, paddedSize)
+	}
+
+	// adding length
+	err = EncodeUint64(uint64(dataSize), buffer, payloadIndex)
+	if err != nil {
+		return err
+	}
+	payloadIndex += EncodedUint64Size
+	// adding data
+	copy(buffer[payloadIndex:payloadIndex+len(data)], data)
+	return nil
+}
diff --git a/fvm/evm/precompiles/abi_test.go b/fvm/evm/precompiles/abi_test.go
new file mode 100644
index 00000000000..6ec9877a3d1
--- /dev/null
+++ b/fvm/evm/precompiles/abi_test.go
@@ -0,0 +1,131 @@
+package precompiles_test
+
+import (
+	"encoding/hex"
+	"math/big"
+	"testing"
+
+	gethCommon "github.com/onflow/go-ethereum/common"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/fvm/evm/precompiles"
+)
+
+func TestABIEncodingDecodingFunctions(t *testing.T) {
+	t.Parallel()
+
+	t.Run("test address", func(t *testing.T) {
+		encodedAddress, err := hex.DecodeString("000000000000000000000000e592427a0aece92de3edee1f18e0157c05861564")
+		require.NoError(t, err)
+		addr, err := precompiles.ReadAddress(encodedAddress, 0)
+		require.NoError(t, err)
+		expectedAddress := gethCommon.HexToAddress("e592427a0aece92de3edee1f18e0157c05861564")
+		require.Equal(t, expectedAddress, addr)
+		reEncoded := make([]byte, precompiles.EncodedAddressSize)
+		err = precompiles.EncodeAddress(addr, reEncoded, 0)
+		require.NoError(t, err)
+		require.Equal(t, encodedAddress, reEncoded)
+	})
+
+	t.Run("test boolean", func(t *testing.T) {
+		encodedBool, err := hex.DecodeString("0000000000000000000000000000000000000000000000000000000000000001")
+		require.NoError(t, err)
+		ret, err := precompiles.ReadBool(encodedBool, 0)
+		require.NoError(t, err)
+		require.True(t, ret)
+		reEncoded := make([]byte, precompiles.EncodedBoolSize)
+		err = precompiles.EncodeBool(ret, reEncoded, 0)
+		require.NoError(t, err)
+		require.Equal(t, encodedBool, reEncoded)
+	})
+
+	t.Run("test uint64", func(t *testing.T) {
+		encodedUint64, err := hex.DecodeString("0000000000000000000000000000000000000000000000000000000000000046")
+		require.NoError(t, err)
+		ret, err := precompiles.ReadUint64(encodedUint64, 0)
+		require.NoError(t, err)
+		expectedUint64 := uint64(70)
+		require.Equal(t, expectedUint64, ret)
+		reEncoded := make([]byte, precompiles.EncodedUint64Size)
+		err = precompiles.EncodeUint64(ret, reEncoded, 0)
+		require.NoError(t, err)
+		require.Equal(t, encodedUint64, reEncoded)
+
+	})
+
+	t.Run("test read uint256", func(t *testing.T) {
+		encodedUint256, err := hex.DecodeString("1000000000000000000000000000000000000000000000000000000000000046")
+		require.NoError(t, err)
+		ret, err := precompiles.ReadUint256(encodedUint256, 0)
+		require.NoError(t, err)
+		expectedValue, success := new(big.Int).SetString("7237005577332262213973186563042994240829374041602535252466099000494570602566", 10)
+		require.True(t, success)
+		require.Equal(t, expectedValue, ret)
+	})
+
+	t.Run("test fixed size bytes", func(t *testing.T) {
+		encodedFixedSizeBytes, err := hex.DecodeString("abcdef1200000000000000000000000000000000000000000000000000000000")
+		require.NoError(t, err)
+		ret, err := precompiles.ReadBytes4(encodedFixedSizeBytes, 0)
+		require.NoError(t, err)
+		require.Equal(t, encodedFixedSizeBytes[0:4], ret)
+
+		ret, err = precompiles.ReadBytes8(encodedFixedSizeBytes, 0)
+		require.NoError(t, err)
+		require.Equal(t, encodedFixedSizeBytes[0:8], ret)
+
+		ret, err = precompiles.ReadBytes32(encodedFixedSizeBytes, 0)
+		require.NoError(t, err)
+		require.Equal(t, encodedFixedSizeBytes[0:32], ret)
+
+		reEncoded := make([]byte, precompiles.EncodedBytes32Size)
+		err = precompiles.EncodeBytes32(ret, reEncoded, 0)
+		require.NoError(t, err)
+		require.Equal(t, encodedFixedSizeBytes, reEncoded)
+	})
+
+	t.Run("test read bytes (variable size)", func(t *testing.T) {
+		encodedData, err := hex.DecodeString("0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000b48656c6c6f20576f726c64000000000000000000000000000000000000000000")
+		require.NoError(t, err)
+
+		ret, err := precompiles.ReadBytes(encodedData, 0)
+		require.NoError(t, err)
+		expectedData, err := hex.DecodeString("48656c6c6f20576f726c64")
+		require.NoError(t, err)
+		require.Equal(t, expectedData, ret)
+
+		bufferSize := precompiles.SizeNeededForBytesEncoding(expectedData)
+		buffer := make([]byte, bufferSize)
+		err = precompiles.EncodeBytes(expectedData, buffer, 0, precompiles.EncodedUint64Size)
+		require.NoError(t, err)
+		require.Equal(t, encodedData, buffer)
+	})
+
+	t.Run("test size needed for encoding bytes", func(t *testing.T) {
+		// len zero
+		data := []byte{}
+		ret := precompiles.SizeNeededForBytesEncoding(data)
+		offsetAndLenEncodingSize := precompiles.EncodedUint64Size + precompiles.EncodedUint64Size
+		expectedSize := offsetAndLenEncodingSize + precompiles.FixedSizeUnitDataReadSize
+		require.Equal(t, expectedSize, ret)
+
+		// data size 1
+		data = []byte{1}
+		ret = precompiles.SizeNeededForBytesEncoding(data)
+		expectedSize = offsetAndLenEncodingSize + precompiles.FixedSizeUnitDataReadSize
+		require.Equal(t, expectedSize, ret)
+
+		// data size 32
+		data = make([]byte, 32)
+		ret = precompiles.SizeNeededForBytesEncoding(data)
+		expectedSize = offsetAndLenEncodingSize + precompiles.FixedSizeUnitDataReadSize
+		require.Equal(t, expectedSize, ret)
+
+		// data size 33
+		data = make([]byte, 33)
+		ret = precompiles.SizeNeededForBytesEncoding(data)
+		expectedSize = offsetAndLenEncodingSize + precompiles.FixedSizeUnitDataReadSize*2
+		require.Equal(t, expectedSize, ret)
+	})
+
+}
diff --git a/fvm/evm/precompiles/arch.go b/fvm/evm/precompiles/arch.go
index ca6477e311a..a396a192e84 100644
--- a/fvm/evm/precompiles/arch.go
+++ b/fvm/evm/precompiles/arch.go
@@ -1,18 +1,27 @@
 package precompiles
 
 import (
-	"encoding/binary"
 	"fmt"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-
 	"github.com/onflow/flow-go/fvm/evm/types"
 )
 
 var (
 	FlowBlockHeightFuncSig = ComputeFunctionSelector("flowBlockHeight", nil)
-	// TODO update me with a higher value if needed
-	FlowBlockHeightFixedGas = uint64(1)
+	// TODO: fix me
+	ProofVerifierFuncSig = ComputeFunctionSelector(
+		"verifyCOAOwnershipProof",
+		[]string{"address", "bytes32", "bytes"},
+	)
+
+	// FlowBlockHeightFixedGas is set to match the `number` opCode (0x43)
+	FlowBlockHeightFixedGas = uint64(2)
+	// ProofVerifierBaseGas covers the cost of decoding, checking capability the resource
+	// and the rest of operations excluding signature verification
+	ProofVerifierBaseGas = uint64(1_000)
+	// ProofVerifierGasMultiplerPerSignature is set to match `ECRECOVER`
+	// but we might increase this in the future
+	ProofVerifierGasMultiplerPerSignature = uint64(3_000)
 )
 
 // ArchContract return a procompile for the Cadence Arch contract
@@ -21,26 +30,32 @@ var (
 func ArchContract(
 	address types.Address,
 	heightProvider func() (uint64, error),
+	proofVer func(*types.COAOwnershipProofInContext) (bool, error),
 ) types.Precompile {
 	return MultiFunctionPrecompileContract(
 		address,
-		[]Function{&flowBlockHeightFunction{heightProvider}},
+		[]Function{
+			&flowBlockHeight{heightProvider},
+			&proofVerifier{proofVer},
+		},
 	)
 }
 
-type flowBlockHeightFunction struct {
+type flowBlockHeight struct {
 	flowBlockHeightLookUp func() (uint64, error)
 }
 
-func (c *flowBlockHeightFunction) FunctionSelector() FunctionSelector {
+var _ Function = &flowBlockHeight{}
+
+func (c *flowBlockHeight) FunctionSelector() FunctionSelector {
 	return FlowBlockHeightFuncSig
 }
 
-func (c *flowBlockHeightFunction) ComputeGas(input []byte) uint64 {
+func (c *flowBlockHeight) ComputeGas(input []byte) uint64 {
 	return FlowBlockHeightFixedGas
 }
 
-func (c *flowBlockHeightFunction) Run(input []byte) ([]byte, error) {
+func (c *flowBlockHeight) Run(input []byte) ([]byte, error) {
 	if len(input) > 0 {
 		return nil, fmt.Errorf("unexpected input is provided")
 	}
@@ -48,9 +63,111 @@ func (c *flowBlockHeightFunction) Run(input []byte) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	encoded := make([]byte, 8)
-	binary.BigEndian.PutUint64(encoded, bh)
-	// the EVM works natively in 256-bit words,
-	// we left pad to that size to prevent extra gas consumtion for masking.
-	return gethCommon.LeftPadBytes(encoded, 32), nil
+	// EVM works natively in 256-bit words,
+	// Encode to 256-bit is the common practice to prevent extra gas consumtion for masking.
+	buffer := make([]byte, EncodedUint64Size)
+	return buffer, EncodeUint64(bh, buffer, 0)
+}
+
+type proofVerifier struct {
+	proofVerifier func(*types.COAOwnershipProofInContext) (bool, error)
+}
+
+var _ Function = &proofVerifier{}
+
+func (f *proofVerifier) FunctionSelector() FunctionSelector {
+	return ProofVerifierFuncSig
+}
+
+func (f *proofVerifier) ComputeGas(input []byte) uint64 {
+	// we compute the gas using a fixed base fee and extra fees
+	// per signatures. Note that the input data is already trimmed from the function selector
+	// and the remaining is ABI encoded of the inputs
+
+	// skip to the encoded signature part of args (skip address and bytes32 data part)
+	index := EncodedAddressSize + Bytes32DataReadSize
+	// Reading the encoded signature bytes
+	encodedSignature, err := ReadBytes(input, index)
+	if err != nil {
+		// if any error run would anyway fail, so returning any non-zero value here is fine
+		return ProofVerifierBaseGas
+	}
+	// this method would return the number of signatures from the encoded signature data
+	// this saves the extra time needed for full decoding
+	// given ComputeGas function is called before charging the gas, we need to keep
+	// this function as light as possible
+	count, err := types.COAOwnershipProofSignatureCountFromEncoded(encodedSignature)
+	if err != nil {
+		// if any error run would anyway fail, so returning any non-zero value here is fine
+		return ProofVerifierBaseGas
+	}
+	return ProofVerifierBaseGas + uint64(count)*ProofVerifierGasMultiplerPerSignature
+}
+
+func (f *proofVerifier) Run(input []byte) ([]byte, error) {
+	proof, err := DecodeABIEncodedProof(input)
+	if err != nil {
+		return nil, err
+	}
+	verified, err := f.proofVerifier(proof)
+	if err != nil {
+		return nil, err
+	}
+
+	buffer := make([]byte, EncodedBoolSize)
+	return buffer, EncodeBool(verified, buffer, 0)
+}
+
+func DecodeABIEncodedProof(input []byte) (*types.COAOwnershipProofInContext, error) {
+	index := 0
+	caller, err := ReadAddress(input, index)
+	index += FixedSizeUnitDataReadSize
+	if err != nil {
+		return nil, err
+	}
+
+	hash, err := ReadBytes32(input, index)
+	index += Bytes32DataReadSize
+	if err != nil {
+		return nil, err
+	}
+
+	encodedProof, err := ReadBytes(input, index)
+	if err != nil {
+		return nil, err
+	}
+
+	return types.NewCOAOwnershipProofInContext(
+		hash,
+		types.Address(caller),
+		encodedProof,
+	)
+}
+
+func ABIEncodeProof(proof *types.COAOwnershipProofInContext) ([]byte, error) {
+	encodedProof, err := proof.COAOwnershipProof.Encode()
+	if err != nil {
+		return nil, err
+	}
+	bufferSize := EncodedAddressSize +
+		EncodedBytes32Size +
+		SizeNeededForBytesEncoding(encodedProof)
+
+	abiEncodedData := make([]byte, bufferSize)
+	index := 0
+	err = EncodeAddress(proof.EVMAddress.ToCommon(), abiEncodedData, index)
+	if err != nil {
+		return nil, err
+	}
+	index += EncodedAddressSize
+	err = EncodeBytes32(proof.SignedData, abiEncodedData, index)
+	if err != nil {
+		return nil, err
+	}
+	index += EncodedBytes32Size
+	err = EncodeBytes(encodedProof, abiEncodedData, index, index+EncodedUint64Size)
+	if err != nil {
+		return nil, err
+	}
+	return abiEncodedData, nil
 }
diff --git a/fvm/evm/precompiles/arch_test.go b/fvm/evm/precompiles/arch_test.go
index 9f0cf186da7..33613e20265 100644
--- a/fvm/evm/precompiles/arch_test.go
+++ b/fvm/evm/precompiles/arch_test.go
@@ -7,29 +7,62 @@ import (
 
 	"github.com/onflow/flow-go/fvm/evm/precompiles"
 	"github.com/onflow/flow-go/fvm/evm/testutils"
+	"github.com/onflow/flow-go/fvm/evm/types"
 )
 
 func TestArchContract(t *testing.T) {
-	address := testutils.RandomAddress(t)
-
-	height := uint64(12)
-	pc := precompiles.ArchContract(
-		address,
-		func() (uint64, error) {
-			return height, nil
-		},
-	)
-
-	input := precompiles.FlowBlockHeightFuncSig.Bytes()
-	require.Equal(t, address, pc.Address())
-	require.Equal(t, precompiles.FlowBlockHeightFixedGas, pc.RequiredGas(input))
-	ret, err := pc.Run(input)
-	require.NoError(t, err)
-
-	expected := make([]byte, 32)
-	expected[31] = 12
-	require.Equal(t, expected, ret)
-
-	_, err = pc.Run([]byte{1, 2, 3})
-	require.Error(t, err)
+
+	t.Run("test block height", func(t *testing.T) {
+		address := testutils.RandomAddress(t)
+		height := uint64(12)
+		pc := precompiles.ArchContract(
+			address,
+			func() (uint64, error) {
+				return height, nil
+			},
+			nil,
+		)
+
+		input := precompiles.FlowBlockHeightFuncSig.Bytes()
+		require.Equal(t, address, pc.Address())
+		require.Equal(t, precompiles.FlowBlockHeightFixedGas, pc.RequiredGas(input))
+		ret, err := pc.Run(input)
+		require.NoError(t, err)
+
+		expected := make([]byte, 32)
+		expected[31] = 12
+		require.Equal(t, expected, ret)
+
+		_, err = pc.Run([]byte{1, 2, 3})
+		require.Error(t, err)
+	})
+
+	t.Run("test proof verification", func(t *testing.T) {
+		proof := testutils.COAOwnershipProofInContextFixture(t)
+		pc := precompiles.ArchContract(
+			testutils.RandomAddress(t),
+			nil,
+			func(p *types.COAOwnershipProofInContext) (bool, error) {
+				require.Equal(t, proof, p)
+				return true, nil
+			},
+		)
+
+		abiEncodedData, err := precompiles.ABIEncodeProof(proof)
+		require.NoError(t, err)
+
+		// add function selector to the input
+		input := append(precompiles.ProofVerifierFuncSig.Bytes(), abiEncodedData...)
+
+		expectedGas := precompiles.ProofVerifierBaseGas +
+			uint64(len(proof.KeyIndices))*precompiles.ProofVerifierGasMultiplerPerSignature
+		require.Equal(t, expectedGas, pc.RequiredGas(input))
+
+		ret, err := pc.Run(input)
+		require.NoError(t, err)
+
+		expected := make([]byte, 32)
+		expected[31] = 1
+		require.Equal(t, expected, ret)
+	})
 }
diff --git a/fvm/evm/precompiles/signature.go b/fvm/evm/precompiles/selector.go
similarity index 95%
rename from fvm/evm/precompiles/signature.go
rename to fvm/evm/precompiles/selector.go
index a62c8f5b9ac..1495ba56028 100644
--- a/fvm/evm/precompiles/signature.go
+++ b/fvm/evm/precompiles/selector.go
@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"strings"
 
-	gethCrypto "github.com/ethereum/go-ethereum/crypto"
+	gethCrypto "github.com/onflow/go-ethereum/crypto"
 )
 
 const FunctionSelectorLength = 4
diff --git a/fvm/evm/precompiles/signature_test.go b/fvm/evm/precompiles/selector_test.go
similarity index 93%
rename from fvm/evm/precompiles/signature_test.go
rename to fvm/evm/precompiles/selector_test.go
index d6f36b9fffe..eb41203ef86 100644
--- a/fvm/evm/precompiles/signature_test.go
+++ b/fvm/evm/precompiles/selector_test.go
@@ -3,7 +3,7 @@ package precompiles_test
 import (
 	"testing"
 
-	gethCrypto "github.com/ethereum/go-ethereum/crypto"
+	gethCrypto "github.com/onflow/go-ethereum/crypto"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/fvm/evm/precompiles"
diff --git a/fvm/evm/stdlib/abiOnlyContract.cdc b/fvm/evm/stdlib/abiOnlyContract.cdc
deleted file mode 100644
index 45378726215..00000000000
--- a/fvm/evm/stdlib/abiOnlyContract.cdc
+++ /dev/null
@@ -1,60 +0,0 @@
-access(all)
-contract EVM {
-
-    /// EVMAddress is an EVM-compatible address
-    access(all)
-    struct EVMAddress {
-
-        /// Bytes of the address
-        access(all)
-        let bytes: [UInt8; 20]
-
-        /// Constructs a new EVM address from the given byte representation
-        init(bytes: [UInt8; 20]) {
-            self.bytes = bytes
-        }
-
-    }
-
-    access(all)
-    fun encodeABI(_ values: [AnyStruct]): [UInt8] {
-        return InternalEVM.encodeABI(values)
-    }
-
-    access(all)
-    fun decodeABI(types: [Type], data: [UInt8]): [AnyStruct] {
-        return InternalEVM.decodeABI(types: types, data: data)
-    }
-
-    access(all)
-    fun encodeABIWithSignature(
-        _ signature: String,
-        _ values: [AnyStruct]
-    ): [UInt8] {
-        let methodID = HashAlgorithm.KECCAK_256.hash(
-            signature.utf8
-        ).slice(from: 0, upTo: 4)
-        let arguments = InternalEVM.encodeABI(values)
-
-        return methodID.concat(arguments)
-    }
-
-    access(all)
-    fun decodeABIWithSignature(
-        _ signature: String,
-        types: [Type],
-        data: [UInt8]
-    ): [AnyStruct] {
-        let methodID = HashAlgorithm.KECCAK_256.hash(
-            signature.utf8
-        ).slice(from: 0, upTo: 4)
-
-        for byte in methodID {
-            if byte != data.removeFirst() {
-                panic("signature mismatch")
-            }
-        }
-
-        return InternalEVM.decodeABI(types: types, data: data)
-    }
-}
diff --git a/fvm/evm/stdlib/contract.cdc b/fvm/evm/stdlib/contract.cdc
index 3151542131b..ff87ab299a3 100644
--- a/fvm/evm/stdlib/contract.cdc
+++ b/fvm/evm/stdlib/contract.cdc
@@ -1,8 +1,24 @@
+import Crypto
 import "FlowToken"
 
 access(all)
 contract EVM {
 
+    access(all)
+    event CadenceOwnedAccountCreated(addressBytes: [UInt8; 20])
+
+    /// FLOWTokensDeposited is emitted when FLOW tokens is bridged
+    /// into the EVM environment. Note that this event is not emitted
+    /// for transfer of flow tokens between two EVM addresses.
+    access(all)
+    event FLOWTokensDeposited(addressBytes: [UInt8; 20], amount: UFix64)
+
+    /// FLOWTokensWithdrawn is emitted when FLOW tokens are bridged
+    /// out of the EVM environment. Note that this event is not emitted
+    /// for transfer of flow tokens between two EVM addresses.
+    access(all)
+    event FLOWTokensWithdrawn(addressBytes: [UInt8; 20], amount: UFix64)
+
     /// EVMAddress is an EVM-compatible address
     access(all)
     struct EVMAddress {
@@ -22,69 +38,219 @@ contract EVM {
             let balance = InternalEVM.balance(
                 address: self.bytes
             )
+            return Balance(attoflow: balance)
+        }
+
+        /// Nonce of the address
+        access(all)
+        fun nonce(): UInt64 {
+            return InternalEVM.nonce(
+                address: self.bytes
+            )
+        }
 
-            return Balance(flow: balance)
+        /// Code of the address
+        access(all)
+        fun code(): [UInt8] {
+            return InternalEVM.code(
+                address: self.bytes
+            )
+        }
+
+        /// CodeHash of the address
+        access(all)
+        fun codeHash(): [UInt8] {
+            return InternalEVM.codeHash(
+                address: self.bytes
+            )
+        }
+
+        /// Deposits the given vault into the EVM account with the given address
+        access(all)
+        fun deposit(from: @FlowToken.Vault) {
+            let amount = from.balance
+            if amount == 0.0 {
+                panic("calling deposit function with an empty vault is not allowed")
+            }
+            InternalEVM.deposit(
+                from: <-from,
+                to: self.bytes
+            )
+            emit FLOWTokensDeposited(addressBytes: self.bytes, amount: amount)
         }
     }
 
     access(all)
     struct Balance {
 
-        /// The balance in FLOW
+        /// The balance in atto-FLOW
+        /// Atto-FLOW is the smallest denomination of FLOW (1e18 FLOW)
+        /// that is used to store account balances inside EVM
+        /// similar to the way WEI is used to store ETH divisible to 18 decimal places.
         access(all)
-        let flow: UFix64
+        var attoflow: UInt
 
-        /// Constructs a new balance, given the balance in FLOW
-        init(flow: UFix64) {
-            self.flow = flow
+        /// Constructs a new balance
+        access(all)
+        init(attoflow: UInt) {
+            self.attoflow = attoflow
         }
 
-        // TODO:
-        // /// Returns the balance in terms of atto-FLOW.
-        // /// Atto-FLOW is the smallest denomination of FLOW inside EVM
-        // access(all)
-        // fun toAttoFlow(): UInt64
+        /// Sets the balance by a UFix64 (8 decimal points), the format
+        /// that is used in Cadence to store FLOW tokens.
+        access(all)
+        fun setFLOW(flow: UFix64){
+            self.attoflow = InternalEVM.castToAttoFLOW(balance: flow)
+        }
+
+        /// Casts the balance to a UFix64 (rounding down)
+        /// Warning! casting a balance to a UFix64 which supports a lower level of precision
+        /// (8 decimal points in compare to 18) might result in rounding down error.
+        /// Use the toAttoFlow function if you care need more accuracy.
+        access(all)
+        fun inFLOW(): UFix64 {
+            return InternalEVM.castToFLOW(balance: self.attoflow)
+        }
+
+        /// Returns the balance in Atto-FLOW
+        access(all)
+        fun inAttoFLOW(): UInt {
+            return self.attoflow
+        }
+
+        /// Returns true if the balance is zero
+        access(all)
+        fun isZero(): Bool {
+            return self.attoflow == 0
+        }
+    }
+
+    /// reports the status of evm execution.
+    access(all) enum Status: UInt8 {
+        /// is (rarely) returned when status is unknown
+        /// and something has gone very wrong.
+        access(all) case unknown
+
+        /// is returned when execution of an evm transaction/call
+        /// has failed at the validation step (e.g. nonce mismatch).
+        /// An invalid transaction/call is rejected to be executed
+        /// or be included in a block.
+        access(all) case invalid
+
+        /// is returned when execution of an evm transaction/call
+        /// has been successful but the vm has reported an error as
+        /// the outcome of execution (e.g. running out of gas).
+        /// A failed tx/call is included in a block.
+        /// Note that resubmission of a failed transaction would
+        /// result in invalid status in the second attempt, given
+        /// the nonce would be come invalid.
+        access(all) case failed
+
+        /// is returned when execution of an evm transaction/call
+        /// has been successful and no error is reported by the vm.
+        access(all) case successful
+    }
+
+    /// reports the outcome of evm transaction/call execution attempt
+    access(all) struct Result {
+        /// status of the execution
+        access(all)
+        let status: Status
+
+        /// error code (error code zero means no error)
+        access(all)
+        let errorCode: UInt64
+
+        /// returns the amount of gas metered during
+        /// evm execution
+        access(all)
+        let gasUsed: UInt64
+
+        /// returns the data that is returned from
+        /// the evm for the call. For coa.deploy
+        /// calls it returns the address bytes of the
+        /// newly deployed contract.
+        access(all)
+        let data: [UInt8]
+
+        init(
+            status: Status,
+            errorCode: UInt64,
+            gasUsed: UInt64,
+            data: [UInt8]
+        ) {
+            self.status = status
+            self.errorCode = errorCode
+            self.gasUsed = gasUsed
+            self.data = data
+        }
     }
 
     access(all)
-    resource BridgedAccount {
+    resource interface Addressable {
+        /// The EVM address
+        access(all)
+        fun address(): EVMAddress
+    }
+
+    access(all)
+    resource CadenceOwnedAccount: Addressable  {
 
         access(self)
-        let addressBytes: [UInt8; 20]
+        var addressBytes: [UInt8; 20]
+
+        init() {
+            // address is initially set to zero
+            // but updated through initAddress later
+            // we have to do this since we need resource id (uuid)
+            // to calculate the EVM address for this cadence owned account
+            self.addressBytes = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
+        }
 
-        init(addressBytes: [UInt8; 20]) {
+        access(contract)
+        fun initAddress(addressBytes: [UInt8; 20]) {
+           // only allow set address for the first time
+           // check address is empty
+            for item in self.addressBytes {
+                assert(item == 0, message: "address byte is not empty")
+            }
            self.addressBytes = addressBytes
         }
 
-        /// The EVM address of the bridged account
+        /// The EVM address of the cadence owned account
         access(all)
         fun address(): EVMAddress {
             // Always create a new EVMAddress instance
             return EVMAddress(bytes: self.addressBytes)
         }
 
-        /// Get balance of the bridged account
+        /// Get balance of the cadence owned account
         access(all)
         fun balance(): Balance {
             return self.address().balance()
         }
 
-        /// Deposits the given vault into the bridged account's balance
+        /// Deposits the given vault into the cadence owned account's balance
         access(all)
         fun deposit(from: @FlowToken.Vault) {
-            InternalEVM.deposit(
-                from: <-from,
-                to: self.addressBytes
-            )
+            self.address().deposit(from: <-from)
         }
 
-        /// Withdraws the balance from the bridged account's balance
+        /// Withdraws the balance from the cadence owned account's balance
+        /// Note that amounts smaller than 10nF (10e-8) can't be withdrawn
+        /// given that Flow Token Vaults use UFix64s to store balances.
+        /// If the given balance conversion to UFix64 results in
+        /// rounding error, this function would fail.
         access(all)
         fun withdraw(balance: Balance): @FlowToken.Vault {
+            if balance.isZero() {
+                panic("calling withdraw function with zero balance is not allowed")
+            }
             let vault <- InternalEVM.withdraw(
                 from: self.addressBytes,
-                amount: balance.flow
+                amount: balance.attoflow
             ) as! @FlowToken.Vault
+            emit FLOWTokensWithdrawn(addressBytes: self.addressBytes, amount: balance.inFLOW())
             return <-vault
         }
 
@@ -100,7 +266,7 @@ contract EVM {
                 from: self.addressBytes,
                 code: code,
                 gasLimit: gasLimit,
-                value: value.flow
+                value: value.attoflow
             )
             return EVMAddress(bytes: addressBytes)
         }
@@ -113,33 +279,50 @@ contract EVM {
             data: [UInt8],
             gasLimit: UInt64,
             value: Balance
-        ): [UInt8] {
-             return InternalEVM.call(
-                 from: self.addressBytes,
-                 to: to.bytes,
-                 data: data,
-                 gasLimit: gasLimit,
-                 value: value.flow
-            )
+        ): Result {
+            return InternalEVM.call(
+                from: self.addressBytes,
+                to: to.bytes,
+                data: data,
+                gasLimit: gasLimit,
+                value: value.attoflow
+            ) as! Result
         }
     }
 
-    /// Creates a new bridged account
+    /// Creates a new cadence owned account
     access(all)
-    fun createBridgedAccount(): @BridgedAccount {
-        return <-create BridgedAccount(
-            addressBytes: InternalEVM.createBridgedAccount()
-        )
+    fun createCadenceOwnedAccount(): @CadenceOwnedAccount {
+        let acc <-create CadenceOwnedAccount()
+        let addr = InternalEVM.createCadenceOwnedAccount(uuid: acc.uuid)
+        acc.initAddress(addressBytes: addr)
+        emit CadenceOwnedAccountCreated(addressBytes: addr)
+        return <-acc
     }
 
     /// Runs an a RLP-encoded EVM transaction, deducts the gas fees,
     /// and deposits the gas fees into the provided coinbase address.
-    ///
-    /// Returns true if the transaction was successful,
-    /// and returns false otherwise
     access(all)
-    fun run(tx: [UInt8], coinbase: EVMAddress) {
-        InternalEVM.run(tx: tx, coinbase: coinbase.bytes)
+    fun run(tx: [UInt8], coinbase: EVMAddress): Result {
+        return InternalEVM.run(
+                tx: tx,
+                coinbase: coinbase.bytes
+        ) as! Result
+    }
+
+    /// mustRun runs the transaction using EVM.run yet it
+    /// rollback if the tx execution status is unknown or invalid.
+    /// Note that this method does not rollback if transaction
+    /// is executed but an vm error is reported as the outcome
+    /// of the execution (status: failed).
+    access(all)
+    fun mustRun(tx: [UInt8], coinbase: EVMAddress): Result {
+        let runResult = self.run(tx: tx, coinbase: coinbase)
+        assert(
+            runResult.status == Status.failed || runResult.status == Status.successful,
+            message: "tx is not valid for execution"
+        )
+        return runResult
     }
 
     access(all)
@@ -183,4 +366,130 @@ contract EVM {
 
         return InternalEVM.decodeABI(types: types, data: data)
     }
+
+    /// ValidationResult returns the result of COA ownership proof validation
+    access(all)
+    struct ValidationResult {
+        access(all)
+        let isValid: Bool
+
+        access(all)
+        let problem: String?
+
+        init(isValid: Bool, problem: String?) {
+            self.isValid = isValid
+            self.problem = problem
+        }
+    }
+
+    /// validateCOAOwnershipProof validates a COA ownership proof
+    access(all)
+    fun validateCOAOwnershipProof(
+        address: Address,
+        path: PublicPath,
+        signedData: [UInt8],
+        keyIndices: [UInt64],
+        signatures: [[UInt8]],
+        evmAddress: [UInt8; 20]
+    ): ValidationResult {
+
+        // make signature set first
+        // check number of signatures matches number of key indices
+        if keyIndices.length != signatures.length {
+            return ValidationResult(
+                isValid: false,
+                problem: "key indices size doesn't match the signatures"
+            )
+        }
+
+        var signatureSet: [Crypto.KeyListSignature] = []
+        for signatureIndex, signature in signatures{
+            signatureSet.append(Crypto.KeyListSignature(
+                keyIndex: Int(keyIndices[signatureIndex]),
+                signature: signature
+            ))
+        }
+
+        // fetch account
+        let acc = getAccount(address)
+
+        // constructing key list
+        let keyList = Crypto.KeyList()
+        for signature in signatureSet {
+            let key = acc.keys.get(keyIndex: signature.keyIndex)!
+            assert(!key.isRevoked, message: "revoked key is used")
+            keyList.add(
+              key.publicKey,
+              hashAlgorithm: key.hashAlgorithm,
+              weight: key.weight,
+           )
+        }
+
+        let isValid = keyList.verify(
+            signatureSet: signatureSet,
+            signedData: signedData
+        )
+
+        if !isValid{
+            return ValidationResult(
+                isValid: false,
+                problem: "the given signatures are not valid or provide enough weight"
+            )
+        }
+
+        let coaRef = acc.getCapability(path)
+            .borrow<&EVM.CadenceOwnedAccount{EVM.Addressable}>()
+
+        if coaRef == nil {
+             return ValidationResult(
+                 isValid: false,
+                 problem: "could not borrow bridge account's resource"
+             )
+        }
+
+        // verify evm address matching
+        var addr = coaRef!.address()
+        for index, item in coaRef!.address().bytes {
+            if item != evmAddress[index] {
+                return ValidationResult(
+                    isValid: false,
+                    problem: "evm address mismatch"
+                )
+            }
+        }
+
+        return ValidationResult(
+            isValid: true,
+            problem: nil
+        )
+    }
+
+    /// Block returns information about the latest executed block.
+    access(all)
+    struct EVMBlock {
+        access(all)
+        let height: UInt64
+
+        access(all)
+        let hash: String
+
+        access(all)
+        let totalSupply: Int
+
+        access(all)
+        let timestamp: UInt64
+
+        init(height: UInt64, hash: String, totalSupply: Int, timestamp: UInt64) {
+            self.height = height
+            self.hash = hash
+            self.totalSupply = totalSupply
+            self.timestamp = timestamp
+        }
+    }
+
+    /// Returns the latest executed block.
+    access(all)
+    fun getLatestBlock(): EVMBlock {
+        return InternalEVM.getLatestBlock() as! EVMBlock
+    }
 }
diff --git a/fvm/evm/stdlib/contract.go b/fvm/evm/stdlib/contract.go
index ba62334fffc..8f680c322d4 100644
--- a/fvm/evm/stdlib/contract.go
+++ b/fvm/evm/stdlib/contract.go
@@ -9,8 +9,6 @@ import (
 	"regexp"
 	"strings"
 
-	gethABI "github.com/ethereum/go-ethereum/accounts/abi"
-	gethCommon "github.com/ethereum/go-ethereum/common"
 	"github.com/onflow/cadence"
 	"github.com/onflow/cadence/runtime"
 	"github.com/onflow/cadence/runtime/common"
@@ -18,6 +16,8 @@ import (
 	"github.com/onflow/cadence/runtime/interpreter"
 	"github.com/onflow/cadence/runtime/sema"
 	"github.com/onflow/cadence/runtime/stdlib"
+	gethABI "github.com/onflow/go-ethereum/accounts/abi"
+	gethCommon "github.com/onflow/go-ethereum/common"
 
 	"github.com/onflow/flow-go/fvm/environment"
 	"github.com/onflow/flow-go/fvm/evm/types"
@@ -27,16 +27,9 @@ import (
 //go:embed contract.cdc
 var contractCode string
 
-//go:embed abiOnlyContract.cdc
-var abiOnlyContractCode string
-
-var flowTokenImportPattern = regexp.MustCompile(`^import "FlowToken"\n`)
-
-func ContractCode(flowTokenAddress flow.Address, evmAbiOnly bool) []byte {
-	if evmAbiOnly {
-		return []byte(abiOnlyContractCode)
-	}
+var flowTokenImportPattern = regexp.MustCompile(`(?m)^import "FlowToken"\n`)
 
+func ContractCode(flowTokenAddress flow.Address) []byte {
 	return []byte(flowTokenImportPattern.ReplaceAllString(
 		contractCode,
 		fmt.Sprintf("import FlowToken from %s", flowTokenAddress.HexWithPrefix()),
@@ -46,6 +39,10 @@ func ContractCode(flowTokenAddress flow.Address, evmAbiOnly bool) []byte {
 const ContractName = "EVM"
 const evmAddressTypeBytesFieldName = "bytes"
 const evmAddressTypeQualifiedIdentifier = "EVM.EVMAddress"
+const evmBalanceTypeQualifiedIdentifier = "EVM.Balance"
+const evmResultTypeQualifiedIdentifier = "EVM.Result"
+const evmStatusTypeQualifiedIdentifier = "EVM.Status"
+const evmBlockTypeQualifiedIdentifier = "EVM.EVMBlock"
 
 const abiEncodingByteSize = 32
 
@@ -926,7 +923,8 @@ var internalEVMTypeRunFunctionType = &sema.FunctionType{
 			TypeAnnotation: sema.NewTypeAnnotation(evmAddressBytesType),
 		},
 	},
-	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.BoolType),
+	// Actually EVM.Result, but cannot refer to it here
+	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.AnyStructType),
 }
 
 func newInternalEVMTypeRunFunction(
@@ -967,10 +965,62 @@ func newInternalEVMTypeRunFunction(
 			// Run
 
 			cb := types.NewAddressFromBytes(coinbase)
-			handler.Run(transaction, cb)
+			result := handler.Run(transaction, cb)
 
-			return interpreter.Void
+			return NewResultValue(handler, gauge, inter, locationRange, result)
+		},
+	)
+}
+
+func NewResultValue(
+	handler types.ContractHandler,
+	gauge common.MemoryGauge,
+	inter *interpreter.Interpreter,
+	locationRange interpreter.LocationRange,
+	result *types.ResultSummary,
+) *interpreter.CompositeValue {
+	loc := common.NewAddressLocation(gauge, handler.EVMContractAddress(), ContractName)
+	return interpreter.NewCompositeValue(
+		inter,
+		locationRange,
+		loc,
+		evmResultTypeQualifiedIdentifier,
+		common.CompositeKindStructure,
+		[]interpreter.CompositeField{
+			{
+				Name: "status",
+				Value: interpreter.NewEnumCaseValue(
+					inter,
+					locationRange,
+					&sema.CompositeType{
+						Location:   loc,
+						Identifier: evmStatusTypeQualifiedIdentifier,
+						Kind:       common.CompositeKindEnum,
+					},
+					interpreter.NewUInt8Value(gauge, func() uint8 {
+						return uint8(result.Status)
+					}),
+					nil,
+				),
+			},
+			{
+				Name: "errorCode",
+				Value: interpreter.NewUInt64Value(gauge, func() uint64 {
+					return uint64(result.ErrorCode)
+				}),
+			},
+			{
+				Name: "gasUsed",
+				Value: interpreter.NewUInt64Value(gauge, func() uint64 {
+					return result.GasConsumed
+				}),
+			},
+			{
+				Name:  "data",
+				Value: interpreter.ByteSliceToByteArrayValue(inter, result.ReturnedValue),
+			},
 		},
+		common.ZeroAddress,
 	)
 }
 
@@ -1019,10 +1069,11 @@ var internalEVMTypeCallFunctionType = &sema.FunctionType{
 		},
 		{
 			Label:          "value",
-			TypeAnnotation: sema.NewTypeAnnotation(sema.UFix64Type),
+			TypeAnnotation: sema.NewTypeAnnotation(sema.UIntType),
 		},
 	},
-	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.ByteArrayType),
+	// Actually EVM.Result, but cannot refer to it here
+	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.AnyStructType),
 }
 
 func AddressBytesArrayValueToEVMAddress(
@@ -1120,40 +1171,49 @@ func newInternalEVMTypeCallFunction(
 
 			// Get balance
 
-			balanceValue, ok := invocation.Arguments[4].(interpreter.UFix64Value)
+			balanceValue, ok := invocation.Arguments[4].(interpreter.UIntValue)
 			if !ok {
 				panic(errors.NewUnreachableError())
 			}
 
-			balance := types.Balance(balanceValue)
-
+			balance := types.NewBalance(balanceValue.BigInt)
 			// Call
 
 			const isAuthorized = true
 			account := handler.AccountByAddress(fromAddress, isAuthorized)
 			result := account.Call(toAddress, data, gasLimit, balance)
 
-			return interpreter.ByteSliceToByteArrayValue(inter, result)
+			return NewResultValue(handler, gauge, inter, locationRange, result)
 		},
 	)
 }
 
-const internalEVMTypeCreateBridgedAccountFunctionName = "createBridgedAccount"
+const internalEVMTypeCreateCadenceOwnedAccountFunctionName = "createCadenceOwnedAccount"
 
-var internalEVMTypeCreateBridgedAccountFunctionType = &sema.FunctionType{
+var internalEVMTypeCreateCadenceOwnedAccountFunctionType = &sema.FunctionType{
+	Parameters: []sema.Parameter{
+		{
+			Label:          "uuid",
+			TypeAnnotation: sema.NewTypeAnnotation(sema.UInt64Type),
+		},
+	},
 	ReturnTypeAnnotation: sema.NewTypeAnnotation(evmAddressBytesType),
 }
 
-func newInternalEVMTypeCreateBridgedAccountFunction(
+func newInternalEVMTypeCreateCadenceOwnedAccountFunction(
 	gauge common.MemoryGauge,
 	handler types.ContractHandler,
 ) *interpreter.HostFunctionValue {
 	return interpreter.NewHostFunctionValue(
 		gauge,
-		internalEVMTypeCreateBridgedAccountFunctionType,
+		internalEVMTypeCreateCadenceOwnedAccountFunctionType,
 		func(invocation interpreter.Invocation) interpreter.Value {
 			inter := invocation.Interpreter
-			address := handler.AllocateAddress()
+			uuid, ok := invocation.Arguments[0].(interpreter.UInt64Value)
+			if !ok {
+				panic(errors.NewUnreachableError())
+			}
+			address := handler.DeployCOA(uint64(uuid))
 			return EVMAddressToAddressBytesArrayValue(inter, address)
 		},
 	)
@@ -1204,7 +1264,7 @@ func newInternalEVMTypeDepositFunction(
 				panic(errors.NewUnreachableError())
 			}
 
-			amount := types.Balance(amountValue)
+			amount := types.NewBalanceFromUFix64(cadence.UFix64(amountValue))
 
 			// Get to address
 
@@ -1243,7 +1303,7 @@ var internalEVMTypeBalanceFunctionType = &sema.FunctionType{
 			TypeAnnotation: sema.NewTypeAnnotation(evmAddressBytesType),
 		},
 	},
-	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.UFix64Type),
+	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.UIntType),
 }
 
 // newInternalEVMTypeBalanceFunction returns the Flow balance of the account
@@ -1271,7 +1331,133 @@ func newInternalEVMTypeBalanceFunction(
 			const isAuthorized = false
 			account := handler.AccountByAddress(address, isAuthorized)
 
-			return interpreter.UFix64Value(account.Balance())
+			return interpreter.UIntValue{BigInt: account.Balance()}
+		},
+	)
+}
+
+const internalEVMTypeNonceFunctionName = "nonce"
+
+var internalEVMTypeNonceFunctionType = &sema.FunctionType{
+	Parameters: []sema.Parameter{
+		{
+			Label:          "address",
+			TypeAnnotation: sema.NewTypeAnnotation(evmAddressBytesType),
+		},
+	},
+	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.UInt64Type),
+}
+
+// newInternalEVMTypeNonceFunction returns the nonce of the account
+func newInternalEVMTypeNonceFunction(
+	gauge common.MemoryGauge,
+	handler types.ContractHandler,
+) *interpreter.HostFunctionValue {
+	return interpreter.NewHostFunctionValue(
+		gauge,
+		internalEVMTypeCallFunctionType,
+		func(invocation interpreter.Invocation) interpreter.Value {
+			inter := invocation.Interpreter
+			locationRange := invocation.LocationRange
+
+			addressValue, ok := invocation.Arguments[0].(*interpreter.ArrayValue)
+			if !ok {
+				panic(errors.NewUnreachableError())
+			}
+
+			address, err := AddressBytesArrayValueToEVMAddress(inter, locationRange, addressValue)
+			if err != nil {
+				panic(err)
+			}
+
+			const isAuthorized = false
+			account := handler.AccountByAddress(address, isAuthorized)
+
+			return interpreter.UInt64Value(account.Nonce())
+		},
+	)
+}
+
+const internalEVMTypeCodeFunctionName = "code"
+
+var internalEVMTypeCodeFunctionType = &sema.FunctionType{
+	Parameters: []sema.Parameter{
+		{
+			Label:          "address",
+			TypeAnnotation: sema.NewTypeAnnotation(evmAddressBytesType),
+		},
+	},
+	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.ByteArrayType),
+}
+
+// newInternalEVMTypeCodeFunction returns the code of the account
+func newInternalEVMTypeCodeFunction(
+	gauge common.MemoryGauge,
+	handler types.ContractHandler,
+) *interpreter.HostFunctionValue {
+	return interpreter.NewHostFunctionValue(
+		gauge,
+		internalEVMTypeCallFunctionType,
+		func(invocation interpreter.Invocation) interpreter.Value {
+			inter := invocation.Interpreter
+			locationRange := invocation.LocationRange
+
+			addressValue, ok := invocation.Arguments[0].(*interpreter.ArrayValue)
+			if !ok {
+				panic(errors.NewUnreachableError())
+			}
+
+			address, err := AddressBytesArrayValueToEVMAddress(inter, locationRange, addressValue)
+			if err != nil {
+				panic(err)
+			}
+
+			const isAuthorized = false
+			account := handler.AccountByAddress(address, isAuthorized)
+
+			return interpreter.ByteSliceToByteArrayValue(inter, account.Code())
+		},
+	)
+}
+
+const internalEVMTypeCodeHashFunctionName = "codeHash"
+
+var internalEVMTypeCodeHashFunctionType = &sema.FunctionType{
+	Parameters: []sema.Parameter{
+		{
+			Label:          "address",
+			TypeAnnotation: sema.NewTypeAnnotation(evmAddressBytesType),
+		},
+	},
+	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.ByteArrayType),
+}
+
+// newInternalEVMTypeCodeHashFunction returns the code hash of the account
+func newInternalEVMTypeCodeHashFunction(
+	gauge common.MemoryGauge,
+	handler types.ContractHandler,
+) *interpreter.HostFunctionValue {
+	return interpreter.NewHostFunctionValue(
+		gauge,
+		internalEVMTypeCallFunctionType,
+		func(invocation interpreter.Invocation) interpreter.Value {
+			inter := invocation.Interpreter
+			locationRange := invocation.LocationRange
+
+			addressValue, ok := invocation.Arguments[0].(*interpreter.ArrayValue)
+			if !ok {
+				panic(errors.NewUnreachableError())
+			}
+
+			address, err := AddressBytesArrayValueToEVMAddress(inter, locationRange, addressValue)
+			if err != nil {
+				panic(err)
+			}
+
+			const isAuthorized = false
+			account := handler.AccountByAddress(address, isAuthorized)
+
+			return interpreter.ByteSliceToByteArrayValue(inter, account.CodeHash())
 		},
 	)
 }
@@ -1286,7 +1472,7 @@ var internalEVMTypeWithdrawFunctionType = &sema.FunctionType{
 		},
 		{
 			Label:          "amount",
-			TypeAnnotation: sema.NewTypeAnnotation(sema.UFix64Type),
+			TypeAnnotation: sema.NewTypeAnnotation(sema.UIntType),
 		},
 	},
 	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.AnyResourceType),
@@ -1317,12 +1503,12 @@ func newInternalEVMTypeWithdrawFunction(
 
 			// Get amount
 
-			amountValue, ok := invocation.Arguments[1].(interpreter.UFix64Value)
+			amountValue, ok := invocation.Arguments[1].(interpreter.UIntValue)
 			if !ok {
 				panic(errors.NewUnreachableError())
 			}
 
-			amount := types.Balance(amountValue)
+			amount := types.NewBalance(amountValue.BigInt)
 
 			// Withdraw
 
@@ -1330,6 +1516,14 @@ func newInternalEVMTypeWithdrawFunction(
 			account := handler.AccountByAddress(fromAddress, isAuthorized)
 			vault := account.Withdraw(amount)
 
+			ufix, roundedOff, err := types.ConvertBalanceToUFix64(vault.Balance())
+			if err != nil {
+				panic(err)
+			}
+			if roundedOff {
+				panic(types.ErrWithdrawBalanceRounding)
+			}
+
 			// TODO: improve: maybe call actual constructor
 			return interpreter.NewCompositeValue(
 				inter,
@@ -1341,7 +1535,13 @@ func newInternalEVMTypeWithdrawFunction(
 					{
 						Name: "balance",
 						Value: interpreter.NewUFix64Value(gauge, func() uint64 {
-							return uint64(vault.Balance())
+							return uint64(ufix)
+						}),
+					},
+					{
+						Name: sema.ResourceUUIDFieldName,
+						Value: interpreter.NewUInt64Value(gauge, func() uint64 {
+							return handler.GenerateResourceUUID()
 						}),
 					},
 				},
@@ -1369,7 +1569,7 @@ var internalEVMTypeDeployFunctionType = &sema.FunctionType{
 		},
 		{
 			Label:          "value",
-			TypeAnnotation: sema.NewTypeAnnotation(sema.UFix64Type),
+			TypeAnnotation: sema.NewTypeAnnotation(sema.UIntType),
 		},
 	},
 	ReturnTypeAnnotation: sema.NewTypeAnnotation(evmAddressBytesType),
@@ -1421,12 +1621,12 @@ func newInternalEVMTypeDeployFunction(
 
 			// Get value
 
-			amountValue, ok := invocation.Arguments[3].(interpreter.UFix64Value)
+			amountValue, ok := invocation.Arguments[3].(interpreter.UIntValue)
 			if !ok {
 				panic(errors.NewUnreachableError())
 			}
 
-			amount := types.Balance(amountValue)
+			amount := types.NewBalance(amountValue.BigInt)
 
 			// Deploy
 
@@ -1439,6 +1639,149 @@ func newInternalEVMTypeDeployFunction(
 	)
 }
 
+const internalEVMTypeCastToAttoFLOWFunctionName = "castToAttoFLOW"
+
+var internalEVMTypeCastToAttoFLOWFunctionType = &sema.FunctionType{
+	Parameters: []sema.Parameter{
+		{
+			Label:          "balance",
+			TypeAnnotation: sema.NewTypeAnnotation(sema.UFix64Type),
+		},
+	},
+	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.UIntType),
+}
+
+func newInternalEVMTypeCastToAttoFLOWFunction(
+	gauge common.MemoryGauge,
+	handler types.ContractHandler,
+) *interpreter.HostFunctionValue {
+	return interpreter.NewHostFunctionValue(
+		gauge,
+		internalEVMTypeCallFunctionType,
+		func(invocation interpreter.Invocation) interpreter.Value {
+			balanceValue, ok := invocation.Arguments[0].(interpreter.UFix64Value)
+			if !ok {
+				panic(errors.NewUnreachableError())
+			}
+			balance := types.NewBalanceFromUFix64(cadence.UFix64(balanceValue))
+			return interpreter.UIntValue{BigInt: balance}
+		},
+	)
+}
+
+const internalEVMTypeCastToFLOWFunctionName = "castToFLOW"
+
+var internalEVMTypeCastToFLOWFunctionType = &sema.FunctionType{
+	Parameters: []sema.Parameter{
+		{
+			Label:          "balance",
+			TypeAnnotation: sema.NewTypeAnnotation(sema.UIntType),
+		},
+	},
+	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.UFix64Type),
+}
+
+func newInternalEVMTypeCastToFLOWFunction(
+	gauge common.MemoryGauge,
+	handler types.ContractHandler,
+) *interpreter.HostFunctionValue {
+	return interpreter.NewHostFunctionValue(
+		gauge,
+		internalEVMTypeCallFunctionType,
+		func(invocation interpreter.Invocation) interpreter.Value {
+			balanceValue, ok := invocation.Arguments[0].(interpreter.UIntValue)
+			if !ok {
+				panic(errors.NewUnreachableError())
+			}
+			balance := types.NewBalance(balanceValue.BigInt)
+			// ignoring the rounding error and let user handle it
+			v, _, err := types.ConvertBalanceToUFix64(balance)
+			if err != nil {
+				panic(err)
+			}
+			return interpreter.UFix64Value(v)
+		},
+	)
+}
+
+const internalEVMTypeGetLatestBlockFunctionName = "getLatestBlock"
+
+var internalEVMTypeGetLatestBlockFunctionType = &sema.FunctionType{
+	Parameters: []sema.Parameter{},
+	// Actually EVM.Block, but cannot refer to it here
+	ReturnTypeAnnotation: sema.NewTypeAnnotation(sema.AnyStructType),
+}
+
+func newInternalEVMTypeGetLatestBlockFunction(
+	gauge common.MemoryGauge,
+	handler types.ContractHandler,
+) *interpreter.HostFunctionValue {
+	return interpreter.NewHostFunctionValue(
+		gauge,
+		internalEVMTypeCallFunctionType,
+		func(invocation interpreter.Invocation) interpreter.Value {
+			inter := invocation.Interpreter
+			locationRange := invocation.LocationRange
+
+			latestBlock := handler.LastExecutedBlock()
+			return NewEVMBlockValue(handler, gauge, inter, locationRange, latestBlock)
+		},
+	)
+}
+
+func NewEVMBlockValue(
+	handler types.ContractHandler,
+	gauge common.MemoryGauge,
+	inter *interpreter.Interpreter,
+	locationRange interpreter.LocationRange,
+	block *types.Block,
+) *interpreter.CompositeValue {
+	loc := common.NewAddressLocation(gauge, handler.EVMContractAddress(), ContractName)
+	hash, err := block.Hash()
+	if err != nil {
+		panic(err)
+	}
+
+	return interpreter.NewCompositeValue(
+		inter,
+		locationRange,
+		loc,
+		evmBlockTypeQualifiedIdentifier,
+		common.CompositeKindStructure,
+		[]interpreter.CompositeField{
+			{
+				Name:  "height",
+				Value: interpreter.UInt64Value(block.Height),
+			},
+			{
+				Name: "hash",
+				Value: interpreter.NewStringValue(
+					inter,
+					common.NewStringMemoryUsage(len(hash)),
+					func() string {
+						return hash.Hex()
+					},
+				),
+			},
+			{
+				Name: "totalSupply",
+				Value: interpreter.NewIntValueFromBigInt(
+					inter,
+					common.NewBigIntMemoryUsage(common.BigIntByteLength(block.TotalSupply)),
+					func() *big.Int {
+						return block.TotalSupply
+					},
+				),
+			},
+			{
+				Name:  "timestamp",
+				Value: interpreter.UInt64Value(block.Timestamp),
+			},
+		},
+		common.ZeroAddress,
+	)
+}
+
 func NewInternalEVMContractValue(
 	gauge common.MemoryGauge,
 	handler types.ContractHandler,
@@ -1450,15 +1793,21 @@ func NewInternalEVMContractValue(
 		internalEVMContractStaticType,
 		InternalEVMContractType.Fields,
 		map[string]interpreter.Value{
-			internalEVMTypeRunFunctionName:                  newInternalEVMTypeRunFunction(gauge, handler),
-			internalEVMTypeCreateBridgedAccountFunctionName: newInternalEVMTypeCreateBridgedAccountFunction(gauge, handler),
-			internalEVMTypeCallFunctionName:                 newInternalEVMTypeCallFunction(gauge, handler),
-			internalEVMTypeDepositFunctionName:              newInternalEVMTypeDepositFunction(gauge, handler),
-			internalEVMTypeWithdrawFunctionName:             newInternalEVMTypeWithdrawFunction(gauge, handler),
-			internalEVMTypeDeployFunctionName:               newInternalEVMTypeDeployFunction(gauge, handler),
-			internalEVMTypeBalanceFunctionName:              newInternalEVMTypeBalanceFunction(gauge, handler),
-			internalEVMTypeEncodeABIFunctionName:            newInternalEVMTypeEncodeABIFunction(gauge, location),
-			internalEVMTypeDecodeABIFunctionName:            newInternalEVMTypeDecodeABIFunction(gauge, location),
+			internalEVMTypeRunFunctionName:                       newInternalEVMTypeRunFunction(gauge, handler),
+			internalEVMTypeCreateCadenceOwnedAccountFunctionName: newInternalEVMTypeCreateCadenceOwnedAccountFunction(gauge, handler),
+			internalEVMTypeCallFunctionName:                      newInternalEVMTypeCallFunction(gauge, handler),
+			internalEVMTypeDepositFunctionName:                   newInternalEVMTypeDepositFunction(gauge, handler),
+			internalEVMTypeWithdrawFunctionName:                  newInternalEVMTypeWithdrawFunction(gauge, handler),
+			internalEVMTypeDeployFunctionName:                    newInternalEVMTypeDeployFunction(gauge, handler),
+			internalEVMTypeBalanceFunctionName:                   newInternalEVMTypeBalanceFunction(gauge, handler),
+			internalEVMTypeNonceFunctionName:                     newInternalEVMTypeNonceFunction(gauge, handler),
+			internalEVMTypeCodeFunctionName:                      newInternalEVMTypeCodeFunction(gauge, handler),
+			internalEVMTypeCodeHashFunctionName:                  newInternalEVMTypeCodeHashFunction(gauge, handler),
+			internalEVMTypeEncodeABIFunctionName:                 newInternalEVMTypeEncodeABIFunction(gauge, location),
+			internalEVMTypeDecodeABIFunctionName:                 newInternalEVMTypeDecodeABIFunction(gauge, location),
+			internalEVMTypeCastToAttoFLOWFunctionName:            newInternalEVMTypeCastToAttoFLOWFunction(gauge, handler),
+			internalEVMTypeCastToFLOWFunctionName:                newInternalEVMTypeCastToFLOWFunction(gauge, handler),
+			internalEVMTypeGetLatestBlockFunctionName:            newInternalEVMTypeGetLatestBlockFunction(gauge, handler),
 		},
 		nil,
 		nil,
@@ -1483,8 +1832,8 @@ var InternalEVMContractType = func() *sema.CompositeType {
 		),
 		sema.NewUnmeteredPublicFunctionMember(
 			ty,
-			internalEVMTypeCreateBridgedAccountFunctionName,
-			internalEVMTypeCreateBridgedAccountFunctionType,
+			internalEVMTypeCreateCadenceOwnedAccountFunctionName,
+			internalEVMTypeCreateCadenceOwnedAccountFunctionType,
 			"",
 		),
 		sema.NewUnmeteredPublicFunctionMember(
@@ -1511,12 +1860,42 @@ var InternalEVMContractType = func() *sema.CompositeType {
 			internalEVMTypeDeployFunctionType,
 			"",
 		),
+		sema.NewUnmeteredPublicFunctionMember(
+			ty,
+			internalEVMTypeCastToAttoFLOWFunctionName,
+			internalEVMTypeCastToAttoFLOWFunctionType,
+			"",
+		),
+		sema.NewUnmeteredPublicFunctionMember(
+			ty,
+			internalEVMTypeCastToFLOWFunctionName,
+			internalEVMTypeCastToFLOWFunctionType,
+			"",
+		),
 		sema.NewUnmeteredPublicFunctionMember(
 			ty,
 			internalEVMTypeBalanceFunctionName,
 			internalEVMTypeBalanceFunctionType,
 			"",
 		),
+		sema.NewUnmeteredPublicFunctionMember(
+			ty,
+			internalEVMTypeNonceFunctionName,
+			internalEVMTypeNonceFunctionType,
+			"",
+		),
+		sema.NewUnmeteredPublicFunctionMember(
+			ty,
+			internalEVMTypeCodeFunctionName,
+			internalEVMTypeCodeFunctionType,
+			"",
+		),
+		sema.NewUnmeteredPublicFunctionMember(
+			ty,
+			internalEVMTypeCodeHashFunctionName,
+			internalEVMTypeCodeHashFunctionType,
+			"",
+		),
 		sema.NewUnmeteredPublicFunctionMember(
 			ty,
 			internalEVMTypeEncodeABIFunctionName,
@@ -1529,6 +1908,12 @@ var InternalEVMContractType = func() *sema.CompositeType {
 			internalEVMTypeDecodeABIFunctionType,
 			"",
 		),
+		sema.NewUnmeteredPublicFunctionMember(
+			ty,
+			internalEVMTypeGetLatestBlockFunctionName,
+			internalEVMTypeGetLatestBlockFunctionType,
+			"",
+		),
 	})
 	return ty
 }()
@@ -1557,8 +1942,12 @@ var internalEVMStandardLibraryType = stdlib.StandardLibraryType{
 	Kind: common.DeclarationKindContract,
 }
 
-func SetupEnvironment(env runtime.Environment, handler types.ContractHandler, service flow.Address) {
-	location := common.NewAddressLocation(nil, common.Address(service), ContractName)
+func SetupEnvironment(
+	env runtime.Environment,
+	handler types.ContractHandler,
+	contractAddress flow.Address,
+) {
+	location := common.NewAddressLocation(nil, common.Address(contractAddress), ContractName)
 
 	env.DeclareType(
 		internalEVMStandardLibraryType,
@@ -1587,11 +1976,85 @@ func NewEVMAddressCadenceType(address common.Address) *cadence.StructType {
 func NewBalanceCadenceType(address common.Address) *cadence.StructType {
 	return cadence.NewStructType(
 		common.NewAddressLocation(nil, address, ContractName),
-		"EVM.Balance",
+		evmBalanceTypeQualifiedIdentifier,
 		[]cadence.Field{
 			{
-				Identifier: "flow",
-				Type:       cadence.UFix64Type{},
+				Identifier: "attoflow",
+				Type:       cadence.UIntType{},
+			},
+		},
+		nil,
+	)
+}
+
+func ResultSummaryFromEVMResultValue(val cadence.Value) (*types.ResultSummary, error) {
+	str, ok := val.(cadence.Struct)
+	if !ok {
+		return nil, fmt.Errorf("invalid input: unexpected value type")
+	}
+	if len(str.Fields) != 4 {
+		return nil, fmt.Errorf("invalid input: field count mismatch")
+	}
+
+	statusEnum, ok := str.Fields[0].(cadence.Enum)
+	if !ok {
+		return nil, fmt.Errorf("invalid input: unexpected type for status field")
+	}
+
+	status, ok := statusEnum.Fields[0].(cadence.UInt8)
+	if !ok {
+		return nil, fmt.Errorf("invalid input: unexpected type for status field")
+	}
+
+	errorCode, ok := str.Fields[1].(cadence.UInt64)
+	if !ok {
+		return nil, fmt.Errorf("invalid input: unexpected type for error code field")
+	}
+
+	gasUsed, ok := str.Fields[2].(cadence.UInt64)
+	if !ok {
+		return nil, fmt.Errorf("invalid input: unexpected type for gas field")
+	}
+
+	data, ok := str.Fields[3].(cadence.Array)
+	if !ok {
+		return nil, fmt.Errorf("invalid input: unexpected type for data field")
+	}
+
+	convertedData := make([]byte, len(data.Values))
+	for i, value := range data.Values {
+		convertedData[i] = value.(cadence.UInt8).ToGoValue().(uint8)
+	}
+
+	return &types.ResultSummary{
+		Status:        types.Status(status),
+		ErrorCode:     types.ErrorCode(errorCode),
+		GasConsumed:   uint64(gasUsed),
+		ReturnedValue: convertedData,
+	}, nil
+
+}
+
+func NewEVMBlockCadenceType(address common.Address) *cadence.StructType {
+	return cadence.NewStructType(
+		common.NewAddressLocation(nil, address, ContractName),
+		evmBlockTypeQualifiedIdentifier,
+		[]cadence.Field{
+			{
+				Identifier: "height",
+				Type:       cadence.UInt64Type{},
+			},
+			{
+				Identifier: "hash",
+				Type:       cadence.StringType{},
+			},
+			{
+				Identifier: "totalSupply",
+				Type:       cadence.IntType{},
+			},
+			{
+				Identifier: "timestamp",
+				Type:       cadence.UInt64Type{},
 			},
 		},
 		nil,
diff --git a/fvm/evm/stdlib/contract_test.go b/fvm/evm/stdlib/contract_test.go
index 0e75a8b3da8..32650c40506 100644
--- a/fvm/evm/stdlib/contract_test.go
+++ b/fvm/evm/stdlib/contract_test.go
@@ -2,15 +2,18 @@ package stdlib_test
 
 import (
 	"encoding/binary"
+	"math/big"
 	"testing"
 
-	"github.com/ethereum/go-ethereum/crypto"
 	"github.com/onflow/cadence"
 	"github.com/onflow/cadence/encoding/json"
 	"github.com/onflow/cadence/runtime"
 	"github.com/onflow/cadence/runtime/common"
+	"github.com/onflow/cadence/runtime/sema"
+	cadenceStdlib "github.com/onflow/cadence/runtime/stdlib"
 	"github.com/onflow/cadence/runtime/tests/utils"
 	coreContracts "github.com/onflow/flow-core-contracts/lib/go/contracts"
+	"github.com/onflow/go-ethereum/crypto"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -23,28 +26,32 @@ import (
 )
 
 type testContractHandler struct {
-	flowTokenAddress  common.Address
-	allocateAddress   func() types.Address
-	addressIndex      uint64
-	accountByAddress  func(types.Address, bool) types.Account
-	lastExecutedBlock func() *types.Block
-	run               func(tx []byte, coinbase types.Address)
+	flowTokenAddress     common.Address
+	evmContractAddress   common.Address
+	deployCOA            func(uint64) types.Address
+	accountByAddress     func(types.Address, bool) types.Account
+	lastExecutedBlock    func() *types.Block
+	run                  func(tx []byte, coinbase types.Address) *types.ResultSummary
+	generateResourceUUID func() uint64
 }
 
+var _ types.ContractHandler = &testContractHandler{}
+
 func (t *testContractHandler) FlowTokenAddress() common.Address {
 	return t.flowTokenAddress
 }
 
-var _ types.ContractHandler = &testContractHandler{}
+func (t *testContractHandler) EVMContractAddress() common.Address {
+	return t.evmContractAddress
+}
 
-func (t *testContractHandler) AllocateAddress() types.Address {
-	if t.allocateAddress == nil {
-		t.addressIndex++
+func (t *testContractHandler) DeployCOA(uuid uint64) types.Address {
+	if t.deployCOA == nil {
 		var address types.Address
-		binary.LittleEndian.PutUint64(address[:], t.addressIndex)
+		binary.LittleEndian.PutUint64(address[:], uuid)
 		return address
 	}
-	return t.allocateAddress()
+	return t.deployCOA(uuid)
 }
 
 func (t *testContractHandler) AccountByAddress(addr types.Address, isAuthorized bool) types.Account {
@@ -61,21 +68,31 @@ func (t *testContractHandler) LastExecutedBlock() *types.Block {
 	return t.lastExecutedBlock()
 }
 
-func (t *testContractHandler) Run(tx []byte, coinbase types.Address) {
+func (t *testContractHandler) Run(tx []byte, coinbase types.Address) *types.ResultSummary {
 	if t.run == nil {
 		panic("unexpected Run")
 	}
-	t.run(tx, coinbase)
+	return t.run(tx, coinbase)
+}
+
+func (t *testContractHandler) GenerateResourceUUID() uint64 {
+	if t.generateResourceUUID == nil {
+		panic("unexpected GenerateResourceUUID")
+	}
+	return t.generateResourceUUID()
 }
 
 type testFlowAccount struct {
 	address  types.Address
 	balance  func() types.Balance
+	code     func() types.Code
+	codeHash func() []byte
+	nonce    func() uint64
 	transfer func(address types.Address, balance types.Balance)
 	deposit  func(vault *types.FLOWTokenVault)
 	withdraw func(balance types.Balance) *types.FLOWTokenVault
 	deploy   func(code types.Code, limit types.GasLimit, balance types.Balance) types.Address
-	call     func(address types.Address, data types.Data, limit types.GasLimit, balance types.Balance) types.Data
+	call     func(address types.Address, data types.Data, limit types.GasLimit, balance types.Balance) *types.ResultSummary
 }
 
 var _ types.Account = &testFlowAccount{}
@@ -86,11 +103,32 @@ func (t *testFlowAccount) Address() types.Address {
 
 func (t *testFlowAccount) Balance() types.Balance {
 	if t.balance == nil {
-		return types.Balance(0)
+		return types.NewBalanceFromUFix64(0)
 	}
 	return t.balance()
 }
 
+func (t *testFlowAccount) Code() types.Code {
+	if t.code == nil {
+		return types.Code{}
+	}
+	return t.code()
+}
+
+func (t *testFlowAccount) CodeHash() []byte {
+	if t.codeHash == nil {
+		return nil
+	}
+	return t.codeHash()
+}
+
+func (t *testFlowAccount) Nonce() uint64 {
+	if t.nonce == nil {
+		return 0
+	}
+	return t.nonce()
+}
+
 func (t *testFlowAccount) Transfer(address types.Address, balance types.Balance) {
 	if t.transfer == nil {
 		panic("unexpected Transfer")
@@ -119,7 +157,7 @@ func (t *testFlowAccount) Deploy(code types.Code, limit types.GasLimit, balance
 	return t.deploy(code, limit, balance)
 }
 
-func (t *testFlowAccount) Call(address types.Address, data types.Data, limit types.GasLimit, balance types.Balance) types.Data {
+func (t *testFlowAccount) Call(address types.Address, data types.Data, limit types.GasLimit, balance types.Balance) *types.ResultSummary {
 	if t.call == nil {
 		panic("unexpected Call")
 	}
@@ -133,7 +171,6 @@ func deployContracts(
 	runtimeInterface *TestRuntimeInterface,
 	transactionEnvironment runtime.Environment,
 	nextTransactionLocation func() common.TransactionLocation,
-	evmAbiOnly bool,
 ) {
 
 	contractsAddressHex := contractsAddress.Hex()
@@ -186,7 +223,7 @@ func deployContracts(
 		},
 		{
 			name: stdlib.ContractName,
-			code: stdlib.ContractCode(contractsAddress, evmAbiOnly),
+			code: stdlib.ContractCode(contractsAddress),
 		},
 	}
 
@@ -216,25 +253,25 @@ func deployContracts(
 
 }
 
-func newEVMTransactionEnvironment(handler types.ContractHandler, service flow.Address) runtime.Environment {
+func newEVMTransactionEnvironment(handler types.ContractHandler, contractAddress flow.Address) runtime.Environment {
 	transactionEnvironment := runtime.NewBaseInterpreterEnvironment(runtime.Config{})
 
 	stdlib.SetupEnvironment(
 		transactionEnvironment,
 		handler,
-		service,
+		contractAddress,
 	)
 
 	return transactionEnvironment
 }
 
-func newEVMScriptEnvironment(handler types.ContractHandler, service flow.Address) runtime.Environment {
+func newEVMScriptEnvironment(handler types.ContractHandler, contractAddress flow.Address) runtime.Environment {
 	scriptEnvironment := runtime.NewScriptInterpreterEnvironment(runtime.Config{})
 
 	stdlib.SetupEnvironment(
 		scriptEnvironment,
 		handler,
-		service,
+		contractAddress,
 	)
 
 	return scriptEnvironment
@@ -271,7 +308,7 @@ func TestEVMEncodeABI(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -307,7 +344,6 @@ func TestEVMEncodeABI(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		true,
 	)
 
 	// Run script
@@ -400,7 +436,7 @@ func TestEVMEncodeABIComputation(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -436,7 +472,6 @@ func TestEVMEncodeABIComputation(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		true,
 	)
 
 	// Run script
@@ -496,7 +531,7 @@ func TestEVMEncodeABIComputationEmptyDynamicVariables(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -532,7 +567,6 @@ func TestEVMEncodeABIComputationEmptyDynamicVariables(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		true,
 	)
 
 	// Run script
@@ -601,7 +635,7 @@ func TestEVMEncodeABIComputationDynamicVariablesAboveChunkSize(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -637,7 +671,6 @@ func TestEVMEncodeABIComputationDynamicVariablesAboveChunkSize(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		true,
 	)
 
 	// Run script
@@ -700,7 +733,7 @@ func TestEVMDecodeABI(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -736,7 +769,6 @@ func TestEVMDecodeABI(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		true,
 	)
 
 	// Run script
@@ -835,7 +867,7 @@ func TestEVMDecodeABIComputation(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -871,7 +903,6 @@ func TestEVMDecodeABIComputation(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		true,
 	)
 
 	// Run script
@@ -1115,7 +1146,7 @@ func TestEVMEncodeDecodeABIRoundtrip(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -1145,7 +1176,6 @@ func TestEVMEncodeDecodeABIRoundtrip(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		true,
 	)
 
 	// Run script
@@ -1194,7 +1224,7 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			OnGetSigningAccounts: func() ([]runtime.Address, error) {
 				return []runtime.Address{runtime.Address(contractsAddress)}, nil
 			},
-			OnResolveLocation: SingleIdentifierLocationResolver(t),
+			OnResolveLocation: LocationResolver,
 			OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 				accountCodes[location] = code
 				return nil
@@ -1224,7 +1254,6 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			runtimeInterface,
 			transactionEnvironment,
 			nextTransactionLocation,
-			true,
 		)
 
 		// Run script
@@ -1281,7 +1310,7 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			OnGetSigningAccounts: func() ([]runtime.Address, error) {
 				return []runtime.Address{runtime.Address(contractsAddress)}, nil
 			},
-			OnResolveLocation: SingleIdentifierLocationResolver(t),
+			OnResolveLocation: LocationResolver,
 			OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 				accountCodes[location] = code
 				return nil
@@ -1311,7 +1340,6 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			runtimeInterface,
 			transactionEnvironment,
 			nextTransactionLocation,
-			true,
 		)
 
 		// Run script
@@ -1367,7 +1395,7 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			OnGetSigningAccounts: func() ([]runtime.Address, error) {
 				return []runtime.Address{runtime.Address(contractsAddress)}, nil
 			},
-			OnResolveLocation: SingleIdentifierLocationResolver(t),
+			OnResolveLocation: LocationResolver,
 			OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 				accountCodes[location] = code
 				return nil
@@ -1397,7 +1425,6 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			runtimeInterface,
 			transactionEnvironment,
 			nextTransactionLocation,
-			true,
 		)
 
 		// Run script
@@ -1454,7 +1481,7 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			OnGetSigningAccounts: func() ([]runtime.Address, error) {
 				return []runtime.Address{runtime.Address(contractsAddress)}, nil
 			},
-			OnResolveLocation: SingleIdentifierLocationResolver(t),
+			OnResolveLocation: LocationResolver,
 			OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 				accountCodes[location] = code
 				return nil
@@ -1484,7 +1511,6 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			runtimeInterface,
 			transactionEnvironment,
 			nextTransactionLocation,
-			true,
 		)
 
 		// Run script
@@ -1541,7 +1567,7 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			OnGetSigningAccounts: func() ([]runtime.Address, error) {
 				return []runtime.Address{runtime.Address(contractsAddress)}, nil
 			},
-			OnResolveLocation: SingleIdentifierLocationResolver(t),
+			OnResolveLocation: LocationResolver,
 			OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 				accountCodes[location] = code
 				return nil
@@ -1571,7 +1597,6 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			runtimeInterface,
 			transactionEnvironment,
 			nextTransactionLocation,
-			true,
 		)
 
 		// Run script
@@ -1581,9 +1606,9 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 
           access(all) struct Token {
             access(all) let id: Int
-            access(all) var balance: Int
+            access(all) var balance: UInt
 
-            init(id: Int, balance: Int) {
+            init(id: Int, balance: UInt) {
               self.id = id
               self.balance = balance
             }
@@ -1638,7 +1663,7 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			OnGetSigningAccounts: func() ([]runtime.Address, error) {
 				return []runtime.Address{runtime.Address(contractsAddress)}, nil
 			},
-			OnResolveLocation: SingleIdentifierLocationResolver(t),
+			OnResolveLocation: LocationResolver,
 			OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 				accountCodes[location] = code
 				return nil
@@ -1668,7 +1693,6 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			runtimeInterface,
 			transactionEnvironment,
 			nextTransactionLocation,
-			true,
 		)
 
 		// Run script
@@ -1725,7 +1749,7 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			OnGetSigningAccounts: func() ([]runtime.Address, error) {
 				return []runtime.Address{runtime.Address(contractsAddress)}, nil
 			},
-			OnResolveLocation: SingleIdentifierLocationResolver(t),
+			OnResolveLocation: LocationResolver,
 			OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 				accountCodes[location] = code
 				return nil
@@ -1755,7 +1779,6 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			runtimeInterface,
 			transactionEnvironment,
 			nextTransactionLocation,
-			true,
 		)
 
 		// Run script
@@ -1812,7 +1835,7 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			OnGetSigningAccounts: func() ([]runtime.Address, error) {
 				return []runtime.Address{runtime.Address(contractsAddress)}, nil
 			},
-			OnResolveLocation: SingleIdentifierLocationResolver(t),
+			OnResolveLocation: LocationResolver,
 			OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 				accountCodes[location] = code
 				return nil
@@ -1842,7 +1865,6 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			runtimeInterface,
 			transactionEnvironment,
 			nextTransactionLocation,
-			true,
 		)
 
 		// Run script
@@ -1899,7 +1921,7 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			OnGetSigningAccounts: func() ([]runtime.Address, error) {
 				return []runtime.Address{runtime.Address(contractsAddress)}, nil
 			},
-			OnResolveLocation: SingleIdentifierLocationResolver(t),
+			OnResolveLocation: LocationResolver,
 			OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 				accountCodes[location] = code
 				return nil
@@ -1929,7 +1951,6 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			runtimeInterface,
 			transactionEnvironment,
 			nextTransactionLocation,
-			true,
 		)
 
 		// Run script
@@ -1986,7 +2007,7 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			OnGetSigningAccounts: func() ([]runtime.Address, error) {
 				return []runtime.Address{runtime.Address(contractsAddress)}, nil
 			},
-			OnResolveLocation: SingleIdentifierLocationResolver(t),
+			OnResolveLocation: LocationResolver,
 			OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 				accountCodes[location] = code
 				return nil
@@ -2016,7 +2037,6 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			runtimeInterface,
 			transactionEnvironment,
 			nextTransactionLocation,
-			true,
 		)
 
 		// Run script
@@ -2073,7 +2093,7 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			OnGetSigningAccounts: func() ([]runtime.Address, error) {
 				return []runtime.Address{runtime.Address(contractsAddress)}, nil
 			},
-			OnResolveLocation: SingleIdentifierLocationResolver(t),
+			OnResolveLocation: LocationResolver,
 			OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 				accountCodes[location] = code
 				return nil
@@ -2103,7 +2123,6 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 			runtimeInterface,
 			transactionEnvironment,
 			nextTransactionLocation,
-			true,
 		)
 
 		// Run script
@@ -2113,9 +2132,9 @@ func TestEVMEncodeDecodeABIErrors(t *testing.T) {
 
           access(all) struct Token {
             access(all) let id: Int
-            access(all) var balance: Int
+            access(all) var balance: UInt
 
-            init(id: Int, balance: Int) {
+            init(id: Int, balance: UInt) {
               self.id = id
               self.balance = balance
             }
@@ -2192,7 +2211,7 @@ func TestEVMEncodeABIWithSignature(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -2235,7 +2254,6 @@ func TestEVMEncodeABIWithSignature(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		true,
 	)
 
 	// Run script
@@ -2326,7 +2344,7 @@ func TestEVMDecodeABIWithSignature(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -2369,7 +2387,6 @@ func TestEVMDecodeABIWithSignature(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		true,
 	)
 
 	// Run script
@@ -2447,7 +2464,7 @@ func TestEVMDecodeABIWithSignatureMismatch(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -2484,7 +2501,6 @@ func TestEVMDecodeABIWithSignatureMismatch(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		true,
 	)
 
 	// Run script
@@ -2551,7 +2567,7 @@ func TestEVMAddressConstructionAndReturn(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -2594,7 +2610,6 @@ func TestEVMAddressConstructionAndReturn(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		true,
 	)
 
 	// Run script
@@ -2644,8 +2659,8 @@ func TestBalanceConstructionAndReturn(t *testing.T) {
       import EVM from 0x1
 
       access(all)
-      fun main(_ flow: UFix64): EVM.Balance {
-          return EVM.Balance(flow: flow)
+      fun main(_ attoflow: UInt): EVM.Balance {
+          return EVM.Balance(attoflow: attoflow)
       }
     `)
 
@@ -2657,7 +2672,7 @@ func TestBalanceConstructionAndReturn(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -2687,13 +2702,11 @@ func TestBalanceConstructionAndReturn(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		false,
 	)
 
 	// Run script
 
-	flowValue, err := cadence.NewUFix64FromParts(1, 23000000)
-	require.NoError(t, err)
+	flowValue := cadence.NewUInt(1230000000000000000)
 
 	result, err := rt.ExecuteScript(
 		runtime.Script{
@@ -2748,8 +2761,10 @@ func TestEVMRun(t *testing.T) {
 
 	runCalled := false
 
+	contractsAddress := flow.BytesToAddress([]byte{0x1})
 	handler := &testContractHandler{
-		run: func(tx []byte, coinbase types.Address) {
+		evmContractAddress: common.Address(contractsAddress),
+		run: func(tx []byte, coinbase types.Address) *types.ResultSummary {
 			runCalled = true
 
 			assert.Equal(t, []byte{1, 2, 3}, tx)
@@ -2759,12 +2774,12 @@ func TestEVMRun(t *testing.T) {
 				},
 				coinbase,
 			)
-
+			return &types.ResultSummary{
+				Status: types.StatusSuccessful,
+			}
 		},
 	}
 
-	contractsAddress := flow.BytesToAddress([]byte{0x1})
-
 	transactionEnvironment := newEVMTransactionEnvironment(handler, contractsAddress)
 	scriptEnvironment := newEVMScriptEnvironment(handler, contractsAddress)
 
@@ -2774,9 +2789,11 @@ func TestEVMRun(t *testing.T) {
       import EVM from 0x1
 
       access(all)
-      fun main(tx: [UInt8], coinbaseBytes: [UInt8; 20]) {
+      fun main(tx: [UInt8], coinbaseBytes: [UInt8; 20]): UInt8 {
           let coinbase = EVM.EVMAddress(bytes: coinbaseBytes)
-          EVM.run(tx: tx, coinbase: coinbase)
+          let res = EVM.run(tx: tx, coinbase: coinbase)
+		  let st = res.status
+		  return st.rawValue
       }
     `)
 
@@ -2788,7 +2805,7 @@ func TestEVMRun(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -2818,12 +2835,39 @@ func TestEVMRun(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		false,
 	)
 
 	// Run script
 
-	_, err := rt.ExecuteScript(
+	val, err := rt.ExecuteScript(
+		runtime.Script{
+			Source:    script,
+			Arguments: EncodeArgs([]cadence.Value{evmTx, coinbase}),
+		},
+		runtime.Context{
+			Interface:   runtimeInterface,
+			Environment: scriptEnvironment,
+			Location:    nextScriptLocation(),
+		},
+	)
+	require.NoError(t, err)
+
+	assert.Equal(t, types.StatusSuccessful, types.Status(val.(cadence.UInt8)))
+	assert.True(t, runCalled)
+
+	// test must run
+	script = []byte(`
+		import EVM from 0x1
+
+		access(all)
+		fun main(tx: [UInt8], coinbaseBytes: [UInt8; 20]): UInt8 {
+			let coinbase = EVM.EVMAddress(bytes: coinbaseBytes)
+			let res = EVM.mustRun(tx: tx, coinbase: coinbase)
+			let st = res.status
+			return st.rawValue
+		}
+  	`)
+	val, err = rt.ExecuteScript(
 		runtime.Script{
 			Source:    script,
 			Arguments: EncodeArgs([]cadence.Value{evmTx, coinbase}),
@@ -2836,20 +2880,26 @@ func TestEVMRun(t *testing.T) {
 	)
 	require.NoError(t, err)
 
+	assert.Equal(t, types.StatusSuccessful, types.Status(val.(cadence.UInt8)))
 	assert.True(t, runCalled)
 }
 
-func TestEVMCreateBridgedAccount(t *testing.T) {
+func TestEVMCreateCadenceOwnedAccount(t *testing.T) {
 
 	t.Parallel()
 
-	handler := &testContractHandler{}
+	uuidCounter := uint64(0)
+	handler := &testContractHandler{
+		deployCOA: func(uuid uint64) types.Address {
+			require.Equal(t, uuidCounter, uuid)
+			return types.Address{uint8(uuidCounter)}
+		},
+	}
 
 	contractsAddress := flow.BytesToAddress([]byte{0x1})
 
 	transactionEnvironment := newEVMTransactionEnvironment(handler, contractsAddress)
 	scriptEnvironment := newEVMScriptEnvironment(handler, contractsAddress)
-
 	rt := runtime.NewInterpreterRuntime(runtime.Config{})
 
 	script := []byte(`
@@ -2857,12 +2907,12 @@ func TestEVMCreateBridgedAccount(t *testing.T) {
 
       access(all)
       fun main(): [UInt8; 20] {
-          let bridgedAccount1 <- EVM.createBridgedAccount()
-          destroy bridgedAccount1
+          let cadenceOwnedAccount1 <- EVM.createCadenceOwnedAccount()
+          destroy cadenceOwnedAccount1
 
-          let bridgedAccount2 <- EVM.createBridgedAccount()
-          let bytes = bridgedAccount2.address().bytes
-          destroy bridgedAccount2
+          let cadenceOwnedAccount2 <- EVM.createCadenceOwnedAccount()
+          let bytes = cadenceOwnedAccount2.address().bytes
+          destroy cadenceOwnedAccount2
 
           return bytes
       }
@@ -2876,7 +2926,7 @@ func TestEVMCreateBridgedAccount(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -2892,6 +2942,10 @@ func TestEVMCreateBridgedAccount(t *testing.T) {
 		OnDecodeArgument: func(b []byte, t cadence.Type) (cadence.Value, error) {
 			return json.Decode(nil, b)
 		},
+		OnGenerateUUID: func() (uint64, error) {
+			uuidCounter++
+			return uuidCounter, nil
+		},
 	}
 
 	nextTransactionLocation := NewTransactionLocationGenerator()
@@ -2906,11 +2960,12 @@ func TestEVMCreateBridgedAccount(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		false,
 	)
 
-	// Run script
+	// reset events
+	events = make([]cadence.Event, 0)
 
+	// Run script
 	actual, err := rt.ExecuteScript(
 		runtime.Script{
 			Source: script,
@@ -2924,7 +2979,7 @@ func TestEVMCreateBridgedAccount(t *testing.T) {
 	require.NoError(t, err)
 
 	expected := cadence.NewArray([]cadence.Value{
-		cadence.UInt8(2), cadence.UInt8(0),
+		cadence.UInt8(4), cadence.UInt8(0),
 		cadence.UInt8(0), cadence.UInt8(0),
 		cadence.UInt8(0), cadence.UInt8(0),
 		cadence.UInt8(0), cadence.UInt8(0),
@@ -2940,18 +2995,35 @@ func TestEVMCreateBridgedAccount(t *testing.T) {
 	))
 
 	require.Equal(t, expected, actual)
+
+	// check deposit event
+	expectedEventTypes := []string{
+		"EVM.CadenceOwnedAccountCreated",
+		"EVM.CadenceOwnedAccountCreated",
+	}
+	CheckCadenceEventTypes(t, events, expectedEventTypes)
+
+	// check cadence owned account created events
+	expectedCoaAddress := types.Address{3}
+	require.Equal(t, expectedCoaAddress.ToCadenceValue().ToGoValue(), events[0].Fields[0].ToGoValue())
+
+	expectedCoaAddress = types.Address{4}
+	require.Equal(t, expectedCoaAddress.ToCadenceValue().ToGoValue(), events[1].Fields[0].ToGoValue())
 }
 
-func TestBridgedAccountCall(t *testing.T) {
+func TestCadenceOwnedAccountCall(t *testing.T) {
 
 	t.Parallel()
 
 	expectedBalance, err := cadence.NewUFix64FromParts(1, 23000000)
 	require.NoError(t, err)
 
+	contractsAddress := flow.BytesToAddress([]byte{0x1})
+
 	handler := &testContractHandler{
+		evmContractAddress: common.Address(contractsAddress),
 		accountByAddress: func(fromAddress types.Address, isAuthorized bool) types.Account {
-			assert.Equal(t, types.Address{1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
+			assert.Equal(t, types.Address{3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
 			assert.True(t, isAuthorized)
 
 			return &testFlowAccount{
@@ -2961,20 +3033,21 @@ func TestBridgedAccountCall(t *testing.T) {
 					data types.Data,
 					limit types.GasLimit,
 					balance types.Balance,
-				) types.Data {
+				) *types.ResultSummary {
 					assert.Equal(t, types.Address{2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, toAddress)
 					assert.Equal(t, types.Data{4, 5, 6}, data)
 					assert.Equal(t, types.GasLimit(9999), limit)
-					assert.Equal(t, types.Balance(expectedBalance), balance)
+					assert.Equal(t, types.NewBalanceFromUFix64(expectedBalance), balance)
 
-					return types.Data{3, 1, 4}
+					return &types.ResultSummary{
+						Status:        types.StatusSuccessful,
+						ReturnedValue: types.Data{3, 1, 4},
+					}
 				},
 			}
 		},
 	}
 
-	contractsAddress := flow.BytesToAddress([]byte{0x1})
-
 	transactionEnvironment := newEVMTransactionEnvironment(handler, contractsAddress)
 	scriptEnvironment := newEVMScriptEnvironment(handler, contractsAddress)
 
@@ -2985,17 +3058,19 @@ func TestBridgedAccountCall(t *testing.T) {
 
       access(all)
       fun main(): [UInt8] {
-          let bridgedAccount <- EVM.createBridgedAccount()
-          let response = bridgedAccount.call(
+          let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+		  let bal = EVM.Balance(attoflow: 0)
+		  bal.setFLOW(flow: 1.23)
+          let response = cadenceOwnedAccount.call(
               to: EVM.EVMAddress(
                   bytes: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
               ),
               data: [4, 5, 6],
               gasLimit: 9999,
-              value: EVM.Balance(flow: 1.23)
+              value: bal
           )
-          destroy bridgedAccount
-          return response
+          destroy cadenceOwnedAccount
+          return response.data
       }
    `)
 
@@ -3007,7 +3082,7 @@ func TestBridgedAccountCall(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -3037,7 +3112,6 @@ func TestBridgedAccountCall(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		false,
 	)
 
 	// Run script
@@ -3067,15 +3141,16 @@ func TestEVMAddressDeposit(t *testing.T) {
 
 	t.Parallel()
 
-	expectedBalance, err := cadence.NewUFix64FromParts(1, 23000000)
+	expectedBalanceInUFix64, err := cadence.NewUFix64FromParts(1, 23000000)
 	require.NoError(t, err)
+	expectedBalance := types.NewBalanceFromUFix64(expectedBalanceInUFix64)
 
 	var deposited bool
 
 	handler := &testContractHandler{
 
 		accountByAddress: func(fromAddress types.Address, isAuthorized bool) types.Account {
-			assert.Equal(t, types.Address{1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
+			assert.Equal(t, types.Address{2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
 			assert.False(t, isAuthorized)
 
 			return &testFlowAccount{
@@ -3111,9 +3186,123 @@ func TestEVMAddressDeposit(t *testing.T) {
           let vault <- minter.mintTokens(amount: 1.23)
           destroy minter
 
-          let bridgedAccount <- EVM.createBridgedAccount()
-          bridgedAccount.deposit(from: <-vault)
-		  destroy bridgedAccount
+          let address = EVM.EVMAddress(
+              bytes: [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
+          )
+          address.deposit(from: <-vault)
+      }
+   `)
+
+	accountCodes := map[common.Location][]byte{}
+	var events []cadence.Event
+
+	runtimeInterface := &TestRuntimeInterface{
+		Storage: NewTestLedger(nil, nil),
+		OnGetSigningAccounts: func() ([]runtime.Address, error) {
+			return []runtime.Address{runtime.Address(contractsAddress)}, nil
+		},
+		OnResolveLocation: LocationResolver,
+		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
+			accountCodes[location] = code
+			return nil
+		},
+		OnGetAccountContractCode: func(location common.AddressLocation) (code []byte, err error) {
+			code = accountCodes[location]
+			return code, nil
+		},
+		OnEmitEvent: func(event cadence.Event) error {
+			events = append(events, event)
+			return nil
+		},
+		OnDecodeArgument: func(b []byte, t cadence.Type) (cadence.Value, error) {
+			return json.Decode(nil, b)
+		},
+	}
+
+	nextTransactionLocation := NewTransactionLocationGenerator()
+	nextScriptLocation := NewScriptLocationGenerator()
+
+	// Deploy contracts
+
+	deployContracts(
+		t,
+		rt,
+		contractsAddress,
+		runtimeInterface,
+		transactionEnvironment,
+		nextTransactionLocation,
+	)
+
+	// Run script
+
+	_, err = rt.ExecuteScript(
+		runtime.Script{
+			Source: script,
+		},
+		runtime.Context{
+			Interface:   runtimeInterface,
+			Environment: scriptEnvironment,
+			Location:    nextScriptLocation(),
+		},
+	)
+	require.NoError(t, err)
+
+	require.True(t, deposited)
+}
+
+func TestCOADeposit(t *testing.T) {
+
+	t.Parallel()
+
+	expectedBalance, err := cadence.NewUFix64FromParts(1, 23000000)
+	require.NoError(t, err)
+
+	var deposited bool
+
+	var expectedCoaAddress = types.Address{5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
+
+	handler := &testContractHandler{
+
+		accountByAddress: func(fromAddress types.Address, isAuthorized bool) types.Account {
+			assert.Equal(t, expectedCoaAddress, fromAddress)
+			assert.False(t, isAuthorized)
+
+			return &testFlowAccount{
+				address: fromAddress,
+				deposit: func(vault *types.FLOWTokenVault) {
+					deposited = true
+					assert.Equal(
+						t,
+						types.NewBalanceFromUFix64(expectedBalance),
+						vault.Balance(),
+					)
+				},
+			}
+		},
+	}
+
+	contractsAddress := flow.BytesToAddress([]byte{0x1})
+
+	transactionEnvironment := newEVMTransactionEnvironment(handler, contractsAddress)
+	scriptEnvironment := newEVMScriptEnvironment(handler, contractsAddress)
+
+	rt := runtime.NewInterpreterRuntime(runtime.Config{})
+
+	script := []byte(`
+      import EVM from 0x1
+      import FlowToken from 0x1
+
+      access(all)
+      fun main() {
+          let admin = getAuthAccount(0x1)
+              .borrow<&FlowToken.Administrator>(from: /storage/flowTokenAdmin)!
+          let minter <- admin.createNewMinter(allowedAmount: 1.23)
+          let vault <- minter.mintTokens(amount: 1.23)
+          destroy minter
+
+          let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+          cadenceOwnedAccount.deposit(from: <-vault)
+		  destroy cadenceOwnedAccount
       }
    `)
 
@@ -3125,7 +3314,7 @@ func TestEVMAddressDeposit(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -3155,11 +3344,13 @@ func TestEVMAddressDeposit(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		false,
 	)
 
 	// Run script
 
+	// reset events before script execution
+	events = make([]cadence.Event, 0)
+
 	_, err = rt.ExecuteScript(
 		runtime.Script{
 			Source: script,
@@ -3173,9 +3364,25 @@ func TestEVMAddressDeposit(t *testing.T) {
 	require.NoError(t, err)
 
 	require.True(t, deposited)
+
+	// check deposit event
+	expectedEventTypes := []string{
+		"FlowToken.MinterCreated",
+		"FlowToken.TokensMinted",
+		"EVM.CadenceOwnedAccountCreated",
+		"EVM.FLOWTokensDeposited",
+	}
+	CheckCadenceEventTypes(t, events, expectedEventTypes)
+
+	// token deposit event
+	tokenDepositEvent := events[3]
+	// check address
+	require.Equal(t, expectedCoaAddress.ToCadenceValue().ToGoValue(), tokenDepositEvent.Fields[0].ToGoValue())
+	// check amount
+	require.Equal(t, expectedBalance.ToGoValue(), tokenDepositEvent.Fields[1].ToGoValue())
 }
 
-func TestBridgedAccountWithdraw(t *testing.T) {
+func TestCadenceOwnedAccountWithdraw(t *testing.T) {
 
 	t.Parallel()
 
@@ -3190,10 +3397,14 @@ func TestBridgedAccountWithdraw(t *testing.T) {
 
 	contractsAddress := flow.BytesToAddress([]byte{0x1})
 
+	var nextUUID uint64 = 1
+
+	var expectedCoaAddress = types.Address{5, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
+
 	handler := &testContractHandler{
 		flowTokenAddress: common.Address(contractsAddress),
 		accountByAddress: func(fromAddress types.Address, isAuthorized bool) types.Account {
-			assert.Equal(t, types.Address{1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
+			assert.Equal(t, expectedCoaAddress, fromAddress)
 			assert.Equal(t, deposited, isAuthorized)
 
 			return &testFlowAccount{
@@ -3201,13 +3412,13 @@ func TestBridgedAccountWithdraw(t *testing.T) {
 				deposit: func(vault *types.FLOWTokenVault) {
 					deposited = true
 					assert.Equal(t,
-						types.Balance(expectedDepositBalance),
+						types.NewBalanceFromUFix64(expectedDepositBalance),
 						vault.Balance(),
 					)
 				},
 				withdraw: func(balance types.Balance) *types.FLOWTokenVault {
 					assert.Equal(t,
-						types.Balance(expectedWithdrawBalance),
+						types.NewBalanceFromUFix64(expectedWithdrawBalance),
 						balance,
 					)
 					withdrew = true
@@ -3215,6 +3426,11 @@ func TestBridgedAccountWithdraw(t *testing.T) {
 				},
 			}
 		},
+		generateResourceUUID: func() uint64 {
+			uuid := nextUUID
+			nextUUID++
+			return uuid
+		},
 	}
 
 	transactionEnvironment := newEVMTransactionEnvironment(handler, contractsAddress)
@@ -3234,12 +3450,14 @@ func TestBridgedAccountWithdraw(t *testing.T) {
           let vault <- minter.mintTokens(amount: 2.34)
           destroy minter
 
-          let bridgedAccount <- EVM.createBridgedAccount()
-          bridgedAccount.deposit(from: <-vault)
+          let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+          cadenceOwnedAccount.deposit(from: <-vault)
 
-          let vault2 <- bridgedAccount.withdraw(balance: EVM.Balance(flow: 1.23))
+          let vault2 <- cadenceOwnedAccount.withdraw(balance: EVM.Balance(attoflow: 1230000000000000000))
           let balance = vault2.balance
-          destroy bridgedAccount
+          log(vault2.uuid)
+
+          destroy cadenceOwnedAccount
           destroy vault2
 
           return balance
@@ -3248,13 +3466,14 @@ func TestBridgedAccountWithdraw(t *testing.T) {
 
 	accountCodes := map[common.Location][]byte{}
 	var events []cadence.Event
+	var logs []string
 
 	runtimeInterface := &TestRuntimeInterface{
 		Storage: NewTestLedger(nil, nil),
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -3270,6 +3489,9 @@ func TestBridgedAccountWithdraw(t *testing.T) {
 		OnDecodeArgument: func(b []byte, t cadence.Type) (cadence.Value, error) {
 			return json.Decode(nil, b)
 		},
+		OnProgramLog: func(s string) {
+			logs = append(logs, s)
+		},
 	}
 
 	nextTransactionLocation := NewTransactionLocationGenerator()
@@ -3284,11 +3506,11 @@ func TestBridgedAccountWithdraw(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		false,
 	)
 
+	// reset events
+	events = make([]cadence.Event, 0)
 	// Run script
-
 	result, err := rt.ExecuteScript(
 		runtime.Script{
 			Source: script,
@@ -3304,9 +3526,28 @@ func TestBridgedAccountWithdraw(t *testing.T) {
 	assert.True(t, deposited)
 	assert.True(t, withdrew)
 	assert.Equal(t, expectedWithdrawBalance, result)
+
+	assert.Equal(t, []string{"1"}, logs)
+
+	// check deposit event
+	expectedEventTypes := []string{
+		"FlowToken.MinterCreated",
+		"FlowToken.TokensMinted",
+		"EVM.CadenceOwnedAccountCreated",
+		"EVM.FLOWTokensDeposited",
+		"EVM.FLOWTokensWithdrawn",
+	}
+	CheckCadenceEventTypes(t, events, expectedEventTypes)
+
+	// token deposit event
+	tokenWithdrawEvent := events[4]
+	// check address
+	require.Equal(t, expectedCoaAddress.ToCadenceValue().ToGoValue(), tokenWithdrawEvent.Fields[0].ToGoValue())
+	// check amount
+	require.Equal(t, expectedWithdrawBalance.ToGoValue(), tokenWithdrawEvent.Fields[1].ToGoValue())
 }
 
-func TestBridgedAccountDeploy(t *testing.T) {
+func TestCadenceOwnedAccountDeploy(t *testing.T) {
 
 	t.Parallel()
 
@@ -3317,11 +3558,10 @@ func TestBridgedAccountDeploy(t *testing.T) {
 	expectedBalance, err := cadence.NewUFix64FromParts(1, 23000000)
 	require.NoError(t, err)
 
-	var handler *testContractHandler
-	handler = &testContractHandler{
+	handler := &testContractHandler{
 		flowTokenAddress: common.Address(contractsAddress),
 		accountByAddress: func(fromAddress types.Address, isAuthorized bool) types.Account {
-			assert.Equal(t, types.Address{1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
+			assert.Equal(t, types.Address{3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
 			assert.True(t, isAuthorized)
 
 			return &testFlowAccount{
@@ -3330,9 +3570,9 @@ func TestBridgedAccountDeploy(t *testing.T) {
 					deployed = true
 					assert.Equal(t, types.Code{4, 5, 6}, code)
 					assert.Equal(t, types.GasLimit(9999), limit)
-					assert.Equal(t, types.Balance(expectedBalance), balance)
+					assert.Equal(t, types.NewBalanceFromUFix64(expectedBalance), balance)
 
-					return handler.AllocateAddress()
+					return types.Address{4}
 				},
 			}
 		},
@@ -3349,13 +3589,13 @@ func TestBridgedAccountDeploy(t *testing.T) {
 
       access(all)
       fun main(): [UInt8; 20] {
-          let bridgedAccount <- EVM.createBridgedAccount()
-          let address = bridgedAccount.deploy(
+          let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+          let address = cadenceOwnedAccount.deploy(
               code: [4, 5, 6],
               gasLimit: 9999,
-              value: EVM.Balance(flow: 1.23)
+              value: EVM.Balance(flow: 1230000000000000000)
           )
-          destroy bridgedAccount
+          destroy cadenceOwnedAccount
           return address.bytes
       }
    `)
@@ -3368,7 +3608,7 @@ func TestBridgedAccountDeploy(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -3398,7 +3638,6 @@ func TestBridgedAccountDeploy(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		false,
 	)
 
 	// Run script
@@ -3416,7 +3655,7 @@ func TestBridgedAccountDeploy(t *testing.T) {
 	require.NoError(t, err)
 
 	expected := cadence.NewArray([]cadence.Value{
-		cadence.UInt8(2), cadence.UInt8(0),
+		cadence.UInt8(4), cadence.UInt8(0),
 		cadence.UInt8(0), cadence.UInt8(0),
 		cadence.UInt8(0), cadence.UInt8(0),
 		cadence.UInt8(0), cadence.UInt8(0),
@@ -3436,51 +3675,257 @@ func TestBridgedAccountDeploy(t *testing.T) {
 	require.True(t, deployed)
 }
 
-func TestEVMAccountBalance(t *testing.T) {
+func RunEVMScript(
+	t *testing.T,
+	handler *testContractHandler,
+	script []byte,
+	expectedValue cadence.Value,
+) {
+	contractsAddress := flow.Address(handler.evmContractAddress)
+	transactionEnvironment := newEVMTransactionEnvironment(handler, contractsAddress)
+	scriptEnvironment := newEVMScriptEnvironment(handler, contractsAddress)
+
+	rt := runtime.NewInterpreterRuntime(runtime.Config{})
+
+	accountCodes := map[common.Location][]byte{}
+	var events []cadence.Event
+
+	runtimeInterface := &TestRuntimeInterface{
+		Storage: NewTestLedger(nil, nil),
+		OnGetSigningAccounts: func() ([]runtime.Address, error) {
+			return []runtime.Address{runtime.Address(contractsAddress)}, nil
+		},
+		OnResolveLocation: LocationResolver,
+		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
+			accountCodes[location] = code
+			return nil
+		},
+		OnGetAccountContractCode: func(location common.AddressLocation) (code []byte, err error) {
+			code = accountCodes[location]
+			return code, nil
+		},
+		OnEmitEvent: func(event cadence.Event) error {
+			events = append(events, event)
+			return nil
+		},
+		OnDecodeArgument: func(b []byte, t cadence.Type) (cadence.Value, error) {
+			return json.Decode(nil, b)
+		},
+	}
+
+	nextTransactionLocation := NewTransactionLocationGenerator()
+	nextScriptLocation := NewScriptLocationGenerator()
+
+	// Deploy contracts
+
+	deployContracts(
+		t,
+		rt,
+		contractsAddress,
+		runtimeInterface,
+		transactionEnvironment,
+		nextTransactionLocation,
+	)
+
+	// Run script
+
+	actual, err := rt.ExecuteScript(
+		runtime.Script{
+			Source: script,
+		},
+		runtime.Context{
+			Interface:   runtimeInterface,
+			Environment: scriptEnvironment,
+			Location:    nextScriptLocation(),
+		},
+	)
+	require.NoError(t, err)
 
+	require.NoError(t, err)
+	require.Equal(t, expectedValue.ToGoValue(), actual.ToGoValue())
+}
+
+func TestEVMAccountBalance(t *testing.T) {
 	t.Parallel()
 
 	contractsAddress := flow.BytesToAddress([]byte{0x1})
-
-	expectedBalanceValue, err := cadence.NewUFix64FromParts(1, 1337000)
+	expectedBalanceValue := cadence.NewUInt(1013370000000000000)
 	expectedBalance := cadence.
 		NewStruct([]cadence.Value{expectedBalanceValue}).
 		WithType(stdlib.NewBalanceCadenceType(common.Address(contractsAddress)))
 
-	require.NoError(t, err)
-
 	handler := &testContractHandler{
-		flowTokenAddress: common.Address(contractsAddress),
+		flowTokenAddress:   common.Address(contractsAddress),
+		evmContractAddress: common.Address(contractsAddress),
 		accountByAddress: func(fromAddress types.Address, isAuthorized bool) types.Account {
-			assert.Equal(t, types.Address{1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
+			assert.Equal(t, types.Address{3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
 			assert.False(t, isAuthorized)
 
 			return &testFlowAccount{
 				address: fromAddress,
 				balance: func() types.Balance {
-					return types.Balance(expectedBalanceValue)
+					return types.NewBalance(expectedBalanceValue.Value)
 				},
 			}
 		},
 	}
 
-	transactionEnvironment := newEVMTransactionEnvironment(handler, contractsAddress)
-	scriptEnvironment := newEVMScriptEnvironment(handler, contractsAddress)
+	script := []byte(`
+	import EVM from 0x1
+
+	access(all)
+	fun main(): EVM.Balance {
+			let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+			let balance = cadenceOwnedAccount.balance()
+			destroy cadenceOwnedAccount
+			return balance
+		}
+	`)
+	RunEVMScript(t, handler, script, expectedBalance)
+}
 
-	rt := runtime.NewInterpreterRuntime(runtime.Config{})
+func TestEVMAccountNonce(t *testing.T) {
+	t.Parallel()
+
+	contractsAddress := flow.BytesToAddress([]byte{0x1})
+	expectedNonceValue := cadence.NewUInt64(2000)
+	handler := &testContractHandler{
+		flowTokenAddress:   common.Address(contractsAddress),
+		evmContractAddress: common.Address(contractsAddress),
+		accountByAddress: func(fromAddress types.Address, isAuthorized bool) types.Account {
+			assert.Equal(t, types.Address{3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
+			assert.False(t, isAuthorized)
+
+			return &testFlowAccount{
+				address: fromAddress,
+				nonce: func() uint64 {
+					return uint64(expectedNonceValue)
+				},
+			}
+		},
+	}
 
 	script := []byte(`
       import EVM from 0x1
 
       access(all)
-      fun main(): EVM.Balance {
-          let bridgedAccount <- EVM.createBridgedAccount()
-          let balance = bridgedAccount.balance()
-          destroy bridgedAccount
-          return balance
+      fun main(): UInt64 {
+          let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+          let nonce = cadenceOwnedAccount.address().nonce()
+          destroy cadenceOwnedAccount
+          return nonce
+      }
+    `)
+
+	RunEVMScript(t, handler, script, expectedNonceValue)
+}
+
+func TestEVMAccountCode(t *testing.T) {
+	t.Parallel()
+
+	contractsAddress := flow.BytesToAddress([]byte{0x1})
+	expectedCodeRaw := []byte{1, 2, 3}
+	expectedCodeValue := cadence.NewArray(
+		[]cadence.Value{cadence.UInt8(1), cadence.UInt8(2), cadence.UInt8(3)},
+	).WithType(cadence.NewVariableSizedArrayType(cadence.TheUInt8Type))
+
+	handler := &testContractHandler{
+		flowTokenAddress:   common.Address(contractsAddress),
+		evmContractAddress: common.Address(contractsAddress),
+		accountByAddress: func(fromAddress types.Address, isAuthorized bool) types.Account {
+			assert.Equal(t, types.Address{3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
+			assert.False(t, isAuthorized)
+
+			return &testFlowAccount{
+				address: fromAddress,
+				code: func() types.Code {
+					return expectedCodeRaw
+				},
+			}
+		},
+	}
+
+	script := []byte(`
+      import EVM from 0x1
+
+      access(all)
+      fun main(): [UInt8] {
+          let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+          let code = cadenceOwnedAccount.address().code()
+          destroy cadenceOwnedAccount
+          return code
+      }
+    `)
+
+	RunEVMScript(t, handler, script, expectedCodeValue)
+}
+
+func TestEVMAccountCodeHash(t *testing.T) {
+	t.Parallel()
+
+	contractsAddress := flow.BytesToAddress([]byte{0x1})
+	expectedCodeHashRaw := []byte{1, 2, 3}
+	expectedCodeHashValue := cadence.NewArray(
+		[]cadence.Value{cadence.UInt8(1), cadence.UInt8(2), cadence.UInt8(3)},
+	).WithType(cadence.NewVariableSizedArrayType(cadence.TheUInt8Type))
+
+	handler := &testContractHandler{
+		flowTokenAddress:   common.Address(contractsAddress),
+		evmContractAddress: common.Address(contractsAddress),
+		accountByAddress: func(fromAddress types.Address, isAuthorized bool) types.Account {
+			assert.Equal(t, types.Address{3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
+			assert.False(t, isAuthorized)
+
+			return &testFlowAccount{
+				address: fromAddress,
+				codeHash: func() []byte {
+					return expectedCodeHashRaw
+				},
+			}
+		},
+	}
+
+	script := []byte(`
+      import EVM from 0x1
+
+      access(all)
+      fun main(): [UInt8] {
+          let cadenceOwnedAccount <- EVM.createCadenceOwnedAccount()
+          let codeHash = cadenceOwnedAccount.address().codeHash()
+          destroy cadenceOwnedAccount
+          return codeHash
       }
     `)
 
+	RunEVMScript(t, handler, script, expectedCodeHashValue)
+}
+
+func TestEVMValidateCOAOwnershipProof(t *testing.T) {
+	t.Parallel()
+
+	contractsAddress := flow.BytesToAddress([]byte{0x1})
+
+	proof := &types.COAOwnershipProofInContext{
+		COAOwnershipProof: types.COAOwnershipProof{
+			Address:        types.FlowAddress(contractsAddress),
+			CapabilityPath: "coa",
+			Signatures:     []types.Signature{[]byte("signature")},
+			KeyIndices:     []uint64{0},
+		},
+		SignedData: []byte("signedData"),
+		EVMAddress: RandomAddress(t),
+	}
+
+	handler := &testContractHandler{
+		deployCOA: func(_ uint64) types.Address {
+			return proof.EVMAddress
+		},
+	}
+	transactionEnvironment := newEVMTransactionEnvironment(handler, contractsAddress)
+	scriptEnvironment := newEVMScriptEnvironment(handler, contractsAddress)
+
+	rt := runtime.NewInterpreterRuntime(runtime.Config{})
+
 	accountCodes := map[common.Location][]byte{}
 	var events []cadence.Event
 
@@ -3489,7 +3934,7 @@ func TestEVMAccountBalance(t *testing.T) {
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -3505,6 +3950,26 @@ func TestEVMAccountBalance(t *testing.T) {
 		OnDecodeArgument: func(b []byte, t cadence.Type) (cadence.Value, error) {
 			return json.Decode(nil, b)
 		},
+		OnGetAccountKey: func(addr runtime.Address, index int) (*cadenceStdlib.AccountKey, error) {
+			require.Equal(t, proof.Address[:], addr[:])
+			return &cadenceStdlib.AccountKey{
+				PublicKey: &cadenceStdlib.PublicKey{},
+				KeyIndex:  index,
+				Weight:    100,
+				HashAlgo:  sema.HashAlgorithmKECCAK_256,
+				IsRevoked: false,
+			}, nil
+		},
+		OnVerifySignature: func(
+			signature []byte,
+			tag string,
+			sd,
+			publicKey []byte,
+			signatureAlgorithm runtime.SignatureAlgorithm,
+			hashAlgorithm runtime.HashAlgorithm) (bool, error) {
+			// require.Equal(t, []byte(signedData.ToGoValue()), st)
+			return true, nil
+		},
 	}
 
 	nextTransactionLocation := NewTransactionLocationGenerator()
@@ -3519,77 +3984,100 @@ func TestEVMAccountBalance(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		false,
 	)
 
-	// Run script
+	setupTx := []byte(`
+		import EVM from 0x1
 
-	actual, err := rt.ExecuteScript(
+		transaction {
+			prepare(account: AuthAccount) {
+				let cadenceOwnedAccount1 <- EVM.createCadenceOwnedAccount()
+				account.save<@EVM.CadenceOwnedAccount>(<-cadenceOwnedAccount1,
+					                              to: /storage/coa)
+				account.link<&EVM.CadenceOwnedAccount{EVM.Addressable}>(/public/coa,
+					                                               target: /storage/coa)
+			}
+		}`)
+
+	err := rt.ExecuteTransaction(
 		runtime.Script{
-			Source: script,
+			Source: setupTx,
 		},
 		runtime.Context{
 			Interface:   runtimeInterface,
-			Environment: scriptEnvironment,
-			Location:    nextScriptLocation(),
+			Environment: transactionEnvironment,
+			Location:    nextTransactionLocation(),
 		},
 	)
 	require.NoError(t, err)
 
+	script := []byte(`
+      import EVM from 0x1
+
+      access(all)
+      fun main(
+		  address: Address,
+		  path: PublicPath,
+		  signedData: [UInt8],
+		  keyIndices: [UInt64],
+		  signatures: [[UInt8]],
+		  evmAddress: [UInt8; 20]
+
+		) {
+          EVM.validateCOAOwnershipProof(
+			address: address,
+			path: path,
+			signedData: signedData,
+			keyIndices: keyIndices,
+			signatures: signatures, 
+			evmAddress: evmAddress
+		  )
+      }
+    `)
+
+	// Run script
+	_, err = rt.ExecuteScript(
+		runtime.Script{
+			Source:    script,
+			Arguments: EncodeArgs(proof.ToCadenceValues()),
+		},
+		runtime.Context{
+			Interface:   runtimeInterface,
+			Environment: scriptEnvironment,
+			Location:    nextScriptLocation(),
+		},
+	)
 	require.NoError(t, err)
-	require.Equal(t, expectedBalance, actual)
 }
 
-func TestEVMAccountBalanceForABIOnlyContract(t *testing.T) {
+func TestInternalEVMAccess(t *testing.T) {
 
 	t.Parallel()
 
-	contractsAddress := flow.BytesToAddress([]byte{0x1})
-
-	expectedBalanceValue, err := cadence.NewUFix64FromParts(1, 1337000)
-	require.NoError(t, err)
-
-	handler := &testContractHandler{
-		flowTokenAddress: common.Address(contractsAddress),
-		accountByAddress: func(fromAddress types.Address, isAuthorized bool) types.Account {
-			assert.Equal(t, types.Address{1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, fromAddress)
-			assert.False(t, isAuthorized)
-
-			return &testFlowAccount{
-				address: fromAddress,
-				balance: func() types.Balance {
-					return types.Balance(expectedBalanceValue)
-				},
-			}
-		},
-	}
+	handler := &testContractHandler{}
 
+	contractsAddress := flow.BytesToAddress([]byte{0x1})
 	transactionEnvironment := newEVMTransactionEnvironment(handler, contractsAddress)
 	scriptEnvironment := newEVMScriptEnvironment(handler, contractsAddress)
-
 	rt := runtime.NewInterpreterRuntime(runtime.Config{})
 
 	script := []byte(`
       import EVM from 0x1
 
       access(all)
-      fun main(): EVM.Balance {
-          let bridgedAccount <- EVM.createBridgedAccount()
-          let balance = bridgedAccount.balance()
-          destroy bridgedAccount
-          return balance
+      fun main() {
+          let a = InternalEVM.createBridgedAccount()
       }
     `)
 
 	accountCodes := map[common.Location][]byte{}
-	var events []cadence.Event
 
 	runtimeInterface := &TestRuntimeInterface{
 		Storage: NewTestLedger(nil, nil),
 		OnGetSigningAccounts: func() ([]runtime.Address, error) {
 			return []runtime.Address{runtime.Address(contractsAddress)}, nil
 		},
-		OnResolveLocation: SingleIdentifierLocationResolver(t),
+		OnResolveLocation: LocationResolver,
 		OnUpdateAccountContractCode: func(location common.AddressLocation, code []byte) error {
 			accountCodes[location] = code
 			return nil
@@ -3599,7 +4087,6 @@ func TestEVMAccountBalanceForABIOnlyContract(t *testing.T) {
 			return code, nil
 		},
 		OnEmitEvent: func(event cadence.Event) error {
-			events = append(events, event)
 			return nil
 		},
 		OnDecodeArgument: func(b []byte, t cadence.Type) (cadence.Value, error) {
@@ -3619,12 +4106,11 @@ func TestEVMAccountBalanceForABIOnlyContract(t *testing.T) {
 		runtimeInterface,
 		transactionEnvironment,
 		nextTransactionLocation,
-		true,
 	)
 
 	// Run script
 
-	_, err = rt.ExecuteScript(
+	_, err := rt.ExecuteScript(
 		runtime.Script{
 			Source: script,
 		},
@@ -3635,15 +4121,55 @@ func TestEVMAccountBalanceForABIOnlyContract(t *testing.T) {
 		},
 	)
 	require.Error(t, err)
+}
 
-	assert.ErrorContains(
-		t,
-		err,
-		"error: cannot find type in this scope: `EVM.Balance`",
-	)
-	assert.ErrorContains(
-		t,
-		err,
-		"error: value of type `EVM` has no member `createBridgedAccount`",
+func TestEVMGetLatestBlock(t *testing.T) {
+	t.Parallel()
+
+	contractsAddress := flow.BytesToAddress([]byte{0x1})
+
+	latestBlock := &types.Block{
+		Height:      uint64(2),
+		TotalSupply: big.NewInt(1500000000000000000),
+		Timestamp:   uint64(1337),
+	}
+	handler := &testContractHandler{
+		evmContractAddress: common.Address(contractsAddress),
+		lastExecutedBlock: func() *types.Block {
+			return latestBlock
+		},
+	}
+
+	script := []byte(`
+      import EVM from 0x1
+
+      access(all)
+      fun main(): EVM.EVMBlock {
+        return EVM.getLatestBlock()
+      }
+	`)
+
+	evmBlockCadenceType := stdlib.NewEVMBlockCadenceType(
+		common.Address(contractsAddress),
 	)
+
+	blockHeight := cadence.NewUInt64(latestBlock.Height)
+	hash, err := latestBlock.Hash()
+	require.NoError(t, err)
+	blockHash, err := cadence.NewString(hash.Hex())
+	require.NoError(t, err)
+	blockTotalSupply := cadence.NewIntFromBig(latestBlock.TotalSupply)
+	timestamp := cadence.NewUInt64(latestBlock.Timestamp)
+
+	expectedEVMBlock := cadence.Struct{
+		StructType: evmBlockCadenceType,
+		Fields: []cadence.Value{
+			blockHeight,
+			blockHash,
+			blockTotalSupply,
+			timestamp,
+		},
+	}
+
+	RunEVMScript(t, handler, script, expectedEVMBlock)
 }
diff --git a/fvm/evm/testutils/accounts.go b/fvm/evm/testutils/accounts.go
index 8df4b712508..41d6133f323 100644
--- a/fvm/evm/testutils/accounts.go
+++ b/fvm/evm/testutils/accounts.go
@@ -8,9 +8,9 @@ import (
 	"sync"
 	"testing"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	gethCrypto "github.com/ethereum/go-ethereum/crypto"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethCrypto "github.com/onflow/go-ethereum/crypto"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/atree"
@@ -97,6 +97,10 @@ func (a *EOATestAccount) signTx(
 	return tx
 }
 
+func (a *EOATestAccount) Nonce() uint64 {
+	return a.nonce
+}
+
 func (a *EOATestAccount) SetNonce(nonce uint64) {
 	a.lock.Lock()
 	defer a.lock.Unlock()
@@ -132,8 +136,10 @@ func FundAndGetEOATestAccount(t testing.TB, led atree.Ledger, flowEVMRootAddress
 
 	_, err = blk.DirectCall(
 		types.NewDepositCall(
+			RandomAddress(t), // any random non-empty address works here
 			account.Address(),
 			new(big.Int).Mul(big.NewInt(1e18), big.NewInt(1000)),
+			account.nonce,
 		),
 	)
 	require.NoError(t, err)
diff --git a/fvm/evm/testutils/backend.go b/fvm/evm/testutils/backend.go
index 8c73fbf02f3..472d38201f4 100644
--- a/fvm/evm/testutils/backend.go
+++ b/fvm/evm/testutils/backend.go
@@ -1,11 +1,13 @@
 package testutils
 
 import (
+	"crypto/rand"
 	"encoding/binary"
 	"fmt"
-	"math"
 	"testing"
 
+	"github.com/onflow/cadence/runtime/stdlib"
+
 	"github.com/onflow/atree"
 	"github.com/onflow/cadence"
 	jsoncdc "github.com/onflow/cadence/encoding/json"
@@ -21,7 +23,7 @@ import (
 )
 
 var TestFlowEVMRootAddress = flow.BytesToAddress([]byte("FlowEVM"))
-var TestComputationLimit = uint(math.MaxUint64 - 1)
+var TestComputationLimit = uint(100_000_000)
 
 func RunWithTestFlowEVMRootAddress(t testing.TB, backend atree.Ledger, f func(flow.Address)) {
 	as := environment.NewAccountStatus()
@@ -32,10 +34,12 @@ func RunWithTestFlowEVMRootAddress(t testing.TB, backend atree.Ledger, f func(fl
 
 func RunWithTestBackend(t testing.TB, f func(*TestBackend)) {
 	tb := &TestBackend{
-		TestValueStore:   GetSimpleValueStore(),
-		testEventEmitter: getSimpleEventEmitter(),
-		testMeter:        getSimpleMeter(),
-		TestBlockInfo:    &TestBlockInfo{},
+		TestValueStore:              GetSimpleValueStore(),
+		testEventEmitter:            getSimpleEventEmitter(),
+		testMeter:                   getSimpleMeter(),
+		TestBlockInfo:               getSimpleBlockStore(),
+		TestRandomGenerator:         getSimpleRandomGenerator(),
+		TestContractFunctionInvoker: &TestContractFunctionInvoker{},
 	}
 	f(tb)
 }
@@ -78,6 +82,10 @@ func GetSimpleValueStore() *TestValueStore {
 		},
 		AllocateStorageIndexFunc: func(owner []byte) (atree.StorageIndex, error) {
 			index := allocator[string(owner)]
+			// TODO: figure out why it result in a collision
+			if index == 0 {
+				index = 10
+			}
 			var data [8]byte
 			allocator[string(owner)] = index + 1
 			binary.BigEndian.PutUint64(data[:], index)
@@ -133,18 +141,17 @@ func getSimpleEventEmitter() *testEventEmitter {
 }
 
 func getSimpleMeter() *testMeter {
-	computationLimit := TestComputationLimit
 	compUsed := uint(0)
 	return &testMeter{
 		meterComputation: func(kind common.ComputationKind, intensity uint) error {
 			compUsed += intensity
-			if compUsed > computationLimit {
-				return fmt.Errorf("computation limit has hit %d", computationLimit)
+			if compUsed > TestComputationLimit {
+				return fmt.Errorf("computation limit has hit %d", TestComputationLimit)
 			}
 			return nil
 		},
 		hasComputationCapacity: func(kind common.ComputationKind, intensity uint) bool {
-			return compUsed+intensity < computationLimit
+			return compUsed+intensity < TestComputationLimit
 		},
 		computationUsed: func() (uint64, error) {
 			return uint64(compUsed), nil
@@ -152,11 +159,32 @@ func getSimpleMeter() *testMeter {
 	}
 }
 
+func getSimpleBlockStore() *TestBlockInfo {
+	var index int64 = 1
+	return &TestBlockInfo{
+		GetCurrentBlockHeightFunc: func() (uint64, error) {
+			index++
+			return uint64(index), nil
+		},
+		GetBlockAtHeightFunc: func(height uint64) (runtime.Block, bool, error) {
+			return runtime.Block{
+				Height:    height,
+				View:      0,
+				Hash:      stdlib.BlockHash{},
+				Timestamp: int64(height),
+			}, true, nil
+		},
+	}
+}
+
 type TestBackend struct {
 	*TestValueStore
 	*testMeter
 	*testEventEmitter
 	*TestBlockInfo
+	*TestRandomGenerator
+	*TestContractFunctionInvoker
+	*testUUIDGenerator
 }
 
 var _ types.Backend = &TestBackend{}
@@ -175,6 +203,10 @@ func (tb *TestBackend) DropEvents() {
 	tb.reset()
 }
 
+func (tb *TestBackend) Get(id flow.RegisterID) (flow.RegisterValue, error) {
+	return tb.GetValue([]byte(id.Owner), []byte(id.Key))
+}
+
 type TestValueStore struct {
 	GetValueFunc             func(owner, key []byte) ([]byte, error)
 	SetValueFunc             func(owner, key, value []byte) error
@@ -405,3 +437,63 @@ func (tb *TestBlockInfo) GetBlockAtHeight(height uint64) (runtime.Block, bool, e
 	}
 	return tb.GetBlockAtHeightFunc(height)
 }
+
+type TestRandomGenerator struct {
+	ReadRandomFunc func([]byte) error
+}
+
+var _ environment.RandomGenerator = &TestRandomGenerator{}
+
+func (t *TestRandomGenerator) ReadRandom(buffer []byte) error {
+	if t.ReadRandomFunc == nil {
+		panic("ReadRandomFunc method is not set")
+	}
+	return t.ReadRandomFunc(buffer)
+}
+
+func getSimpleRandomGenerator() *TestRandomGenerator {
+	return &TestRandomGenerator{
+		ReadRandomFunc: func(buffer []byte) error {
+			_, err := rand.Read(buffer)
+			return err
+		},
+	}
+}
+
+type TestContractFunctionInvoker struct {
+	InvokeFunc func(
+		spec environment.ContractFunctionSpec,
+		arguments []cadence.Value,
+	) (
+		cadence.Value,
+		error,
+	)
+}
+
+var _ environment.ContractFunctionInvoker = &TestContractFunctionInvoker{}
+
+func (t *TestContractFunctionInvoker) Invoke(
+	spec environment.ContractFunctionSpec,
+	arguments []cadence.Value,
+) (
+	cadence.Value,
+	error,
+) {
+	if t.InvokeFunc == nil {
+		panic("InvokeFunc method is not set")
+	}
+	return t.InvokeFunc(spec, arguments)
+}
+
+type testUUIDGenerator struct {
+	generateUUID func() (uint64, error)
+}
+
+var _ environment.UUIDGenerator = &testUUIDGenerator{}
+
+func (t *testUUIDGenerator) GenerateUUID() (uint64, error) {
+	if t.generateUUID == nil {
+		panic("generateUUID method is not set")
+	}
+	return t.generateUUID()
+}
diff --git a/fvm/evm/testutils/cadence.go b/fvm/evm/testutils/cadence.go
index a35070c3f69..0ec8fd7ca87 100644
--- a/fvm/evm/testutils/cadence.go
+++ b/fvm/evm/testutils/cadence.go
@@ -16,6 +16,7 @@ import (
 	"github.com/onflow/cadence"
 	"github.com/onflow/cadence/encoding/json"
 	"github.com/onflow/cadence/runtime"
+	"github.com/onflow/cadence/runtime/ast"
 	"github.com/onflow/cadence/runtime/common"
 	"github.com/onflow/cadence/runtime/interpreter"
 	"github.com/onflow/cadence/runtime/sema"
@@ -24,31 +25,58 @@ import (
 	"go.opentelemetry.io/otel/attribute"
 )
 
-// TODO: replace with Cadence runtime testing utils once available https://github.com/onflow/cadence/pull/2800
-
-func SingleIdentifierLocationResolver(t testing.TB) func(
-	identifiers []runtime.Identifier,
-	location runtime.Location,
+// LocationResolver is a location Cadence runtime interface location resolver
+// very similar to ContractReader.ResolveLocation,
+// but it does not look up available contract names
+func LocationResolver(
+	identifiers []ast.Identifier,
+	location common.Location,
 ) (
-	[]runtime.ResolvedLocation,
-	error,
+	result []sema.ResolvedLocation,
+	err error,
 ) {
-	return func(identifiers []runtime.Identifier, location runtime.Location) ([]runtime.ResolvedLocation, error) {
-		require.Len(t, identifiers, 1)
-		require.IsType(t, common.AddressLocation{}, location)
+	addressLocation, isAddress := location.(common.AddressLocation)
 
+	// if the location is not an address location, e.g. an identifier location
+	// (`import Crypto`), then return a single resolved location which declares
+	// all identifiers.
+	if !isAddress {
 		return []runtime.ResolvedLocation{
 			{
-				Location: common.AddressLocation{
-					Address: location.(common.AddressLocation).Address,
-					Name:    identifiers[0].Identifier,
-				},
+				Location:    location,
 				Identifiers: identifiers,
 			},
 		}, nil
 	}
+
+	// if the location is an address,
+	// and no specific identifiers where requested in the import statement,
+	// then assume the imported identifier is the address location's identifier (the contract)
+	if len(identifiers) == 0 {
+		identifiers = []ast.Identifier{
+			{Identifier: addressLocation.Name},
+		}
+	}
+
+	// return one resolved location per identifier.
+	// each resolved location is an address contract location
+	resolvedLocations := make([]runtime.ResolvedLocation, len(identifiers))
+	for i := range resolvedLocations {
+		identifier := identifiers[i]
+		resolvedLocations[i] = runtime.ResolvedLocation{
+			Location: common.AddressLocation{
+				Address: addressLocation.Address,
+				Name:    identifier.Identifier,
+			},
+			Identifiers: []runtime.Identifier{identifier},
+		}
+	}
+
+	return resolvedLocations, nil
 }
 
+// TODO: replace with Cadence runtime testing utils once available https://github.com/onflow/cadence/pull/2800
+
 func newLocationGenerator[T ~[32]byte]() func() T {
 	var count uint64
 	return func() T {
@@ -689,3 +717,10 @@ func (i *TestRuntimeInterface) InteractionUsed() (uint64, error) {
 
 	return i.OnInteractionUsed()
 }
+
+func CheckCadenceEventTypes(t testing.TB, events []cadence.Event, expectedTypes []string) {
+	require.Equal(t, len(events), len(expectedTypes))
+	for i, ev := range events {
+		require.Equal(t, expectedTypes[i], ev.EventType.QualifiedIdentifier)
+	}
+}
diff --git a/fvm/evm/testutils/contract.go b/fvm/evm/testutils/contract.go
index f67cced4c94..d00e6ee133a 100644
--- a/fvm/evm/testutils/contract.go
+++ b/fvm/evm/testutils/contract.go
@@ -1,401 +1,83 @@
 package testutils
 
 import (
-	"encoding/hex"
 	"math"
 	"math/big"
 	"strings"
 	"testing"
 
-	gethABI "github.com/ethereum/go-ethereum/accounts/abi"
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	"github.com/stretchr/testify/require"
-
 	"github.com/onflow/atree"
+	gethABI "github.com/onflow/go-ethereum/accounts/abi"
+	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/fvm/evm/emulator"
+	"github.com/onflow/flow-go/fvm/evm/testutils/contracts"
 	"github.com/onflow/flow-go/fvm/evm/types"
 	"github.com/onflow/flow-go/model/flow"
 )
 
 type TestContract struct {
-	Code       string
 	ABI        string
 	ByteCode   []byte
 	DeployedAt types.Address
 }
 
-func (tc *TestContract) MakeCallData(t testing.TB, name string, args ...interface{}) []byte {
-	abi, err := gethABI.JSON(strings.NewReader(tc.ABI))
+func MakeCallData(t testing.TB, abiString string, name string, args ...interface{}) []byte {
+	abi, err := gethABI.JSON(strings.NewReader(abiString))
 	require.NoError(t, err)
 	call, err := abi.Pack(name, args...)
 	require.NoError(t, err)
 	return call
 }
 
+func (tc *TestContract) MakeCallData(t testing.TB, name string, args ...interface{}) []byte {
+	return MakeCallData(t, tc.ABI, name, args...)
+}
+
 func (tc *TestContract) SetDeployedAt(deployedAt types.Address) {
 	tc.DeployedAt = deployedAt
 }
 
 func GetStorageTestContract(tb testing.TB) *TestContract {
-	byteCodes, err := hex.DecodeString("608060405261022c806100136000396000f3fe608060405234801561001057600080fd5b50600436106100575760003560e01c80632e64cec11461005c57806348b151661461007a57806357e871e7146100985780636057361d146100b657806385df51fd146100d2575b600080fd5b610064610102565b6040516100719190610149565b60405180910390f35b61008261010b565b60405161008f9190610149565b60405180910390f35b6100a0610113565b6040516100ad9190610149565b60405180910390f35b6100d060048036038101906100cb9190610195565b61011b565b005b6100ec60048036038101906100e79190610195565b610125565b6040516100f991906101db565b60405180910390f35b60008054905090565b600042905090565b600043905090565b8060008190555050565b600081409050919050565b6000819050919050565b61014381610130565b82525050565b600060208201905061015e600083018461013a565b92915050565b600080fd5b61017281610130565b811461017d57600080fd5b50565b60008135905061018f81610169565b92915050565b6000602082840312156101ab576101aa610164565b5b60006101b984828501610180565b91505092915050565b6000819050919050565b6101d5816101c2565b82525050565b60006020820190506101f060008301846101cc565b9291505056fea26469706673582212203ee61567a25f0b1848386ae6b8fdbd7733c8a502c83b5ed305b921b7933f4e8164736f6c63430008120033")
-	require.NoError(tb, err)
 	return &TestContract{
-		Code: `
-			contract Storage {
-				uint256 number;
-				constructor() payable {
-				}
-				function store(uint256 num) public {
-					number = num;
-				}
-				function retrieve() public view returns (uint256){
-					return number;
-				}
-				function blockNumber() public view returns (uint256) {
-					return block.number;
-				}
-				function blockTime() public view returns (uint) {
-					return  block.timestamp;
-				}
-				function blockHash(uint num)  public view returns (bytes32) {
-					return blockhash(num);
-				}
-			}
-		`,
-
-		ABI: `
-		[
-			{
-				"inputs": [],
-				"stateMutability": "payable",
-				"type": "constructor"
-			},
-			{
-				"inputs": [
-					{
-						"internalType": "uint256",
-						"name": "num",
-						"type": "uint256"
-					}
-				],
-				"name": "blockHash",
-				"outputs": [
-					{
-						"internalType": "bytes32",
-						"name": "",
-						"type": "bytes32"
-					}
-				],
-				"stateMutability": "view",
-				"type": "function"
-			},
-			{
-				"inputs": [],
-				"name": "blockNumber",
-				"outputs": [
-					{
-						"internalType": "uint256",
-						"name": "",
-						"type": "uint256"
-					}
-				],
-				"stateMutability": "view",
-				"type": "function"
-			},
-			{
-				"inputs": [],
-				"name": "blockTime",
-				"outputs": [
-					{
-						"internalType": "uint256",
-						"name": "",
-						"type": "uint256"
-					}
-				],
-				"stateMutability": "view",
-				"type": "function"
-			},
-			{
-				"inputs": [],
-				"name": "retrieve",
-				"outputs": [
-					{
-						"internalType": "uint256",
-						"name": "",
-						"type": "uint256"
-					}
-				],
-				"stateMutability": "view",
-				"type": "function"
-			},
-			{
-				"inputs": [
-					{
-						"internalType": "uint256",
-						"name": "num",
-						"type": "uint256"
-					}
-				],
-				"name": "store",
-				"outputs": [],
-				"stateMutability": "nonpayable",
-				"type": "function"
-			}
-		]
-		`,
-		ByteCode: byteCodes,
+		ABI:      contracts.TestContractABIJSON,
+		ByteCode: contracts.TestContractBytes,
 	}
 }
 
 func GetDummyKittyTestContract(t testing.TB) *TestContract {
-	byteCodes, err := hex.DecodeString("608060405234801561001057600080fd5b506107dd806100206000396000f3fe608060405234801561001057600080fd5b50600436106100415760003560e01c8063a45f4bfc14610046578063d0b169d114610076578063ddf252ad146100a6575b600080fd5b610060600480360381019061005b91906104e4565b6100c2565b60405161006d9190610552565b60405180910390f35b610090600480360381019061008b919061056d565b6100f5565b60405161009d91906105e3565b60405180910390f35b6100c060048036038101906100bb919061062a565b610338565b005b60026020528060005260406000206000915054906101000a900473ffffffffffffffffffffffffffffffffffffffff1681565b60008463ffffffff16851461010957600080fd5b8363ffffffff16841461011b57600080fd5b8261ffff16831461012b57600080fd5b60006040518060a001604052808481526020014267ffffffffffffffff1681526020018763ffffffff1681526020018663ffffffff1681526020018561ffff16815250905060018190806001815401808255809150506001900390600052602060002090600202016000909190919091506000820151816000015560208201518160010160006101000a81548167ffffffffffffffff021916908367ffffffffffffffff16021790555060408201518160010160086101000a81548163ffffffff021916908363ffffffff160217905550606082015181600101600c6101000a81548163ffffffff021916908363ffffffff16021790555060808201518160010160106101000a81548161ffff021916908361ffff16021790555050507fc1e409485f45287e73ab1623a8f2ef17af5eac1b4c792ee9ec466e8795e7c09133600054836040015163ffffffff16846060015163ffffffff16856000015160405161029995949392919061067d565b60405180910390a13073ffffffffffffffffffffffffffffffffffffffff1663ddf252ad6000336000546040518463ffffffff1660e01b81526004016102e1939291906106d0565b600060405180830381600087803b1580156102fb57600080fd5b505af115801561030f573d6000803e3d6000fd5b5050505060008081548092919061032590610736565b9190505550600054915050949350505050565b600360008373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff168152602001908152602001600020600081548092919061038890610736565b9190505550816002600083815260200190815260200160002060006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff160217905550600073ffffffffffffffffffffffffffffffffffffffff168373ffffffffffffffffffffffffffffffffffffffff161461046957600360008473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200190815260200160002060008154809291906104639061077e565b91905055505b7feaf1c4b3ce0f4f62a2bae7eb3e68225c75f7e6ff4422073b7437b9a78d25f17083838360405161049c939291906106d0565b60405180910390a1505050565b600080fd5b6000819050919050565b6104c1816104ae565b81146104cc57600080fd5b50565b6000813590506104de816104b8565b92915050565b6000602082840312156104fa576104f96104a9565b5b6000610508848285016104cf565b91505092915050565b600073ffffffffffffffffffffffffffffffffffffffff82169050919050565b600061053c82610511565b9050919050565b61054c81610531565b82525050565b60006020820190506105676000830184610543565b92915050565b60008060008060808587031215610587576105866104a9565b5b6000610595878288016104cf565b94505060206105a6878288016104cf565b93505060406105b7878288016104cf565b92505060606105c8878288016104cf565b91505092959194509250565b6105dd816104ae565b82525050565b60006020820190506105f860008301846105d4565b92915050565b61060781610531565b811461061257600080fd5b50565b600081359050610624816105fe565b92915050565b600080600060608486031215610643576106426104a9565b5b600061065186828701610615565b935050602061066286828701610615565b9250506040610673868287016104cf565b9150509250925092565b600060a0820190506106926000830188610543565b61069f60208301876105d4565b6106ac60408301866105d4565b6106b960608301856105d4565b6106c660808301846105d4565b9695505050505050565b60006060820190506106e56000830186610543565b6106f26020830185610543565b6106ff60408301846105d4565b949350505050565b7f4e487b7100000000000000000000000000000000000000000000000000000000600052601160045260246000fd5b6000610741826104ae565b91507fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff820361077357610772610707565b5b600182019050919050565b6000610789826104ae565b91506000820361079c5761079b610707565b5b60018203905091905056fea2646970667358221220ab35c07ec72cc064a663de06ec7f5f919b1a499a25cf6ef0c63a45fdd4a1e91e64736f6c63430008120033")
-	require.NoError(t, err)
 	return &TestContract{
-		Code: `
-			contract DummyKitty {
-				
-				event BirthEvent(address owner, uint256 kittyId, uint256 matronId, uint256 sireId, uint256 genes);
-				event TransferEvent(address from, address to, uint256 tokenId);
-			
-				struct Kitty {
-					uint256 genes;
-					uint64 birthTime;
-					uint32 matronId;
-					uint32 sireId;
-					uint16 generation;
-				}
-			
-				uint256 idCounter;
-			
-				// @dev all kitties 
-				Kitty[] kitties;
-			
-				/// @dev a mapping from cat IDs to the address that owns them. 
-				mapping (uint256 => address) public kittyIndexToOwner;
-			
-				// @dev a mapping from owner address to count of tokens that address owns.
-				mapping (address => uint256) ownershipTokenCount;
-			
-				/// @dev a method to transfer kitty
-				function Transfer(address _from, address _to, uint256 _tokenId) external {
-					// Since the number of kittens is capped to 2^32 we can't overflow this
-					ownershipTokenCount[_to]++;
-					// transfer ownership
-					kittyIndexToOwner[_tokenId] = _to;
-					// When creating new kittens _from is 0x0, but we can't account that address.
-					if (_from != address(0)) {
-						ownershipTokenCount[_from]--;
-					}
-					// Emit the transfer event.
-					emit TransferEvent(_from, _to, _tokenId);
-				}
-			
-				/// @dev a method callable by anyone to create a kitty
-				function CreateKitty(
-					uint256 _matronId,
-					uint256 _sireId,
-					uint256 _generation,
-					uint256 _genes
-				)
-					external
-					returns (uint)
-				{
-			
-					require(_matronId == uint256(uint32(_matronId)));
-					require(_sireId == uint256(uint32(_sireId)));
-					require(_generation == uint256(uint16(_generation)));
-			
-					Kitty memory _kitty = Kitty({
-						genes: _genes,
-						birthTime: uint64(block.timestamp),
-						matronId: uint32(_matronId),
-						sireId: uint32(_sireId),
-						generation: uint16(_generation)
-					});
-			
-					kitties.push(_kitty);
-			
-					emit BirthEvent(
-						msg.sender,
-						idCounter,
-						uint256(_kitty.matronId),
-						uint256(_kitty.sireId),
-						_kitty.genes
-					);
-			
-					this.Transfer(address(0), msg.sender, idCounter);
-			
-					idCounter++;
-			
-					return idCounter;
-				}
-			}
-		`,
-
-		ABI: `
-		[
-			{
-				"anonymous": false,
-				"inputs": [
-					{
-						"indexed": false,
-						"internalType": "address",
-						"name": "owner",
-						"type": "address"
-					},
-					{
-						"indexed": false,
-						"internalType": "uint256",
-						"name": "kittyId",
-						"type": "uint256"
-					},
-					{
-						"indexed": false,
-						"internalType": "uint256",
-						"name": "matronId",
-						"type": "uint256"
-					},
-					{
-						"indexed": false,
-						"internalType": "uint256",
-						"name": "sireId",
-						"type": "uint256"
-					},
-					{
-						"indexed": false,
-						"internalType": "uint256",
-						"name": "genes",
-						"type": "uint256"
-					}
-				],
-				"name": "BirthEvent",
-				"type": "event"
-			},
-			{
-				"anonymous": false,
-				"inputs": [
-					{
-						"indexed": false,
-						"internalType": "address",
-						"name": "from",
-						"type": "address"
-					},
-					{
-						"indexed": false,
-						"internalType": "address",
-						"name": "to",
-						"type": "address"
-					},
-					{
-						"indexed": false,
-						"internalType": "uint256",
-						"name": "tokenId",
-						"type": "uint256"
-					}
-				],
-				"name": "TransferEvent",
-				"type": "event"
-			},
-			{
-				"inputs": [
-					{
-						"internalType": "uint256",
-						"name": "_matronId",
-						"type": "uint256"
-					},
-					{
-						"internalType": "uint256",
-						"name": "_sireId",
-						"type": "uint256"
-					},
-					{
-						"internalType": "uint256",
-						"name": "_generation",
-						"type": "uint256"
-					},
-					{
-						"internalType": "uint256",
-						"name": "_genes",
-						"type": "uint256"
-					}
-				],
-				"name": "CreateKitty",
-				"outputs": [
-					{
-						"internalType": "uint256",
-						"name": "",
-						"type": "uint256"
-					}
-				],
-				"stateMutability": "nonpayable",
-				"type": "function"
-			},
-			{
-				"inputs": [
-					{
-						"internalType": "address",
-						"name": "_from",
-						"type": "address"
-					},
-					{
-						"internalType": "address",
-						"name": "_to",
-						"type": "address"
-					},
-					{
-						"internalType": "uint256",
-						"name": "_tokenId",
-						"type": "uint256"
-					}
-				],
-				"name": "Transfer",
-				"outputs": [],
-				"stateMutability": "nonpayable",
-				"type": "function"
-			},
-			{
-				"inputs": [
-					{
-						"internalType": "uint256",
-						"name": "",
-						"type": "uint256"
-					}
-				],
-				"name": "kittyIndexToOwner",
-				"outputs": [
-					{
-						"internalType": "address",
-						"name": "",
-						"type": "address"
-					}
-				],
-				"stateMutability": "view",
-				"type": "function"
-			}
-		]
-		`,
-		ByteCode: byteCodes,
+		ABI:      contracts.DummyKittyContractABIJSON,
+		ByteCode: contracts.DummyKittyContractBytes,
 	}
 }
 
 func RunWithDeployedContract(t testing.TB, tc *TestContract, led atree.Ledger, flowEVMRootAddress flow.Address, f func(*TestContract)) {
-	DeployContract(t, tc, led, flowEVMRootAddress)
+	DeployContract(t, RandomAddress(t), tc, led, flowEVMRootAddress)
 	f(tc)
 }
 
-func DeployContract(t testing.TB, tc *TestContract, led atree.Ledger, flowEVMRootAddress flow.Address) {
+func DeployContract(t testing.TB, caller types.Address, tc *TestContract, led atree.Ledger, flowEVMRootAddress flow.Address) {
 	// deploy contract
 	e := emulator.NewEmulator(led, flowEVMRootAddress)
 
-	blk, err := e.NewBlockView(types.NewDefaultBlockContext(2))
+	ctx := types.NewDefaultBlockContext(2)
+
+	bl, err := e.NewReadOnlyBlockView(ctx)
+	require.NoError(t, err)
+
+	nonce, err := bl.NonceOf(caller)
+	require.NoError(t, err)
+
+	blk, err := e.NewBlockView(ctx)
 	require.NoError(t, err)
 
-	caller := types.NewAddress(gethCommon.Address{})
 	_, err = blk.DirectCall(
 		types.NewDepositCall(
+			RandomAddress(t), // any random non-empty address works here
 			caller,
 			new(big.Int).Mul(big.NewInt(1e18), big.NewInt(1000)),
+			nonce,
 		),
 	)
 	require.NoError(t, err)
@@ -409,9 +91,9 @@ func DeployContract(t testing.TB, tc *TestContract, led atree.Ledger, flowEVMRoo
 			tc.ByteCode,
 			math.MaxUint64,
 			big.NewInt(0),
+			nonce+1,
 		),
 	)
 	require.NoError(t, err)
-
 	tc.SetDeployedAt(res.DeployedContractAddress)
 }
diff --git a/fvm/evm/testutils/contracts/contracts.go b/fvm/evm/testutils/contracts/contracts.go
new file mode 100644
index 00000000000..adce36b692e
--- /dev/null
+++ b/fvm/evm/testutils/contracts/contracts.go
@@ -0,0 +1,22 @@
+package contracts
+
+import (
+	_ "embed"
+	"encoding/hex"
+)
+
+//go:embed test_bytes.hex
+var testContractBytesInHex string
+
+var TestContractBytes, _ = hex.DecodeString(testContractBytesInHex)
+
+//go:embed test_abi.json
+var TestContractABIJSON string
+
+//go:embed dummy_kitty_bytes.hex
+var dummyKittyContractBytesInHex string
+
+var DummyKittyContractBytes, _ = hex.DecodeString(dummyKittyContractBytesInHex)
+
+//go:embed dummy_kitty_abi.json
+var DummyKittyContractABIJSON string
diff --git a/fvm/evm/testutils/contracts/dummy_kitty.sol b/fvm/evm/testutils/contracts/dummy_kitty.sol
new file mode 100644
index 00000000000..e93570da7f1
--- /dev/null
+++ b/fvm/evm/testutils/contracts/dummy_kitty.sol
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-3.0
+
+contract DummyKitty {		
+    event BirthEvent(address owner, uint256 kittyId, uint256 matronId, uint256 sireId, uint256 genes);
+    event TransferEvent(address from, address to, uint256 tokenId);
+
+    struct Kitty {
+        uint256 genes;
+        uint64 birthTime;
+        uint32 matronId;
+        uint32 sireId;
+        uint16 generation;
+    }
+
+    uint256 idCounter;
+
+    // @dev all kitties 
+    Kitty[] kitties;
+
+    /// @dev a mapping from cat IDs to the address that owns them. 
+    mapping (uint256 => address) public kittyIndexToOwner;
+
+    // @dev a mapping from owner address to count of tokens that address owns.
+    mapping (address => uint256) ownershipTokenCount;
+
+    /// @dev a method to transfer kitty
+    function Transfer(address _from, address _to, uint256 _tokenId) external {
+        // Since the number of kittens is capped to 2^32 we can't overflow this
+        ownershipTokenCount[_to]++;
+        // transfer ownership
+        kittyIndexToOwner[_tokenId] = _to;
+        // When creating new kittens _from is 0x0, but we can't account that address.
+        if (_from != address(0)) {
+            ownershipTokenCount[_from]--;
+        }
+        // Emit the transfer event.
+        emit TransferEvent(_from, _to, _tokenId);
+    }
+
+    /// @dev a method callable by anyone to create a kitty
+    function CreateKitty(
+        uint256 _matronId,
+        uint256 _sireId,
+        uint256 _generation,
+        uint256 _genes
+    )
+        external
+        returns (uint)
+    {
+
+        require(_matronId == uint256(uint32(_matronId)));
+        require(_sireId == uint256(uint32(_sireId)));
+        require(_generation == uint256(uint16(_generation)));
+
+        Kitty memory _kitty = Kitty({
+            genes: _genes,
+            birthTime: uint64(block.timestamp),
+            matronId: uint32(_matronId),
+            sireId: uint32(_sireId),
+            generation: uint16(_generation)
+        });
+
+        kitties.push(_kitty);
+
+        emit BirthEvent(
+            msg.sender,
+            idCounter,
+            uint256(_kitty.matronId),
+            uint256(_kitty.sireId),
+            _kitty.genes
+        );
+
+        this.Transfer(address(0), msg.sender, idCounter);
+
+        idCounter++;
+
+        return idCounter;
+    }
+}
\ No newline at end of file
diff --git a/fvm/evm/testutils/contracts/dummy_kitty_abi.json b/fvm/evm/testutils/contracts/dummy_kitty_abi.json
new file mode 100644
index 00000000000..44294463ca1
--- /dev/null
+++ b/fvm/evm/testutils/contracts/dummy_kitty_abi.json
@@ -0,0 +1,140 @@
+[
+    {
+        "anonymous": false,
+        "inputs": [
+            {
+                "indexed": false,
+                "internalType": "address",
+                "name": "owner",
+                "type": "address"
+            },
+            {
+                "indexed": false,
+                "internalType": "uint256",
+                "name": "kittyId",
+                "type": "uint256"
+            },
+            {
+                "indexed": false,
+                "internalType": "uint256",
+                "name": "matronId",
+                "type": "uint256"
+            },
+            {
+                "indexed": false,
+                "internalType": "uint256",
+                "name": "sireId",
+                "type": "uint256"
+            },
+            {
+                "indexed": false,
+                "internalType": "uint256",
+                "name": "genes",
+                "type": "uint256"
+            }
+        ],
+        "name": "BirthEvent",
+        "type": "event"
+    },
+    {
+        "anonymous": false,
+        "inputs": [
+            {
+                "indexed": false,
+                "internalType": "address",
+                "name": "from",
+                "type": "address"
+            },
+            {
+                "indexed": false,
+                "internalType": "address",
+                "name": "to",
+                "type": "address"
+            },
+            {
+                "indexed": false,
+                "internalType": "uint256",
+                "name": "tokenId",
+                "type": "uint256"
+            }
+        ],
+        "name": "TransferEvent",
+        "type": "event"
+    },
+    {
+        "inputs": [
+            {
+                "internalType": "uint256",
+                "name": "_matronId",
+                "type": "uint256"
+            },
+            {
+                "internalType": "uint256",
+                "name": "_sireId",
+                "type": "uint256"
+            },
+            {
+                "internalType": "uint256",
+                "name": "_generation",
+                "type": "uint256"
+            },
+            {
+                "internalType": "uint256",
+                "name": "_genes",
+                "type": "uint256"
+            }
+        ],
+        "name": "CreateKitty",
+        "outputs": [
+            {
+                "internalType": "uint256",
+                "name": "",
+                "type": "uint256"
+            }
+        ],
+        "stateMutability": "nonpayable",
+        "type": "function"
+    },
+    {
+        "inputs": [
+            {
+                "internalType": "address",
+                "name": "_from",
+                "type": "address"
+            },
+            {
+                "internalType": "address",
+                "name": "_to",
+                "type": "address"
+            },
+            {
+                "internalType": "uint256",
+                "name": "_tokenId",
+                "type": "uint256"
+            }
+        ],
+        "name": "Transfer",
+        "outputs": [],
+        "stateMutability": "nonpayable",
+        "type": "function"
+    },
+    {
+        "inputs": [
+            {
+                "internalType": "uint256",
+                "name": "",
+                "type": "uint256"
+            }
+        ],
+        "name": "kittyIndexToOwner",
+        "outputs": [
+            {
+                "internalType": "address",
+                "name": "",
+                "type": "address"
+            }
+        ],
+        "stateMutability": "view",
+        "type": "function"
+    }
+]
\ No newline at end of file
diff --git a/fvm/evm/testutils/contracts/dummy_kitty_bytes.hex b/fvm/evm/testutils/contracts/dummy_kitty_bytes.hex
new file mode 100644
index 00000000000..81d8760e5db
--- /dev/null
+++ b/fvm/evm/testutils/contracts/dummy_kitty_bytes.hex
@@ -0,0 +1 @@
+608060405234801561001057600080fd5b506107dd806100206000396000f3fe608060405234801561001057600080fd5b50600436106100415760003560e01c8063a45f4bfc14610046578063d0b169d114610076578063ddf252ad146100a6575b600080fd5b610060600480360381019061005b91906104e4565b6100c2565b60405161006d9190610552565b60405180910390f35b610090600480360381019061008b919061056d565b6100f5565b60405161009d91906105e3565b60405180910390f35b6100c060048036038101906100bb919061062a565b610338565b005b60026020528060005260406000206000915054906101000a900473ffffffffffffffffffffffffffffffffffffffff1681565b60008463ffffffff16851461010957600080fd5b8363ffffffff16841461011b57600080fd5b8261ffff16831461012b57600080fd5b60006040518060a001604052808481526020014267ffffffffffffffff1681526020018763ffffffff1681526020018663ffffffff1681526020018561ffff16815250905060018190806001815401808255809150506001900390600052602060002090600202016000909190919091506000820151816000015560208201518160010160006101000a81548167ffffffffffffffff021916908367ffffffffffffffff16021790555060408201518160010160086101000a81548163ffffffff021916908363ffffffff160217905550606082015181600101600c6101000a81548163ffffffff021916908363ffffffff16021790555060808201518160010160106101000a81548161ffff021916908361ffff16021790555050507fc1e409485f45287e73ab1623a8f2ef17af5eac1b4c792ee9ec466e8795e7c09133600054836040015163ffffffff16846060015163ffffffff16856000015160405161029995949392919061067d565b60405180910390a13073ffffffffffffffffffffffffffffffffffffffff1663ddf252ad6000336000546040518463ffffffff1660e01b81526004016102e1939291906106d0565b600060405180830381600087803b1580156102fb57600080fd5b505af115801561030f573d6000803e3d6000fd5b5050505060008081548092919061032590610736565b9190505550600054915050949350505050565b600360008373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff168152602001908152602001600020600081548092919061038890610736565b9190505550816002600083815260200190815260200160002060006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff160217905550600073ffffffffffffffffffffffffffffffffffffffff168373ffffffffffffffffffffffffffffffffffffffff161461046957600360008473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200190815260200160002060008154809291906104639061077e565b91905055505b7feaf1c4b3ce0f4f62a2bae7eb3e68225c75f7e6ff4422073b7437b9a78d25f17083838360405161049c939291906106d0565b60405180910390a1505050565b600080fd5b6000819050919050565b6104c1816104ae565b81146104cc57600080fd5b50565b6000813590506104de816104b8565b92915050565b6000602082840312156104fa576104f96104a9565b5b6000610508848285016104cf565b91505092915050565b600073ffffffffffffffffffffffffffffffffffffffff82169050919050565b600061053c82610511565b9050919050565b61054c81610531565b82525050565b60006020820190506105676000830184610543565b92915050565b60008060008060808587031215610587576105866104a9565b5b6000610595878288016104cf565b94505060206105a6878288016104cf565b93505060406105b7878288016104cf565b92505060606105c8878288016104cf565b91505092959194509250565b6105dd816104ae565b82525050565b60006020820190506105f860008301846105d4565b92915050565b61060781610531565b811461061257600080fd5b50565b600081359050610624816105fe565b92915050565b600080600060608486031215610643576106426104a9565b5b600061065186828701610615565b935050602061066286828701610615565b9250506040610673868287016104cf565b9150509250925092565b600060a0820190506106926000830188610543565b61069f60208301876105d4565b6106ac60408301866105d4565b6106b960608301856105d4565b6106c660808301846105d4565b9695505050505050565b60006060820190506106e56000830186610543565b6106f26020830185610543565b6106ff60408301846105d4565b949350505050565b7f4e487b7100000000000000000000000000000000000000000000000000000000600052601160045260246000fd5b6000610741826104ae565b91507fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff820361077357610772610707565b5b600182019050919050565b6000610789826104ae565b91506000820361079c5761079b610707565b5b60018203905091905056fea2646970667358221220ab35c07ec72cc064a663de06ec7f5f919b1a499a25cf6ef0c63a45fdd4a1e91e64736f6c63430008120033
\ No newline at end of file
diff --git a/fvm/evm/testutils/contracts/test.sol b/fvm/evm/testutils/contracts/test.sol
new file mode 100644
index 00000000000..ef35445274f
--- /dev/null
+++ b/fvm/evm/testutils/contracts/test.sol
@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: GPL-3.0
+
+pragma solidity >=0.7.0 <0.9.0;
+
+contract Storage {
+
+    address constant public cadenceArch = 0x0000000000000000000000010000000000000001;
+    
+    uint256 number;
+
+    constructor() payable {
+    }
+
+    function store(uint256 num) public {
+        number = num;
+    }
+
+    function storeButRevert(uint256 num) public {
+        number = num;
+        revert();
+    }
+
+    function retrieve() public view returns (uint256){
+        return number;
+    }
+
+    function blockNumber() public view returns (uint256) {
+        return block.number;
+    }
+
+    function blockTime() public view returns (uint) {
+        return block.timestamp;
+    }
+
+    function blockHash(uint num)  public view returns (bytes32) {
+        return blockhash(num);
+    }
+
+    function random() public view returns (uint256) {
+        return block.prevrandao;
+    }
+
+    function chainID() public view returns (uint256) {
+        return block.chainid;
+    }
+
+    function destroy() public {
+        selfdestruct(payable(msg.sender));
+    }
+
+    function verifyArchCallToFlowBlockHeight(uint64 expected) public view returns (uint64){
+        (bool ok, bytes memory data) = cadenceArch.staticcall(abi.encodeWithSignature("flowBlockHeight()"));
+        require(ok, "unsuccessful call to arch ");
+        uint64 output = abi.decode(data, (uint64));
+        require(expected == output, "output doesnt match the expected value");
+        return output;
+    }
+
+    function verifyArchCallToVerifyCOAOwnershipProof(bool expected, address arg0 , bytes32 arg1 , bytes memory arg2 ) public view returns (bool){
+        (bool ok, bytes memory data) = cadenceArch.staticcall(abi.encodeWithSignature("verifyCOAOwnershipProof(address,bytes32,bytes)", arg0, arg1, arg2));
+        require(ok, "unsuccessful call to arch");
+        bool output = abi.decode(data, (bool));
+        require(expected == output, "output doesnt match the expected value");
+        return output;
+    }
+}
\ No newline at end of file
diff --git a/fvm/evm/testutils/contracts/test_abi.json b/fvm/evm/testutils/contracts/test_abi.json
new file mode 100644
index 00000000000..d0d9fef9fbd
--- /dev/null
+++ b/fvm/evm/testutils/contracts/test_abi.json
@@ -0,0 +1,190 @@
+[
+	{
+		"inputs": [],
+		"stateMutability": "payable",
+		"type": "constructor"
+	},
+	{
+		"inputs": [
+			{
+				"internalType": "uint256",
+				"name": "num",
+				"type": "uint256"
+			}
+		],
+		"name": "blockHash",
+		"outputs": [
+			{
+				"internalType": "bytes32",
+				"name": "",
+				"type": "bytes32"
+			}
+		],
+		"stateMutability": "view",
+		"type": "function"
+	},
+	{
+		"inputs": [],
+		"name": "blockNumber",
+		"outputs": [
+			{
+				"internalType": "uint256",
+				"name": "",
+				"type": "uint256"
+			}
+		],
+		"stateMutability": "view",
+		"type": "function"
+	},
+	{
+		"inputs": [],
+		"name": "blockTime",
+		"outputs": [
+			{
+				"internalType": "uint256",
+				"name": "",
+				"type": "uint256"
+			}
+		],
+		"stateMutability": "view",
+		"type": "function"
+	},
+	{
+		"inputs": [],
+		"name": "cadenceArch",
+		"outputs": [
+			{
+				"internalType": "address",
+				"name": "",
+				"type": "address"
+			}
+		],
+		"stateMutability": "view",
+		"type": "function"
+	},
+	{
+		"inputs": [],
+		"name": "chainID",
+		"outputs": [
+			{
+				"internalType": "uint256",
+				"name": "",
+				"type": "uint256"
+			}
+		],
+		"stateMutability": "view",
+		"type": "function"
+	},
+	{
+		"inputs": [],
+		"name": "destroy",
+		"outputs": [],
+		"stateMutability": "nonpayable",
+		"type": "function"
+	},
+	{
+		"inputs": [],
+		"name": "random",
+		"outputs": [
+			{
+				"internalType": "uint256",
+				"name": "",
+				"type": "uint256"
+			}
+		],
+		"stateMutability": "view",
+		"type": "function"
+	},
+	{
+		"inputs": [],
+		"name": "retrieve",
+		"outputs": [
+			{
+				"internalType": "uint256",
+				"name": "",
+				"type": "uint256"
+			}
+		],
+		"stateMutability": "view",
+		"type": "function"
+	},
+	{
+		"inputs": [
+			{
+				"internalType": "uint256",
+				"name": "num",
+				"type": "uint256"
+			}
+		],
+		"name": "store",
+		"outputs": [],
+		"stateMutability": "nonpayable",
+		"type": "function"
+	},
+	{
+		"inputs": [
+			{
+				"internalType": "uint256",
+				"name": "num",
+				"type": "uint256"
+			}
+		],
+		"name": "storeButRevert",
+		"outputs": [],
+		"stateMutability": "nonpayable",
+		"type": "function"
+	},
+	{
+		"inputs": [
+			{
+				"internalType": "uint64",
+				"name": "expected",
+				"type": "uint64"
+			}
+		],
+		"name": "verifyArchCallToFlowBlockHeight",
+		"outputs": [
+			{
+				"internalType": "uint64",
+				"name": "",
+				"type": "uint64"
+			}
+		],
+		"stateMutability": "view",
+		"type": "function"
+	},
+	{
+		"inputs": [
+			{
+				"internalType": "bool",
+				"name": "expected",
+				"type": "bool"
+			},
+			{
+				"internalType": "address",
+				"name": "arg0",
+				"type": "address"
+			},
+			{
+				"internalType": "bytes32",
+				"name": "arg1",
+				"type": "bytes32"
+			},
+			{
+				"internalType": "bytes",
+				"name": "arg2",
+				"type": "bytes"
+			}
+		],
+		"name": "verifyArchCallToVerifyCOAOwnershipProof",
+		"outputs": [
+			{
+				"internalType": "bool",
+				"name": "",
+				"type": "bool"
+			}
+		],
+		"stateMutability": "view",
+		"type": "function"
+	}
+]
\ No newline at end of file
diff --git a/fvm/evm/testutils/contracts/test_bytes.hex b/fvm/evm/testutils/contracts/test_bytes.hex
new file mode 100644
index 00000000000..1194ffe0f8d
--- /dev/null
+++ b/fvm/evm/testutils/contracts/test_bytes.hex
@@ -0,0 +1 @@
+6080604052610d43806100115f395ff3fe608060405234801561000f575f80fd5b50600436106100b2575f3560e01c80636057361d1161006f5780636057361d1461017a578063828dd0481461019657806383197ef0146101c657806385df51fd146101d0578063adc879e914610200578063d0d250bd1461021e576100b2565b80632e64cec1146100b657806348b15166146100d45780634cbefa6a146100f257806352e240241461010e57806357e871e71461013e5780635ec01e4d1461015c575b5f80fd5b6100be61023c565b6040516100cb9190610616565b60405180910390f35b6100dc610244565b6040516100e99190610616565b60405180910390f35b61010c6004803603810190610107919061066a565b61024b565b005b610128600480360381019061012391906106d2565b610254565b604051610135919061070c565b60405180910390f35b610146610401565b6040516101539190610616565b60405180910390f35b610164610408565b6040516101719190610616565b60405180910390f35b610194600480360381019061018f919061066a565b61040f565b005b6101b060048036038101906101ab9190610923565b610418565b6040516101bd91906109b2565b60405180910390f35b6101ce6105c7565b005b6101ea60048036038101906101e5919061066a565b6105e0565b6040516101f791906109da565b60405180910390f35b6102086105ea565b6040516102159190610616565b60405180910390f35b6102266105f1565b6040516102339190610a02565b60405180910390f35b5f8054905090565b5f42905090565b805f8190555f80fd5b5f805f6801000000000000000173ffffffffffffffffffffffffffffffffffffffff166040516024016040516020818303038152906040527f53e87d66000000000000000000000000000000000000000000000000000000007bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19166020820180517bffffffffffffffffffffffffffffffffffffffffffffffffffffffff83818316178352505050506040516103079190610a87565b5f60405180830381855afa9150503d805f811461033f576040519150601f19603f3d011682016040523d82523d5f602084013e610344565b606091505b509150915081610389576040517f08c379a000000000000000000000000000000000000000000000000000000000815260040161038090610af7565b60405180910390fd5b5f8180602001905181019061039e9190610b29565b90508067ffffffffffffffff168567ffffffffffffffff16146103f6576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016103ed90610bc4565b60405180910390fd5b809350505050919050565b5f43905090565b5f44905090565b805f8190555050565b5f805f6801000000000000000173ffffffffffffffffffffffffffffffffffffffff1686868660405160240161045093929190610c2a565b6040516020818303038152906040527f5ee837e7000000000000000000000000000000000000000000000000000000007bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19166020820180517bffffffffffffffffffffffffffffffffffffffffffffffffffffffff83818316178352505050506040516104da9190610a87565b5f60405180830381855afa9150503d805f8114610512576040519150601f19603f3d011682016040523d82523d5f602084013e610517565b606091505b50915091508161055c576040517f08c379a000000000000000000000000000000000000000000000000000000000815260040161055390610cb0565b60405180910390fd5b5f818060200190518101906105719190610ce2565b9050801515881515146105b9576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004016105b090610bc4565b60405180910390fd5b809350505050949350505050565b3373ffffffffffffffffffffffffffffffffffffffff16ff5b5f81409050919050565b5f46905090565b6801000000000000000181565b5f819050919050565b610610816105fe565b82525050565b5f6020820190506106295f830184610607565b92915050565b5f604051905090565b5f80fd5b5f80fd5b610649816105fe565b8114610653575f80fd5b50565b5f8135905061066481610640565b92915050565b5f6020828403121561067f5761067e610638565b5b5f61068c84828501610656565b91505092915050565b5f67ffffffffffffffff82169050919050565b6106b181610695565b81146106bb575f80fd5b50565b5f813590506106cc816106a8565b92915050565b5f602082840312156106e7576106e6610638565b5b5f6106f4848285016106be565b91505092915050565b61070681610695565b82525050565b5f60208201905061071f5f8301846106fd565b92915050565b5f8115159050919050565b61073981610725565b8114610743575f80fd5b50565b5f8135905061075481610730565b92915050565b5f73ffffffffffffffffffffffffffffffffffffffff82169050919050565b5f6107838261075a565b9050919050565b61079381610779565b811461079d575f80fd5b50565b5f813590506107ae8161078a565b92915050565b5f819050919050565b6107c6816107b4565b81146107d0575f80fd5b50565b5f813590506107e1816107bd565b92915050565b5f80fd5b5f80fd5b5f601f19601f8301169050919050565b7f4e487b71000000000000000000000000000000000000000000000000000000005f52604160045260245ffd5b610835826107ef565b810181811067ffffffffffffffff82111715610854576108536107ff565b5b80604052505050565b5f61086661062f565b9050610872828261082c565b919050565b5f67ffffffffffffffff821115610891576108906107ff565b5b61089a826107ef565b9050602081019050919050565b828183375f83830152505050565b5f6108c76108c284610877565b61085d565b9050828152602081018484840111156108e3576108e26107eb565b5b6108ee8482856108a7565b509392505050565b5f82601f83011261090a576109096107e7565b5b813561091a8482602086016108b5565b91505092915050565b5f805f806080858703121561093b5761093a610638565b5b5f61094887828801610746565b9450506020610959878288016107a0565b935050604061096a878288016107d3565b925050606085013567ffffffffffffffff81111561098b5761098a61063c565b5b610997878288016108f6565b91505092959194509250565b6109ac81610725565b82525050565b5f6020820190506109c55f8301846109a3565b92915050565b6109d4816107b4565b82525050565b5f6020820190506109ed5f8301846109cb565b92915050565b6109fc81610779565b82525050565b5f602082019050610a155f8301846109f3565b92915050565b5f81519050919050565b5f81905092915050565b5f5b83811015610a4c578082015181840152602081019050610a31565b5f8484015250505050565b5f610a6182610a1b565b610a6b8185610a25565b9350610a7b818560208601610a2f565b80840191505092915050565b5f610a928284610a57565b915081905092915050565b5f82825260208201905092915050565b7f756e7375636365737366756c2063616c6c20746f2061726368200000000000005f82015250565b5f610ae1601a83610a9d565b9150610aec82610aad565b602082019050919050565b5f6020820190508181035f830152610b0e81610ad5565b9050919050565b5f81519050610b23816106a8565b92915050565b5f60208284031215610b3e57610b3d610638565b5b5f610b4b84828501610b15565b91505092915050565b7f6f757470757420646f65736e74206d61746368207468652065787065637465645f8201527f2076616c75650000000000000000000000000000000000000000000000000000602082015250565b5f610bae602683610a9d565b9150610bb982610b54565b604082019050919050565b5f6020820190508181035f830152610bdb81610ba2565b9050919050565b5f82825260208201905092915050565b5f610bfc82610a1b565b610c068185610be2565b9350610c16818560208601610a2f565b610c1f816107ef565b840191505092915050565b5f606082019050610c3d5f8301866109f3565b610c4a60208301856109cb565b8181036040830152610c5c8184610bf2565b9050949350505050565b7f756e7375636365737366756c2063616c6c20746f2061726368000000000000005f82015250565b5f610c9a601983610a9d565b9150610ca582610c66565b602082019050919050565b5f6020820190508181035f830152610cc781610c8e565b9050919050565b5f81519050610cdc81610730565b92915050565b5f60208284031215610cf757610cf6610638565b5b5f610d0484828501610cce565b9150509291505056fea2646970667358221220999b40bd5ac8934676e6fb864603dcd7a9b88f1f98dd05290a76aed17dc2989164736f6c63430008180033
diff --git a/fvm/evm/testutils/emulator.go b/fvm/evm/testutils/emulator.go
index 0cdc0d4d93c..e02adee2232 100644
--- a/fvm/evm/testutils/emulator.go
+++ b/fvm/evm/testutils/emulator.go
@@ -3,7 +3,7 @@ package testutils
 import (
 	"math/big"
 
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
 
 	"github.com/onflow/flow-go/fvm/evm/types"
 )
@@ -12,6 +12,7 @@ type TestEmulator struct {
 	BalanceOfFunc      func(address types.Address) (*big.Int, error)
 	NonceOfFunc        func(address types.Address) (uint64, error)
 	CodeOfFunc         func(address types.Address) (types.Code, error)
+	CodeHashOfFunc     func(address types.Address) ([]byte, error)
 	DirectCallFunc     func(call *types.DirectCall) (*types.Result, error)
 	RunTransactionFunc func(tx *gethTypes.Transaction) (*types.Result, error)
 }
@@ -44,7 +45,7 @@ func (em *TestEmulator) NonceOf(address types.Address) (uint64, error) {
 	return em.NonceOfFunc(address)
 }
 
-// CodeOf returns the code for this address (if smart contract is deployed at this address)
+// CodeOf returns the code for this address
 func (em *TestEmulator) CodeOf(address types.Address) (types.Code, error) {
 	if em.CodeOfFunc == nil {
 		panic("method not set")
@@ -52,6 +53,14 @@ func (em *TestEmulator) CodeOf(address types.Address) (types.Code, error) {
 	return em.CodeOfFunc(address)
 }
 
+// CodeHashOf returns the code hash for this address
+func (em *TestEmulator) CodeHashOf(address types.Address) ([]byte, error) {
+	if em.CodeHashOfFunc == nil {
+		panic("method not set")
+	}
+	return em.CodeHashOfFunc(address)
+}
+
 // DirectCall executes a direct call
 func (em *TestEmulator) DirectCall(call *types.DirectCall) (*types.Result, error) {
 	if em.DirectCallFunc == nil {
diff --git a/fvm/evm/testutils/misc.go b/fvm/evm/testutils/misc.go
index b335ad3adfb..b2f5493cdd7 100644
--- a/fvm/evm/testutils/misc.go
+++ b/fvm/evm/testutils/misc.go
@@ -6,8 +6,8 @@ import (
 	"math/rand"
 	"testing"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/fvm/evm/types"
@@ -59,7 +59,23 @@ func GetRandomLogFixture(t testing.TB) *gethTypes.Log {
 	}
 }
 
-// MakeABalanceInFlow makes a balance object that has `amount` Flow Token in it
-func MakeABalanceInFlow(amount uint64) types.Balance {
-	return types.Balance(uint64(100_000_000) * amount)
+func COAOwnershipProofFixture(t testing.TB) *types.COAOwnershipProof {
+	return &types.COAOwnershipProof{
+		Address:        types.FlowAddress{1, 2, 3},
+		CapabilityPath: "path",
+		KeyIndices:     types.KeyIndices{1, 2},
+		Signatures: types.Signatures{
+			types.Signature("sig1"),
+			types.Signature("sig2"),
+		},
+	}
+}
+
+func COAOwnershipProofInContextFixture(t testing.TB) *types.COAOwnershipProofInContext {
+	signedMsg := RandomCommonHash(t)
+	return &types.COAOwnershipProofInContext{
+		COAOwnershipProof: *COAOwnershipProofFixture(t),
+		SignedData:        types.SignedData(signedMsg[:]),
+		EVMAddress:        RandomAddress(t),
+	}
 }
diff --git a/fvm/evm/types/account.go b/fvm/evm/types/account.go
index 9e247fe1992..3323b76304e 100644
--- a/fvm/evm/types/account.go
+++ b/fvm/evm/types/account.go
@@ -2,28 +2,37 @@ package types
 
 // Account is an EVM account, currently
 // three types of accounts are supported on Flow EVM,
-// externally owned accounts (EOAs), smart contract accounts and bridged accounts
-// BridgedAccount is a new type of account in the environment,
+// externally owned accounts (EOAs), smart contract accounts and cadence owned accounts
+// Cadence-owned-account (COA) is a new type of account in the environment,
 // that instead of being managed by public key,
 // it is managed by a resource owned by a Flow account.
 //
 // In other words, the FVM account who owns the FOA resource
-// can bridge native tokens to and from the account associated with the bridged account,
+// can bridge native tokens to and from the account associated with the COA,
 // deploy contracts to the environment,
 // or call methods on contracts without the need to sign a transaction.
 type Account interface {
 	// Returns the address of this account
 	Address() Address
 
-	// Returns balance of this account
+	// Returns the balance of this account
 	Balance() Balance
 
+	// Returns the code of this account
+	Code() Code
+
+	// Returns the code hash of this account
+	CodeHash() []byte
+
+	// Returns the nonce of this account
+	Nonce() uint64
+
 	// Deposit deposits the token from the given vault into this account
 	Deposit(*FLOWTokenVault)
 
 	// Withdraw withdraws the balance from account and
 	// return it as a FlowTokenVault
-	// works only for bridged accounts
+	// works only for COAs
 	Withdraw(Balance) *FLOWTokenVault
 
 	// Transfer is a utility method on top of call for transfering tokens to another account
@@ -31,17 +40,17 @@ type Account interface {
 
 	// Deploy deploys a contract to the environment
 	// the new deployed contract would be at the returned address and
-	// the contract data is not controlled by the bridge account
-	// works only for bridged accounts
+	// the contract data is not controlled by the COA
+	// works only for COAs
 	Deploy(Code, GasLimit, Balance) Address
 
 	// Call calls a smart contract function with the given data.
 	// The gas usage is limited by the given gas limit,
 	// and the Flow transaction's computation limit.
-	// The fees are deducted from the bridged account
+	// The fees are deducted from the COA
 	// and are transferred to the target address.
 	// if no data is provided it would behave as transfering tokens to the
 	// target address
-	// works only for bridged accounts
-	Call(Address, Data, GasLimit, Balance) Data
+	// works only for COAs
+	Call(Address, Data, GasLimit, Balance) *ResultSummary
 }
diff --git a/fvm/evm/types/address.go b/fvm/evm/types/address.go
index 134ae6c6cf8..b5fb85bf75a 100644
--- a/fvm/evm/types/address.go
+++ b/fvm/evm/types/address.go
@@ -1,9 +1,41 @@
 package types
 
 import (
-	"math/big"
+	"bytes"
+	"fmt"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
+	"github.com/onflow/cadence"
+	"github.com/onflow/cadence/encoding/ccf"
+	"github.com/onflow/cadence/runtime/sema"
+	gethCommon "github.com/onflow/go-ethereum/common"
+
+	"github.com/onflow/flow-go/model/flow"
+)
+
+// FlowEVMSpecialAddressPrefixLen captures the number of prefix bytes with constant values for special accounts (extended precompiles and COAs).
+//
+// The prefix length should insure a high-enough level of security against finding a preimage using the hash
+// function used for EVM addresses generation (Keccak256). This is required to avoid finding an EVM address
+// that is also a valid FlowEVM address.
+// The target (minimal) security in this case is the security level provided by EVM addresses.
+// Since EVM addresses are 160-bits long, they offer only 80 bits of security (collision resistance
+// offers the lowest level).
+// A preimage resistance of 80 bits requires the prefix to be at least 80-bits long (i.e 10 bytes).
+// When used as a prefix in EVM addresses (20-bytes long), a prefix length of 12 bytes
+// leaves a variable part of 8 bytes (64 bits).
+const FlowEVMSpecialAddressPrefixLen = 12
+
+const COAAddressTemplate = "A.%v.EVM.CadenceOwnedAccountCreated"
+
+var (
+	// Using leading zeros for prefix helps with the storage compactness.
+	//
+	// Prefix for the built-in EVM precompiles
+	FlowEVMNativePrecompileAddressPrefix = [FlowEVMSpecialAddressPrefixLen]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
+	// Prefix for the extended precompiles
+	FlowEVMExtendedPrecompileAddressPrefix = [FlowEVMSpecialAddressPrefixLen]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1}
+	// Prefix for the COA addresses
+	FlowEVMCOAAddressPrefix = [FlowEVMSpecialAddressPrefixLen]byte{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2}
 )
 
 // Address is an EVM-compatible address
@@ -25,6 +57,15 @@ func (fa Address) Bytes() []byte {
 	return fa[:]
 }
 
+// String returns the hex encoding of the address
+// it returns empty string if address is empty
+func (fa Address) String() string {
+	if fa == EmptyAddress {
+		return ""
+	}
+	return fa.ToCommon().Hex()
+}
+
 // ToCommon returns the geth address
 func (fa Address) ToCommon() gethCommon.Address {
 	return gethCommon.Address(fa)
@@ -35,18 +76,51 @@ func NewAddressFromBytes(inp []byte) Address {
 	return Address(gethCommon.BytesToAddress(inp))
 }
 
+func COAAddressFromFlowEvent(evmContractAddress flow.Address, event flow.Event) (Address, error) {
+	// check the type first
+	if string(event.Type) != fmt.Sprintf(COAAddressTemplate, evmContractAddress.Hex()) {
+		return Address{}, fmt.Errorf("wrong event type is passed")
+	}
+	// then decode
+	eventData, err := ccf.Decode(nil, event.Payload)
+	if err != nil {
+		return Address{}, err
+	}
+	addressBytes := make([]byte, AddressLength)
+	for i, v := range eventData.(cadence.Event).Fields[0].(cadence.Array).Values {
+		addressBytes[i] = v.ToGoValue().(byte)
+	}
+	return NewAddressFromBytes(addressBytes), nil
+}
+
 // NewAddressFromString constructs a new address from an string
 func NewAddressFromString(str string) Address {
 	return NewAddressFromBytes([]byte(str))
 }
 
-type GasLimit uint64
+var AddressBytesCadenceType = cadence.NewVariableSizedArrayType(cadence.TheUInt8Type)
+var AddressBytesSemaType = sema.ByteArrayType
 
-type Code []byte
+func (a Address) ToCadenceValue() cadence.Array {
+	values := make([]cadence.Value, len(a))
+	for i, v := range a {
+		values[i] = cadence.NewUInt8(v)
+	}
+	return cadence.NewArray(values).WithType(AddressBytesCadenceType)
+}
 
-type Data []byte
+// IsACOAAddress returns true if the address is a COA address
+//
+// This test insures `addr` has been generated as a COA address with high probability.
+// Brute forcing an EVM address `addr` to pass the `IsACOAAddress` test is as hard as the bit-length
+// of `FlowEVMCOAAddressPrefix` (here 96 bits).
+// Although this is lower than the protocol-wide security level in Flow (128 bits), it remains
+// higher than the EVM addresses security (80 bits when considering collision attacks)
+func IsACOAAddress(addr Address) bool {
+	return bytes.HasPrefix(addr[:], FlowEVMCOAAddressPrefix[:])
+}
 
-// AsBigInt process the data and return it as a big integer
-func (d Data) AsBigInt() *big.Int {
-	return new(big.Int).SetBytes(d)
+// IsAnExtendedPrecompileAddress returns true if the address is a extended precompile address
+func IsAnExtendedPrecompileAddress(addr Address) bool {
+	return bytes.HasPrefix(addr[:], FlowEVMExtendedPrecompileAddressPrefix[:])
 }
diff --git a/fvm/evm/types/backend.go b/fvm/evm/types/backend.go
new file mode 100644
index 00000000000..2a281f94a6b
--- /dev/null
+++ b/fvm/evm/types/backend.go
@@ -0,0 +1,18 @@
+package types
+
+import (
+	"github.com/onflow/flow-go/fvm/environment"
+)
+
+// Backend provides a subset of the FVM environment functionality
+// Any error returned by a Backend is expected to be a `FatalError` or
+// a `BackendError`.
+type Backend interface {
+	environment.ValueStore
+	environment.Meter
+	environment.EventEmitter
+	environment.BlockInfo
+	environment.RandomGenerator
+	environment.ContractFunctionInvoker
+	environment.UUIDGenerator
+}
diff --git a/fvm/evm/types/balance.go b/fvm/evm/types/balance.go
index d4ea1e46faa..775f740cf88 100644
--- a/fvm/evm/types/balance.go
+++ b/fvm/evm/types/balance.go
@@ -1,67 +1,92 @@
 package types
 
 import (
-	"encoding/binary"
+	"fmt"
+	"math"
 	"math/big"
 
 	"github.com/onflow/cadence"
+	"github.com/onflow/cadence/fixedpoint"
 )
 
 var (
-	SmallestAcceptableBalanceValueInAttoFlow = new(big.Int).SetInt64(1e10)
-	OneFlowInAttoFlow                        = new(big.Int).SetInt64(1e18)
+	AttoScale                      = 18
+	UFixedScale                    = fixedpoint.Fix64Scale
+	UFixedToAttoConversionScale    = AttoScale - UFixedScale
+	UFixToAttoConversionMultiplier = new(big.Int).Exp(big.NewInt(10), big.NewInt(int64(UFixedToAttoConversionScale)), nil)
+
+	OneFlowInUFix64 = cadence.UFix64(uint64(math.Pow(10, float64(UFixedScale))))
+	OneFlowBalance  = Balance(new(big.Int).Exp(big.NewInt(10), big.NewInt(int64(AttoScale)), nil))
+	EmptyBalance    = Balance(new(big.Int))
 )
 
 // Balance represents the balance of an address
-// in the evm environment, balances are kept in attoflow (1e10^-18 flow),
+// in the evm environment (Flow EVM), balances are kept in attoflow (1e-18 flow);
 // the smallest denomination of FLOW token (similar to how Wei is used to store Eth)
-// But on the FLOW Vaults, we use Cadence.UFix64 to store values in Flow.
-// this could result in accidental conversion mistakes, the balance object here would
-// do the conversions and does appropriate checks.
-//
-// For example the smallest unit of Flow token that a FlowVault could store is 1e10^-8,
-// so transfering smaller values (or values with smalls fractions) could result in loss in
-// conversion. The balance object checks it to prevent invalid balance.
-// This means that values smaller than 1e10^-8 flow could not be bridged between FVM and Flow EVM.
-type Balance cadence.UFix64
+// But A Cadence FLOW Vault uses a Cadence.UFix64 to store values in Flow, which means
+// 1e-8 is the smallest value that can be stored on the vault.
+// The balance here considers the highest precision (attoflow) but utility
+// function has been provided for conversion from/to UFix64 to prevent accidental
+// conversion errors and dealing with rounding errors.
+type Balance *big.Int
 
-// ToAttoFlow converts the balance into AttoFlow
-func (b Balance) ToAttoFlow() *big.Int {
-	return new(big.Int).Mul(new(big.Int).SetUint64(uint64(b)), SmallestAcceptableBalanceValueInAttoFlow)
+// NewBalanceconstructs a new balance from an atto flow value
+func NewBalance(inp *big.Int) Balance {
+	return Balance(inp)
 }
 
-// Sub subtract the other balance from this balance
-func (b Balance) Sub(other Balance) Balance {
-	// no need to check for underflow, as go does it
-	return Balance(uint64(b) - uint64(other))
+// NewBalanceFromUFix64 constructs a new balance from flow value (how its stored in Cadence Flow)
+func NewBalanceFromUFix64(inp cadence.UFix64) Balance {
+	return new(big.Int).Mul(
+		new(big.Int).SetUint64(uint64(inp)),
+		UFixToAttoConversionMultiplier)
 }
 
-// Add adds the other balance from this balance
-func (b Balance) Add(other Balance) Balance {
-	// no need to check for overflow, as go does it
-	return Balance(uint64(b) + uint64(other))
+// CopyBalance creates a copy of the balance
+func CopyBalance(inp Balance) Balance {
+	return Balance(new(big.Int).Set(inp))
 }
 
-// Encode encodes the balance into byte slice
-func (b Balance) Encode() []byte {
-	encoded := make([]byte, 8)
-	binary.BigEndian.PutUint64(encoded, b.ToAttoFlow().Uint64())
-	return encoded
+// BalanceToBigInt convert balance into big int
+func BalanceToBigInt(bal Balance) *big.Int {
+	return (*big.Int)(bal)
+}
+
+// ConvertBalanceToUFix64 casts the balance into a UFix64,
+//
+// Warning! The smallest unit of Flow token that a FlowVault (Cadence) could store is 1e10^-8,
+// so transfering smaller values (or values with smalls fractions) could result in loss in
+// conversion. The rounded flag should be used to prevent loss of assets.
+func ConvertBalanceToUFix64(bal Balance) (value cadence.UFix64, roundedOff bool, err error) {
+	converted := new(big.Int).Div(bal, UFixToAttoConversionMultiplier)
+	if !converted.IsUint64() {
+		// this should never happen
+		err = fmt.Errorf("balance can't be casted to a uint64")
+	}
+	return cadence.UFix64(converted.Uint64()), BalanceConvertionToUFix64ProneToRoundingError(bal), err
+
 }
 
-// DecodeBalance decodes a balance from an encoded byte slice
-func DecodeBalance(encoded []byte) (Balance, error) {
-	balance := new(big.Int)
-	return NewBalanceFromAttoFlow(balance.SetUint64(binary.BigEndian.Uint64(encoded)))
+// BalanceConvertionToUFix64ProneToRoundingError returns true
+// if casting to UFix64 could result in rounding error
+func BalanceConvertionToUFix64ProneToRoundingError(bal Balance) bool {
+	return new(big.Int).Mod(bal, UFixToAttoConversionMultiplier).BitLen() != 0
 }
 
-// NewBalanceFromAttoFlow constructs a new balance from atto flow value
-func NewBalanceFromAttoFlow(inp *big.Int) (Balance, error) {
-	if new(big.Int).Mod(inp, SmallestAcceptableBalanceValueInAttoFlow).Cmp(big.NewInt(0)) != 0 {
-		return 0, ErrBalanceConversion
+// Subtract balance 2 from balance 1 and returns the result as a new balance
+func SubBalance(bal1 Balance, bal2 Balance) (Balance, error) {
+	if (*big.Int)(bal1).Cmp(bal2) == -1 {
+		return nil, ErrInvalidBalance
 	}
+	return new(big.Int).Sub(bal1, bal2), nil
+}
+
+// AddBalance balance 2 to balance 1 and returns the result as a new balance
+func AddBalance(bal1 Balance, bal2 Balance) (Balance, error) {
+	return new(big.Int).Add(bal1, bal2), nil
+}
 
-	// we only need to divide by 10 given we already have 8 as factor
-	converted := new(big.Int).Div(inp, SmallestAcceptableBalanceValueInAttoFlow)
-	return Balance(cadence.UFix64(converted.Uint64())), nil
+// MakeABalanceInFlow makes a balance object that has `amount` Flow Token in it
+func MakeABalanceInFlow(amount uint64) Balance {
+	return NewBalance(new(big.Int).Mul(OneFlowBalance, new(big.Int).SetUint64(amount)))
 }
diff --git a/fvm/evm/types/balance_test.go b/fvm/evm/types/balance_test.go
index 9b92fc92b46..c13d7d0d870 100644
--- a/fvm/evm/types/balance_test.go
+++ b/fvm/evm/types/balance_test.go
@@ -13,28 +13,28 @@ import (
 
 func TestBalance(t *testing.T) {
 	// test attoflow to flow
-
-	bal, err := types.NewBalanceFromAttoFlow(types.OneFlowInAttoFlow)
-	require.NoError(t, err)
-
-	conv := bal.ToAttoFlow()
-	require.Equal(t, types.OneFlowInAttoFlow, conv)
-
-	// encoding decoding
-	ret, err := types.DecodeBalance(bal.Encode())
-	require.NoError(t, err)
-	require.Equal(t, bal, ret)
+	bal := types.OneFlowBalance
+	require.Equal(t, bal, types.NewBalanceFromUFix64(types.OneFlowInUFix64))
 
 	// 100.0002 Flow
 	u, err := cadence.NewUFix64("100.0002")
 	require.NoError(t, err)
 	require.Equal(t, "100.00020000", u.String())
 
-	bb := types.Balance(u).ToAttoFlow()
-	require.Equal(t, "100000200000000000000", bb.String())
-
-	// invalid conversion
-	_, err = types.NewBalanceFromAttoFlow(big.NewInt(1))
-	require.Error(t, err)
+	bb := types.NewBalanceFromUFix64(u)
+	require.Equal(t, "100000200000000000000", types.BalanceToBigInt(bb).String())
+	require.False(t, types.BalanceConvertionToUFix64ProneToRoundingError(bb))
+	bret, roundedOff, err := types.ConvertBalanceToUFix64(bb)
+	require.NoError(t, err)
+	require.Equal(t, u, bret)
+	require.False(t, roundedOff)
 
+	// rounded off flag
+	bal = types.NewBalance(big.NewInt(1))
+	require.NoError(t, err)
+	require.True(t, types.BalanceConvertionToUFix64ProneToRoundingError(bal))
+	bret, roundedOff, err = types.ConvertBalanceToUFix64(bal)
+	require.NoError(t, err)
+	require.Equal(t, cadence.UFix64(0), bret)
+	require.True(t, roundedOff)
 }
diff --git a/fvm/evm/types/block.go b/fvm/evm/types/block.go
index 9ec08551104..6c70903bbea 100644
--- a/fvm/evm/types/block.go
+++ b/fvm/evm/types/block.go
@@ -3,9 +3,11 @@ package types
 import (
 	"math/big"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	"github.com/ethereum/go-ethereum/rlp"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethCrypto "github.com/onflow/go-ethereum/crypto"
+	gethRLP "github.com/onflow/go-ethereum/rlp"
+	gethTrie "github.com/onflow/go-ethereum/trie"
 )
 
 // Block represents a evm block.
@@ -17,10 +19,17 @@ type Block struct {
 	// Height returns the height of this block
 	Height uint64
 
+	// Timestamp is a Unix timestamp in seconds at which the block was created
+	// Note that this value must be provided from the FVM Block
+	Timestamp uint64
+
 	// holds the total amount of the native token deposited in the evm side. (in attoflow)
 	TotalSupply *big.Int
 
 	// ReceiptRoot returns the root hash of the receipts emitted in this block
+	// Note that this value won't be unique to each block, for example for the
+	// case of empty trie of receipts or a single receipt with no logs and failed state
+	// the same receipt root would be reported for block.
 	ReceiptRoot gethCommon.Hash
 
 	// transaction hashes
@@ -29,13 +38,27 @@ type Block struct {
 
 // ToBytes encodes the block into bytes
 func (b *Block) ToBytes() ([]byte, error) {
-	return rlp.EncodeToBytes(b)
+	return gethRLP.EncodeToBytes(b)
 }
 
 // Hash returns the hash of the block
 func (b *Block) Hash() (gethCommon.Hash, error) {
 	data, err := b.ToBytes()
-	return gethCommon.BytesToHash(data), err
+	return gethCrypto.Keccak256Hash(data), err
+}
+
+// PopulateReceiptRoot populates receipt root with the given results
+func (b *Block) PopulateReceiptRoot(results []Result) {
+	if len(results) == 0 {
+		b.ReceiptRoot = gethTypes.EmptyReceiptsHash
+		return
+	}
+
+	receipts := make(gethTypes.Receipts, len(results))
+	for i, res := range results {
+		receipts[i] = res.Receipt()
+	}
+	b.ReceiptRoot = gethTypes.DeriveSha(receipts, gethTrie.NewStackTrie(nil))
 }
 
 // AppendTxHash appends a transaction hash to the list of transaction hashes of the block
@@ -44,12 +67,18 @@ func (b *Block) AppendTxHash(txHash gethCommon.Hash) {
 }
 
 // NewBlock constructs a new block
-func NewBlock(height, uuidIndex uint64, totalSupply *big.Int,
-	stateRoot, receiptRoot gethCommon.Hash,
+func NewBlock(
+	parentBlockHash gethCommon.Hash,
+	height uint64,
+	timestamp uint64,
+	totalSupply *big.Int,
+	receiptRoot gethCommon.Hash,
 	txHashes []gethCommon.Hash,
 ) *Block {
 	return &Block{
+		ParentBlockHash:   parentBlockHash,
 		Height:            height,
+		Timestamp:         timestamp,
 		TotalSupply:       totalSupply,
 		ReceiptRoot:       receiptRoot,
 		TransactionHashes: txHashes,
@@ -59,7 +88,7 @@ func NewBlock(height, uuidIndex uint64, totalSupply *big.Int,
 // NewBlockFromBytes constructs a new block from encoded data
 func NewBlockFromBytes(encoded []byte) (*Block, error) {
 	res := &Block{}
-	err := rlp.DecodeBytes(encoded, res)
+	err := gethRLP.DecodeBytes(encoded, res)
 	return res, err
 }
 
@@ -70,3 +99,5 @@ var GenesisBlock = &Block{
 	TotalSupply:     new(big.Int),
 	ReceiptRoot:     gethTypes.EmptyRootHash,
 }
+
+var GenesisBlockHash, _ = GenesisBlock.Hash()
diff --git a/fvm/evm/types/blockHashList.go b/fvm/evm/types/blockHashList.go
new file mode 100644
index 00000000000..c5b1f203899
--- /dev/null
+++ b/fvm/evm/types/blockHashList.go
@@ -0,0 +1,174 @@
+package types
+
+import (
+	"encoding/binary"
+	"fmt"
+
+	gethCommon "github.com/onflow/go-ethereum/common"
+)
+
+const (
+	capacityEncodingSize = 8
+	tailEncodingSize     = 8
+	countEncodingSize    = 8
+	heightEncodingSize   = 8
+	hashEncodingSize     = 32
+	minEncodedByteSize   = capacityEncodingSize +
+		tailEncodingSize +
+		countEncodingSize +
+		heightEncodingSize
+)
+
+// BlockHashList holds the last `capacity` number of block hashes in the list
+type BlockHashList struct {
+	blocks   []gethCommon.Hash
+	capacity int
+	tail     int    // element index to write to
+	count    int    // number of elements (count <= capacity)
+	height   uint64 // keeps the height of last added block
+}
+
+// NewBlockHashList constructs a new block hash list of the given capacity
+func NewBlockHashList(capacity int) *BlockHashList {
+	return &BlockHashList{
+		blocks:   make([]gethCommon.Hash, capacity),
+		capacity: capacity,
+		tail:     0,
+		count:    0,
+		height:   0,
+	}
+}
+
+// Push pushes a block hash for the next height to the list.
+// If the list is full, it overwrites the oldest element.
+func (bhl *BlockHashList) Push(height uint64, bh gethCommon.Hash) error {
+	if bhl.IsEmpty() && height != 0 {
+		return fmt.Errorf("out of the order block hash, expected: 0, got: %d", height)
+	}
+	if !bhl.IsEmpty() && height != bhl.height+1 {
+		return fmt.Errorf("out of the order block hash, expected: %d, got: %d", bhl.height+1, height)
+	}
+	bhl.blocks[bhl.tail] = bh
+	bhl.tail = (bhl.tail + 1) % bhl.capacity
+	bhl.height = height
+	if bhl.count != bhl.capacity {
+		bhl.count++
+	}
+	return nil
+}
+
+// IsEmpty returns true if the list is empty
+func (bhl *BlockHashList) IsEmpty() bool {
+	return bhl.count == 0
+}
+
+// LastAddedBlockHash returns the last block hash added to the list
+// for empty list it returns empty hash value
+func (bhl *BlockHashList) LastAddedBlockHash() gethCommon.Hash {
+	if bhl.count == 0 {
+		// return empty hash
+		return gethCommon.Hash{}
+	}
+	indx := bhl.tail - 1
+	if indx < 0 {
+		indx = bhl.capacity - 1
+	}
+	return bhl.blocks[indx]
+}
+
+// MinAvailableHeight returns the min available height in the list
+func (bhl *BlockHashList) MinAvailableHeight() uint64 {
+	return bhl.height - (uint64(bhl.count) - 1)
+}
+
+// MaxAvailableHeight returns the max available height in the list
+func (bhl *BlockHashList) MaxAvailableHeight() uint64 {
+	return bhl.height
+}
+
+// BlockHashByIndex returns the block hash by block height
+func (bhl *BlockHashList) BlockHashByHeight(height uint64) (found bool, bh gethCommon.Hash) {
+	if bhl.count == 0 || // empty
+		height > bhl.height || // height too high
+		height < bhl.MinAvailableHeight() { // height too low
+		return false, gethCommon.Hash{}
+	}
+
+	diff := bhl.height - height
+	indx := bhl.tail - int(diff) - 1
+	if indx < 0 {
+		indx = bhl.capacity + indx
+	}
+	return true, bhl.blocks[indx]
+}
+
+func (bhl *BlockHashList) Encode() []byte {
+	encodedByteSize := capacityEncodingSize +
+		tailEncodingSize +
+		countEncodingSize +
+		heightEncodingSize +
+		len(bhl.blocks)*hashEncodingSize
+
+	buffer := make([]byte, encodedByteSize)
+	pos := 0
+
+	// encode capacity
+	binary.BigEndian.PutUint64(buffer[pos:], uint64(bhl.capacity))
+	pos += capacityEncodingSize
+
+	// encode tail
+	binary.BigEndian.PutUint64(buffer[pos:], uint64(bhl.tail))
+	pos += tailEncodingSize
+
+	// encode count
+	binary.BigEndian.PutUint64(buffer[pos:], uint64(bhl.count))
+	pos += countEncodingSize
+
+	// encode height
+	binary.BigEndian.PutUint64(buffer[pos:], uint64(bhl.height))
+	pos += heightEncodingSize
+
+	// encode hashes
+	for i := 0; i < bhl.count; i++ {
+		copy(buffer[pos:pos+hashEncodingSize], bhl.blocks[i][:])
+		pos += hashEncodingSize
+	}
+	return buffer
+}
+
+func NewBlockHashListFromEncoded(encoded []byte) (*BlockHashList, error) {
+	if len(encoded) < minEncodedByteSize {
+		return nil, fmt.Errorf("encoded input too short: %d < %d", len(encoded), minEncodedByteSize)
+	}
+
+	pos := 0
+	// decode capacity
+	capacity := binary.BigEndian.Uint64(encoded[pos:])
+	pos += capacityEncodingSize
+
+	// create bhl
+	bhl := NewBlockHashList(int(capacity))
+
+	// decode tail
+	bhl.tail = int(binary.BigEndian.Uint64(encoded[pos:]))
+	pos += tailEncodingSize
+
+	// decode count
+	bhl.count = int(binary.BigEndian.Uint64(encoded[pos:]))
+	pos += countEncodingSize
+
+	// decode height
+	bhl.height = binary.BigEndian.Uint64(encoded[pos:])
+	pos += heightEncodingSize
+
+	// decode hashes
+	if len(encoded[pos:]) < bhl.count*hashEncodingSize {
+		return nil, fmt.Errorf("encoded input too short: %d < %d", len(encoded), minEncodedByteSize)
+	}
+	for i := 0; i < bhl.count; i++ {
+		bhl.blocks[i] = gethCommon.BytesToHash(encoded[pos : pos+hashEncodingSize])
+		pos += hashEncodingSize
+	}
+
+	return bhl, nil
+}
diff --git a/fvm/evm/types/blockHashList_test.go b/fvm/evm/types/blockHashList_test.go
new file mode 100644
index 00000000000..5d4ca70a6c6
--- /dev/null
+++ b/fvm/evm/types/blockHashList_test.go
@@ -0,0 +1,60 @@
+package types_test
+
+import (
+	"testing"
+
+	gethCommon "github.com/onflow/go-ethereum/common"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/fvm/evm/types"
+)
+
+func TestBlockHashList(t *testing.T) {
+
+	capacity := 5
+	bhl := types.NewBlockHashList(capacity)
+	require.True(t, bhl.IsEmpty())
+
+	require.Equal(t, gethCommon.Hash{}, bhl.LastAddedBlockHash())
+
+	found, h := bhl.BlockHashByHeight(0)
+	require.False(t, found)
+	require.Equal(t, gethCommon.Hash{}, h)
+
+	// first full range
+	for i := 0; i < capacity; i++ {
+		err := bhl.Push(uint64(i), gethCommon.Hash{byte(i)})
+		require.NoError(t, err)
+		require.Equal(t, uint64(0), bhl.MinAvailableHeight())
+		require.Equal(t, uint64(i), bhl.MaxAvailableHeight())
+	}
+	for i := 0; i < capacity; i++ {
+		found, h := bhl.BlockHashByHeight(uint64(i))
+		require.True(t, found)
+		require.Equal(t, gethCommon.Hash{byte(i)}, h)
+	}
+	require.Equal(t, gethCommon.Hash{byte(capacity - 1)}, bhl.LastAddedBlockHash())
+
+	// over border range
+	for i := capacity; i < capacity+3; i++ {
+		err := bhl.Push(uint64(i), gethCommon.Hash{byte(i)})
+		require.NoError(t, err)
+		require.Equal(t, uint64(i-capacity+1), bhl.MinAvailableHeight())
+		require.Equal(t, uint64(i), bhl.MaxAvailableHeight())
+	}
+	for i := 0; i < capacity-2; i++ {
+		found, _ := bhl.BlockHashByHeight(uint64(i))
+		require.False(t, found)
+	}
+	for i := capacity - 2; i < capacity+3; i++ {
+		found, h := bhl.BlockHashByHeight(uint64(i))
+		require.True(t, found)
+		require.Equal(t, gethCommon.Hash{byte(i)}, h)
+	}
+	require.Equal(t, gethCommon.Hash{byte(capacity + 2)}, bhl.LastAddedBlockHash())
+
+	encoded := bhl.Encode()
+	bhl2, err := types.NewBlockHashListFromEncoded(encoded)
+	require.NoError(t, err)
+	require.Equal(t, bhl, bhl2)
+}
diff --git a/fvm/evm/types/block_test.go b/fvm/evm/types/block_test.go
new file mode 100644
index 00000000000..ce20f56cf9f
--- /dev/null
+++ b/fvm/evm/types/block_test.go
@@ -0,0 +1,43 @@
+package types
+
+import (
+	"math/big"
+	"testing"
+
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_BlockHash(t *testing.T) {
+	b := Block{
+		ParentBlockHash: gethCommon.HexToHash("0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"),
+		Height:          1,
+		TotalSupply:     big.NewInt(1000),
+		ReceiptRoot:     gethCommon.Hash{0x2, 0x3, 0x4},
+		TransactionHashes: []gethCommon.Hash{
+			gethCommon.HexToHash("0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"),
+		},
+	}
+
+	h1, err := b.Hash()
+	require.NoError(t, err)
+
+	b.Height = 2
+
+	h2, err := b.Hash()
+	require.NoError(t, err)
+
+	// hashes should not equal if any data is changed
+	assert.NotEqual(t, h1, h2)
+
+	b.PopulateReceiptRoot(nil)
+	require.Equal(t, gethTypes.EmptyReceiptsHash, b.ReceiptRoot)
+
+	res := Result{
+		GasConsumed: 10,
+	}
+	b.PopulateReceiptRoot([]Result{res})
+	require.NotEqual(t, gethTypes.EmptyReceiptsHash, b.ReceiptRoot)
+}
diff --git a/fvm/evm/types/call.go b/fvm/evm/types/call.go
index 31562fe9ccd..c9a97bb2cf9 100644
--- a/fvm/evm/types/call.go
+++ b/fvm/evm/types/call.go
@@ -1,16 +1,18 @@
 package types
 
 import (
+	"fmt"
 	"math/big"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethCore "github.com/ethereum/go-ethereum/core"
-	gethCrypto "github.com/ethereum/go-ethereum/crypto"
-	"github.com/ethereum/go-ethereum/rlp"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethCore "github.com/onflow/go-ethereum/core"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethParams "github.com/onflow/go-ethereum/params"
+	"github.com/onflow/go-ethereum/rlp"
 )
 
 const (
-	// tx type 255 is used for direct calls from bridged accounts
+	// tx type 255 is used for direct calls from COAs
 	DirectCallTxType = byte(255)
 
 	UnknownCallSubType  = byte(0)
@@ -20,12 +22,29 @@ const (
 	DeployCallSubType   = byte(4)
 	ContractCallSubType = byte(5)
 
-	TransferGasUsage = 21_000
+	// Note that these gas values might need to change if we
+	// change the transaction (e.g. add accesslist),
+	// then it has to be updated to use Intrinsic function
+	// to calculate the minimum gas needed to run the transaction.
+	IntrinsicFeeForTokenTransfer = gethParams.TxGas
+
+	// 21_000 is the minimum for a transaction + max gas allowed for receive/fallback methods
+	DefaultGasLimitForTokenTransfer = IntrinsicFeeForTokenTransfer + 2_300
+
+	// the value is set to the gas limit for transfer to facilitate transfers
+	// to smart contract addresses.
+	DepositCallGasLimit  = DefaultGasLimitForTokenTransfer
+	WithdrawCallGasLimit = DefaultGasLimitForTokenTransfer
 )
 
 // DirectCall captures all the data related to a direct call to evm
 // direct calls are similar to transactions but they don't have
 // signatures and don't need sequence number checks
+// Note that eventhough we don't check the nonce, it impacts
+// hash calculation and also impacts the address of resulting contract
+// when deployed through direct calls.
+// Users don't have the worry about the nonce, handler sets
+// it to the right value.
 type DirectCall struct {
 	Type     byte
 	SubType  byte
@@ -34,6 +53,16 @@ type DirectCall struct {
 	Data     []byte
 	Value    *big.Int
 	GasLimit uint64
+	Nonce    uint64
+}
+
+// DirectCallFromEncoded constructs a DirectCall from encoded data
+func DirectCallFromEncoded(encoded []byte) (*DirectCall, error) {
+	if encoded[0] != DirectCallTxType {
+		return nil, fmt.Errorf("tx type mismatch")
+	}
+	dc := &DirectCall{}
+	return dc, rlp.DecodeBytes(encoded[1:], dc)
 }
 
 // Encode encodes the direct call it also adds the type
@@ -45,56 +74,96 @@ func (dc *DirectCall) Encode() ([]byte, error) {
 
 // Hash computes the hash of a direct call
 func (dc *DirectCall) Hash() (gethCommon.Hash, error) {
-	encoded, err := dc.Encode()
-	return gethCrypto.Keccak256Hash(encoded), err
+	// we use geth transaction hash calculation since direct call hash is included in the
+	// block transaction hashes, and thus observed as any other transaction
+	return dc.Transaction().Hash(), nil
 }
 
 // Message constructs a core.Message from the direct call
 func (dc *DirectCall) Message() *gethCore.Message {
-	var to *gethCommon.Address
-	if dc.To != EmptyAddress {
-		ct := dc.To.ToCommon()
-		to = &ct
-	}
 	return &gethCore.Message{
 		From:      dc.From.ToCommon(),
-		To:        to,
+		To:        dc.to(),
 		Value:     dc.Value,
 		Data:      dc.Data,
+		Nonce:     dc.Nonce,
 		GasLimit:  dc.GasLimit,
 		GasPrice:  big.NewInt(0), // price is set to zero fo direct calls
-		GasTipCap: big.NewInt(1), // also known as maxPriorityFeePerGas
-		GasFeeCap: big.NewInt(2), // also known as maxFeePerGas
+		GasTipCap: big.NewInt(0), // also known as maxPriorityFeePerGas (in GWei)
+		GasFeeCap: big.NewInt(0), // also known as maxFeePerGas (in GWei)
 		// AccessList:        tx.AccessList(), // TODO revisit this value, the cost matter but performance might
 		SkipAccountChecks: true, // this would let us not set the nonce
 	}
 }
 
-func NewDepositCall(address Address, amount *big.Int) *DirectCall {
+// Transaction constructs a geth.Transaction from the direct call
+func (dc *DirectCall) Transaction() *gethTypes.Transaction {
+	return gethTypes.NewTx(&gethTypes.LegacyTx{
+		GasPrice: big.NewInt(0),
+		Gas:      dc.GasLimit,
+		To:       dc.to(),
+		Value:    dc.Value,
+		Data:     dc.Data,
+		Nonce:    dc.Nonce,
+	})
+}
+
+// EmptyToField returns true if `to` field contains an empty address
+func (dc *DirectCall) EmptyToField() bool {
+	return dc.To == EmptyAddress
+}
+
+func (dc *DirectCall) to() *gethCommon.Address {
+	var to *gethCommon.Address
+	if !dc.EmptyToField() {
+		ct := dc.To.ToCommon()
+		to = &ct
+	}
+	return to
+}
+
+func NewDepositCall(
+	bridge Address,
+	address Address,
+	amount *big.Int,
+	nonce uint64,
+) *DirectCall {
 	return &DirectCall{
 		Type:     DirectCallTxType,
 		SubType:  DepositCallSubType,
-		From:     EmptyAddress,
+		From:     bridge,
 		To:       address,
 		Data:     nil,
 		Value:    amount,
-		GasLimit: TransferGasUsage,
+		GasLimit: DepositCallGasLimit,
+		Nonce:    nonce,
 	}
 }
 
-func NewWithdrawCall(address Address, amount *big.Int) *DirectCall {
+func NewWithdrawCall(
+	bridge Address,
+	address Address,
+	amount *big.Int,
+	nonce uint64,
+) *DirectCall {
 	return &DirectCall{
 		Type:     DirectCallTxType,
 		SubType:  WithdrawCallSubType,
 		From:     address,
-		To:       EmptyAddress,
+		To:       bridge,
 		Data:     nil,
 		Value:    amount,
-		GasLimit: TransferGasUsage,
+		GasLimit: WithdrawCallGasLimit,
+		Nonce:    nonce,
 	}
 }
 
-func NewTransferCall(from Address, to Address, amount *big.Int) *DirectCall {
+func NewTransferCall(
+	from Address,
+	to Address,
+	amount *big.Int,
+	nonce uint64,
+) *DirectCall {
 	return &DirectCall{
 		Type:     DirectCallTxType,
 		SubType:  TransferCallSubType,
@@ -102,11 +171,18 @@ func NewTransferCall(from Address, to Address, amount *big.Int) *DirectCall {
 		To:       to,
 		Data:     nil,
 		Value:    amount,
-		GasLimit: TransferGasUsage,
+		GasLimit: DefaultGasLimitForTokenTransfer,
+		Nonce:    nonce,
 	}
 }
 
-func NewDeployCall(caller Address, code Code, gasLimit uint64, value *big.Int) *DirectCall {
+func NewDeployCall(
+	caller Address,
+	code Code,
+	gasLimit uint64,
+	value *big.Int,
+	nonce uint64,
+) *DirectCall {
 	return &DirectCall{
 		Type:     DirectCallTxType,
 		SubType:  DeployCallSubType,
@@ -115,10 +191,41 @@ func NewDeployCall(caller Address, code Code, gasLimit uint64, value *big.Int) *
 		Data:     code,
 		Value:    value,
 		GasLimit: gasLimit,
+		Nonce:    nonce,
+	}
+}
+
+// this subtype should only be used internally for
+// deploying contracts at given addresses (e.g. COA account init setup)
+// should not be used for other means.
+func NewDeployCallWithTargetAddress(
+	caller Address,
+	to Address,
+	code Code,
+	gasLimit uint64,
+	value *big.Int,
+	nonce uint64,
+) *DirectCall {
+	return &DirectCall{
+		Type:     DirectCallTxType,
+		SubType:  DeployCallSubType,
+		From:     caller,
+		To:       to,
+		Data:     code,
+		Value:    value,
+		GasLimit: gasLimit,
+		Nonce:    nonce,
 	}
 }
 
-func NewContractCall(caller Address, to Address, data Data, gasLimit uint64, value *big.Int) *DirectCall {
+func NewContractCall(
+	caller Address,
+	to Address,
+	data Data,
+	gasLimit uint64,
+	value *big.Int,
+	nonce uint64,
+) *DirectCall {
 	return &DirectCall{
 		Type:     DirectCallTxType,
 		SubType:  ContractCallSubType,
@@ -127,5 +234,17 @@ func NewContractCall(caller Address, to Address, data Data, gasLimit uint64, val
 		Data:     data,
 		Value:    value,
 		GasLimit: gasLimit,
+		Nonce:    nonce,
 	}
 }
+
+type GasLimit uint64
+
+type Code []byte
+
+type Data []byte
+
+// AsBigInt process the data and return it as a big integer
+func (d Data) AsBigInt() *big.Int {
+	return new(big.Int).SetBytes(d)
+}
diff --git a/fvm/evm/types/call_test.go b/fvm/evm/types/call_test.go
new file mode 100644
index 00000000000..54880558aa9
--- /dev/null
+++ b/fvm/evm/types/call_test.go
@@ -0,0 +1,39 @@
+package types
+
+import (
+	"math/big"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDirectCall(t *testing.T) {
+	dc := &DirectCall{
+		Type:     DirectCallTxType,
+		SubType:  DepositCallSubType,
+		From:     Address{0x1, 0x2},
+		To:       Address{0x3, 0x4},
+		Data:     []byte{0xf, 0xa, 0xb},
+		Value:    big.NewInt(5),
+		GasLimit: 100,
+	}
+
+	t.Run("calculate hash", func(t *testing.T) {
+		h, err := dc.Hash()
+		require.NoError(t, err)
+		assert.Equal(t, "0xe28ff08eca95608646d765e3007b3710f7f2a8ac5e297431da1962c33487e7b6", h.Hex())
+	})
+
+	t.Run("construct transaction", func(t *testing.T) {
+		tx := dc.Transaction()
+		h, err := dc.Hash()
+		require.NoError(t, err)
+		assert.Equal(t, dc.Value, tx.Value())
+		assert.Equal(t, dc.To.ToCommon(), *tx.To())
+		assert.Equal(t, h, tx.Hash())
+		assert.Equal(t, dc.GasLimit, tx.Gas())
+		assert.Equal(t, dc.Data, tx.Data())
+		assert.Equal(t, uint64(0), tx.Nonce()) // no nonce exists for direct call
+	})
+}
diff --git a/fvm/evm/types/chainIDs.go b/fvm/evm/types/chainIDs.go
new file mode 100644
index 00000000000..d979bc732a3
--- /dev/null
+++ b/fvm/evm/types/chainIDs.go
@@ -0,0 +1,25 @@
+package types
+
+import (
+	"math/big"
+
+	"github.com/onflow/flow-go/model/flow"
+)
+
+var (
+	FlowEVMPreviewNetChainID = big.NewInt(646)
+	FlowEVMTestNetChainID    = big.NewInt(545)
+	FlowEVMMainNetChainID    = big.NewInt(747)
+)
+
+func EVMChainIDFromFlowChainID(flowChainID flow.ChainID) *big.Int {
+	// default evm chain ID is previewNet
+	switch flowChainID {
+	case flow.Mainnet:
+		return FlowEVMMainNetChainID
+	case flow.Testnet:
+		return FlowEVMTestNetChainID
+	default:
+		return FlowEVMPreviewNetChainID
+	}
+}
diff --git a/fvm/evm/types/codeFinder.go b/fvm/evm/types/codeFinder.go
new file mode 100644
index 00000000000..ad2ab9213fa
--- /dev/null
+++ b/fvm/evm/types/codeFinder.go
@@ -0,0 +1,89 @@
+package types
+
+import (
+	"errors"
+
+	gethCore "github.com/onflow/go-ethereum/core"
+	gethVM "github.com/onflow/go-ethereum/core/vm"
+)
+
+func ValidationErrorCode(err error) ErrorCode {
+	// direct errors that are returned by the evm
+	switch err {
+	case gethVM.ErrGasUintOverflow:
+		return ValidationErrCodeGasUintOverflow
+	}
+
+	// wrapped errors return from the evm
+	nested := errors.Unwrap(err)
+	switch nested {
+	case gethCore.ErrNonceTooLow:
+		return ValidationErrCodeNonceTooLow
+	case gethCore.ErrNonceTooHigh:
+		return ValidationErrCodeNonceTooHigh
+	case gethCore.ErrNonceMax:
+		return ValidationErrCodeNonceMax
+	case gethCore.ErrGasLimitReached:
+		return ValidationErrCodeGasLimitReached
+	case gethCore.ErrInsufficientFundsForTransfer:
+		return ValidationErrCodeInsufficientFundsForTransfer
+	case gethCore.ErrMaxInitCodeSizeExceeded:
+		return ValidationErrCodeMaxInitCodeSizeExceeded
+	case gethCore.ErrInsufficientFunds:
+		return ValidationErrCodeInsufficientFunds
+	case gethCore.ErrIntrinsicGas:
+		return ValidationErrCodeIntrinsicGas
+	case gethCore.ErrTxTypeNotSupported:
+		return ValidationErrCodeTxTypeNotSupported
+	case gethCore.ErrTipAboveFeeCap:
+		return ValidationErrCodeTipAboveFeeCap
+	case gethCore.ErrTipVeryHigh:
+		return ValidationErrCodeTipVeryHigh
+	case gethCore.ErrFeeCapVeryHigh:
+		return ValidationErrCodeFeeCapVeryHigh
+	case gethCore.ErrFeeCapTooLow:
+		return ValidationErrCodeFeeCapTooLow
+	case gethCore.ErrSenderNoEOA:
+		return ValidationErrCodeSenderNoEOA
+	case gethCore.ErrBlobFeeCapTooLow:
+		return ValidationErrCodeBlobFeeCapTooLow
+	default:
+		return ValidationErrCodeMisc
+	}
+}
+
+func ExecutionErrorCode(err error) ErrorCode {
+	// execution VM errors are never wrapped
+	switch err {
+	case gethVM.ErrOutOfGas:
+		return ExecutionErrCodeOutOfGas
+	case gethVM.ErrCodeStoreOutOfGas:
+		return ExecutionErrCodeCodeStoreOutOfGas
+	case gethVM.ErrDepth:
+		return ExecutionErrCodeDepth
+	case gethVM.ErrInsufficientBalance:
+		return ExecutionErrCodeInsufficientBalance
+	case gethVM.ErrContractAddressCollision:
+		return ExecutionErrCodeContractAddressCollision
+	case gethVM.ErrExecutionReverted:
+		return ExecutionErrCodeExecutionReverted
+	case gethVM.ErrMaxInitCodeSizeExceeded:
+		return ExecutionErrCodeMaxInitCodeSizeExceeded
+	case gethVM.ErrMaxCodeSizeExceeded:
+		return ExecutionErrCodeMaxCodeSizeExceeded
+	case gethVM.ErrInvalidJump:
+		return ExecutionErrCodeInvalidJump
+	case gethVM.ErrWriteProtection:
+		return ExecutionErrCodeWriteProtection
+	case gethVM.ErrReturnDataOutOfBounds:
+		return ExecutionErrCodeReturnDataOutOfBounds
+	case gethVM.ErrGasUintOverflow:
+		return ExecutionErrCodeGasUintOverflow
+	case gethVM.ErrInvalidCode:
+		return ExecutionErrCodeInvalidCode
+	case gethVM.ErrNonceUintOverflow:
+		return ExecutionErrCodeNonceUintOverflow
+	default:
+		return ExecutionErrCodeMisc
+	}
+}
diff --git a/fvm/evm/types/emulator.go b/fvm/evm/types/emulator.go
index 01577a4132a..b0118df2719 100644
--- a/fvm/evm/types/emulator.go
+++ b/fvm/evm/types/emulator.go
@@ -3,8 +3,10 @@ package types
 import (
 	"math/big"
 
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	gethVM "github.com/ethereum/go-ethereum/core/vm"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethVM "github.com/onflow/go-ethereum/core/vm"
+	gethCrypto "github.com/onflow/go-ethereum/crypto"
 )
 
 var (
@@ -22,10 +24,14 @@ type Precompile interface {
 
 // BlockContext holds the context needed for the emulator operations
 type BlockContext struct {
+	ChainID                *big.Int
 	BlockNumber            uint64
+	BlockTimestamp         uint64
 	DirectCallBaseGasUsage uint64
 	DirectCallGasPrice     uint64
 	GasFeeCollector        Address
+	GetHashFunc            func(n uint64) gethCommon.Hash
+	Random                 gethCommon.Hash
 
 	// a set of extra precompiles to be injected
 	ExtraPrecompiles []Precompile
@@ -34,9 +40,13 @@ type BlockContext struct {
 // NewDefaultBlockContext returns a new default block context
 func NewDefaultBlockContext(BlockNumber uint64) BlockContext {
 	return BlockContext{
+		ChainID:                FlowEVMPreviewNetChainID,
 		BlockNumber:            BlockNumber,
 		DirectCallBaseGasUsage: DefaultDirectCallBaseGasUsage,
 		DirectCallGasPrice:     DefaultDirectCallGasPrice,
+		GetHashFunc: func(n uint64) gethCommon.Hash { // default returns some random hash values
+			return gethCommon.BytesToHash(gethCrypto.Keccak256([]byte(new(big.Int).SetUint64(n).String())))
+		},
 	}
 }
 
@@ -46,16 +56,17 @@ type ReadOnlyBlockView interface {
 	BalanceOf(address Address) (*big.Int, error)
 	// NonceOf returns the nonce of this address
 	NonceOf(address Address) (uint64, error)
-	// CodeOf returns the code for this address (if smart contract is deployed at this address)
+	// CodeOf returns the code for this address
 	CodeOf(address Address) (Code, error)
+	// CodeHashOf returns the code hash for this address
+	CodeHashOf(address Address) ([]byte, error)
 }
 
-// BlockView facilitates execution of a transaction or a direct evm  call in the context of a block
-// Errors returned by the methods are one of the followings:
-// - Fatal error
-// - Database error (non-fatal)
-// - EVM validation error
-// - EVM execution error
+// BlockView facilitates execution of a transaction or a direct evm call in the context of a block
+// Any error returned by any of the methods (e.g. stateDB errors) if non-fatal stops the outer flow transaction
+// if fatal stops the node.
+// EVM validation errors and EVM execution errors are part of the returned result
+// and should be handled separately.
 type BlockView interface {
 	// executes a direct call
 	DirectCall(call *DirectCall) (*Result, error)
diff --git a/fvm/evm/types/errors.go b/fvm/evm/types/errors.go
index 3e8385f5331..c05dc4d5c17 100644
--- a/fvm/evm/types/errors.go
+++ b/fvm/evm/types/errors.go
@@ -5,12 +5,90 @@ import (
 	"fmt"
 )
 
-var (
-	// ErrAccountDoesNotExist is returned when evm account doesn't exist
-	ErrAccountDoesNotExist = errors.New("account does not exist")
+type ErrorCode uint64
+
+// internal error codes
+const ( // code reserved for no error
+	ErrCodeNoError ErrorCode = 0
+
+	// covers all other validation codes that doesn't have an specific code
+	ValidationErrCodeMisc ErrorCode = 100
+
+	// general execution error returned for cases that don't have an specific code
+	ExecutionErrCodeMisc ErrorCode = 400
+)
+
+// geth evm core errors (reserved range: [201-300) )
+const (
+	// the nonce of the tx is lower than the expected
+	ValidationErrCodeNonceTooLow ErrorCode = iota + 201
+	// the nonce of the tx is higher than the expected
+	ValidationErrCodeNonceTooHigh
+	// tx sender account has reached to the maximum nonce
+	ValidationErrCodeNonceMax
+	// not enough gas is available on the block to include this transaction
+	ValidationErrCodeGasLimitReached
+	// the transaction sender doesn't have enough funds for transfer(topmost call only).
+	ValidationErrCodeInsufficientFundsForTransfer
+	// creation transaction provides the init code bigger than init code size limit.
+	ValidationErrCodeMaxInitCodeSizeExceeded
+	// the total cost of executing a transaction is higher than the balance of the user's account.
+	ValidationErrCodeInsufficientFunds
+	// overflow detected when calculating the gas usage
+	ValidationErrCodeGasUintOverflow
+	// the transaction is specified to use less gas than required to start the invocation.
+	ValidationErrCodeIntrinsicGas
+	// the transaction is not supported in the current network configuration.
+	ValidationErrCodeTxTypeNotSupported
+	// tip was set to higher than the total fee cap
+	ValidationErrCodeTipAboveFeeCap
+	// an extremely big numbers is set for the tip field
+	ValidationErrCodeTipVeryHigh
+	// an extremely big numbers is set for the fee cap field
+	ValidationErrCodeFeeCapVeryHigh
+	// the transaction fee cap is less than the base fee of the block
+	ValidationErrCodeFeeCapTooLow
+	// the sender of a transaction is a contract
+	ValidationErrCodeSenderNoEOA
+	// the transaction fee cap is less than the blob gas fee of the block.
+	ValidationErrCodeBlobFeeCapTooLow
+)
+
+// evm execution errors (reserved range: [301-400) )
+const (
+	// execution ran out of gas
+	ExecutionErrCodeOutOfGas ErrorCode = iota + 301
+	// contract creation code storage out of gas
+	ExecutionErrCodeCodeStoreOutOfGas
+	// max call depth exceeded
+	ExecutionErrCodeDepth
+	// insufficient balance for transfer
+	ExecutionErrCodeInsufficientBalance
+	// contract address collision"
+	ExecutionErrCodeContractAddressCollision
+	// execution reverted
+	ExecutionErrCodeExecutionReverted
+	// max initcode size exceeded
+	ExecutionErrCodeMaxInitCodeSizeExceeded
+	// max code size exceeded
+	ExecutionErrCodeMaxCodeSizeExceeded
+	// invalid jump destination
+	ExecutionErrCodeInvalidJump
+	// write protection
+	ExecutionErrCodeWriteProtection
+	// return data out of bounds
+	ExecutionErrCodeReturnDataOutOfBounds
+	// gas uint64 overflow
+	ExecutionErrCodeGasUintOverflow
+	// invalid code: must not begin with 0xef
+	ExecutionErrCodeInvalidCode
+	// nonce uint64 overflow
+	ExecutionErrCodeNonceUintOverflow
+)
 
-	// ErrInsufficientBalance is returned when evm account doesn't have enough balance
-	ErrInsufficientBalance = errors.New("insufficient balance")
+var (
+	// ErrInvalidBalance is returned when an invalid balance is provided for transfer (e.g. negative)
+	ErrInvalidBalance = errors.New("invalid balance for transfer")
 
 	// ErrInsufficientComputation is returned when not enough computation is
 	// left in the context of flow transaction to execute the evm operation.
@@ -19,77 +97,26 @@ var (
 	// ErrUnAuthroizedMethodCall method call, usually emited when calls are called on EOA accounts
 	ErrUnAuthroizedMethodCall = errors.New("unauthroized method call")
 
+	// ErrInternalDirecCallFailed is returned when a withdraw or deposit internal call has failed.
+	ErrInternalDirectCallFailed = errors.New("internal direct call execution failed")
+
+	// ErrWithdrawBalanceRounding is returned when withdraw call has a balance that could
+	// yeild to rounding error, i.e. the balance contains fractions smaller than 10^8 Flow (smallest unit allowed to transfer).
+	ErrWithdrawBalanceRounding = errors.New("withdraw failed! the balance is susceptible to the rounding error")
+
+	// ErrUnexpectedEmptyResult is returned when a result is expected to be returned by the emulator
+	// but nil has been returned. This should never happen and is a safety error.
+	ErrUnexpectedEmptyResult = errors.New("unexpected empty result has been returned")
+
 	// ErrInsufficientTotalSupply is returned when flow token
 	// is withdraw request is there but not enough balance is on EVM vault
 	// this should never happen but its a saftey measure to protect Flow against EVM issues.
-	// TODO: we might consider this fatal
-	ErrInsufficientTotalSupply = errors.New("insufficient total supply")
-
-	// ErrBalanceConversion is returned conversion of balance has failed, usually
-	// is returned when the balance presented in attoflow has values that could
-	// be marginally lost on the conversion.
-	ErrBalanceConversion = errors.New("balance converion error")
+	ErrInsufficientTotalSupply = NewFatalError(errors.New("insufficient total supply"))
 
 	// ErrNotImplemented is a fatal error when something is called that is not implemented
 	ErrNotImplemented = NewFatalError(errors.New("a functionality is called that is not implemented"))
 )
 
-// EVMExecutionError is a non-fatal error, returned when execution of
-// an evm transaction or direct call has failed.
-type EVMExecutionError struct {
-	err error
-}
-
-// NewEVMExecutionError returns a new EVMExecutionError
-func NewEVMExecutionError(rootCause error) EVMExecutionError {
-	return EVMExecutionError{
-		err: rootCause,
-	}
-}
-
-// Unwrap unwraps the underlying evm error
-func (err EVMExecutionError) Unwrap() error {
-	return err.err
-}
-
-func (err EVMExecutionError) Error() string {
-	return fmt.Sprintf("EVM execution error: %v", err.err)
-}
-
-// IsEVMValidationError returns true if the error or any underlying errors
-// is of the type EVM execution error
-func IsEVMExecutionError(err error) bool {
-	return errors.As(err, &EVMExecutionError{})
-}
-
-// EVMValidationError is a non-fatal error, returned when validation steps of an EVM transaction
-// or direct call has failed.
-type EVMValidationError struct {
-	err error
-}
-
-// NewEVMValidationError returns a new EVMValidationError
-func NewEVMValidationError(rootCause error) EVMValidationError {
-	return EVMValidationError{
-		err: rootCause,
-	}
-}
-
-// Unwrap unwraps the underlying evm error
-func (err EVMValidationError) Unwrap() error {
-	return err.err
-}
-
-func (err EVMValidationError) Error() string {
-	return fmt.Sprintf("EVM validation error: %v", err.err)
-}
-
-// IsEVMValidationError returns true if the error or any underlying errors
-// is of the type EVM validation error
-func IsEVMValidationError(err error) bool {
-	return errors.As(err, &EVMValidationError{})
-}
-
 // StateError is a non-fatal error, returned when a state operation
 // has failed (e.g. reaching storage interaction limit)
 type StateError struct {
@@ -113,7 +140,7 @@ func (err StateError) Error() string {
 }
 
 // IsAStateError returns true if the error or any underlying errors
-// is of the type EVM validation error
+// is a state error
 func IsAStateError(err error) bool {
 	return errors.As(err, &StateError{})
 }
@@ -153,8 +180,41 @@ func IsAInsufficientTotalSupplyError(err error) bool {
 	return errors.Is(err, ErrInsufficientTotalSupply)
 }
 
+// IsWithdrawBalanceRoundingError returns true if the error type is
+// ErrWithdrawBalanceRounding
+func IsWithdrawBalanceRoundingError(err error) bool {
+	return errors.Is(err, ErrWithdrawBalanceRounding)
+}
+
 // IsAUnAuthroizedMethodCallError returns true if the error type is
 // UnAuthroizedMethodCallError
 func IsAUnAuthroizedMethodCallError(err error) bool {
 	return errors.Is(err, ErrUnAuthroizedMethodCall)
 }
+
+// BackendError is a non-fatal error wraps errors returned from the backend
+type BackendError struct {
+	err error
+}
+
+// NewBackendError returns a new BackendError
+func NewBackendError(rootCause error) BackendError {
+	return BackendError{
+		err: rootCause,
+	}
+}
+
+// Unwrap unwraps the underlying evm error
+func (err BackendError) Unwrap() error {
+	return err.err
+}
+
+func (err BackendError) Error() string {
+	return fmt.Sprintf("backend error: %v", err.err)
+}
+
+// IsABackendError returns true if the error or
+// any underlying errors is a backend error
+func IsABackendError(err error) bool {
+	return errors.As(err, &BackendError{})
+}
diff --git a/fvm/evm/types/events.go b/fvm/evm/types/events.go
index f8afcf2c040..15a061bcea9 100644
--- a/fvm/evm/types/events.go
+++ b/fvm/evm/types/events.go
@@ -6,10 +6,10 @@ import (
 	"fmt"
 	"strings"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	"github.com/ethereum/go-ethereum/rlp"
 	"github.com/onflow/cadence"
 	"github.com/onflow/cadence/runtime/common"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	"github.com/onflow/go-ethereum/rlp"
 
 	"github.com/onflow/flow-go/model/flow"
 )
@@ -17,7 +17,6 @@ import (
 const (
 	EventTypeBlockExecuted       flow.EventType = "BlockExecuted"
 	EventTypeTransactionExecuted flow.EventType = "TransactionExecuted"
-	evmLocationPrefix                           = "evm"
 	locationDivider                             = "."
 )
 
@@ -36,7 +35,7 @@ var _ common.Location = EVMLocation{}
 type EVMLocation struct{}
 
 func (l EVMLocation) TypeID(memoryGauge common.MemoryGauge, qualifiedIdentifier string) common.TypeID {
-	id := fmt.Sprintf("%s%s%s", evmLocationPrefix, locationDivider, qualifiedIdentifier)
+	id := fmt.Sprintf("%s%s%s", flow.EVMLocationPrefix, locationDivider, qualifiedIdentifier)
 	common.UseMemory(memoryGauge, common.NewRawStringMemoryUsage(len(id)))
 
 	return common.TypeID(id)
@@ -53,15 +52,15 @@ func (l EVMLocation) QualifiedIdentifier(typeID common.TypeID) string {
 }
 
 func (l EVMLocation) String() string {
-	return evmLocationPrefix
+	return flow.EVMLocationPrefix
 }
 
 func (l EVMLocation) Description() string {
-	return evmLocationPrefix
+	return flow.EVMLocationPrefix
 }
 
 func (l EVMLocation) ID() string {
-	return evmLocationPrefix
+	return flow.EVMLocationPrefix
 }
 
 func (l EVMLocation) MarshalJSON() ([]byte, error) {
@@ -74,7 +73,7 @@ func (l EVMLocation) MarshalJSON() ([]byte, error) {
 
 func init() {
 	common.RegisterTypeIDDecoder(
-		evmLocationPrefix,
+		flow.EVMLocationPrefix,
 		func(_ common.MemoryGauge, typeID string) (common.Location, string, error) {
 			if typeID == "" {
 				return nil, "", fmt.Errorf("invalid EVM type location ID: missing type prefix")
@@ -82,7 +81,7 @@ func init() {
 
 			parts := strings.SplitN(typeID, ".", 2)
 			prefix := parts[0]
-			if prefix != evmLocationPrefix {
+			if prefix != flow.EVMLocationPrefix {
 				return EVMLocation{}, "", fmt.Errorf("invalid EVM type location ID: invalid prefix")
 			}
 
@@ -97,10 +96,12 @@ func init() {
 	)
 }
 
-// we might break this event into two (tx included /tx executed) if size becomes an issue
+// todo we might have to break this event into two (tx included /tx executed) if size becomes an issue
+
 type TransactionExecutedPayload struct {
 	BlockHeight uint64
 	TxEncoded   []byte
+	BlockHash   gethCommon.Hash
 	TxHash      gethCommon.Hash
 	Result      *Result
 }
@@ -121,9 +122,11 @@ func (p *TransactionExecutedPayload) CadenceEvent() (cadence.Event, error) {
 			string(EventTypeTransactionExecuted),
 			[]cadence.Field{
 				cadence.NewField("blockHeight", cadence.UInt64Type{}),
+				cadence.NewField("blockHash", cadence.StringType{}),
 				cadence.NewField("transactionHash", cadence.StringType{}),
 				cadence.NewField("transaction", cadence.StringType{}),
 				cadence.NewField("failed", cadence.BoolType{}),
+				cadence.NewField("vmError", cadence.StringType{}),
 				cadence.NewField("transactionType", cadence.UInt8Type{}),
 				cadence.NewField("gasConsumed", cadence.UInt64Type{}),
 				cadence.NewField("deployedContractAddress", cadence.StringType{}),
@@ -134,12 +137,14 @@ func (p *TransactionExecutedPayload) CadenceEvent() (cadence.Event, error) {
 		),
 		Fields: []cadence.Value{
 			cadence.NewUInt64(p.BlockHeight),
+			cadence.String(p.BlockHash.String()),
 			cadence.String(p.TxHash.String()),
 			cadence.String(hex.EncodeToString(p.TxEncoded)),
-			cadence.NewBool(p.Result.Failed),
+			cadence.Bool(p.Result.Failed()),
+			cadence.String(p.Result.VMErrorString()),
 			cadence.NewUInt8(p.Result.TxType),
 			cadence.NewUInt64(p.Result.GasConsumed),
-			cadence.String(hex.EncodeToString(p.Result.DeployedContractAddress.Bytes())),
+			cadence.String(p.Result.DeployedContractAddress.String()),
 			cadence.String(hex.EncodeToString(p.Result.ReturnedValue)),
 			cadence.String(hex.EncodeToString(encodedLogs)),
 		},
@@ -149,6 +154,7 @@ func (p *TransactionExecutedPayload) CadenceEvent() (cadence.Event, error) {
 func NewTransactionExecutedEvent(
 	height uint64,
 	txEncoded []byte,
+	blockHash gethCommon.Hash,
 	txHash gethCommon.Hash,
 	result *Result,
 ) *Event {
@@ -156,6 +162,7 @@ func NewTransactionExecutedEvent(
 		Etype: EventTypeTransactionExecuted,
 		Payload: &TransactionExecutedPayload{
 			BlockHeight: height,
+			BlockHash:   blockHash,
 			TxEncoded:   txEncoded,
 			TxHash:      txHash,
 			Result:      result,
@@ -169,6 +176,7 @@ var blockExecutedEventCadenceType = &cadence.EventType{
 	Fields: []cadence.Field{
 		cadence.NewField("height", cadence.UInt64Type{}),
 		cadence.NewField("hash", cadence.StringType{}),
+		cadence.NewField("timestamp", cadence.UInt64Type{}),
 		cadence.NewField("totalSupply", cadence.IntType{}),
 		cadence.NewField("parentHash", cadence.StringType{}),
 		cadence.NewField("receiptRoot", cadence.StringType{}),
@@ -197,6 +205,7 @@ func (p *BlockExecutedEventPayload) CadenceEvent() (cadence.Event, error) {
 	fields := []cadence.Value{
 		cadence.NewUInt64(p.Block.Height),
 		cadence.String(blockHash.String()),
+		cadence.NewUInt64(p.Block.Timestamp),
 		cadence.NewIntFromBig(p.Block.TotalSupply),
 		cadence.String(p.Block.ParentBlockHash.String()),
 		cadence.String(p.Block.ReceiptRoot.String()),
diff --git a/fvm/evm/types/events_test.go b/fvm/evm/types/events_test.go
new file mode 100644
index 00000000000..cdea389c0d9
--- /dev/null
+++ b/fvm/evm/types/events_test.go
@@ -0,0 +1,236 @@
+package types_test
+
+import (
+	"encoding/hex"
+	"fmt"
+	"math/big"
+	"testing"
+
+	"github.com/onflow/cadence"
+	"github.com/onflow/cadence/encoding/ccf"
+	cdcCommon "github.com/onflow/cadence/runtime/common"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	"github.com/onflow/go-ethereum/rlp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/fvm/evm/testutils"
+	"github.com/onflow/flow-go/fvm/evm/types"
+)
+
+type blockEventPayload struct {
+	Height            uint64           `cadence:"height"`
+	Hash              string           `cadence:"hash"`
+	Timestamp         uint64           `cadence:"timestamp"`
+	TotalSupply       cadence.Int      `cadence:"totalSupply"`
+	ParentBlockHash   string           `cadence:"parentHash"`
+	ReceiptRoot       string           `cadence:"receiptRoot"`
+	TransactionHashes []cadence.String `cadence:"transactionHashes"`
+}
+
+type txEventPayload struct {
+	BlockHeight             uint64 `cadence:"blockHeight"`
+	BlockHash               string `cadence:"blockHash"`
+	TransactionHash         string `cadence:"transactionHash"`
+	Transaction             string `cadence:"transaction"`
+	Failed                  bool   `cadence:"failed"`
+	VMError                 string `cadence:"vmError"`
+	TransactionType         uint8  `cadence:"transactionType"`
+	GasConsumed             uint64 `cadence:"gasConsumed"`
+	DeployedContractAddress string `cadence:"deployedContractAddress"`
+	ReturnedValue           string `cadence:"returnedValue"`
+	Logs                    string `cadence:"logs"`
+}
+
+func TestEVMBlockExecutedEventCCFEncodingDecoding(t *testing.T) {
+	t.Parallel()
+
+	block := &types.Block{
+		Height:          2,
+		Timestamp:       100,
+		TotalSupply:     big.NewInt(1500),
+		ParentBlockHash: gethCommon.HexToHash("0x2813452cff514c3054ac9f40cd7ce1b016cc78ab7f99f1c6d49708837f6e06d1"),
+		ReceiptRoot:     gethCommon.Hash{},
+		TransactionHashes: []gethCommon.Hash{
+			gethCommon.HexToHash("0x70b67ce6710355acf8d69b2ea013d34e212bc4824926c5d26f189c1ca9667246"),
+		},
+	}
+
+	event := types.NewBlockExecutedEvent(block)
+	ev, err := event.Payload.CadenceEvent()
+	require.NoError(t, err)
+
+	var bep blockEventPayload
+	err = cadence.DecodeFields(ev, &bep)
+	require.NoError(t, err)
+
+	assert.Equal(t, bep.Height, block.Height)
+
+	blockHash, err := block.Hash()
+	require.NoError(t, err)
+	assert.Equal(t, bep.Hash, blockHash.Hex())
+
+	assert.Equal(t, bep.TotalSupply.Value, block.TotalSupply)
+	assert.Equal(t, bep.Timestamp, block.Timestamp)
+	assert.Equal(t, bep.ParentBlockHash, block.ParentBlockHash.Hex())
+	assert.Equal(t, bep.ReceiptRoot, block.ReceiptRoot.Hex())
+
+	hashes := make([]gethCommon.Hash, len(bep.TransactionHashes))
+	for i, h := range bep.TransactionHashes {
+		hashes[i] = gethCommon.HexToHash(h.ToGoValue().(string))
+	}
+	assert.Equal(t, hashes, block.TransactionHashes)
+
+	v, err := ccf.Encode(ev)
+	require.NoError(t, err)
+	assert.Equal(t, ccf.HasMsgPrefix(v), true)
+
+	evt, err := ccf.Decode(nil, v)
+	require.NoError(t, err)
+
+	assert.Equal(t, evt.Type().ID(), "evm.BlockExecuted")
+
+	location, qualifiedIdentifier, err := cdcCommon.DecodeTypeID(nil, "evm.BlockExecuted")
+	require.NoError(t, err)
+
+	assert.Equal(t, types.EVMLocation{}, location)
+	assert.Equal(t, "BlockExecuted", qualifiedIdentifier)
+}
+
+func TestEVMTransactionExecutedEventCCFEncodingDecoding(t *testing.T) {
+	t.Parallel()
+
+	txEncoded := "fff83b81ff0194000000000000000000000000000000000000000094000000000000000000000000000000000000000180895150ae84a8cdf00000825208"
+	txBytes, err := hex.DecodeString(txEncoded)
+	require.NoError(t, err)
+	txHash := testutils.RandomCommonHash(t)
+	blockHash := testutils.RandomCommonHash(t)
+	data := "000000000000000000000000000000000000000000000000000000000000002a"
+	dataBytes, err := hex.DecodeString(data)
+	require.NoError(t, err)
+	blockHeight := uint64(2)
+	log := &gethTypes.Log{
+		Index:       1,
+		BlockNumber: blockHeight,
+		BlockHash:   blockHash,
+		TxHash:      txHash,
+		TxIndex:     3,
+		Address:     gethCommon.HexToAddress("0x99466ed2e37b892a2ee3e9cd55a98b68f5735db2"),
+		Data:        dataBytes,
+		Topics: []gethCommon.Hash{
+			gethCommon.HexToHash("0x24abdb5865df5079dcc5ac590ff6f01d5c16edbc5fab4e195d9febd1114503da"),
+		},
+	}
+	vmError := fmt.Errorf("ran out of gas")
+	txResult := &types.Result{
+		VMError:                 vmError,
+		TxType:                  255,
+		GasConsumed:             23200,
+		DeployedContractAddress: types.NewAddress(gethCommon.HexToAddress("0x99466ed2e37b892a2ee3e9cd55a98b68f5735db2")),
+		ReturnedValue:           dataBytes,
+		Logs:                    []*gethTypes.Log{log},
+	}
+
+	t.Run("evm.TransactionExecuted with failed status", func(t *testing.T) {
+		event := types.NewTransactionExecutedEvent(
+			blockHeight,
+			txBytes,
+			blockHash,
+			txHash,
+			txResult,
+		)
+		ev, err := event.Payload.CadenceEvent()
+		require.NoError(t, err)
+
+		var tep txEventPayload
+		err = cadence.DecodeFields(ev, &tep)
+		require.NoError(t, err)
+
+		assert.Equal(t, tep.BlockHeight, blockHeight)
+		assert.Equal(t, tep.BlockHash, blockHash.Hex())
+		assert.Equal(t, tep.TransactionHash, txHash.Hex())
+		assert.Equal(t, tep.Transaction, txEncoded)
+		assert.True(t, tep.Failed)
+		assert.Equal(t, tep.VMError, vmError.Error())
+		assert.Equal(t, tep.TransactionType, txResult.TxType)
+		assert.Equal(t, tep.GasConsumed, txResult.GasConsumed)
+		assert.Equal(
+			t,
+			tep.DeployedContractAddress,
+			txResult.DeployedContractAddress.ToCommon().Hex(),
+		)
+		assert.Equal(t, tep.ReturnedValue, data)
+
+		encodedLogs, err := rlp.EncodeToBytes(txResult.Logs)
+		require.NoError(t, err)
+		assert.Equal(t, tep.Logs, hex.EncodeToString(encodedLogs))
+
+		v, err := ccf.Encode(ev)
+		require.NoError(t, err)
+		assert.Equal(t, ccf.HasMsgPrefix(v), true)
+
+		evt, err := ccf.Decode(nil, v)
+		require.NoError(t, err)
+
+		assert.Equal(t, evt.Type().ID(), "evm.TransactionExecuted")
+
+		location, qualifiedIdentifier, err := cdcCommon.DecodeTypeID(nil, "evm.TransactionExecuted")
+		require.NoError(t, err)
+
+		assert.Equal(t, types.EVMLocation{}, location)
+		assert.Equal(t, "TransactionExecuted", qualifiedIdentifier)
+	})
+
+	t.Run("evm.TransactionExecuted with non-failed status", func(t *testing.T) {
+		txResult.VMError = nil
+
+		event := types.NewTransactionExecutedEvent(
+			blockHeight,
+			txBytes,
+			blockHash,
+			txHash,
+			txResult,
+		)
+		ev, err := event.Payload.CadenceEvent()
+		require.NoError(t, err)
+
+		var tep txEventPayload
+		err = cadence.DecodeFields(ev, &tep)
+		require.NoError(t, err)
+
+		assert.Equal(t, tep.BlockHeight, blockHeight)
+		assert.Equal(t, tep.BlockHash, blockHash.Hex())
+		assert.Equal(t, tep.TransactionHash, txHash.Hex())
+		assert.Equal(t, tep.Transaction, txEncoded)
+		assert.False(t, tep.Failed)
+		assert.Equal(t, "", tep.VMError)
+		assert.Equal(t, tep.TransactionType, txResult.TxType)
+		assert.Equal(t, tep.GasConsumed, txResult.GasConsumed)
+		assert.Equal(
+			t,
+			tep.DeployedContractAddress,
+			txResult.DeployedContractAddress.ToCommon().Hex(),
+		)
+		assert.Equal(t, tep.ReturnedValue, data)
+
+		encodedLogs, err := rlp.EncodeToBytes(txResult.Logs)
+		require.NoError(t, err)
+		assert.Equal(t, tep.Logs, hex.EncodeToString(encodedLogs))
+
+		v, err := ccf.Encode(ev)
+		require.NoError(t, err)
+		assert.Equal(t, ccf.HasMsgPrefix(v), true)
+
+		evt, err := ccf.Decode(nil, v)
+		require.NoError(t, err)
+
+		assert.Equal(t, evt.Type().ID(), "evm.TransactionExecuted")
+
+		location, qualifiedIdentifier, err := cdcCommon.DecodeTypeID(nil, "evm.TransactionExecuted")
+		require.NoError(t, err)
+
+		assert.Equal(t, types.EVMLocation{}, location)
+		assert.Equal(t, "TransactionExecuted", qualifiedIdentifier)
+	})
+}
diff --git a/fvm/evm/types/handler.go b/fvm/evm/types/handler.go
index bfe187234e8..28e75daa7f0 100644
--- a/fvm/evm/types/handler.go
+++ b/fvm/evm/types/handler.go
@@ -1,10 +1,8 @@
 package types
 
 import (
-	gethCommon "github.com/ethereum/go-ethereum/common"
 	"github.com/onflow/cadence/runtime/common"
-
-	"github.com/onflow/flow-go/fvm/environment"
+	gethCommon "github.com/onflow/go-ethereum/common"
 )
 
 // EVM is an account inside FVM with special access to the underlying infrastructure
@@ -15,21 +13,21 @@ import (
 // First, passing a signed transaction (EOA account) to the `EVM.run` Cadence function
 // creates a new block, updates the internal merkle tree, and emits a new root hash.
 //
-// The Second way is through a new form of account called bridged accounts,
+// The Second way is through a new form of account called cadence-owned-accounts (COAs),
 // which is represented and controlled through a resource, owned by a Flow account.
-// The owner of the bridged account resource can interact with the evm environment on behalf of the address stored on the resource.
+// The owner of the COA resource can interact with the evm environment on behalf of the address stored on the resource.
 //
 // The evm environment shares the same native token as Flow, there are no new tokens minted.
-// Other ERC-20 fungible tokens can be bridged between bridged account resources and Flow accounts.
+// Other ERC-20 fungible tokens can be bridged between COA resources and Flow accounts.
 
 // ContractHandler handles operations on the evm environment
 type ContractHandler interface {
-	// AllocateAddress allocates an address to be used by a bridged account resource
-	AllocateAddress() Address
+	// DeployCOA deploys a Cadence owned account and return the address
+	DeployCOA(uuid uint64) Address
 
 	// AccountByAddress returns an account by address
 	// if isAuthorized is set, it allows for functionality like `call`, `deploy`
-	// should only be set for bridged accounts only.
+	// should only be set for the cadence owned accounts only.
 	AccountByAddress(address Address, isAuthorized bool) Account
 
 	// LastExecutedBlock returns information about the last executed block
@@ -37,23 +35,29 @@ type ContractHandler interface {
 
 	// Run runs a transaction in the evm environment,
 	// collects the gas fees, and transfers the gas fees to the given coinbase account.
-	Run(tx []byte, coinbase Address)
+	Run(tx []byte, coinbase Address) *ResultSummary
 
+	// FlowTokenAddress returns the address where FLOW token is deployed
 	FlowTokenAddress() common.Address
-}
 
-// Backend passes the FVM functionality needed inside the handler
-type Backend interface {
-	environment.ValueStore
-	environment.Meter
-	environment.EventEmitter
-	environment.BlockInfo
+	// EVMContractAddress returns the address where EVM is deployed
+	EVMContractAddress() common.Address
+
+	// GenerateResourceUUID generates a new UUID for a resource
+	GenerateResourceUUID() uint64
 }
 
 // AddressAllocator allocates addresses, used by the handler
 type AddressAllocator interface {
 	// AllocateAddress allocates an address to be used by a COA resource
-	AllocateCOAAddress() (Address, error)
+	AllocateCOAAddress(uuid uint64) Address
+
+	// COAFactoryAddress returns the address for the COA factory
+	COAFactoryAddress() Address
+
+	// NativeTokenBridgeAddress returns the address for the native token bridge
+	// used for deposit and withdraw calls
+	NativeTokenBridgeAddress() Address
 
 	// AllocateAddress allocates an address by index to be used by a precompile contract
 	AllocatePrecompileAddress(index uint64) Address
@@ -65,7 +69,7 @@ type BlockStore interface {
 	LatestBlock() (*Block, error)
 
 	// BlockHash returns the hash of the block at the given height
-	BlockHash(height int) (gethCommon.Hash, error)
+	BlockHash(height uint64) (gethCommon.Hash, error)
 
 	// BlockProposal returns the block proposal
 	BlockProposal() (*Block, error)
diff --git a/fvm/evm/types/proof.go b/fvm/evm/types/proof.go
new file mode 100644
index 00000000000..57a8b5aba53
--- /dev/null
+++ b/fvm/evm/types/proof.go
@@ -0,0 +1,169 @@
+package types
+
+import (
+	"fmt"
+
+	"github.com/onflow/cadence"
+	"github.com/onflow/cadence/runtime/common"
+	"github.com/onflow/cadence/runtime/sema"
+	cadenceRLP "github.com/onflow/cadence/runtime/stdlib/rlp"
+	"github.com/onflow/go-ethereum/rlp"
+
+	"github.com/onflow/flow-go/model/flow"
+)
+
+type FlowAddress flow.Address
+
+var FlowAddressCadenceType = cadence.TheAddressType
+var FlowAddressSemaType = sema.TheAddressType
+
+func (addr FlowAddress) ToCadenceValue() cadence.Address {
+	return cadence.Address(addr)
+}
+
+type PublicPath string
+
+var PublicPathCadenceType = cadence.ThePathType
+var PublicPathSemaType = sema.PathType
+
+func (p PublicPath) ToCadenceValue() cadence.Path {
+	return cadence.Path{
+		Domain:     common.PathDomainPublic,
+		Identifier: string(p),
+	}
+}
+
+type SignedData []byte
+
+var SignedDataCadenceType = cadence.NewVariableSizedArrayType(cadence.TheUInt8Type)
+var SignedDataSemaType = sema.ByteArrayType
+
+func (sd SignedData) ToCadenceValue() cadence.Array {
+	values := make([]cadence.Value, len(sd))
+	for i, v := range sd {
+		values[i] = cadence.NewUInt8(v)
+	}
+	return cadence.NewArray(values).WithType(SignedDataCadenceType)
+}
+
+type KeyIndices []uint64
+
+var KeyIndicesCadenceType = cadence.NewVariableSizedArrayType(cadence.TheUInt64Type)
+var KeyIndicesSemaType = &sema.VariableSizedType{Type: sema.UInt64Type}
+
+func (ki KeyIndices) ToCadenceValue() cadence.Array {
+	values := make([]cadence.Value, len(ki))
+	for i, v := range ki {
+		values[i] = cadence.NewUInt64(v)
+	}
+	return cadence.NewArray(values).WithType(KeyIndicesCadenceType)
+}
+
+func (ki KeyIndices) Count() int {
+	return len(ki)
+}
+
+type Signature []byte
+
+var SignatureCadenceType = cadence.NewVariableSizedArrayType(cadence.TheUInt8Type)
+
+func (s Signature) ToCadenceValue() cadence.Array {
+	values := make([]cadence.Value, len(s))
+	for i, v := range s {
+		values[i] = cadence.NewUInt8(v)
+	}
+	return cadence.NewArray(values).WithType(SignatureCadenceType)
+}
+
+type Signatures []Signature
+
+var SignaturesCadenceType = cadence.NewVariableSizedArrayType(SignatureCadenceType)
+var SignaturesSemaType = sema.ByteArrayArrayType
+
+func (ss Signatures) ToCadenceValue() cadence.Array {
+	values := make([]cadence.Value, len(ss))
+	for i, s := range ss {
+		values[i] = s.ToCadenceValue()
+	}
+	return cadence.NewArray(values).WithType(SignaturesCadenceType)
+}
+
+func (ss Signatures) Count() int {
+	return len(ss)
+}
+
+// COAOwnershipProofInContext contains all the data
+// needed to verify a COAOwnership proof.
+// The proof is verified by checking the signatures over the
+// input signed data (SignedData), then loading the resource
+// capability from the provided path in the proof, and
+// at last checking if the EVMAddress of the resource matches
+// the provided one.
+type COAOwnershipProofInContext struct {
+	COAOwnershipProof
+	SignedData SignedData
+	EVMAddress Address
+}
+
+func NewCOAOwnershipProofInContext(sd []byte, addr Address, encodedProof []byte) (*COAOwnershipProofInContext, error) {
+	proof, err := COAOwnershipProofFromEncoded(encodedProof)
+	if err != nil {
+		return nil, err
+	}
+	return &COAOwnershipProofInContext{
+		COAOwnershipProof: *proof,
+		SignedData:        sd,
+		EVMAddress:        addr,
+	}, nil
+}
+
+func (proof *COAOwnershipProofInContext) ToCadenceValues() []cadence.Value {
+	return []cadence.Value{
+		proof.Address.ToCadenceValue(),
+		proof.CapabilityPath.ToCadenceValue(),
+		proof.SignedData.ToCadenceValue(),
+		proof.KeyIndices.ToCadenceValue(),
+		proof.Signatures.ToCadenceValue(),
+		proof.EVMAddress.ToCadenceValue(),
+	}
+}
+
+// COAOwnershipProof is a proof that a flow account
+// controls a COA resource. To do so, the flow
+// account (Address is address of this account)
+// provides signatures (with proper total weights) over an arbitary data input
+// set by proof requester. KeyIndicies captures,
+// which account keys has been used for signatures.
+// Beside signatures, it provides the CapabilityPath
+// where the resource EVMAddress capability is stored.
+type COAOwnershipProof struct {
+	KeyIndices     KeyIndices
+	Address        FlowAddress
+	CapabilityPath PublicPath
+	Signatures     Signatures
+}
+
+func (p *COAOwnershipProof) Encode() ([]byte, error) {
+	return rlp.EncodeToBytes(p)
+}
+
+func COAOwnershipProofSignatureCountFromEncoded(data []byte) (int, error) {
+	// first break into proof encoded items
+	encodedItems, _, err := cadenceRLP.DecodeList(data, 0)
+	if err != nil {
+		return 0, err
+	}
+	// first encoded item is KeyIndicies
+	// so reading number of elements in the key indicies
+	// should return the count without the need to fully decode
+	KeyIndices, _, err := cadenceRLP.DecodeList(encodedItems[0], 0)
+	return len(KeyIndices), err
+}
+
+func COAOwnershipProofFromEncoded(data []byte) (*COAOwnershipProof, error) {
+	if len(data) == 0 {
+		return nil, fmt.Errorf("empty proof")
+	}
+	p := &COAOwnershipProof{}
+	return p, rlp.DecodeBytes(data, p)
+}
diff --git a/fvm/evm/types/proof_test.go b/fvm/evm/types/proof_test.go
new file mode 100644
index 00000000000..b4ad31c8030
--- /dev/null
+++ b/fvm/evm/types/proof_test.go
@@ -0,0 +1,24 @@
+package types_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/fvm/evm/testutils"
+	"github.com/onflow/flow-go/fvm/evm/types"
+)
+
+func TestProof(t *testing.T) {
+	proof := testutils.COAOwnershipProofFixture(t)
+	encoded, err := proof.Encode()
+	require.NoError(t, err)
+
+	ret, err := types.COAOwnershipProofFromEncoded(encoded)
+	require.NoError(t, err)
+	require.Equal(t, proof, ret)
+
+	count, err := types.COAOwnershipProofSignatureCountFromEncoded(encoded)
+	require.NoError(t, err)
+	require.Equal(t, 2, count)
+}
diff --git a/fvm/evm/types/result.go b/fvm/evm/types/result.go
index fb7321a5847..4eae1ca9146 100644
--- a/fvm/evm/types/result.go
+++ b/fvm/evm/types/result.go
@@ -1,9 +1,47 @@
 package types
 
 import (
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
 )
 
+// InvalidTransactionGasCost is a gas cost we charge when
+// a transaction or call fails at validation step.
+// in typical evm environment this doesn't exist given
+// if a transaction is invalid it won't be included
+// and no fees can be charged for users even though
+// the validation has used some resources, in our case
+// given we charge the fees on flow transaction and we
+// are doing on chain validation we can/should charge the
+// user for the validation fee.
+const InvalidTransactionGasCost = 1_000
+
+// Status captures the status of an interaction to the emulator
+type Status uint8
+
+var (
+	StatusUnknown Status = 0
+	// StatusInvalid shows that the transaction was not a valid
+	// transaction and rejected to be executed and included in any block.
+	StatusInvalid Status = 1
+	// StatusFailed shows that the transaction has been executed,
+	// but the output of the execution was an error
+	// for this case a block is formed and receipts are available
+	StatusFailed Status = 2
+	// StatusFailed shows that the transaction has been executed and the execution has returned success
+	// for this case a block is formed and receipts are available
+	StatusSuccessful Status = 3
+)
+
+// ResultSummary summerizes the outcome of a EVM call or tx run
+type ResultSummary struct {
+	Status                  Status
+	ErrorCode               ErrorCode
+	GasConsumed             uint64
+	DeployedContractAddress Address
+	ReturnedValue           Data
+}
+
 // Result captures the result of an interaction to the emulator
 // it could be the out put of a direct call or output of running an
 // evm transaction.
@@ -12,8 +50,10 @@ import (
 // but we take a different apporach here and include more data so that
 // it requires less work for anyone who tracks and consume results.
 type Result struct {
-	// a boolean that is set to false if the execution has failed (non-fatal)
-	Failed bool
+	// captures error returned during validation step (pre-checks)
+	ValidationError error
+	// captures error returned by the EVM
+	VMError error
 	// type of transaction defined by the evm package
 	// see DirectCallTxType as extra type we added type for direct calls.
 	TxType uint8
@@ -25,23 +65,83 @@ type Result struct {
 	ReturnedValue []byte
 	// EVM logs (events that are emited by evm)
 	Logs []*gethTypes.Log
+	// TX hash holdes the cached value of tx hash
+	TxHash gethCommon.Hash
+}
+
+// Invalid returns true if transaction has been rejected
+func (res *Result) Invalid() bool {
+	return res.ValidationError != nil
+}
+
+// Failed returns true if transaction has been executed but VM has returned some error
+func (res *Result) Failed() bool {
+	return res.VMError != nil
+}
+
+// SetValidationError sets the validation error
+// and also sets the gas used to the fixed invalid gas usage
+func (res *Result) SetValidationError(err error) {
+	res.ValidationError = err
+	res.GasConsumed = InvalidTransactionGasCost
+}
+
+// returns the VM error as an string, if no error it returns an empty string
+func (res *Result) VMErrorString() string {
+	if res.VMError != nil {
+		return res.VMError.Error()
+	}
+	return ""
 }
 
 // Receipt constructs an EVM-style receipt
 // can be used by json-rpc and other integration to be returned.
-func (res *Result) Receipt() *gethTypes.ReceiptForStorage {
+//
+// This is method is also used to construct block receipt root hash
+// which requires the return receipt satisfy RLP encoding and cover these feilds
+// Type (txType), PostState or Status, CumulativeGasUsed, Logs and Logs Bloom
+// and for each log, Address, Topics, Data (consensus fields)
+// During execution we also do fill in BlockNumber, TxIndex, Index (event index)
+func (res *Result) Receipt() *gethTypes.Receipt {
+	if res.Invalid() {
+		return nil
+	}
 	receipt := &gethTypes.Receipt{
 		Type:              res.TxType,
 		CumulativeGasUsed: res.GasConsumed, // TODO: update to capture cumulative
 		Logs:              res.Logs,
 		ContractAddress:   res.DeployedContractAddress.ToCommon(),
 	}
-	if res.Failed {
+	if res.Failed() {
 		receipt.Status = gethTypes.ReceiptStatusFailed
 	} else {
 		receipt.Status = gethTypes.ReceiptStatusSuccessful
 	}
 
 	receipt.Bloom = gethTypes.CreateBloom(gethTypes.Receipts{receipt})
-	return (*gethTypes.ReceiptForStorage)(receipt)
+	return receipt
+}
+
+// ResultSummary constructs a result summary
+func (res *Result) ResultSummary() *ResultSummary {
+	rs := &ResultSummary{}
+
+	rs.GasConsumed = res.GasConsumed
+	rs.DeployedContractAddress = res.DeployedContractAddress
+	rs.ReturnedValue = res.ReturnedValue
+
+	if res.Invalid() {
+		rs.ErrorCode = ValidationErrorCode(res.ValidationError)
+		rs.Status = StatusInvalid
+		return rs
+	}
+
+	if res.Failed() {
+		rs.ErrorCode = ExecutionErrorCode(res.VMError)
+		rs.Status = StatusFailed
+		return rs
+	}
+
+	rs.Status = StatusSuccessful
+	return rs
 }
diff --git a/fvm/evm/types/state.go b/fvm/evm/types/state.go
index ee31f94fa89..44741b9330b 100644
--- a/fvm/evm/types/state.go
+++ b/fvm/evm/types/state.go
@@ -3,9 +3,9 @@ package types
 import (
 	"math/big"
 
-	gethCommon "github.com/ethereum/go-ethereum/common"
-	gethTypes "github.com/ethereum/go-ethereum/core/types"
-	gethVM "github.com/ethereum/go-ethereum/core/vm"
+	gethCommon "github.com/onflow/go-ethereum/common"
+	gethTypes "github.com/onflow/go-ethereum/core/types"
+	gethVM "github.com/onflow/go-ethereum/core/vm"
 )
 
 // StateDB acts as the main interface to the EVM runtime
@@ -13,18 +13,30 @@ type StateDB interface {
 	gethVM.StateDB
 
 	// Commit commits the changes
-	Commit() error
+	// setting `finalize` flag
+	// calls a subsequent call to Finalize
+	// defering finalization and calling it once at the end
+	// improves efficiency of batch operations.
+	Commit(finalize bool) error
+
+	// Finalize flushes all the changes
+	// to the permanent storage
+	Finalize() error
 
 	// Logs collects and prepares logs
 	Logs(
-		blockHash gethCommon.Hash,
 		blockNumber uint64,
 		txHash gethCommon.Hash,
 		txIndex uint,
 	) []*gethTypes.Log
 
-	// returns a map of preimages
+	// Preimages returns a map of preimages
 	Preimages() map[gethCommon.Hash][]byte
+
+	// Reset resets uncommitted changes and transient artifacts such as error, logs,
+	// preimages, access lists, ...
+	// The method is often called between execution of different transactions
+	Reset()
 }
 
 // ReadOnlyView provides a readonly view of the state
diff --git a/fvm/evm/types/tokenVault.go b/fvm/evm/types/tokenVault.go
index 8815382874d..77eb4a67f3e 100644
--- a/fvm/evm/types/tokenVault.go
+++ b/fvm/evm/types/tokenVault.go
@@ -1,5 +1,7 @@
 package types
 
+import "math/big"
+
 // FLOWTokenVault holds a balance of flow token
 type FLOWTokenVault struct {
 	balance Balance
@@ -13,11 +15,16 @@ func (t *FLOWTokenVault) Balance() Balance {
 	return t.balance
 }
 
-func (t *FLOWTokenVault) Withdraw(b Balance) *FLOWTokenVault {
-	t.balance = t.balance.Sub(b)
-	return NewFlowTokenVault(b)
+func (t *FLOWTokenVault) Withdraw(b Balance) (*FLOWTokenVault, error) {
+	var err error
+	t.balance, err = SubBalance(t.balance, b)
+	return NewFlowTokenVault(b), err
 }
 
-func (t *FLOWTokenVault) Deposit(inp *FLOWTokenVault) {
-	t.balance = t.balance.Add(inp.Balance())
+func (t *FLOWTokenVault) Deposit(inp *FLOWTokenVault) error {
+	var err error
+	t.balance, err = AddBalance(t.balance, inp.balance)
+	// reset balance for the inp incase
+	inp.balance = new(big.Int)
+	return err
 }
diff --git a/fvm/evm/types/tokenVault_test.go b/fvm/evm/types/tokenVault_test.go
new file mode 100644
index 00000000000..2dfefcf672b
--- /dev/null
+++ b/fvm/evm/types/tokenVault_test.go
@@ -0,0 +1,26 @@
+package types_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/fvm/evm/types"
+)
+
+func TestVault(t *testing.T) {
+
+	vault1 := types.NewFlowTokenVault(types.MakeABalanceInFlow(3))
+
+	vault2, err := vault1.Withdraw(types.OneFlowBalance)
+	require.NoError(t, err)
+
+	require.Equal(t, types.MakeABalanceInFlow(2), vault1.Balance())
+	require.Equal(t, types.OneFlowBalance, vault2.Balance())
+
+	toBeDeposited := types.NewFlowTokenVault(types.OneFlowBalance)
+	err = vault1.Deposit(toBeDeposited)
+	require.NoError(t, err)
+	require.Equal(t, types.MakeABalanceInFlow(3), vault1.Balance())
+	require.Equal(t, types.EmptyBalance, toBeDeposited.Balance())
+}
diff --git a/fvm/fvm_bench_test.go b/fvm/fvm_bench_test.go
index 619c86c19b8..4d8a798dcd0 100644
--- a/fvm/fvm_bench_test.go
+++ b/fvm/fvm_bench_test.go
@@ -34,6 +34,7 @@ import (
 	"github.com/onflow/flow-go/fvm"
 	"github.com/onflow/flow-go/fvm/environment"
 	"github.com/onflow/flow-go/fvm/evm/testutils"
+	"github.com/onflow/flow-go/fvm/evm/types"
 	reusableRuntime "github.com/onflow/flow-go/fvm/runtime"
 	"github.com/onflow/flow-go/fvm/storage/derived"
 	"github.com/onflow/flow-go/fvm/storage/snapshot"
@@ -475,7 +476,7 @@ func BenchmarkRuntimeTransaction(b *testing.B) {
 		tc := testutils.GetStorageTestContract(b)
 		var evmTestAccount *testutils.EOATestAccount
 		blockExecutor.RunWithLedger(b, func(ledger atree.Ledger) {
-			testutils.DeployContract(b, tc, ledger, chain.ServiceAddress())
+			testutils.DeployContract(b, types.EmptyAddress, tc, ledger, chain.ServiceAddress())
 			evmTestAccount = testutils.FundAndGetEOATestAccount(b, ledger, chain.ServiceAddress())
 		})
 
diff --git a/fvm/fvm_fuzz_test.go b/fvm/fvm_fuzz_test.go
index 41c1c201d31..18e66386ea6 100644
--- a/fvm/fvm_fuzz_test.go
+++ b/fvm/fvm_fuzz_test.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/onflow/flow-go/engine/execution/testutil"
 	"github.com/onflow/flow-go/fvm"
+	"github.com/onflow/flow-go/fvm/environment"
 	"github.com/onflow/flow-go/fvm/errors"
 	"github.com/onflow/flow-go/fvm/meter"
 	"github.com/onflow/flow-go/fvm/storage/snapshot"
@@ -256,7 +257,7 @@ func bootstrapFuzzStateAndTxContext(tb testing.TB) (bootstrappedVmTest, transact
 	bootstrappedVMTest, err := newVMTest().withBootstrapProcedureOptions(
 		fvm.WithTransactionFee(fvm.DefaultTransactionFees),
 		fvm.WithExecutionMemoryLimit(math.MaxUint32),
-		fvm.WithExecutionEffortWeights(mainnetExecutionEffortWeights),
+		fvm.WithExecutionEffortWeights(environment.MainnetExecutionEffortWeights),
 		fvm.WithExecutionMemoryWeights(meter.DefaultMemoryWeights),
 		fvm.WithMinimumStorageReservation(fvm.DefaultMinimumStorageReservation),
 		fvm.WithAccountCreationFee(fvm.DefaultAccountCreationFee),
diff --git a/fvm/fvm_test.go b/fvm/fvm_test.go
index 6fb975b7007..7fe79a3d033 100644
--- a/fvm/fvm_test.go
+++ b/fvm/fvm_test.go
@@ -8,6 +8,8 @@ import (
 	"strings"
 	"testing"
 
+	envMock "github.com/onflow/flow-go/fvm/environment/mock"
+
 	"github.com/onflow/cadence"
 	"github.com/onflow/cadence/encoding/ccf"
 	jsoncdc "github.com/onflow/cadence/encoding/json"
@@ -38,16 +40,6 @@ import (
 	"github.com/onflow/flow-go/utils/unittest"
 )
 
-// from 18.8.2022
-var mainnetExecutionEffortWeights = meter.ExecutionEffortWeights{
-	common.ComputationKindStatement:          1569,
-	common.ComputationKindLoop:               1569,
-	common.ComputationKindFunctionInvocation: 1569,
-	environment.ComputationKindGetValue:      808,
-	environment.ComputationKindCreateAccount: 2837670,
-	environment.ComputationKindSetValue:      765,
-}
-
 type vmTest struct {
 	bootstrapOptions []fvm.BootstrapProcedureOption
 	contextOptions   []fvm.Option
@@ -78,6 +70,7 @@ func (vmt vmTest) run(
 		baseOpts := []fvm.Option{
 			// default chain is Testnet
 			fvm.WithChain(flow.Testnet.Chain()),
+			fvm.WithEntropyProvider(testutil.EntropyProviderFixture(nil)),
 		}
 
 		opts := append(baseOpts, vmt.contextOptions...)
@@ -1045,7 +1038,7 @@ func TestTransactionFeeDeduction(t *testing.T) {
 		t.Run(fmt.Sprintf("Transaction Fees %d: %s", i, tc.name), newVMTest().withBootstrapProcedureOptions(
 			fvm.WithTransactionFee(fvm.DefaultTransactionFees),
 			fvm.WithExecutionMemoryLimit(math.MaxUint64),
-			fvm.WithExecutionEffortWeights(mainnetExecutionEffortWeights),
+			fvm.WithExecutionEffortWeights(environment.MainnetExecutionEffortWeights),
 			fvm.WithExecutionMemoryWeights(meter.DefaultMemoryWeights),
 		).withContextOptions(
 			fvm.WithTransactionFeesEnabled(true),
@@ -1062,7 +1055,7 @@ func TestTransactionFeeDeduction(t *testing.T) {
 			fvm.WithMinimumStorageReservation(fvm.DefaultMinimumStorageReservation),
 			fvm.WithAccountCreationFee(fvm.DefaultAccountCreationFee),
 			fvm.WithExecutionMemoryLimit(math.MaxUint64),
-			fvm.WithExecutionEffortWeights(mainnetExecutionEffortWeights),
+			fvm.WithExecutionEffortWeights(environment.MainnetExecutionEffortWeights),
 			fvm.WithExecutionMemoryWeights(meter.DefaultMemoryWeights),
 		).withContextOptions(
 			fvm.WithTransactionFeesEnabled(true),
@@ -1413,7 +1406,8 @@ func TestSettingExecutionWeights(t *testing.T) {
 	).run(
 		func(t *testing.T, vm fvm.VM, chain flow.Chain, ctx fvm.Context, snapshotTree snapshot.SnapshotTree) {
 			// Use the maximum amount of computation so that the transaction still passes.
-			loops := uint64(997)
+			loops := uint64(996)
+			executionEffortNeededToCheckStorage := uint64(1)
 			maxExecutionEffort := uint64(997)
 			txBody := flow.NewTransactionBody().
 				SetScript([]byte(fmt.Sprintf(`
@@ -1436,8 +1430,8 @@ func TestSettingExecutionWeights(t *testing.T) {
 
 			snapshotTree = snapshotTree.Append(executionSnapshot)
 
-			// expected used is number of loops.
-			require.Equal(t, loops, output.ComputationUsed)
+			// expected computation used is number of loops + 1 (from the storage limit check).
+			require.Equal(t, loops+executionEffortNeededToCheckStorage, output.ComputationUsed)
 
 			// increasing the number of loops should fail the transaction.
 			loops = loops + 1
@@ -1460,8 +1454,8 @@ func TestSettingExecutionWeights(t *testing.T) {
 			require.NoError(t, err)
 
 			require.ErrorContains(t, output.Err, "computation exceeds limit (997)")
-			// computation used should the actual computation used.
-			require.Equal(t, loops, output.ComputationUsed)
+			// expected computation used is still number of loops + 1 (from the storage limit check).
+			require.Equal(t, loops+executionEffortNeededToCheckStorage, output.ComputationUsed)
 
 			for _, event := range output.Events {
 				// the fee deduction event should only contain the max gas worth of execution effort.
@@ -1486,6 +1480,117 @@ func TestSettingExecutionWeights(t *testing.T) {
 			unittest.EnsureEventsIndexSeq(t, output.Events, chain.ChainID())
 		},
 	))
+
+	t.Run("transaction with more accounts touched uses more computation", newVMTest().withBootstrapProcedureOptions(
+		fvm.WithMinimumStorageReservation(fvm.DefaultMinimumStorageReservation),
+		fvm.WithAccountCreationFee(fvm.DefaultAccountCreationFee),
+		fvm.WithStorageMBPerFLOW(fvm.DefaultStorageMBPerFLOW),
+		fvm.WithTransactionFee(fvm.DefaultTransactionFees),
+		fvm.WithExecutionEffortWeights(
+			meter.ExecutionEffortWeights{
+				common.ComputationKindStatement: 0,
+				// only count loops
+				// the storage check has a loop
+				common.ComputationKindLoop:               1 << meter.MeterExecutionInternalPrecisionBytes,
+				common.ComputationKindFunctionInvocation: 0,
+			},
+		),
+	).withContextOptions(
+		fvm.WithAccountStorageLimit(true),
+		fvm.WithTransactionFeesEnabled(true),
+		fvm.WithMemoryLimit(math.MaxUint64),
+	).run(
+		func(t *testing.T, vm fvm.VM, chain flow.Chain, ctx fvm.Context, snapshotTree snapshot.SnapshotTree) {
+			// Create an account private key.
+			privateKeys, err := testutil.GenerateAccountPrivateKeys(5)
+			require.NoError(t, err)
+
+			// Bootstrap a ledger, creating accounts with the provided
+			// private keys and the root account.
+			snapshotTree, accounts, err := testutil.CreateAccounts(
+				vm,
+				snapshotTree,
+				privateKeys,
+				chain)
+			require.NoError(t, err)
+
+			sc := systemcontracts.SystemContractsForChain(chain.ChainID())
+
+			// create a transaction without loops so only the looping in the storage check is counted.
+			txBody := flow.NewTransactionBody().
+				SetScript([]byte(fmt.Sprintf(`
+					import FungibleToken from 0x%s
+					import FlowToken from 0x%s
+	
+					transaction() {
+						let sentVault: @FungibleToken.Vault
+	
+						prepare(signer: AuthAccount) {
+							let vaultRef = signer.borrow<&FlowToken.Vault>(from: /storage/flowTokenVault)
+								?? panic("Could not borrow reference to the owner's Vault!")
+	
+							self.sentVault <- vaultRef.withdraw(amount: 5.0)
+						}
+	
+						execute {
+							let recipient1 = getAccount(%s)
+							let recipient2 = getAccount(%s)
+							let recipient3 = getAccount(%s)
+							let recipient4 = getAccount(%s)
+							let recipient5 = getAccount(%s)
+	
+							let receiverRef1 = recipient1.getCapability(/public/flowTokenReceiver)
+								.borrow<&{FungibleToken.Receiver}>()
+								?? panic("Could not borrow receiver reference to the recipient's Vault")
+							let receiverRef2 = recipient2.getCapability(/public/flowTokenReceiver)
+								.borrow<&{FungibleToken.Receiver}>()
+								?? panic("Could not borrow receiver reference to the recipient's Vault")
+							let receiverRef3 = recipient3.getCapability(/public/flowTokenReceiver)
+								.borrow<&{FungibleToken.Receiver}>()
+								?? panic("Could not borrow receiver reference to the recipient's Vault")
+							let receiverRef4 = recipient4.getCapability(/public/flowTokenReceiver)
+								.borrow<&{FungibleToken.Receiver}>()
+								?? panic("Could not borrow receiver reference to the recipient's Vault")
+							let receiverRef5 = recipient5.getCapability(/public/flowTokenReceiver)
+								.borrow<&{FungibleToken.Receiver}>()
+								?? panic("Could not borrow receiver reference to the recipient's Vault")
+	
+							receiverRef1.deposit(from: <-self.sentVault.withdraw(amount: 1.0))
+							receiverRef2.deposit(from: <-self.sentVault.withdraw(amount: 1.0))
+							receiverRef3.deposit(from: <-self.sentVault.withdraw(amount: 1.0))
+							receiverRef4.deposit(from: <-self.sentVault.withdraw(amount: 1.0))
+							receiverRef5.deposit(from: <-self.sentVault.withdraw(amount: 1.0))
+
+							destroy self.sentVault
+						}
+					}`,
+					sc.FungibleToken.Address,
+					sc.FlowToken.Address,
+					accounts[0].HexWithPrefix(),
+					accounts[1].HexWithPrefix(),
+					accounts[2].HexWithPrefix(),
+					accounts[3].HexWithPrefix(),
+					accounts[4].HexWithPrefix(),
+				))).
+				SetProposalKey(chain.ServiceAddress(), 0, 0).
+				AddAuthorizer(chain.ServiceAddress()).
+				SetPayer(chain.ServiceAddress())
+
+			err = testutil.SignTransactionAsServiceAccount(txBody, 0, chain)
+			require.NoError(t, err)
+
+			_, output, err := vm.Run(
+				ctx,
+				fvm.Transaction(txBody, 0),
+				snapshotTree)
+			require.NoError(t, err)
+			require.NoError(t, output.Err)
+
+			// The storage check should loop once for each of the five accounts created +
+			// once for the service account
+			require.Equal(t, uint64(5+1), output.ComputationUsed)
+		},
+	))
 }
 
 func TestStorageUsed(t *testing.T) {
@@ -2958,12 +3063,24 @@ func TestTransientNetworkCoreContractAddresses(t *testing.T) {
 }
 
 func TestEVM(t *testing.T) {
+	blocks := new(envMock.Blocks)
+	block1 := unittest.BlockFixture()
+	blocks.On("ByHeightFrom",
+		block1.Header.Height,
+		block1.Header,
+	).Return(block1.Header, nil)
+
+	ctxOpts := []fvm.Option{
+		fvm.WithChain(flow.Emulator.Chain()),
+		fvm.WithEVMEnabled(true),
+		fvm.WithBlocks(blocks),
+		fvm.WithBlockHeader(block1.Header),
+		fvm.WithCadenceLogging(true),
+	}
+
 	t.Run("successful transaction", newVMTest().
 		withBootstrapProcedureOptions(fvm.WithSetupEVMEnabled(true)).
-		withContextOptions(
-			fvm.WithEVMEnabled(true),
-			fvm.WithCadenceLogging(true),
-		).
+		withContextOptions(ctxOpts...).
 		run(func(
 			t *testing.T,
 			vm fvm.VM,
@@ -3016,63 +3133,10 @@ func TestEVM(t *testing.T) {
 		}),
 	)
 
-	// this test makes sure that only ABI encoding/decoding functionality is
-	// available through the EVM contract, when bootstraped with `WithEVMABIOnly`
-	t.Run("with ABI only EVM", newVMTest().
-		withBootstrapProcedureOptions(
-			fvm.WithSetupEVMEnabled(true),
-			fvm.WithEVMABIOnly(true),
-		).
-		withContextOptions(
-			fvm.WithEVMEnabled(true),
-		).
-		run(func(
-			t *testing.T,
-			vm fvm.VM,
-			chain flow.Chain,
-			ctx fvm.Context,
-			snapshotTree snapshot.SnapshotTree,
-		) {
-			txBody := flow.NewTransactionBody().
-				SetScript([]byte(fmt.Sprintf(`
-						import EVM from %s
-
-						transaction {
-							execute {
-								let data = EVM.encodeABI(["John Doe", UInt64(33), false])
-								log(data.length)
-								assert(data.length == 160)
-
-								let acc <- EVM.createBridgedAccount()
-								destroy acc
-							}
-						}
-					`, chain.ServiceAddress().HexWithPrefix()))).
-				SetProposalKey(chain.ServiceAddress(), 0, 0).
-				SetPayer(chain.ServiceAddress())
-
-			err := testutil.SignTransactionAsServiceAccount(txBody, 0, chain)
-			require.NoError(t, err)
-
-			_, output, err := vm.Run(
-				ctx,
-				fvm.Transaction(txBody, 0),
-				snapshotTree)
-
-			require.NoError(t, err)
-			require.Error(t, output.Err)
-			assert.ErrorContains(
-				t,
-				output.Err,
-				"value of type `EVM` has no member `createBridgedAccount`",
-			)
-		}),
-	)
-
 	// this test makes sure the execution error is correctly handled and returned as a correct type
 	t.Run("execution reverted", newVMTest().
 		withBootstrapProcedureOptions(fvm.WithSetupEVMEnabled(true)).
-		withContextOptions(fvm.WithEVMEnabled(true)).
+		withContextOptions(ctxOpts...).
 		run(func(
 			t *testing.T,
 			vm fvm.VM,
@@ -3085,8 +3149,8 @@ func TestEVM(t *testing.T) {
 				import EVM from %s
 				
 				pub fun main() {
-					let bal = EVM.Balance(flow: 1.0);
-					let acc <- EVM.createBridgedAccount();
+					let bal = EVM.Balance(attoflow: 1000000000000000000);
+					let acc <- EVM.createCadenceOwnedAccount();
 					// withdraw insufficient balance
 					destroy acc.withdraw(balance: bal);
 					destroy acc;
@@ -3109,7 +3173,7 @@ func TestEVM(t *testing.T) {
 	// we have implemented a snapshot wrapper to return an error from the EVM
 	t.Run("internal evm error handling", newVMTest().
 		withBootstrapProcedureOptions(fvm.WithSetupEVMEnabled(true)).
-		withContextOptions(fvm.WithEVMEnabled(true)).
+		withContextOptions(ctxOpts...).
 		run(func(
 			t *testing.T,
 			vm fvm.VM,
@@ -3137,7 +3201,7 @@ func TestEVM(t *testing.T) {
 				errStorage.
 					On("Get", mockery.AnythingOfType("flow.RegisterID")).
 					Return(func(id flow.RegisterID) (flow.RegisterValue, error) {
-						if id.Key == "AddressAllocator" {
+						if id.Key == "LatestBlock" {
 							return nil, e.err
 						}
 						return snapshotTree.Get(id)
@@ -3147,7 +3211,7 @@ func TestEVM(t *testing.T) {
 					import EVM from %s
 					
 					pub fun main() {
-						destroy <- EVM.createBridgedAccount();
+						destroy <- EVM.createCadenceOwnedAccount();
 					}
 				`, sc.EVMContract.Address.HexWithPrefix())))
 
@@ -3162,7 +3226,17 @@ func TestEVM(t *testing.T) {
 	)
 
 	t.Run("deploy contract code", newVMTest().
-		withBootstrapProcedureOptions(fvm.WithSetupEVMEnabled(true)).
+		withBootstrapProcedureOptions(
+			fvm.WithSetupEVMEnabled(true),
+		).
+		withContextOptions(
+			// default is testnet, but testnet has a special EVM storage contract location
+			// so we have to use emulator here so that the EVM storage contract is deployed
+			// to the 5th address
+			fvm.WithChain(flow.Emulator.Chain()),
+			fvm.WithBlocks(blocks),
+			fvm.WithBlockHeader(block1.Header),
+		).
 		run(func(
 			t *testing.T,
 			vm fvm.VM,
@@ -3183,7 +3257,7 @@ func TestEVM(t *testing.T) {
 							let vaultRef = acc.borrow<&{FungibleToken.Provider}>(from: /storage/flowTokenVault)
 							?? panic("Could not borrow reference to the owner's Vault!")
 
-							let acc <- EVM.createBridgedAccount()
+							let acc <- EVM.createCadenceOwnedAccount()
 							let amount <- vaultRef.withdraw(amount: 0.0000001) as! @FlowToken.Vault
 							acc.deposit(from: <- amount)
 							destroy acc
@@ -3208,10 +3282,10 @@ func TestEVM(t *testing.T) {
 
 			require.NoError(t, err)
 			require.NoError(t, output.Err)
-			require.Len(t, output.Events, 3)
+			require.Len(t, output.Events, 7)
 
 			evmLocation := types.EVMLocation{}
-			txExe, blockExe := output.Events[1], output.Events[2]
+			txExe, blockExe := output.Events[4], output.Events[5]
 			assert.Equal(t, evmLocation.TypeID(nil, string(types.EventTypeTransactionExecuted)), common.TypeID(txExe.Type))
 			assert.Equal(t, evmLocation.TypeID(nil, string(types.EventTypeBlockExecuted)), common.TypeID(blockExe.Type))
 		}),
diff --git a/fvm/meter/computation_meter.go b/fvm/meter/computation_meter.go
index a921c005dfc..4966650d748 100644
--- a/fvm/meter/computation_meter.go
+++ b/fvm/meter/computation_meter.go
@@ -29,6 +29,15 @@ const MeterExecutionInternalPrecisionBytes = 16
 
 type ExecutionEffortWeights map[common.ComputationKind]uint64
 
+func (weights ExecutionEffortWeights) ComputationFromIntensities(intensities MeteredComputationIntensities) uint64 {
+	var result uint64
+	for kind, weight := range weights {
+		intensity := uint64(intensities[kind])
+		result += weight * intensity
+	}
+	return result >> MeterExecutionInternalPrecisionBytes
+}
+
 type ComputationMeterParameters struct {
 	computationLimit   uint64
 	computationWeights ExecutionEffortWeights
diff --git a/fvm/script.go b/fvm/script.go
index c310c73ba00..28067cfc1bd 100644
--- a/fvm/script.go
+++ b/fvm/script.go
@@ -207,7 +207,6 @@ func (executor *scriptExecutor) executeScript() error {
 			chain.ChainID(),
 			executor.env,
 			rt.ScriptRuntimeEnv,
-			chain.ServiceAddress(),
 			sc.FlowToken.Address,
 		)
 		if err != nil {
diff --git a/fvm/systemcontracts/system_contracts.go b/fvm/systemcontracts/system_contracts.go
index d3af00c629c..a0c3a39848d 100644
--- a/fvm/systemcontracts/system_contracts.go
+++ b/fvm/systemcontracts/system_contracts.go
@@ -82,6 +82,11 @@ var (
 	nftTokenAddressMainnet = flow.HexToAddress("1d7e57aa55817448")
 	// nftTokenAddressTestnet is the address of the NonFungibleToken contract on Testnet
 	nftTokenAddressTestnet = flow.HexToAddress("631e88ae7f1d7c20")
+
+	// evmStorageAddressTestnet is the address of the EVM state storage contract on Testnet
+	evmStorageAddressTestnet = flow.HexToAddress("1a54ed2be7552821")
+	// evmStorageAddressMainnet is the address of the EVM state storage contract on Mainnet
+	evmStorageAddressMainnet = flow.HexToAddress("d421a63faae318f9")
 )
 
 // SystemContract represents a system contract on a particular chain.
@@ -284,6 +289,17 @@ func init() {
 		}
 	}
 
+	evmStorageEVMFunc := func(chain flow.ChainID) flow.Address {
+		switch chain {
+		case flow.Mainnet:
+			return evmStorageAddressMainnet
+		case flow.Testnet:
+			return evmStorageAddressTestnet
+		default:
+			return nthAddressFunc(EVMStorageAccountIndex)(chain)
+		}
+	}
+
 	contractAddressFunc = map[string]func(id flow.ChainID) flow.Address{
 		ContractNameIDTableStaking: epochAddressFunc,
 		ContractNameEpoch:          epochAddressFunc,
@@ -304,7 +320,7 @@ func init() {
 		ContractNameViewResolver:     nftTokenAddressFunc,
 
 		ContractNameEVM:       serviceAddressFunc,
-		AccountNameEVMStorage: nthAddressFunc(EVMStorageAccountIndex),
+		AccountNameEVMStorage: evmStorageEVMFunc,
 	}
 
 	getSystemContractsForChain := func(chainID flow.ChainID) *SystemContracts {
diff --git a/fvm/transactionInvoker.go b/fvm/transactionInvoker.go
index 57c0c449cbf..5e05b9016d3 100644
--- a/fvm/transactionInvoker.go
+++ b/fvm/transactionInvoker.go
@@ -190,7 +190,6 @@ func (executor *transactionExecutor) preprocessTransactionBody() error {
 			chain.ChainID(),
 			executor.env,
 			executor.cadenceRuntime.TxRuntimeEnv,
-			chain.ServiceAddress(),
 			sc.FlowToken.Address,
 		)
 		if err != nil {
@@ -250,7 +249,6 @@ func (executor *transactionExecutor) ExecuteTransactionBody() error {
 			chain.ChainID(),
 			executor.env,
 			executor.cadenceRuntime.TxRuntimeEnv,
-			chain.ServiceAddress(),
 			sc.FlowToken.Address,
 		)
 		if err != nil {
@@ -397,21 +395,16 @@ func (executor *transactionExecutor) normalExecution() (
 
 	// Check if all account storage limits are ok
 	//
-	// disable the computation/memory limit checks on storage checks,
-	// so we don't error from computation/memory limits on this part.
-	//
 	// The storage limit check is performed for all accounts that were touched during the transaction.
 	// The storage capacity of an account depends on its balance and should be higher than the accounts storage used.
 	// The payer account is special cased in this check and its balance is considered max_fees lower than its
 	// actual balance, for the purpose of calculating storage capacity, because the payer will have to pay for this tx.
-	executor.txnState.RunWithAllLimitsDisabled(func() {
-		err = executor.CheckStorageLimits(
-			executor.ctx,
-			executor.env,
-			bodySnapshot,
-			executor.proc.Transaction.Payer,
-			maxTxFees)
-	})
+	err = executor.CheckStorageLimits(
+		executor.ctx,
+		executor.env,
+		bodySnapshot,
+		executor.proc.Transaction.Payer,
+		maxTxFees)
 
 	if err != nil {
 		return
diff --git a/fvm/transactionPayerBalanceChecker_test.go b/fvm/transactionPayerBalanceChecker_test.go
index 931f2984bd1..99bf19354a6 100644
--- a/fvm/transactionPayerBalanceChecker_test.go
+++ b/fvm/transactionPayerBalanceChecker_test.go
@@ -52,7 +52,7 @@ func TestTransactionPayerBalanceChecker(t *testing.T) {
 		d := fvm.TransactionPayerBalanceChecker{}
 		maxFees, err := d.CheckPayerBalanceAndReturnMaxFees(proc, txnState, env)
 		require.Error(t, err)
-		require.True(t, errors.HasErrorCode(err, errors.FailureCodePayerBalanceCheckFailure))
+		require.True(t, errors.HasFailureCode(err, errors.FailureCodePayerBalanceCheckFailure))
 		require.ErrorIs(t, err, someError)
 		require.Equal(t, uint64(0), maxFees)
 	})
@@ -73,7 +73,7 @@ func TestTransactionPayerBalanceChecker(t *testing.T) {
 		d := fvm.TransactionPayerBalanceChecker{}
 		maxFees, err := d.CheckPayerBalanceAndReturnMaxFees(proc, txnState, env)
 		require.Error(t, err)
-		require.True(t, errors.HasErrorCode(err, errors.FailureCodePayerBalanceCheckFailure))
+		require.True(t, errors.HasFailureCode(err, errors.FailureCodePayerBalanceCheckFailure))
 		require.Equal(t, uint64(0), maxFees)
 	})
 
diff --git a/go.mod b/go.mod
index 964a9ac2761..8ddab239286 100644
--- a/go.mod
+++ b/go.mod
@@ -14,111 +14,113 @@ require (
 	github.com/davecgh/go-spew v1.1.1
 	github.com/dgraph-io/badger/v2 v2.2007.4
 	github.com/ef-ds/deque v1.0.4
-	github.com/ethereum/go-ethereum v1.13.5
+	github.com/ethereum/go-ethereum v1.13.10
 	github.com/fxamacker/cbor/v2 v2.4.1-0.20230228173756-c0c9f774e40c
 	github.com/gammazero/workerpool v1.1.2
 	github.com/gogo/protobuf v1.3.2
 	github.com/golang/mock v1.6.0
 	github.com/golang/protobuf v1.5.3
 	github.com/google/go-cmp v0.6.0
-	github.com/google/pprof v0.0.0-20230602150820-91b7bce49751
-	github.com/google/uuid v1.4.0
-	github.com/gorilla/mux v1.8.0
+	github.com/google/pprof v0.0.0-20231229205709-960ae82b1e42
+	github.com/google/uuid v1.6.0
+	github.com/gorilla/mux v1.8.1
 	github.com/grpc-ecosystem/go-grpc-middleware/providers/zerolog/v2 v2.0.0-rc.2
-	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.0-20200501113911-9a95f0fdbfea
+	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.0-rc.2
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0
 	github.com/hashicorp/go-multierror v1.1.1
-	github.com/hashicorp/golang-lru v0.5.4
+	github.com/hashicorp/golang-lru v1.0.2
 	github.com/improbable-eng/grpc-web v0.15.0
-	github.com/ipfs/go-block-format v0.1.2
+	github.com/ipfs/go-block-format v0.2.0
 	github.com/ipfs/go-blockservice v0.4.0
 	github.com/ipfs/go-cid v0.4.1
 	github.com/ipfs/go-datastore v0.6.0
 	github.com/ipfs/go-ds-badger2 v0.1.3
 	github.com/ipfs/go-ipfs-blockstore v1.3.0
 	github.com/ipfs/go-ipfs-provider v0.7.0
-	github.com/ipfs/go-ipld-format v0.5.0
+	github.com/ipfs/go-ipld-format v0.6.0
 	github.com/ipfs/go-log v1.0.5
 	github.com/ipfs/go-log/v2 v2.5.1
 	github.com/libp2p/go-addr-util v0.1.0
-	github.com/libp2p/go-libp2p v0.28.1
-	github.com/libp2p/go-libp2p-kad-dht v0.24.2
+	github.com/libp2p/go-libp2p v0.32.2
+	github.com/libp2p/go-libp2p-kad-dht v0.25.2
 	github.com/libp2p/go-libp2p-kbucket v0.6.3
-	github.com/libp2p/go-libp2p-pubsub v0.9.3
+	github.com/libp2p/go-libp2p-pubsub v0.10.0
 	github.com/montanaflynn/stats v0.6.6
-	github.com/multiformats/go-multiaddr v0.9.0
+	github.com/multiformats/go-multiaddr v0.12.2
 	github.com/multiformats/go-multiaddr-dns v0.3.1
 	github.com/multiformats/go-multihash v0.2.3
 	github.com/onflow/atree v0.6.0
-	github.com/onflow/cadence v0.42.7
-	github.com/onflow/crypto v0.25.0
+	github.com/onflow/cadence v0.42.10
+	github.com/onflow/crypto v0.25.1
 	github.com/onflow/flow v0.3.4
-	github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1-0.20231219201108-fbdb10b0a2da
-	github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1-0.20231219201108-fbdb10b0a2da
+	github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1
+	github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1
 	github.com/onflow/flow-go-sdk v0.44.0
-	github.com/onflow/flow/protobuf/go/flow v0.3.2-0.20231213135419-ae911cc351a2
-	github.com/onflow/go-bitswap v0.0.0-20230703214630-6d3db958c73d
+	github.com/onflow/flow/protobuf/go/flow v0.3.7-0.20240404170900-c321c1475f1e
 	github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58
 	github.com/pierrec/lz4 v2.6.1+incompatible
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/profile v1.7.0
-	github.com/prometheus/client_golang v1.14.0
+	github.com/prometheus/client_golang v1.18.0
 	github.com/rs/cors v1.8.0
 	github.com/rs/zerolog v1.29.0
 	github.com/schollz/progressbar/v3 v3.13.1
 	github.com/sethvargo/go-retry v0.2.3
 	github.com/shirou/gopsutil/v3 v3.22.2
-	github.com/spf13/cobra v1.6.1
+	github.com/spf13/cobra v1.8.0
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.15.0
 	github.com/stretchr/testify v1.8.4
 	github.com/vmihailenco/msgpack v4.0.4+incompatible
 	github.com/vmihailenco/msgpack/v4 v4.3.11
-	go.opentelemetry.io/otel v1.16.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0
-	go.opentelemetry.io/otel/sdk v1.16.0
-	go.opentelemetry.io/otel/trace v1.16.0
+	go.opentelemetry.io/otel v1.22.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0
+	go.opentelemetry.io/otel/sdk v1.21.0
+	go.opentelemetry.io/otel/trace v1.22.0
 	go.uber.org/atomic v1.11.0
 	go.uber.org/multierr v1.11.0
-	golang.org/x/crypto v0.17.0
-	golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611
-	golang.org/x/sync v0.5.0
-	golang.org/x/sys v0.15.0
+	golang.org/x/crypto v0.18.0
+	golang.org/x/exp v0.0.0-20240119083558-1b970713d09a
+	golang.org/x/sync v0.6.0
+	golang.org/x/sys v0.16.0
 	golang.org/x/text v0.14.0
 	golang.org/x/time v0.3.0
-	golang.org/x/tools v0.16.0
+	golang.org/x/tools v0.17.0
 	google.golang.org/api v0.151.0
-	google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b
-	google.golang.org/grpc v1.59.0
+	google.golang.org/genproto v0.0.0-20240102182953-50ed04b92917
+	google.golang.org/grpc v1.60.1
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0
-	google.golang.org/protobuf v1.31.0
+	google.golang.org/protobuf v1.32.0
 	gotest.tools v2.2.0+incompatible
-	pgregory.net/rapid v0.4.7
+	pgregory.net/rapid v1.1.0
 )
 
 require (
 	github.com/cockroachdb/pebble v0.0.0-20230928194634-aa077af62593
 	github.com/coreos/go-semver v0.3.0
+	github.com/docker/go-units v0.5.0
 	github.com/go-playground/validator/v10 v10.14.1
 	github.com/golang/snappy v0.0.5-0.20220116011046-fa5810519dcb
 	github.com/gorilla/websocket v1.5.0
-	github.com/hashicorp/golang-lru/v2 v2.0.2
+	github.com/hashicorp/golang-lru/v2 v2.0.7
+	github.com/ipfs/boxo v0.17.0
 	github.com/mitchellh/mapstructure v1.5.0
 	github.com/onflow/flow-ft/lib/go/contracts v0.7.1-0.20230711213910-baad011d2b13
 	github.com/onflow/flow-nft/lib/go/contracts v1.1.0
-	github.com/onflow/wal v0.0.0-20230529184820-bc9f8244608d
+	github.com/onflow/go-ethereum v1.13.4
+	github.com/onflow/wal v0.0.0-20240208022732-d756cd497d3b
 	github.com/slok/go-http-metrics v0.10.0
 	github.com/sony/gobreaker v0.5.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b
+	google.golang.org/genproto/googleapis/api v0.0.0-20240108191215-35c7eff3a6b1
 	google.golang.org/genproto/googleapis/bytestream v0.0.0-20231030173426-d783a09b4405
 	gopkg.in/yaml.v2 v2.4.0
 )
 
 require (
-	cloud.google.com/go v0.110.8 // indirect
-	cloud.google.com/go/compute v1.23.1 // indirect
-	cloud.google.com/go/iam v1.1.3 // indirect
+	cloud.google.com/go v0.111.0 // indirect
+	cloud.google.com/go/compute v1.23.3 // indirect
+	cloud.google.com/go/iam v1.1.5 // indirect
 	github.com/DataDog/zstd v1.5.2 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/StackExchange/wmi v1.2.1 // indirect
@@ -138,7 +140,7 @@ require (
 	github.com/aws/smithy-go v1.17.0 // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bits-and-blooms/bitset v1.7.0 // indirect
+	github.com/bits-and-blooms/bitset v1.10.0 // indirect
 	github.com/btcsuite/btcd/chaincfg/chainhash v1.0.2 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
@@ -158,25 +160,23 @@ require (
 	github.com/deckarep/golang-set/v2 v2.1.0 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
 	github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f // indirect
-	github.com/dgraph-io/ristretto v0.0.3-0.20200630154024-f66de99634de // indirect
+	github.com/dgraph-io/ristretto v0.1.0 // indirect
 	github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2 // indirect
-	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/elastic/gosigar v0.14.2 // indirect
 	github.com/ethereum/c-kzg-4844 v0.4.0 // indirect
 	github.com/felixge/fgprof v0.9.3 // indirect
-	github.com/flynn/noise v1.0.0 // indirect
+	github.com/flynn/noise v1.0.1 // indirect
 	github.com/francoispqt/gojay v1.2.13 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/fxamacker/circlehash v0.3.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
 	github.com/gammazero/deque v0.1.0 // indirect
 	github.com/getsentry/sentry-go v0.18.0 // indirect
-	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-kit/kit v0.12.0 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
-	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
@@ -194,11 +194,10 @@ require (
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/holiman/bloomfilter/v2 v2.0.3 // indirect
-	github.com/holiman/uint256 v1.2.3 // indirect
+	github.com/holiman/uint256 v1.2.4 // indirect
 	github.com/huin/goupnp v1.3.0 // indirect
-	github.com/inconshreveable/mousetrap v1.0.1 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
-	github.com/ipfs/boxo v0.10.0 // indirect
 	github.com/ipfs/go-bitswap v0.9.0 // indirect
 	github.com/ipfs/go-cidutil v0.1.0 // indirect
 	github.com/ipfs/go-fetcher v1.5.0 // indirect
@@ -206,19 +205,19 @@ require (
 	github.com/ipfs/go-ipfs-ds-help v1.1.0 // indirect
 	github.com/ipfs/go-ipfs-exchange-interface v0.2.0 // indirect
 	github.com/ipfs/go-ipfs-pq v0.0.3 // indirect
-	github.com/ipfs/go-ipfs-util v0.0.2 // indirect
+	github.com/ipfs/go-ipfs-util v0.0.3 // indirect
 	github.com/ipfs/go-metrics-interface v0.0.1 // indirect
 	github.com/ipfs/go-peertaskqueue v0.8.1 // indirect
 	github.com/ipfs/go-verifcid v0.0.1 // indirect
-	github.com/ipld/go-ipld-prime v0.20.0 // indirect
+	github.com/ipld/go-ipld-prime v0.21.0 // indirect
 	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
 	github.com/jbenet/go-temp-err-catcher v0.1.0 // indirect
 	github.com/jbenet/goprocess v0.1.4 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/k0kubun/pp/v3 v3.2.0 // indirect
 	github.com/kevinburke/go-bindata v3.23.0+incompatible // indirect
-	github.com/klauspost/compress v1.16.5 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.5 // indirect
+	github.com/klauspost/compress v1.17.4 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.6 // indirect
 	github.com/koron/go-ssdp v0.0.4 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
@@ -226,23 +225,24 @@ require (
 	github.com/libp2p/go-buffer-pool v0.1.0 // indirect
 	github.com/libp2p/go-cidranger v1.1.0 // indirect
 	github.com/libp2p/go-flow-metrics v0.1.0 // indirect
-	github.com/libp2p/go-libp2p-asn-util v0.3.0 // indirect
+	github.com/libp2p/go-libp2p-asn-util v0.4.1 // indirect
 	github.com/libp2p/go-libp2p-core v0.20.1 // indirect
 	github.com/libp2p/go-libp2p-record v0.2.0 // indirect
+	github.com/libp2p/go-libp2p-routing-helpers v0.7.3 // indirect
 	github.com/libp2p/go-msgio v0.3.0 // indirect
 	github.com/libp2p/go-nat v0.2.0 // indirect
 	github.com/libp2p/go-netroute v0.2.1 // indirect
-	github.com/libp2p/go-reuseport v0.3.0 // indirect
-	github.com/libp2p/go-yamux/v4 v4.0.0 // indirect
+	github.com/libp2p/go-reuseport v0.4.0 // indirect
+	github.com/libp2p/go-yamux/v4 v4.0.1 // indirect
 	github.com/logrusorgru/aurora/v4 v4.0.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/marten-seemann/tcp v0.0.0-20210406111302-dfbc87cc63fd // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19 // indirect
-	github.com/mattn/go-runewidth v0.0.14 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/miekg/dns v1.1.54 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
+	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
+	github.com/miekg/dns v1.1.57 // indirect
 	github.com/mikioh/tcpinfo v0.0.0-20190314235526-30a79bb1804b // indirect
 	github.com/mikioh/tcpopt v0.0.0-20190314235656-172688c1accc // indirect
 	github.com/minio/sha256-simd v1.0.1 // indirect
@@ -254,29 +254,29 @@ require (
 	github.com/multiformats/go-multiaddr-fmt v0.1.0 // indirect
 	github.com/multiformats/go-multibase v0.2.0 // indirect
 	github.com/multiformats/go-multicodec v0.9.0 // indirect
-	github.com/multiformats/go-multistream v0.4.1 // indirect
+	github.com/multiformats/go-multistream v0.5.0 // indirect
 	github.com/multiformats/go-varint v0.0.7 // indirect
+	github.com/nxadm/tail v1.4.8 // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
 	github.com/onflow/sdks v0.5.0 // indirect
-	github.com/onsi/ginkgo/v2 v2.9.7 // indirect
-	github.com/opencontainers/runtime-spec v1.0.2 // indirect
+	github.com/onsi/ginkgo/v2 v2.13.2 // indirect
+	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.6 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/polydawn/refmt v0.89.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
-	github.com/prometheus/client_model v0.4.0 // indirect
-	github.com/prometheus/common v0.42.0 // indirect
-	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
+	github.com/prometheus/common v0.45.0 // indirect
+	github.com/prometheus/procfs v0.12.0 // indirect
 	github.com/psiemens/sconfig v0.1.0 // indirect
 	github.com/quic-go/qpack v0.4.0 // indirect
-	github.com/quic-go/qtls-go1-19 v0.3.2 // indirect
-	github.com/quic-go/qtls-go1-20 v0.2.2 // indirect
-	github.com/quic-go/quic-go v0.33.0 // indirect
-	github.com/quic-go/webtransport-go v0.5.3 // indirect
+	github.com/quic-go/qtls-go1-20 v0.4.1 // indirect
+	github.com/quic-go/quic-go v0.40.1 // indirect
+	github.com/quic-go/webtransport-go v0.6.0 // indirect
 	github.com/raulk/go-watchdog v1.3.0 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
-	github.com/rogpeppe/go-internal v1.9.0 // indirect
+	github.com/rogpeppe/go-internal v1.10.0 // indirect
 	github.com/shirou/gopsutil v3.21.4-0.20210419000835-c7a38de76ee5+incompatible // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/spf13/afero v1.10.0 // indirect
@@ -296,24 +296,27 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.2 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0 // indirect
-	go.opentelemetry.io/otel/metric v1.16.0 // indirect
-	go.opentelemetry.io/proto/otlp v0.19.0 // indirect
-	go.uber.org/dig v1.17.0 // indirect
-	go.uber.org/fx v1.19.2 // indirect
-	go.uber.org/zap v1.24.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.22.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
+	go.uber.org/dig v1.17.1 // indirect
+	go.uber.org/fx v1.20.1 // indirect
+	go.uber.org/mock v0.4.0 // indirect
+	go.uber.org/zap v1.26.0 // indirect
 	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/net v0.19.0 // indirect
-	golang.org/x/oauth2 v0.13.0 // indirect
-	golang.org/x/term v0.15.0 // indirect
-	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	gonum.org/v1/gonum v0.13.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405 // indirect
+	golang.org/x/net v0.20.0 // indirect
+	golang.org/x/oauth2 v0.16.0 // indirect
+	golang.org/x/term v0.16.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
+	gonum.org/v1/gonum v0.14.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240108191215-35c7eff3a6b1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	lukechampine.com/blake3 v1.2.1 // indirect
 	nhooyr.io/websocket v1.8.7 // indirect
 	rsc.io/tmplfunc v0.0.3 // indirect
 )
+
+// Using custom fork until https://github.com/onflow/flow-go/issues/5338 is resolved
+replace github.com/ipfs/boxo => github.com/onflow/boxo v0.0.0-20240201202436-f2477b92f483
diff --git a/go.sum b/go.sum
index d416631722f..e38d2ea2a20 100644
--- a/go.sum
+++ b/go.sum
@@ -31,8 +31,8 @@ cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW
 cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
 cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
 cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
-cloud.google.com/go v0.110.8 h1:tyNdfIxjzaWctIiLYOTalaLKZ17SI44SKFW26QbOhME=
-cloud.google.com/go v0.110.8/go.mod h1:Iz8AkXJf1qmxC3Oxoep8R1T36w8B92yU29PcBhHO5fk=
+cloud.google.com/go v0.111.0 h1:YHLKNupSD1KqjDbQ3+LVdQ81h/UJbJyZG203cEfnQgM=
+cloud.google.com/go v0.111.0/go.mod h1:0mibmpKP1TyOOFYQY5izo0LnT+ecvOQ0Sg3OdmMiNRU=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
@@ -44,15 +44,15 @@ cloud.google.com/go/compute v1.3.0/go.mod h1:cCZiE1NHEtai4wiufUhW8I8S1JKkAnhnQJW
 cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6mkzQJeu0M=
 cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz/FMzPu0s=
 cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
-cloud.google.com/go/compute v1.23.1 h1:V97tBoDaZHb6leicZ1G6DLK2BAaZLJ/7+9BB/En3hR0=
-cloud.google.com/go/compute v1.23.1/go.mod h1:CqB3xpmPKKt3OJpW2ndFIXnA9A4xAy/F3Xp1ixncW78=
+cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
+cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
-cloud.google.com/go/iam v1.1.3 h1:18tKG7DzydKWUnLjonWcJO6wjSCAtzh4GcRKlH/Hrzc=
-cloud.google.com/go/iam v1.1.3/go.mod h1:3khUlaBXfPKKe7huYgEpDn6FtgRyMEqbkvBxrQyY5SE=
+cloud.google.com/go/iam v1.1.5 h1:1jTsCu4bcsNsE4iiqNT5SHwrDRCfRmIaaaVFhRveTJI=
+cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXEbzv8=
 cloud.google.com/go/kms v1.0.0/go.mod h1:nhUehi+w7zht2XrUfvTRNpxrfayBHqP4lu2NSywui/0=
 cloud.google.com/go/profiler v0.3.0 h1:R6y/xAeifaUXxd2x6w+jIwKxoKl8Cv5HJvcvASTPWJo=
 cloud.google.com/go/profiler v0.3.0/go.mod h1:9wYk9eY4iZHsev8TQb61kh3wiOiSyz/xOYixWPzweCU=
@@ -192,8 +192,8 @@ github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+Ce
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bits-and-blooms/bitset v1.7.0 h1:YjAGVd3XmtK9ktAbX8Zg2g2PwLIMjGREZJHlV4j7NEo=
-github.com/bits-and-blooms/bitset v1.7.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
+github.com/bits-and-blooms/bitset v1.10.0 h1:ePXTeiPEazB5+opbv5fr8umg2R/1NlzgDsyepwsSr88=
+github.com/bits-and-blooms/bitset v1.10.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
 github.com/btcsuite/btcd v0.0.0-20171128150713-2e60448ffcc6/go.mod h1:Dmm/EzmjnCiweXmzRIAiUWCInVmPgjkzgv5k4tVyXiQ=
 github.com/btcsuite/btcd v0.0.0-20190213025234-306aecffea32/go.mod h1:DrZx5ec/dmnfpw9KyYoQyYo7d0KEvTkk/5M/vbZjAr8=
@@ -292,7 +292,7 @@ github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfc
 github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwcJI5acqYI6dE=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/crate-crypto/go-kzg-4844 v0.7.0 h1:C0vgZRk4q4EZ/JgPfzuSoxdCq3C3mOZMBShovmncxvA=
 github.com/crate-crypto/go-kzg-4844 v0.7.0/go.mod h1:1kMhvPgI0Ky3yIa+9lFySEBUBXkYxeOi8ZF1sYioxhc=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
@@ -323,8 +323,9 @@ github.com/dgraph-io/badger/v2 v2.2007.3/go.mod h1:26P/7fbL4kUZVEVKLAKXkBXKOydDm
 github.com/dgraph-io/badger/v2 v2.2007.4 h1:TRWBQg8UrlUhaFdco01nO2uXwzKS7zd+HVdwV/GHc4o=
 github.com/dgraph-io/badger/v2 v2.2007.4/go.mod h1:vSw/ax2qojzbN6eXHIx6KPKtCSHJN/Uz0X0VPruTIhk=
 github.com/dgraph-io/ristretto v0.0.2/go.mod h1:KPxhHT9ZxKefz+PCeOGsrHpl1qZ7i70dGTu2u+Ahh6E=
-github.com/dgraph-io/ristretto v0.0.3-0.20200630154024-f66de99634de h1:t0UHb5vdojIDUqktM6+xJAfScFBsVpXZmqC9dsgJmeA=
 github.com/dgraph-io/ristretto v0.0.3-0.20200630154024-f66de99634de/go.mod h1:KPxhHT9ZxKefz+PCeOGsrHpl1qZ7i70dGTu2u+Ahh6E=
+github.com/dgraph-io/ristretto v0.1.0 h1:Jv3CGQHp9OjuMBSne1485aDpUkTKEcUqF+jm/LuerPI=
+github.com/dgraph-io/ristretto v0.1.0/go.mod h1:fux0lOrBhrVCJd3lcTHsIJhq1T2rokOu6v9Vcb3Q9ug=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgryski/go-farm v0.0.0-20190104051053-3adb47b1fb0f/go.mod h1:SqUrOPUnsFjfmXRMNPybcSiG0BgUW2AuFH8PAnS2iTw=
 github.com/dgryski/go-farm v0.0.0-20190423205320-6a90982ecee2 h1:tdlZCpZ/P9DhczCTSixgIKmwPv6+wP5DGjqLYw5SUiA=
@@ -365,8 +366,8 @@ github.com/etcd-io/bbolt v1.3.3/go.mod h1:ZF2nL25h33cCyBtcyWeZ2/I3HQOfTP+0PIEvHj
 github.com/ethereum/c-kzg-4844 v0.4.0 h1:3MS1s4JtA868KpJxroZoepdV0ZKBp3u/O5HcZ7R3nlY=
 github.com/ethereum/c-kzg-4844 v0.4.0/go.mod h1:VewdlzQmpT5QSrVhbBuGoCdFJkpaJlO1aQputP83wc0=
 github.com/ethereum/go-ethereum v1.9.9/go.mod h1:a9TqabFudpDu1nucId+k9S8R9whYaHnGBLKFouA5EAo=
-github.com/ethereum/go-ethereum v1.13.5 h1:U6TCRciCqZRe4FPXmy1sMGxTfuk8P7u2UoinF3VbaFk=
-github.com/ethereum/go-ethereum v1.13.5/go.mod h1:yMTu38GSuyxaYzQMViqNmQ1s3cE84abZexQmTgenWk0=
+github.com/ethereum/go-ethereum v1.13.10 h1:Ppdil79nN+Vc+mXfge0AuUgmKWuVv4eMqzoIVSdqZek=
+github.com/ethereum/go-ethereum v1.13.10/go.mod h1:sc48XYQxCzH3fG9BcrXCOOgQk2JfZzNAmIKnceogzsA=
 github.com/fasthttp-contrib/websocket v0.0.0-20160511215533-1f3b11f56072/go.mod h1:duJ4Jxv5lDcvg4QuQr0oowTf7dz4/CR8NtyCooz9HL8=
 github.com/fatih/color v1.3.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
@@ -376,15 +377,16 @@ github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNu
 github.com/fjl/memsize v0.0.0-20180418122429-ca190fb6ffbc/go.mod h1:VvhXpOYNQvB+uIk2RvXzuaQtkQJzzIx6lSBe1xv7hi0=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/flynn/noise v0.0.0-20180327030543-2492fe189ae6/go.mod h1:1i71OnUq3iUe1ma7Lr6yG6/rjvM3emb6yoL7xLFzcVQ=
-github.com/flynn/noise v1.0.0 h1:DlTHqmzmvcEiKj+4RYo/imoswx/4r6iBlCMfVtrMXpQ=
 github.com/flynn/noise v1.0.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
+github.com/flynn/noise v1.0.1 h1:vPp/jdQLXC6ppsXSj/pM3W1BIJ5FEHE2TulSJBpb43Y=
+github.com/flynn/noise v1.0.1/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
 github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
 github.com/francoispqt/gojay v1.2.13 h1:d2m3sFjloqoIUQU3TsHBgj6qg/BVGlTBeHDUmyJnXKk=
 github.com/francoispqt/gojay v1.2.13/go.mod h1:ehT5mTG4ua4581f1++1WLG0vPdaA9HaiDsoyrBGkyDY=
 github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
 github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
-github.com/frankban/quicktest v1.14.4 h1:g2rn0vABPOOXmZUj+vbmUp0lPoXEMuhTpIluN0XL9UY=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
@@ -395,8 +397,8 @@ github.com/fxamacker/cbor/v2 v2.4.1-0.20230228173756-c0c9f774e40c/go.mod h1:TA1x
 github.com/fxamacker/circlehash v0.1.0/go.mod h1:3aq3OfVvsWtkWMb6A1owjOQFA+TLsD5FgJflnaQwtMM=
 github.com/fxamacker/circlehash v0.3.0 h1:XKdvTtIJV9t7DDUtsf0RIpC1OcxZtPbmgIH7ekx28WA=
 github.com/fxamacker/circlehash v0.3.0/go.mod h1:3aq3OfVvsWtkWMb6A1owjOQFA+TLsD5FgJflnaQwtMM=
-github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
-github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
+github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
+github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
 github.com/gammazero/deque v0.1.0 h1:f9LnNmq66VDeuAlSAapemq/U7hJ2jpIWa4c09q8Dlik=
 github.com/gammazero/deque v0.1.0/go.mod h1:KQw7vFau1hHuM8xmI9RbgKFbAsQFWmBpqQ2KenFLk6M=
 github.com/gammazero/workerpool v1.1.2 h1:vuioDQbgrz4HoaCi2q1HLlOXdpbap5AET7xu5/qj87g=
@@ -406,7 +408,6 @@ github.com/gballet/go-libpcsclite v0.0.0-20190607065134-2772fd86a8ff/go.mod h1:x
 github.com/getsentry/sentry-go v0.12.0/go.mod h1:NSap0JBYWzHND8oMbyi0+XZhUalc1TBdRL1M71JZW2c=
 github.com/getsentry/sentry-go v0.18.0 h1:MtBW5H9QgdcJabtZcuJG80BMOwaBpkRDZkxRkNC1sN0=
 github.com/getsentry/sentry-go v0.18.0/go.mod h1:Kgon4Mby+FJ7ZWHFUAZgVaIa8sxHtnRJRLTXZr51aKQ=
-github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gin-contrib/sse v0.0.0-20190301062529-5545eab6dad3/go.mod h1:VJ0WA2NBN22VlZ2dKZQPAPnyWw5XTlK1KymzLKsr59s=
 github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
@@ -435,8 +436,8 @@ github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG
 github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
 github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
-github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-martini/martini v0.0.0-20170121215854-22fa46961aab/go.mod h1:/P9AEU963A2AYjv4d1V5eVL1CQbEJq6aCNHDDjibzu8=
@@ -465,12 +466,12 @@ github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEe
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
 github.com/go-test/deep v1.0.5/go.mod h1:QV8Hv/iy04NyLBxAdO9njL0iVPN1S4d/A3NVv1V36o8=
 github.com/go-yaml/yaml v2.1.0+incompatible/go.mod h1:w2MrLa16VYP0jy6N7M5kHaCkaLENm+P+Tv+MfurjSw0=
-github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee h1:s+21KNqlpePfkah2I+gwHF8xmJWRjooY+5248k6m4A0=
 github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
-github.com/gobwas/pool v0.2.0 h1:QEmUOlnSjWtnpRGHF3SauEiOsy82Cup83Vf2LcMlnc8=
+github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
 github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.0.2 h1:CoAavW/wd/kulfZmSIBt6p24n4j7tHgNVCjsfHVNUbo=
+github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
+github.com/gobwas/ws v1.2.1 h1:F2aeBZrm2NDsc7vbovKrWSogd4wvfAxg0FQ89/iqOTk=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
@@ -492,7 +493,6 @@ github.com/gogo/status v1.1.0/go.mod h1:BFv9nrluPLmrS0EmGVvLaPNmRosr9KapBYd5/hpY
 github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
 github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
 github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -589,8 +589,8 @@ github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
 github.com/google/pprof v0.0.0-20220412212628-83db2b799d1f/go.mod h1:Pt31oes+eGImORns3McJn8zHefuQl2rG8l6xQjGYB4U=
-github.com/google/pprof v0.0.0-20230602150820-91b7bce49751 h1:hR7/MlvK23p6+lIw9SN1TigNLn9ZnF3W4SYRKq2gAHs=
-github.com/google/pprof v0.0.0-20230602150820-91b7bce49751/go.mod h1:Jh3hGz2jkYak8qXPD19ryItVnUgpgeqzdkY/D0EaeuA=
+github.com/google/pprof v0.0.0-20231229205709-960ae82b1e42 h1:dHLYa5D8/Ta0aLR2XcPsrkpAgGeFs6thhMcQK0oQ0n8=
+github.com/google/pprof v0.0.0-20231229205709-960ae82b1e42/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
 github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
@@ -599,8 +599,8 @@ github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4=
-github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
 github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
 github.com/googleapis/gax-go v2.0.0+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
@@ -621,8 +621,8 @@ github.com/gopherjs/gopherjs v0.0.0-20190430165422-3e4dfb77656c h1:7lF+Vz0LqiRid
 github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
 github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
-github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
-github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.1-0.20190629185528-ae1634f6a989/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
@@ -637,16 +637,17 @@ github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de
 github.com/grpc-ecosystem/go-grpc-middleware v1.2.2/go.mod h1:EaizFBKfUKtMIF5iaDEhniwNedqGo9FuLFzppDr3uwI=
 github.com/grpc-ecosystem/go-grpc-middleware/providers/zerolog/v2 v2.0.0-rc.2 h1:uxUHSMwWDJ/9jVPHNumRC8WZOi3hrBL22ObVOoLg4ww=
 github.com/grpc-ecosystem/go-grpc-middleware/providers/zerolog/v2 v2.0.0-rc.2/go.mod h1:BL7w7qd2l/j9jgY6WMhYutfOFQc0I8RTVwtjpnAMoTM=
-github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.0-20200501113911-9a95f0fdbfea h1:1Tk1IbruXbunEnaIZEFb+Hpv9BIZti3OxKwKn5wWyKk=
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.0-20200501113911-9a95f0fdbfea/go.mod h1:GugMBs30ZSAkckqXEAIEGyYdDH6EgqowG8ppA3Zt+AY=
+github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.0-rc.2 h1:1aeRCnE2CkKYqyzBu0+B2lgTcZPc3ea2lGpijeHbI1c=
+github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.0-rc.2/go.mod h1:GhphxcdlaRyAuBSvo6rV71BvQcvB/vuX8ugCyybuS2k=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.5.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpgL2+G+NZTnrVHpWWfpdw=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 h1:BZHcxBETFHIdVyhyEfOvn/RdU/QGdLI4y34qQGjGWO0=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 h1:Wqo399gCIufwto+VfwCSvsnfGpF/w5E9CNxSwbpD6No=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0/go.mod h1:qmOFXW2epJhM0qSnUUYpldc7gVz2KMQwJ/QYCDIa7XU=
 github.com/gxed/hashland/keccakpg v0.0.1/go.mod h1:kRzw3HkwxFU1mpmPP8v1WyQzwdGfmKFJ6tItnhQ67kU=
 github.com/gxed/hashland/murmur3 v0.0.1/go.mod h1:KjXop02n4/ckmZSnY2+HKcLud/tcmvhST0bie/0lS48=
 github.com/hashicorp/consul/api v1.3.0/go.mod h1:MmDNSzIMUjNpY/mQ398R4bk2FnqQLoPndWW5VkKPlCE=
@@ -670,10 +671,11 @@ github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA
 github.com/hashicorp/golang-lru v0.0.0-20160813221303-0a025b7e63ad/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/hashicorp/golang-lru/v2 v2.0.2 h1:Dwmkdr5Nc/oBiXgJS3CDHNhJtIHkuZ3DZF5twqnfBdU=
-github.com/hashicorp/golang-lru/v2 v2.0.2/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
+github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
@@ -682,8 +684,8 @@ github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2p
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
 github.com/holiman/bloomfilter/v2 v2.0.3 h1:73e0e/V0tCydx14a0SCYS/EWCxgwLZ18CZcZKVu0fao=
 github.com/holiman/bloomfilter/v2 v2.0.3/go.mod h1:zpoh+gs7qcpqrHr3dB55AMiJwo0iURXE7ZOP9L9hSkA=
-github.com/holiman/uint256 v1.2.3 h1:K8UWO1HUJpRMXBxbmaY1Y8IAMZC/RsKB+ArEnnK4l5o=
-github.com/holiman/uint256 v1.2.3/go.mod h1:SC8Ryt4n+UBbPbIBKaG9zbbDlp4jOru9xFZmPzLUTxw=
+github.com/holiman/uint256 v1.2.4 h1:jUc4Nk8fm9jZabQuqr2JzednajVmBpC+oiTiXZJEApU=
+github.com/holiman/uint256 v1.2.4/go.mod h1:EOMSn4q6Nyt9P6efbI3bueV4e1b3dGlUCXeiRV4ng7E=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/hudl/fargo v1.3.0/go.mod h1:y3CKSmjA+wD2gak7sUSXTAoopbhU08POFhmITJgmKTg=
 github.com/huin/goupnp v0.0.0-20161224104101-679507af18f3/go.mod h1:MZ2ZmwcBpvOoJ22IJsc7va19ZwoheaBk43rKg12SKag=
@@ -699,15 +701,13 @@ github.com/imkira/go-interpol v1.1.0/go.mod h1:z0h2/2T3XF8kyEPpRgJ3kmNv+C43p+I/C
 github.com/improbable-eng/grpc-web v0.15.0 h1:BN+7z6uNXZ1tQGcNAuaU1YjsLTApzkjt2tzCixLaUPQ=
 github.com/improbable-eng/grpc-web v0.15.0/go.mod h1:1sy9HKV4Jt9aEs9JSnkWlRJPuPtwNr0l57L4f878wP8=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/inconshreveable/mousetrap v1.0.1 h1:U3uMjPSQEBMNp1lFxmllqCPM6P5u/Xq7Pgzkat/bFNc=
-github.com/inconshreveable/mousetrap v1.0.1/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/influxdata/influxdb v1.2.3-0.20180221223340-01288bdb0883/go.mod h1:qZna6X/4elxqT3yI9iZYdZrWWdeFOOprn86kgg4+IzY=
 github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod h1:qj24IKcXYK6Iy9ceXlo3Tc+vtHo9lIhSX5JddghvEPo=
 github.com/ipfs/bbloom v0.0.1/go.mod h1:oqo8CVWsJFMOZqTglBG4wydCE4IQA/G2/SEofB0rjUI=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.10.0 h1:tdDAxq8jrsbRkYoF+5Rcqyeb91hgWe2hp7iLu7ORZLY=
-github.com/ipfs/boxo v0.10.0/go.mod h1:Fg+BnfxZ0RPzR0nOodzdIq3A7KgoWAOWsEIImrIQdBM=
 github.com/ipfs/go-bitswap v0.1.8/go.mod h1:TOWoxllhccevbWFUR2N7B1MTSVVge1s6XSMiCSA4MzM=
 github.com/ipfs/go-bitswap v0.3.4/go.mod h1:4T7fvNv/LmOys+21tnLzGKncMeeXUYUd1nUiJ2teMvI=
 github.com/ipfs/go-bitswap v0.5.0/go.mod h1:WwyyYD33RHCpczgHjpx+xjWYIy8l41K+l5EMy4/ctSM=
@@ -716,8 +716,8 @@ github.com/ipfs/go-bitswap v0.9.0/go.mod h1:zkfBcGWp4dQTQd0D0akpudhpOVUAJT9GbH9t
 github.com/ipfs/go-block-format v0.0.1/go.mod h1:DK/YYcsSUIVAFNwo/KZCdIIbpN0ROH/baNLgayt4pFc=
 github.com/ipfs/go-block-format v0.0.2/go.mod h1:AWR46JfpcObNfg3ok2JHDUfdiHRgWhJgCQF+KIgOPJY=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
-github.com/ipfs/go-block-format v0.1.2 h1:GAjkfhVx1f4YTODS6Esrj1wt2HhrtwTnhEr+DyPUaJo=
-github.com/ipfs/go-block-format v0.1.2/go.mod h1:mACVcrxarQKstUU3Yf/RdwbC4DzPV6++rO2a3d+a/KE=
+github.com/ipfs/go-block-format v0.2.0 h1:ZqrkxBA2ICbDRbK8KJs/u0O3dlp6gmAuuXUJNiW1Ycs=
+github.com/ipfs/go-block-format v0.2.0/go.mod h1:+jpL11nFx5A/SPpsoBn6Bzkra/zaArfSmsknbPMYgzM=
 github.com/ipfs/go-blockservice v0.1.4/go.mod h1:OTZhFpkgY48kNzbgyvcexW9cHrpjBYIjSR0KoDOFOLU=
 github.com/ipfs/go-blockservice v0.2.0/go.mod h1:Vzvj2fAnbbyly4+T7D5+p9n3+ZKVHA2bRMMo1QoILtQ=
 github.com/ipfs/go-blockservice v0.4.0 h1:7MUijAW5SqdsqEW/EhnNFRJXVF8mGU5aGhZ3CQaCWbY=
@@ -790,10 +790,11 @@ github.com/ipfs/go-ipfs-routing v0.1.0/go.mod h1:hYoUkJLyAUKhF58tysKpids8RNDPO42
 github.com/ipfs/go-ipfs-routing v0.2.0/go.mod h1:384byD/LHKhAgKE3NmwOjXCpDzhczROMBzidoYV7tfM=
 github.com/ipfs/go-ipfs-routing v0.2.1 h1:E+whHWhJkdN9YeoHZNj5itzc+OR292AJ2uE9FFiW0BY=
 github.com/ipfs/go-ipfs-util v0.0.1/go.mod h1:spsl5z8KUnrve+73pOhSVZND1SIxPW5RyBCNzQxlJBc=
-github.com/ipfs/go-ipfs-util v0.0.2 h1:59Sswnk1MFaiq+VcaknX7aYEyGyGDAA73ilhEK2POp8=
 github.com/ipfs/go-ipfs-util v0.0.2/go.mod h1:CbPtkWJzjLdEcezDns2XYaehFVNXG9zrdrtMecczcsQ=
-github.com/ipfs/go-ipld-format v0.5.0 h1:WyEle9K96MSrvr47zZHKKcDxJ/vlpET6PSiQsAFO+Ds=
-github.com/ipfs/go-ipld-format v0.5.0/go.mod h1:ImdZqJQaEouMjCvqCe0ORUS+uoBmf7Hf+EO/jh+nk3M=
+github.com/ipfs/go-ipfs-util v0.0.3 h1:2RFdGez6bu2ZlZdI+rWfIdbQb1KudQp3VGwPtdNCmE0=
+github.com/ipfs/go-ipfs-util v0.0.3/go.mod h1:LHzG1a0Ig4G+iZ26UUOMjHd+lfM84LZCrn17xAKWBvs=
+github.com/ipfs/go-ipld-format v0.6.0 h1:VEJlA2kQ3LqFSIm5Vu6eIlSxD/Ze90xtc4Meten1F5U=
+github.com/ipfs/go-ipld-format v0.6.0/go.mod h1:g4QVMTn3marU3qXchwjpKPKgJv+zF+OlaKMyhJ4LHPg=
 github.com/ipfs/go-log v0.0.1/go.mod h1:kL1d2/hzSpI0thNYjiKfjanbVNU+IIGA/WnNESY9leM=
 github.com/ipfs/go-log v1.0.2/go.mod h1:1MNjMxe0u6xvJZgeqbJ8vdo2TKaGwZ1a0Bpza+sr2Sk=
 github.com/ipfs/go-log v1.0.3/go.mod h1:OsLySYkwIbiSUR/yBTdv1qPtcE4FW3WPWk/ewz9Ru+A=
@@ -819,8 +820,8 @@ github.com/ipfs/go-peertaskqueue v0.8.1/go.mod h1:Oxxd3eaK279FxeydSPPVGHzbwVeHja
 github.com/ipfs/go-verifcid v0.0.1 h1:m2HI7zIuR5TFyQ1b79Da5N9dnnCP1vcu2QqawmWlK2E=
 github.com/ipfs/go-verifcid v0.0.1/go.mod h1:5Hrva5KBeIog4A+UpqlaIU+DEstipcJYQQZc0g37pY0=
 github.com/ipld/go-ipld-prime v0.11.0/go.mod h1:+WIAkokurHmZ/KwzDOMUuoeJgaRQktHtEaLglS3ZeV8=
-github.com/ipld/go-ipld-prime v0.20.0 h1:Ud3VwE9ClxpO2LkCYP7vWPc0Fo+dYdYzgxUJZ3uRG4g=
-github.com/ipld/go-ipld-prime v0.20.0/go.mod h1:PzqZ/ZR981eKbgdr3y2DJYeD/8bgMawdGVlJDE8kK+M=
+github.com/ipld/go-ipld-prime v0.21.0 h1:n4JmcpOlPDIxBcY037SVfpd1G+Sj1nKZah0m6QH9C2E=
+github.com/ipld/go-ipld-prime v0.21.0/go.mod h1:3RLqy//ERg/y5oShXXdx5YIp50cFGOanyMctpPjsvxQ=
 github.com/iris-contrib/blackfriday v2.0.0+incompatible/go.mod h1:UzZ2bDEoaSGPbkg6SAB4att1aAwTmVIx/5gCVqeyUdI=
 github.com/iris-contrib/go.uuid v2.0.0+incompatible/go.mod h1:iz2lgM/1UnEf1kP0L/+fafWORmlnuysV2EMP8MW+qe0=
 github.com/iris-contrib/jade v1.1.3/go.mod h1:H/geBymxJhShH5kecoiOCSssPX7QWYH7UaeZTSWddIk=
@@ -889,15 +890,15 @@ github.com/klauspost/compress v1.9.7/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0
 github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.11.7/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
-github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
-github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
+github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
 github.com/klauspost/cpuid v1.2.1/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.0.4/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.6/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
-github.com/klauspost/cpuid/v2 v2.2.5 h1:0E5MSMDEoAulmXNFquVs//DdoomxaoTY1kUhbc/qbZg=
-github.com/klauspost/cpuid/v2 v2.2.5/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/klauspost/cpuid/v2 v2.2.6 h1:ndNyv040zDGIDh8thGkXYjnFtiN02M1PVVF+JE/48xc=
+github.com/klauspost/cpuid/v2 v2.2.6/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/koron/go-ssdp v0.0.0-20180514024734-4a0ed625a78b/go.mod h1:5Ky9EC2xfoUKUor0Hjgi2BJhCSXJfMOFlmyYrVKGQMk=
@@ -952,10 +953,10 @@ github.com/libp2p/go-libp2p v0.7.4/go.mod h1:oXsBlTLF1q7pxr+9w6lqzS1ILpyHsaBPniV
 github.com/libp2p/go-libp2p v0.8.1/go.mod h1:QRNH9pwdbEBpx5DTJYg+qxcVaDMAz3Ee/qDKwXujH5o=
 github.com/libp2p/go-libp2p v0.13.0/go.mod h1:pM0beYdACRfHO1WcJlp65WXyG2A6NqYM+t2DTVAJxMo=
 github.com/libp2p/go-libp2p v0.14.3/go.mod h1:d12V4PdKbpL0T1/gsUNN8DfgMuRPDX8bS2QxCZlwRH0=
-github.com/libp2p/go-libp2p v0.28.1 h1:YurK+ZAI6cKfASLJBVFkpVBdl3wGhFi6fusOt725ii8=
-github.com/libp2p/go-libp2p v0.28.1/go.mod h1:s3Xabc9LSwOcnv9UD4nORnXKTsWkPMkIMB/JIGXVnzk=
-github.com/libp2p/go-libp2p-asn-util v0.3.0 h1:gMDcMyYiZKkocGXDQ5nsUQyquC9+H+iLEQHwOCZ7s8s=
-github.com/libp2p/go-libp2p-asn-util v0.3.0/go.mod h1:B1mcOrKUE35Xq/ASTmQ4tN3LNzVVaMNmq2NACuqyB9w=
+github.com/libp2p/go-libp2p v0.32.2 h1:s8GYN4YJzgUoyeYNPdW7JZeZ5Ee31iNaIBfGYMAY4FQ=
+github.com/libp2p/go-libp2p v0.32.2/go.mod h1:E0LKe+diV/ZVJVnOJby8VC5xzHF0660osg71skcxJvk=
+github.com/libp2p/go-libp2p-asn-util v0.4.1 h1:xqL7++IKD9TBFMgnLPZR6/6iYhawHKHl950SO9L6n94=
+github.com/libp2p/go-libp2p-asn-util v0.4.1/go.mod h1:d/NI6XZ9qxw67b4e+NgpQexCIiFYJjErASrYW4PFDN8=
 github.com/libp2p/go-libp2p-autonat v0.1.0/go.mod h1:1tLf2yXxiE/oKGtDwPYWTSYG3PtvYlJmg7NeVtPRqH8=
 github.com/libp2p/go-libp2p-autonat v0.1.1/go.mod h1:OXqkeGOY2xJVWKAGV2inNF5aKN/djNA3fdpCWloIudE=
 github.com/libp2p/go-libp2p-autonat v0.2.0/go.mod h1:DX+9teU4pEEoZUqR1PiMlqliONQdNbfzE1C718tcViI=
@@ -999,8 +1000,8 @@ github.com/libp2p/go-libp2p-discovery v0.1.0/go.mod h1:4F/x+aldVHjHDHuX85x1zWoFT
 github.com/libp2p/go-libp2p-discovery v0.2.0/go.mod h1:s4VGaxYMbw4+4+tsoQTqh7wfxg97AEdo4GYBt6BadWg=
 github.com/libp2p/go-libp2p-discovery v0.3.0/go.mod h1:o03drFnz9BVAZdzC/QUQ+NeQOu38Fu7LJGEOK2gQltw=
 github.com/libp2p/go-libp2p-discovery v0.5.0/go.mod h1:+srtPIU9gDaBNu//UHvcdliKBIcr4SfDcm0/PfPJLug=
-github.com/libp2p/go-libp2p-kad-dht v0.24.2 h1:zd7myKBKCmtZBhI3I0zm8xBkb28v3gmSEtQfBdAdFwc=
-github.com/libp2p/go-libp2p-kad-dht v0.24.2/go.mod h1:BShPzRbK6+fN3hk8a0WGAYKpb8m4k+DtchkqouGTrSg=
+github.com/libp2p/go-libp2p-kad-dht v0.25.2 h1:FOIk9gHoe4YRWXTu8SY9Z1d0RILol0TrtApsMDPjAVQ=
+github.com/libp2p/go-libp2p-kad-dht v0.25.2/go.mod h1:6za56ncRHYXX4Nc2vn8z7CZK0P4QiMcrn77acKLM2Oo=
 github.com/libp2p/go-libp2p-kbucket v0.6.3 h1:p507271wWzpy2f1XxPzCQG9NiN6R6lHL9GiSErbQQo0=
 github.com/libp2p/go-libp2p-kbucket v0.6.3/go.mod h1:RCseT7AH6eJWxxk2ol03xtP9pEHetYSPXOaJnOiD8i0=
 github.com/libp2p/go-libp2p-loggables v0.1.0 h1:h3w8QFfCt2UJl/0/NW4K829HX/0S4KD31PQ7m8UXXO8=
@@ -1027,12 +1028,14 @@ github.com/libp2p/go-libp2p-peerstore v0.2.2/go.mod h1:NQxhNjWxf1d4w6PihR8btWIRj
 github.com/libp2p/go-libp2p-peerstore v0.2.6/go.mod h1:ss/TWTgHZTMpsU/oKVVPQCGuDHItOpf2W8RxAi50P2s=
 github.com/libp2p/go-libp2p-peerstore v0.2.7/go.mod h1:ss/TWTgHZTMpsU/oKVVPQCGuDHItOpf2W8RxAi50P2s=
 github.com/libp2p/go-libp2p-pnet v0.2.0/go.mod h1:Qqvq6JH/oMZGwqs3N1Fqhv8NVhrdYcO0BW4wssv21LA=
-github.com/libp2p/go-libp2p-pubsub v0.9.3 h1:ihcz9oIBMaCK9kcx+yHWm3mLAFBMAUsM4ux42aikDxo=
-github.com/libp2p/go-libp2p-pubsub v0.9.3/go.mod h1:RYA7aM9jIic5VV47WXu4GkcRxRhrdElWf8xtyli+Dzc=
+github.com/libp2p/go-libp2p-pubsub v0.10.0 h1:wS0S5FlISavMaAbxyQn3dxMOe2eegMfswM471RuHJwA=
+github.com/libp2p/go-libp2p-pubsub v0.10.0/go.mod h1:1OxbaT/pFRO5h+Dpze8hdHQ63R0ke55XTs6b6NwLLkw=
 github.com/libp2p/go-libp2p-quic-transport v0.10.0/go.mod h1:RfJbZ8IqXIhxBRm5hqUEJqjiiY8xmEuq3HUDS993MkA=
 github.com/libp2p/go-libp2p-record v0.1.0/go.mod h1:ujNc8iuE5dlKWVy6wuL6dd58t0n7xI4hAIl8pE6wu5Q=
 github.com/libp2p/go-libp2p-record v0.2.0 h1:oiNUOCWno2BFuxt3my4i1frNrt7PerzB3queqa1NkQ0=
 github.com/libp2p/go-libp2p-record v0.2.0/go.mod h1:I+3zMkvvg5m2OcSdoL0KPljyJyvNDFGKX7QdlpYUcwk=
+github.com/libp2p/go-libp2p-routing-helpers v0.7.3 h1:u1LGzAMVRK9Nqq5aYDVOiq/HaB93U9WWczBzGyAC5ZY=
+github.com/libp2p/go-libp2p-routing-helpers v0.7.3/go.mod h1:cN4mJAD/7zfPKXBcs9ze31JGYAZgzdABEm+q/hkswb8=
 github.com/libp2p/go-libp2p-secio v0.1.0/go.mod h1:tMJo2w7h3+wN4pgU2LSYeiKPrfqBgkOsdiKK77hE7c8=
 github.com/libp2p/go-libp2p-secio v0.2.0/go.mod h1:2JdZepB8J5V9mBp79BmwsaPQhRPNN2NrnB2lKQcdy6g=
 github.com/libp2p/go-libp2p-secio v0.2.1/go.mod h1:cWtZpILJqkqrSkiYcDBh5lA3wbT2Q+hz3rJQq3iftD8=
@@ -1101,8 +1104,8 @@ github.com/libp2p/go-openssl v0.0.5/go.mod h1:unDrJpgy3oFr+rqXsarWifmJuNnJR4chtO
 github.com/libp2p/go-openssl v0.0.7/go.mod h1:unDrJpgy3oFr+rqXsarWifmJuNnJR4chtO1HmaZjggc=
 github.com/libp2p/go-reuseport v0.0.1/go.mod h1:jn6RmB1ufnQwl0Q1f+YxAj8isJgDCQzaaxIFYDhcYEA=
 github.com/libp2p/go-reuseport v0.0.2/go.mod h1:SPD+5RwGC7rcnzngoYC86GjPzjSywuQyMVAheVBD9nQ=
-github.com/libp2p/go-reuseport v0.3.0 h1:iiZslO5byUYZEg9iCwJGf5h+sf1Agmqx2V2FDjPyvUw=
-github.com/libp2p/go-reuseport v0.3.0/go.mod h1:laea40AimhtfEqysZ71UpYj4S+R9VpH8PgqLo7L+SwI=
+github.com/libp2p/go-reuseport v0.4.0 h1:nR5KU7hD0WxXCJbmw7r2rhRYruNRl2koHw8fQscQm2s=
+github.com/libp2p/go-reuseport v0.4.0/go.mod h1:ZtI03j/wO5hZVDFo2jKywN6bYKWLOy8Se6DrI2E1cLU=
 github.com/libp2p/go-reuseport-transport v0.0.2/go.mod h1:YkbSDrvjUVDL6b8XqriyA20obEtsW9BLkuOUyQAOCbs=
 github.com/libp2p/go-reuseport-transport v0.0.3/go.mod h1:Spv+MPft1exxARzP2Sruj2Wb5JSyHNncjf1Oi2dEbzM=
 github.com/libp2p/go-reuseport-transport v0.0.4/go.mod h1:trPa7r/7TJK/d+0hdBLOCGvpQQVOU74OXbNCIMkufGw=
@@ -1131,8 +1134,8 @@ github.com/libp2p/go-yamux v1.4.0/go.mod h1:fr7aVgmdNGJK+N1g+b6DW6VxzbRCjCOejR/h
 github.com/libp2p/go-yamux v1.4.1/go.mod h1:fr7aVgmdNGJK+N1g+b6DW6VxzbRCjCOejR/hkmpooHE=
 github.com/libp2p/go-yamux/v2 v2.0.0/go.mod h1:NVWira5+sVUIU6tu1JWvaRn1dRnG+cawOJiflsAM+7U=
 github.com/libp2p/go-yamux/v2 v2.2.0/go.mod h1:3So6P6TV6r75R9jiBpiIKgU/66lOarCZjqROGxzPpPQ=
-github.com/libp2p/go-yamux/v4 v4.0.0 h1:+Y80dV2Yx/kv7Y7JKu0LECyVdMXm1VUoko+VQ9rBfZQ=
-github.com/libp2p/go-yamux/v4 v4.0.0/go.mod h1:NWjl8ZTLOGlozrXSOZ/HlfG++39iKNnM5wwmtQP1YB4=
+github.com/libp2p/go-yamux/v4 v4.0.1 h1:FfDR4S1wj6Bw2Pqbc8Uz7pCxeRBPbwsBbEdfwiCypkQ=
+github.com/libp2p/go-yamux/v4 v4.0.1/go.mod h1:NWjl8ZTLOGlozrXSOZ/HlfG++39iKNnM5wwmtQP1YB4=
 github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM=
 github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
 github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
@@ -1179,21 +1182,22 @@ github.com/mattn/go-isatty v0.0.13/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Ky
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
-github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.3/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.6/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU=
 github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
+github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-tty v0.0.3/go.mod h1:ihxohKRERHTVzN+aSVRwACLCeqIoZAWpoICkkvrWyR0=
 github.com/mattn/goveralls v0.0.2/go.mod h1:8d1ZMHsd7fW6IRPKQh46F2WRpyib5/X4FOpevwGNQEw=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
-github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
 github.com/mediocregopher/radix/v3 v3.4.2/go.mod h1:8FL3F6UQRXHXIBSPUs5h0RybMF8i4n7wVopoX3x7Bv8=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4=
@@ -1203,8 +1207,8 @@ github.com/miekg/dns v1.1.12/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3N
 github.com/miekg/dns v1.1.28/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
 github.com/miekg/dns v1.1.31/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
-github.com/miekg/dns v1.1.54 h1:5jon9mWcb0sFJGpnI99tOMhCPyJ+RPVz5b63MQG0VWI=
-github.com/miekg/dns v1.1.54/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
+github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
+github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
 github.com/mikioh/tcp v0.0.0-20190314235350-803a9b46060c h1:bzE/A84HN25pxAuk9Eej1Kz9OUelF97nAc82bDquQI8=
 github.com/mikioh/tcp v0.0.0-20190314235350-803a9b46060c/go.mod h1:0SQS9kMwD2VsyFEB++InYyBJroV/FRmBgcydeSUcJms=
 github.com/mikioh/tcpinfo v0.0.0-20190314235526-30a79bb1804b h1:z78hV3sbSMAUoyUMM0I83AUIT6Hu17AWfgjzIbtrYFc=
@@ -1268,8 +1272,8 @@ github.com/multiformats/go-multiaddr v0.2.2/go.mod h1:NtfXiOtHvghW9KojvtySjH5y0u
 github.com/multiformats/go-multiaddr v0.3.0/go.mod h1:dF9kph9wfJ+3VLAaeBqo9Of8x4fJxp6ggJGteB8HQTI=
 github.com/multiformats/go-multiaddr v0.3.1/go.mod h1:uPbspcUPd5AfaP6ql3ujFY+QWzmBD8uLLL4bXW0XfGc=
 github.com/multiformats/go-multiaddr v0.3.3/go.mod h1:lCKNGP1EQ1eZ35Za2wlqnabm9xQkib3fyB+nZXHLag0=
-github.com/multiformats/go-multiaddr v0.9.0 h1:3h4V1LHIk5w4hJHekMKWALPXErDfz/sggzwC/NcqbDQ=
-github.com/multiformats/go-multiaddr v0.9.0/go.mod h1:mI67Lb1EeTOYb8GQfL/7wpIZwc46ElrvzhYnoJOmTT0=
+github.com/multiformats/go-multiaddr v0.12.2 h1:9G9sTY/wCYajKa9lyfWPmpZAwe6oV+Wb1zcmMS1HG24=
+github.com/multiformats/go-multiaddr v0.12.2/go.mod h1:GKyaTYjZRdcUhyOetrxTk9z0cW+jA/YrnqTOvKgi44M=
 github.com/multiformats/go-multiaddr-dns v0.0.1/go.mod h1:9kWcqw/Pj6FwxAwW38n/9403szc57zJPs45fmnznu3Q=
 github.com/multiformats/go-multiaddr-dns v0.0.2/go.mod h1:9kWcqw/Pj6FwxAwW38n/9403szc57zJPs45fmnznu3Q=
 github.com/multiformats/go-multiaddr-dns v0.2.0/go.mod h1:TJ5pr5bBO7Y1B18djPuRsVkduhQH2YqYSbxWJzYGdK0=
@@ -1307,8 +1311,8 @@ github.com/multiformats/go-multistream v0.1.1/go.mod h1:KmHZ40hzVxiaiwlj3MEbYgK9
 github.com/multiformats/go-multistream v0.2.0/go.mod h1:5GZPQZbkWOLOn3J2y4Y99vVW7vOfsAflxARk3x14o6k=
 github.com/multiformats/go-multistream v0.2.1/go.mod h1:5GZPQZbkWOLOn3J2y4Y99vVW7vOfsAflxARk3x14o6k=
 github.com/multiformats/go-multistream v0.2.2/go.mod h1:UIcnm7Zuo8HKG+HkWgfQsGL+/MIEhyTqbODbIUwSXKs=
-github.com/multiformats/go-multistream v0.4.1 h1:rFy0Iiyn3YT0asivDUIR05leAdwZq3de4741sbiSdfo=
-github.com/multiformats/go-multistream v0.4.1/go.mod h1:Mz5eykRVAjJWckE2U78c6xqdtyNUEhKSM0Lwar2p77Q=
+github.com/multiformats/go-multistream v0.5.0 h1:5htLSLl7lvJk3xx3qT/8Zm9J4K8vEOf/QGkvOGQAyiE=
+github.com/multiformats/go-multistream v0.5.0/go.mod h1:n6tMZiwiP2wUsR8DgfDWw1dydlEqV3l6N3/GBsX6ILA=
 github.com/multiformats/go-varint v0.0.1/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
 github.com/multiformats/go-varint v0.0.2/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
 github.com/multiformats/go-varint v0.0.5/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
@@ -1330,8 +1334,9 @@ github.com/nats-io/nkeys v0.1.3/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxzi
 github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
 github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJEU3ofeGjhHklVoIGuVj85JJwZ6kWPaJwCIxgnFmo=
 github.com/neelance/sourcemap v0.0.0-20151028013722-8c68805598ab/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM=
-github.com/nxadm/tail v1.4.4 h1:DQuhQpB1tVlglWS2hLQ5OV6B5r8aGxSrPc5Qo6uTN78=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/oklog/oklog v0.3.2/go.mod h1:FCV+B7mhrz4o+ueLpx+KqkyXRGMWOYEvfiXtdGtbWGs=
 github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
@@ -1343,17 +1348,19 @@ github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6
 github.com/onflow/atree v0.1.0-beta1.0.20211027184039-559ee654ece9/go.mod h1:+6x071HgCF/0v5hQcaE5qqjc2UqN5gCU8h5Mk6uqpOg=
 github.com/onflow/atree v0.6.0 h1:j7nQ2r8npznx4NX39zPpBYHmdy45f4xwoi+dm37Jk7c=
 github.com/onflow/atree v0.6.0/go.mod h1:gBHU0M05qCbv9NN0kijLWMgC47gHVNBIp4KmsVFi0tc=
+github.com/onflow/boxo v0.0.0-20240201202436-f2477b92f483 h1:LpiQhTAfM9CAmNVEs0n//cBBgCg+vJSiIxTHYUklZ84=
+github.com/onflow/boxo v0.0.0-20240201202436-f2477b92f483/go.mod h1:pIZgTWdm3k3pLF9Uq6MB8JEcW07UDwNJjlXW1HELW80=
 github.com/onflow/cadence v0.20.1/go.mod h1:7mzUvPZUIJztIbr9eTvs+fQjWWHTF8veC+yk4ihcNIA=
-github.com/onflow/cadence v0.42.7 h1:Qp9VYX901saO7wPwF/rwV4cMS+0mfWxnm9EqbYElYy4=
-github.com/onflow/cadence v0.42.7/go.mod h1:raU8va8QRyTa/eUbhej4mbyW2ETePfSaywoo36MddgE=
-github.com/onflow/crypto v0.25.0 h1:BeWbLsh3ZD13Ej+Uky6kg1PL1ZIVBDVX+2MVBNwqddg=
-github.com/onflow/crypto v0.25.0/go.mod h1:C8FbaX0x8y+FxWjbkHy0Q4EASCDR9bSPWZqlpCLYyVI=
+github.com/onflow/cadence v0.42.10 h1:3oC5ceeXhdCrhHcf9H0yYXQKW3Tw/vkSXLe+PUZa4i0=
+github.com/onflow/cadence v0.42.10/go.mod h1:1wFd+LiNiN6qoZXof3MBdpM6d8BsxbVIxOA77LbIYmE=
+github.com/onflow/crypto v0.25.1 h1:0txy2PKPMM873JbpxQNbJmuOJtD56bfs48RQfm0ts5A=
+github.com/onflow/crypto v0.25.1/go.mod h1:C8FbaX0x8y+FxWjbkHy0Q4EASCDR9bSPWZqlpCLYyVI=
 github.com/onflow/flow v0.3.4 h1:FXUWVdYB90f/rjNcY0Owo30gL790tiYff9Pb/sycXYE=
 github.com/onflow/flow v0.3.4/go.mod h1:lzyAYmbu1HfkZ9cfnL5/sjrrsnJiUU8fRL26CqLP7+c=
-github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1-0.20231219201108-fbdb10b0a2da h1:8CEioYNnP0rwjnRbKDgs8SmiQTsdaroeX4d/Q3pQuh4=
-github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1-0.20231219201108-fbdb10b0a2da/go.mod h1:WHp24VkUQfcfZi0XjI1uRVRt5alM5SHVkwOil1U2Tpc=
-github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1-0.20231219201108-fbdb10b0a2da h1:V2zI6AfDtPykMGhgw69ZEGcvyMudRUFOVHYCMN4BbQo=
-github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1-0.20231219201108-fbdb10b0a2da/go.mod h1:c09d6sNyF/j5/pAynK7sNPb1XKqJqk1rxZPEqEL+dUo=
+github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1 h1:xF5wHug6H8vKfz7p1LYy9jck6eD9K1HLjTdi6o4kg1k=
+github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1/go.mod h1:WHp24VkUQfcfZi0XjI1uRVRt5alM5SHVkwOil1U2Tpc=
+github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1 h1:EjWjbyVEA+bMxXbM44dE6MsYeqOu5a9q/EwSWa4ma2M=
+github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1/go.mod h1:c09d6sNyF/j5/pAynK7sNPb1XKqJqk1rxZPEqEL+dUo=
 github.com/onflow/flow-ft/lib/go/contracts v0.7.1-0.20230711213910-baad011d2b13 h1:B4ll7e3j+MqTJv2122Enq3RtDNzmIGRu9xjV7fo7un0=
 github.com/onflow/flow-ft/lib/go/contracts v0.7.1-0.20230711213910-baad011d2b13/go.mod h1:kTMFIySzEJJeupk+7EmXs0EJ6CBWY/MV9fv9iYQk+RU=
 github.com/onflow/flow-go-sdk v0.24.0/go.mod h1:IoptMLPyFXWvyd9yYA6/4EmSeeozl6nJoIv4FaEMg74=
@@ -1363,34 +1370,35 @@ github.com/onflow/flow-go/crypto v0.21.3/go.mod h1:vI6V4CY3R6c4JKBxdcRiR/AnjBfL8
 github.com/onflow/flow-nft/lib/go/contracts v1.1.0 h1:rhUDeD27jhLwOqQKI/23008CYfnqXErrJvc4EFRP2a0=
 github.com/onflow/flow-nft/lib/go/contracts v1.1.0/go.mod h1:YsvzYng4htDgRB9sa9jxdwoTuuhjK8WYWXTyLkIigZY=
 github.com/onflow/flow/protobuf/go/flow v0.2.2/go.mod h1:gQxYqCfkI8lpnKsmIjwtN2mV/N2PIwc1I+RUK4HPIc8=
-github.com/onflow/flow/protobuf/go/flow v0.3.2-0.20231213135419-ae911cc351a2 h1:+rT+UsfTR39JZO8ht2+4fkaWfHw74SCj1fyz1lWuX8A=
-github.com/onflow/flow/protobuf/go/flow v0.3.2-0.20231213135419-ae911cc351a2/go.mod h1:NA2pX2nw8zuaxfKphhKsk00kWLwfd+tv8mS23YXO4Sk=
-github.com/onflow/go-bitswap v0.0.0-20230703214630-6d3db958c73d h1:QcOAeEyF3iAUHv21LQ12sdcsr0yFrJGoGLyCAzYYtvI=
-github.com/onflow/go-bitswap v0.0.0-20230703214630-6d3db958c73d/go.mod h1:GCPpiyRoHncdqPj++zPr9ZOYBX4hpJ0pYZRYqSE8VKk=
+github.com/onflow/flow/protobuf/go/flow v0.3.7-0.20240404170900-c321c1475f1e h1:r4+gVDDMOOc04Y1qjCZULAdgoaxSMsqSdE1EyviG76U=
+github.com/onflow/flow/protobuf/go/flow v0.3.7-0.20240404170900-c321c1475f1e/go.mod h1:NA2pX2nw8zuaxfKphhKsk00kWLwfd+tv8mS23YXO4Sk=
+github.com/onflow/go-ethereum v1.13.4 h1:iNO86fm8RbBbhZ87ZulblInqCdHnAQVY8okBrNsTevc=
+github.com/onflow/go-ethereum v1.13.4/go.mod h1:cE/gEUkAffhwbVmMJYz+t1dAfVNHNwZCgc3BWtZxBGY=
 github.com/onflow/sdks v0.5.0 h1:2HCRibwqDaQ1c9oUApnkZtEAhWiNY2GTpRD5+ftdkN8=
 github.com/onflow/sdks v0.5.0/go.mod h1:F0dj0EyHC55kknLkeD10js4mo14yTdMotnWMslPirrU=
-github.com/onflow/wal v0.0.0-20230529184820-bc9f8244608d h1:gAEqYPn3DS83rHIKEpsajnppVD1+zwuYPFyeDVFaQvg=
-github.com/onflow/wal v0.0.0-20230529184820-bc9f8244608d/go.mod h1:iMC8gkLqu4nkbkAla5HkSBb+FGyQOZiWz3DYm2wSXCk=
+github.com/onflow/wal v0.0.0-20240208022732-d756cd497d3b h1:6O/BEmA99PDT5QVjoJgrYlGsWnpxGJTAMmsC+V9gyds=
+github.com/onflow/wal v0.0.0-20240208022732-d756cd497d3b/go.mod h1:iMC8gkLqu4nkbkAla5HkSBb+FGyQOZiWz3DYm2wSXCk=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.14.0 h1:2mOpI4JVVPBN+WQRa0WKH2eXR+Ey+uK4n7Zj0aYpIQA=
 github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
-github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo/v2 v2.9.7 h1:06xGQy5www2oN160RtEZoTvnP2sPhEfePYmCDc2szss=
-github.com/onsi/ginkgo/v2 v2.9.7/go.mod h1:cxrmXWykAwTwhQsJOPfdIDiJ+l2RYq7U8hFU+M/1uw0=
+github.com/onsi/ginkgo/v2 v2.13.2 h1:Bi2gGVkfn6gQcjNjZJVO8Gf0FHzMPf2phUei9tejVMs=
+github.com/onsi/ginkgo/v2 v2.13.2/go.mod h1:XStQ8QcGwLyF4HdfcZB8SFOS/MWCgDuXMSBe6zrvLgM=
 github.com/onsi/gomega v1.4.1/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.27.7 h1:fVih9JD6ogIiHUN6ePK7HJidyEDpWGVB5mzM7cWNXoU=
+github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
-github.com/opencontainers/runtime-spec v1.0.2 h1:UfAcuLBJB9Coz72x1hgl8O5RVzTdNiaglX6v2DM6FI0=
 github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.1.0 h1:HHUyrt9mwHUjtasSbXSMvs4cyFxh+Bll4AjJ9odEGpg=
+github.com/opencontainers/runtime-spec v1.1.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=
 github.com/opentracing/basictracer-go v1.0.0/go.mod h1:QfBfYuafItcjQuMwinw9GhYKwFXS9KnPs5lxoYwgW74=
 github.com/opentracing/opentracing-go v1.0.2/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
@@ -1445,16 +1453,16 @@ github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5Fsn
 github.com/prometheus/client_golang v1.3.0/go.mod h1:hJaj2vgQTGQmVCsAACORcieXFeDPbaTKGT+JTgUa3og=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.10.0/go.mod h1:WJM3cc3yu7XKBKa/I8WeZm+V3eltZnBwfENSU7mdogU=
-github.com/prometheus/client_golang v1.14.0 h1:nJdhIvne2eSX/XRAFV9PcvFFRbrjbcTUj0VP62TMhnw=
-github.com/prometheus/client_golang v1.14.0/go.mod h1:8vpkKitgIVNcqrRBWh1C4TIUQgYNtG/XQE4E/Zae36Y=
+github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
+github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.1.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY=
-github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU=
+github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
+github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
 github.com/prometheus/common v0.0.0-20180801064454-c7de2306084e/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
@@ -1464,8 +1472,8 @@ github.com/prometheus/common v0.7.0/go.mod h1:DjGbpBbp5NYNiECxcL/VnbXCCaQpKd3tt2
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.15.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
 github.com/prometheus/common v0.18.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
-github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
-github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
+github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
+github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
 github.com/prometheus/procfs v0.0.0-20180725123919-05ee40e3a273/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
@@ -1475,22 +1483,20 @@ github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+Gx
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.3.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI=
-github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY=
+github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
+github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
 github.com/prometheus/tsdb v0.6.2-0.20190402121629-4f204dcbc150/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/psiemens/sconfig v0.1.0 h1:xfWqW+TRpih7mXZIqKYTmpRhlZLQ1kbxV8EjllPv76s=
 github.com/psiemens/sconfig v0.1.0/go.mod h1:+MLKqdledP/8G3rOBpknbLh0IclCf4WneJUtS26JB2U=
 github.com/quic-go/qpack v0.4.0 h1:Cr9BXA1sQS2SmDUWjSofMPNKmvF6IiIfDRmgU0w1ZCo=
 github.com/quic-go/qpack v0.4.0/go.mod h1:UZVnYIfi5GRk+zI9UMaCPsmZ2xKJP7XBUvVyT1Knj9A=
-github.com/quic-go/qtls-go1-19 v0.3.2 h1:tFxjCFcTQzK+oMxG6Zcvp4Dq8dx4yD3dDiIiyc86Z5U=
-github.com/quic-go/qtls-go1-19 v0.3.2/go.mod h1:ySOI96ew8lnoKPtSqx2BlI5wCpUVPT05RMAlajtnyOI=
-github.com/quic-go/qtls-go1-20 v0.2.2 h1:WLOPx6OY/hxtTxKV1Zrq20FtXtDEkeY00CGQm8GEa3E=
-github.com/quic-go/qtls-go1-20 v0.2.2/go.mod h1:JKtK6mjbAVcUTN/9jZpvLbGxvdWIKS8uT7EiStoU1SM=
-github.com/quic-go/quic-go v0.33.0 h1:ItNoTDN/Fm/zBlq769lLJc8ECe9gYaW40veHCCco7y0=
-github.com/quic-go/quic-go v0.33.0/go.mod h1:YMuhaAV9/jIu0XclDXwZPAsP/2Kgr5yMYhe9oxhhOFA=
-github.com/quic-go/webtransport-go v0.5.3 h1:5XMlzemqB4qmOlgIus5zB45AcZ2kCgCy2EptUrfOPWU=
-github.com/quic-go/webtransport-go v0.5.3/go.mod h1:OhmmgJIzTTqXK5xvtuX0oBpLV2GkLWNDA+UeTGJXErU=
+github.com/quic-go/qtls-go1-20 v0.4.1 h1:D33340mCNDAIKBqXuAvexTNMUByrYmFYVfKfDN5nfFs=
+github.com/quic-go/qtls-go1-20 v0.4.1/go.mod h1:X9Nh97ZL80Z+bX/gUXMbipO6OxdiDi58b/fMC9mAL+k=
+github.com/quic-go/quic-go v0.40.1 h1:X3AGzUNFs0jVuO3esAGnTfvdgvL4fq655WaOi1snv1Q=
+github.com/quic-go/quic-go v0.40.1/go.mod h1:PeN7kuVJ4xZbxSv/4OX6S1USOX8MJvydwpTx31vx60c=
+github.com/quic-go/webtransport-go v0.6.0 h1:CvNsKqc4W2HljHJnoT+rMmbRJybShZ0YPFDD3NxaZLY=
+github.com/quic-go/webtransport-go v0.6.0/go.mod h1:9KjU4AEBqEQidGHNDkZrb8CAa1abRaosM2yGOyiikEc=
 github.com/raulk/go-watchdog v1.3.0 h1:oUmdlHxdkXRJlwfG0O9omj8ukerm8MEQavSiDTEtBsk=
 github.com/raulk/go-watchdog v1.3.0/go.mod h1:fIvOnLbF0b0ZwkB9YU4mOW9Did//4vPZtDqv66NfsMU=
 github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
@@ -1504,8 +1510,9 @@ github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6L
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.8.1/go.mod h1:JeRgkft04UBgHMgCIwADu4Pn6Mtm5d4nPKWu0nJ5d+o=
-github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/rs/cors v0.0.0-20160617231935-a62a804a8a00/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
 github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
 github.com/rs/cors v1.8.0 h1:P2KMzcFwrPoSjkF1WLRPsp3UMLyql8L4v9hQpVeK5so=
@@ -1591,8 +1598,8 @@ github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
 github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
 github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
-github.com/spf13/cobra v1.6.1 h1:o94oiPyS4KD1mPy2fmcYYHHfCxLqYjJOhGsCHFZtEzA=
-github.com/spf13/cobra v1.6.1/go.mod h1:IOw/AERYS7UzyrGinqmz6HLUo219MORXGxhbaJUqzrY=
+github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
+github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
 github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
 github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
@@ -1675,7 +1682,7 @@ github.com/vmihailenco/msgpack/v4 v4.3.11 h1:Q47CePddpNGNhk4GCnAx9DDtASi2rasatE0
 github.com/vmihailenco/msgpack/v4 v4.3.11/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+NXzzngzBKDPIqw4=
 github.com/vmihailenco/tagparser v0.1.1 h1:quXMXlA39OCbd2wAdTsGDlK9RkOk6Wuw+x37wVyIuWY=
 github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
-github.com/warpfork/go-testmark v0.11.0 h1:J6LnV8KpceDvo7spaNU4+DauH2n1x+6RaO2rJrmpQ9U=
+github.com/warpfork/go-testmark v0.12.1 h1:rMgCpJfwy1sJ50x0M0NgyphxYYPMOODIJHhsXyEHU0s=
 github.com/warpfork/go-wish v0.0.0-20200122115046-b9ea61034e4a/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0 h1:GDDkbFiaK8jsSDJfjId/PEGEShv6ugrt4kYsC5UIDaQ=
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
@@ -1706,6 +1713,7 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.2 h1:KBNDSne4vP5mbSWnJbO+51IMOXJB67QiYCSBrubbPRg=
 github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
@@ -1732,23 +1740,21 @@ go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/otel v1.16.0 h1:Z7GVAX/UkAXPKsy94IU+i6thsQS4nb7LviLpnaNeW8s=
-go.opentelemetry.io/otel v1.16.0/go.mod h1:vl0h9NUa1D5s1nv3A5vZOYWn8av4K8Ml6JDeHrT/bx4=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0 h1:t4ZwRPU+emrcvM2e9DHd0Fsf0JTPVcbfa/BhTDF03d0=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0/go.mod h1:vLarbg68dH2Wa77g71zmKQqlQ8+8Rq3GRG31uc0WcWI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0 h1:cbsD4cUcviQGXdw8+bo5x2wazq10SKz8hEbtCRPcU78=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0/go.mod h1:JgXSGah17croqhJfhByOLVY719k1emAXC8MVhCIJlRs=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0 h1:ap+y8RXX3Mu9apKVtOkM6WSFESLM8K3wNQyOU8sWHcc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0/go.mod h1:5w41DY6S9gZrbjuq6Y+753e96WfPha5IcsOSZTtullM=
-go.opentelemetry.io/otel/metric v1.16.0 h1:RbrpwVG1Hfv85LgnZ7+txXioPDoh6EdbZHo26Q3hqOo=
-go.opentelemetry.io/otel/metric v1.16.0/go.mod h1:QE47cpOmkwipPiefDwo2wDzwJrlfxxNYodqc4xnGCo4=
-go.opentelemetry.io/otel/sdk v1.16.0 h1:Z1Ok1YsijYL0CSJpHt4cS3wDDh7p572grzNrBMiMWgE=
-go.opentelemetry.io/otel/sdk v1.16.0/go.mod h1:tMsIuKXuuIWPBAOrH+eHtvhTL+SntFtXF9QD68aP6p4=
-go.opentelemetry.io/otel/trace v1.16.0 h1:8JRpaObFoW0pxuVPapkgH8UhHQj+bJW8jJsCZEu5MQs=
-go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLkqr2QVwea0ef0=
+go.opentelemetry.io/otel v1.22.0 h1:xS7Ku+7yTFvDfDraDIJVpw7XPyuHlB9MCiqqX5mcJ6Y=
+go.opentelemetry.io/otel v1.22.0/go.mod h1:eoV4iAi3Ea8LkAEI9+GFT44O6T/D0GWAVFyZVCC6pMI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 h1:tIqheXEFWAZ7O8A7m+J0aPTmpJN3YQ7qetUAdkkkKpk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0/go.mod h1:nUeKExfxAQVbiVFn32YXpXZZHZ61Cc3s3Rn1pDBGAb0=
+go.opentelemetry.io/otel/metric v1.22.0 h1:lypMQnGyJYeuYPhOM/bgjbFM6WE44W1/T45er4d8Hhg=
+go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xCWdXjK8pzFvliY=
+go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
+go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
+go.opentelemetry.io/otel/trace v1.22.0 h1:Hg6pPujv0XG9QaVbGOBVHunyuLcCC3jN7WEhPx83XD0=
+go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v0.19.0 h1:IVN6GR+mhC4s5yfcTbmzHYODqvWAp3ZedA2SJPI1Nnw=
-go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
+go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
+go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
@@ -1756,14 +1762,16 @@ go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-go.uber.org/dig v1.17.0 h1:5Chju+tUvcC+N7N6EV08BJz41UZuO3BmHcN4A287ZLI=
-go.uber.org/dig v1.17.0/go.mod h1:rTxpf7l5I0eBTlE6/9RL+lDybC7WFwY2QH55ZSjy1mU=
-go.uber.org/fx v1.19.2 h1:SyFgYQFr1Wl0AYstE8vyYIzP4bFz2URrScjwC4cwUvY=
-go.uber.org/fx v1.19.2/go.mod h1:43G1VcqSzbIv77y00p1DRAsyZS8WdzuYdhZXmEUkMyQ=
+go.uber.org/dig v1.17.1 h1:Tga8Lz8PcYNsWsyHMZ1Vm0OQOUaJNDyvPImgbAu9YSc=
+go.uber.org/dig v1.17.1/go.mod h1:Us0rSJiThwCv2GteUN0Q7OKvU7n5J4dxZ9JKUXozFdE=
+go.uber.org/fx v1.20.1 h1:zVwVQGS8zYvhh9Xxcu4w1M6ESyeMzebzj2NbSayZ4Mk=
+go.uber.org/fx v1.20.1/go.mod h1:iSYNbHf2y55acNCwCXKx7LbWb5WG1Bnue5RDXz1OREg=
 go.uber.org/goleak v1.0.0/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.1.11-0.20210813005559-691160354723/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
+go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
 go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
@@ -1778,8 +1786,8 @@ go.uber.org/zap v1.14.1/go.mod h1:Mb2vm2krFEG5DV0W9qcHBYFtp/Wku1cvYaqPsS/WYfc=
 go.uber.org/zap v1.15.0/go.mod h1:Mb2vm2krFEG5DV0W9qcHBYFtp/Wku1cvYaqPsS/WYfc=
 go.uber.org/zap v1.16.0/go.mod h1:MA8QOfq0BHJwdXa996Y4dYkAqRKB8/1K1QMMZVaNZjQ=
 go.uber.org/zap v1.19.1/go.mod h1:j3DNczoxDZroyBnOT1L/Q79cfUMGZxlv/9dzN7SM1rI=
-go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
-go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
+go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
+go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
 go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
 golang.org/x/build v0.0.0-20190111050920-041ab4dc3f9d/go.mod h1:OWs+y06UdEOHN4y+MfF/py+xQ/tYqIWW03b70/CG9Rw=
 golang.org/x/crypto v0.0.0-20170930174604-9419663f5a44/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -1817,8 +1825,8 @@ golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1833,8 +1841,8 @@ golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
 golang.org/x/exp v0.0.0-20200331195152-e8c3332aa8e5/go.mod h1:4M0jN8W1tt0AVLNr8HDosyJCDCDuyL9N9+3m7wDWgKw=
-golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611 h1:qCEDpW1G+vcj3Y7Fy52pEM1AWm3abj8WimGYejI3SC4=
-golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
+golang.org/x/exp v0.0.0-20240119083558-1b970713d09a h1:Q8/wZp0KX97QFTc2ywcOE0YRjZPVIx+MXInMzdvQqcA=
+golang.org/x/exp v0.0.0-20240119083558-1b970713d09a/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -1862,6 +1870,7 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180719180050-a680a1efc54d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1931,8 +1940,9 @@ golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su
 golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220412020605-290c469a71a5/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
 golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
+golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -1954,8 +1964,8 @@ golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
 golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.13.0 h1:jDDenyj+WgFtmV3zYVoi8aE2BwtXFLWOA67ZfNWftiY=
-golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
+golang.org/x/oauth2 v0.16.0 h1:aDkGMBSYxElaoP81NpoUoz2oo2R2wHdZpGToUxfyQrQ=
+golang.org/x/oauth2 v0.16.0/go.mod h1:hqZ+0LWXsiVoZpeld6jVt06P3adbS2Uu911W1SsJv2o=
 golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852/go.mod h1:JLpeXjPJfIyPr5TlbXLkXWLhP8nz10XfvxElABhCtcw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1968,8 +1978,9 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180810173357-98c5dad5d1a0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -2085,21 +2096,23 @@ golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
+golang.org/x/term v0.16.0 h1:m+B6fahuftsE9qjo0VWp2FW0mB3MTJvR0BaMQrq0pmE=
+golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2109,6 +2122,7 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -2189,19 +2203,20 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.16.0 h1:GO788SKMRunPIBCXiQyo2AaexLstOrVhuAL5YwsckQM=
-golang.org/x/tools v0.16.0/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
+golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 gonum.org/v1/gonum v0.0.0-20180816165407-929014505bf4/go.mod h1:Y+Yx5eoAFn32cQvJDxZx5Dpnq+c3wtXuadVZAcxbbBo=
 gonum.org/v1/gonum v0.6.1/go.mod h1:9mxDZsDKxgMAuccQkewq682L+0eCu4dCN2yonUJTCLU=
-gonum.org/v1/gonum v0.13.0 h1:a0T3bh+7fhRyqeNbiC3qVHYmkiQgit3wnNan/2c0HMM=
-gonum.org/v1/gonum v0.13.0/go.mod h1:/WPYRckkfWrhWefxyYTfrTtQR0KH4iyHNuzxqXAKyAU=
+gonum.org/v1/gonum v0.14.0 h1:2NiG67LD1tEH0D7kM+ps2V+fXmsAnpUeec7n8tcr4S0=
+gonum.org/v1/gonum v0.14.0/go.mod h1:AoWeoz0becf9QMWtE8iWXNXc27fK4fNeHNf/oMejGfU=
 gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
 gonum.org/v1/plot v0.0.0-20190515093506-e2840ee46a6b/go.mod h1:Wt8AAjI+ypCyYX3nZBvf6cAIx93T+c/OS2HFAYskSZc=
 google.golang.org/api v0.0.0-20180910000450-7ca32eb868bf/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
@@ -2256,8 +2271,9 @@ google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7
 google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20180518175338-11a468237815/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20180831171423-11092d34479b/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
@@ -2346,14 +2362,14 @@ google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3/go.mod h1:8w6bsBMX
 google.golang.org/genproto v0.0.0-20220429170224-98d788798c3e/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
 google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20220518221133-4f43b3371335/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b h1:+YaDE2r2OG8t/z5qmsh7Y+XXwCbvadxxZ0YY6mTdrVA=
-google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:CgAqfJo+Xmu0GwA0411Ht3OU3OntXwsGmrmjI8ioGXI=
-google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b h1:CIC2YMXmIhYw6evmhPxBKJ4fmLbOFtXQN/GV3XOZR8k=
-google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:IBQ646DjkDkvUIsVq/cc03FUFQ9wbZu7yE396YcL870=
+google.golang.org/genproto v0.0.0-20240102182953-50ed04b92917 h1:nz5NESFLZbJGPFxDT/HCn+V1mZ8JGNoY4nUpmW/Y2eg=
+google.golang.org/genproto v0.0.0-20240102182953-50ed04b92917/go.mod h1:pZqR+glSb11aJ+JQcczCvgf47+duRuzNSKqE8YAQnV0=
+google.golang.org/genproto/googleapis/api v0.0.0-20240108191215-35c7eff3a6b1 h1:OPXtXn7fNMaXwO3JvOmF1QyTc00jsSFFz1vXXBOdCDo=
+google.golang.org/genproto/googleapis/api v0.0.0-20240108191215-35c7eff3a6b1/go.mod h1:B5xPO//w8qmBDjGReYLpR6UJPnkldGkCSMoH/2vxJeg=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20231030173426-d783a09b4405 h1:o4S3HvTUEXgRsNSUQsALDVog0O9F/U1JJlHmmUN8Uas=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20231030173426-d783a09b4405/go.mod h1:GRUCuLdzVqZte8+Dl/D4N25yLzcGqqWaYkeVOwulFqw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405 h1:AB/lmRny7e2pLhFEYIbl5qkDAUt2h0ZRO4wGPhZf+ik=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405/go.mod h1:67X1fPuzjcrkymZzZV1vvkFeTn2Rvc6lYF9MYFGCcwE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240108191215-35c7eff3a6b1 h1:gphdwh0npgs8elJ4T6J+DQJHPVF7RsuJHCfwztUb4J4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240108191215-35c7eff3a6b1/go.mod h1:daQN87bsDqDoe316QbbvX60nMoJQa4r6Ds0ZuoAe5yA=
 google.golang.org/grpc v1.12.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.16.0/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
@@ -2390,12 +2406,11 @@ google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnD
 google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
 google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
 google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
 google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
-google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
+google.golang.org/grpc v1.60.1 h1:26+wFr+cNqSGFcOXcabYC0lUVJVRa2Sb2ortSK7VrEU=
+google.golang.org/grpc v1.60.1/go.mod h1:OlCHIeLYqSSsLi6i49B5QGdzaMZK9+M7LXN2FKz4eGM=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0 h1:TLkBREm4nIsEcexnCjgQd5GQWaHcqMzwQV0TX9pq8S0=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0/go.mod h1:DNq5QpG7LJqD2AamLZ7zvKE0DEpVl2BSEVjFycAAjRY=
@@ -2413,8 +2428,8 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
+google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -2474,8 +2489,9 @@ lukechampine.com/blake3 v1.2.1/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1
 nhooyr.io/websocket v1.8.6/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
 nhooyr.io/websocket v1.8.7 h1:usjR2uOr/zjjkVMy0lW+PPohFok7PCow5sDjLgX4P4g=
 nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
-pgregory.net/rapid v0.4.7 h1:MTNRktPuv5FNqOO151TM9mDTa+XHcX6ypYeISDVD14g=
 pgregory.net/rapid v0.4.7/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
+pgregory.net/rapid v1.1.0 h1:CMa0sjHSru3puNx+J0MIAuiiEV4N0qj8/cMWGBBCsjw=
+pgregory.net/rapid v1.1.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
diff --git a/insecure/Makefile b/insecure/Makefile
index f38a03381b3..b9d8101f592 100644
--- a/insecure/Makefile
+++ b/insecure/Makefile
@@ -1,6 +1,10 @@
 # Name of the cover profile
 COVER_PROFILE := cover.out
 
+# By default, this will run all tests in all packages, but we have a way to override this in CI so that we can
+# dynamically split up CI jobs into smaller jobs that can be run in parallel
+GO_TEST_PACKAGES := ./...
+
 # allows CI to specify whether to have race detection on / off
 ifeq ($(RACE_DETECTOR),1)
 	RACE_FLAG := -race
@@ -8,14 +12,13 @@ else
 	RACE_FLAG :=
 endif
 
+# set `CRYPTO_FLAG` when building natively (not cross-compiling)
 include ../crypto_adx_flag.mk
 
-CGO_FLAG := CGO_CFLAGS=$(CRYPTO_FLAG)
-
 # runs all unit tests of the insecure module
 .PHONY: test
 test:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) -coverprofile=$(COVER_PROFILE) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test $(if $(VERBOSE),-v,) -coverprofile=$(COVER_PROFILE) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) $(GO_TEST_PACKAGES)
 
 .PHONY: lint
 lint: tidy
diff --git a/insecure/cmd/mods_override.sh b/insecure/cmd/mods_override.sh
index ef0a732da73..8f05aa7bc7f 100755
--- a/insecure/cmd/mods_override.sh
+++ b/insecure/cmd/mods_override.sh
@@ -6,7 +6,7 @@ cp ./go.mod ./go2.mod
 cp ./go.sum ./go2.sum
 
 # inject forked libp2p-pubsub into main module to allow building corrupt Docker images
-echo "require github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20230703223453-544e2fe28a26" >> ./go.mod
+echo "require github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20240220190333-03695dea34a3" >> ./go.mod
 
 # update go.sum since added new dependency
 go mod tidy
diff --git a/insecure/corruptlibp2p/libp2p_node_factory.go b/insecure/corruptlibp2p/libp2p_node_factory.go
index 5bc70a50f0c..79002c1c6ed 100644
--- a/insecure/corruptlibp2p/libp2p_node_factory.go
+++ b/insecure/corruptlibp2p/libp2p_node_factory.go
@@ -164,5 +164,5 @@ func CorruptGossipSubConfigFactoryWithInspector(inspector func(peer.ID, *corrupt
 
 func overrideWithCorruptGossipSub(builder p2p.NodeBuilder, opts ...CorruptPubSubAdapterConfigOption) {
 	factory := CorruptGossipSubFactory()
-	builder.SetGossipSubFactory(factory, CorruptGossipSubConfigFactory(opts...))
+	builder.OverrideGossipSubFactory(factory, CorruptGossipSubConfigFactory(opts...))
 }
diff --git a/insecure/corruptlibp2p/pubsub_adapter_config.go b/insecure/corruptlibp2p/pubsub_adapter_config.go
index 1bae78dd872..adc3337d629 100644
--- a/insecure/corruptlibp2p/pubsub_adapter_config.go
+++ b/insecure/corruptlibp2p/pubsub_adapter_config.go
@@ -153,7 +153,7 @@ func (c *CorruptPubSubAdapterConfig) ScoreTracer() p2p.PeerScoreTracer {
 	return c.scoreTracer
 }
 
-func (c *CorruptPubSubAdapterConfig) WithInspectorSuite(_ p2p.GossipSubInspectorSuite) {
+func (c *CorruptPubSubAdapterConfig) WithRpcInspector(_ p2p.GossipSubRPCInspector) {
 	// CorruptPubSub does not support inspector suite. This is a no-op.
 }
 
diff --git a/insecure/corruptnet/network_egress_test.go b/insecure/corruptnet/network_egress_test.go
index c2b807990fa..072f4394a9f 100644
--- a/insecure/corruptnet/network_egress_test.go
+++ b/insecure/corruptnet/network_egress_test.go
@@ -13,11 +13,11 @@ import (
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 
-	"github.com/onflow/flow-go/engine/testutil"
 	"github.com/onflow/flow-go/insecure"
 	mockinsecure "github.com/onflow/flow-go/insecure/mock"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/libp2p/message"
+	"github.com/onflow/flow-go/module/local"
 	"github.com/onflow/flow-go/network/mocknetwork"
 	"github.com/onflow/flow-go/utils/unittest"
 )
@@ -26,16 +26,20 @@ import (
 // The attacker is mocked out in this test.
 func TestHandleOutgoingEvent_AttackerRegistered(t *testing.T) {
 	codec := unittest.NetworkCodec()
-	corruptedIdentity := unittest.IdentityFixture(unittest.WithAddress(insecure.DefaultAddress))
+	corruptedIdentity := unittest.PrivateNodeInfoFixture(unittest.WithAddress(insecure.DefaultAddress))
 	flowNetwork := mocknetwork.NewNetwork(t)
 	ccf := mockinsecure.NewCorruptConduitFactory(t)
 	ccf.On("RegisterEgressController", mock.Anything).Return(nil)
 
+	privateKeys, err := corruptedIdentity.PrivateKeys()
+	require.NoError(t, err)
+	me, err := local.New(corruptedIdentity.Identity().IdentitySkeleton, privateKeys.StakingKey)
+	require.NoError(t, err)
 	corruptNetwork, err := NewCorruptNetwork(
 		unittest.Logger(),
 		flow.BftTestnet,
 		insecure.DefaultAddress,
-		testutil.LocalFixture(t, corruptedIdentity),
+		me,
 		codec,
 		flowNetwork,
 		ccf)
diff --git a/insecure/corruptnet/network_test_helper.go b/insecure/corruptnet/network_test_helper.go
index 11b45734575..1f7ff8b1cf4 100644
--- a/insecure/corruptnet/network_test_helper.go
+++ b/insecure/corruptnet/network_test_helper.go
@@ -9,20 +9,17 @@ import (
 	"testing"
 	"time"
 
-	"github.com/stretchr/testify/mock"
-
 	"github.com/rs/zerolog"
-
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
 	grpcinsecure "google.golang.org/grpc/credentials/insecure"
 
 	"github.com/onflow/flow-go/insecure"
-	"github.com/onflow/flow-go/module/irrecoverable"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/onflow/flow-go/engine/testutil"
+	"github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/irrecoverable"
+	"github.com/onflow/flow-go/module/local"
 	"github.com/onflow/flow-go/network/mocknetwork"
 	"github.com/onflow/flow-go/utils/unittest"
 )
@@ -31,14 +28,14 @@ import (
 // By default, no attacker is registered on this corruptible network.
 // This function is not meant to be used by tests directly because it expects the corrupt network to be properly started and stopped.
 // Otherwise, it will throw mock expectations errors.
-func corruptNetworkFixture(t *testing.T, logger zerolog.Logger, corruptedID ...*flow.Identity) (*Network, *mocknetwork.Adapter) {
+func corruptNetworkFixture(t *testing.T, logger zerolog.Logger, corruptedID ...flow.Identifier) (*Network, *mocknetwork.Adapter, bootstrap.NodeInfo) {
 	// create corruptible network with no attacker registered
 	codec := unittest.NetworkCodec()
 
-	corruptedIdentity := unittest.IdentityFixture(unittest.WithAddress(insecure.DefaultAddress))
+	corruptedIdentity := unittest.PrivateNodeInfoFixture(unittest.WithAddress(insecure.DefaultAddress))
 	// some tests will want to create corruptible network with a specific ID
 	if len(corruptedID) > 0 {
-		corruptedIdentity = corruptedID[0]
+		corruptedIdentity.NodeID = corruptedID[0]
 	}
 
 	flowNetwork := mocknetwork.NewNetwork(t)
@@ -65,18 +62,22 @@ func corruptNetworkFixture(t *testing.T, logger zerolog.Logger, corruptedID ...*
 	err := ccf.RegisterAdapter(adapter)
 	require.NoError(t, err)
 
+	private, err := corruptedIdentity.PrivateKeys()
+	require.NoError(t, err)
+	me, err := local.New(corruptedIdentity.Identity().IdentitySkeleton, private.StakingKey)
+	require.NoError(t, err)
 	corruptibleNetwork, err := NewCorruptNetwork(
 		logger,
 		flow.BftTestnet,
 		insecure.DefaultAddress,
-		testutil.LocalFixture(t, corruptedIdentity),
+		me,
 		codec,
 		flowNetwork,
 		ccf)
 	require.NoError(t, err)
 
 	// return adapter so callers can set up test specific expectations
-	return corruptibleNetwork, adapter
+	return corruptibleNetwork, adapter, corruptedIdentity
 }
 
 // runCorruptNetworkTest creates and starts a corruptible network, runs the "run" function of a simulated attacker and then
@@ -89,8 +90,6 @@ func runCorruptNetworkTest(t *testing.T, logger zerolog.Logger,
 		insecure.CorruptNetwork_ProcessAttackerMessageClient, // gRPC interface that orchestrator network uses to send messages to this ccf.
 	)) {
 
-	corruptedIdentity := unittest.IdentityFixture(unittest.WithAddress(insecure.DefaultAddress))
-
 	// life-cycle management of corruptible network
 	ctx, cancel := context.WithCancel(context.Background())
 	ccfCtx, errChan := irrecoverable.WithSignaler(ctx)
@@ -103,7 +102,8 @@ func runCorruptNetworkTest(t *testing.T, logger zerolog.Logger,
 		}
 	}()
 
-	corruptibleNetwork, adapter := corruptNetworkFixture(t, logger, corruptedIdentity)
+	corruptedIdentifier := unittest.IdentifierFixture()
+	corruptibleNetwork, adapter, corruptedIdentity := corruptNetworkFixture(t, logger, corruptedIdentifier)
 
 	// start corruptible network
 	corruptibleNetwork.Start(ccfCtx)
@@ -124,7 +124,7 @@ func runCorruptNetworkTest(t *testing.T, logger zerolog.Logger,
 	stream, err := client.ProcessAttackerMessage(context.Background())
 	require.NoError(t, err)
 
-	run(*corruptedIdentity, corruptibleNetwork, adapter, stream)
+	run(*corruptedIdentity.Identity(), corruptibleNetwork, adapter, stream)
 
 	// terminates orchestratorNetwork
 	cancel()
diff --git a/insecure/go.mod b/insecure/go.mod
index 7e6bc5a1bee..3195eeaa334 100644
--- a/insecure/go.mod
+++ b/insecure/go.mod
@@ -7,25 +7,25 @@ require (
 	github.com/golang/protobuf v1.5.3
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/ipfs/go-datastore v0.6.0
-	github.com/libp2p/go-libp2p v0.28.1
-	github.com/libp2p/go-libp2p-pubsub v0.9.3
+	github.com/libp2p/go-libp2p v0.32.2
+	github.com/libp2p/go-libp2p-pubsub v0.10.0
 	github.com/multiformats/go-multiaddr-dns v0.3.1
-	github.com/onflow/crypto v0.25.0
+	github.com/onflow/crypto v0.25.1
 	github.com/onflow/flow-go v0.32.4-0.20231130134727-3c01c7f8966c
 	github.com/rs/zerolog v1.29.0
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.8.4
-	github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20230703223453-544e2fe28a26
+	github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20240220190333-03695dea34a3 // libp2p v0.32.0
 	go.uber.org/atomic v1.11.0
-	google.golang.org/grpc v1.59.0
-	google.golang.org/protobuf v1.31.0
+	google.golang.org/grpc v1.60.1
+	google.golang.org/protobuf v1.32.0
 )
 
 require (
-	cloud.google.com/go v0.110.8 // indirect
-	cloud.google.com/go/compute v1.23.1 // indirect
+	cloud.google.com/go v0.111.0 // indirect
+	cloud.google.com/go/compute v1.23.3 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	cloud.google.com/go/iam v1.1.3 // indirect
+	cloud.google.com/go/iam v1.1.5 // indirect
 	cloud.google.com/go/storage v1.30.1 // indirect
 	github.com/DataDog/zstd v1.5.2 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
@@ -49,7 +49,7 @@ require (
 	github.com/aws/smithy-go v1.17.0 // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bits-and-blooms/bitset v1.7.0 // indirect
+	github.com/bits-and-blooms/bitset v1.10.0 // indirect
 	github.com/btcsuite/btcd/btcec/v2 v2.2.1 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
@@ -80,20 +80,20 @@ require (
 	github.com/ef-ds/deque v1.0.4 // indirect
 	github.com/elastic/gosigar v0.14.2 // indirect
 	github.com/ethereum/c-kzg-4844 v0.4.0 // indirect
-	github.com/ethereum/go-ethereum v1.13.5 // indirect
-	github.com/flynn/noise v1.0.0 // indirect
+	github.com/ethereum/go-ethereum v1.13.10 // indirect
+	github.com/flynn/noise v1.0.1 // indirect
 	github.com/francoispqt/gojay v1.2.13 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.4.1-0.20230228173756-c0c9f774e40c // indirect
 	github.com/fxamacker/circlehash v0.3.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
 	github.com/gammazero/deque v0.1.0 // indirect
 	github.com/gammazero/workerpool v1.1.2 // indirect
 	github.com/getsentry/sentry-go v0.18.0 // indirect
 	github.com/go-kit/kit v0.12.0 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
-	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
@@ -109,9 +109,9 @@ require (
 	github.com/golang/mock v1.6.0 // indirect
 	github.com/golang/snappy v0.0.5-0.20220116011046-fa5810519dcb // indirect
 	github.com/google/gopacket v1.1.19 // indirect
-	github.com/google/pprof v0.0.0-20230602150820-91b7bce49751 // indirect
+	github.com/google/pprof v0.0.0-20231229205709-960ae82b1e42 // indirect
 	github.com/google/s2a-go v0.1.7 // indirect
-	github.com/google/uuid v1.4.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
@@ -119,19 +119,19 @@ require (
 	github.com/grpc-ecosystem/go-grpc-middleware/providers/zerolog/v2 v2.0.0-rc.2 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.0-rc.2 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/golang-lru v0.5.4 // indirect
-	github.com/hashicorp/golang-lru/v2 v2.0.2 // indirect
+	github.com/hashicorp/golang-lru v1.0.2 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/holiman/bloomfilter/v2 v2.0.3 // indirect
-	github.com/holiman/uint256 v1.2.3 // indirect
+	github.com/holiman/uint256 v1.2.4 // indirect
 	github.com/huin/goupnp v1.3.0 // indirect
 	github.com/improbable-eng/grpc-web v0.15.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
-	github.com/ipfs/boxo v0.10.0 // indirect
-	github.com/ipfs/go-block-format v0.1.2 // indirect
+	github.com/ipfs/boxo v0.17.0 // indirect
+	github.com/ipfs/go-block-format v0.2.0 // indirect
 	github.com/ipfs/go-blockservice v0.4.0 // indirect
 	github.com/ipfs/go-cid v0.4.1 // indirect
 	github.com/ipfs/go-cidutil v0.1.0 // indirect
@@ -143,22 +143,22 @@ require (
 	github.com/ipfs/go-ipfs-exchange-interface v0.2.0 // indirect
 	github.com/ipfs/go-ipfs-pq v0.0.3 // indirect
 	github.com/ipfs/go-ipfs-provider v0.7.0 // indirect
-	github.com/ipfs/go-ipfs-util v0.0.2 // indirect
-	github.com/ipfs/go-ipld-format v0.5.0 // indirect
+	github.com/ipfs/go-ipfs-util v0.0.3 // indirect
+	github.com/ipfs/go-ipld-format v0.6.0 // indirect
 	github.com/ipfs/go-log v1.0.5 // indirect
 	github.com/ipfs/go-log/v2 v2.5.1 // indirect
 	github.com/ipfs/go-metrics-interface v0.0.1 // indirect
 	github.com/ipfs/go-peertaskqueue v0.8.1 // indirect
 	github.com/ipfs/go-verifcid v0.0.1 // indirect
-	github.com/ipld/go-ipld-prime v0.20.0 // indirect
+	github.com/ipld/go-ipld-prime v0.21.0 // indirect
 	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
 	github.com/jbenet/go-temp-err-catcher v0.1.0 // indirect
 	github.com/jbenet/goprocess v0.1.4 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/k0kubun/pp/v3 v3.2.0 // indirect
 	github.com/kevinburke/go-bindata v3.23.0+incompatible // indirect
-	github.com/klauspost/compress v1.16.5 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.5 // indirect
+	github.com/klauspost/compress v1.17.4 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.6 // indirect
 	github.com/koron/go-ssdp v0.0.4 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
@@ -167,25 +167,25 @@ require (
 	github.com/libp2p/go-buffer-pool v0.1.0 // indirect
 	github.com/libp2p/go-cidranger v1.1.0 // indirect
 	github.com/libp2p/go-flow-metrics v0.1.0 // indirect
-	github.com/libp2p/go-libp2p-asn-util v0.3.0 // indirect
+	github.com/libp2p/go-libp2p-asn-util v0.4.1 // indirect
 	github.com/libp2p/go-libp2p-core v0.20.1 // indirect
-	github.com/libp2p/go-libp2p-kad-dht v0.24.2 // indirect
+	github.com/libp2p/go-libp2p-kad-dht v0.25.2 // indirect
 	github.com/libp2p/go-libp2p-kbucket v0.6.3 // indirect
 	github.com/libp2p/go-libp2p-record v0.2.0 // indirect
+	github.com/libp2p/go-libp2p-routing-helpers v0.7.3 // indirect
 	github.com/libp2p/go-msgio v0.3.0 // indirect
 	github.com/libp2p/go-nat v0.2.0 // indirect
 	github.com/libp2p/go-netroute v0.2.1 // indirect
-	github.com/libp2p/go-reuseport v0.3.0 // indirect
-	github.com/libp2p/go-yamux/v4 v4.0.0 // indirect
+	github.com/libp2p/go-reuseport v0.4.0 // indirect
+	github.com/libp2p/go-yamux/v4 v4.0.1 // indirect
 	github.com/logrusorgru/aurora/v4 v4.0.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/marten-seemann/tcp v0.0.0-20210406111302-dfbc87cc63fd // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19 // indirect
-	github.com/mattn/go-runewidth v0.0.14 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/miekg/dns v1.1.54 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
+	github.com/miekg/dns v1.1.57 // indirect
 	github.com/mikioh/tcpinfo v0.0.0-20190314235526-30a79bb1804b // indirect
 	github.com/mikioh/tcpopt v0.0.0-20190314235656-172688c1accc // indirect
 	github.com/minio/sha256-simd v1.0.1 // indirect
@@ -195,28 +195,27 @@ require (
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/multiformats/go-base32 v0.1.0 // indirect
 	github.com/multiformats/go-base36 v0.2.0 // indirect
-	github.com/multiformats/go-multiaddr v0.9.0 // indirect
+	github.com/multiformats/go-multiaddr v0.12.2 // indirect
 	github.com/multiformats/go-multiaddr-fmt v0.1.0 // indirect
 	github.com/multiformats/go-multibase v0.2.0 // indirect
 	github.com/multiformats/go-multicodec v0.9.0 // indirect
 	github.com/multiformats/go-multihash v0.2.3 // indirect
-	github.com/multiformats/go-multistream v0.4.1 // indirect
+	github.com/multiformats/go-multistream v0.5.0 // indirect
 	github.com/multiformats/go-varint v0.0.7 // indirect
-	github.com/nxadm/tail v1.4.8 // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
 	github.com/onflow/atree v0.6.0 // indirect
-	github.com/onflow/cadence v0.42.7 // indirect
-	github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1-0.20231219201108-fbdb10b0a2da // indirect
-	github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1-0.20231219201108-fbdb10b0a2da // indirect
+	github.com/onflow/cadence v0.42.10 // indirect
+	github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1 // indirect
+	github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1 // indirect
 	github.com/onflow/flow-ft/lib/go/contracts v0.7.1-0.20230711213910-baad011d2b13 // indirect
-	github.com/onflow/flow-go-sdk v0.44.0 // indirect
+	github.com/onflow/flow-go-sdk v0.46.0 // indirect
 	github.com/onflow/flow-nft/lib/go/contracts v1.1.0 // indirect
-	github.com/onflow/flow/protobuf/go/flow v0.3.2-0.20231213135419-ae911cc351a2 // indirect
-	github.com/onflow/go-bitswap v0.0.0-20230703214630-6d3db958c73d // indirect
+	github.com/onflow/flow/protobuf/go/flow v0.3.7-0.20240404170900-c321c1475f1e // indirect
+	github.com/onflow/go-ethereum v1.13.4 // indirect
 	github.com/onflow/sdks v0.5.0 // indirect
-	github.com/onflow/wal v0.0.0-20230529184820-bc9f8244608d // indirect
-	github.com/onsi/ginkgo/v2 v2.9.7 // indirect
-	github.com/opencontainers/runtime-spec v1.0.2 // indirect
+	github.com/onflow/wal v0.0.0-20240208022732-d756cd497d3b // indirect
+	github.com/onsi/ginkgo/v2 v2.13.2 // indirect
+	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.6 // indirect
@@ -225,19 +224,18 @@ require (
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/polydawn/refmt v0.89.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
-	github.com/prometheus/client_golang v1.16.0 // indirect
-	github.com/prometheus/client_model v0.4.0 // indirect
-	github.com/prometheus/common v0.42.0 // indirect
-	github.com/prometheus/procfs v0.10.1 // indirect
+	github.com/prometheus/client_golang v1.18.0 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
+	github.com/prometheus/common v0.46.0 // indirect
+	github.com/prometheus/procfs v0.12.0 // indirect
 	github.com/psiemens/sconfig v0.1.0 // indirect
 	github.com/quic-go/qpack v0.4.0 // indirect
-	github.com/quic-go/qtls-go1-19 v0.3.2 // indirect
-	github.com/quic-go/qtls-go1-20 v0.2.2 // indirect
-	github.com/quic-go/quic-go v0.33.0 // indirect
-	github.com/quic-go/webtransport-go v0.5.3 // indirect
+	github.com/quic-go/qtls-go1-20 v0.4.1 // indirect
+	github.com/quic-go/quic-go v0.40.1 // indirect
+	github.com/quic-go/webtransport-go v0.6.0 // indirect
 	github.com/raulk/go-watchdog v1.3.0 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
-	github.com/rogpeppe/go-internal v1.9.0 // indirect
+	github.com/rogpeppe/go-internal v1.10.0 // indirect
 	github.com/rs/cors v1.8.0 // indirect
 	github.com/schollz/progressbar/v3 v3.13.1 // indirect
 	github.com/sethvargo/go-retry v0.2.3 // indirect
@@ -267,36 +265,36 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.2 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/otel v1.16.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0 // indirect
-	go.opentelemetry.io/otel/metric v1.16.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.16.0 // indirect
-	go.opentelemetry.io/otel/trace v1.16.0 // indirect
-	go.opentelemetry.io/proto/otlp v0.19.0 // indirect
-	go.uber.org/dig v1.17.0 // indirect
-	go.uber.org/fx v1.19.2 // indirect
+	go.opentelemetry.io/otel v1.22.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.22.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.21.0 // indirect
+	go.opentelemetry.io/otel/trace v1.22.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
+	go.uber.org/dig v1.17.1 // indirect
+	go.uber.org/fx v1.20.1 // indirect
+	go.uber.org/mock v0.4.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.24.0 // indirect
-	golang.org/x/crypto v0.17.0 // indirect
-	golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611 // indirect
+	go.uber.org/zap v1.26.0 // indirect
+	golang.org/x/crypto v0.18.0 // indirect
+	golang.org/x/exp v0.0.0-20240119083558-1b970713d09a // indirect
 	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/net v0.19.0 // indirect
-	golang.org/x/oauth2 v0.13.0 // indirect
-	golang.org/x/sync v0.5.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
-	golang.org/x/term v0.15.0 // indirect
+	golang.org/x/net v0.20.0 // indirect
+	golang.org/x/oauth2 v0.16.0 // indirect
+	golang.org/x/sync v0.6.0 // indirect
+	golang.org/x/sys v0.16.0 // indirect
+	golang.org/x/term v0.16.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.16.0 // indirect
-	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	gonum.org/v1/gonum v0.13.0 // indirect
+	golang.org/x/tools v0.17.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
+	gonum.org/v1/gonum v0.14.0 // indirect
 	google.golang.org/api v0.151.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto v0.0.0-20240102182953-50ed04b92917 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240108191215-35c7eff3a6b1 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240108191215-35c7eff3a6b1 // indirect
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/insecure/go.sum b/insecure/go.sum
index 4872f6e5f04..29793ab10f4 100644
--- a/insecure/go.sum
+++ b/insecure/go.sum
@@ -29,22 +29,22 @@ cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aD
 cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
 cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
 cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
-cloud.google.com/go v0.110.8 h1:tyNdfIxjzaWctIiLYOTalaLKZ17SI44SKFW26QbOhME=
-cloud.google.com/go v0.110.8/go.mod h1:Iz8AkXJf1qmxC3Oxoep8R1T36w8B92yU29PcBhHO5fk=
+cloud.google.com/go v0.111.0 h1:YHLKNupSD1KqjDbQ3+LVdQ81h/UJbJyZG203cEfnQgM=
+cloud.google.com/go v0.111.0/go.mod h1:0mibmpKP1TyOOFYQY5izo0LnT+ecvOQ0Sg3OdmMiNRU=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute v1.23.1 h1:V97tBoDaZHb6leicZ1G6DLK2BAaZLJ/7+9BB/En3hR0=
-cloud.google.com/go/compute v1.23.1/go.mod h1:CqB3xpmPKKt3OJpW2ndFIXnA9A4xAy/F3Xp1ixncW78=
+cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
+cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/iam v1.1.3 h1:18tKG7DzydKWUnLjonWcJO6wjSCAtzh4GcRKlH/Hrzc=
-cloud.google.com/go/iam v1.1.3/go.mod h1:3khUlaBXfPKKe7huYgEpDn6FtgRyMEqbkvBxrQyY5SE=
+cloud.google.com/go/iam v1.1.5 h1:1jTsCu4bcsNsE4iiqNT5SHwrDRCfRmIaaaVFhRveTJI=
+cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXEbzv8=
 cloud.google.com/go/kms v1.0.0/go.mod h1:nhUehi+w7zht2XrUfvTRNpxrfayBHqP4lu2NSywui/0=
 cloud.google.com/go/profiler v0.3.0 h1:R6y/xAeifaUXxd2x6w+jIwKxoKl8Cv5HJvcvASTPWJo=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
@@ -181,8 +181,8 @@ github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+Ce
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bits-and-blooms/bitset v1.7.0 h1:YjAGVd3XmtK9ktAbX8Zg2g2PwLIMjGREZJHlV4j7NEo=
-github.com/bits-and-blooms/bitset v1.7.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
+github.com/bits-and-blooms/bitset v1.10.0 h1:ePXTeiPEazB5+opbv5fr8umg2R/1NlzgDsyepwsSr88=
+github.com/bits-and-blooms/bitset v1.10.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
 github.com/btcsuite/btcd v0.0.0-20171128150713-2e60448ffcc6/go.mod h1:Dmm/EzmjnCiweXmzRIAiUWCInVmPgjkzgv5k4tVyXiQ=
 github.com/btcsuite/btcd v0.0.0-20190213025234-306aecffea32/go.mod h1:DrZx5ec/dmnfpw9KyYoQyYo7d0KEvTkk/5M/vbZjAr8=
@@ -234,11 +234,7 @@ github.com/cloudflare/cloudflare-go v0.10.2-0.20190916151808-a80f83b9add9/go.mod
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
 github.com/cockroachdb/datadriven v1.0.2/go.mod h1:a9RdTaap04u637JoCzcUoIcDmvwSUtcUFtT/C3kJlTU=
 github.com/cockroachdb/datadriven v1.0.3-0.20230413201302-be42291fc80f h1:otljaYPt5hWxV3MUfO5dFPFiOXg9CyG5/kCfayTqsJ4=
@@ -347,14 +343,13 @@ github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5y
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/etcd-io/bbolt v1.3.3/go.mod h1:ZF2nL25h33cCyBtcyWeZ2/I3HQOfTP+0PIEvHjkjCrw=
 github.com/ethereum/c-kzg-4844 v0.4.0 h1:3MS1s4JtA868KpJxroZoepdV0ZKBp3u/O5HcZ7R3nlY=
 github.com/ethereum/c-kzg-4844 v0.4.0/go.mod h1:VewdlzQmpT5QSrVhbBuGoCdFJkpaJlO1aQputP83wc0=
 github.com/ethereum/go-ethereum v1.9.9/go.mod h1:a9TqabFudpDu1nucId+k9S8R9whYaHnGBLKFouA5EAo=
-github.com/ethereum/go-ethereum v1.13.5 h1:U6TCRciCqZRe4FPXmy1sMGxTfuk8P7u2UoinF3VbaFk=
-github.com/ethereum/go-ethereum v1.13.5/go.mod h1:yMTu38GSuyxaYzQMViqNmQ1s3cE84abZexQmTgenWk0=
+github.com/ethereum/go-ethereum v1.13.10 h1:Ppdil79nN+Vc+mXfge0AuUgmKWuVv4eMqzoIVSdqZek=
+github.com/ethereum/go-ethereum v1.13.10/go.mod h1:sc48XYQxCzH3fG9BcrXCOOgQk2JfZzNAmIKnceogzsA=
 github.com/fasthttp-contrib/websocket v0.0.0-20160511215533-1f3b11f56072/go.mod h1:duJ4Jxv5lDcvg4QuQr0oowTf7dz4/CR8NtyCooz9HL8=
 github.com/fatih/color v1.3.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
@@ -362,15 +357,16 @@ github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga
 github.com/fjl/memsize v0.0.0-20180418122429-ca190fb6ffbc/go.mod h1:VvhXpOYNQvB+uIk2RvXzuaQtkQJzzIx6lSBe1xv7hi0=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/flynn/noise v0.0.0-20180327030543-2492fe189ae6/go.mod h1:1i71OnUq3iUe1ma7Lr6yG6/rjvM3emb6yoL7xLFzcVQ=
-github.com/flynn/noise v1.0.0 h1:DlTHqmzmvcEiKj+4RYo/imoswx/4r6iBlCMfVtrMXpQ=
 github.com/flynn/noise v1.0.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
+github.com/flynn/noise v1.0.1 h1:vPp/jdQLXC6ppsXSj/pM3W1BIJ5FEHE2TulSJBpb43Y=
+github.com/flynn/noise v1.0.1/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
 github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
 github.com/francoispqt/gojay v1.2.13 h1:d2m3sFjloqoIUQU3TsHBgj6qg/BVGlTBeHDUmyJnXKk=
 github.com/francoispqt/gojay v1.2.13/go.mod h1:ehT5mTG4ua4581f1++1WLG0vPdaA9HaiDsoyrBGkyDY=
 github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
 github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
-github.com/frankban/quicktest v1.14.4 h1:g2rn0vABPOOXmZUj+vbmUp0lPoXEMuhTpIluN0XL9UY=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
@@ -381,8 +377,8 @@ github.com/fxamacker/cbor/v2 v2.4.1-0.20230228173756-c0c9f774e40c/go.mod h1:TA1x
 github.com/fxamacker/circlehash v0.1.0/go.mod h1:3aq3OfVvsWtkWMb6A1owjOQFA+TLsD5FgJflnaQwtMM=
 github.com/fxamacker/circlehash v0.3.0 h1:XKdvTtIJV9t7DDUtsf0RIpC1OcxZtPbmgIH7ekx28WA=
 github.com/fxamacker/circlehash v0.3.0/go.mod h1:3aq3OfVvsWtkWMb6A1owjOQFA+TLsD5FgJflnaQwtMM=
-github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
-github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
+github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
+github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
 github.com/gammazero/deque v0.1.0 h1:f9LnNmq66VDeuAlSAapemq/U7hJ2jpIWa4c09q8Dlik=
 github.com/gammazero/deque v0.1.0/go.mod h1:KQw7vFau1hHuM8xmI9RbgKFbAsQFWmBpqQ2KenFLk6M=
 github.com/gammazero/workerpool v1.1.2 h1:vuioDQbgrz4HoaCi2q1HLlOXdpbap5AET7xu5/qj87g=
@@ -420,8 +416,8 @@ github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG
 github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
 github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
-github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-martini/martini v0.0.0-20170121215854-22fa46961aab/go.mod h1:/P9AEU963A2AYjv4d1V5eVL1CQbEJq6aCNHDDjibzu8=
@@ -450,12 +446,12 @@ github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEe
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
 github.com/go-test/deep v1.0.5/go.mod h1:QV8Hv/iy04NyLBxAdO9njL0iVPN1S4d/A3NVv1V36o8=
 github.com/go-yaml/yaml v2.1.0+incompatible/go.mod h1:w2MrLa16VYP0jy6N7M5kHaCkaLENm+P+Tv+MfurjSw0=
-github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee h1:s+21KNqlpePfkah2I+gwHF8xmJWRjooY+5248k6m4A0=
 github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
-github.com/gobwas/pool v0.2.0 h1:QEmUOlnSjWtnpRGHF3SauEiOsy82Cup83Vf2LcMlnc8=
+github.com/gobwas/httphead v0.1.0 h1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=
 github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
-github.com/gobwas/ws v1.0.2 h1:CoAavW/wd/kulfZmSIBt6p24n4j7tHgNVCjsfHVNUbo=
+github.com/gobwas/pool v0.2.1 h1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=
 github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
+github.com/gobwas/ws v1.2.1 h1:F2aeBZrm2NDsc7vbovKrWSogd4wvfAxg0FQ89/iqOTk=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
@@ -477,7 +473,6 @@ github.com/gogo/status v1.1.0/go.mod h1:BFv9nrluPLmrS0EmGVvLaPNmRosr9KapBYd5/hpY
 github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
 github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
 github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -570,8 +565,8 @@ github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20230602150820-91b7bce49751 h1:hR7/MlvK23p6+lIw9SN1TigNLn9ZnF3W4SYRKq2gAHs=
-github.com/google/pprof v0.0.0-20230602150820-91b7bce49751/go.mod h1:Jh3hGz2jkYak8qXPD19ryItVnUgpgeqzdkY/D0EaeuA=
+github.com/google/pprof v0.0.0-20231229205709-960ae82b1e42 h1:dHLYa5D8/Ta0aLR2XcPsrkpAgGeFs6thhMcQK0oQ0n8=
+github.com/google/pprof v0.0.0-20231229205709-960ae82b1e42/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
 github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
@@ -580,8 +575,8 @@ github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4=
-github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
 github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
 github.com/googleapis/gax-go v2.0.0+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
@@ -623,9 +618,8 @@ github.com/grpc-ecosystem/grpc-gateway v1.5.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpg
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 h1:lLT7ZLSzGLI08vc9cpd+tYmNWjdKDqyr/2L+f6U12Fk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 h1:Wqo399gCIufwto+VfwCSvsnfGpF/w5E9CNxSwbpD6No=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0/go.mod h1:qmOFXW2epJhM0qSnUUYpldc7gVz2KMQwJ/QYCDIa7XU=
 github.com/gxed/hashland/keccakpg v0.0.1/go.mod h1:kRzw3HkwxFU1mpmPP8v1WyQzwdGfmKFJ6tItnhQ67kU=
 github.com/gxed/hashland/murmur3 v0.0.1/go.mod h1:KjXop02n4/ckmZSnY2+HKcLud/tcmvhST0bie/0lS48=
 github.com/hashicorp/consul/api v1.3.0/go.mod h1:MmDNSzIMUjNpY/mQ398R4bk2FnqQLoPndWW5VkKPlCE=
@@ -649,10 +643,11 @@ github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA
 github.com/hashicorp/golang-lru v0.0.0-20160813221303-0a025b7e63ad/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/hashicorp/golang-lru/v2 v2.0.2 h1:Dwmkdr5Nc/oBiXgJS3CDHNhJtIHkuZ3DZF5twqnfBdU=
-github.com/hashicorp/golang-lru/v2 v2.0.2/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
+github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
@@ -661,8 +656,8 @@ github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2p
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
 github.com/holiman/bloomfilter/v2 v2.0.3 h1:73e0e/V0tCydx14a0SCYS/EWCxgwLZ18CZcZKVu0fao=
 github.com/holiman/bloomfilter/v2 v2.0.3/go.mod h1:zpoh+gs7qcpqrHr3dB55AMiJwo0iURXE7ZOP9L9hSkA=
-github.com/holiman/uint256 v1.2.3 h1:K8UWO1HUJpRMXBxbmaY1Y8IAMZC/RsKB+ArEnnK4l5o=
-github.com/holiman/uint256 v1.2.3/go.mod h1:SC8Ryt4n+UBbPbIBKaG9zbbDlp4jOru9xFZmPzLUTxw=
+github.com/holiman/uint256 v1.2.4 h1:jUc4Nk8fm9jZabQuqr2JzednajVmBpC+oiTiXZJEApU=
+github.com/holiman/uint256 v1.2.4/go.mod h1:EOMSn4q6Nyt9P6efbI3bueV4e1b3dGlUCXeiRV4ng7E=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/hudl/fargo v1.3.0/go.mod h1:y3CKSmjA+wD2gak7sUSXTAoopbhU08POFhmITJgmKTg=
 github.com/huin/goupnp v0.0.0-20161224104101-679507af18f3/go.mod h1:MZ2ZmwcBpvOoJ22IJsc7va19ZwoheaBk43rKg12SKag=
@@ -684,8 +679,8 @@ github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod
 github.com/ipfs/bbloom v0.0.1/go.mod h1:oqo8CVWsJFMOZqTglBG4wydCE4IQA/G2/SEofB0rjUI=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.10.0 h1:tdDAxq8jrsbRkYoF+5Rcqyeb91hgWe2hp7iLu7ORZLY=
-github.com/ipfs/boxo v0.10.0/go.mod h1:Fg+BnfxZ0RPzR0nOodzdIq3A7KgoWAOWsEIImrIQdBM=
+github.com/ipfs/boxo v0.17.0 h1:fVXAb12dNbraCX1Cdid5BB6Kl62gVLNVA+e0EYMqAU0=
+github.com/ipfs/boxo v0.17.0/go.mod h1:pIZgTWdm3k3pLF9Uq6MB8JEcW07UDwNJjlXW1HELW80=
 github.com/ipfs/go-bitswap v0.1.8/go.mod h1:TOWoxllhccevbWFUR2N7B1MTSVVge1s6XSMiCSA4MzM=
 github.com/ipfs/go-bitswap v0.3.4/go.mod h1:4T7fvNv/LmOys+21tnLzGKncMeeXUYUd1nUiJ2teMvI=
 github.com/ipfs/go-bitswap v0.5.0/go.mod h1:WwyyYD33RHCpczgHjpx+xjWYIy8l41K+l5EMy4/ctSM=
@@ -693,8 +688,8 @@ github.com/ipfs/go-bitswap v0.9.0 h1:/dZi/XhUN/aIk78pI4kaZrilUglJ+7/SCmOHWIpiy8E
 github.com/ipfs/go-block-format v0.0.1/go.mod h1:DK/YYcsSUIVAFNwo/KZCdIIbpN0ROH/baNLgayt4pFc=
 github.com/ipfs/go-block-format v0.0.2/go.mod h1:AWR46JfpcObNfg3ok2JHDUfdiHRgWhJgCQF+KIgOPJY=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
-github.com/ipfs/go-block-format v0.1.2 h1:GAjkfhVx1f4YTODS6Esrj1wt2HhrtwTnhEr+DyPUaJo=
-github.com/ipfs/go-block-format v0.1.2/go.mod h1:mACVcrxarQKstUU3Yf/RdwbC4DzPV6++rO2a3d+a/KE=
+github.com/ipfs/go-block-format v0.2.0 h1:ZqrkxBA2ICbDRbK8KJs/u0O3dlp6gmAuuXUJNiW1Ycs=
+github.com/ipfs/go-block-format v0.2.0/go.mod h1:+jpL11nFx5A/SPpsoBn6Bzkra/zaArfSmsknbPMYgzM=
 github.com/ipfs/go-blockservice v0.1.4/go.mod h1:OTZhFpkgY48kNzbgyvcexW9cHrpjBYIjSR0KoDOFOLU=
 github.com/ipfs/go-blockservice v0.2.0/go.mod h1:Vzvj2fAnbbyly4+T7D5+p9n3+ZKVHA2bRMMo1QoILtQ=
 github.com/ipfs/go-blockservice v0.4.0 h1:7MUijAW5SqdsqEW/EhnNFRJXVF8mGU5aGhZ3CQaCWbY=
@@ -767,10 +762,11 @@ github.com/ipfs/go-ipfs-routing v0.1.0/go.mod h1:hYoUkJLyAUKhF58tysKpids8RNDPO42
 github.com/ipfs/go-ipfs-routing v0.2.0/go.mod h1:384byD/LHKhAgKE3NmwOjXCpDzhczROMBzidoYV7tfM=
 github.com/ipfs/go-ipfs-routing v0.2.1 h1:E+whHWhJkdN9YeoHZNj5itzc+OR292AJ2uE9FFiW0BY=
 github.com/ipfs/go-ipfs-util v0.0.1/go.mod h1:spsl5z8KUnrve+73pOhSVZND1SIxPW5RyBCNzQxlJBc=
-github.com/ipfs/go-ipfs-util v0.0.2 h1:59Sswnk1MFaiq+VcaknX7aYEyGyGDAA73ilhEK2POp8=
 github.com/ipfs/go-ipfs-util v0.0.2/go.mod h1:CbPtkWJzjLdEcezDns2XYaehFVNXG9zrdrtMecczcsQ=
-github.com/ipfs/go-ipld-format v0.5.0 h1:WyEle9K96MSrvr47zZHKKcDxJ/vlpET6PSiQsAFO+Ds=
-github.com/ipfs/go-ipld-format v0.5.0/go.mod h1:ImdZqJQaEouMjCvqCe0ORUS+uoBmf7Hf+EO/jh+nk3M=
+github.com/ipfs/go-ipfs-util v0.0.3 h1:2RFdGez6bu2ZlZdI+rWfIdbQb1KudQp3VGwPtdNCmE0=
+github.com/ipfs/go-ipfs-util v0.0.3/go.mod h1:LHzG1a0Ig4G+iZ26UUOMjHd+lfM84LZCrn17xAKWBvs=
+github.com/ipfs/go-ipld-format v0.6.0 h1:VEJlA2kQ3LqFSIm5Vu6eIlSxD/Ze90xtc4Meten1F5U=
+github.com/ipfs/go-ipld-format v0.6.0/go.mod h1:g4QVMTn3marU3qXchwjpKPKgJv+zF+OlaKMyhJ4LHPg=
 github.com/ipfs/go-log v0.0.1/go.mod h1:kL1d2/hzSpI0thNYjiKfjanbVNU+IIGA/WnNESY9leM=
 github.com/ipfs/go-log v1.0.2/go.mod h1:1MNjMxe0u6xvJZgeqbJ8vdo2TKaGwZ1a0Bpza+sr2Sk=
 github.com/ipfs/go-log v1.0.3/go.mod h1:OsLySYkwIbiSUR/yBTdv1qPtcE4FW3WPWk/ewz9Ru+A=
@@ -796,8 +792,8 @@ github.com/ipfs/go-peertaskqueue v0.8.1/go.mod h1:Oxxd3eaK279FxeydSPPVGHzbwVeHja
 github.com/ipfs/go-verifcid v0.0.1 h1:m2HI7zIuR5TFyQ1b79Da5N9dnnCP1vcu2QqawmWlK2E=
 github.com/ipfs/go-verifcid v0.0.1/go.mod h1:5Hrva5KBeIog4A+UpqlaIU+DEstipcJYQQZc0g37pY0=
 github.com/ipld/go-ipld-prime v0.11.0/go.mod h1:+WIAkokurHmZ/KwzDOMUuoeJgaRQktHtEaLglS3ZeV8=
-github.com/ipld/go-ipld-prime v0.20.0 h1:Ud3VwE9ClxpO2LkCYP7vWPc0Fo+dYdYzgxUJZ3uRG4g=
-github.com/ipld/go-ipld-prime v0.20.0/go.mod h1:PzqZ/ZR981eKbgdr3y2DJYeD/8bgMawdGVlJDE8kK+M=
+github.com/ipld/go-ipld-prime v0.21.0 h1:n4JmcpOlPDIxBcY037SVfpd1G+Sj1nKZah0m6QH9C2E=
+github.com/ipld/go-ipld-prime v0.21.0/go.mod h1:3RLqy//ERg/y5oShXXdx5YIp50cFGOanyMctpPjsvxQ=
 github.com/iris-contrib/blackfriday v2.0.0+incompatible/go.mod h1:UzZ2bDEoaSGPbkg6SAB4att1aAwTmVIx/5gCVqeyUdI=
 github.com/iris-contrib/go.uuid v2.0.0+incompatible/go.mod h1:iz2lgM/1UnEf1kP0L/+fafWORmlnuysV2EMP8MW+qe0=
 github.com/iris-contrib/jade v1.1.3/go.mod h1:H/geBymxJhShH5kecoiOCSssPX7QWYH7UaeZTSWddIk=
@@ -866,15 +862,15 @@ github.com/klauspost/compress v1.9.7/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0
 github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.11.7/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
-github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
-github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
+github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
 github.com/klauspost/cpuid v1.2.1/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.0.4/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.6/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
-github.com/klauspost/cpuid/v2 v2.2.5 h1:0E5MSMDEoAulmXNFquVs//DdoomxaoTY1kUhbc/qbZg=
-github.com/klauspost/cpuid/v2 v2.2.5/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/klauspost/cpuid/v2 v2.2.6 h1:ndNyv040zDGIDh8thGkXYjnFtiN02M1PVVF+JE/48xc=
+github.com/klauspost/cpuid/v2 v2.2.6/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/koron/go-ssdp v0.0.0-20180514024734-4a0ed625a78b/go.mod h1:5Ky9EC2xfoUKUor0Hjgi2BJhCSXJfMOFlmyYrVKGQMk=
@@ -929,10 +925,10 @@ github.com/libp2p/go-libp2p v0.7.4/go.mod h1:oXsBlTLF1q7pxr+9w6lqzS1ILpyHsaBPniV
 github.com/libp2p/go-libp2p v0.8.1/go.mod h1:QRNH9pwdbEBpx5DTJYg+qxcVaDMAz3Ee/qDKwXujH5o=
 github.com/libp2p/go-libp2p v0.13.0/go.mod h1:pM0beYdACRfHO1WcJlp65WXyG2A6NqYM+t2DTVAJxMo=
 github.com/libp2p/go-libp2p v0.14.3/go.mod h1:d12V4PdKbpL0T1/gsUNN8DfgMuRPDX8bS2QxCZlwRH0=
-github.com/libp2p/go-libp2p v0.28.1 h1:YurK+ZAI6cKfASLJBVFkpVBdl3wGhFi6fusOt725ii8=
-github.com/libp2p/go-libp2p v0.28.1/go.mod h1:s3Xabc9LSwOcnv9UD4nORnXKTsWkPMkIMB/JIGXVnzk=
-github.com/libp2p/go-libp2p-asn-util v0.3.0 h1:gMDcMyYiZKkocGXDQ5nsUQyquC9+H+iLEQHwOCZ7s8s=
-github.com/libp2p/go-libp2p-asn-util v0.3.0/go.mod h1:B1mcOrKUE35Xq/ASTmQ4tN3LNzVVaMNmq2NACuqyB9w=
+github.com/libp2p/go-libp2p v0.32.2 h1:s8GYN4YJzgUoyeYNPdW7JZeZ5Ee31iNaIBfGYMAY4FQ=
+github.com/libp2p/go-libp2p v0.32.2/go.mod h1:E0LKe+diV/ZVJVnOJby8VC5xzHF0660osg71skcxJvk=
+github.com/libp2p/go-libp2p-asn-util v0.4.1 h1:xqL7++IKD9TBFMgnLPZR6/6iYhawHKHl950SO9L6n94=
+github.com/libp2p/go-libp2p-asn-util v0.4.1/go.mod h1:d/NI6XZ9qxw67b4e+NgpQexCIiFYJjErASrYW4PFDN8=
 github.com/libp2p/go-libp2p-autonat v0.1.0/go.mod h1:1tLf2yXxiE/oKGtDwPYWTSYG3PtvYlJmg7NeVtPRqH8=
 github.com/libp2p/go-libp2p-autonat v0.1.1/go.mod h1:OXqkeGOY2xJVWKAGV2inNF5aKN/djNA3fdpCWloIudE=
 github.com/libp2p/go-libp2p-autonat v0.2.0/go.mod h1:DX+9teU4pEEoZUqR1PiMlqliONQdNbfzE1C718tcViI=
@@ -976,8 +972,8 @@ github.com/libp2p/go-libp2p-discovery v0.1.0/go.mod h1:4F/x+aldVHjHDHuX85x1zWoFT
 github.com/libp2p/go-libp2p-discovery v0.2.0/go.mod h1:s4VGaxYMbw4+4+tsoQTqh7wfxg97AEdo4GYBt6BadWg=
 github.com/libp2p/go-libp2p-discovery v0.3.0/go.mod h1:o03drFnz9BVAZdzC/QUQ+NeQOu38Fu7LJGEOK2gQltw=
 github.com/libp2p/go-libp2p-discovery v0.5.0/go.mod h1:+srtPIU9gDaBNu//UHvcdliKBIcr4SfDcm0/PfPJLug=
-github.com/libp2p/go-libp2p-kad-dht v0.24.2 h1:zd7myKBKCmtZBhI3I0zm8xBkb28v3gmSEtQfBdAdFwc=
-github.com/libp2p/go-libp2p-kad-dht v0.24.2/go.mod h1:BShPzRbK6+fN3hk8a0WGAYKpb8m4k+DtchkqouGTrSg=
+github.com/libp2p/go-libp2p-kad-dht v0.25.2 h1:FOIk9gHoe4YRWXTu8SY9Z1d0RILol0TrtApsMDPjAVQ=
+github.com/libp2p/go-libp2p-kad-dht v0.25.2/go.mod h1:6za56ncRHYXX4Nc2vn8z7CZK0P4QiMcrn77acKLM2Oo=
 github.com/libp2p/go-libp2p-kbucket v0.6.3 h1:p507271wWzpy2f1XxPzCQG9NiN6R6lHL9GiSErbQQo0=
 github.com/libp2p/go-libp2p-kbucket v0.6.3/go.mod h1:RCseT7AH6eJWxxk2ol03xtP9pEHetYSPXOaJnOiD8i0=
 github.com/libp2p/go-libp2p-loggables v0.1.0 h1:h3w8QFfCt2UJl/0/NW4K829HX/0S4KD31PQ7m8UXXO8=
@@ -1004,12 +1000,14 @@ github.com/libp2p/go-libp2p-peerstore v0.2.2/go.mod h1:NQxhNjWxf1d4w6PihR8btWIRj
 github.com/libp2p/go-libp2p-peerstore v0.2.6/go.mod h1:ss/TWTgHZTMpsU/oKVVPQCGuDHItOpf2W8RxAi50P2s=
 github.com/libp2p/go-libp2p-peerstore v0.2.7/go.mod h1:ss/TWTgHZTMpsU/oKVVPQCGuDHItOpf2W8RxAi50P2s=
 github.com/libp2p/go-libp2p-pnet v0.2.0/go.mod h1:Qqvq6JH/oMZGwqs3N1Fqhv8NVhrdYcO0BW4wssv21LA=
-github.com/libp2p/go-libp2p-pubsub v0.9.3 h1:ihcz9oIBMaCK9kcx+yHWm3mLAFBMAUsM4ux42aikDxo=
-github.com/libp2p/go-libp2p-pubsub v0.9.3/go.mod h1:RYA7aM9jIic5VV47WXu4GkcRxRhrdElWf8xtyli+Dzc=
+github.com/libp2p/go-libp2p-pubsub v0.10.0 h1:wS0S5FlISavMaAbxyQn3dxMOe2eegMfswM471RuHJwA=
+github.com/libp2p/go-libp2p-pubsub v0.10.0/go.mod h1:1OxbaT/pFRO5h+Dpze8hdHQ63R0ke55XTs6b6NwLLkw=
 github.com/libp2p/go-libp2p-quic-transport v0.10.0/go.mod h1:RfJbZ8IqXIhxBRm5hqUEJqjiiY8xmEuq3HUDS993MkA=
 github.com/libp2p/go-libp2p-record v0.1.0/go.mod h1:ujNc8iuE5dlKWVy6wuL6dd58t0n7xI4hAIl8pE6wu5Q=
 github.com/libp2p/go-libp2p-record v0.2.0 h1:oiNUOCWno2BFuxt3my4i1frNrt7PerzB3queqa1NkQ0=
 github.com/libp2p/go-libp2p-record v0.2.0/go.mod h1:I+3zMkvvg5m2OcSdoL0KPljyJyvNDFGKX7QdlpYUcwk=
+github.com/libp2p/go-libp2p-routing-helpers v0.7.3 h1:u1LGzAMVRK9Nqq5aYDVOiq/HaB93U9WWczBzGyAC5ZY=
+github.com/libp2p/go-libp2p-routing-helpers v0.7.3/go.mod h1:cN4mJAD/7zfPKXBcs9ze31JGYAZgzdABEm+q/hkswb8=
 github.com/libp2p/go-libp2p-secio v0.1.0/go.mod h1:tMJo2w7h3+wN4pgU2LSYeiKPrfqBgkOsdiKK77hE7c8=
 github.com/libp2p/go-libp2p-secio v0.2.0/go.mod h1:2JdZepB8J5V9mBp79BmwsaPQhRPNN2NrnB2lKQcdy6g=
 github.com/libp2p/go-libp2p-secio v0.2.1/go.mod h1:cWtZpILJqkqrSkiYcDBh5lA3wbT2Q+hz3rJQq3iftD8=
@@ -1078,8 +1076,8 @@ github.com/libp2p/go-openssl v0.0.5/go.mod h1:unDrJpgy3oFr+rqXsarWifmJuNnJR4chtO
 github.com/libp2p/go-openssl v0.0.7/go.mod h1:unDrJpgy3oFr+rqXsarWifmJuNnJR4chtO1HmaZjggc=
 github.com/libp2p/go-reuseport v0.0.1/go.mod h1:jn6RmB1ufnQwl0Q1f+YxAj8isJgDCQzaaxIFYDhcYEA=
 github.com/libp2p/go-reuseport v0.0.2/go.mod h1:SPD+5RwGC7rcnzngoYC86GjPzjSywuQyMVAheVBD9nQ=
-github.com/libp2p/go-reuseport v0.3.0 h1:iiZslO5byUYZEg9iCwJGf5h+sf1Agmqx2V2FDjPyvUw=
-github.com/libp2p/go-reuseport v0.3.0/go.mod h1:laea40AimhtfEqysZ71UpYj4S+R9VpH8PgqLo7L+SwI=
+github.com/libp2p/go-reuseport v0.4.0 h1:nR5KU7hD0WxXCJbmw7r2rhRYruNRl2koHw8fQscQm2s=
+github.com/libp2p/go-reuseport v0.4.0/go.mod h1:ZtI03j/wO5hZVDFo2jKywN6bYKWLOy8Se6DrI2E1cLU=
 github.com/libp2p/go-reuseport-transport v0.0.2/go.mod h1:YkbSDrvjUVDL6b8XqriyA20obEtsW9BLkuOUyQAOCbs=
 github.com/libp2p/go-reuseport-transport v0.0.3/go.mod h1:Spv+MPft1exxARzP2Sruj2Wb5JSyHNncjf1Oi2dEbzM=
 github.com/libp2p/go-reuseport-transport v0.0.4/go.mod h1:trPa7r/7TJK/d+0hdBLOCGvpQQVOU74OXbNCIMkufGw=
@@ -1108,8 +1106,8 @@ github.com/libp2p/go-yamux v1.4.0/go.mod h1:fr7aVgmdNGJK+N1g+b6DW6VxzbRCjCOejR/h
 github.com/libp2p/go-yamux v1.4.1/go.mod h1:fr7aVgmdNGJK+N1g+b6DW6VxzbRCjCOejR/hkmpooHE=
 github.com/libp2p/go-yamux/v2 v2.0.0/go.mod h1:NVWira5+sVUIU6tu1JWvaRn1dRnG+cawOJiflsAM+7U=
 github.com/libp2p/go-yamux/v2 v2.2.0/go.mod h1:3So6P6TV6r75R9jiBpiIKgU/66lOarCZjqROGxzPpPQ=
-github.com/libp2p/go-yamux/v4 v4.0.0 h1:+Y80dV2Yx/kv7Y7JKu0LECyVdMXm1VUoko+VQ9rBfZQ=
-github.com/libp2p/go-yamux/v4 v4.0.0/go.mod h1:NWjl8ZTLOGlozrXSOZ/HlfG++39iKNnM5wwmtQP1YB4=
+github.com/libp2p/go-yamux/v4 v4.0.1 h1:FfDR4S1wj6Bw2Pqbc8Uz7pCxeRBPbwsBbEdfwiCypkQ=
+github.com/libp2p/go-yamux/v4 v4.0.1/go.mod h1:NWjl8ZTLOGlozrXSOZ/HlfG++39iKNnM5wwmtQP1YB4=
 github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM=
 github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
 github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
@@ -1156,21 +1154,20 @@ github.com/mattn/go-isatty v0.0.13/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Ky
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
-github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.3/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.6/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU=
 github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
+github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-tty v0.0.3/go.mod h1:ihxohKRERHTVzN+aSVRwACLCeqIoZAWpoICkkvrWyR0=
 github.com/mattn/goveralls v0.0.2/go.mod h1:8d1ZMHsd7fW6IRPKQh46F2WRpyib5/X4FOpevwGNQEw=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
-github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/mediocregopher/radix/v3 v3.4.2/go.mod h1:8FL3F6UQRXHXIBSPUs5h0RybMF8i4n7wVopoX3x7Bv8=
 github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/microcosm-cc/bluemonday v1.0.1/go.mod h1:hsXNsILzKxV+sX77C5b8FSuKF00vh2OMYv+xgHpAMF4=
@@ -1180,8 +1177,8 @@ github.com/miekg/dns v1.1.12/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3N
 github.com/miekg/dns v1.1.28/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
 github.com/miekg/dns v1.1.31/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
-github.com/miekg/dns v1.1.54 h1:5jon9mWcb0sFJGpnI99tOMhCPyJ+RPVz5b63MQG0VWI=
-github.com/miekg/dns v1.1.54/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
+github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
+github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
 github.com/mikioh/tcp v0.0.0-20190314235350-803a9b46060c h1:bzE/A84HN25pxAuk9Eej1Kz9OUelF97nAc82bDquQI8=
 github.com/mikioh/tcp v0.0.0-20190314235350-803a9b46060c/go.mod h1:0SQS9kMwD2VsyFEB++InYyBJroV/FRmBgcydeSUcJms=
 github.com/mikioh/tcpinfo v0.0.0-20190314235526-30a79bb1804b h1:z78hV3sbSMAUoyUMM0I83AUIT6Hu17AWfgjzIbtrYFc=
@@ -1243,8 +1240,8 @@ github.com/multiformats/go-multiaddr v0.2.2/go.mod h1:NtfXiOtHvghW9KojvtySjH5y0u
 github.com/multiformats/go-multiaddr v0.3.0/go.mod h1:dF9kph9wfJ+3VLAaeBqo9Of8x4fJxp6ggJGteB8HQTI=
 github.com/multiformats/go-multiaddr v0.3.1/go.mod h1:uPbspcUPd5AfaP6ql3ujFY+QWzmBD8uLLL4bXW0XfGc=
 github.com/multiformats/go-multiaddr v0.3.3/go.mod h1:lCKNGP1EQ1eZ35Za2wlqnabm9xQkib3fyB+nZXHLag0=
-github.com/multiformats/go-multiaddr v0.9.0 h1:3h4V1LHIk5w4hJHekMKWALPXErDfz/sggzwC/NcqbDQ=
-github.com/multiformats/go-multiaddr v0.9.0/go.mod h1:mI67Lb1EeTOYb8GQfL/7wpIZwc46ElrvzhYnoJOmTT0=
+github.com/multiformats/go-multiaddr v0.12.2 h1:9G9sTY/wCYajKa9lyfWPmpZAwe6oV+Wb1zcmMS1HG24=
+github.com/multiformats/go-multiaddr v0.12.2/go.mod h1:GKyaTYjZRdcUhyOetrxTk9z0cW+jA/YrnqTOvKgi44M=
 github.com/multiformats/go-multiaddr-dns v0.0.1/go.mod h1:9kWcqw/Pj6FwxAwW38n/9403szc57zJPs45fmnznu3Q=
 github.com/multiformats/go-multiaddr-dns v0.0.2/go.mod h1:9kWcqw/Pj6FwxAwW38n/9403szc57zJPs45fmnznu3Q=
 github.com/multiformats/go-multiaddr-dns v0.2.0/go.mod h1:TJ5pr5bBO7Y1B18djPuRsVkduhQH2YqYSbxWJzYGdK0=
@@ -1282,8 +1279,8 @@ github.com/multiformats/go-multistream v0.1.1/go.mod h1:KmHZ40hzVxiaiwlj3MEbYgK9
 github.com/multiformats/go-multistream v0.2.0/go.mod h1:5GZPQZbkWOLOn3J2y4Y99vVW7vOfsAflxARk3x14o6k=
 github.com/multiformats/go-multistream v0.2.1/go.mod h1:5GZPQZbkWOLOn3J2y4Y99vVW7vOfsAflxARk3x14o6k=
 github.com/multiformats/go-multistream v0.2.2/go.mod h1:UIcnm7Zuo8HKG+HkWgfQsGL+/MIEhyTqbODbIUwSXKs=
-github.com/multiformats/go-multistream v0.4.1 h1:rFy0Iiyn3YT0asivDUIR05leAdwZq3de4741sbiSdfo=
-github.com/multiformats/go-multistream v0.4.1/go.mod h1:Mz5eykRVAjJWckE2U78c6xqdtyNUEhKSM0Lwar2p77Q=
+github.com/multiformats/go-multistream v0.5.0 h1:5htLSLl7lvJk3xx3qT/8Zm9J4K8vEOf/QGkvOGQAyiE=
+github.com/multiformats/go-multistream v0.5.0/go.mod h1:n6tMZiwiP2wUsR8DgfDWw1dydlEqV3l6N3/GBsX6ILA=
 github.com/multiformats/go-varint v0.0.1/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
 github.com/multiformats/go-varint v0.0.2/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
 github.com/multiformats/go-varint v0.0.5/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
@@ -1307,7 +1304,6 @@ github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJE
 github.com/neelance/sourcemap v0.0.0-20151028013722-8c68805598ab/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
-github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/oklog/oklog v0.3.2/go.mod h1:FCV+B7mhrz4o+ueLpx+KqkyXRGMWOYEvfiXtdGtbWGs=
 github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
@@ -1320,51 +1316,52 @@ github.com/onflow/atree v0.1.0-beta1.0.20211027184039-559ee654ece9/go.mod h1:+6x
 github.com/onflow/atree v0.6.0 h1:j7nQ2r8npznx4NX39zPpBYHmdy45f4xwoi+dm37Jk7c=
 github.com/onflow/atree v0.6.0/go.mod h1:gBHU0M05qCbv9NN0kijLWMgC47gHVNBIp4KmsVFi0tc=
 github.com/onflow/cadence v0.20.1/go.mod h1:7mzUvPZUIJztIbr9eTvs+fQjWWHTF8veC+yk4ihcNIA=
-github.com/onflow/cadence v0.42.7 h1:Qp9VYX901saO7wPwF/rwV4cMS+0mfWxnm9EqbYElYy4=
-github.com/onflow/cadence v0.42.7/go.mod h1:raU8va8QRyTa/eUbhej4mbyW2ETePfSaywoo36MddgE=
-github.com/onflow/crypto v0.25.0 h1:BeWbLsh3ZD13Ej+Uky6kg1PL1ZIVBDVX+2MVBNwqddg=
-github.com/onflow/crypto v0.25.0/go.mod h1:C8FbaX0x8y+FxWjbkHy0Q4EASCDR9bSPWZqlpCLYyVI=
-github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1-0.20231219201108-fbdb10b0a2da h1:8CEioYNnP0rwjnRbKDgs8SmiQTsdaroeX4d/Q3pQuh4=
-github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1-0.20231219201108-fbdb10b0a2da/go.mod h1:WHp24VkUQfcfZi0XjI1uRVRt5alM5SHVkwOil1U2Tpc=
-github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1-0.20231219201108-fbdb10b0a2da h1:V2zI6AfDtPykMGhgw69ZEGcvyMudRUFOVHYCMN4BbQo=
-github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1-0.20231219201108-fbdb10b0a2da/go.mod h1:c09d6sNyF/j5/pAynK7sNPb1XKqJqk1rxZPEqEL+dUo=
+github.com/onflow/cadence v0.42.10 h1:3oC5ceeXhdCrhHcf9H0yYXQKW3Tw/vkSXLe+PUZa4i0=
+github.com/onflow/cadence v0.42.10/go.mod h1:1wFd+LiNiN6qoZXof3MBdpM6d8BsxbVIxOA77LbIYmE=
+github.com/onflow/crypto v0.25.1 h1:0txy2PKPMM873JbpxQNbJmuOJtD56bfs48RQfm0ts5A=
+github.com/onflow/crypto v0.25.1/go.mod h1:C8FbaX0x8y+FxWjbkHy0Q4EASCDR9bSPWZqlpCLYyVI=
+github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1 h1:xF5wHug6H8vKfz7p1LYy9jck6eD9K1HLjTdi6o4kg1k=
+github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1/go.mod h1:WHp24VkUQfcfZi0XjI1uRVRt5alM5SHVkwOil1U2Tpc=
+github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1 h1:EjWjbyVEA+bMxXbM44dE6MsYeqOu5a9q/EwSWa4ma2M=
+github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1/go.mod h1:c09d6sNyF/j5/pAynK7sNPb1XKqJqk1rxZPEqEL+dUo=
 github.com/onflow/flow-ft/lib/go/contracts v0.7.1-0.20230711213910-baad011d2b13 h1:B4ll7e3j+MqTJv2122Enq3RtDNzmIGRu9xjV7fo7un0=
 github.com/onflow/flow-ft/lib/go/contracts v0.7.1-0.20230711213910-baad011d2b13/go.mod h1:kTMFIySzEJJeupk+7EmXs0EJ6CBWY/MV9fv9iYQk+RU=
 github.com/onflow/flow-go-sdk v0.24.0/go.mod h1:IoptMLPyFXWvyd9yYA6/4EmSeeozl6nJoIv4FaEMg74=
-github.com/onflow/flow-go-sdk v0.44.0 h1:gVRLcZ6LUNs/5mzHDx0mp4mEnBAWD62O51P4/nYm4rE=
-github.com/onflow/flow-go-sdk v0.44.0/go.mod h1:mm1Fi2hiMrexNMwRzTrAN2zwTvlP8iQ5CF2JSAgJR8U=
+github.com/onflow/flow-go-sdk v0.46.0 h1:mrIQziCDe6Oi5HH/aPFvYluh1XUwO6lYpoXLWrBZc2s=
+github.com/onflow/flow-go-sdk v0.46.0/go.mod h1:azVWF0yHI8wT1erF0vuYGqQZybl6Frbc+0Zu3rIPeHc=
 github.com/onflow/flow-go/crypto v0.21.3/go.mod h1:vI6V4CY3R6c4JKBxdcRiR/AnjBfL8OSD97bJc60cLuQ=
 github.com/onflow/flow-nft/lib/go/contracts v1.1.0 h1:rhUDeD27jhLwOqQKI/23008CYfnqXErrJvc4EFRP2a0=
 github.com/onflow/flow-nft/lib/go/contracts v1.1.0/go.mod h1:YsvzYng4htDgRB9sa9jxdwoTuuhjK8WYWXTyLkIigZY=
 github.com/onflow/flow/protobuf/go/flow v0.2.2/go.mod h1:gQxYqCfkI8lpnKsmIjwtN2mV/N2PIwc1I+RUK4HPIc8=
-github.com/onflow/flow/protobuf/go/flow v0.3.2-0.20231213135419-ae911cc351a2 h1:+rT+UsfTR39JZO8ht2+4fkaWfHw74SCj1fyz1lWuX8A=
-github.com/onflow/flow/protobuf/go/flow v0.3.2-0.20231213135419-ae911cc351a2/go.mod h1:NA2pX2nw8zuaxfKphhKsk00kWLwfd+tv8mS23YXO4Sk=
-github.com/onflow/go-bitswap v0.0.0-20230703214630-6d3db958c73d h1:QcOAeEyF3iAUHv21LQ12sdcsr0yFrJGoGLyCAzYYtvI=
-github.com/onflow/go-bitswap v0.0.0-20230703214630-6d3db958c73d/go.mod h1:GCPpiyRoHncdqPj++zPr9ZOYBX4hpJ0pYZRYqSE8VKk=
+github.com/onflow/flow/protobuf/go/flow v0.3.7-0.20240404170900-c321c1475f1e h1:r4+gVDDMOOc04Y1qjCZULAdgoaxSMsqSdE1EyviG76U=
+github.com/onflow/flow/protobuf/go/flow v0.3.7-0.20240404170900-c321c1475f1e/go.mod h1:NA2pX2nw8zuaxfKphhKsk00kWLwfd+tv8mS23YXO4Sk=
+github.com/onflow/go-ethereum v1.13.4 h1:iNO86fm8RbBbhZ87ZulblInqCdHnAQVY8okBrNsTevc=
+github.com/onflow/go-ethereum v1.13.4/go.mod h1:cE/gEUkAffhwbVmMJYz+t1dAfVNHNwZCgc3BWtZxBGY=
 github.com/onflow/sdks v0.5.0 h1:2HCRibwqDaQ1c9oUApnkZtEAhWiNY2GTpRD5+ftdkN8=
 github.com/onflow/sdks v0.5.0/go.mod h1:F0dj0EyHC55kknLkeD10js4mo14yTdMotnWMslPirrU=
-github.com/onflow/wal v0.0.0-20230529184820-bc9f8244608d h1:gAEqYPn3DS83rHIKEpsajnppVD1+zwuYPFyeDVFaQvg=
-github.com/onflow/wal v0.0.0-20230529184820-bc9f8244608d/go.mod h1:iMC8gkLqu4nkbkAla5HkSBb+FGyQOZiWz3DYm2wSXCk=
+github.com/onflow/wal v0.0.0-20240208022732-d756cd497d3b h1:6O/BEmA99PDT5QVjoJgrYlGsWnpxGJTAMmsC+V9gyds=
+github.com/onflow/wal v0.0.0-20240208022732-d756cd497d3b/go.mod h1:iMC8gkLqu4nkbkAla5HkSBb+FGyQOZiWz3DYm2wSXCk=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.14.0 h1:2mOpI4JVVPBN+WQRa0WKH2eXR+Ey+uK4n7Zj0aYpIQA=
 github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
-github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo/v2 v2.9.7 h1:06xGQy5www2oN160RtEZoTvnP2sPhEfePYmCDc2szss=
-github.com/onsi/ginkgo/v2 v2.9.7/go.mod h1:cxrmXWykAwTwhQsJOPfdIDiJ+l2RYq7U8hFU+M/1uw0=
+github.com/onsi/ginkgo/v2 v2.13.2 h1:Bi2gGVkfn6gQcjNjZJVO8Gf0FHzMPf2phUei9tejVMs=
+github.com/onsi/ginkgo/v2 v2.13.2/go.mod h1:XStQ8QcGwLyF4HdfcZB8SFOS/MWCgDuXMSBe6zrvLgM=
 github.com/onsi/gomega v1.4.1/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.27.7 h1:fVih9JD6ogIiHUN6ePK7HJidyEDpWGVB5mzM7cWNXoU=
+github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
-github.com/opencontainers/runtime-spec v1.0.2 h1:UfAcuLBJB9Coz72x1hgl8O5RVzTdNiaglX6v2DM6FI0=
 github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.1.0 h1:HHUyrt9mwHUjtasSbXSMvs4cyFxh+Bll4AjJ9odEGpg=
+github.com/opencontainers/runtime-spec v1.1.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=
 github.com/opentracing/basictracer-go v1.0.0/go.mod h1:QfBfYuafItcjQuMwinw9GhYKwFXS9KnPs5lxoYwgW74=
 github.com/opentracing/opentracing-go v1.0.2/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
@@ -1417,16 +1414,16 @@ github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5Fsn
 github.com/prometheus/client_golang v1.3.0/go.mod h1:hJaj2vgQTGQmVCsAACORcieXFeDPbaTKGT+JTgUa3og=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.10.0/go.mod h1:WJM3cc3yu7XKBKa/I8WeZm+V3eltZnBwfENSU7mdogU=
-github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
-github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc=
+github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
+github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.1.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY=
-github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU=
+github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
+github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
 github.com/prometheus/common v0.0.0-20180801064454-c7de2306084e/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
@@ -1436,8 +1433,8 @@ github.com/prometheus/common v0.7.0/go.mod h1:DjGbpBbp5NYNiECxcL/VnbXCCaQpKd3tt2
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.15.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
 github.com/prometheus/common v0.18.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
-github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
-github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
+github.com/prometheus/common v0.46.0 h1:doXzt5ybi1HBKpsZOL0sSkaNHJJqkyfEWZGGqqScV0Y=
+github.com/prometheus/common v0.46.0/go.mod h1:Tp0qkxpb9Jsg54QMe+EAmqXkSV7Evdy1BTn+g2pa/hQ=
 github.com/prometheus/procfs v0.0.0-20180725123919-05ee40e3a273/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
@@ -1447,22 +1444,20 @@ github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+Gx
 github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.3.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg=
-github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM=
+github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
+github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
 github.com/prometheus/tsdb v0.6.2-0.20190402121629-4f204dcbc150/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/psiemens/sconfig v0.1.0 h1:xfWqW+TRpih7mXZIqKYTmpRhlZLQ1kbxV8EjllPv76s=
 github.com/psiemens/sconfig v0.1.0/go.mod h1:+MLKqdledP/8G3rOBpknbLh0IclCf4WneJUtS26JB2U=
 github.com/quic-go/qpack v0.4.0 h1:Cr9BXA1sQS2SmDUWjSofMPNKmvF6IiIfDRmgU0w1ZCo=
 github.com/quic-go/qpack v0.4.0/go.mod h1:UZVnYIfi5GRk+zI9UMaCPsmZ2xKJP7XBUvVyT1Knj9A=
-github.com/quic-go/qtls-go1-19 v0.3.2 h1:tFxjCFcTQzK+oMxG6Zcvp4Dq8dx4yD3dDiIiyc86Z5U=
-github.com/quic-go/qtls-go1-19 v0.3.2/go.mod h1:ySOI96ew8lnoKPtSqx2BlI5wCpUVPT05RMAlajtnyOI=
-github.com/quic-go/qtls-go1-20 v0.2.2 h1:WLOPx6OY/hxtTxKV1Zrq20FtXtDEkeY00CGQm8GEa3E=
-github.com/quic-go/qtls-go1-20 v0.2.2/go.mod h1:JKtK6mjbAVcUTN/9jZpvLbGxvdWIKS8uT7EiStoU1SM=
-github.com/quic-go/quic-go v0.33.0 h1:ItNoTDN/Fm/zBlq769lLJc8ECe9gYaW40veHCCco7y0=
-github.com/quic-go/quic-go v0.33.0/go.mod h1:YMuhaAV9/jIu0XclDXwZPAsP/2Kgr5yMYhe9oxhhOFA=
-github.com/quic-go/webtransport-go v0.5.3 h1:5XMlzemqB4qmOlgIus5zB45AcZ2kCgCy2EptUrfOPWU=
-github.com/quic-go/webtransport-go v0.5.3/go.mod h1:OhmmgJIzTTqXK5xvtuX0oBpLV2GkLWNDA+UeTGJXErU=
+github.com/quic-go/qtls-go1-20 v0.4.1 h1:D33340mCNDAIKBqXuAvexTNMUByrYmFYVfKfDN5nfFs=
+github.com/quic-go/qtls-go1-20 v0.4.1/go.mod h1:X9Nh97ZL80Z+bX/gUXMbipO6OxdiDi58b/fMC9mAL+k=
+github.com/quic-go/quic-go v0.40.1 h1:X3AGzUNFs0jVuO3esAGnTfvdgvL4fq655WaOi1snv1Q=
+github.com/quic-go/quic-go v0.40.1/go.mod h1:PeN7kuVJ4xZbxSv/4OX6S1USOX8MJvydwpTx31vx60c=
+github.com/quic-go/webtransport-go v0.6.0 h1:CvNsKqc4W2HljHJnoT+rMmbRJybShZ0YPFDD3NxaZLY=
+github.com/quic-go/webtransport-go v0.6.0/go.mod h1:9KjU4AEBqEQidGHNDkZrb8CAa1abRaosM2yGOyiikEc=
 github.com/raulk/go-watchdog v1.3.0 h1:oUmdlHxdkXRJlwfG0O9omj8ukerm8MEQavSiDTEtBsk=
 github.com/raulk/go-watchdog v1.3.0/go.mod h1:fIvOnLbF0b0ZwkB9YU4mOW9Did//4vPZtDqv66NfsMU=
 github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
@@ -1476,8 +1471,9 @@ github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6L
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.8.1/go.mod h1:JeRgkft04UBgHMgCIwADu4Pn6Mtm5d4nPKWu0nJ5d+o=
-github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/rs/cors v0.0.0-20160617231935-a62a804a8a00/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
 github.com/rs/cors v1.7.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
 github.com/rs/cors v1.8.0 h1:P2KMzcFwrPoSjkF1WLRPsp3UMLyql8L4v9hQpVeK5so=
@@ -1647,7 +1643,7 @@ github.com/vmihailenco/msgpack/v4 v4.3.11 h1:Q47CePddpNGNhk4GCnAx9DDtASi2rasatE0
 github.com/vmihailenco/msgpack/v4 v4.3.11/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+NXzzngzBKDPIqw4=
 github.com/vmihailenco/tagparser v0.1.1 h1:quXMXlA39OCbd2wAdTsGDlK9RkOk6Wuw+x37wVyIuWY=
 github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
-github.com/warpfork/go-testmark v0.11.0 h1:J6LnV8KpceDvo7spaNU4+DauH2n1x+6RaO2rJrmpQ9U=
+github.com/warpfork/go-testmark v0.12.1 h1:rMgCpJfwy1sJ50x0M0NgyphxYYPMOODIJHhsXyEHU0s=
 github.com/warpfork/go-wish v0.0.0-20200122115046-b9ea61034e4a/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0 h1:GDDkbFiaK8jsSDJfjId/PEGEShv6ugrt4kYsC5UIDaQ=
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
@@ -1670,8 +1666,8 @@ github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQ
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/yalp/jsonpath v0.0.0-20180802001716-5cc68e5049a0/go.mod h1:/LWChgwKmvncFJFHJ7Gvn9wZArjbV5/FppcK2fKk/tI=
-github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20230703223453-544e2fe28a26 h1:C7wI5fYoMlSMEGEVi/PH3Toh9TzpIWlvX9DTLIco52Y=
-github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20230703223453-544e2fe28a26/go.mod h1:bZmV+V29p09ee2aWv/1WCAfHKIwWlwYmNeMspQ2CzJc=
+github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20240220190333-03695dea34a3 h1:GyrwPbleN4FGHa/Ku1aiNKowV4l4FCKRzZfCbvbv5P4=
+github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20240220190333-03695dea34a3/go.mod h1:Irbd2TlWD6Bk0i9ggIqd+WPz0Axp8wP9VuNCm2+Ibrg=
 github.com/yudai/gojsondiff v1.0.0/go.mod h1:AY32+k2cwILAkW1fbgxQ5mUmMiZFgLIV+FBNExI05xg=
 github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82/go.mod h1:lgjkn3NuSvDfVJdfcVVdX+jpBxNmX4rDAzaS45IcYoM=
 github.com/yudai/pp v2.0.1+incompatible/go.mod h1:PuxR/8QJ7cyCkFp/aUDS+JY727OFEZkTdatxwunjIkc=
@@ -1680,6 +1676,7 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.2 h1:KBNDSne4vP5mbSWnJbO+51IMOXJB67QiYCSBrubbPRg=
 github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
@@ -1706,23 +1703,21 @@ go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/otel v1.16.0 h1:Z7GVAX/UkAXPKsy94IU+i6thsQS4nb7LviLpnaNeW8s=
-go.opentelemetry.io/otel v1.16.0/go.mod h1:vl0h9NUa1D5s1nv3A5vZOYWn8av4K8Ml6JDeHrT/bx4=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0 h1:t4ZwRPU+emrcvM2e9DHd0Fsf0JTPVcbfa/BhTDF03d0=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0/go.mod h1:vLarbg68dH2Wa77g71zmKQqlQ8+8Rq3GRG31uc0WcWI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0 h1:cbsD4cUcviQGXdw8+bo5x2wazq10SKz8hEbtCRPcU78=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0/go.mod h1:JgXSGah17croqhJfhByOLVY719k1emAXC8MVhCIJlRs=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0 h1:ap+y8RXX3Mu9apKVtOkM6WSFESLM8K3wNQyOU8sWHcc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0/go.mod h1:5w41DY6S9gZrbjuq6Y+753e96WfPha5IcsOSZTtullM=
-go.opentelemetry.io/otel/metric v1.16.0 h1:RbrpwVG1Hfv85LgnZ7+txXioPDoh6EdbZHo26Q3hqOo=
-go.opentelemetry.io/otel/metric v1.16.0/go.mod h1:QE47cpOmkwipPiefDwo2wDzwJrlfxxNYodqc4xnGCo4=
-go.opentelemetry.io/otel/sdk v1.16.0 h1:Z1Ok1YsijYL0CSJpHt4cS3wDDh7p572grzNrBMiMWgE=
-go.opentelemetry.io/otel/sdk v1.16.0/go.mod h1:tMsIuKXuuIWPBAOrH+eHtvhTL+SntFtXF9QD68aP6p4=
-go.opentelemetry.io/otel/trace v1.16.0 h1:8JRpaObFoW0pxuVPapkgH8UhHQj+bJW8jJsCZEu5MQs=
-go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLkqr2QVwea0ef0=
+go.opentelemetry.io/otel v1.22.0 h1:xS7Ku+7yTFvDfDraDIJVpw7XPyuHlB9MCiqqX5mcJ6Y=
+go.opentelemetry.io/otel v1.22.0/go.mod h1:eoV4iAi3Ea8LkAEI9+GFT44O6T/D0GWAVFyZVCC6pMI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 h1:tIqheXEFWAZ7O8A7m+J0aPTmpJN3YQ7qetUAdkkkKpk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0/go.mod h1:nUeKExfxAQVbiVFn32YXpXZZHZ61Cc3s3Rn1pDBGAb0=
+go.opentelemetry.io/otel/metric v1.22.0 h1:lypMQnGyJYeuYPhOM/bgjbFM6WE44W1/T45er4d8Hhg=
+go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xCWdXjK8pzFvliY=
+go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
+go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
+go.opentelemetry.io/otel/trace v1.22.0 h1:Hg6pPujv0XG9QaVbGOBVHunyuLcCC3jN7WEhPx83XD0=
+go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v0.19.0 h1:IVN6GR+mhC4s5yfcTbmzHYODqvWAp3ZedA2SJPI1Nnw=
-go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
+go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
+go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
@@ -1730,14 +1725,16 @@ go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-go.uber.org/dig v1.17.0 h1:5Chju+tUvcC+N7N6EV08BJz41UZuO3BmHcN4A287ZLI=
-go.uber.org/dig v1.17.0/go.mod h1:rTxpf7l5I0eBTlE6/9RL+lDybC7WFwY2QH55ZSjy1mU=
-go.uber.org/fx v1.19.2 h1:SyFgYQFr1Wl0AYstE8vyYIzP4bFz2URrScjwC4cwUvY=
-go.uber.org/fx v1.19.2/go.mod h1:43G1VcqSzbIv77y00p1DRAsyZS8WdzuYdhZXmEUkMyQ=
+go.uber.org/dig v1.17.1 h1:Tga8Lz8PcYNsWsyHMZ1Vm0OQOUaJNDyvPImgbAu9YSc=
+go.uber.org/dig v1.17.1/go.mod h1:Us0rSJiThwCv2GteUN0Q7OKvU7n5J4dxZ9JKUXozFdE=
+go.uber.org/fx v1.20.1 h1:zVwVQGS8zYvhh9Xxcu4w1M6ESyeMzebzj2NbSayZ4Mk=
+go.uber.org/fx v1.20.1/go.mod h1:iSYNbHf2y55acNCwCXKx7LbWb5WG1Bnue5RDXz1OREg=
 go.uber.org/goleak v1.0.0/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.1.11-0.20210813005559-691160354723/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
+go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
 go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
@@ -1752,8 +1749,8 @@ go.uber.org/zap v1.14.1/go.mod h1:Mb2vm2krFEG5DV0W9qcHBYFtp/Wku1cvYaqPsS/WYfc=
 go.uber.org/zap v1.15.0/go.mod h1:Mb2vm2krFEG5DV0W9qcHBYFtp/Wku1cvYaqPsS/WYfc=
 go.uber.org/zap v1.16.0/go.mod h1:MA8QOfq0BHJwdXa996Y4dYkAqRKB8/1K1QMMZVaNZjQ=
 go.uber.org/zap v1.19.1/go.mod h1:j3DNczoxDZroyBnOT1L/Q79cfUMGZxlv/9dzN7SM1rI=
-go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
-go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
+go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
+go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
 go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
 golang.org/x/build v0.0.0-20190111050920-041ab4dc3f9d/go.mod h1:OWs+y06UdEOHN4y+MfF/py+xQ/tYqIWW03b70/CG9Rw=
 golang.org/x/crypto v0.0.0-20170930174604-9419663f5a44/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -1791,8 +1788,8 @@ golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5
 golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1807,8 +1804,8 @@ golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
 golang.org/x/exp v0.0.0-20200331195152-e8c3332aa8e5/go.mod h1:4M0jN8W1tt0AVLNr8HDosyJCDCDuyL9N9+3m7wDWgKw=
-golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611 h1:qCEDpW1G+vcj3Y7Fy52pEM1AWm3abj8WimGYejI3SC4=
-golang.org/x/exp v0.0.0-20231214170342-aacd6d4b4611/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
+golang.org/x/exp v0.0.0-20240119083558-1b970713d09a h1:Q8/wZp0KX97QFTc2ywcOE0YRjZPVIx+MXInMzdvQqcA=
+golang.org/x/exp v0.0.0-20240119083558-1b970713d09a/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -1836,6 +1833,7 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180719180050-a680a1efc54d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1900,8 +1898,9 @@ golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qx
 golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211008194852-3b03d305991f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
+golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -1919,9 +1918,8 @@ golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.13.0 h1:jDDenyj+WgFtmV3zYVoi8aE2BwtXFLWOA67ZfNWftiY=
-golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
+golang.org/x/oauth2 v0.16.0 h1:aDkGMBSYxElaoP81NpoUoz2oo2R2wHdZpGToUxfyQrQ=
+golang.org/x/oauth2 v0.16.0/go.mod h1:hqZ+0LWXsiVoZpeld6jVt06P3adbS2Uu911W1SsJv2o=
 golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852/go.mod h1:JLpeXjPJfIyPr5TlbXLkXWLhP8nz10XfvxElABhCtcw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -1934,8 +1932,9 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180810173357-98c5dad5d1a0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -2044,20 +2043,23 @@ golang.org/x/sys v0.0.0-20211025112917-711f33c9992c/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220111092808-5a964db01320/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
+golang.org/x/term v0.16.0 h1:m+B6fahuftsE9qjo0VWp2FW0mB3MTJvR0BaMQrq0pmE=
+golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2067,6 +2069,7 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -2147,18 +2150,19 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.16.0 h1:GO788SKMRunPIBCXiQyo2AaexLstOrVhuAL5YwsckQM=
-golang.org/x/tools v0.16.0/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
+golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 gonum.org/v1/gonum v0.0.0-20180816165407-929014505bf4/go.mod h1:Y+Yx5eoAFn32cQvJDxZx5Dpnq+c3wtXuadVZAcxbbBo=
 gonum.org/v1/gonum v0.6.1/go.mod h1:9mxDZsDKxgMAuccQkewq682L+0eCu4dCN2yonUJTCLU=
-gonum.org/v1/gonum v0.13.0 h1:a0T3bh+7fhRyqeNbiC3qVHYmkiQgit3wnNan/2c0HMM=
-gonum.org/v1/gonum v0.13.0/go.mod h1:/WPYRckkfWrhWefxyYTfrTtQR0KH4iyHNuzxqXAKyAU=
+gonum.org/v1/gonum v0.14.0 h1:2NiG67LD1tEH0D7kM+ps2V+fXmsAnpUeec7n8tcr4S0=
+gonum.org/v1/gonum v0.14.0/go.mod h1:AoWeoz0becf9QMWtE8iWXNXc27fK4fNeHNf/oMejGfU=
 gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
 gonum.org/v1/plot v0.0.0-20190515093506-e2840ee46a6b/go.mod h1:Wt8AAjI+ypCyYX3nZBvf6cAIx93T+c/OS2HFAYskSZc=
 google.golang.org/api v0.0.0-20180910000450-7ca32eb868bf/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
@@ -2205,8 +2209,9 @@ google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7
 google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20180518175338-11a468237815/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20180831171423-11092d34479b/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
@@ -2276,14 +2281,13 @@ google.golang.org/genproto v0.0.0-20210917145530-b395a37504d4/go.mod h1:eFjDcFEc
 google.golang.org/genproto v0.0.0-20210921142501-181ce0d877f6/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211007155348-82e027067bd4/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b h1:+YaDE2r2OG8t/z5qmsh7Y+XXwCbvadxxZ0YY6mTdrVA=
-google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:CgAqfJo+Xmu0GwA0411Ht3OU3OntXwsGmrmjI8ioGXI=
-google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b h1:CIC2YMXmIhYw6evmhPxBKJ4fmLbOFtXQN/GV3XOZR8k=
-google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:IBQ646DjkDkvUIsVq/cc03FUFQ9wbZu7yE396YcL870=
+google.golang.org/genproto v0.0.0-20240102182953-50ed04b92917 h1:nz5NESFLZbJGPFxDT/HCn+V1mZ8JGNoY4nUpmW/Y2eg=
+google.golang.org/genproto v0.0.0-20240102182953-50ed04b92917/go.mod h1:pZqR+glSb11aJ+JQcczCvgf47+duRuzNSKqE8YAQnV0=
+google.golang.org/genproto/googleapis/api v0.0.0-20240108191215-35c7eff3a6b1 h1:OPXtXn7fNMaXwO3JvOmF1QyTc00jsSFFz1vXXBOdCDo=
+google.golang.org/genproto/googleapis/api v0.0.0-20240108191215-35c7eff3a6b1/go.mod h1:B5xPO//w8qmBDjGReYLpR6UJPnkldGkCSMoH/2vxJeg=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20231030173426-d783a09b4405 h1:o4S3HvTUEXgRsNSUQsALDVog0O9F/U1JJlHmmUN8Uas=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405 h1:AB/lmRny7e2pLhFEYIbl5qkDAUt2h0ZRO4wGPhZf+ik=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405/go.mod h1:67X1fPuzjcrkymZzZV1vvkFeTn2Rvc6lYF9MYFGCcwE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240108191215-35c7eff3a6b1 h1:gphdwh0npgs8elJ4T6J+DQJHPVF7RsuJHCfwztUb4J4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240108191215-35c7eff3a6b1/go.mod h1:daQN87bsDqDoe316QbbvX60nMoJQa4r6Ds0ZuoAe5yA=
 google.golang.org/grpc v1.12.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.16.0/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
@@ -2319,9 +2323,8 @@ google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQ
 google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
-google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
+google.golang.org/grpc v1.60.1 h1:26+wFr+cNqSGFcOXcabYC0lUVJVRa2Sb2ortSK7VrEU=
+google.golang.org/grpc v1.60.1/go.mod h1:OlCHIeLYqSSsLi6i49B5QGdzaMZK9+M7LXN2FKz4eGM=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0 h1:TLkBREm4nIsEcexnCjgQd5GQWaHcqMzwQV0TX9pq8S0=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0/go.mod h1:DNq5QpG7LJqD2AamLZ7zvKE0DEpVl2BSEVjFycAAjRY=
@@ -2338,8 +2341,8 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
-google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
+google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -2398,8 +2401,8 @@ lukechampine.com/blake3 v1.2.1/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1
 nhooyr.io/websocket v1.8.6/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
 nhooyr.io/websocket v1.8.7 h1:usjR2uOr/zjjkVMy0lW+PPohFok7PCow5sDjLgX4P4g=
 nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
-pgregory.net/rapid v0.4.7 h1:MTNRktPuv5FNqOO151TM9mDTa+XHcX6ypYeISDVD14g=
 pgregory.net/rapid v0.4.7/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
+pgregory.net/rapid v1.1.0 h1:CMa0sjHSru3puNx+J0MIAuiiEV4N0qj8/cMWGBBCsjw=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
diff --git a/insecure/integration/functional/test/gossipsub/rpc_inspector/utils.go b/insecure/integration/functional/test/gossipsub/rpc_inspector/utils.go
index fdbba188f45..977b7b17f0e 100644
--- a/insecure/integration/functional/test/gossipsub/rpc_inspector/utils.go
+++ b/insecure/integration/functional/test/gossipsub/rpc_inspector/utils.go
@@ -7,17 +7,13 @@ import (
 	"testing"
 	"time"
 
-	mockery "github.com/stretchr/testify/mock"
-
 	"github.com/onflow/flow-go/config"
-	"github.com/onflow/flow-go/insecure/corruptlibp2p"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module"
 	"github.com/onflow/flow-go/module/irrecoverable"
 	"github.com/onflow/flow-go/module/metrics"
 	"github.com/onflow/flow-go/network/channels"
 	"github.com/onflow/flow-go/network/p2p"
-	mockp2p "github.com/onflow/flow-go/network/p2p/mock"
 	p2ptest "github.com/onflow/flow-go/network/p2p/test"
 	"github.com/onflow/flow-go/network/p2p/tracer"
 	"github.com/onflow/flow-go/utils/unittest"
@@ -45,29 +41,27 @@ func randomClusterPrefixedTopic() channels.Topic {
 	return channels.Topic(channels.SyncCluster(flow.ChainID(fmt.Sprintf("%d", rand.Uint64()))))
 }
 
-type onNotificationDissemination func(spammer *corruptlibp2p.GossipSubRouterSpammer) func(args mockery.Arguments)
-type mockDistributorOption func(*mockp2p.GossipSubInspectorNotificationDistributor, *corruptlibp2p.GossipSubRouterSpammer)
-
-func withExpectedNotificationDissemination(expectedNumOfTotalNotif int, f onNotificationDissemination) mockDistributorOption {
-	return func(distributor *mockp2p.GossipSubInspectorNotificationDistributor, spammer *corruptlibp2p.GossipSubRouterSpammer) {
-		distributor.
-			On("Distribute", mockery.Anything).
-			Times(expectedNumOfTotalNotif).
-			Run(f(spammer)).
-			Return(nil)
+func randomClusterPrefixedTopics(n int) []string {
+	topics := make([]string, n)
+	for i := 0; i < n; i++ {
+		topics[i] = randomClusterPrefixedTopic().String()
 	}
+	return topics
 }
 
 func meshTracerFixture(flowConfig *config.FlowConfig, idProvider module.IdentityProvider) *tracer.GossipSubMeshTracer {
 	meshTracerCfg := &tracer.GossipSubMeshTracerConfig{
-		Logger:                             unittest.Logger(),
-		Metrics:                            metrics.NewNoopCollector(),
-		IDProvider:                         idProvider,
-		LoggerInterval:                     time.Second,
-		HeroCacheMetricsFactory:            metrics.NewNoopHeroCacheMetricsFactory(),
-		RpcSentTrackerCacheSize:            flowConfig.NetworkConfig.GossipSub.RpcTracer.RPCSentTrackerCacheSize,
-		RpcSentTrackerWorkerQueueCacheSize: flowConfig.NetworkConfig.GossipSub.RpcTracer.RPCSentTrackerQueueCacheSize,
-		RpcSentTrackerNumOfWorkers:         flowConfig.NetworkConfig.GossipSub.RpcTracer.RpcSentTrackerNumOfWorkers,
+		Logger:                  unittest.Logger(),
+		Metrics:                 metrics.NewNoopCollector(),
+		IDProvider:              idProvider,
+		LoggerInterval:          time.Second,
+		HeroCacheMetricsFactory: metrics.NewNoopHeroCacheMetricsFactory(),
+		RpcSentTracker: tracer.RpcSentTrackerConfig{
+			CacheSize:            flowConfig.NetworkConfig.GossipSub.RpcTracer.RPCSentTrackerCacheSize,
+			WorkerQueueCacheSize: flowConfig.NetworkConfig.GossipSub.RpcTracer.RPCSentTrackerQueueCacheSize,
+			WorkerQueueNumber:    flowConfig.NetworkConfig.GossipSub.RpcTracer.RpcSentTrackerNumOfWorkers,
+		},
+		DuplicateMessageTrackerCacheConfig: flowConfig.NetworkConfig.GossipSub.RpcTracer.DuplicateMessageTrackerConfig,
 	}
 	return tracer.NewGossipSubMeshTracer(meshTracerCfg)
 }
diff --git a/insecure/integration/functional/test/gossipsub/rpc_inspector/validation_inspector_test.go b/insecure/integration/functional/test/gossipsub/rpc_inspector/validation_inspector_test.go
index 0f68de8a4d7..1c43a9999e7 100644
--- a/insecure/integration/functional/test/gossipsub/rpc_inspector/validation_inspector_test.go
+++ b/insecure/integration/functional/test/gossipsub/rpc_inspector/validation_inspector_test.go
@@ -4,16 +4,16 @@ import (
 	"context"
 	"fmt"
 	"math"
-	"os"
 	"testing"
 	"time"
 
 	pubsub "github.com/libp2p/go-libp2p-pubsub"
 	pb "github.com/libp2p/go-libp2p-pubsub/pb"
+	pubsub_pb "github.com/libp2p/go-libp2p-pubsub/pb"
 	"github.com/libp2p/go-libp2p/core/peer"
-	"github.com/rs/zerolog"
 	mockery "github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
+	corrupt "github.com/yhassanzadeh13/go-libp2p-pubsub"
 	"go.uber.org/atomic"
 
 	"github.com/onflow/flow-go/config"
@@ -56,30 +56,6 @@ func TestValidationInspector_InvalidTopicId_Detection(t *testing.T) {
 	invIHaveNotifCount := atomic.NewUint64(0)
 	done := make(chan struct{})
 	expectedNumOfTotalNotif := 9
-	// ensure expected notifications are disseminated with expected error
-	inspectDisseminatedNotifyFunc := func(spammer *corruptlibp2p.GossipSubRouterSpammer) func(args mockery.Arguments) {
-		return func(args mockery.Arguments) {
-			count.Inc()
-			notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
-			require.True(t, ok)
-			require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType, "IsClusterPrefixed is expected to be false, no RPC with cluster prefixed topic sent in this test")
-			require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
-			require.True(t, channels.IsInvalidTopicErr(notification.Error))
-			switch notification.MsgType {
-			case p2pmsg.CtrlMsgGraft:
-				invGraftNotifCount.Inc()
-			case p2pmsg.CtrlMsgPrune:
-				invPruneNotifCount.Inc()
-			case p2pmsg.CtrlMsgIHave:
-				invIHaveNotifCount.Inc()
-			default:
-				require.Fail(t, fmt.Sprintf("unexpected control message type %s error: %s", notification.MsgType, notification.Error))
-			}
-			if count.Load() == uint64(expectedNumOfTotalNotif) {
-				close(done)
-			}
-		}
-	}
 
 	idProvider := mock.NewIdentityProvider(t)
 	spammer := corruptlibp2p.NewGossipSubRouterSpammer(t, sporkID, role, idProvider)
@@ -87,22 +63,41 @@ func TestValidationInspector_InvalidTopicId_Detection(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
 
-	distributor := mockp2p.NewGossipSubInspectorNotificationDistributor(t)
-	p2ptest.MockInspectorNotificationDistributorReadyDoneAware(distributor)
-	withExpectedNotificationDissemination(expectedNumOfTotalNotif, inspectDisseminatedNotifyFunc)(distributor, spammer)
+	consumer := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
+	consumer.On("OnInvalidControlMessageNotification", mockery.Anything).Run(func(args mockery.Arguments) {
+		count.Inc()
+		notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
+		require.True(t, ok)
+		require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType, "IsClusterPrefixed is expected to be false, no RPC with cluster prefixed topic sent in this test")
+		require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
+		require.True(t, validation.IsInvalidTopicIDThresholdExceeded(notification.Error))
+		switch notification.MsgType {
+		case p2pmsg.CtrlMsgGraft:
+			invGraftNotifCount.Inc()
+		case p2pmsg.CtrlMsgPrune:
+			invPruneNotifCount.Inc()
+		case p2pmsg.CtrlMsgIHave:
+			invIHaveNotifCount.Inc()
+		default:
+			require.Fail(t, fmt.Sprintf("unexpected control message type %s error: %s", notification.MsgType, notification.Error))
+		}
+		if count.Load() == uint64(expectedNumOfTotalNotif) {
+			close(done)
+		}
+	}).Return().Times(expectedNumOfTotalNotif)
 
 	meshTracer := meshTracerFixture(flowConfig, idProvider)
-	topicProvider := newMockUpdatableTopicProvider()
+	topicProvider := p2ptest.NewUpdatableTopicProviderFixture()
 	validationInspector, err := validation.NewControlMsgValidationInspector(&validation.InspectorParams{
 		Logger:                  unittest.Logger(),
 		SporkID:                 sporkID,
 		Config:                  &inspectorConfig,
-		Distributor:             distributor,
 		IdProvider:              idProvider,
 		HeroCacheMetricsFactory: metrics.NewNoopHeroCacheMetricsFactory(),
 		InspectorMetrics:        metrics.NewNoopCollector(),
 		RpcTracker:              meshTracer,
 		NetworkingType:          network.PrivateNetwork,
+		InvalidControlMessageNotificationConsumer: consumer,
 		TopicOracle: func() p2p.TopicProvider {
 			return topicProvider
 		},
@@ -193,30 +188,6 @@ func TestValidationInspector_DuplicateTopicId_Detection(t *testing.T) {
 	invGraftNotifCount := atomic.NewUint64(0)
 	invPruneNotifCount := atomic.NewUint64(0)
 	invIHaveNotifCount := atomic.NewUint64(0)
-	inspectDisseminatedNotifyFunc := func(spammer *corruptlibp2p.GossipSubRouterSpammer) func(args mockery.Arguments) {
-		return func(args mockery.Arguments) {
-			count.Inc()
-			notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
-			require.True(t, ok)
-			require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType, "IsClusterPrefixed is expected to be false, no RPC with cluster prefixed topic sent in this test")
-			require.True(t, validation.IsDuplicateTopicErr(notification.Error))
-			require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
-			switch notification.MsgType {
-			case p2pmsg.CtrlMsgGraft:
-				invGraftNotifCount.Inc()
-			case p2pmsg.CtrlMsgPrune:
-				invPruneNotifCount.Inc()
-			case p2pmsg.CtrlMsgIHave:
-				invIHaveNotifCount.Inc()
-			default:
-				require.Fail(t, fmt.Sprintf("unexpected control message type %s error: %s", notification.MsgType, notification.Error))
-			}
-
-			if count.Load() == int64(expectedNumOfTotalNotif) {
-				close(done)
-			}
-		}
-	}
 
 	idProvider := mock.NewIdentityProvider(t)
 	spammer := corruptlibp2p.NewGossipSubRouterSpammer(t, sporkID, role, idProvider)
@@ -224,21 +195,42 @@ func TestValidationInspector_DuplicateTopicId_Detection(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
 
-	distributor := mockp2p.NewGossipSubInspectorNotificationDistributor(t)
-	p2ptest.MockInspectorNotificationDistributorReadyDoneAware(distributor)
-	withExpectedNotificationDissemination(expectedNumOfTotalNotif, inspectDisseminatedNotifyFunc)(distributor, spammer)
+	consumer := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
+	consumer.On("OnInvalidControlMessageNotification", mockery.Anything).Run(func(args mockery.Arguments) {
+		count.Inc()
+		notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
+		require.True(t, ok)
+		require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType, "IsClusterPrefixed is expected to be false, no RPC with cluster prefixed topic sent in this test")
+		require.True(t, validation.IsDuplicateTopicIDThresholdExceeded(notification.Error))
+		require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
+		switch notification.MsgType {
+		case p2pmsg.CtrlMsgGraft:
+			invGraftNotifCount.Inc()
+		case p2pmsg.CtrlMsgPrune:
+			invPruneNotifCount.Inc()
+		case p2pmsg.CtrlMsgIHave:
+			invIHaveNotifCount.Inc()
+		default:
+			require.Fail(t, fmt.Sprintf("unexpected control message type %s error: %s", notification.MsgType, notification.Error))
+		}
+
+		if count.Load() == int64(expectedNumOfTotalNotif) {
+			close(done)
+		}
+	}).Return().Times(expectedNumOfTotalNotif)
+
 	meshTracer := meshTracerFixture(flowConfig, idProvider)
-	topicProvider := newMockUpdatableTopicProvider()
+	topicProvider := p2ptest.NewUpdatableTopicProviderFixture()
 	validationInspector, err := validation.NewControlMsgValidationInspector(&validation.InspectorParams{
 		Logger:                  unittest.Logger(),
 		SporkID:                 sporkID,
 		Config:                  &inspectorConfig,
-		Distributor:             distributor,
 		IdProvider:              idProvider,
 		HeroCacheMetricsFactory: metrics.NewNoopHeroCacheMetricsFactory(),
 		InspectorMetrics:        metrics.NewNoopCollector(),
 		RpcTracker:              meshTracer,
 		NetworkingType:          network.PrivateNetwork,
+		InvalidControlMessageNotificationConsumer: consumer,
 		TopicOracle: func() p2p.TopicProvider {
 			return topicProvider
 		},
@@ -291,54 +283,45 @@ func TestValidationInspector_IHaveDuplicateMessageId_Detection(t *testing.T) {
 	flowConfig, err := config.DefaultConfig()
 	require.NoError(t, err)
 	inspectorConfig := flowConfig.NetworkConfig.GossipSub.RpcInspector.Validation
-
 	inspectorConfig.InspectionQueue.NumberOfWorkers = 1
 
 	count := atomic.NewInt64(0)
 	done := make(chan struct{})
 	expectedNumOfTotalNotif := 1
 	invIHaveNotifCount := atomic.NewUint64(0)
-	inspectDisseminatedNotifyFunc := func(spammer *corruptlibp2p.GossipSubRouterSpammer) func(args mockery.Arguments) {
-		return func(args mockery.Arguments) {
-			count.Inc()
-			notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
-			require.True(t, ok)
-			require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType, "IsClusterPrefixed is expected to be false, no RPC with cluster prefixed topic sent in this test")
-			require.True(t, validation.IsDuplicateMessageIDErr(notification.Error))
-			require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
-			require.True(t,
-				notification.MsgType == p2pmsg.CtrlMsgIHave,
-				fmt.Sprintf("unexpected control message type %s error: %s", notification.MsgType, notification.Error))
-			invIHaveNotifCount.Inc()
-
-			if count.Load() == int64(expectedNumOfTotalNotif) {
-				close(done)
-			}
-		}
-	}
-
 	idProvider := mock.NewIdentityProvider(t)
 	spammer := corruptlibp2p.NewGossipSubRouterSpammer(t, sporkID, role, idProvider)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
+	consumer := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
+	consumer.On("OnInvalidControlMessageNotification", mockery.Anything).Run(func(args mockery.Arguments) {
+		count.Inc()
+		notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
+		require.True(t, ok)
+		require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType, "IsClusterPrefixed is expected to be false, no RPC with cluster prefixed topic sent in this test")
+		require.True(t, validation.IsDuplicateMessageIDErr(notification.Error))
+		require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
+		require.True(t, notification.MsgType == p2pmsg.CtrlMsgIHave, fmt.Sprintf("unexpected control message type %s error: %s", notification.MsgType, notification.Error))
+		invIHaveNotifCount.Inc()
+
+		if count.Load() == int64(expectedNumOfTotalNotif) {
+			close(done)
+		}
+	}).Return().Times(expectedNumOfTotalNotif)
 
-	distributor := mockp2p.NewGossipSubInspectorNotificationDistributor(t)
-	p2ptest.MockInspectorNotificationDistributorReadyDoneAware(distributor)
-	withExpectedNotificationDissemination(expectedNumOfTotalNotif, inspectDisseminatedNotifyFunc)(distributor, spammer)
 	meshTracer := meshTracerFixture(flowConfig, idProvider)
-
-	topicProvider := newMockUpdatableTopicProvider()
+	topicProvider := p2ptest.NewUpdatableTopicProviderFixture()
 	validationInspector, err := validation.NewControlMsgValidationInspector(&validation.InspectorParams{
 		Logger:                  unittest.Logger(),
 		SporkID:                 sporkID,
 		Config:                  &inspectorConfig,
-		Distributor:             distributor,
 		IdProvider:              idProvider,
 		HeroCacheMetricsFactory: metrics.NewNoopHeroCacheMetricsFactory(),
 		InspectorMetrics:        metrics.NewNoopCollector(),
 		RpcTracker:              meshTracer,
 		NetworkingType:          network.PrivateNetwork,
+		InvalidControlMessageNotificationConsumer: consumer,
 		TopicOracle: func() p2p.TopicProvider {
 			return topicProvider
 		},
@@ -401,10 +384,12 @@ func TestValidationInspector_UnknownClusterId_Detection(t *testing.T) {
 	// we force the inspector to return an error
 	inspectorConfig.ClusterPrefixedMessage.HardThreshold = 0
 	inspectorConfig.InspectionQueue.NumberOfWorkers = 1
+	// set invalid topic id threshold to 0 so that inspector returns error early
+	inspectorConfig.GraftPrune.InvalidTopicIdThreshold = 0
 
-	// SafetyThreshold < messageCount < HardThreshold ensures that the RPC message will be further inspected and topic IDs will be checked
+	// ensure we send a number of message with unknown cluster ids higher than the invalid topic ids threshold
 	// restricting the message count to 1 allows us to only aggregate a single error when the error is logged in the inspector.
-	messageCount := 10
+	messageCount := 60
 	controlMessageCount := int64(1)
 
 	count := atomic.NewInt64(0)
@@ -412,49 +397,46 @@ func TestValidationInspector_UnknownClusterId_Detection(t *testing.T) {
 	expectedNumOfTotalNotif := 2
 	invGraftNotifCount := atomic.NewUint64(0)
 	invPruneNotifCount := atomic.NewUint64(0)
-	inspectDisseminatedNotifyFunc := func(spammer *corruptlibp2p.GossipSubRouterSpammer) func(args mockery.Arguments) {
-		return func(args mockery.Arguments) {
-			count.Inc()
-			notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
-			require.True(t, ok)
-			require.Equal(t, notification.TopicType, p2p.CtrlMsgTopicTypeClusterPrefixed)
-			require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
-			require.True(t, channels.IsUnknownClusterIDErr(notification.Error))
-			switch notification.MsgType {
-			case p2pmsg.CtrlMsgGraft:
-				invGraftNotifCount.Inc()
-			case p2pmsg.CtrlMsgPrune:
-				invPruneNotifCount.Inc()
-			default:
-				require.Fail(t, fmt.Sprintf("unexpected control message type %s error: %s", notification.MsgType, notification.Error))
-			}
-
-			if count.Load() == int64(expectedNumOfTotalNotif) {
-				close(done)
-			}
-		}
-	}
 
 	idProvider := mock.NewIdentityProvider(t)
 	spammer := corruptlibp2p.NewGossipSubRouterSpammer(t, sporkID, role, idProvider)
 	ctx, cancel := context.WithCancel(context.Background())
 	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
 
-	distributor := mockp2p.NewGossipSubInspectorNotificationDistributor(t)
-	p2ptest.MockInspectorNotificationDistributorReadyDoneAware(distributor)
-	withExpectedNotificationDissemination(expectedNumOfTotalNotif, inspectDisseminatedNotifyFunc)(distributor, spammer)
+	consumer := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
+	consumer.On("OnInvalidControlMessageNotification", mockery.Anything).Run(func(args mockery.Arguments) {
+		count.Inc()
+		notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
+		require.True(t, ok)
+		require.Equal(t, notification.TopicType, p2p.CtrlMsgTopicTypeClusterPrefixed)
+		require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
+		require.True(t, validation.IsInvalidTopicIDThresholdExceeded(notification.Error))
+		switch notification.MsgType {
+		case p2pmsg.CtrlMsgGraft:
+			invGraftNotifCount.Inc()
+		case p2pmsg.CtrlMsgPrune:
+			invPruneNotifCount.Inc()
+		default:
+			require.Fail(t, fmt.Sprintf("unexpected control message type %s error: %s", notification.MsgType, notification.Error))
+		}
+
+		if count.Load() == int64(expectedNumOfTotalNotif) {
+			close(done)
+		}
+	}).Return().Times(expectedNumOfTotalNotif)
+
 	meshTracer := meshTracerFixture(flowConfig, idProvider)
-	topicProvider := newMockUpdatableTopicProvider()
+	topicProvider := p2ptest.NewUpdatableTopicProviderFixture()
 	validationInspector, err := validation.NewControlMsgValidationInspector(&validation.InspectorParams{
 		Logger:                  unittest.Logger(),
 		SporkID:                 sporkID,
 		Config:                  &inspectorConfig,
-		Distributor:             distributor,
 		IdProvider:              idProvider,
 		HeroCacheMetricsFactory: metrics.NewNoopHeroCacheMetricsFactory(),
 		InspectorMetrics:        metrics.NewNoopCollector(),
 		RpcTracker:              meshTracer,
 		NetworkingType:          network.PrivateNetwork,
+		InvalidControlMessageNotificationConsumer: consumer,
 		TopicOracle: func() p2p.TopicProvider {
 			return topicProvider
 		},
@@ -469,7 +451,7 @@ func TestValidationInspector_UnknownClusterId_Detection(t *testing.T) {
 		p2ptest.WithRole(role),
 		internal.WithCorruptGossipSub(corruptlibp2p.CorruptGossipSubFactory(), corruptlibp2p.CorruptGossipSubConfigFactoryWithInspector(corruptInspectorFunc)))
 	idProvider.On("ByPeerID", victimNode.ID()).Return(&victimIdentity, true).Maybe()
-	idProvider.On("ByPeerID", spammer.SpammerNode.ID()).Return(&spammer.SpammerId, true).Times(4)
+	idProvider.On("ByPeerID", spammer.SpammerNode.ID()).Return(&spammer.SpammerId, true)
 
 	// setup cluster prefixed topic with an invalid cluster ID
 	unknownClusterID := channels.Topic(channels.SyncCluster("unknown-cluster-ID"))
@@ -508,47 +490,43 @@ func TestValidationInspector_ActiveClusterIdsNotSet_Graft_Detection(t *testing.T
 	flowConfig, err := config.DefaultConfig()
 	require.NoError(t, err)
 	inspectorConfig := flowConfig.NetworkConfig.GossipSub.RpcInspector.Validation
+	inspectorConfig.GraftPrune.InvalidTopicIdThreshold = 0
 	inspectorConfig.ClusterPrefixedMessage.HardThreshold = 5
 	inspectorConfig.InspectionQueue.NumberOfWorkers = 1
-	controlMessageCount := int64(10)
 
 	count := atomic.NewInt64(0)
 	done := make(chan struct{})
-	expectedNumOfLogs := 5
-
-	hook := zerolog.HookFunc(func(e *zerolog.Event, level zerolog.Level, message string) {
-		if level == zerolog.WarnLevel {
-			if message == "active cluster ids not set" {
-				count.Inc()
-			}
-		}
-		if count.Load() == int64(expectedNumOfLogs) {
-			close(done)
-		}
-	})
-	logger := zerolog.New(os.Stdout).Level(zerolog.WarnLevel).Hook(hook)
-
-	inspectorIdProvider := mock.NewIdentityProvider(t)
 	idProvider := mock.NewIdentityProvider(t)
 	spammer := corruptlibp2p.NewGossipSubRouterSpammer(t, sporkID, role, idProvider)
 	ctx, cancel := context.WithCancel(context.Background())
 	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
 
-	distributor := mockp2p.NewGossipSubInspectorNotificationDistributor(t)
-	p2ptest.MockInspectorNotificationDistributorReadyDoneAware(distributor)
+	consumer := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
+	consumer.On("OnInvalidControlMessageNotification", mockery.Anything).Run(func(args mockery.Arguments) {
+		count.Inc()
+		notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
+		require.True(t, ok)
+		require.Equal(t, notification.TopicType, p2p.CtrlMsgTopicTypeClusterPrefixed)
+		require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
+		require.True(t, validation.IsInvalidTopicIDThresholdExceeded(notification.Error))
+		require.Equal(t, notification.MsgType, p2pmsg.CtrlMsgGraft)
+		if count.Load() == 1 {
+			close(done)
+		}
+	}).Return().Once()
 	meshTracer := meshTracerFixture(flowConfig, idProvider)
 
-	topicProvider := newMockUpdatableTopicProvider()
+	topicProvider := p2ptest.NewUpdatableTopicProviderFixture()
 	validationInspector, err := validation.NewControlMsgValidationInspector(&validation.InspectorParams{
-		Logger:                  logger,
+		Logger:                  unittest.Logger(),
 		SporkID:                 sporkID,
 		Config:                  &inspectorConfig,
-		Distributor:             distributor,
-		IdProvider:              inspectorIdProvider,
+		IdProvider:              idProvider,
 		HeroCacheMetricsFactory: metrics.NewNoopHeroCacheMetricsFactory(),
 		InspectorMetrics:        metrics.NewNoopCollector(),
 		RpcTracker:              meshTracer,
 		NetworkingType:          network.PrivateNetwork,
+		InvalidControlMessageNotificationConsumer: consumer,
 		TopicOracle: func() p2p.TopicProvider {
 			return topicProvider
 		},
@@ -563,13 +541,10 @@ func TestValidationInspector_ActiveClusterIdsNotSet_Graft_Detection(t *testing.T
 		p2ptest.WithRole(role),
 		internal.WithCorruptGossipSub(corruptlibp2p.CorruptGossipSubFactory(), corruptlibp2p.CorruptGossipSubConfigFactoryWithInspector(corruptInspectorFunc)))
 	idProvider.On("ByPeerID", victimNode.ID()).Return(&victimIdentity, true).Maybe()
-	idProvider.On("ByPeerID", spammer.SpammerNode.ID()).Return(&spammer.SpammerId, true).Maybe()
-	// we expect controlMessageCount plus 1 extra call, this is due to messages that are exchanged when the nodes startup
-	inspectorIdProvider.On("ByPeerID", spammer.SpammerNode.ID()).Return(&spammer.SpammerId, true).Times(int(controlMessageCount + 1))
-	clusterPrefixedTopic := randomClusterPrefixedTopic()
-
+	idProvider.On("ByPeerID", spammer.SpammerNode.ID()).Return(&spammer.SpammerId, true)
+	topics := randomClusterPrefixedTopics(int(inspectorConfig.ClusterPrefixedMessage.HardThreshold) + 1)
 	// set topic oracle to return list with all topics to avoid hasSubscription failures and force topic validation
-	topicProvider.UpdateTopics([]string{clusterPrefixedTopic.String()})
+	topicProvider.UpdateTopics(topics)
 
 	// we deliberately avoid setting the cluster IDs so that we eventually receive errors after we have exceeded the allowed cluster
 	// prefixed hard threshold
@@ -580,7 +555,7 @@ func TestValidationInspector_ActiveClusterIdsNotSet_Graft_Detection(t *testing.T
 	defer stopComponents(t, cancel, nodes, validationInspector)
 	// generate multiple control messages with GRAFT's for randomly generated
 	// cluster prefixed channels, this ensures we do not encounter duplicate topic ID errors
-	ctlMsgs := spammer.GenerateCtlMessages(int(controlMessageCount), p2ptest.WithGraft(1, clusterPrefixedTopic.String()))
+	ctlMsgs := spammer.GenerateCtlMessages(1, p2ptest.WithGrafts(topics...))
 	// start spamming the victim peer
 	spammer.SpamControlMessage(t, victimNode, ctlMsgs)
 
@@ -596,50 +571,48 @@ func TestValidationInspector_ActiveClusterIdsNotSet_Prune_Detection(t *testing.T
 	flowConfig, err := config.DefaultConfig()
 	require.NoError(t, err)
 	inspectorConfig := flowConfig.NetworkConfig.GossipSub.RpcInspector.Validation
+	inspectorConfig.GraftPrune.InvalidTopicIdThreshold = 0
 	inspectorConfig.ClusterPrefixedMessage.HardThreshold = 5
 	inspectorConfig.InspectionQueue.NumberOfWorkers = 1
-	controlMessageCount := int64(10)
 
 	count := atomic.NewInt64(0)
 	done := make(chan struct{})
-	expectedNumOfLogs := 5
-	hook := zerolog.HookFunc(func(e *zerolog.Event, level zerolog.Level, message string) {
-		if level == zerolog.WarnLevel {
-			if message == "active cluster ids not set" {
-				count.Inc()
-			}
-		}
-		if count.Load() == int64(expectedNumOfLogs) {
-			close(done)
-		}
-	})
-	logger := zerolog.New(os.Stdout).Level(zerolog.WarnLevel).Hook(hook)
-
 	idProvider := mock.NewIdentityProvider(t)
 	spammer := corruptlibp2p.NewGossipSubRouterSpammer(t, sporkID, role, idProvider)
 	ctx, cancel := context.WithCancel(context.Background())
 	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
 
-	distributor := mockp2p.NewGossipSubInspectorNotificationDistributor(t)
-	p2ptest.MockInspectorNotificationDistributorReadyDoneAware(distributor)
+	consumer := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
+	consumer.On("OnInvalidControlMessageNotification", mockery.Anything).Run(func(args mockery.Arguments) {
+		count.Inc()
+		notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
+		require.True(t, ok)
+		require.Equal(t, notification.TopicType, p2p.CtrlMsgTopicTypeClusterPrefixed)
+		require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
+		require.True(t, validation.IsInvalidTopicIDThresholdExceeded(notification.Error))
+		require.Equal(t, notification.MsgType, p2pmsg.CtrlMsgPrune)
+		if count.Load() == 1 {
+			close(done)
+		}
+	}).Return().Once()
 	meshTracer := meshTracerFixture(flowConfig, idProvider)
-	topicProvider := newMockUpdatableTopicProvider()
-	inspectorIdProvider := mock.NewIdentityProvider(t)
+	topicProvider := p2ptest.NewUpdatableTopicProviderFixture()
 	validationInspector, err := validation.NewControlMsgValidationInspector(&validation.InspectorParams{
-		Logger:                  logger,
+		Logger:                  unittest.Logger(),
 		SporkID:                 sporkID,
 		Config:                  &inspectorConfig,
-		Distributor:             distributor,
-		IdProvider:              inspectorIdProvider,
+		IdProvider:              idProvider,
 		HeroCacheMetricsFactory: metrics.NewNoopHeroCacheMetricsFactory(),
 		InspectorMetrics:        metrics.NewNoopCollector(),
 		RpcTracker:              meshTracer,
 		NetworkingType:          network.PrivateNetwork,
+		InvalidControlMessageNotificationConsumer: consumer,
 		TopicOracle: func() p2p.TopicProvider {
 			return topicProvider
 		},
 	})
 	require.NoError(t, err)
+
 	corruptInspectorFunc := corruptlibp2p.CorruptInspectorFunc(validationInspector)
 	victimNode, victimIdentity := p2ptest.NodeFixture(t,
 		sporkID,
@@ -648,13 +621,10 @@ func TestValidationInspector_ActiveClusterIdsNotSet_Prune_Detection(t *testing.T
 		p2ptest.WithRole(role),
 		internal.WithCorruptGossipSub(corruptlibp2p.CorruptGossipSubFactory(), corruptlibp2p.CorruptGossipSubConfigFactoryWithInspector(corruptInspectorFunc)))
 	idProvider.On("ByPeerID", victimNode.ID()).Return(&victimIdentity, true).Maybe()
-	idProvider.On("ByPeerID", spammer.SpammerNode.ID()).Return(&spammer.SpammerId, true).Maybe()
-	// we expect controlMessageCount plus 1 extra call, this is due to messages that are exchanged when the nodes startup
-	inspectorIdProvider.On("ByPeerID", spammer.SpammerNode.ID()).Return(&spammer.SpammerId, true).Times(int(controlMessageCount + 1))
-
-	clusterPrefixedTopic := randomClusterPrefixedTopic()
+	idProvider.On("ByPeerID", spammer.SpammerNode.ID()).Return(&spammer.SpammerId, true)
+	topics := randomClusterPrefixedTopics(int(inspectorConfig.ClusterPrefixedMessage.HardThreshold) + 1)
 	// set topic oracle to return list with all topics to avoid hasSubscription failures and force topic validation
-	topicProvider.UpdateTopics([]string{clusterPrefixedTopic.String()})
+	topicProvider.UpdateTopics(topics)
 
 	// we deliberately avoid setting the cluster IDs so that we eventually receive errors after we have exceeded the allowed cluster
 	// prefixed hard threshold
@@ -663,9 +633,9 @@ func TestValidationInspector_ActiveClusterIdsNotSet_Prune_Detection(t *testing.T
 	startNodesAndEnsureConnected(t, signalerCtx, nodes, sporkID)
 	spammer.Start(t)
 	defer stopComponents(t, cancel, nodes, validationInspector)
-	// generate multiple control messages with GRAFT's for randomly generated
+	// generate multiple control messages with prunes for randomly generated
 	// cluster prefixed channels, this ensures we do not encounter duplicate topic ID errors
-	ctlMsgs := spammer.GenerateCtlMessages(int(controlMessageCount), p2ptest.WithPrune(1, clusterPrefixedTopic.String()))
+	ctlMsgs := spammer.GenerateCtlMessages(1, p2ptest.WithPrunes(topics...))
 	// start spamming the victim peer
 	spammer.SpamControlMessage(t, victimNode, ctlMsgs)
 
@@ -673,94 +643,88 @@ func TestValidationInspector_ActiveClusterIdsNotSet_Prune_Detection(t *testing.T
 }
 
 // TestValidationInspector_Unstaked_Node_Detection ensures that RPC control message inspector disseminates an invalid control message notification when an unstaked peer
-// sends a control message for a cluster prefixed topic.
+// sends an RPC.
 func TestValidationInspector_UnstakedNode_Detection(t *testing.T) {
 	role := flow.RoleConsensus
 	sporkID := unittest.IdentifierFixture()
 	flowConfig, err := config.DefaultConfig()
 	require.NoError(t, err)
 	inspectorConfig := flowConfig.NetworkConfig.GossipSub.RpcInspector.Validation
-	// set hard threshold to 0 so that in the case of invalid cluster ID
-	// we force the inspector to return an error
-	inspectorConfig.ClusterPrefixedMessage.HardThreshold = 0
 	inspectorConfig.InspectionQueue.NumberOfWorkers = 1
-
-	// SafetyThreshold < messageCount < HardThreshold ensures that the RPC message will be further inspected and topic IDs will be checked
-	// restricting the message count to 1 allows us to only aggregate a single error when the error is logged in the inspector.
-	messageCount := 10
 	controlMessageCount := int64(1)
 
 	count := atomic.NewInt64(0)
 	done := make(chan struct{})
-	expectedNumOfLogs := 2
-	hook := zerolog.HookFunc(func(e *zerolog.Event, level zerolog.Level, message string) {
-		if level == zerolog.WarnLevel {
-			if message == "control message received from unstaked peer" {
-				count.Inc()
-			}
-		}
-		if count.Load() == int64(expectedNumOfLogs) {
-			close(done)
-		}
-	})
-	logger := zerolog.New(os.Stdout).Level(zerolog.WarnLevel).Hook(hook)
 
 	idProvider := mock.NewIdentityProvider(t)
+	inspectorIDProvider := mock.NewIdentityProvider(t)
 	spammer := corruptlibp2p.NewGossipSubRouterSpammer(t, sporkID, role, idProvider)
 	ctx, cancel := context.WithCancel(context.Background())
 	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
 
-	distributor := mockp2p.NewGossipSubInspectorNotificationDistributor(t)
-	p2ptest.MockInspectorNotificationDistributorReadyDoneAware(distributor)
-	meshTracer := meshTracerFixture(flowConfig, idProvider)
+	unstakedPeerID := unittest.PeerIdFixture(t)
+	consumer := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
+	consumer.On("OnInvalidControlMessageNotification", mockery.Anything).Run(func(args mockery.Arguments) {
+		count.Inc()
+		notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
+		require.True(t, ok)
+		require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType)
+		require.Equal(t, unstakedPeerID, notification.PeerID)
+		require.True(t, validation.IsErrUnstakedPeer(notification.Error))
+		require.Equal(t, notification.MsgType, p2pmsg.CtrlMsgRPC)
+
+		if count.Load() == 2 {
+			close(done)
+		}
+	}).Return()
 
-	topicProvider := newMockUpdatableTopicProvider()
-	inspectorIdProvider := mock.NewIdentityProvider(t)
+	meshTracer := meshTracerFixture(flowConfig, idProvider)
+	topicProvider := p2ptest.NewUpdatableTopicProviderFixture()
 	validationInspector, err := validation.NewControlMsgValidationInspector(&validation.InspectorParams{
-		Logger:                  logger,
+		Logger:                  unittest.Logger(),
 		SporkID:                 sporkID,
 		Config:                  &inspectorConfig,
-		Distributor:             distributor,
-		IdProvider:              inspectorIdProvider,
+		IdProvider:              inspectorIDProvider,
 		HeroCacheMetricsFactory: metrics.NewNoopHeroCacheMetricsFactory(),
 		InspectorMetrics:        metrics.NewNoopCollector(),
 		RpcTracker:              meshTracer,
 		NetworkingType:          network.PrivateNetwork,
+		InvalidControlMessageNotificationConsumer: consumer,
 		TopicOracle: func() p2p.TopicProvider {
 			return topicProvider
 		},
 	})
 	require.NoError(t, err)
 	corruptInspectorFunc := corruptlibp2p.CorruptInspectorFunc(validationInspector)
+	// we need to wait until nodes are connected before we can start returning unstaked identity.
+	nodesConnected := atomic.NewBool(false)
 	victimNode, victimIdentity := p2ptest.NodeFixture(t,
 		sporkID,
 		t.Name(),
 		idProvider,
 		p2ptest.WithRole(role),
-		internal.WithCorruptGossipSub(corruptlibp2p.CorruptGossipSubFactory(), corruptlibp2p.CorruptGossipSubConfigFactoryWithInspector(corruptInspectorFunc)))
+		internal.WithCorruptGossipSub(corruptlibp2p.CorruptGossipSubFactory(), corruptlibp2p.CorruptGossipSubConfigFactoryWithInspector(func(id peer.ID, rpc *corrupt.RPC) error {
+			if nodesConnected.Load() {
+				// after nodes are connected invoke corrupt callback with an unstaked peer ID
+				return corruptInspectorFunc(unstakedPeerID, rpc)
+			}
+			return corruptInspectorFunc(id, rpc)
+		})))
 	idProvider.On("ByPeerID", victimNode.ID()).Return(&victimIdentity, true).Maybe()
 	idProvider.On("ByPeerID", spammer.SpammerNode.ID()).Return(&spammer.SpammerId, true).Maybe()
-	// we expect 2 calls from notification inspection plus 1 extra call, this is due to messages that are exchanged when the nodes startup
-	inspectorIdProvider.On("ByPeerID", spammer.SpammerNode.ID()).Return(nil, false).Times(3)
-
-	// setup cluster prefixed topic with an invalid cluster ID
-	clusterID := flow.ChainID("known-cluster-id")
-	clusterIDTopic := channels.Topic(channels.SyncCluster(clusterID))
-	// consume cluster ID update so that active cluster IDs set
-	validationInspector.ActiveClustersChanged(flow.ChainIDList{clusterID})
-
-	// set topic oracle to return list with all topics to avoid hasSubscription failures and force topic validation
-	topicProvider.UpdateTopics([]string{clusterIDTopic.String()})
+	inspectorIDProvider.On("ByPeerID", spammer.SpammerNode.ID()).Return(&spammer.SpammerId, true)
+	inspectorIDProvider.On("ByPeerID", unstakedPeerID).Return(nil, false)
 
 	validationInspector.Start(signalerCtx)
 	nodes := []p2p.LibP2PNode{victimNode, spammer.SpammerNode}
 	startNodesAndEnsureConnected(t, signalerCtx, nodes, sporkID)
+	nodesConnected.Store(true)
 	spammer.Start(t)
 	defer stopComponents(t, cancel, nodes, validationInspector)
 
-	// prepare to spam - generate control messages
-	graftCtlMsgsDuplicateTopic := spammer.GenerateCtlMessages(int(controlMessageCount), p2ptest.WithGraft(messageCount, clusterIDTopic.String()))
-	pruneCtlMsgsDuplicateTopic := spammer.GenerateCtlMessages(int(controlMessageCount), p2ptest.WithPrune(messageCount, clusterIDTopic.String()))
+	// prepare to spam - generate control messages each of which will be immediately rejected because the sender is unstaked
+	graftCtlMsgsDuplicateTopic := spammer.GenerateCtlMessages(int(controlMessageCount), p2ptest.WithGraft(10, ""))
+	pruneCtlMsgsDuplicateTopic := spammer.GenerateCtlMessages(int(controlMessageCount), p2ptest.WithPrune(10, ""))
 
 	// start spamming the victim peer
 	spammer.SpamControlMessage(t, victimNode, graftCtlMsgsDuplicateTopic)
@@ -784,24 +748,6 @@ func TestValidationInspector_InspectIWants_CacheMissThreshold(t *testing.T) {
 	controlMessageCount := int64(1)
 	cacheMissThresholdNotifCount := atomic.NewUint64(0)
 	done := make(chan struct{})
-	// ensure expected notifications are disseminated with expected error
-	inspectDisseminatedNotifyFunc := func(spammer *corruptlibp2p.GossipSubRouterSpammer) func(args mockery.Arguments) {
-		return func(args mockery.Arguments) {
-			notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
-			require.True(t, ok)
-			require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType, "IsClusterPrefixed is expected to be false, no RPC with cluster prefixed topic sent in this test")
-			require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
-			require.True(t,
-				notification.MsgType == p2pmsg.CtrlMsgIWant,
-				fmt.Sprintf("unexpected control message type %s error: %s", notification.MsgType, notification.Error))
-			require.True(t, validation.IsIWantCacheMissThresholdErr(notification.Error))
-
-			cacheMissThresholdNotifCount.Inc()
-			if cacheMissThresholdNotifCount.Load() == 1 {
-				close(done)
-			}
-		}
-	}
 
 	idProvider := mock.NewIdentityProvider(t)
 	spammer := corruptlibp2p.NewGossipSubRouterSpammer(t, sporkID, role, idProvider)
@@ -809,22 +755,33 @@ func TestValidationInspector_InspectIWants_CacheMissThreshold(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
 
-	distributor := mockp2p.NewGossipSubInspectorNotificationDistributor(t)
-	p2ptest.MockInspectorNotificationDistributorReadyDoneAware(distributor)
-	withExpectedNotificationDissemination(1, inspectDisseminatedNotifyFunc)(distributor, spammer)
-	meshTracer := meshTracerFixture(flowConfig, idProvider)
+	consumer := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
+	consumer.On("OnInvalidControlMessageNotification", mockery.Anything).Run(func(args mockery.Arguments) {
+		notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
+		require.True(t, ok)
+		require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType, "IsClusterPrefixed is expected to be false, no RPC with cluster prefixed topic sent in this test")
+		require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
+		require.True(t, notification.MsgType == p2pmsg.CtrlMsgIWant, fmt.Sprintf("unexpected control message type %s error: %s", notification.MsgType, notification.Error))
+		require.True(t, validation.IsIWantCacheMissThresholdErr(notification.Error))
+
+		cacheMissThresholdNotifCount.Inc()
+		if cacheMissThresholdNotifCount.Load() == 1 {
+			close(done)
+		}
+	}).Return().Once()
 
-	topicProvider := newMockUpdatableTopicProvider()
+	meshTracer := meshTracerFixture(flowConfig, idProvider)
+	topicProvider := p2ptest.NewUpdatableTopicProviderFixture()
 	validationInspector, err := validation.NewControlMsgValidationInspector(&validation.InspectorParams{
 		Logger:                  unittest.Logger(),
 		SporkID:                 sporkID,
 		Config:                  &inspectorConfig,
-		Distributor:             distributor,
 		IdProvider:              idProvider,
 		HeroCacheMetricsFactory: metrics.NewNoopHeroCacheMetricsFactory(),
 		InspectorMetrics:        metrics.NewNoopCollector(),
 		RpcTracker:              meshTracer,
 		NetworkingType:          network.PrivateNetwork,
+		InvalidControlMessageNotificationConsumer: consumer,
 		TopicOracle: func() p2p.TopicProvider {
 			return topicProvider
 		},
@@ -902,7 +859,7 @@ func TestValidationInspector_InspectRpcPublishMessages(t *testing.T) {
 	// ejected identity
 	ejectedIdentityPeerID := unittest.PeerIdFixture(t)
 	ejectedIdentity := unittest.IdentityFixture()
-	ejectedIdentity.Ejected = true
+	ejectedIdentity.EpochParticipationStatus = flow.EpochParticipationStatusEjected
 
 	// invalid messages this should force a notification to disseminate
 	invalidPublishMsgs := []*pb.Message{
@@ -918,48 +875,42 @@ func TestValidationInspector_InspectRpcPublishMessages(t *testing.T) {
 	// first create 4 valid messages
 	publishMsgs := unittest.GossipSubMessageFixtures(4, topic.String(), unittest.WithFrom(spammer.SpammerNode.ID()))
 	publishMsgs = append(publishMsgs, invalidPublishMsgs...)
-	// ensure expected notifications are disseminated with expected error
-	inspectDisseminatedNotifyFunc := func(spammer *corruptlibp2p.GossipSubRouterSpammer) func(args mockery.Arguments) {
-		return func(args mockery.Arguments) {
-			notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
-			require.True(t, ok)
-			require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType, "IsClusterPrefixed is expected to be false, no RPC with cluster prefixed topic sent in this test")
-			require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
-			require.True(t,
-				notification.MsgType == p2pmsg.RpcPublishMessage,
-				fmt.Sprintf("unexpected control message type %s error: %s", notification.MsgType, notification.Error))
-			require.True(t, validation.IsInvalidRpcPublishMessagesErr(notification.Error))
-			require.Contains(t,
-				notification.Error.Error(),
-				fmt.Sprintf("%d error(s) encountered", len(invalidPublishMsgs)),
-				fmt.Sprintf("expected %d errors, an error for each invalid pubsub message", len(invalidPublishMsgs)))
-			require.Contains(t, notification.Error.Error(), fmt.Sprintf("received rpc publish message from unstaked peer: %s", unknownPeerID))
-			require.Contains(t, notification.Error.Error(), fmt.Sprintf("received rpc publish message from ejected peer: %s", ejectedIdentityPeerID))
-			notificationCount.Inc()
-			if notificationCount.Load() == 1 {
-				close(done)
-			}
-		}
-	}
 
 	ctx, cancel := context.WithCancel(context.Background())
 	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
 
-	distributor := mockp2p.NewGossipSubInspectorNotificationDistributor(t)
-	p2ptest.MockInspectorNotificationDistributorReadyDoneAware(distributor)
-	withExpectedNotificationDissemination(1, inspectDisseminatedNotifyFunc)(distributor, spammer)
+	consumer := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
+	consumer.On("OnInvalidControlMessageNotification", mockery.Anything).Run(func(args mockery.Arguments) {
+		notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
+		require.True(t, ok)
+		require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType, "IsClusterPrefixed is expected to be false, no RPC with cluster prefixed topic sent in this test")
+		require.Equal(t, spammer.SpammerNode.ID(), notification.PeerID)
+		require.True(t, notification.MsgType == p2pmsg.RpcPublishMessage, fmt.Sprintf("unexpected control message type %s error: %s", notification.MsgType, notification.Error))
+		require.True(t, validation.IsInvalidRpcPublishMessagesErr(notification.Error))
+		require.Contains(t,
+			notification.Error.Error(),
+			fmt.Sprintf("%d error(s) encountered", len(invalidPublishMsgs)),
+			fmt.Sprintf("expected %d errors, an error for each invalid pubsub message", len(invalidPublishMsgs)))
+		require.Contains(t, notification.Error.Error(), fmt.Sprintf("unstaked peer: %s", unknownPeerID))
+		require.Contains(t, notification.Error.Error(), fmt.Sprintf("ejected peer: %s", ejectedIdentityPeerID))
+		notificationCount.Inc()
+		if notificationCount.Load() == 1 {
+			close(done)
+		}
+	}).Return().Once()
+
 	meshTracer := meshTracerFixture(flowConfig, idProvider)
-	topicProvider := newMockUpdatableTopicProvider()
+	topicProvider := p2ptest.NewUpdatableTopicProviderFixture()
 	validationInspector, err := validation.NewControlMsgValidationInspector(&validation.InspectorParams{
 		Logger:                  unittest.Logger(),
 		SporkID:                 sporkID,
 		Config:                  &inspectorConfig,
-		Distributor:             distributor,
 		IdProvider:              idProvider,
 		HeroCacheMetricsFactory: metrics.NewNoopHeroCacheMetricsFactory(),
 		InspectorMetrics:        metrics.NewNoopCollector(),
 		RpcTracker:              meshTracer,
 		NetworkingType:          network.PrivateNetwork,
+		InvalidControlMessageNotificationConsumer: consumer,
 		TopicOracle: func() p2p.TopicProvider {
 			return topicProvider
 		},
@@ -970,12 +921,10 @@ func TestValidationInspector_InspectRpcPublishMessages(t *testing.T) {
 	for i := 0; i < len(publishMsgs); i++ {
 		topics[i] = publishMsgs[i].GetTopic()
 	}
-	topicProvider.UpdateTopics(topics)
 
+	topicProvider.UpdateTopics(topics)
 	// after 7 errors encountered disseminate a notification
 	inspectorConfig.PublishMessages.ErrorThreshold = 6
-
-	require.NoError(t, err)
 	corruptInspectorFunc := corruptlibp2p.CorruptInspectorFunc(validationInspector)
 	victimNode, victimIdentity := p2ptest.NodeFixture(t,
 		sporkID,
@@ -991,9 +940,6 @@ func TestValidationInspector_InspectRpcPublishMessages(t *testing.T) {
 	// return ejected identity for peer ID will force message validation failure
 	idProvider.On("ByPeerID", ejectedIdentityPeerID).Return(ejectedIdentity, true).Once()
 
-	// set topic oracle to return list with all topics to avoid hasSubscription failures and force topic validation
-	topicProvider.UpdateTopics([]string{topic.String(), unknownTopic, malformedTopic, invalidSporkIDTopic})
-
 	validationInspector.Start(signalerCtx)
 	nodes := []p2p.LibP2PNode{victimNode, spammer.SpammerNode}
 	startNodesAndEnsureConnected(t, signalerCtx, nodes, sporkID)
@@ -1011,13 +957,28 @@ func TestValidationInspector_InspectRpcPublishMessages(t *testing.T) {
 	require.Equal(t, uint64(1), notificationCount.Load())
 }
 
-// TestGossipSubSpamMitigationIntegration tests that the spam mitigation feature of GossipSub is working as expected.
-// The test puts toghether the spam detection (through the GossipSubInspector) and the spam mitigation (through the
+// TestGossipSubSpamMitigationIntegration_Grafts tests that the spam mitigation feature of GossipSub is working as expected for Graft control messages.
+func TestGossipSubSpamMitigationIntegration_Grafts(t *testing.T) {
+	testGossipSubSpamMitigationIntegration(t, p2pmsg.CtrlMsgGraft)
+}
+
+// TestGossipSubSpamMitigationIntegration_Prunes tests that the spam mitigation feature of GossipSub is working as expected for Prune control messages.
+func TestGossipSubSpamMitigationIntegration_Prunes(t *testing.T) {
+	testGossipSubSpamMitigationIntegration(t, p2pmsg.CtrlMsgPrune)
+}
+
+// TestGossipSubSpamMitigationIntegration_IHaves tests that the spam mitigation feature of GossipSub is working as expected for IHaves control messages.
+func TestGossipSubSpamMitigationIntegration_IHaves(t *testing.T) {
+	testGossipSubSpamMitigationIntegration(t, p2pmsg.CtrlMsgIHave)
+}
+
+// testGossipSubSpamMitigationIntegration tests that the spam mitigation feature of GossipSub is working as expected.
+// The test puts together the spam detection (through the GossipSubInspector) and the spam mitigation (through the
 // scoring system) and ensures that the mitigation is triggered when the spam detection detects spam.
-// The test scenario involves a spammer node that sends a large number of control messages to a victim node.
+// The test scenario involves a spammer node that sends a large number of control messages for the specified control message type to a victim node.
 // The victim node is configured to use the GossipSubInspector to detect spam and the scoring system to mitigate spam.
 // The test ensures that the victim node is disconnected from the spammer node on the GossipSub mesh after the spam detection is triggered.
-func TestGossipSubSpamMitigationIntegration(t *testing.T) {
+func testGossipSubSpamMitigationIntegration(t *testing.T, msgType p2pmsg.ControlMessageType) {
 	idProvider := mock.NewIdentityProvider(t)
 	sporkID := unittest.IdentifierFixture()
 	spammer := corruptlibp2p.NewGossipSubRouterSpammer(t, sporkID, flow.RoleConsensus, idProvider)
@@ -1029,6 +990,8 @@ func TestGossipSubSpamMitigationIntegration(t *testing.T) {
 	// set the scoring parameters to be more aggressive to speed up the test
 	cfg.NetworkConfig.GossipSub.RpcTracer.ScoreTracerInterval = 100 * time.Millisecond
 	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 100 * time.Millisecond
+	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor = .99
+
 	victimNode, victimId := p2ptest.NodeFixture(t,
 		sporkID,
 		t.Name(),
@@ -1058,8 +1021,8 @@ func TestGossipSubSpamMitigationIntegration(t *testing.T) {
 		}
 	})
 
-	spamRpcCount := 100            // total number of individual rpc messages to send
-	spamCtrlMsgCount := int64(100) // total number of control messages to send on each RPC
+	spamRpcCount := 1000            // total number of individual rpc messages to send
+	spamCtrlMsgCount := int64(1000) // total number of control messages to send on each RPC
 
 	// unknownTopic is an unknown topic to the victim node but shaped like a valid topic (i.e., it has the correct prefix and spork ID).
 	unknownTopic := channels.Topic(fmt.Sprintf("%s/%s", p2ptest.GossipSubTopicIdFixture(), sporkID))
@@ -1088,29 +1051,38 @@ func TestGossipSubSpamMitigationIntegration(t *testing.T) {
 		return unittest.ProposalFixture()
 	})
 
-	// prepares spam graft and prune messages with different strategies.
-	graftCtlMsgsWithUnknownTopic := spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithGraft(spamRpcCount, unknownTopic.String()))
-	graftCtlMsgsWithMalformedTopic := spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithGraft(spamRpcCount, malformedTopic.String()))
-	graftCtlMsgsInvalidSporkIDTopic := spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithGraft(spamRpcCount, invalidSporkIDTopic.String()))
-	graftCtlMsgsDuplicateTopic := spammer.GenerateCtlMessages(int(spamCtrlMsgCount), // sets duplicate to +2 above the threshold to ensure that the victim node will penalize the spammer node
-		p2ptest.WithGraft(cfg.NetworkConfig.GossipSub.RpcInspector.Validation.GraftPrune.DuplicateTopicIdThreshold+2, duplicateTopic.String()))
-
-	pruneCtlMsgsWithUnknownTopic := spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithPrune(spamRpcCount, unknownTopic.String()))
-	pruneCtlMsgsWithMalformedTopic := spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithPrune(spamRpcCount, malformedTopic.String()))
-	pruneCtlMsgsInvalidSporkIDTopic := spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithGraft(spamRpcCount, invalidSporkIDTopic.String()))
-	pruneCtlMsgsDuplicateTopic := spammer.GenerateCtlMessages(int(spamCtrlMsgCount), // sets duplicate to +2 above the threshold to ensure that the victim node will penalize the spammer node
-		p2ptest.WithPrune(cfg.NetworkConfig.GossipSub.RpcInspector.Validation.GraftPrune.DuplicateTopicIdThreshold+2, duplicateTopic.String()))
+	var unknownTopicSpam []pubsub_pb.ControlMessage
+	var malformedTopicSpam []pubsub_pb.ControlMessage
+	var invalidSporkIDTopicSpam []pubsub_pb.ControlMessage
+	var duplicateTopicSpam []pubsub_pb.ControlMessage
+	switch msgType {
+	case p2pmsg.CtrlMsgGraft:
+		unknownTopicSpam = spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithGraft(spamRpcCount, unknownTopic.String()))
+		malformedTopicSpam = spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithGraft(spamRpcCount, malformedTopic.String()))
+		invalidSporkIDTopicSpam = spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithGraft(spamRpcCount, invalidSporkIDTopic.String()))
+		duplicateTopicSpam = spammer.GenerateCtlMessages(int(spamCtrlMsgCount), // sets duplicate to +2 above the threshold to ensure that the victim node will penalize the spammer node
+			p2ptest.WithGraft(cfg.NetworkConfig.GossipSub.RpcInspector.Validation.GraftPrune.DuplicateTopicIdThreshold+2, duplicateTopic.String()))
+	case p2pmsg.CtrlMsgPrune:
+		unknownTopicSpam = spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithPrune(spamRpcCount, unknownTopic.String()))
+		malformedTopicSpam = spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithPrune(spamRpcCount, malformedTopic.String()))
+		invalidSporkIDTopicSpam = spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithPrune(spamRpcCount, invalidSporkIDTopic.String()))
+		duplicateTopicSpam = spammer.GenerateCtlMessages(int(spamCtrlMsgCount), // sets duplicate to +2 above the threshold to ensure that the victim node will penalize the spammer node
+			p2ptest.WithPrune(cfg.NetworkConfig.GossipSub.RpcInspector.Validation.GraftPrune.DuplicateTopicIdThreshold+2, duplicateTopic.String()))
+	case p2pmsg.CtrlMsgIHave:
+		unknownTopicSpam = spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithIHave(spamRpcCount, 100, unknownTopic.String()))
+		malformedTopicSpam = spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithIHave(spamRpcCount, 100, malformedTopic.String()))
+		invalidSporkIDTopicSpam = spammer.GenerateCtlMessages(int(spamCtrlMsgCount), p2ptest.WithIHave(spamRpcCount, 100, invalidSporkIDTopic.String()))
+		duplicateTopicSpam = spammer.GenerateCtlMessages(int(spamCtrlMsgCount), // sets duplicate to +2 above the threshold to ensure that the victim node will penalize the spammer node
+			p2ptest.WithIHave(cfg.NetworkConfig.GossipSub.RpcInspector.Validation.IHave.DuplicateTopicIdThreshold+spamRpcCount, 100, duplicateTopic.String()))
+	default:
+		t.Fatal("invalid control message type expected graft or prune")
+	}
 
 	// start spamming the victim peer
-	spammer.SpamControlMessage(t, victimNode, graftCtlMsgsWithUnknownTopic)
-	spammer.SpamControlMessage(t, victimNode, graftCtlMsgsWithMalformedTopic)
-	spammer.SpamControlMessage(t, victimNode, graftCtlMsgsInvalidSporkIDTopic)
-	spammer.SpamControlMessage(t, victimNode, graftCtlMsgsDuplicateTopic)
-
-	spammer.SpamControlMessage(t, victimNode, pruneCtlMsgsWithUnknownTopic)
-	spammer.SpamControlMessage(t, victimNode, pruneCtlMsgsWithMalformedTopic)
-	spammer.SpamControlMessage(t, victimNode, pruneCtlMsgsInvalidSporkIDTopic)
-	spammer.SpamControlMessage(t, victimNode, pruneCtlMsgsDuplicateTopic)
+	spammer.SpamControlMessage(t, victimNode, unknownTopicSpam)
+	spammer.SpamControlMessage(t, victimNode, malformedTopicSpam)
+	spammer.SpamControlMessage(t, victimNode, invalidSporkIDTopicSpam)
+	spammer.SpamControlMessage(t, victimNode, duplicateTopicSpam)
 	scoreOptParameters := cfg.NetworkConfig.GossipSub.ScoringParameters.PeerScoring.Internal.Thresholds
 	// wait for three GossipSub heartbeat intervals to ensure that the victim node has penalized the spammer node.
 	require.Eventually(t, func() bool {
@@ -1132,36 +1104,3 @@ func TestGossipSubSpamMitigationIntegration(t *testing.T) {
 			return unittest.ProposalFixture()
 		})
 }
-
-// mockUpdatableTopicProvider is a mock implementation of the TopicProvider interface.
-// TODO: there is a duplicate implementation of this in the test package, we should consolidate them.
-// The duplicate exists in network/p2p/inspector/internal/mockTopicProvider.go. The reason for duplication is that
-// the inspector/validation package does not have a separate test package. Hence, sharing the mock implementation
-// will cause a cyclic dependency.
-type mockUpdatableTopicProvider struct {
-	topics        []string
-	subscriptions map[string][]peer.ID
-}
-
-func newMockUpdatableTopicProvider() *mockUpdatableTopicProvider {
-	return &mockUpdatableTopicProvider{
-		topics:        []string{},
-		subscriptions: map[string][]peer.ID{},
-	}
-}
-
-func (m *mockUpdatableTopicProvider) GetTopics() []string {
-	return m.topics
-}
-
-func (m *mockUpdatableTopicProvider) ListPeers(topic string) []peer.ID {
-	return m.subscriptions[topic]
-}
-
-func (m *mockUpdatableTopicProvider) UpdateTopics(topics []string) {
-	m.topics = topics
-}
-
-func (m *mockUpdatableTopicProvider) UpdateSubscriptions(topic string, peers []peer.ID) {
-	m.subscriptions[topic] = peers
-}
diff --git a/insecure/integration/functional/test/gossipsub/scoring/scoring_test.go b/insecure/integration/functional/test/gossipsub/scoring/scoring_test.go
index daed9f30953..184f365f60c 100644
--- a/insecure/integration/functional/test/gossipsub/scoring/scoring_test.go
+++ b/insecure/integration/functional/test/gossipsub/scoring/scoring_test.go
@@ -94,7 +94,6 @@ func TestGossipSubInvalidMessageDelivery_Integration(t *testing.T) {
 // - t: the test instance.
 // - spamMsgFactory: a function that creates unique invalid messages to spam the victim with.
 func testGossipSubInvalidMessageDeliveryScoring(t *testing.T, spamMsgFactory func(peer.ID, peer.ID, channels.Topic) *pubsub_pb.Message) {
-
 	role := flow.RoleConsensus
 	sporkId := unittest.IdentifierFixture()
 	blockTopic := channels.TopicFromChannel(channels.PushBlocks, sporkId)
@@ -108,6 +107,8 @@ func testGossipSubInvalidMessageDeliveryScoring(t *testing.T, spamMsgFactory fun
 	require.NoError(t, err)
 	// we override the decay interval to 1 second so that the score is updated within 1 second intervals.
 	cfg.NetworkConfig.GossipSub.RpcTracer.ScoreTracerInterval = 1 * time.Second
+	cfg.NetworkConfig.GossipSub.ScoringParameters.PeerScoring.Internal.TopicParameters.InvalidMessageDeliveriesDecay = .99
+
 	victimNode, victimIdentity := p2ptest.NodeFixture(
 		t,
 		sporkId,
@@ -131,15 +132,15 @@ func testGossipSubInvalidMessageDeliveryScoring(t *testing.T, spamMsgFactory fun
 		return unittest.ProposalFixture()
 	})
 
-	// generates 2000 spam messages to send to the victim node; based on default-config.yaml, ~1400 of these messages are enough to
+	// generates 3000 spam messages to send to the victim node; based on default-config.yaml, ~1400 of these messages are enough to
 	// penalize the spammer node to disconnect from the victim node.
-	totalSpamMessages := 2000
+	totalSpamMessages := 3000
 	msgs := make([]*pubsub_pb.Message, 0)
 	for i := 0; i <= totalSpamMessages; i++ {
 		msgs = append(msgs, spamMsgFactory(spammer.SpammerNode.ID(), victimNode.ID(), blockTopic))
 	}
 
-	// sends all 2000 spam messages to the victim node over 1 RPC.
+	// sends all 3000 spam messages to the victim node over 1 RPC.
 	spammer.SpamControlMessage(t, victimNode,
 		spammer.GenerateCtlMessages(1), msgs...)
 
@@ -167,7 +168,7 @@ func testGossipSubInvalidMessageDeliveryScoring(t *testing.T, spamMsgFactory fun
 		}
 
 		return true
-	}, 3*time.Second, 100*time.Millisecond)
+	}, 5*time.Second, 100*time.Millisecond)
 
 	topicsSnapshot, ok := victimNode.PeerScoreExposer().GetTopicScores(spammer.SpammerNode.ID())
 	require.True(t, ok)
@@ -446,7 +447,8 @@ func TestGossipSubMeshDeliveryScoring_Replay_Will_Not_Counted(t *testing.T) {
 	conf.NetworkConfig.GossipSub.RpcTracer.ScoreTracerInterval = 1 * time.Second
 	blockTopicOverrideParams := defaultTopicScoreParams(t)
 	blockTopicOverrideParams.MeshMessageDeliveriesActivation = 1 * time.Second // we start observing the mesh message deliveries after 1 second of the node startup.
-	thisNode, thisId := p2ptest.NodeFixture(                                   // this node is the one that will be penalizing the under-performer node.
+	// this node is the one that will be penalizing the under-performer node.
+	thisNode, thisId := p2ptest.NodeFixture(
 		t,
 		sporkId,
 		t.Name(),
diff --git a/insecure/integration/tests/composability_test.go b/insecure/integration/tests/composability_test.go
index 4bac2aeb0c5..9e996697b7e 100644
--- a/insecure/integration/tests/composability_test.go
+++ b/insecure/integration/tests/composability_test.go
@@ -13,13 +13,13 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/onflow/flow-go/engine/testutil"
 	"github.com/onflow/flow-go/insecure"
 	"github.com/onflow/flow-go/insecure/corruptnet"
 	"github.com/onflow/flow-go/insecure/orchestrator"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/libp2p/message"
 	"github.com/onflow/flow-go/module/irrecoverable"
+	"github.com/onflow/flow-go/module/local"
 	"github.com/onflow/flow-go/network/channels"
 	"github.com/onflow/flow-go/network/stub"
 	"github.com/onflow/flow-go/utils/unittest"
@@ -122,7 +122,7 @@ func TestCorruptNetworkFrameworkHappyPath(t *testing.T) {
 // withCorruptNetwork creates a real corrupt network, starts it, runs the "run" function, and then stops it.
 func withCorruptNetwork(t *testing.T, run func(*testing.T, flow.Identity, *corruptnet.Network, *stub.Hub)) {
 	codec := unittest.NetworkCodec()
-	corruptedIdentity := unittest.IdentityFixture(unittest.WithAddress(insecure.DefaultAddress))
+	corruptedIdentity := unittest.PrivateNodeInfoFixture(unittest.WithAddress(insecure.DefaultAddress))
 
 	// life-cycle management of orchestratorNetwork.
 	ctx, cancel := context.WithCancel(context.Background())
@@ -138,11 +138,16 @@ func withCorruptNetwork(t *testing.T, run func(*testing.T, flow.Identity, *corru
 	hub := stub.NewNetworkHub()
 	ccf := corruptnet.NewCorruptConduitFactory(unittest.Logger(), flow.BftTestnet)
 	flowNetwork := stub.NewNetwork(t, corruptedIdentity.NodeID, hub, stub.WithConduitFactory(ccf))
+
+	privateKeys, err := corruptedIdentity.PrivateKeys()
+	require.NoError(t, err)
+	me, err := local.New(corruptedIdentity.Identity().IdentitySkeleton, privateKeys.StakingKey)
+	require.NoError(t, err)
 	corruptNetwork, err := corruptnet.NewCorruptNetwork(
 		unittest.Logger(),
 		flow.BftTestnet,
 		insecure.DefaultAddress,
-		testutil.LocalFixture(t, corruptedIdentity),
+		me,
 		codec,
 		flowNetwork,
 		ccf)
@@ -161,7 +166,7 @@ func withCorruptNetwork(t *testing.T, run func(*testing.T, flow.Identity, *corru
 		flowNetwork.StartConDev(100*time.Millisecond, true)
 	}, 100*time.Millisecond, "failed to start corrupted node network")
 
-	run(t, *corruptedIdentity, corruptNetwork, hub)
+	run(t, *corruptedIdentity.Identity(), corruptNetwork, hub)
 
 	// terminates orchestratorNetwork
 	cancel()
diff --git a/insecure/wintermute/attackOrchestrator.go b/insecure/wintermute/attackOrchestrator.go
index 40b7b60616e..9ff3bd3c1f5 100644
--- a/insecure/wintermute/attackOrchestrator.go
+++ b/insecure/wintermute/attackOrchestrator.go
@@ -217,8 +217,8 @@ func (o *Orchestrator) handleExecutionReceiptEvent(receiptEvent *insecure.Egress
 	corruptedResult := o.corruptExecutionResult(receipt)
 
 	corruptedExecutionIds := o.allNodeIds.Filter(
-		filter.And(filter.HasRole(flow.RoleExecution),
-			filter.HasNodeID(o.corruptedNodeIds...))).NodeIDs()
+		filter.And(filter.HasRole[flow.Identity](flow.RoleExecution),
+			filter.HasNodeID[flow.Identity](o.corruptedNodeIds...))).NodeIDs()
 
 	// sends corrupted execution result to all corrupted execution nodes.
 	for _, corruptedExecutionId := range corruptedExecutionIds {
@@ -394,7 +394,7 @@ func (o *Orchestrator) replyWithAttestation(chunkDataPackRequestEvent *insecure.
 		}
 
 		// sends an attestation on behalf of verification node to all consensus nodes
-		consensusIds := o.allNodeIds.Filter(filter.HasRole(flow.RoleConsensus)).NodeIDs()
+		consensusIds := o.allNodeIds.Filter(filter.HasRole[flow.Identity](flow.RoleConsensus)).NodeIDs()
 		err = o.network.SendEgress(&insecure.EgressEvent{
 			CorruptOriginId: chunkDataPackRequestEvent.CorruptOriginId,
 			Channel:         channels.PushApprovals,
diff --git a/insecure/wintermute/attackOrchestrator_test.go b/insecure/wintermute/attackOrchestrator_test.go
index 1c5d46f6899..bb1c70e5f73 100644
--- a/insecure/wintermute/attackOrchestrator_test.go
+++ b/insecure/wintermute/attackOrchestrator_test.go
@@ -27,13 +27,13 @@ func TestSingleExecutionReceipt(t *testing.T) {
 	rootStateFixture, allIds, corruptedIds := bootstrapWintermuteFlowSystem(t)
 
 	// identities of nodes who are expected targets of an execution receipt.
-	receiptTargetIds, err := rootStateFixture.State.Final().Identities(filter.HasRole(flow.RoleAccess, flow.RoleConsensus, flow.RoleVerification))
+	receiptTargetIds, err := rootStateFixture.State.Final().Identities(filter.HasRole[flow.Identity](flow.RoleAccess, flow.RoleConsensus, flow.RoleVerification))
 	require.NoError(t, err)
 
 	corruptedExecutionIds := flow.IdentifierList(
 		allIds.Filter(
-			filter.And(filter.HasRole(flow.RoleExecution),
-				filter.HasNodeID(corruptedIds...)),
+			filter.And(filter.HasRole[flow.Identity](flow.RoleExecution),
+				filter.HasNodeID[flow.Identity](corruptedIds...)),
 		).NodeIDs())
 	eventMap, receipts := receiptsWithSameResultFixture(t, 1, corruptedExecutionIds[0:1], receiptTargetIds.NodeIDs())
 
@@ -140,11 +140,11 @@ func testConcurrentExecutionReceipts(t *testing.T,
 	rootStateFixture, allIds, corruptedIds := bootstrapWintermuteFlowSystem(t)
 	corruptedExecutionIds := flow.IdentifierList(
 		allIds.Filter(
-			filter.And(filter.HasRole(flow.RoleExecution),
-				filter.HasNodeID(corruptedIds...)),
+			filter.And(filter.HasRole[flow.Identity](flow.RoleExecution),
+				filter.HasNodeID[flow.Identity](corruptedIds...)),
 		).NodeIDs())
 	// identities of nodes who are expected targets of an execution receipt.
-	receiptTargetIds, err := rootStateFixture.State.Final().Identities(filter.HasRole(flow.RoleAccess, flow.RoleConsensus, flow.RoleVerification))
+	receiptTargetIds, err := rootStateFixture.State.Final().Identities(filter.HasRole[flow.Identity](flow.RoleAccess, flow.RoleConsensus, flow.RoleVerification))
 	require.NoError(t, err)
 
 	var eventMap map[flow.Identifier]*insecure.EgressEvent
@@ -270,8 +270,8 @@ func TestRespondingWithCorruptedAttestation(t *testing.T) {
 	_, allIds, corruptedIds := bootstrapWintermuteFlowSystem(t)
 	corruptedVerIds := flow.IdentifierList(
 		allIds.Filter(
-			filter.And(filter.HasRole(flow.RoleVerification),
-				filter.HasNodeID(corruptedIds...)),
+			filter.And(filter.HasRole[flow.Identity](flow.RoleVerification),
+				filter.HasNodeID[flow.Identity](corruptedIds...)),
 		).NodeIDs())
 	wintermuteOrchestrator := NewOrchestrator(unittest.Logger(), corruptedIds, allIds)
 
@@ -351,8 +351,8 @@ func TestPassingThroughChunkDataRequests(t *testing.T) {
 	_, allIds, corruptedIds := bootstrapWintermuteFlowSystem(t)
 	corruptedVerIds := flow.IdentifierList(
 		allIds.Filter(
-			filter.And(filter.HasRole(flow.RoleVerification),
-				filter.HasNodeID(corruptedIds...)),
+			filter.And(filter.HasRole[flow.Identity](flow.RoleVerification),
+				filter.HasNodeID[flow.Identity](corruptedIds...)),
 		).NodeIDs())
 	wintermuteOrchestrator := NewOrchestrator(unittest.Logger(), corruptedIds, allIds)
 
@@ -440,7 +440,7 @@ func TestPassingThroughChunkDataResponse_WithAttack(t *testing.T) {
 func testPassingThroughChunkDataResponse(t *testing.T, state *attackState) {
 	totalChunks := 10
 	_, allIds, corruptedIds := bootstrapWintermuteFlowSystem(t)
-	verIds := flow.IdentifierList(allIds.Filter(filter.HasRole(flow.RoleVerification)).NodeIDs())
+	verIds := flow.IdentifierList(allIds.Filter(filter.HasRole[flow.Identity](flow.RoleVerification)).NodeIDs())
 	wintermuteOrchestrator := NewOrchestrator(unittest.Logger(), corruptedIds, allIds)
 
 	wintermuteOrchestrator.state = state
@@ -510,8 +510,8 @@ func TestWintermuteChunkResponseForCorruptedChunks(t *testing.T) {
 	_, allIds, corruptedIds := bootstrapWintermuteFlowSystem(t)
 	honestVnIds := flow.IdentifierList(
 		allIds.Filter(filter.And(
-			filter.HasRole(flow.RoleVerification),
-			filter.Not(filter.HasNodeID(corruptedIds...)))).NodeIDs())
+			filter.HasRole[flow.Identity](flow.RoleVerification),
+			filter.Not(filter.HasNodeID[flow.Identity](corruptedIds...)))).NodeIDs())
 	wintermuteOrchestrator := NewOrchestrator(unittest.Logger(), corruptedIds, allIds)
 
 	originalResult := unittest.ExecutionResultFixture()
diff --git a/integration/Makefile b/integration/Makefile
index 2811de6ddb3..df840bebc8b 100644
--- a/integration/Makefile
+++ b/integration/Makefile
@@ -1,6 +1,8 @@
 # Name of the cover profile
 COVER_PROFILE := cover.out
 
+GO_TEST_PACKAGES := `go list ./... | grep -v -e integration/tests`
+
 # allows CI to specify whether to have race detection on / off
 ifeq ($(RACE_DETECTOR),1)
 	RACE_FLAG := -race
@@ -8,10 +10,9 @@ else
 	RACE_FLAG :=
 endif
 
+# set `CRYPTO_FLAG` when building natively (not cross-compiling)
 include ../crypto_adx_flag.mk
 
-CGO_FLAG := CGO_CFLAGS=$(CRYPTO_FLAG)
-
 # Run the integration test suite
 .PHONY: integration-test
 integration-test: access-tests ghost-tests mvp-tests execution-tests verification-tests upgrades-tests collection-tests epochs-tests network-tests consensus-tests
@@ -19,30 +20,30 @@ integration-test: access-tests ghost-tests mvp-tests execution-tests verificatio
 # Run unit tests for test utilities in this module
 .PHONY: test
 test:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) -coverprofile=$(COVER_PROFILE) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) `go list ./... | grep -v -e integration/tests`
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test $(if $(VERBOSE),-v,) -coverprofile=$(COVER_PROFILE) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) $(GO_TEST_PACKAGES)
 
 .PHONY: access-tests
 access-tests: access-cohort1-tests access-cohort2-tests access-cohort3-tests
 
 .PHONY: access-cohort1-tests
 access-cohort1-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/access/cohort1/...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/access/cohort1/...
 
 .PHONY: access-cohort2-tests
 access-cohort2-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/access/cohort2/...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/access/cohort2/...
 
 .PHONY: access-cohort3-tests
 access-cohort3-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/access/cohort3/...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/access/cohort3/...
 
 .PHONY: collection-tests
 collection-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/collection/...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/collection/...
 
 .PHONY: consensus-tests
 consensus-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/consensus/...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/consensus/...
 
 .PHONY: epochs-tests
 epochs-tests: epochs-cohort1-tests epochs-cohort2-tests
@@ -50,48 +51,48 @@ epochs-tests: epochs-cohort1-tests epochs-cohort2-tests
 .PHONY: epochs-cohort1-tests
 epochs-cohort1-tests:
 	# Use a higher timeout of 20m for the suite of tests which span full epochs
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) -timeout 20m ./tests/epochs/cohort1/...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) -timeout 20m ./tests/epochs/cohort1/...
 
 .PHONY: epochs-cohort2-tests
 epochs-cohort2-tests:
 	# Use a higher timeout of 20m for the suite of tests which span full epochs
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) -timeout 20m ./tests/epochs/cohort2/...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) -timeout 20m ./tests/epochs/cohort2/...
 
 .PHONY: ghost-tests
 ghost-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/ghost/...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/ghost/...
 
 .PHONY: mvp-tests
 mvp-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/mvp/...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/mvp/...
 
 .PHONY: execution-tests
 execution-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/execution/...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/execution/...
 
 .PHONY: verification-tests
 verification-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/verification/...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/verification/...
 
 # upgrades-tests tests need to be run sequentially (-p 1) due to interference between different Docker networks when tests are run in parallel
 .PHONY: upgrades-tests
 upgrades-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/upgrades/... -p 1
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/upgrades/... -p 1
 
 .PHONY: network-tests
 network-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/network/...
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/network/...
 
 # BFT tests need to be run sequentially (-p 1) due to interference between different Docker networks when tests are run in parallel
 .PHONY: bft-framework-tests
 bft-framework-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/bft/framework/... -p 1
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/bft/framework/... -p 1
 .PHONY: bft-protocol-tests
 bft-protocol-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/bft/protocol/... -p 1
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/bft/protocol/... -p 1
 .PHONY: bft-gossipsub-tests
 bft-gossipsub-tests:
-	$(CGO_FLAG) go test $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/bft/gossipsub/... -p 1
+	CGO_CFLAGS=$(CRYPTO_FLAG) go test -failfast $(if $(VERBOSE),-v,) $(RACE_FLAG) $(if $(JSON_OUTPUT),-json,) $(if $(NUM_RUNS),-count $(NUM_RUNS),) ./tests/bft/gossipsub/... -p 1
 
 .PHONY: bft-tests
 bft-tests: bft-framework-tests bft-protocol-tests bft-gossipsub-tests
diff --git a/integration/README.md b/integration/README.md
index b6b59f4fa82..8b479f06477 100644
--- a/integration/README.md
+++ b/integration/README.md
@@ -14,15 +14,15 @@ Since the test cases run docker instances as a network of nodes, we need to ensu
 To ensure the latest docker images have been built, you can run:
 
 ```
-make docker-build-access
-make docker-build-collection
-make docker-build-consensus
-make docker-build-execution
-make docker-build-verification
-make docker-build-ghost
+make docker-native-build-access
+make docker-native-build-collection
+make docker-native-build-consensus
+make docker-native-build-execution
+make docker-native-build-verification
+make docker-native-build-ghost
 ```
 
-Or simply run `make docker-build-flow`
+Or simply run `make docker-native-build-flow`
 
 After images have been built, we can run the integration tests:
 ```
@@ -65,11 +65,11 @@ Because launching a full execution node in the consensus integration tests will
 ### Rebuild image when debugging
 During test cases debugging, you might want to update some code. However, if you run `make integration-test` after updating the code, the new change will not be included, because the integration tests still use the old code from the docker image, which was built before adding the changes.
 
-So you need to rebuild all the images by running `make docker-build-flow` again before re-running the integration tests.
+So you need to rebuild all the images by running `make docker-native-build-flow` again before re-running the integration tests.
 
 Rebuilding all images takes quite some time, here is a shortcut:
 
-If consensus's code was changed, then only consensus's image need to be rebuilt, so simply run `make docker-build-consensus` instead of rebuilding all the images.
+If consensus's code was changed, then only consensus's image need to be rebuilt, so simply run `make docker-native-build-consensus` instead of rebuilding all the images.
 
 ### Organization
 
@@ -81,4 +81,4 @@ in the Makefile.
 
 To send random transactions, for example to load test a network, run `cd integration/localnet; make load`.
 
-In order to build a docker container with the benchmarking binary, run `make docker-build-loader` from the root of this repository.
+In order to build a docker container with the benchmarking binary, run `make docker-native-build-loader` from the root of this repository.
diff --git a/integration/benchmark/account/account.go b/integration/benchmark/account/account.go
index 81a938d93b3..9cce1304056 100644
--- a/integration/benchmark/account/account.go
+++ b/integration/benchmark/account/account.go
@@ -12,62 +12,70 @@ import (
 )
 
 type FlowAccount struct {
-	Address *flowsdk.Address
-	ID      int
-
-	keys *keystore
+	Address    flowsdk.Address
+	keys       *keystore
+	PrivateKey crypto.PrivateKey
+	HashAlgo   crypto.HashAlgorithm
 }
 
-func New(i int, address *flowsdk.Address, privKey crypto.PrivateKey, accountKeys []*flowsdk.AccountKey) (*FlowAccount, error) {
-	keys := make([]*accountKey, 0, len(accountKeys))
+func New(
+	address flowsdk.Address,
+	privateKey crypto.PrivateKey,
+	hashAlgo crypto.HashAlgorithm,
+	accountKeys []flowsdk.AccountKey,
+) (*FlowAccount, error) {
+	keys := make([]*AccountKey, 0, len(accountKeys))
 	for _, key := range accountKeys {
-		signer, err := crypto.NewInMemorySigner(privKey, key.HashAlgo)
+		// signer are not thread safe, so we need to create a new signer for each key
+		signer, err := crypto.NewInMemorySigner(privateKey, hashAlgo)
 		if err != nil {
-			return nil, fmt.Errorf("error while creating signer: %w", err)
+			return nil, fmt.Errorf("error while creating in-memory signer: %w", err)
 		}
 
-		keys = append(keys, &accountKey{
-			AccountKey: *key,
+		keys = append(keys, &AccountKey{
+			AccountKey: key,
 			Address:    address,
 			Signer:     signer,
 		})
 	}
 
 	return &FlowAccount{
-		Address: address,
-		ID:      i,
-		keys:    newKeystore(keys),
+		Address:    address,
+		keys:       newKeystore(keys),
+		PrivateKey: privateKey,
+		HashAlgo:   hashAlgo,
 	}, nil
 }
 
-func LoadServiceAccount(
+func LoadAccount(
 	ctx context.Context,
 	flowClient access.Client,
-	servAccAddress *flowsdk.Address,
-	servAccPrivKeyHex string,
+	address flowsdk.Address,
+	privateKey crypto.PrivateKey,
+	hashAlgo crypto.HashAlgorithm,
 ) (*FlowAccount, error) {
-	acc, err := flowClient.GetAccount(ctx, *servAccAddress)
+	acc, err := flowClient.GetAccount(ctx, address)
 	if err != nil {
-		return nil, fmt.Errorf("error while calling get account for service account: %w", err)
+		return nil, fmt.Errorf("error while calling get account for account %s: %w", address, err)
 	}
 
-	privateKey, err := crypto.DecodePrivateKeyHex(acc.Keys[0].SigAlgo, servAccPrivKeyHex)
-	if err != nil {
-		return nil, fmt.Errorf("error while decoding serice account private key hex: %w", err)
+	keys := make([]flowsdk.AccountKey, len(acc.Keys))
+	for i, key := range acc.Keys {
+		keys[i] = *key
 	}
 
-	return New(0, servAccAddress, privateKey, acc.Keys)
+	return New(address, privateKey, hashAlgo, keys)
 }
 
 func (acc *FlowAccount) NumKeys() int {
 	return acc.keys.Size()
 }
 
-func (acc *FlowAccount) GetKey() (*accountKey, error) {
+func (acc *FlowAccount) GetKey() (*AccountKey, error) {
 	return acc.keys.getKey()
 }
 
-// randomPrivateKey returns a randomly generated ECDSA P-256 private key.
+// RandomPrivateKey returns a randomly generated ECDSA P-256 private key.
 func RandomPrivateKey() crypto.PrivateKey {
 	seed := make([]byte, crypto.MinSeedLength)
 
diff --git a/integration/benchmark/account/account_loader.go b/integration/benchmark/account/account_loader.go
new file mode 100644
index 00000000000..595cabfaf67
--- /dev/null
+++ b/integration/benchmark/account/account_loader.go
@@ -0,0 +1,64 @@
+package account
+
+import (
+	"context"
+
+	"github.com/rs/zerolog"
+
+	flowsdk "github.com/onflow/flow-go-sdk"
+	"github.com/onflow/flow-go-sdk/access"
+	"github.com/onflow/flow-go-sdk/crypto"
+)
+
+type Loader interface {
+	Load(
+		address flowsdk.Address,
+		privateKey crypto.PrivateKey,
+		hashAlgo crypto.HashAlgorithm,
+	) (*FlowAccount, error)
+}
+
+type ClientAccountLoader struct {
+	log        zerolog.Logger
+	ctx        context.Context
+	flowClient access.Client
+}
+
+func NewClientAccountLoader(
+	log zerolog.Logger,
+	ctx context.Context,
+	flowClient access.Client,
+) *ClientAccountLoader {
+	return &ClientAccountLoader{
+		log:        log.With().Str("component", "account_loader").Logger(),
+		ctx:        ctx,
+		flowClient: flowClient,
+	}
+}
+
+func (c *ClientAccountLoader) Load(
+	address flowsdk.Address,
+	privateKey crypto.PrivateKey,
+	hashAlgo crypto.HashAlgorithm,
+) (*FlowAccount, error) {
+	acc, err := LoadAccount(c.ctx, c.flowClient, address, privateKey, hashAlgo)
+
+	c.log.Debug().
+		Str("address", address.String()).
+		Int("keys", acc.NumKeys()).
+		Msg("Loaded account")
+
+	return acc, err
+}
+
+func ReloadAccount(c Loader, acc *FlowAccount) error {
+	newAcc, err := c.Load(acc.Address, acc.PrivateKey, acc.HashAlgo)
+	if err != nil {
+		return err
+	}
+
+	acc.keys = newAcc.keys
+	return nil
+}
+
+var _ Loader = (*ClientAccountLoader)(nil)
diff --git a/integration/benchmark/account/account_provider.go b/integration/benchmark/account/account_provider.go
new file mode 100644
index 00000000000..89eec3b1f1a
--- /dev/null
+++ b/integration/benchmark/account/account_provider.go
@@ -0,0 +1,231 @@
+package account
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/onflow/cadence"
+	"github.com/rs/zerolog"
+	"golang.org/x/sync/errgroup"
+
+	flowsdk "github.com/onflow/flow-go-sdk"
+	"github.com/onflow/flow-go/module/util"
+
+	"github.com/onflow/flow-go-sdk/crypto"
+	"github.com/onflow/flow-go/fvm/blueprints"
+	"github.com/onflow/flow-go/fvm/systemcontracts"
+	"github.com/onflow/flow-go/integration/benchmark/common"
+	"github.com/onflow/flow-go/integration/benchmark/scripts"
+	"github.com/onflow/flow-go/model/flow"
+)
+
+var ErrNoAccountsAvailable = errors.New("no accounts available")
+
+type AccountProvider interface {
+	// BorrowAvailableAccount borrows an account from the account provider.
+	// It doesn't block.
+	// If no account is available, it returns ErrNoAccountsAvailable.
+	BorrowAvailableAccount() (*FlowAccount, error)
+	// ReturnAvailableAccount returns an account to the account provider, so it can be reused.
+	ReturnAvailableAccount(*FlowAccount)
+}
+
+type provider struct {
+	log                      zerolog.Logger
+	availableAccounts        chan *FlowAccount
+	numberOfAccounts         int
+	accountCreationBatchSize int
+}
+
+var _ AccountProvider = (*provider)(nil)
+
+func (p *provider) BorrowAvailableAccount() (*FlowAccount, error) {
+	select {
+	case account := <-p.availableAccounts:
+		return account, nil
+	default:
+		return nil, ErrNoAccountsAvailable
+	}
+}
+
+func (p *provider) ReturnAvailableAccount(account *FlowAccount) {
+	select {
+	case p.availableAccounts <- account:
+	default:
+	}
+}
+
+func SetupProvider(
+	log zerolog.Logger,
+	ctx context.Context,
+	numberOfAccounts int,
+	fundAmount uint64,
+	rb common.ReferenceBlockProvider,
+	creator *FlowAccount,
+	sender common.TransactionSender,
+	chain flow.Chain,
+) (AccountProvider, error) {
+	p := &provider{
+		log:                      log.With().Str("component", "AccountProvider").Logger(),
+		availableAccounts:        make(chan *FlowAccount, numberOfAccounts),
+		numberOfAccounts:         numberOfAccounts,
+		accountCreationBatchSize: 25,
+	}
+
+	err := p.init(ctx, fundAmount, rb, creator, sender, chain)
+	if err != nil {
+		return nil, fmt.Errorf("failed to initialize account provider: %w", err)
+	}
+
+	return p, nil
+}
+
+func (p *provider) init(
+	ctx context.Context,
+	fundAmount uint64,
+	rb common.ReferenceBlockProvider,
+	creator *FlowAccount,
+	sender common.TransactionSender,
+	chain flow.Chain,
+) error {
+	g, ctx := errgroup.WithContext(ctx)
+	g.SetLimit(creator.NumKeys())
+
+	progress := util.LogProgress(p.log,
+		util.DefaultLogProgressConfig(
+			"creating accounts",
+			p.numberOfAccounts,
+		))
+
+	p.log.Info().
+		Int("number_of_accounts", p.numberOfAccounts).
+		Int("account_creation_batch_size", p.accountCreationBatchSize).
+		Int("number_of_keys", creator.NumKeys()).
+		Msg("creating accounts")
+
+	for i := 0; i < p.numberOfAccounts; i += p.accountCreationBatchSize {
+		i := i
+		g.Go(func() error {
+			select {
+			case <-ctx.Done():
+				return nil
+			default:
+			}
+
+			num := p.accountCreationBatchSize
+			if i+p.accountCreationBatchSize > p.numberOfAccounts {
+				num = p.numberOfAccounts - i
+			}
+
+			defer func() { progress(num) }()
+
+			err := p.createAccountBatch(num, fundAmount, rb, creator, sender, chain)
+			if err != nil {
+				p.log.
+					Err(err).
+					Int("batch_size", num).
+					Int("index", i).
+					Msg("error creating accounts")
+				return err
+			}
+
+			return nil
+		})
+	}
+	err := g.Wait()
+	if err != nil {
+		return fmt.Errorf("error creating accounts: %w", err)
+	}
+	return nil
+}
+
+func (p *provider) createAccountBatch(
+	num int,
+	fundAmount uint64,
+	rb common.ReferenceBlockProvider,
+	creator *FlowAccount,
+	sender common.TransactionSender,
+	chain flow.Chain,
+) error {
+	wrapErr := func(err error) error {
+		return fmt.Errorf("error in create accounts: %w", err)
+	}
+
+	privKey := RandomPrivateKey()
+	accountKey := flowsdk.NewAccountKey().
+		FromPrivateKey(privKey).
+		SetHashAlgo(crypto.SHA3_256).
+		SetWeight(flowsdk.AccountKeyWeightThreshold)
+
+	sc := systemcontracts.SystemContractsForChain(chain.ChainID())
+
+	// Generate an account creation script
+	createAccountTx := flowsdk.NewTransaction().
+		SetScript(scripts.CreateAccountsTransaction(
+			flowsdk.BytesToAddress(sc.FungibleToken.Address.Bytes()),
+			flowsdk.BytesToAddress(sc.FlowToken.Address.Bytes()))).
+		SetReferenceBlockID(rb.ReferenceBlockID())
+
+	publicKey := blueprints.BytesToCadenceArray(accountKey.PublicKey.Encode())
+	count := cadence.NewInt(num)
+
+	initialTokenAmount := cadence.UFix64(fundAmount)
+
+	err := createAccountTx.AddArgument(publicKey)
+	if err != nil {
+		return wrapErr(err)
+	}
+
+	err = createAccountTx.AddArgument(count)
+	if err != nil {
+		return wrapErr(err)
+	}
+
+	err = createAccountTx.AddArgument(initialTokenAmount)
+	if err != nil {
+		return wrapErr(err)
+	}
+
+	key, err := creator.GetKey()
+	if err != nil {
+		return wrapErr(err)
+	}
+	defer key.Done()
+
+	err = key.SetProposerPayerAndSign(createAccountTx)
+	if err != nil {
+		return wrapErr(err)
+	}
+
+	result, err := sender.Send(createAccountTx)
+	if err == nil || errors.Is(err, common.TransactionError{}) {
+		key.IncrementSequenceNumber()
+	}
+	if err != nil {
+		return wrapErr(err)
+	}
+
+	var accountsCreated int
+	for _, event := range result.Events {
+		if event.Type != flowsdk.EventAccountCreated {
+			continue
+		}
+
+		accountCreatedEvent := flowsdk.AccountCreatedEvent(event)
+		accountAddress := accountCreatedEvent.Address()
+
+		newAcc, err := New(accountAddress, privKey, crypto.SHA3_256, []flowsdk.AccountKey{*accountKey})
+		if err != nil {
+			return fmt.Errorf("failed to create account: %w", err)
+		}
+		accountsCreated++
+
+		p.availableAccounts <- newAcc
+	}
+	if accountsCreated != num {
+		return fmt.Errorf("failed to create enough contracts, expected: %d, created: %d",
+			num, accountsCreated)
+	}
+	return nil
+}
diff --git a/integration/benchmark/account/keys.go b/integration/benchmark/account/keys.go
index 82d90e59c81..88a2a4bc222 100644
--- a/integration/benchmark/account/keys.go
+++ b/integration/benchmark/account/keys.go
@@ -1,9 +1,17 @@
 package account
 
 import (
+	"errors"
 	"fmt"
 	"sync"
 
+	"github.com/onflow/cadence"
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/fvm/blueprints"
+	"github.com/onflow/flow-go/integration/benchmark/common"
+	"github.com/onflow/flow-go/integration/benchmark/scripts"
+
 	flowsdk "github.com/onflow/flow-go-sdk"
 
 	"github.com/onflow/flow-go-sdk/crypto"
@@ -11,25 +19,25 @@ import (
 
 var ErrNoKeysAvailable = fmt.Errorf("no keys available")
 
-type accountKey struct {
+type AccountKey struct {
 	flowsdk.AccountKey
 
 	mu      sync.Mutex
 	ks      *keystore
-	Address *flowsdk.Address
-	Signer  crypto.InMemorySigner
+	Address flowsdk.Address
+	Signer  crypto.Signer
 	inuse   bool
 }
 
 type keystore struct {
-	availableKeys chan *accountKey
+	availableKeys chan *AccountKey
 	size          int
 }
 
-func newKeystore(keys []*accountKey) *keystore {
+func newKeystore(keys []*AccountKey) *keystore {
 	ks := &keystore{}
 
-	availableKeys := make(chan *accountKey, len(keys))
+	availableKeys := make(chan *AccountKey, len(keys))
 	for _, key := range keys {
 		key.ks = ks
 		availableKeys <- key
@@ -44,7 +52,7 @@ func (k *keystore) Size() int {
 	return k.size
 }
 
-func (k *keystore) getKey() (*accountKey, error) {
+func (k *keystore) getKey() (*AccountKey, error) {
 	select {
 	case key := <-k.availableKeys:
 		key.mu.Lock()
@@ -61,7 +69,7 @@ func (k *keystore) getKey() (*accountKey, error) {
 	}
 }
 
-func (k *accountKey) markUnused() {
+func (k *AccountKey) markUnused() {
 	k.mu.Lock()
 	defer k.mu.Unlock()
 
@@ -69,14 +77,14 @@ func (k *accountKey) markUnused() {
 }
 
 // Done unlocks a key after use and puts it back into the pool.
-func (k *accountKey) Done() {
+func (k *AccountKey) Done() {
 	k.markUnused()
 	k.ks.availableKeys <- k
 }
 
 // IncrementSequenceNumber is called when a key was successfully used to sign a transaction as the proposer.
 // It increments the sequence number.
-func (k *accountKey) IncrementSequenceNumber() {
+func (k *AccountKey) IncrementSequenceNumber() {
 	k.mu.Lock()
 	defer k.mu.Unlock()
 
@@ -86,17 +94,93 @@ func (k *accountKey) IncrementSequenceNumber() {
 	k.SequenceNumber++
 }
 
-func (k *accountKey) SignPayload(tx *flowsdk.Transaction) error {
-	return tx.SignPayload(*k.Address, k.Index, k.Signer)
+func (k *AccountKey) SignPayload(tx *flowsdk.Transaction) error {
+	return tx.SignPayload(k.Address, k.Index, k.Signer)
 }
 
-func (k *accountKey) SignTx(tx *flowsdk.Transaction) error {
+func (k *AccountKey) SetProposerPayerAndSign(tx *flowsdk.Transaction) error {
 	if len(tx.Authorizers) == 0 {
-		tx = tx.AddAuthorizer(*k.Address)
+		tx = tx.AddAuthorizer(k.Address)
 	}
 
 	return tx.
-		SetProposalKey(*k.Address, k.Index, k.SequenceNumber).
-		SetPayer(*k.Address).
-		SignEnvelope(*k.Address, k.Index, k.Signer)
+		SetProposalKey(k.Address, k.Index, k.SequenceNumber).
+		SetPayer(k.Address).
+		SignEnvelope(k.Address, k.Index, k.Signer)
+}
+
+func EnsureAccountHasKeys(
+	log zerolog.Logger,
+	account *FlowAccount,
+	num int,
+	referenceBlockProvider common.ReferenceBlockProvider,
+	sender common.TransactionSender,
+) error {
+	if account.NumKeys() >= num {
+		return nil
+	}
+
+	numberOfKeysToAdd := num - account.NumKeys()
+
+	return AddKeysToAccount(log, account, numberOfKeysToAdd, referenceBlockProvider, sender)
+}
+
+func AddKeysToAccount(
+	log zerolog.Logger,
+	account *FlowAccount,
+	numberOfKeysToAdd int,
+	referenceBlockProvider common.ReferenceBlockProvider,
+	sender common.TransactionSender,
+) error {
+	log.Debug().
+		Int("number_of_keys_to_add", numberOfKeysToAdd).
+		Str("account", account.Address.String()).
+		Msg("adding keys to account")
+
+	key, err := account.GetKey()
+	if err != nil {
+		return err
+	}
+	defer key.Done()
+
+	wrapErr := func(err error) error {
+		return fmt.Errorf("error adding keys to account %s: %w", account.Address, err)
+	}
+	accountKeys := make([]flowsdk.AccountKey, numberOfKeysToAdd)
+	for i := 0; i < numberOfKeysToAdd; i++ {
+		accountKey := key.AccountKey
+		accountKey.Index = i + account.NumKeys()
+		accountKey.SequenceNumber = 0
+		accountKeys[i] = accountKey
+	}
+
+	cadenceKeys := make([]cadence.Value, numberOfKeysToAdd)
+	for i := 0; i < numberOfKeysToAdd; i++ {
+		cadenceKeys[i] = blueprints.BytesToCadenceArray(accountKeys[i].PublicKey.Encode())
+	}
+	cadenceKeysArray := cadence.NewArray(cadenceKeys)
+
+	addKeysTx := flowsdk.NewTransaction().
+		SetScript(scripts.AddKeysToAccountTransaction).
+		SetReferenceBlockID(referenceBlockProvider.ReferenceBlockID())
+
+	err = addKeysTx.AddArgument(cadenceKeysArray)
+	if err != nil {
+		return err
+	}
+
+	err = key.SetProposerPayerAndSign(addKeysTx)
+	if err != nil {
+		return wrapErr(err)
+	}
+
+	_, err = sender.Send(addKeysTx)
+	if err == nil || errors.Is(err, common.TransactionError{}) {
+		key.IncrementSequenceNumber()
+	}
+	if err != nil {
+		return wrapErr(err)
+	}
+
+	return nil
 }
diff --git a/integration/benchmark/cmd/ci/adjuster.go b/integration/benchmark/cmd/ci/adjuster.go
index ed96d9b53ab..2367fe7af22 100644
--- a/integration/benchmark/cmd/ci/adjuster.go
+++ b/integration/benchmark/cmd/ci/adjuster.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"time"
 
@@ -11,7 +12,7 @@ import (
 	"github.com/onflow/flow-go/integration/benchmark"
 )
 
-type adjuster struct {
+type Adjuster struct {
 	ctx    context.Context
 	cancel context.CancelFunc
 	done   chan struct{}
@@ -47,9 +48,9 @@ func NewTPSAdjuster(
 	lg *benchmark.ContLoadGenerator,
 	workerStatsTracker *benchmark.WorkerStatsTracker,
 	params AdjusterParams,
-) *adjuster {
+) *Adjuster {
 	ctx, cancel := context.WithCancel(ctx)
-	a := &adjuster{
+	a := &Adjuster{
 		ctx:    ctx,
 		cancel: cancel,
 		done:   make(chan struct{}),
@@ -77,29 +78,29 @@ func NewTPSAdjuster(
 	go func() {
 		defer close(a.done)
 
-		log.Info().Dur("delayInMS", params.Delay).Msg("Waiting before starting TPS adjuster")
+		log.Info().Dur("delayInMS", params.Delay).Msg("Waiting before starting TPS Adjuster")
 		select {
 		case <-time.After(params.Delay):
-			log.Info().Msg("starting TPS adjuster")
+			log.Info().Msg("starting TPS Adjuster")
 		case <-ctx.Done():
 			return
 		}
 
 		err := a.adjustTPSForever()
-		if err != nil && err != context.Canceled {
-			log.Error().Err(err).Msg("adjuster failed")
+		if err != nil && !errors.Is(err, context.Canceled) {
+			log.Error().Err(err).Msg("Adjuster failed")
 		}
 	}()
 
 	return a
 }
 
-func (a *adjuster) Stop() {
+func (a *Adjuster) Stop() {
 	a.cancel()
 	<-a.done
 }
 
-func (a *adjuster) adjustTPSForever() (err error) {
+func (a *Adjuster) adjustTPSForever() (err error) {
 	initialStats := a.workerStatsTracker.GetStats()
 	lastState := adjusterState{
 		timestamp: time.Now(),
@@ -133,7 +134,7 @@ func (a *adjuster) adjustTPSForever() (err error) {
 // compared to the last round.
 //
 // Target TPS is always bounded by [minTPS, maxTPS].
-func (a *adjuster) adjustOnce(nowTs time.Time, lastState adjusterState) (adjusterState, error) {
+func (a *Adjuster) adjustOnce(nowTs time.Time, lastState adjusterState) (adjusterState, error) {
 	timeDiff := nowTs.Sub(lastState.timestamp)
 	currentStats := a.workerStatsTracker.GetStats()
 
diff --git a/integration/benchmark/cmd/ci/main.go b/integration/benchmark/cmd/ci/main.go
index adab61e1f4c..c3917f5b161 100644
--- a/integration/benchmark/cmd/ci/main.go
+++ b/integration/benchmark/cmd/ci/main.go
@@ -3,23 +3,23 @@ package main
 import (
 	"context"
 	"flag"
-	"net"
 	"os"
 	"strings"
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
-
 	"github.com/rs/zerolog"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
+	"gopkg.in/yaml.v3"
 
 	flowsdk "github.com/onflow/flow-go-sdk"
 	"github.com/onflow/flow-go-sdk/access"
 	client "github.com/onflow/flow-go-sdk/access/grpc"
 
 	"github.com/onflow/flow-go/integration/benchmark"
-	pb "github.com/onflow/flow-go/integration/benchmark/proto"
+	"github.com/onflow/flow-go/integration/benchmark/load"
+	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/metrics"
 	"github.com/onflow/flow-go/utils/unittest"
 )
@@ -30,7 +30,7 @@ type BenchmarkInfo struct {
 
 // Hardcoded CI values
 const (
-	loadType                    = "token-transfer"
+	defaultLoadType             = load.TokenTransferLoadType
 	metricport                  = uint(8080)
 	accessNodeAddress           = "127.0.0.1:4001"
 	pushgateway                 = "127.0.0.1:9091"
@@ -42,22 +42,24 @@ const (
 	defaultMetricCollectionInterval = 20 * time.Second
 
 	// gRPC constants
-	defaultMaxMsgSize  = 1024 * 1024 * 16 // 16 MB
-	defaultGRPCAddress = "127.0.0.1:4777"
+	defaultMaxMsgSize = 1024 * 1024 * 16 // 16 MB
 )
 
 func main() {
 	logLvl := flag.String("log-level", "info", "set log level")
 
 	// CI relevant flags
-	grpcAddressFlag := flag.String("grpc-address", defaultGRPCAddress, "listen address for gRPC server")
 	initialTPSFlag := flag.Int("tps-initial", 10, "starting transactions per second")
 	maxTPSFlag := flag.Int("tps-max", *initialTPSFlag, "maximum transactions per second allowed")
 	minTPSFlag := flag.Int("tps-min", *initialTPSFlag, "minimum transactions per second allowed")
+	loadTypeFlag := flag.String("load-type", string(defaultLoadType), "load type (token-transfer / const-exec / evm) from the load config file")
+	loadConfigFileLocationFlag := flag.String("load-config", "", "load config file location. If not provided, default config will be used.")
+
 	adjustIntervalFlag := flag.Duration("tps-adjust-interval", defaultAdjustInterval, "interval for adjusting TPS")
 	adjustDelayFlag := flag.Duration("tps-adjust-delay", 120*time.Second, "delay before adjusting TPS")
-	statIntervalFlag := flag.Duration("stat-interval", defaultMetricCollectionInterval, "")
 	durationFlag := flag.Duration("duration", 10*time.Minute, "test duration")
+
+	statIntervalFlag := flag.Duration("stat-interval", defaultMetricCollectionInterval, "")
 	gitRepoPathFlag := flag.String("git-repo-path", "../..", "git repo path of the filesystem")
 	gitRepoURLFlag := flag.String("git-repo-url", "https://github.com/onflow/flow-go.git", "git repo URL")
 	bigQueryUpload := flag.Bool("bigquery-upload", true, "whether to upload results to BigQuery (true / false)")
@@ -66,13 +68,16 @@ func main() {
 	bigQueryRawTableFlag := flag.String("bigquery-raw-table", "rawResults", "table name for the bigquery raw results")
 	flag.Parse()
 
-	// parse log level and apply to logger
-	log := zerolog.New(os.Stderr).With().Timestamp().Logger().Output(zerolog.ConsoleWriter{Out: os.Stderr})
-	lvl, err := zerolog.ParseLevel(strings.ToLower(*logLvl))
-	if err != nil {
-		log.Fatal().Err(err).Str("strLevel", *logLvl).Msg("invalid log level")
-	}
-	log = log.Level(lvl)
+	log := setupLogger(logLvl)
+
+	loadConfig := getLoadConfig(
+		log,
+		*loadConfigFileLocationFlag,
+		*loadTypeFlag,
+		*minTPSFlag,
+		*maxTPSFlag,
+		*initialTPSFlag,
+	)
 
 	if *gitRepoPathFlag == "" {
 		flag.PrintDefaults()
@@ -86,26 +91,6 @@ func main() {
 	<-server.Ready()
 	loaderMetrics := metrics.NewLoaderCollector()
 
-	grpcServerOptions := []grpc.ServerOption{
-		grpc.MaxRecvMsgSize(defaultMaxMsgSize),
-		grpc.MaxSendMsgSize(defaultMaxMsgSize),
-	}
-	grpcServer := grpc.NewServer(grpcServerOptions...)
-	defer grpcServer.Stop()
-
-	pb.RegisterBenchmarkServer(grpcServer, &benchmarkServer{})
-
-	grpcListener, err := net.Listen("tcp", *grpcAddressFlag)
-	if err != nil {
-		log.Fatal().Err(err).Str("address", *grpcAddressFlag).Msg("failed to listen")
-	}
-
-	go func() {
-		if err := grpcServer.Serve(grpcListener); err != nil {
-			log.Fatal().Err(err).Msg("failed to serve")
-		}
-	}()
-
 	sp := benchmark.NewStatsPusher(ctx, log, pushgateway, "loader", prometheus.DefaultGatherer)
 	defer sp.Stop()
 
@@ -136,10 +121,7 @@ func main() {
 
 	// prepare load generator
 	log.Info().
-		Str("load_type", loadType).
-		Int("initialTPS", *initialTPSFlag).
-		Int("minTPS", *minTPSFlag).
-		Int("maxTPS", *maxTPSFlag).
+		Interface("loadConfig", loadConfig).
 		Dur("duration", *durationFlag).
 		Msg("Running load case")
 
@@ -148,7 +130,7 @@ func main() {
 	workerStatsTracker := benchmark.NewWorkerStatsTracker(bCtx)
 	defer workerStatsTracker.Stop()
 
-	statsLogger := benchmark.NewPeriodicStatsLogger(workerStatsTracker, log)
+	statsLogger := benchmark.NewPeriodicStatsLogger(ctx, workerStatsTracker, log)
 	statsLogger.Start()
 	defer statsLogger.Stop()
 
@@ -159,28 +141,19 @@ func main() {
 		loaderMetrics,
 		[]access.Client{flowClient},
 		benchmark.NetworkParams{
-			ServAccPrivKeyHex:     serviceAccountPrivateKeyHex,
-			ServiceAccountAddress: &serviceAccountAddress,
-			FungibleTokenAddress:  &fungibleTokenAddress,
-			FlowTokenAddress:      &flowTokenAddress,
+			ServAccPrivKeyHex: serviceAccountPrivateKeyHex,
+			ChainId:           flow.Emulator,
 		},
 		benchmark.LoadParams{
 			NumberOfAccounts: maxInflight,
-			LoadType:         benchmark.LoadType(loadType),
+			LoadConfig:       loadConfig,
 			FeedbackEnabled:  feedbackEnabled,
 		},
-		// We do support only one load type for now.
-		benchmark.ConstExecParams{},
 	)
 	if err != nil {
 		log.Fatal().Err(err).Msg("unable to create new cont load generator")
 	}
 
-	err = lg.Init()
-	if err != nil {
-		log.Fatal().Err(err).Msg("unable to init loader")
-	}
-
 	// run load
 	err = lg.SetTPS(uint(*initialTPSFlag))
 	if err != nil {
@@ -196,9 +169,9 @@ func main() {
 		AdjusterParams{
 			Delay:       *adjustDelayFlag,
 			Interval:    *adjustIntervalFlag,
-			InitialTPS:  uint(*initialTPSFlag),
-			MinTPS:      uint(*minTPSFlag),
-			MaxTPS:      uint(*maxTPSFlag),
+			InitialTPS:  uint(loadConfig.TPSInitial),
+			MinTPS:      uint(loadConfig.TpsMin),
+			MaxTPS:      uint(loadConfig.TpsMax),
 			MaxInflight: uint(maxInflight / 2),
 		},
 	)
@@ -227,7 +200,7 @@ func main() {
 	// only upload valid data
 	if *bigQueryUpload {
 		repoInfo := MustGetRepoInfo(log, *gitRepoURLFlag, *gitRepoPathFlag)
-		mustUploadData(ctx, log, recorder, repoInfo, *bigQueryProjectFlag, *bigQueryDatasetFlag, *bigQueryRawTableFlag)
+		mustUploadData(ctx, log, recorder, repoInfo, *bigQueryProjectFlag, *bigQueryDatasetFlag, *bigQueryRawTableFlag, loadConfig.LoadName)
 	} else {
 		log.Info().Int("raw_tps_size", len(recorder.BenchmarkResults.RawTPS)).Msg("logging tps results locally")
 		// log results locally when not uploading to BigQuery
@@ -237,21 +210,92 @@ func main() {
 	}
 }
 
+func getLoadConfig(
+	log zerolog.Logger,
+	loadConfigLocation string,
+	load string,
+	minTPS int,
+	maxTPS int,
+	initialTPS int,
+) benchmark.LoadConfig {
+	if loadConfigLocation == "" {
+		lc := benchmark.LoadConfig{
+			LoadName:   load,
+			LoadType:   load,
+			TpsMax:     maxTPS,
+			TpsMin:     minTPS,
+			TPSInitial: initialTPS,
+		}
+
+		log.Info().
+			Interface("loadConfig", lc).
+			Msg("Load config file not provided, using parameters supplied in TPS flags")
+		return lc
+	}
+
+	var loadConfigs map[string]benchmark.LoadConfig
+
+	// check if the file exists
+	if _, err := os.Stat(loadConfigLocation); os.IsNotExist(err) {
+		log.Fatal().Err(err).Str("loadConfigLocation", loadConfigLocation).Msg("load config file not found")
+	}
+
+	yamlFile, err := os.ReadFile(loadConfigLocation)
+	if err != nil {
+		log.Fatal().Err(err).Str("loadConfigLocation", loadConfigLocation).Msg("failed to read load config file")
+	}
+
+	err = yaml.Unmarshal(yamlFile, &loadConfigs)
+	if err != nil {
+		log.Fatal().Err(err).Str("loadConfigLocation", loadConfigLocation).Msg("failed to unmarshal load config file")
+	}
+
+	lc, ok := loadConfigs[load]
+	if !ok {
+		log.Fatal().Str("load", load).Msg("load not found in load config file")
+	}
+	lc.LoadName = load
+
+	return lc
+}
+
+// setupLogger parses log level and apply to logger
+func setupLogger(logLvl *string) zerolog.Logger {
+	log := zerolog.New(os.Stderr).
+		With().
+		Timestamp().
+		Logger().
+		Output(zerolog.ConsoleWriter{Out: os.Stderr})
+
+	lvl, err := zerolog.ParseLevel(strings.ToLower(*logLvl))
+	if err != nil {
+		log.Fatal().Err(err).Str("strLevel", *logLvl).Msg("invalid log level")
+	}
+	log = log.Level(lvl)
+	return log
+}
+
 func mustUploadData(
 	ctx context.Context,
 	log zerolog.Logger,
-	recorder *tpsRecorder,
+	recorder *TPSRecorder,
 	repoInfo *RepoInfo,
 	bigQueryProject string,
 	bigQueryDataset string,
 	bigQueryRawTable string,
+	loadName string,
 ) {
 	log.Info().Msg("Initializing BigQuery")
 	db, err := NewDB(ctx, log, bigQueryProject)
 	if err != nil {
 		log.Fatal().Err(err).Msg("failed to create bigquery client")
 	}
-	defer db.Close()
+	defer func(db *DB) {
+		err := db.Close()
+		if err != nil {
+			log.Fatal().Err(err).Msg("failed to close bigquery client")
+		}
+	}(db)
 
 	err = db.createTable(ctx, bigQueryDataset, bigQueryRawTable, RawRecord{})
 	if err != nil {
@@ -265,7 +309,7 @@ func mustUploadData(
 		bigQueryRawTable,
 		recorder.BenchmarkResults,
 		*repoInfo,
-		BenchmarkInfo{BenchmarkType: loadType},
+		BenchmarkInfo{BenchmarkType: loadName},
 		MustGetDefaultEnvironment(),
 	)
 	if err != nil {
@@ -273,7 +317,7 @@ func mustUploadData(
 	}
 }
 
-func mustValidateData(log zerolog.Logger, recorder *tpsRecorder) {
+func mustValidateData(log zerolog.Logger, recorder *TPSRecorder) {
 	log.Info().Msg("Validating data")
 	var totalTPS float64
 	for _, record := range recorder.BenchmarkResults.RawTPS {
diff --git a/integration/benchmark/cmd/ci/recorder.go b/integration/benchmark/cmd/ci/recorder.go
index 80c03440f5e..6e482be6b14 100644
--- a/integration/benchmark/cmd/ci/recorder.go
+++ b/integration/benchmark/cmd/ci/recorder.go
@@ -39,7 +39,7 @@ type BenchmarkResults struct {
 	RawTPS []RawTPSRecord
 }
 
-type tpsRecorder struct {
+type TPSRecorder struct {
 	BenchmarkResults
 
 	lastStats benchmark.WorkerStats
@@ -56,10 +56,10 @@ func NewTPSRecorder(
 	ctx context.Context,
 	workerStatsTracker *benchmark.WorkerStatsTracker,
 	statInterval time.Duration,
-) *tpsRecorder {
+) *TPSRecorder {
 	ctx, cancel := context.WithCancel(ctx)
 
-	r := &tpsRecorder{
+	r := &TPSRecorder{
 		BenchmarkResults: BenchmarkResults{
 			Status:    StatusUnknown,
 			StartTime: time.Now(),
@@ -90,7 +90,7 @@ func NewTPSRecorder(
 	return r
 }
 
-func (r *tpsRecorder) Stop() {
+func (r *TPSRecorder) Stop() {
 	r.stopOnce.Do(func() {
 		r.cancel()
 		<-r.done
@@ -103,11 +103,11 @@ func (r *tpsRecorder) Stop() {
 	})
 }
 
-func (r *tpsRecorder) SetStatus(status Status) {
+func (r *TPSRecorder) SetStatus(status Status) {
 	r.Status = status
 }
 
-func (r *tpsRecorder) record(nowTs time.Time, stats benchmark.WorkerStats) {
+func (r *TPSRecorder) record(nowTs time.Time, stats benchmark.WorkerStats) {
 	if !r.lastTs.IsZero() {
 		r.RawTPS = append(r.RawTPS, r.statsToRawTPS(nowTs, stats))
 	}
@@ -116,7 +116,7 @@ func (r *tpsRecorder) record(nowTs time.Time, stats benchmark.WorkerStats) {
 	r.lastTs = nowTs
 }
 
-func (r *tpsRecorder) statsToRawTPS(nowTs time.Time, stats benchmark.WorkerStats) RawTPSRecord {
+func (r *TPSRecorder) statsToRawTPS(nowTs time.Time, stats benchmark.WorkerStats) RawTPSRecord {
 	timeDiff := nowTs.Sub(r.lastTs).Seconds()
 
 	return RawTPSRecord{
diff --git a/integration/benchmark/cmd/ci/server.go b/integration/benchmark/cmd/ci/server.go
deleted file mode 100644
index b3420a203e6..00000000000
--- a/integration/benchmark/cmd/ci/server.go
+++ /dev/null
@@ -1,28 +0,0 @@
-package main
-
-import (
-	"context"
-
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/types/known/emptypb"
-
-	pb "github.com/onflow/flow-go/integration/benchmark/proto"
-)
-
-type benchmarkServer struct {
-	pb.UnimplementedBenchmarkServer
-}
-
-func (s *benchmarkServer) StartMacroBenchmark(req *pb.StartMacroBenchmarkRequest, stream pb.Benchmark_StartMacroBenchmarkServer) error {
-	return status.Errorf(codes.Unimplemented, "method StartMacroBenchmark not implemented")
-}
-func (s *benchmarkServer) GetMacroBenchmark(context.Context, *pb.GetMacroBenchmarkRequest) (*pb.GetMacroBenchmarkResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetMacroBenchmark not implemented")
-}
-func (s *benchmarkServer) ListMacroBenchmarks(context.Context, *emptypb.Empty) (*pb.ListMacroBenchmarksResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListMacroBenchmarks not implemented")
-}
-func (s *benchmarkServer) Status(context.Context, *emptypb.Empty) (*pb.StatusResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Status not implemented")
-}
diff --git a/integration/benchmark/cmd/manual/Dockerfile b/integration/benchmark/cmd/manual/Dockerfile
index 788c2e6edb0..49989db4c68 100644
--- a/integration/benchmark/cmd/manual/Dockerfile
+++ b/integration/benchmark/cmd/manual/Dockerfile
@@ -39,7 +39,7 @@ RUN --mount=type=cache,sharing=locked,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=ssh \
     cd integration && \
-    CGO_ENABLED=1 CGO_FLAGS="${CGO_FLAG}" go build -ldflags "-extldflags -static" -o ./app ./${TARGET}
+    CGO_ENABLED=1 CGO_CFLAGS="${CGO_FLAG}" go build -ldflags "-extldflags -static" -o ./app ./${TARGET}
 
 RUN mv /app/integration/app /app/app
 
diff --git a/integration/benchmark/cmd/manual/main.go b/integration/benchmark/cmd/manual/main.go
index bbdd014d242..ffaa9615570 100644
--- a/integration/benchmark/cmd/manual/main.go
+++ b/integration/benchmark/cmd/manual/main.go
@@ -47,13 +47,9 @@ func main() {
 	_ = flag.Bool("track-txs", false, "deprecated")
 	accountMultiplierFlag := flag.Int("account-multiplier", 100, "number of accounts to create per load tps")
 	feedbackEnabled := flag.Bool("feedback-enabled", true, "wait for trannsaction execution before submitting new transaction")
-	maxConstExecTxSizeInBytes := flag.Uint("const-exec-max-tx-size", flow.DefaultMaxTransactionByteSize/10, "max byte size of constant exec transaction size to generate")
-	authAccNumInConstExecTx := flag.Uint("const-exec-num-authorizer", 1, "num of authorizer for each constant exec transaction to generate")
-	argSizeInByteInConstExecTx := flag.Uint("const-exec-arg-size", 100, "byte size of tx argument for each constant exec transaction to generate")
-	payerKeyCountInConstExecTx := flag.Uint("const-exec-payer-key-count", 2, "num of payer keys for each constant exec transaction to generate")
 	flag.Parse()
 
-	chainID := flowsdk.ChainID([]byte(*chainIDStr))
+	chainID := flowsdk.ChainID(*chainIDStr)
 
 	// parse log level and apply to logger
 	log := zerolog.New(os.Stderr).With().Timestamp().Logger().Output(zerolog.ConsoleWriter{Out: os.Stderr})
@@ -118,7 +114,7 @@ func main() {
 	workerStatsTracker := benchmark.NewWorkerStatsTracker(ctx)
 	defer workerStatsTracker.Stop()
 
-	statsLogger := benchmark.NewPeriodicStatsLogger(workerStatsTracker, log)
+	statsLogger := benchmark.NewPeriodicStatsLogger(context.TODO(), workerStatsTracker, log)
 	statsLogger.Start()
 	defer statsLogger.Stop()
 
@@ -129,21 +125,19 @@ func main() {
 		loaderMetrics,
 		clients,
 		benchmark.NetworkParams{
-			ServAccPrivKeyHex:     *serviceAccountPrivateKeyHex,
-			ServiceAccountAddress: &serviceAccountAddress,
-			FungibleTokenAddress:  &fungibleTokenAddress,
-			FlowTokenAddress:      &flowTokenAddress,
+			ServAccPrivKeyHex: *serviceAccountPrivateKeyHex,
+			ChainId:           flow.ChainID(chainID),
 		},
 		benchmark.LoadParams{
 			NumberOfAccounts: int(maxTPS) * *accountMultiplierFlag,
-			LoadType:         benchmark.LoadType(*loadTypeFlag),
-			FeedbackEnabled:  *feedbackEnabled,
-		},
-		benchmark.ConstExecParams{
-			MaxTxSizeInByte: *maxConstExecTxSizeInBytes,
-			AuthAccountNum:  *authAccNumInConstExecTx,
-			ArgSizeInByte:   *argSizeInByteInConstExecTx,
-			PayerKeyCount:   *payerKeyCountInConstExecTx,
+			LoadConfig: benchmark.LoadConfig{
+				LoadName:   *loadTypeFlag,
+				LoadType:   *loadTypeFlag,
+				TpsMax:     int(maxTPS),
+				TpsMin:     int(maxTPS),
+				TPSInitial: int(maxTPS),
+			},
+			FeedbackEnabled: *feedbackEnabled,
 		},
 	)
 	if err != nil {
@@ -151,11 +145,6 @@ func main() {
 	}
 	defer lg.Stop()
 
-	err = lg.Init()
-	if err != nil {
-		log.Fatal().Err(err).Msg("unable to init loader")
-	}
-
 	for i, c := range loadCases {
 		log.Info().
 			Str("load_type", *loadTypeFlag).
diff --git a/integration/benchmark/common/errors.go b/integration/benchmark/common/errors.go
new file mode 100644
index 00000000000..cd8341a3760
--- /dev/null
+++ b/integration/benchmark/common/errors.go
@@ -0,0 +1,19 @@
+package common
+
+import "fmt"
+
+type TransactionError struct {
+	Err error
+}
+
+func (m TransactionError) Error() string {
+	return fmt.Sprintf("TransactionError: %s", m.Err)
+}
+
+func (m TransactionError) Unwrap() error {
+	return m.Err
+}
+
+func NewTransactionError(err error) *TransactionError {
+	return &TransactionError{Err: err}
+}
diff --git a/integration/benchmark/common/reference_block_provider.go b/integration/benchmark/common/reference_block_provider.go
new file mode 100644
index 00000000000..c03af0cab21
--- /dev/null
+++ b/integration/benchmark/common/reference_block_provider.go
@@ -0,0 +1,8 @@
+package common
+
+import flowsdk "github.com/onflow/flow-go-sdk"
+
+type ReferenceBlockProvider interface {
+	// ReferenceBlockID returns the reference block ID of a recent block.
+	ReferenceBlockID() flowsdk.Identifier
+}
diff --git a/integration/benchmark/common/transaction_sender.go b/integration/benchmark/common/transaction_sender.go
new file mode 100644
index 00000000000..4f14693a5ea
--- /dev/null
+++ b/integration/benchmark/common/transaction_sender.go
@@ -0,0 +1,10 @@
+package common
+
+import flowsdk "github.com/onflow/flow-go-sdk"
+
+type TransactionSender interface {
+	// Send sends a transaction to the network.
+	// It blocks until the transaction result is received or an error occurs.
+	// If the transaction execution fails, the returned error type is TransactionError.
+	Send(tx *flowsdk.Transaction) (flowsdk.TransactionResult, error)
+}
diff --git a/integration/benchmark/contLoadGenerator.go b/integration/benchmark/contLoadGenerator.go
index c719699e910..4b5c147b8ff 100644
--- a/integration/benchmark/contLoadGenerator.go
+++ b/integration/benchmark/contLoadGenerator.go
@@ -5,51 +5,23 @@ import (
 	"errors"
 	"fmt"
 	"sync"
-
 	"time"
 
-	"github.com/onflow/cadence"
 	"github.com/rs/zerolog"
-	"golang.org/x/sync/errgroup"
-
-	"github.com/onflow/flow-go/integration/benchmark/account"
-	"github.com/onflow/flow-go/module/metrics"
 
 	flowsdk "github.com/onflow/flow-go-sdk"
 	"github.com/onflow/flow-go-sdk/access"
 	"github.com/onflow/flow-go-sdk/crypto"
+	"github.com/onflow/flow-go/fvm/systemcontracts"
+	"github.com/onflow/flow-go/integration/benchmark/account"
+	"github.com/onflow/flow-go/integration/benchmark/common"
+	"github.com/onflow/flow-go/integration/benchmark/load"
 	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/metrics"
+	"github.com/onflow/flow-go/utils/unittest"
 )
 
-type LoadType string
-
-const (
-	TokenTransferLoadType LoadType = "token-transfer"
-	TokenAddKeysLoadType  LoadType = "add-keys"
-	CompHeavyLoadType     LoadType = "computation-heavy"
-	EventHeavyLoadType    LoadType = "event-heavy"
-	LedgerHeavyLoadType   LoadType = "ledger-heavy"
-	ConstExecCostLoadType LoadType = "const-exec" // for an empty transactions with various tx arguments
-	ExecDataHeavyLoadType LoadType = "exec-data-heavy"
-)
-
-const lostTransactionThreshold = 90 * time.Second
-
-var accountCreationBatchSize = 750 // a higher number would hit max gRPC message size
-
-const (
-	// flow testnets only have 10e6 total supply, so we choose a small amounts here
-	tokensPerTransfer = 0.000001
-	tokensPerAccount  = 10
-)
-
-// ConstExecParam hosts all parameters for const-exec load type
-type ConstExecParams struct {
-	MaxTxSizeInByte uint
-	AuthAccountNum  uint
-	ArgSizeInByte   uint
-	PayerKeyCount   uint
-}
+const lostTransactionThreshold = 180 * time.Second
 
 // ContLoadGenerator creates a continuous load of transactions to the network
 // by creating many accounts and transfer flow tokens between them
@@ -59,12 +31,7 @@ type ContLoadGenerator struct {
 	log                zerolog.Logger
 	loaderMetrics      *metrics.LoaderCollector
 	loadParams         LoadParams
-	networkParams      NetworkParams
-	constExecParams    ConstExecParams
 	flowClient         access.Client
-	serviceAccount     *account.FlowAccount
-	favContractAddress *flowsdk.Address
-	availableAccounts  chan *account.FlowAccount // queue with accounts available for workers
 	workerStatsTracker *WorkerStatsTracker
 	stoppedChannel     chan struct{}
 	follower           TxFollower
@@ -72,21 +39,27 @@ type ContLoadGenerator struct {
 
 	workersMutex sync.Mutex
 	workers      []*Worker
-
-	accountsMutex sync.Mutex
-	accounts      []*account.FlowAccount
 }
 
 type NetworkParams struct {
-	ServAccPrivKeyHex     string
-	ServiceAccountAddress *flowsdk.Address
-	FungibleTokenAddress  *flowsdk.Address
-	FlowTokenAddress      *flowsdk.Address
+	ServAccPrivKeyHex string
+	ChainId           flow.ChainID
+}
+
+type LoadConfig struct {
+	// LoadName is the name of the load. This can be different from the LoadType
+	// and is used to identify the load in the results. The use case is when a single
+	// load type is used to run multiple loads with different parameters.
+	LoadName   string `yaml:"-"`
+	LoadType   string `yaml:"load_type"`
+	TpsMax     int    `yaml:"tps_max"`
+	TpsMin     int    `yaml:"tps_min"`
+	TPSInitial int    `yaml:"tps_initial"`
 }
 
 type LoadParams struct {
 	NumberOfAccounts int
-	LoadType         LoadType
+	LoadConfig       LoadConfig
 
 	// TODO(rbtz): inject a TxFollower
 	FeedbackEnabled bool
@@ -101,15 +74,21 @@ func New(
 	flowClients []access.Client,
 	networkParams NetworkParams,
 	loadParams LoadParams,
-	constExecParams ConstExecParams,
 ) (*ContLoadGenerator, error) {
 	if len(flowClients) == 0 {
 		return nil, errors.New("no flow clients available")
 	}
-	// TODO(rbtz): add loadbalancing between multiple clients
+
 	flowClient := flowClients[0]
 
-	servAcc, err := account.LoadServiceAccount(ctx, flowClient, networkParams.ServiceAccountAddress, networkParams.ServAccPrivKeyHex)
+	sc := systemcontracts.SystemContractsForChain(networkParams.ChainId)
+
+	privateKey, err := crypto.DecodePrivateKeyHex(unittest.ServiceAccountPrivateKey.SignAlgo, networkParams.ServAccPrivKeyHex)
+	if err != nil {
+		return nil, fmt.Errorf("error while decoding serice account private key hex: %w", err)
+	}
+
+	servAcc, err := account.LoadAccount(ctx, flowClient, flowsdk.BytesToAddress(sc.FlowServiceAccount.Address.Bytes()), privateKey, unittest.ServiceAccountPrivateKey.HashAlgo)
 	if err != nil {
 		return nil, fmt.Errorf("error loading service account %w", err)
 	}
@@ -124,270 +103,105 @@ func New(
 		return nil, err
 	}
 
-	// check and cap params for const-exec mode
-	if loadParams.LoadType == ConstExecCostLoadType {
-		if constExecParams.MaxTxSizeInByte > flow.DefaultMaxTransactionByteSize {
-			errMsg := fmt.Sprintf("MaxTxSizeInByte(%d) is larger than DefaultMaxTransactionByteSize(%d).",
-				constExecParams.MaxTxSizeInByte,
-				flow.DefaultMaxTransactionByteSize)
-			log.Error().Msg(errMsg)
-
-			return nil, errors.New(errMsg)
-		}
-
-		// accounts[0] will be used as the proposer\payer
-		if constExecParams.AuthAccountNum > uint(loadParams.NumberOfAccounts-1) {
-			errMsg := fmt.Sprintf("Number of authorizer(%d) is larger than max possible(%d).",
-				constExecParams.AuthAccountNum,
-				loadParams.NumberOfAccounts-1)
-			log.Error().Msg(errMsg)
-
-			return nil, errors.New(errMsg)
-		}
-
-		if constExecParams.ArgSizeInByte > flow.DefaultMaxTransactionByteSize {
-			errMsg := fmt.Sprintf("ArgSizeInByte(%d) is larger than DefaultMaxTransactionByteSize(%d).",
-				constExecParams.ArgSizeInByte,
-				flow.DefaultMaxTransactionByteSize)
-			log.Error().Msg(errMsg)
-			return nil, errors.New(errMsg)
-		}
-	}
-
 	lg := &ContLoadGenerator{
 		ctx:                ctx,
 		log:                log,
 		loaderMetrics:      loaderMetrics,
 		loadParams:         loadParams,
-		networkParams:      networkParams,
-		constExecParams:    constExecParams,
 		flowClient:         flowClient,
-		serviceAccount:     servAcc,
-		accounts:           make([]*account.FlowAccount, 0),
-		availableAccounts:  make(chan *account.FlowAccount, loadParams.NumberOfAccounts),
 		workerStatsTracker: workerStatsTracker,
 		follower:           follower,
 		stoppedChannel:     make(chan struct{}),
 	}
 
-	lg.log.Info().Int("num_keys", lg.serviceAccount.NumKeys()).Msg("service account loaded")
-
-	// TODO(rbtz): hide load implementation behind an interface
-	switch loadParams.LoadType {
-	case TokenTransferLoadType:
-		lg.workFunc = lg.sendTokenTransferTx
-	case TokenAddKeysLoadType:
-		lg.workFunc = lg.sendAddKeyTx
-	case ConstExecCostLoadType:
-		lg.workFunc = lg.sendConstExecCostTx
-	case CompHeavyLoadType, EventHeavyLoadType, LedgerHeavyLoadType, ExecDataHeavyLoadType:
-		lg.workFunc = lg.sendFavContractTx
-	default:
-		return nil, fmt.Errorf("unknown load type: %s", loadParams.LoadType)
-	}
-
-	return lg, nil
-}
-
-func (lg *ContLoadGenerator) stopped() bool {
-	select {
-	case <-lg.stoppedChannel:
-		return true
-	default:
-		return false
-	}
-}
+	lg.log.Info().Int("num_keys", servAcc.NumKeys()).Msg("service account loaded")
 
-func (lg *ContLoadGenerator) populateServiceAccountKeys(num int) error {
-	if lg.serviceAccount.NumKeys() >= num {
-		return nil
+	ts := &transactionSender{
+		ctx:                      ctx,
+		log:                      log,
+		flowClient:               flowClient,
+		loaderMetrics:            loaderMetrics,
+		workerStatsTracker:       workerStatsTracker,
+		follower:                 follower,
+		lostTransactionThreshold: lostTransactionThreshold,
 	}
 
-	key1, _ := lg.serviceAccount.GetKey()
-	lg.log.Info().
-		Stringer("HashAlgo", key1.HashAlgo).
-		Stringer("SigAlgo", key1.SigAlgo).
-		Int("Index", key1.Index).
-		Int("Weight", key1.Weight).
-		Msg("service account info")
-	key1.Done()
-
-	numberOfKeysToAdd := num - lg.serviceAccount.NumKeys()
-
-	lg.log.Info().Int("num_keys_to_add", numberOfKeysToAdd).Msg("adding keys to service account")
+	accountLoader := account.NewClientAccountLoader(lg.log, ctx, flowClient)
 
-	addKeysTx, err := lg.createAddKeyTx(*lg.serviceAccount.Address, uint(numberOfKeysToAdd))
+	err = account.EnsureAccountHasKeys(lg.log, servAcc, 100, lg.follower, ts)
 	if err != nil {
-		return fmt.Errorf("error creating add key tx: %w", err)
+		return nil, fmt.Errorf("error ensuring service account has keys: %w", err)
 	}
 
-	addKeysTx.SetReferenceBlockID(lg.follower.BlockID())
+	// we need to wait for the tx adding keys to be sealed otherwise the client won't
+	// pickup the changes
+	// TODO: add a better way to wait for txs to be sealed
+	time.Sleep(10 * time.Second)
 
-	key, err := lg.serviceAccount.GetKey()
+	err = account.ReloadAccount(accountLoader, servAcc)
 	if err != nil {
-		return fmt.Errorf("error getting service account key: %w", err)
+		return nil, fmt.Errorf("error reloading service account: %w", err)
 	}
-	defer key.Done()
 
-	err = key.SignTx(addKeysTx)
-	if err != nil {
-		return fmt.Errorf("error signing transaction: %w", err)
-	}
-
-	ch, err := lg.sendTx(0, addKeysTx)
+	ap, err := account.SetupProvider(
+		lg.log,
+		ctx,
+		loadParams.NumberOfAccounts,
+		100_000_000_000,
+		lg.follower,
+		servAcc,
+		ts,
+		networkParams.ChainId.Chain(),
+	)
 	if err != nil {
-		return fmt.Errorf("error sending transaction: %w", err)
+		return nil, fmt.Errorf("error setting up account provider: %w", err)
 	}
-	defer key.IncrementSequenceNumber()
 
-	var result flowsdk.TransactionResult
-	select {
-	case result = <-ch:
-	case <-lg.Done():
-		return fmt.Errorf("load generator stopped")
+	lc := load.LoadContext{
+		ChainID: networkParams.ChainId,
+		WorkerContext: load.WorkerContext{
+			WorkerID: -1,
+		},
+		AccountProvider:        ap,
+		TransactionSender:      ts,
+		ReferenceBlockProvider: lg.follower,
+		Proposer:               servAcc,
 	}
 
-	lg.log.Info().Stringer("result", result.Status).Msg("add key tx")
-	if result.Error != nil {
-		return fmt.Errorf("error adding keys to service account: %w", result.Error)
-	}
+	l := load.CreateLoadType(log, load.LoadType(loadParams.LoadConfig.LoadType))
 
-	// reload service account until it has enough keys
-	timeout := time.After(30 * time.Second)
-	for {
-		select {
-		case <-timeout:
-			return fmt.Errorf("timeout waiting for service account to have %d keys", num)
-		case <-lg.Done():
-			return fmt.Errorf("load generator stopped")
-		default:
-		}
-
-		lg.serviceAccount, err = account.LoadServiceAccount(lg.ctx, lg.flowClient, lg.serviceAccount.Address, lg.networkParams.ServAccPrivKeyHex)
-		if err != nil {
-			return fmt.Errorf("error loading service account %w", err)
-		}
-		lg.log.Info().Int("num_keys", lg.serviceAccount.NumKeys()).Msg("service account reloaded")
-
-		if lg.serviceAccount.NumKeys() >= num {
-			break
-		}
-
-		time.Sleep(1 * time.Second)
-	}
-
-	return nil
-}
-
-// TODO(rbtz): make part of New
-func (lg *ContLoadGenerator) Init() error {
-	err := lg.populateServiceAccountKeys(50)
+	err = l.Setup(log, lc)
 	if err != nil {
-		return fmt.Errorf("error populating service account keys: %w", err)
+		return nil, fmt.Errorf("error setting up load: %w", err)
 	}
 
-	g := errgroup.Group{}
-	for i := 0; i < lg.loadParams.NumberOfAccounts; i += accountCreationBatchSize {
-		i := i
-		g.Go(func() error {
-			if lg.stopped() {
-				return lg.ctx.Err()
-			}
-
-			num := lg.loadParams.NumberOfAccounts - i
-			if num > accountCreationBatchSize {
-				num = accountCreationBatchSize
-			}
-
-			lg.log.Info().Int("cumulative", i).Int("num", num).Int("numberOfAccounts", lg.loadParams.NumberOfAccounts).Msg("creating accounts")
-			for {
-				err := lg.createAccounts(num)
-				if errors.Is(err, account.ErrNoKeysAvailable) {
-					lg.log.Warn().Err(err).Msg("error creating accounts, retrying...")
-					time.Sleep(1 * time.Second)
-					continue
-				}
-				return err
-			}
-		})
-		// This is needed to avoid hitting the gRPC message size limit.
-		time.Sleep(1 * time.Second)
-	}
+	lg.workFunc = func(workerID int) {
 
-	if err := g.Wait(); err != nil {
-		return fmt.Errorf("error creating accounts: %w", err)
-	}
+		wlc := lc
+		wlc.WorkerContext.WorkerID = workerID
 
-	// TODO(rbtz): create an interface for different load types: Setup()
-	if lg.loadParams.LoadType != ConstExecCostLoadType {
-		err := lg.setupFavContract()
-		if err != nil {
-			lg.log.Error().Err(err).Msg("failed to setup fav contract")
-			return err
-		}
-	} else {
-		lg.log.Info().Int("numberOfAccountsCreated", len(lg.accounts)).
-			Msg("new accounts created. Grabbing the first as the proposer/payer " +
-				"and adding multiple keys to that account")
-
-		err := lg.addKeysToProposerAccount(lg.accounts[0])
-		if err != nil {
-			lg.log.Error().Msg("failed to create add-key transaction for const-exec")
-			return err
+		log := lg.log.With().Int("workerID", workerID).Logger()
+		err := l.Load(log, wlc)
+		if err != nil && !errors.Is(err, context.Canceled) {
+			log.Error().Err(err).Msg("error running load")
 		}
 	}
 
-	return nil
+	return lg, nil
 }
 
-func (lg *ContLoadGenerator) setupFavContract() error {
-	// take one of the accounts
-	if len(lg.accounts) == 0 {
-		return errors.New("can't setup fav contract, zero accounts available")
-	}
-
-	acc := lg.accounts[0]
-
-	lg.log.Trace().Msg("creating fav contract deployment script")
-	deployScript := DeployingMyFavContractScript()
-
-	lg.log.Trace().Msg("creating fav contract deployment transaction")
-	deploymentTx := flowsdk.NewTransaction().
-		SetReferenceBlockID(lg.follower.BlockID()).
-		SetScript(deployScript).
-		SetComputeLimit(9999)
-
-	lg.log.Trace().Msg("signing transaction")
-
-	key, err := acc.GetKey()
-	if err != nil {
-		lg.log.Error().Err(err).Msg("error getting key")
-		return err
-	}
-	defer key.Done()
-
-	err = key.SignTx(deploymentTx)
-	if err != nil {
-		lg.log.Error().Err(err).Msg("error signing transaction")
-		return err
-	}
-
-	ch, err := lg.sendTx(-1, deploymentTx)
-	if err != nil {
-		return err
+func (lg *ContLoadGenerator) stopped() bool {
+	select {
+	case <-lg.stoppedChannel:
+		return true
+	default:
+		return false
 	}
-	defer key.IncrementSequenceNumber()
-
-	<-ch
-	lg.workerStatsTracker.IncTxExecuted()
-
-	lg.favContractAddress = acc.Address
-	return nil
 }
 
 func (lg *ContLoadGenerator) startWorkers(num int) error {
 	for i := 0; i < num; i++ {
-		worker := NewWorker(len(lg.workers), 1*time.Second, lg.workFunc)
+		worker := NewWorker(lg.ctx, len(lg.workers), 1*time.Second, lg.workFunc)
 		lg.log.Trace().Int("workerID", worker.workerID).Msg("starting worker")
 		worker.Start()
 		lg.workers = append(lg.workers, worker)
@@ -471,501 +285,52 @@ func (lg *ContLoadGenerator) Done() <-chan struct{} {
 	return lg.stoppedChannel
 }
 
-func (lg *ContLoadGenerator) createAccounts(num int) error {
-	privKey := account.RandomPrivateKey()
-	accountKey := flowsdk.NewAccountKey().
-		FromPrivateKey(privKey).
-		SetHashAlgo(crypto.SHA3_256).
-		SetWeight(flowsdk.AccountKeyWeightThreshold)
-
-	// Generate an account creation script
-	createAccountTx := flowsdk.NewTransaction().
-		SetScript(CreateAccountsScript(*lg.networkParams.FungibleTokenAddress, *lg.networkParams.FlowTokenAddress)).
-		SetReferenceBlockID(lg.follower.BlockID()).
-		SetComputeLimit(999999)
-
-	publicKey := bytesToCadenceArray(accountKey.PublicKey.Encode())
-	count := cadence.NewInt(num)
-
-	initialTokenAmount, err := cadence.NewUFix64FromParts(
-		tokensPerAccount,
-		0,
-	)
-	if err != nil {
-		return err
-	}
-
-	err = createAccountTx.AddArgument(publicKey)
-	if err != nil {
-		return err
-	}
-
-	err = createAccountTx.AddArgument(count)
-	if err != nil {
-		return err
-	}
-
-	err = createAccountTx.AddArgument(initialTokenAmount)
-	if err != nil {
-		return err
-	}
-
-	key, err := lg.serviceAccount.GetKey()
-	if err != nil {
-		lg.log.Error().Err(err).Msg("error getting key")
-		return err
-	}
-	defer key.Done()
-
-	err = key.SignTx(createAccountTx)
-	if err != nil {
-		return err
-	}
-
-	// Do not wait for the transaction to be sealed.
-	ch, err := lg.sendTx(-1, createAccountTx)
-	if err != nil {
-		return err
-	}
-	defer key.IncrementSequenceNumber()
-
-	var result flowsdk.TransactionResult
-	select {
-	case result = <-ch:
-		lg.workerStatsTracker.IncTxExecuted()
-	case <-time.After(60 * time.Second):
-		return fmt.Errorf("timeout waiting for account creation tx to be executed")
-	case <-lg.Done():
-		return fmt.Errorf("loader stopped while waiting for account creation tx to be executed")
-	}
-
-	log := lg.log.With().Str("tx_id", createAccountTx.ID().String()).Logger()
-	log.Trace().Str("status", result.Status.String()).Msg("account creation tx executed")
-	if result.Error != nil {
-		log.Error().Err(result.Error).Msg("account creation tx failed")
-	}
-
-	var accountsCreated int
-	for _, event := range result.Events {
-		log.Trace().Str("event_type", event.Type).Str("event", event.String()).Msg("account creation tx event")
-
-		if event.Type == flowsdk.EventAccountCreated {
-			accountCreatedEvent := flowsdk.AccountCreatedEvent(event)
-			accountAddress := accountCreatedEvent.Address()
-
-			log.Trace().Hex("address", accountAddress.Bytes()).Msg("new account created")
-
-			newAcc, err := account.New(accountsCreated, &accountAddress, privKey, []*flowsdk.AccountKey{accountKey})
-			if err != nil {
-				return fmt.Errorf("failed to create account: %w", err)
-			}
-			accountsCreated++
-
-			lg.accountsMutex.Lock()
-			lg.accounts = append(lg.accounts, newAcc)
-			lg.accountsMutex.Unlock()
-			lg.availableAccounts <- newAcc
-
-			log.Trace().Hex("address", accountAddress.Bytes()).Msg("new account added")
-		}
-	}
-	if accountsCreated != num {
-		return fmt.Errorf("failed to create enough contracts, expected: %d, created: %d",
-			num, accountsCreated)
-	}
-	return nil
-}
-
-func (lg *ContLoadGenerator) createAddKeyTx(accountAddress flowsdk.Address, numberOfKeysToAdd uint) (*flowsdk.Transaction, error) {
-
-	key, err := lg.serviceAccount.GetKey()
-	if err != nil {
-		return nil, err
-	}
-	key.Done() // we don't actually need it
-
-	cadenceKeys := make([]cadence.Value, numberOfKeysToAdd)
-	for i := uint(0); i < numberOfKeysToAdd; i++ {
-		accountKey := key.AccountKey
-		cadenceKeys[i] = bytesToCadenceArray(accountKey.PublicKey.Encode())
-	}
-	cadenceKeysArray := cadence.NewArray(cadenceKeys)
-
-	addKeysScript, err := AddKeyToAccountScript()
-	if err != nil {
-		lg.log.Error().Err(err).Msg("error getting add key to account script")
-		return nil, err
-	}
-
-	addKeysTx := flowsdk.NewTransaction().
-		SetScript(addKeysScript).
-		AddAuthorizer(accountAddress).
-		SetReferenceBlockID(lg.follower.BlockID()).
-		SetComputeLimit(9999)
-
-	err = addKeysTx.AddArgument(cadenceKeysArray)
-	if err != nil {
-		lg.log.Error().Err(err).Msg("error constructing add keys to account transaction")
-		return nil, err
-	}
-
-	return addKeysTx, nil
-}
-
-func (lg *ContLoadGenerator) sendAddKeyTx(workerID int) {
-	log := lg.log.With().Int("workerID", workerID).Logger()
-
-	// TODO move this as a configurable parameter
-	numberOfKeysToAdd := uint(50)
-
-	log.Trace().Msg("getting next available account")
-
-	acc := <-lg.availableAccounts
-	defer func() { lg.availableAccounts <- acc }()
-
-	log.Trace().Msg("creating add proposer key script")
-
-	addKeysTx, err := lg.createAddKeyTx(*acc.Address, numberOfKeysToAdd)
-	if err != nil {
-		log.Error().Err(err).Msg("error creating AddKey transaction")
-		return
-	}
-
-	log.Trace().Msg("creating transaction")
-
-	addKeysTx.SetReferenceBlockID(lg.follower.BlockID())
-
-	log.Trace().Msg("signing transaction")
-
-	key, err := acc.GetKey()
-	if err != nil {
-		log.Error().Err(err).Msg("error getting service account key")
-		return
-	}
-	defer key.Done()
-
-	err = key.SignTx(addKeysTx)
-	if err != nil {
-		log.Error().Err(err).Msg("error signing transaction")
-		return
-	}
-
-	ch, err := lg.sendTx(workerID, addKeysTx)
-	if err != nil {
-		return
-	}
-	defer key.IncrementSequenceNumber()
-	<-ch
-	lg.workerStatsTracker.IncTxExecuted()
-}
-
-func (lg *ContLoadGenerator) addKeysToProposerAccount(proposerPayerAccount *account.FlowAccount) error {
-	if proposerPayerAccount == nil {
-		return errors.New("proposerPayerAccount is nil")
-	}
-
-	addKeysToPayerTx, err := lg.createAddKeyTx(*lg.accounts[0].Address, lg.constExecParams.PayerKeyCount)
-	if err != nil {
-		lg.log.Error().Msg("failed to create add-key transaction for const-exec")
-		return err
-	}
-	addKeysToPayerTx.SetReferenceBlockID(lg.follower.BlockID())
-
-	lg.log.Info().Msg("signing the add-key transaction for const-exec")
-
-	key, err := lg.accounts[0].GetKey()
-	if err != nil {
-		lg.log.Error().Err(err).Msg("error getting key")
-		return err
-	}
-	defer key.Done()
-
-	err = key.SignTx(addKeysToPayerTx)
-	if err != nil {
-		lg.log.Error().Err(err).Msg("error signing the add-key transaction for const-exec")
-		return err
-	}
-
-	lg.log.Info().Msg("issuing the add-key transaction for const-exec")
-	ch, err := lg.sendTx(0, addKeysToPayerTx)
-	if err != nil {
-		return err
-	}
-	defer key.IncrementSequenceNumber()
-
-	<-ch
-	lg.workerStatsTracker.IncTxExecuted()
-
-	lg.log.Info().Msg("the add-key transaction for const-exec is done")
-	return nil
+type transactionSender struct {
+	ctx                      context.Context
+	log                      zerolog.Logger
+	flowClient               access.Client
+	loaderMetrics            *metrics.LoaderCollector
+	workerStatsTracker       *WorkerStatsTracker
+	follower                 TxFollower
+	lostTransactionThreshold time.Duration
 }
 
-func (lg *ContLoadGenerator) sendConstExecCostTx(workerID int) {
-	log := lg.log.With().Int("workerID", workerID).Logger()
+func (t *transactionSender) Send(tx *flowsdk.Transaction) (flowsdk.TransactionResult, error) {
+	// Add follower before sending the transaction to avoid race condition
+	ch := t.follower.Follow(tx.ID())
 
-	txScriptNoComment := ConstExecCostTransaction(lg.constExecParams.AuthAccountNum, 0)
-
-	proposerKey, err := lg.accounts[0].GetKey()
+	err := t.flowClient.SendTransaction(t.ctx, *tx)
 	if err != nil {
-		log.Error().Err(err).Msg("error getting key")
-		return
+		return flowsdk.TransactionResult{}, fmt.Errorf("error sending transaction: %w", err)
 	}
-	defer proposerKey.Done()
 
-	tx := flowsdk.NewTransaction().
-		SetReferenceBlockID(lg.follower.BlockID()).
-		SetScript(txScriptNoComment).
-		SetComputeLimit(10). // const-exec tx has empty transaction
-		SetProposalKey(*proposerKey.Address, proposerKey.Index, proposerKey.SequenceNumber).
-		SetPayer(*proposerKey.Address)
-
-	txArgStr := generateRandomStringWithLen(lg.constExecParams.ArgSizeInByte)
-	txArg, err := cadence.NewString(txArgStr)
-	if err != nil {
-		log.Trace().Msg("Failed to generate cadence String parameter. Using empty string.")
-	}
-	err = tx.AddArgument(txArg)
-	if err != nil {
-		log.Trace().Msg("Failed to add argument. Skipping.")
-	}
-
-	// Add authorizers. lg.accounts[0] used as proposer\payer
-	log.Trace().Msg("Adding tx authorizers")
-	for i := uint(1); i < lg.constExecParams.AuthAccountNum+1; i++ {
-		tx = tx.AddAuthorizer(*lg.accounts[i].Address)
-	}
-
-	log.Trace().Msg("Authorizers signing tx")
-	for i := uint(1); i < lg.constExecParams.AuthAccountNum+1; i++ {
-		key, err := lg.accounts[i].GetKey()
-		if err != nil {
-			log.Error().Err(err).Msg("error getting key")
-			return
-		}
-
-		err = key.SignPayload(tx)
-		key.Done() // authorizers don't need to increment their sequence number
-
-		if err != nil {
-			log.Error().Err(err).Msg("error signing payload")
-			return
-		}
-	}
-
-	log.Trace().Msg("Payer signing tx")
-	for i := uint(1); i < lg.constExecParams.PayerKeyCount; i++ {
-		key, err := lg.accounts[i].GetKey()
-		if err != nil {
-			log.Error().Err(err).Msg("error getting key")
-			return
-		}
-
-		err = tx.SignEnvelope(*key.Address, key.Index, key.Signer)
-		key.Done() // payers don't need to increment their sequence number
-
-		if err != nil {
-			log.Error().Err(err).Msg("error signing transaction")
-			return
-		}
-	}
-
-	// calculate RLP-encoded binary size of the transaction without comment
-	txSizeWithoutComment := uint(len(tx.Encode()))
-	if txSizeWithoutComment > lg.constExecParams.MaxTxSizeInByte {
-		log.Error().Msg(fmt.Sprintf("current tx size(%d) without comment "+
-			"is larger than max tx size configured(%d)",
-			txSizeWithoutComment, lg.constExecParams.MaxTxSizeInByte))
-		return
-	}
-
-	// now adding comment to fulfill the final transaction size
-	commentSizeInByte := lg.constExecParams.MaxTxSizeInByte - txSizeWithoutComment
-	txScriptWithComment := ConstExecCostTransaction(lg.constExecParams.AuthAccountNum, commentSizeInByte)
-	tx = tx.SetScript(txScriptWithComment)
-
-	txSizeWithComment := uint(len(tx.Encode()))
-	log.Trace().Uint("Max Tx Size", lg.constExecParams.MaxTxSizeInByte).
-		Uint("Actual Tx Size", txSizeWithComment).
-		Uint("Tx Arg Size", lg.constExecParams.ArgSizeInByte).
-		Uint("Num of Authorizers", lg.constExecParams.AuthAccountNum).
-		Uint("Num of payer keys", lg.constExecParams.PayerKeyCount).
-		Uint("Script comment length", commentSizeInByte).
-		Msg("Generating one const-exec transaction")
-
-	log.Trace().Msg("Issuing tx")
-	ch, err := lg.sendTx(workerID, tx)
-	if err != nil {
-		log.Error().Err(err).Msg("const-exec tx failed")
-		return
-	}
-	defer proposerKey.IncrementSequenceNumber()
-
-	<-ch
-	lg.workerStatsTracker.IncTxExecuted()
-
-	log.Trace().Msg("const-exec tx suceeded")
-}
-
-func (lg *ContLoadGenerator) sendTokenTransferTx(workerID int) {
-	log := lg.log.With().Int("workerID", workerID).Logger()
-
-	log.Trace().
-		Int("availableAccounts", len(lg.availableAccounts)).
-		Msg("getting next available account")
-
-	var acc *account.FlowAccount
-
-	select {
-	case acc = <-lg.availableAccounts:
-	default:
-		log.Error().Msg("next available account channel empty; skipping send")
-		return
-	}
-	defer func() { lg.availableAccounts <- acc }()
-	nextAcc := lg.accounts[(acc.ID+1)%len(lg.accounts)]
-
-	log.Trace().
-		Float64("tokens", tokensPerTransfer).
-		Hex("srcAddress", acc.Address.Bytes()).
-		Hex("dstAddress", nextAcc.Address.Bytes()).
-		Int("srcAccount", acc.ID).
-		Int("dstAccount", nextAcc.ID).
-		Msg("creating transfer script")
-
-	transferTx, err := TokenTransferTransaction(
-		lg.networkParams.FungibleTokenAddress,
-		lg.networkParams.FlowTokenAddress,
-		nextAcc.Address,
-		tokensPerTransfer)
-	if err != nil {
-		log.Error().Err(err).Msg("error creating token transfer script")
-		return
-	}
-
-	log.Trace().Msg("creating token transfer transaction")
-	transferTx = transferTx.
-		SetReferenceBlockID(lg.follower.BlockID()).
-		SetComputeLimit(9999)
-
-	log.Trace().Msg("signing transaction")
-
-	key, err := acc.GetKey()
-	if err != nil {
-		log.Error().Err(err).Msg("error getting key")
-		return
-	}
-	defer key.Done()
-
-	err = key.SignTx(transferTx)
-	if err != nil {
-		log.Error().Err(err).Msg("error signing transaction")
-		return
-	}
+	t.workerStatsTracker.IncTxSent()
+	t.loaderMetrics.TransactionSent()
 
+	timer := time.NewTimer(t.lostTransactionThreshold)
+	defer timer.Stop()
 	startTime := time.Now()
-	ch, err := lg.sendTx(workerID, transferTx)
-	if err != nil {
-		return
-	}
-	defer key.IncrementSequenceNumber()
-
-	log = log.With().Hex("tx_id", transferTx.ID().Bytes()).Logger()
-	log.Trace().Msg("transaction sent")
-
-	t := time.NewTimer(lostTransactionThreshold)
-	defer t.Stop()
 
 	select {
+	case <-t.ctx.Done():
+		return flowsdk.TransactionResult{}, t.ctx.Err()
 	case result := <-ch:
+		t.workerStatsTracker.IncTxExecuted()
+
 		if result.Error != nil {
-			lg.workerStatsTracker.IncTxFailed()
+			t.workerStatsTracker.IncTxFailed()
+			return result, common.NewTransactionError(result.Error)
 		}
-		log.Trace().
-			Dur("duration", time.Since(startTime)).
-			Err(result.Error).
-			Str("status", result.Status.String()).
-			Msg("transaction confirmed")
-	case <-t.C:
-		lg.loaderMetrics.TransactionLost()
-		log.Warn().
+
+		return result, nil
+	case <-timer.C:
+		t.loaderMetrics.TransactionLost()
+		t.log.Warn().
 			Dur("duration", time.Since(startTime)).
-			Int("availableAccounts", len(lg.availableAccounts)).
 			Msg("transaction lost")
-		lg.workerStatsTracker.IncTxTimedout()
-	case <-lg.Done():
-		return
-	}
-	lg.workerStatsTracker.IncTxExecuted()
-}
-
-// TODO update this to include loadtype
-func (lg *ContLoadGenerator) sendFavContractTx(workerID int) {
-	log := lg.log.With().Int("workerID", workerID).Logger()
-	log.Trace().Msg("getting next available account")
-
-	acc := <-lg.availableAccounts
-	defer func() { lg.availableAccounts <- acc }()
-	var txScript []byte
-
-	switch lg.loadParams.LoadType {
-	case CompHeavyLoadType:
-		txScript = ComputationHeavyScript(*lg.favContractAddress)
-	case EventHeavyLoadType:
-		txScript = EventHeavyScript(*lg.favContractAddress)
-	case LedgerHeavyLoadType:
-		txScript = LedgerHeavyScript(*lg.favContractAddress)
-	case ExecDataHeavyLoadType:
-		txScript = ExecDataHeavyScript(*lg.favContractAddress)
-	default:
-		log.Error().Msg("unknown load type")
-		return
-	}
-
-	log.Trace().Msg("creating transaction")
-	tx := flowsdk.NewTransaction().
-		SetReferenceBlockID(lg.follower.BlockID()).
-		SetScript(txScript).
-		SetComputeLimit(9999)
-
-	log.Trace().Msg("signing transaction")
-
-	key, err := acc.GetKey()
-	if err != nil {
-		log.Error().Err(err).Msg("error getting key")
-		return
-	}
-	defer key.Done()
-
-	err = key.SignTx(tx)
-	if err != nil {
-		log.Error().Err(err).Msg("error signing transaction")
-		return
-	}
-
-	ch, err := lg.sendTx(workerID, tx)
-	if err != nil {
-		return
+		t.workerStatsTracker.IncTxTimedOut()
+		return flowsdk.TransactionResult{}, fmt.Errorf("transaction lost")
 	}
-	defer key.IncrementSequenceNumber()
-
-	<-ch
-	lg.workerStatsTracker.IncTxExecuted()
 }
 
-func (lg *ContLoadGenerator) sendTx(workerID int, tx *flowsdk.Transaction) (<-chan flowsdk.TransactionResult, error) {
-	log := lg.log.With().Int("workerID", workerID).Str("tx_id", tx.ID().String()).Logger()
-	log.Trace().Msg("sending transaction")
-
-	// Add watcher before sending the transaction to avoid race condition
-	ch := lg.follower.Follow(tx.ID())
-
-	err := lg.flowClient.SendTransaction(lg.ctx, *tx)
-	if err != nil {
-		log.Error().Err(err).Msg("error sending transaction")
-		return nil, err
-	}
-
-	lg.workerStatsTracker.IncTxSent()
-	lg.loaderMetrics.TransactionSent()
-	return ch, err
-}
+var _ common.TransactionSender = (*transactionSender)(nil)
diff --git a/integration/benchmark/follower.go b/integration/benchmark/follower.go
index 933a528622d..746c5b17b40 100644
--- a/integration/benchmark/follower.go
+++ b/integration/benchmark/follower.go
@@ -6,6 +6,8 @@ import (
 	"sync"
 	"time"
 
+	"github.com/onflow/flow-go/integration/benchmark/common"
+
 	flowsdk "github.com/onflow/flow-go-sdk"
 	"github.com/onflow/flow-go-sdk/access"
 	"github.com/onflow/flow-go/module/metrics"
@@ -14,6 +16,7 @@ import (
 )
 
 type TxFollower interface {
+	common.ReferenceBlockProvider
 	// Follow returns a channel that is closed when the transaction is complete.
 	Follow(ID flowsdk.Identifier) <-chan flowsdk.TransactionResult
 
@@ -27,17 +30,17 @@ type TxFollower interface {
 	Stop()
 }
 
-type followerOption func(f *txFollowerImpl)
+type FollowerOption func(f *txFollowerImpl)
 
-func WithLogger(logger zerolog.Logger) followerOption {
+func WithLogger(logger zerolog.Logger) FollowerOption {
 	return func(f *txFollowerImpl) { f.logger = logger }
 }
 
-func WithInteval(interval time.Duration) followerOption {
+func WithInteval(interval time.Duration) FollowerOption {
 	return func(f *txFollowerImpl) { f.interval = interval }
 }
 
-func WithMetrics(m *metrics.LoaderCollector) followerOption {
+func WithMetrics(m *metrics.LoaderCollector) FollowerOption {
 	return func(f *txFollowerImpl) { f.metrics = m }
 }
 
@@ -72,7 +75,7 @@ type txInfo struct {
 
 // NewTxFollower creates a new follower that tracks the current block height
 // and can notify on transaction completion.
-func NewTxFollower(ctx context.Context, client access.Client, opts ...followerOption) (TxFollower, error) {
+func NewTxFollower(ctx context.Context, client access.Client, opts ...FollowerOption) (TxFollower, error) {
 	newCtx, cancel := context.WithCancel(ctx)
 
 	f := &txFollowerImpl{
@@ -282,13 +285,17 @@ func (f *txFollowerImpl) Stop() {
 	f.txToChan = make(map[flowsdk.Identifier]txInfo)
 }
 
+func (f *txFollowerImpl) ReferenceBlockID() flowsdk.Identifier {
+	return f.BlockID()
+}
+
 type nopTxFollower struct {
 	*txFollowerImpl
 }
 
 // NewNopTxFollower creates a new follower that tracks the current block height and ID
 // but does not notify on transaction completion.
-func NewNopTxFollower(ctx context.Context, client access.Client, opts ...followerOption) (TxFollower, error) {
+func NewNopTxFollower(ctx context.Context, client access.Client, opts ...FollowerOption) (TxFollower, error) {
 	f, err := NewTxFollower(ctx, client, opts...)
 	if err != nil {
 		return nil, err
diff --git a/integration/benchmark/load/add_keys_load.go b/integration/benchmark/load/add_keys_load.go
new file mode 100644
index 00000000000..95325e961cd
--- /dev/null
+++ b/integration/benchmark/load/add_keys_load.go
@@ -0,0 +1,43 @@
+package load
+
+import (
+	"fmt"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/integration/benchmark/account"
+)
+
+type AddKeysLoad struct {
+	numberOfKeysToAdd int
+}
+
+func NewAddKeysLoad() *AddKeysLoad {
+	return &AddKeysLoad{
+		10,
+	}
+}
+
+var _ Load = (*AddKeysLoad)(nil)
+
+func (l *AddKeysLoad) Type() LoadType {
+	return AddKeysLoadType
+}
+
+func (l *AddKeysLoad) Setup(_ zerolog.Logger, _ LoadContext) error {
+	return nil
+}
+
+func (l *AddKeysLoad) Load(log zerolog.Logger, lc LoadContext) error {
+	wrapErr := func(err error) error {
+		return fmt.Errorf("failed to send load: %w", err)
+	}
+
+	acc, err := lc.BorrowAvailableAccount()
+	if err != nil {
+		return wrapErr(err)
+	}
+	defer lc.ReturnAvailableAccount(acc)
+
+	return account.AddKeysToAccount(log, acc, l.numberOfKeysToAdd, lc, lc)
+}
diff --git a/integration/benchmark/load/common.go b/integration/benchmark/load/common.go
new file mode 100644
index 00000000000..93882d96757
--- /dev/null
+++ b/integration/benchmark/load/common.go
@@ -0,0 +1,71 @@
+package load
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/rs/zerolog"
+
+	flowsdk "github.com/onflow/flow-go-sdk"
+	"github.com/onflow/flow-go/integration/benchmark/common"
+
+	"github.com/onflow/flow-go/integration/benchmark/account"
+)
+
+// transactionFunc is a function that creates a transaction.
+// It is used by sendSimpleTransaction.
+type transactionFunc func(
+	log zerolog.Logger,
+	lc LoadContext,
+	acc *account.FlowAccount,
+) (*flowsdk.Transaction, error)
+
+// sendSimpleTransaction is a helper function for sending a transaction.
+// It
+// - borrows an account,
+// - creates a transaction,
+// - sets the reference block ID,
+// - sets the proposer and payer and one authorizer (if not already set),
+// - signs it with the account,
+// - sends the transaction to the network.
+// - waits for the transaction result.
+func sendSimpleTransaction(log zerolog.Logger, lc LoadContext, txFN transactionFunc) error {
+	wrapErr := func(err error) error {
+		return fmt.Errorf("error in send simple transaction: %w", err)
+	}
+
+	acc, err := lc.BorrowAvailableAccount()
+	if err != nil {
+		return wrapErr(err)
+	}
+	defer lc.ReturnAvailableAccount(acc)
+
+	tx, err := txFN(log, lc, acc)
+	if err != nil {
+		return wrapErr(err)
+	}
+
+	tx.SetReferenceBlockID(lc.ReferenceBlockID())
+
+	key, err := acc.GetKey()
+	if err != nil {
+		return wrapErr(err)
+	}
+	defer key.Done()
+
+	err = key.SetProposerPayerAndSign(tx)
+	if err != nil {
+		return wrapErr(err)
+	}
+
+	_, err = lc.Send(tx)
+	if err == nil || errors.Is(err, common.TransactionError{}) {
+		key.IncrementSequenceNumber()
+	}
+	if err != nil {
+
+		return wrapErr(err)
+	}
+
+	return nil
+}
diff --git a/integration/benchmark/load/create_account_load.go b/integration/benchmark/load/create_account_load.go
new file mode 100644
index 00000000000..7fe0e9808e7
--- /dev/null
+++ b/integration/benchmark/load/create_account_load.go
@@ -0,0 +1,52 @@
+package load
+
+import (
+	"github.com/rs/zerolog"
+
+	flowsdk "github.com/onflow/flow-go-sdk"
+	"github.com/onflow/flow-go/integration/benchmark/account"
+)
+
+type CreateAccountLoad struct {
+}
+
+func NewCreateAccountLoad() *CreateAccountLoad {
+	return &CreateAccountLoad{}
+}
+
+func (c CreateAccountLoad) Type() LoadType {
+	return CreateAccount
+}
+
+func (c CreateAccountLoad) Setup(zerolog.Logger, LoadContext) error {
+	// no setup needed
+	return nil
+}
+
+func (c CreateAccountLoad) Load(log zerolog.Logger, lc LoadContext) error {
+
+	return sendSimpleTransaction(
+		log,
+		lc,
+		func(
+			log zerolog.Logger,
+			lc LoadContext,
+			acc *account.FlowAccount,
+		) (*flowsdk.Transaction, error) {
+			tx := flowsdk.NewTransaction().
+				SetScript(
+					[]byte(`
+						transaction() {
+							prepare(signer: AuthAccount) {
+								AuthAccount(payer: signer)
+							}
+						}`,
+					),
+				)
+
+			return tx, nil
+
+		})
+}
+
+var _ Load = (*CreateAccountLoad)(nil)
diff --git a/integration/benchmark/load/evm_load.go b/integration/benchmark/load/evm_load.go
new file mode 100644
index 00000000000..4b549eb0d03
--- /dev/null
+++ b/integration/benchmark/load/evm_load.go
@@ -0,0 +1,432 @@
+package load
+
+import (
+	"bytes"
+	"context"
+	"crypto/ecdsa"
+	"fmt"
+	"io"
+	"math/big"
+	"time"
+
+	"github.com/onflow/cadence"
+	gethcommon "github.com/onflow/go-ethereum/common"
+	"github.com/onflow/go-ethereum/core/types"
+	"github.com/onflow/go-ethereum/crypto"
+	"github.com/onflow/go-ethereum/params"
+	"github.com/rs/zerolog"
+	"go.uber.org/atomic"
+	"golang.org/x/sync/errgroup"
+
+	flowsdk "github.com/onflow/flow-go-sdk"
+
+	"github.com/onflow/flow-go/fvm/blueprints"
+	"github.com/onflow/flow-go/fvm/evm/emulator"
+	"github.com/onflow/flow-go/fvm/evm/stdlib"
+	evmTypes "github.com/onflow/flow-go/fvm/evm/types"
+	"github.com/onflow/flow-go/fvm/systemcontracts"
+	"github.com/onflow/flow-go/integration/benchmark/account"
+	"github.com/onflow/flow-go/module/util"
+)
+
+// eoa is a struct that represents an evm owned account.
+type eoa struct {
+	addressArg cadence.Value
+	nonce      uint64
+	pk         *ecdsa.PrivateKey
+	adress     gethcommon.Address
+}
+
+type EVMTransferLoad struct {
+	PreCreateEOAAccounts int
+
+	log               zerolog.Logger
+	tokensPerTransfer cadence.UFix64
+
+	eoaChan  chan *eoa
+	doneChan chan struct{}
+
+	transfers atomic.Uint64
+	creations atomic.Uint64
+
+	bridgedAcountAddress flowsdk.Address
+}
+
+func NewEVMTransferLoad(log zerolog.Logger) *EVMTransferLoad {
+	load := &EVMTransferLoad{
+		log:               log.With().Str("component", "EVMTransferLoad").Logger(),
+		tokensPerTransfer: cadence.UFix64(100),
+		// really large channel,
+		// it's going to get filled as needed
+		eoaChan:              make(chan *eoa, 1_000_000),
+		doneChan:             make(chan struct{}),
+		PreCreateEOAAccounts: 5000,
+	}
+
+	go load.reportStatus()
+
+	return load
+}
+
+var _ Load = (*EVMTransferLoad)(nil)
+var _ io.Closer = (*EVMTransferLoad)(nil)
+
+func (l *EVMTransferLoad) Close() error {
+	close(l.eoaChan)
+	close(l.doneChan)
+	return nil
+}
+
+func (l *EVMTransferLoad) reportStatus() {
+	// report status every 10 seconds until done
+	for {
+		select {
+		case <-l.doneChan:
+			return
+		case <-time.After(10 * time.Second):
+			l.log.Info().
+				Uint64("transfers", l.transfers.Load()).
+				Uint64("creations", l.creations.Load()).
+				Msg("EVMTransferLoad status report")
+		}
+	}
+
+}
+
+func (l *EVMTransferLoad) Type() LoadType {
+	return EVMTransferLoadType
+}
+
+func (l *EVMTransferLoad) Setup(log zerolog.Logger, lc LoadContext) error {
+
+	// create a shared bridged account
+	err := sendSimpleTransaction(
+		log,
+		lc,
+		func(
+			log zerolog.Logger,
+			lc LoadContext,
+			acc *account.FlowAccount,
+		) (*flowsdk.Transaction, error) {
+			l.bridgedAcountAddress = acc.Address
+
+			sc := systemcontracts.SystemContractsForChain(lc.ChainID)
+
+			contractName := "BridgedAccountContract"
+
+			contract := fmt.Sprintf(`
+				import EVM from %s
+				import FlowToken from %s
+
+				access(all) contract BridgedAccountContract {
+					access(self) var acc: @EVM.CadenceOwnedAccount
+
+					access(all)
+					fun address() : EVM.EVMAddress {
+						return self.acc.address()
+					}
+
+					access(all)
+					fun call(
+						to: EVM.EVMAddress,
+						data: [UInt8],
+						gasLimit: UInt64,
+						value: EVM.Balance
+					): EVM.Result {
+						return self.acc.call(
+							to: to,
+							data: data,
+							gasLimit: gasLimit,
+							value: value
+						)
+					}
+
+					access(all)
+					fun deposit(from: @FlowToken.Vault) {
+						self.acc.deposit(from: <-from)
+					}
+
+					init() {
+						self.acc <- EVM.createCadenceOwnedAccount()
+					}
+				}
+			`,
+				sc.EVMContract.Address.HexWithPrefix(),
+				sc.FlowToken.Address.HexWithPrefix())
+
+			tx := flowsdk.NewTransaction().
+				SetScript(blueprints.DeployContractTransactionTemplate)
+
+			err := tx.AddArgument(cadence.String(contractName))
+			if err != nil {
+				return nil, err
+			}
+			err = tx.AddArgument(cadence.String(contract))
+			if err != nil {
+				return nil, err
+			}
+
+			return tx, nil
+		})
+	if err != nil {
+		return fmt.Errorf("error creating shared bridged account: %w", err)
+	}
+
+	// create some EOA ahead of time to get a better result for the benchmark
+	createEOA := l.PreCreateEOAAccounts
+
+	g, ctx := errgroup.WithContext(context.Background())
+	g.SetLimit(lc.Proposer.NumKeys())
+
+	progress := util.LogProgress(l.log,
+		util.DefaultLogProgressConfig(
+			"creating and funding EOC accounts",
+			createEOA,
+		))
+
+	l.log.Info().
+		Int("number_of_accounts", createEOA).
+		Int("number_of_keys", lc.Proposer.NumKeys()).
+		Msg("creating and funding EOC accounts")
+
+	for i := 0; i < createEOA; i += 1 {
+		i := i
+		g.Go(func() error {
+			select {
+			case <-ctx.Done():
+				return nil
+			default:
+			}
+			defer func() { progress(1) }()
+
+			eoa, err := l.setupTransaction(log, lc)
+			if err != nil {
+				return err
+			}
+
+			if err != nil {
+				l.log.
+					Err(err).
+					Int("index", i).
+					Msg("error creating EOA accounts")
+				return err
+			}
+
+			l.creations.Add(1)
+
+			select {
+			case l.eoaChan <- eoa:
+			default:
+			}
+
+			return nil
+		})
+	}
+	err = g.Wait()
+	if err != nil {
+		return fmt.Errorf("error creating EOC accounts: %w", err)
+	}
+	return nil
+}
+
+func (l *EVMTransferLoad) Load(log zerolog.Logger, lc LoadContext) error {
+	select {
+	case eoa := <-l.eoaChan:
+		if eoa == nil {
+			return nil
+		}
+		err := l.transferTransaction(log, lc, eoa)
+		if err == nil {
+			eoa.nonce += 1
+		}
+
+		l.transfers.Add(1)
+
+		select {
+		case l.eoaChan <- eoa:
+		default:
+		}
+
+		return err
+	default:
+		// no eoa available, create a new one
+		eoa, err := l.setupTransaction(log, lc)
+		if err != nil {
+			return err
+		}
+		l.creations.Add(1)
+
+		select {
+		case l.eoaChan <- eoa:
+		default:
+		}
+
+		return nil
+	}
+}
+
+func (l *EVMTransferLoad) setupTransaction(
+	log zerolog.Logger,
+	lc LoadContext,
+) (*eoa, error) {
+	eoa := &eoa{}
+
+	privateKey, err := crypto.GenerateKey()
+	if err != nil {
+		return nil, err
+	}
+
+	publicKey := privateKey.Public()
+	publicKeyECDSA, ok := publicKey.(*ecdsa.PublicKey)
+	if !ok {
+		return nil, fmt.Errorf("error casting public key to ECDSA")
+	}
+	eoa.pk = privateKey
+	eoa.adress = crypto.PubkeyToAddress(*publicKeyECDSA)
+
+	addressCadenceBytes := make([]cadence.Value, 20)
+	for i := range addressCadenceBytes {
+		addressCadenceBytes[i] = cadence.UInt8(eoa.adress[i])
+	}
+
+	eoa.addressArg = cadence.NewArray(addressCadenceBytes).WithType(stdlib.EVMAddressBytesCadenceType)
+
+	err = sendSimpleTransaction(
+		log,
+		lc,
+		func(
+			log zerolog.Logger,
+			lc LoadContext,
+			acc *account.FlowAccount,
+		) (*flowsdk.Transaction, error) {
+			sc := systemcontracts.SystemContractsForChain(lc.ChainID)
+
+			amountArg, err := cadence.NewUFix64("1.0")
+			if err != nil {
+				return nil, err
+			}
+
+			// Fund evm address
+			txBody := flowsdk.NewTransaction().
+				SetScript([]byte(fmt.Sprintf(
+					`
+						import EVM from %s
+						import FungibleToken from %s
+						import FlowToken from %s
+						import BridgedAccountContract from 0x%s
+
+						transaction(address: [UInt8; 20], amount: UFix64) {
+							let fundVault: @FlowToken.Vault
+
+							prepare(signer: AuthAccount) {
+								let vaultRef = signer.borrow<&FlowToken.Vault>(from: /storage/flowTokenVault)
+									?? panic("Could not borrow reference to the owner's Vault!")
+						
+								// 1.0 Flow for the EVM gass fees
+								self.fundVault <- vaultRef.withdraw(amount: amount+1.0) as! @FlowToken.Vault
+							}
+
+							execute {
+								BridgedAccountContract.deposit(from: <-self.fundVault)
+								let fundAddress = EVM.EVMAddress(bytes: address)
+								var balance = EVM.Balance(attoflow: 0)
+								balance.setFLOW(flow: amount)
+								BridgedAccountContract.call(
+										to: fundAddress,
+										data: [],
+										gasLimit: 21000,
+										value: balance)
+							}
+						}
+					`,
+					sc.FlowServiceAccount.Address.HexWithPrefix(),
+					sc.FungibleToken.Address.HexWithPrefix(),
+					sc.FlowToken.Address.HexWithPrefix(),
+					l.bridgedAcountAddress.Hex(),
+				)))
+
+			err = txBody.AddArgument(eoa.addressArg)
+			if err != nil {
+				return nil, err
+			}
+			err = txBody.AddArgument(amountArg)
+			if err != nil {
+				return nil, err
+			}
+
+			return txBody, nil
+		})
+	if err != nil {
+		return nil, err
+	}
+	return eoa, nil
+}
+
+func (l *EVMTransferLoad) transferTransaction(
+	log zerolog.Logger,
+	lc LoadContext,
+	eoa *eoa,
+) error {
+	return sendSimpleTransaction(
+		log,
+		lc,
+		func(
+			log zerolog.Logger,
+			lc LoadContext,
+			acc *account.FlowAccount,
+		) (*flowsdk.Transaction, error) {
+			nonce := eoa.nonce
+			to := gethcommon.HexToAddress("")
+			gasPrice := big.NewInt(0)
+
+			oneFlow := cadence.UFix64(100_000_000)
+			amount := new(big.Int).Div(evmTypes.OneFlowBalance, big.NewInt(int64(oneFlow)))
+			evmTx := types.NewTx(&types.LegacyTx{Nonce: nonce, To: &to, Value: amount, Gas: params.TxGas, GasPrice: gasPrice, Data: nil})
+
+			signed, err := types.SignTx(evmTx, emulator.GetDefaultSigner(), eoa.pk)
+			if err != nil {
+				return nil, fmt.Errorf("error signing EVM transaction: %w", err)
+			}
+			var encoded bytes.Buffer
+			err = signed.EncodeRLP(&encoded)
+			if err != nil {
+				return nil, fmt.Errorf("error encoding EVM transaction: %w", err)
+			}
+
+			encodedCadence := make([]cadence.Value, 0)
+			for _, b := range encoded.Bytes() {
+				encodedCadence = append(encodedCadence, cadence.UInt8(b))
+			}
+			transactionBytes := cadence.NewArray(encodedCadence).WithType(stdlib.EVMTransactionBytesCadenceType)
+
+			sc := systemcontracts.SystemContractsForChain(lc.ChainID)
+			txBody := flowsdk.NewTransaction().
+				SetScript([]byte(fmt.Sprintf(
+					`
+import EVM from %s
+import FungibleToken from %s
+import FlowToken from %s
+
+transaction(encodedTx: [UInt8], address: [UInt8; 20]) {
+	prepare(signer: AuthAccount){}
+	execute {
+		EVM.run(tx: encodedTx, coinbase: EVM.EVMAddress(bytes: address))
+	}
+}
+					`,
+					sc.EVMContract.Address.HexWithPrefix(),
+					sc.FungibleToken.Address.HexWithPrefix(),
+					sc.FlowToken.Address.HexWithPrefix(),
+				)))
+
+			err = txBody.AddArgument(transactionBytes)
+			if err != nil {
+				return nil, fmt.Errorf("error adding argument to transaction: %w", err)
+			}
+			err = txBody.AddArgument(eoa.addressArg)
+			if err != nil {
+				return nil, fmt.Errorf("error adding argument to transaction: %w", err)
+			}
+			return txBody, nil
+		})
+}
diff --git a/integration/benchmark/load/load_type.go b/integration/benchmark/load/load_type.go
new file mode 100644
index 00000000000..1fb5bfbb8ae
--- /dev/null
+++ b/integration/benchmark/load/load_type.go
@@ -0,0 +1,97 @@
+package load
+
+import (
+	_ "embed"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/integration/benchmark/account"
+	"github.com/onflow/flow-go/integration/benchmark/common"
+	"github.com/onflow/flow-go/integration/benchmark/scripts"
+	"github.com/onflow/flow-go/model/flow"
+)
+
+type LoadType string
+
+const (
+	CompHeavyLoadType     LoadType = "computation-heavy"
+	EventHeavyLoadType    LoadType = "event-heavy"
+	ExecDataHeavyLoadType LoadType = "exec-data-heavy"
+	LedgerHeavyLoadType   LoadType = "ledger-heavy"
+
+	// TODO: port this load type from old code
+	// ConstExecCostLoadType LoadType = "const-exec" // for an empty transactions with various tx arguments
+
+	TokenTransferLoadType LoadType = "token-transfer"
+	AddKeysLoadType       LoadType = "add-keys"
+	EVMTransferLoadType   LoadType = "evm-transfer"
+	CreateAccount         LoadType = "create-account"
+)
+
+type LoadContext struct {
+	ChainID flow.ChainID
+	WorkerContext
+	account.AccountProvider
+	common.TransactionSender
+	common.ReferenceBlockProvider
+	Proposer *account.FlowAccount
+}
+
+type WorkerContext struct {
+	WorkerID int
+}
+
+type Load interface {
+	Type() LoadType
+	// Setup is called once before the load starts.
+	Setup(log zerolog.Logger, lc LoadContext) error
+	// Load is called repeatedly from multiple goroutines.
+	Load(log zerolog.Logger, lc LoadContext) error
+}
+
+var CompHeavyLoad = NewSimpleLoadType(
+	CompHeavyLoadType,
+	"ComputationHeavy",
+	scripts.ComputationHeavyContractTemplate,
+	scripts.ComputationHeavyScriptTemplate)
+
+var EventHeavyLoad = NewSimpleLoadType(
+	EventHeavyLoadType,
+	"EventHeavy",
+	scripts.EventHeavyContractTemplate,
+	scripts.EventHeavyScriptTemplate)
+
+var LedgerHeavyLoad = NewSimpleLoadType(
+	LedgerHeavyLoadType,
+	"LedgerHeavy",
+	scripts.LedgerHeavyContractTemplate,
+	scripts.LedgerHeavyScriptTemplate)
+
+var ExecDataHeavyLoad = NewSimpleLoadType(
+	ExecDataHeavyLoadType,
+	"DataHeavy",
+	scripts.DataHeavyContractTemplate,
+	scripts.DataHeavyScriptTemplate)
+
+func CreateLoadType(log zerolog.Logger, t LoadType) Load {
+	switch t {
+	case CompHeavyLoadType:
+		return CompHeavyLoad
+	case EventHeavyLoadType:
+		return EventHeavyLoad
+	case LedgerHeavyLoadType:
+		return LedgerHeavyLoad
+	case ExecDataHeavyLoadType:
+		return ExecDataHeavyLoad
+	case TokenTransferLoadType:
+		return NewTokenTransferLoad()
+	case AddKeysLoadType:
+		return NewAddKeysLoad()
+	case EVMTransferLoadType:
+		return NewEVMTransferLoad(log)
+	case CreateAccount:
+		return NewCreateAccountLoad()
+	default:
+		panic("unknown load type")
+	}
+}
diff --git a/integration/benchmark/load/load_type_test.go b/integration/benchmark/load/load_type_test.go
new file mode 100644
index 00000000000..1517924a7e5
--- /dev/null
+++ b/integration/benchmark/load/load_type_test.go
@@ -0,0 +1,308 @@
+package load_test
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+
+	"github.com/onflow/cadence"
+	"github.com/onflow/cadence/encoding/ccf"
+	convert2 "github.com/onflow/flow-emulator/convert"
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
+
+	sdk "github.com/onflow/flow-go-sdk"
+	"github.com/onflow/flow-go-sdk/crypto"
+
+	"github.com/onflow/flow-go/engine/execution/computation"
+	"github.com/onflow/flow-go/engine/execution/testutil"
+	"github.com/onflow/flow-go/fvm"
+	"github.com/onflow/flow-go/fvm/environment"
+	"github.com/onflow/flow-go/fvm/storage/snapshot"
+	"github.com/onflow/flow-go/integration/benchmark/account"
+	"github.com/onflow/flow-go/integration/benchmark/common"
+	"github.com/onflow/flow-go/integration/benchmark/load"
+	"github.com/onflow/flow-go/integration/convert"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+func TestLoadTypes(t *testing.T) {
+
+	log := zerolog.New(zerolog.NewTestWriter(t))
+
+	evmLoad := load.NewEVMTransferLoad(log)
+	// don't create that many accounts for the test
+	evmLoad.PreCreateEOAAccounts = 20
+
+	loads := []load.Load{
+		load.CompHeavyLoad,
+		load.EventHeavyLoad,
+		load.LedgerHeavyLoad,
+		load.ExecDataHeavyLoad,
+		load.NewTokenTransferLoad(),
+		load.NewAddKeysLoad(),
+		evmLoad,
+		load.NewCreateAccountLoad(),
+	}
+
+	for _, l := range loads {
+		t.Run(string(l.Type()), testLoad(log, l))
+	}
+}
+
+func testLoad(log zerolog.Logger, l load.Load) func(t *testing.T) {
+
+	return func(t *testing.T) {
+
+		chain := flow.Benchnet.Chain()
+
+		vm, ctx, snapshotTree := bootstrapVM(t, chain)
+		testSnapshotTree := &testSnapshotTree{snapshot: snapshotTree}
+
+		blockProvider := noopReferenceBlockProvider{}
+		transactionSender := &testTransactionSender{
+			t:        t,
+			log:      log.With().Str("component", "testTransactionSender").Logger(),
+			vm:       vm,
+			ctx:      ctx,
+			snapshot: testSnapshotTree,
+		}
+		accountLoader := &TestAccountLoader{
+			ctx:      ctx,
+			vm:       vm,
+			snapshot: testSnapshotTree,
+		}
+
+		serviceAccount, err := accountLoader.Load(sdk.ServiceAddress(sdk.ChainID(chain.ChainID())), unittest.ServiceAccountPrivateKey.PrivateKey, unittest.ServiceAccountPrivateKey.HashAlgo)
+		require.NoError(t, err)
+
+		err = account.EnsureAccountHasKeys(log, serviceAccount, 50, blockProvider, transactionSender)
+		require.NoError(t, err)
+
+		err = account.ReloadAccount(accountLoader, serviceAccount)
+		require.NoError(t, err)
+
+		accountProvider, err := account.SetupProvider(
+			log,
+			context.Background(),
+			100,
+			10_000_000_000,
+			blockProvider,
+			serviceAccount,
+			transactionSender,
+			chain,
+		)
+		require.NoError(t, err)
+
+		lc := load.LoadContext{
+			ChainID:                chain.ChainID(),
+			AccountProvider:        accountProvider,
+			ReferenceBlockProvider: blockProvider,
+			TransactionSender:      transactionSender,
+			WorkerContext: load.WorkerContext{
+				WorkerID: 0,
+			},
+			Proposer: serviceAccount,
+		}
+
+		err = l.Setup(log, lc)
+		require.NoError(t, err)
+		for i := 0; i < 100; i++ {
+			err = l.Load(log, lc)
+			require.NoError(t, err)
+		}
+	}
+}
+
+func bootstrapVM(t *testing.T, chain flow.Chain) (*fvm.VirtualMachine, fvm.Context, snapshot.SnapshotTree) {
+	source := testutil.EntropyProviderFixture(nil)
+
+	opts := computation.DefaultFVMOptions(chain.ChainID(), false, false)
+	opts = append(opts,
+		fvm.WithTransactionFeesEnabled(true),
+		fvm.WithAccountStorageLimit(true),
+		fvm.WithContractDeploymentRestricted(false),
+		fvm.WithEntropyProvider(source),
+	)
+
+	ctx := fvm.NewContext(opts...)
+
+	vm := fvm.NewVirtualMachine()
+	snapshotTree := snapshot.NewSnapshotTree(nil)
+	bootstrapOpts := []fvm.BootstrapProcedureOption{
+		fvm.WithInitialTokenSupply(unittest.GenesisTokenSupply),
+		fvm.WithAccountCreationFee(fvm.DefaultAccountCreationFee),
+		fvm.WithMinimumStorageReservation(fvm.DefaultMinimumStorageReservation),
+		fvm.WithTransactionFee(fvm.DefaultTransactionFees),
+		fvm.WithStorageMBPerFLOW(fvm.DefaultStorageMBPerFLOW),
+		fvm.WithSetupEVMEnabled(true),
+	}
+
+	executionSnapshot, _, err := vm.Run(
+		ctx,
+		fvm.Bootstrap(unittest.ServiceAccountPublicKey, bootstrapOpts...),
+		snapshotTree)
+	require.NoError(t, err)
+	snapshotTree = snapshotTree.Append(executionSnapshot)
+
+	return vm, ctx, snapshotTree
+}
+
+type noopReferenceBlockProvider struct{}
+
+func (n noopReferenceBlockProvider) ReferenceBlockID() sdk.Identifier {
+	return sdk.EmptyID
+}
+
+var _ common.ReferenceBlockProvider = noopReferenceBlockProvider{}
+
+type testTransactionSender struct {
+	t        *testing.T
+	log      zerolog.Logger
+	vm       *fvm.VirtualMachine
+	ctx      fvm.Context
+	snapshot *testSnapshotTree
+}
+
+var _ common.TransactionSender = (*testTransactionSender)(nil)
+
+func (t *testTransactionSender) Send(tx *sdk.Transaction) (sdk.TransactionResult, error) {
+	txBody :=
+		flow.NewTransactionBody().
+			SetScript(tx.Script).
+			SetReferenceBlockID(convert.IDFromSDK(tx.ReferenceBlockID)).
+			SetComputeLimit(tx.GasLimit).
+			SetProposalKey(
+				flow.BytesToAddress(tx.ProposalKey.Address.Bytes()),
+				uint64(tx.ProposalKey.KeyIndex),
+				tx.ProposalKey.SequenceNumber,
+			).
+			SetPayer(flow.BytesToAddress(tx.Payer.Bytes()))
+
+	for _, auth := range tx.Authorizers {
+		txBody.AddAuthorizer(flow.BytesToAddress(auth.Bytes()))
+	}
+	for _, arg := range tx.Arguments {
+		txBody.AddArgument(arg)
+	}
+	for _, sig := range tx.PayloadSignatures {
+		txBody.AddPayloadSignature(
+			flow.BytesToAddress(sig.Address.Bytes()),
+			uint64(sig.KeyIndex),
+			sig.Signature,
+		)
+	}
+	for _, sig := range tx.EnvelopeSignatures {
+		txBody.AddEnvelopeSignature(
+			flow.BytesToAddress(sig.Address.Bytes()),
+			uint64(sig.KeyIndex),
+			sig.Signature,
+		)
+	}
+
+	require.Equal(t.t, string(tx.PayloadMessage()), string(txBody.PayloadMessage()))
+	require.Equal(t.t, string(tx.EnvelopeMessage()), string(txBody.EnvelopeMessage()))
+
+	proc := fvm.Transaction(txBody, 0)
+
+	t.snapshot.Lock()
+	defer t.snapshot.Unlock()
+
+	executionSnapshot, result, err := t.vm.Run(t.ctx, proc, t.snapshot)
+	if err != nil {
+		return sdk.TransactionResult{}, err
+	}
+	// Update the snapshot
+	t.snapshot.Append(executionSnapshot)
+
+	computationUsed := environment.MainnetExecutionEffortWeights.ComputationFromIntensities(result.ComputationIntensities)
+	t.log.Debug().Uint64("computation", computationUsed).Msg("Transaction applied")
+
+	sdkResult := sdk.TransactionResult{
+		Status:        sdk.TransactionStatusSealed,
+		Error:         result.Err,
+		BlockID:       sdk.EmptyID,
+		BlockHeight:   0,
+		TransactionID: convert2.FlowIdentifierToSDK(txBody.ID()),
+		CollectionID:  sdk.EmptyID,
+	}
+
+	for _, event := range result.Events {
+		decoded, err := ccf.Decode(nil, event.Payload)
+		if err != nil {
+			return sdkResult, fmt.Errorf("error decoding event payload: %w", err)
+		}
+
+		sdkResult.Events = append(sdkResult.Events, sdk.Event{
+			Type:             string(event.Type),
+			TransactionID:    sdk.Identifier{},
+			TransactionIndex: 0,
+			EventIndex:       int(event.EventIndex),
+			Value:            decoded.(cadence.Event),
+			Payload:          event.Payload,
+		})
+	}
+
+	if result.Err != nil {
+		return sdkResult, common.NewTransactionError(result.Err)
+	}
+
+	return sdkResult, nil
+}
+
+type TestAccountLoader struct {
+	ctx      fvm.Context
+	vm       *fvm.VirtualMachine
+	snapshot *testSnapshotTree
+}
+
+var _ account.Loader = (*TestAccountLoader)(nil)
+
+func (t *TestAccountLoader) Load(
+	address sdk.Address,
+	privateKey crypto.PrivateKey,
+	hashAlgo crypto.HashAlgorithm) (*account.FlowAccount, error) {
+	wrapErr := func(err error) error {
+		return fmt.Errorf("error while loading account: %w", err)
+	}
+
+	t.snapshot.Lock()
+	defer t.snapshot.Unlock()
+
+	acc, err := t.vm.GetAccount(t.ctx, flow.ConvertAddress(address), t.snapshot)
+	if err != nil {
+		return nil, wrapErr(err)
+	}
+
+	keys := make([]sdk.AccountKey, 0, len(acc.Keys))
+	for _, key := range acc.Keys {
+		keys = append(keys, sdk.AccountKey{
+			Index:          key.Index,
+			PublicKey:      key.PublicKey,
+			SigAlgo:        key.SignAlgo,
+			HashAlgo:       key.HashAlgo,
+			Weight:         key.Weight,
+			SequenceNumber: key.SeqNumber,
+			Revoked:        key.Revoked,
+		})
+	}
+
+	return account.New(address, privateKey, hashAlgo, keys)
+}
+
+type testSnapshotTree struct {
+	snapshot snapshot.SnapshotTree
+	sync.Mutex
+}
+
+func (t *testSnapshotTree) Get(id flow.RegisterID) (flow.RegisterValue, error) {
+	return t.snapshot.Get(id)
+}
+
+var _ snapshot.StorageSnapshot = (*testSnapshotTree)(nil)
+
+func (t *testSnapshotTree) Append(snapshot *snapshot.ExecutionSnapshot) {
+	t.snapshot = t.snapshot.Append(snapshot)
+}
diff --git a/integration/benchmark/load/simple_load.go b/integration/benchmark/load/simple_load.go
new file mode 100644
index 00000000000..e10927d5493
--- /dev/null
+++ b/integration/benchmark/load/simple_load.go
@@ -0,0 +1,95 @@
+package load
+
+import (
+	"fmt"
+
+	"github.com/onflow/cadence"
+	"github.com/rs/zerolog"
+
+	flowsdk "github.com/onflow/flow-go-sdk"
+	"github.com/onflow/flow-go/fvm/blueprints"
+	"github.com/onflow/flow-go/integration/benchmark/account"
+)
+
+// SimpleLoad is a load that at setup deploys a contract,
+// and at load sends a transaction using that contract.
+type SimpleLoad struct {
+	loadType         LoadType
+	contractName     string
+	contractTemplate string
+	scriptTemplate   string
+
+	contractAddress flowsdk.Address
+}
+
+var _ Load = (*SimpleLoad)(nil)
+
+// NewSimpleLoadType creates a new SimpleLoad.
+//   - loadType is the type of the load.
+//   - contractName is the name of the contract.
+//   - contractTemplate is the template of the contract.
+//   - scriptTemplate is the template of the script. It should contain a %s placeholder for
+//     the contract address.
+func NewSimpleLoadType(
+	loadType LoadType,
+	contractName string,
+	contractTemplate string,
+	scriptTemplate string,
+) *SimpleLoad {
+	return &SimpleLoad{
+		loadType:         loadType,
+		contractName:     contractName,
+		contractTemplate: contractTemplate,
+		scriptTemplate:   scriptTemplate,
+	}
+}
+
+func (l *SimpleLoad) Type() LoadType {
+	return l.loadType
+}
+
+func (l *SimpleLoad) Setup(log zerolog.Logger, lc LoadContext) error {
+	return sendSimpleTransaction(
+		log,
+		lc,
+		func(
+			log zerolog.Logger,
+			lc LoadContext,
+			acc *account.FlowAccount,
+		) (*flowsdk.Transaction, error) {
+			// this is going to be the contract address
+			l.contractAddress = acc.Address
+
+			deploymentTx := flowsdk.NewTransaction().
+				SetReferenceBlockID(lc.ReferenceBlockID()).
+				SetScript(blueprints.DeployContractTransactionTemplate)
+
+			err := deploymentTx.AddArgument(cadence.String(l.contractName))
+			if err != nil {
+				return nil, err
+			}
+			err = deploymentTx.AddArgument(cadence.String(l.contractTemplate))
+			if err != nil {
+				return nil, err
+			}
+
+			return deploymentTx, nil
+		},
+	)
+}
+
+func (l *SimpleLoad) Load(log zerolog.Logger, lc LoadContext) error {
+	return sendSimpleTransaction(
+		log,
+		lc,
+		func(
+			log zerolog.Logger,
+			lc LoadContext,
+			acc *account.FlowAccount,
+		) (*flowsdk.Transaction, error) {
+			txScript := fmt.Sprintf(l.scriptTemplate, l.contractAddress)
+			return flowsdk.NewTransaction().
+				SetScript([]byte(txScript)), nil
+		},
+	)
+}
diff --git a/integration/benchmark/load/token_transfer_load.go b/integration/benchmark/load/token_transfer_load.go
new file mode 100644
index 00000000000..e382c58611f
--- /dev/null
+++ b/integration/benchmark/load/token_transfer_load.go
@@ -0,0 +1,72 @@
+package load
+
+import (
+	"github.com/onflow/cadence"
+	"github.com/rs/zerolog"
+
+	flowsdk "github.com/onflow/flow-go-sdk"
+	"github.com/onflow/flow-go/fvm/errors"
+	"github.com/onflow/flow-go/fvm/systemcontracts"
+	"github.com/onflow/flow-go/integration/benchmark/account"
+	"github.com/onflow/flow-go/integration/benchmark/scripts"
+	"github.com/onflow/flow-go/model/flow"
+)
+
+type TokenTransferLoad struct {
+	tokensPerTransfer cadence.UFix64
+}
+
+func NewTokenTransferLoad() *TokenTransferLoad {
+	return &TokenTransferLoad{
+		tokensPerTransfer: cadence.UFix64(100),
+	}
+}
+
+var _ Load = (*TokenTransferLoad)(nil)
+
+func (l *TokenTransferLoad) Type() LoadType {
+	return TokenTransferLoadType
+}
+
+func (l *TokenTransferLoad) Setup(_ zerolog.Logger, _ LoadContext) error {
+	return nil
+}
+
+func (l *TokenTransferLoad) Load(log zerolog.Logger, lc LoadContext) error {
+	return sendSimpleTransaction(
+		log,
+		lc,
+		func(
+			log zerolog.Logger,
+			lc LoadContext,
+			acc *account.FlowAccount,
+		) (*flowsdk.Transaction, error) {
+			sc := systemcontracts.SystemContractsForChain(lc.ChainID)
+
+			// get another account to send tokens to
+			var destinationAddress flow.Address
+			acc2, err := lc.BorrowAvailableAccount()
+			if err != nil {
+				if !errors.Is(err, account.ErrNoAccountsAvailable) {
+					return nil, err
+				}
+				// if no accounts are available, just send to the service account
+				destinationAddress = sc.FlowServiceAccount.Address
+			} else {
+				destinationAddress = flow.ConvertAddress(acc2.Address)
+				lc.ReturnAvailableAccount(acc2)
+			}
+
+			transferTx, err := scripts.TokenTransferTransaction(
+				sc.FungibleToken.Address,
+				sc.FlowToken.Address,
+				destinationAddress,
+				l.tokensPerTransfer)
+			if err != nil {
+				return nil, err
+			}
+
+			return transferTx, nil
+		},
+	)
+}
diff --git a/integration/benchmark/mocksiface/mocks.go b/integration/benchmark/mocksiface/mocks.go
deleted file mode 100644
index 0068b5676c2..00000000000
--- a/integration/benchmark/mocksiface/mocks.go
+++ /dev/null
@@ -1,10 +0,0 @@
-package mocksiface_test
-
-import (
-	"github.com/onflow/flow-go-sdk/access"
-)
-
-// This is a proxy for the real access.Client for mockery to use.
-type Client interface {
-	access.Client
-}
diff --git a/integration/benchmark/prometheus.go b/integration/benchmark/prometheus.go
index baa29e8ae4c..8fa7caca2cf 100644
--- a/integration/benchmark/prometheus.go
+++ b/integration/benchmark/prometheus.go
@@ -9,7 +9,7 @@ import (
 	"github.com/rs/zerolog"
 )
 
-type statsPusherImpl struct {
+type StatsPusherImpl struct {
 	pusher *push.Pusher
 	cancel context.CancelFunc
 	done   chan struct{}
@@ -22,10 +22,10 @@ func NewStatsPusher(
 	pushgateway string,
 	job string,
 	gatherer prometheus.Gatherer,
-) *statsPusherImpl {
+) *StatsPusherImpl {
 
 	localCtx, cancel := context.WithCancel(ctx)
-	sp := &statsPusherImpl{
+	sp := &StatsPusherImpl{
 		pusher: push.New(pushgateway, job).Gatherer(gatherer),
 		done:   make(chan struct{}),
 		cancel: cancel,
@@ -60,7 +60,7 @@ func NewStatsPusher(
 }
 
 // Stop the stats pusher and waits for it to finish.
-func (sp *statsPusherImpl) Stop() {
+func (sp *StatsPusherImpl) Stop() {
 	sp.cancel()
 	<-sp.done
 }
diff --git a/integration/benchmark/proto/generate.go b/integration/benchmark/proto/generate.go
deleted file mode 100644
index b36797e4592..00000000000
--- a/integration/benchmark/proto/generate.go
+++ /dev/null
@@ -1,3 +0,0 @@
-//go:generate protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative macro_benchmark.proto
-
-package proto
diff --git a/integration/benchmark/proto/macro_benchmark.pb.go b/integration/benchmark/proto/macro_benchmark.pb.go
deleted file mode 100644
index 15fdb7b4cf9..00000000000
--- a/integration/benchmark/proto/macro_benchmark.pb.go
+++ /dev/null
@@ -1,435 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.28.1
-// 	protoc        v3.21.9
-// source: macro_benchmark.proto
-
-package proto
-
-import (
-	reflect "reflect"
-	sync "sync"
-
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	emptypb "google.golang.org/protobuf/types/known/emptypb"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-type StartMacroBenchmarkRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *StartMacroBenchmarkRequest) Reset() {
-	*x = StartMacroBenchmarkRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_macro_benchmark_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *StartMacroBenchmarkRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*StartMacroBenchmarkRequest) ProtoMessage() {}
-
-func (x *StartMacroBenchmarkRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_macro_benchmark_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use StartMacroBenchmarkRequest.ProtoReflect.Descriptor instead.
-func (*StartMacroBenchmarkRequest) Descriptor() ([]byte, []int) {
-	return file_macro_benchmark_proto_rawDescGZIP(), []int{0}
-}
-
-type StartMacroBenchmarkResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *StartMacroBenchmarkResponse) Reset() {
-	*x = StartMacroBenchmarkResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_macro_benchmark_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *StartMacroBenchmarkResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*StartMacroBenchmarkResponse) ProtoMessage() {}
-
-func (x *StartMacroBenchmarkResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_macro_benchmark_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use StartMacroBenchmarkResponse.ProtoReflect.Descriptor instead.
-func (*StartMacroBenchmarkResponse) Descriptor() ([]byte, []int) {
-	return file_macro_benchmark_proto_rawDescGZIP(), []int{1}
-}
-
-type GetMacroBenchmarkRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *GetMacroBenchmarkRequest) Reset() {
-	*x = GetMacroBenchmarkRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_macro_benchmark_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *GetMacroBenchmarkRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetMacroBenchmarkRequest) ProtoMessage() {}
-
-func (x *GetMacroBenchmarkRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_macro_benchmark_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetMacroBenchmarkRequest.ProtoReflect.Descriptor instead.
-func (*GetMacroBenchmarkRequest) Descriptor() ([]byte, []int) {
-	return file_macro_benchmark_proto_rawDescGZIP(), []int{2}
-}
-
-type GetMacroBenchmarkResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *GetMacroBenchmarkResponse) Reset() {
-	*x = GetMacroBenchmarkResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_macro_benchmark_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *GetMacroBenchmarkResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetMacroBenchmarkResponse) ProtoMessage() {}
-
-func (x *GetMacroBenchmarkResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_macro_benchmark_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetMacroBenchmarkResponse.ProtoReflect.Descriptor instead.
-func (*GetMacroBenchmarkResponse) Descriptor() ([]byte, []int) {
-	return file_macro_benchmark_proto_rawDescGZIP(), []int{3}
-}
-
-type ListMacroBenchmarksResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *ListMacroBenchmarksResponse) Reset() {
-	*x = ListMacroBenchmarksResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_macro_benchmark_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *ListMacroBenchmarksResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*ListMacroBenchmarksResponse) ProtoMessage() {}
-
-func (x *ListMacroBenchmarksResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_macro_benchmark_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use ListMacroBenchmarksResponse.ProtoReflect.Descriptor instead.
-func (*ListMacroBenchmarksResponse) Descriptor() ([]byte, []int) {
-	return file_macro_benchmark_proto_rawDescGZIP(), []int{4}
-}
-
-type StatusResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *StatusResponse) Reset() {
-	*x = StatusResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_macro_benchmark_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *StatusResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*StatusResponse) ProtoMessage() {}
-
-func (x *StatusResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_macro_benchmark_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use StatusResponse.ProtoReflect.Descriptor instead.
-func (*StatusResponse) Descriptor() ([]byte, []int) {
-	return file_macro_benchmark_proto_rawDescGZIP(), []int{5}
-}
-
-var File_macro_benchmark_proto protoreflect.FileDescriptor
-
-var file_macro_benchmark_proto_rawDesc = []byte{
-	0x0a, 0x15, 0x6d, 0x61, 0x63, 0x72, 0x6f, 0x5f, 0x62, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72,
-	0x6b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x09, 0x62, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61,
-	0x72, 0x6b, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
-	0x1c, 0x0a, 0x1a, 0x53, 0x74, 0x61, 0x72, 0x74, 0x4d, 0x61, 0x63, 0x72, 0x6f, 0x42, 0x65, 0x6e,
-	0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x1d, 0x0a,
-	0x1b, 0x53, 0x74, 0x61, 0x72, 0x74, 0x4d, 0x61, 0x63, 0x72, 0x6f, 0x42, 0x65, 0x6e, 0x63, 0x68,
-	0x6d, 0x61, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1a, 0x0a, 0x18,
-	0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x72, 0x6f, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72,
-	0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x1b, 0x0a, 0x19, 0x47, 0x65, 0x74, 0x4d,
-	0x61, 0x63, 0x72, 0x6f, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1d, 0x0a, 0x1b, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63,
-	0x72, 0x6f, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x10, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0xef, 0x02, 0x0a, 0x09, 0x42, 0x65, 0x6e, 0x63, 0x68,
-	0x6d, 0x61, 0x72, 0x6b, 0x12, 0x68, 0x0a, 0x13, 0x53, 0x74, 0x61, 0x72, 0x74, 0x4d, 0x61, 0x63,
-	0x72, 0x6f, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x12, 0x25, 0x2e, 0x62, 0x65,
-	0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x2e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x4d, 0x61, 0x63,
-	0x72, 0x6f, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x26, 0x2e, 0x62, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x2e, 0x53,
-	0x74, 0x61, 0x72, 0x74, 0x4d, 0x61, 0x63, 0x72, 0x6f, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61,
-	0x72, 0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x30, 0x01, 0x12, 0x60,
-	0x0a, 0x11, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x72, 0x6f, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x6d,
-	0x61, 0x72, 0x6b, 0x12, 0x23, 0x2e, 0x62, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x2e,
-	0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x72, 0x6f, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72,
-	0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x24, 0x2e, 0x62, 0x65, 0x6e, 0x63, 0x68,
-	0x6d, 0x61, 0x72, 0x6b, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x61, 0x63, 0x72, 0x6f, 0x42, 0x65, 0x6e,
-	0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x57, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x72, 0x6f, 0x42, 0x65, 0x6e,
-	0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a,
-	0x26, 0x2e, 0x62, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x2e, 0x4c, 0x69, 0x73, 0x74,
-	0x4d, 0x61, 0x63, 0x72, 0x6f, 0x42, 0x65, 0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x73, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x3d, 0x0a, 0x06, 0x53, 0x74, 0x61,
-	0x74, 0x75, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x19, 0x2e, 0x62, 0x65,
-	0x6e, 0x63, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x6e, 0x66, 0x6c, 0x6f, 0x77, 0x2f, 0x66, 0x6c,
-	0x6f, 0x77, 0x2d, 0x67, 0x6f, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x2f, 0x62, 0x65, 0x63, 0x6e, 0x68, 0x6d, 0x61, 0x72, 0x6b, 0x2f, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
-
-var (
-	file_macro_benchmark_proto_rawDescOnce sync.Once
-	file_macro_benchmark_proto_rawDescData = file_macro_benchmark_proto_rawDesc
-)
-
-func file_macro_benchmark_proto_rawDescGZIP() []byte {
-	file_macro_benchmark_proto_rawDescOnce.Do(func() {
-		file_macro_benchmark_proto_rawDescData = protoimpl.X.CompressGZIP(file_macro_benchmark_proto_rawDescData)
-	})
-	return file_macro_benchmark_proto_rawDescData
-}
-
-var file_macro_benchmark_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
-var file_macro_benchmark_proto_goTypes = []interface{}{
-	(*StartMacroBenchmarkRequest)(nil),  // 0: benchmark.StartMacroBenchmarkRequest
-	(*StartMacroBenchmarkResponse)(nil), // 1: benchmark.StartMacroBenchmarkResponse
-	(*GetMacroBenchmarkRequest)(nil),    // 2: benchmark.GetMacroBenchmarkRequest
-	(*GetMacroBenchmarkResponse)(nil),   // 3: benchmark.GetMacroBenchmarkResponse
-	(*ListMacroBenchmarksResponse)(nil), // 4: benchmark.ListMacroBenchmarksResponse
-	(*StatusResponse)(nil),              // 5: benchmark.StatusResponse
-	(*emptypb.Empty)(nil),               // 6: google.protobuf.Empty
-}
-var file_macro_benchmark_proto_depIdxs = []int32{
-	0, // 0: benchmark.Benchmark.StartMacroBenchmark:input_type -> benchmark.StartMacroBenchmarkRequest
-	2, // 1: benchmark.Benchmark.GetMacroBenchmark:input_type -> benchmark.GetMacroBenchmarkRequest
-	6, // 2: benchmark.Benchmark.ListMacroBenchmarks:input_type -> google.protobuf.Empty
-	6, // 3: benchmark.Benchmark.Status:input_type -> google.protobuf.Empty
-	1, // 4: benchmark.Benchmark.StartMacroBenchmark:output_type -> benchmark.StartMacroBenchmarkResponse
-	3, // 5: benchmark.Benchmark.GetMacroBenchmark:output_type -> benchmark.GetMacroBenchmarkResponse
-	4, // 6: benchmark.Benchmark.ListMacroBenchmarks:output_type -> benchmark.ListMacroBenchmarksResponse
-	5, // 7: benchmark.Benchmark.Status:output_type -> benchmark.StatusResponse
-	4, // [4:8] is the sub-list for method output_type
-	0, // [0:4] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
-}
-
-func init() { file_macro_benchmark_proto_init() }
-func file_macro_benchmark_proto_init() {
-	if File_macro_benchmark_proto != nil {
-		return
-	}
-	if !protoimpl.UnsafeEnabled {
-		file_macro_benchmark_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StartMacroBenchmarkRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_macro_benchmark_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StartMacroBenchmarkResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_macro_benchmark_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetMacroBenchmarkRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_macro_benchmark_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetMacroBenchmarkResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_macro_benchmark_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ListMacroBenchmarksResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_macro_benchmark_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StatusResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_macro_benchmark_proto_rawDesc,
-			NumEnums:      0,
-			NumMessages:   6,
-			NumExtensions: 0,
-			NumServices:   1,
-		},
-		GoTypes:           file_macro_benchmark_proto_goTypes,
-		DependencyIndexes: file_macro_benchmark_proto_depIdxs,
-		MessageInfos:      file_macro_benchmark_proto_msgTypes,
-	}.Build()
-	File_macro_benchmark_proto = out.File
-	file_macro_benchmark_proto_rawDesc = nil
-	file_macro_benchmark_proto_goTypes = nil
-	file_macro_benchmark_proto_depIdxs = nil
-}
diff --git a/integration/benchmark/proto/macro_benchmark.proto b/integration/benchmark/proto/macro_benchmark.proto
deleted file mode 100644
index e461ea81892..00000000000
--- a/integration/benchmark/proto/macro_benchmark.proto
+++ /dev/null
@@ -1,28 +0,0 @@
-syntax = "proto3";
-
-package benchmark;
-option go_package = "github.com/onflow/flow-go/integration/becnhmark/proto";
-
-import "google/protobuf/empty.proto";
-
-message StartMacroBenchmarkRequest {}
-message StartMacroBenchmarkResponse {}
-
-message GetMacroBenchmarkRequest {}
-message GetMacroBenchmarkResponse {}
-
-message ListMacroBenchmarksResponse {}
-
-message StatusResponse {}
-
-service Benchmark {
-  rpc StartMacroBenchmark(StartMacroBenchmarkRequest)
-      returns (stream StartMacroBenchmarkResponse) {}
-  rpc GetMacroBenchmark(GetMacroBenchmarkRequest)
-      returns (GetMacroBenchmarkResponse) {}
-  rpc ListMacroBenchmarks(google.protobuf.Empty)
-      returns (ListMacroBenchmarksResponse) {}
-
-  rpc Status(google.protobuf.Empty) returns (StatusResponse) {}
-}
-
diff --git a/integration/benchmark/proto/macro_benchmark_grpc.pb.go b/integration/benchmark/proto/macro_benchmark_grpc.pb.go
deleted file mode 100644
index 065a26fcb39..00000000000
--- a/integration/benchmark/proto/macro_benchmark_grpc.pb.go
+++ /dev/null
@@ -1,243 +0,0 @@
-// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-// versions:
-// - protoc-gen-go-grpc v1.2.0
-// - protoc             v3.21.9
-// source: macro_benchmark.proto
-
-package proto
-
-import (
-	context "context"
-
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
-	emptypb "google.golang.org/protobuf/types/known/emptypb"
-)
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.32.0 or later.
-const _ = grpc.SupportPackageIsVersion7
-
-// BenchmarkClient is the client API for Benchmark service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-type BenchmarkClient interface {
-	StartMacroBenchmark(ctx context.Context, in *StartMacroBenchmarkRequest, opts ...grpc.CallOption) (Benchmark_StartMacroBenchmarkClient, error)
-	GetMacroBenchmark(ctx context.Context, in *GetMacroBenchmarkRequest, opts ...grpc.CallOption) (*GetMacroBenchmarkResponse, error)
-	ListMacroBenchmarks(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListMacroBenchmarksResponse, error)
-	Status(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*StatusResponse, error)
-}
-
-type benchmarkClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewBenchmarkClient(cc grpc.ClientConnInterface) BenchmarkClient {
-	return &benchmarkClient{cc}
-}
-
-func (c *benchmarkClient) StartMacroBenchmark(ctx context.Context, in *StartMacroBenchmarkRequest, opts ...grpc.CallOption) (Benchmark_StartMacroBenchmarkClient, error) {
-	stream, err := c.cc.NewStream(ctx, &Benchmark_ServiceDesc.Streams[0], "/benchmark.Benchmark/StartMacroBenchmark", opts...)
-	if err != nil {
-		return nil, err
-	}
-	x := &benchmarkStartMacroBenchmarkClient{stream}
-	if err := x.ClientStream.SendMsg(in); err != nil {
-		return nil, err
-	}
-	if err := x.ClientStream.CloseSend(); err != nil {
-		return nil, err
-	}
-	return x, nil
-}
-
-type Benchmark_StartMacroBenchmarkClient interface {
-	Recv() (*StartMacroBenchmarkResponse, error)
-	grpc.ClientStream
-}
-
-type benchmarkStartMacroBenchmarkClient struct {
-	grpc.ClientStream
-}
-
-func (x *benchmarkStartMacroBenchmarkClient) Recv() (*StartMacroBenchmarkResponse, error) {
-	m := new(StartMacroBenchmarkResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-func (c *benchmarkClient) GetMacroBenchmark(ctx context.Context, in *GetMacroBenchmarkRequest, opts ...grpc.CallOption) (*GetMacroBenchmarkResponse, error) {
-	out := new(GetMacroBenchmarkResponse)
-	err := c.cc.Invoke(ctx, "/benchmark.Benchmark/GetMacroBenchmark", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *benchmarkClient) ListMacroBenchmarks(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListMacroBenchmarksResponse, error) {
-	out := new(ListMacroBenchmarksResponse)
-	err := c.cc.Invoke(ctx, "/benchmark.Benchmark/ListMacroBenchmarks", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *benchmarkClient) Status(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*StatusResponse, error) {
-	out := new(StatusResponse)
-	err := c.cc.Invoke(ctx, "/benchmark.Benchmark/Status", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-// BenchmarkServer is the server API for Benchmark service.
-// All implementations must embed UnimplementedBenchmarkServer
-// for forward compatibility
-type BenchmarkServer interface {
-	StartMacroBenchmark(*StartMacroBenchmarkRequest, Benchmark_StartMacroBenchmarkServer) error
-	GetMacroBenchmark(context.Context, *GetMacroBenchmarkRequest) (*GetMacroBenchmarkResponse, error)
-	ListMacroBenchmarks(context.Context, *emptypb.Empty) (*ListMacroBenchmarksResponse, error)
-	Status(context.Context, *emptypb.Empty) (*StatusResponse, error)
-	mustEmbedUnimplementedBenchmarkServer()
-}
-
-// UnimplementedBenchmarkServer must be embedded to have forward compatible implementations.
-type UnimplementedBenchmarkServer struct {
-}
-
-func (UnimplementedBenchmarkServer) StartMacroBenchmark(*StartMacroBenchmarkRequest, Benchmark_StartMacroBenchmarkServer) error {
-	return status.Errorf(codes.Unimplemented, "method StartMacroBenchmark not implemented")
-}
-func (UnimplementedBenchmarkServer) GetMacroBenchmark(context.Context, *GetMacroBenchmarkRequest) (*GetMacroBenchmarkResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetMacroBenchmark not implemented")
-}
-func (UnimplementedBenchmarkServer) ListMacroBenchmarks(context.Context, *emptypb.Empty) (*ListMacroBenchmarksResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ListMacroBenchmarks not implemented")
-}
-func (UnimplementedBenchmarkServer) Status(context.Context, *emptypb.Empty) (*StatusResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Status not implemented")
-}
-func (UnimplementedBenchmarkServer) mustEmbedUnimplementedBenchmarkServer() {}
-
-// UnsafeBenchmarkServer may be embedded to opt out of forward compatibility for this service.
-// Use of this interface is not recommended, as added methods to BenchmarkServer will
-// result in compilation errors.
-type UnsafeBenchmarkServer interface {
-	mustEmbedUnimplementedBenchmarkServer()
-}
-
-func RegisterBenchmarkServer(s grpc.ServiceRegistrar, srv BenchmarkServer) {
-	s.RegisterService(&Benchmark_ServiceDesc, srv)
-}
-
-func _Benchmark_StartMacroBenchmark_Handler(srv interface{}, stream grpc.ServerStream) error {
-	m := new(StartMacroBenchmarkRequest)
-	if err := stream.RecvMsg(m); err != nil {
-		return err
-	}
-	return srv.(BenchmarkServer).StartMacroBenchmark(m, &benchmarkStartMacroBenchmarkServer{stream})
-}
-
-type Benchmark_StartMacroBenchmarkServer interface {
-	Send(*StartMacroBenchmarkResponse) error
-	grpc.ServerStream
-}
-
-type benchmarkStartMacroBenchmarkServer struct {
-	grpc.ServerStream
-}
-
-func (x *benchmarkStartMacroBenchmarkServer) Send(m *StartMacroBenchmarkResponse) error {
-	return x.ServerStream.SendMsg(m)
-}
-
-func _Benchmark_GetMacroBenchmark_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(GetMacroBenchmarkRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(BenchmarkServer).GetMacroBenchmark(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/benchmark.Benchmark/GetMacroBenchmark",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(BenchmarkServer).GetMacroBenchmark(ctx, req.(*GetMacroBenchmarkRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Benchmark_ListMacroBenchmarks_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(emptypb.Empty)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(BenchmarkServer).ListMacroBenchmarks(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/benchmark.Benchmark/ListMacroBenchmarks",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(BenchmarkServer).ListMacroBenchmarks(ctx, req.(*emptypb.Empty))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Benchmark_Status_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(emptypb.Empty)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(BenchmarkServer).Status(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/benchmark.Benchmark/Status",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(BenchmarkServer).Status(ctx, req.(*emptypb.Empty))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-// Benchmark_ServiceDesc is the grpc.ServiceDesc for Benchmark service.
-// It's only intended for direct use with grpc.RegisterService,
-// and not to be introspected or modified (even as a copy)
-var Benchmark_ServiceDesc = grpc.ServiceDesc{
-	ServiceName: "benchmark.Benchmark",
-	HandlerType: (*BenchmarkServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "GetMacroBenchmark",
-			Handler:    _Benchmark_GetMacroBenchmark_Handler,
-		},
-		{
-			MethodName: "ListMacroBenchmarks",
-			Handler:    _Benchmark_ListMacroBenchmarks_Handler,
-		},
-		{
-			MethodName: "Status",
-			Handler:    _Benchmark_Status_Handler,
-		},
-	},
-	Streams: []grpc.StreamDesc{
-		{
-			StreamName:    "StartMacroBenchmark",
-			Handler:       _Benchmark_StartMacroBenchmark_Handler,
-			ServerStreams: true,
-		},
-	},
-	Metadata: "macro_benchmark.proto",
-}
diff --git a/integration/benchmark/scripts.go b/integration/benchmark/scripts.go
deleted file mode 100644
index 7a3b85438b0..00000000000
--- a/integration/benchmark/scripts.go
+++ /dev/null
@@ -1,137 +0,0 @@
-package benchmark
-
-import (
-	_ "embed"
-	"encoding/hex"
-	"fmt"
-	"math/rand"
-	"strings"
-
-	"github.com/onflow/cadence"
-
-	flowsdk "github.com/onflow/flow-go-sdk"
-)
-
-//go:embed scripts/tokenTransferTransaction.cdc
-var tokenTransferTransactionTemplate string
-
-// TokenTransferTransaction returns a transaction script for transferring `amount` flow tokens to `toAddr` address
-func TokenTransferTransaction(ftAddr, flowToken, toAddr *flowsdk.Address, amount float64) (*flowsdk.Transaction, error) {
-
-	withFTAddr := strings.Replace(tokenTransferTransactionTemplate, "0xFUNGIBLETOKENADDRESS", "0x"+ftAddr.Hex(), 1)
-	withFlowTokenAddr := strings.Replace(withFTAddr, "0xTOKENADDRESS", "0x"+flowToken.Hex(), 1)
-
-	tx := flowsdk.NewTransaction().
-		SetScript([]byte(withFlowTokenAddr))
-
-	cadAmount, err := cadence.NewUFix64(fmt.Sprintf("%f", amount))
-	if err != nil {
-		return nil, err
-	}
-
-	err = tx.AddArgument(cadAmount)
-	if err != nil {
-		return nil, err
-	}
-	err = tx.AddArgument(cadence.BytesToAddress(toAddr.Bytes()))
-	if err != nil {
-		return nil, err
-	}
-
-	return tx, nil
-}
-
-//go:embed scripts/addKeyToAccountTransaction.cdc
-var addKeyToAccountTransactionTemplate string
-
-// AddKeyToAccountScript returns a transaction script to add keys to an account
-func AddKeyToAccountScript() ([]byte, error) {
-	return []byte(addKeyToAccountTransactionTemplate), nil
-}
-
-//go:embed scripts/createAccountsTransaction.cdc
-var createAccountsScriptTemplate string
-
-// CreateAccountsScript returns a transaction script for creating an account
-func CreateAccountsScript(fungibleToken, flowToken flowsdk.Address) []byte {
-	return []byte(fmt.Sprintf(createAccountsScriptTemplate, fungibleToken, flowToken))
-}
-
-//go:embed scripts/myFavContract.cdc
-var myFavContract string
-
-//go:embed scripts/deployingMyFavContractTransaction.cdc
-var deployingMyFavContractScriptTemplate string
-
-func DeployingMyFavContractScript() []byte {
-	return []byte(fmt.Sprintf(deployingMyFavContractScriptTemplate, "MyFavContract", hex.EncodeToString([]byte(myFavContract))))
-
-}
-
-//go:embed scripts/eventHeavyTransaction.cdc
-var eventHeavyScriptTemplate string
-
-func EventHeavyScript(favContractAddress flowsdk.Address) []byte {
-	return []byte(fmt.Sprintf(eventHeavyScriptTemplate, favContractAddress))
-}
-
-//go:embed scripts/compHeavyTransaction.cdc
-var compHeavyScriptTemplate string
-
-func ComputationHeavyScript(favContractAddress flowsdk.Address) []byte {
-	return []byte(fmt.Sprintf(compHeavyScriptTemplate, favContractAddress))
-}
-
-//go:embed scripts/ledgerHeavyTransaction.cdc
-var ledgerHeavyScriptTemplate string
-
-func LedgerHeavyScript(favContractAddress flowsdk.Address) []byte {
-	return []byte(fmt.Sprintf(ledgerHeavyScriptTemplate, favContractAddress))
-}
-
-//go:embed scripts/execDataHeavyTransaction.cdc
-var execDataHeavyScriptTemplate string
-
-func ExecDataHeavyScript(favContractAddress flowsdk.Address) []byte {
-	return []byte(fmt.Sprintf(execDataHeavyScriptTemplate, favContractAddress))
-}
-
-//go:embed scripts/constExecCostTransaction.cdc
-var constExecTransactionTemplate string
-
-func generateRandomStringWithLen(commentLen uint) string {
-	const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
-	bytes := make([]byte, commentLen)
-	for i := range bytes {
-		bytes[i] = letterBytes[rand.Intn(len(letterBytes))]
-	}
-	return string(bytes)
-}
-
-func generateAuthAccountParamList(authAccountNum uint) string {
-	authAccountList := []string{}
-	for i := uint(0); i < authAccountNum; i++ {
-		authAccountList = append(authAccountList, fmt.Sprintf("acct%d: AuthAccount", i+1))
-	}
-	return strings.Join(authAccountList, ", ")
-}
-
-// ConstExecCostTransaction returns a transaction script for constant execution size (0)
-func ConstExecCostTransaction(numOfAuthorizer, commentSizeInByte uint) []byte {
-	commentStr := generateRandomStringWithLen(commentSizeInByte)
-	authAccountListStr := generateAuthAccountParamList(numOfAuthorizer)
-
-	// the transaction template has two `%s`: #1 is for comment; #2 is for AuthAccount param list
-	return []byte(fmt.Sprintf(constExecTransactionTemplate, commentStr, authAccountListStr))
-}
-
-func bytesToCadenceArray(l []byte) cadence.Array {
-	values := make([]cadence.Value, len(l))
-	for i, b := range l {
-		values[i] = cadence.NewUInt8(b)
-	}
-
-	return cadence.NewArray(values)
-}
-
-// TODO add tx size heavy similar to add keys
diff --git a/integration/benchmark/scripts/addKeyToAccountTransaction.cdc b/integration/benchmark/scripts/addKeysToAccountTransaction.cdc
similarity index 100%
rename from integration/benchmark/scripts/addKeyToAccountTransaction.cdc
rename to integration/benchmark/scripts/addKeysToAccountTransaction.cdc
diff --git a/integration/benchmark/scripts/compHeavyContract.cdc b/integration/benchmark/scripts/compHeavyContract.cdc
new file mode 100644
index 00000000000..a44a757228b
--- /dev/null
+++ b/integration/benchmark/scripts/compHeavyContract.cdc
@@ -0,0 +1,16 @@
+access(all) contract ComputationHeavy {
+    access(all) fun ComputationHeavy(_ n: Int) {
+    	var s: Int256 = 1024102410241024
+        var i = 0
+        var a = Int256(7)
+        var b = Int256(5)
+        var c = Int256(2)
+        while i < n {
+            s = s * a
+            s = s / b
+            s = s / c
+            i = i + 1
+        }
+        log(i)
+    }
+}
diff --git a/integration/benchmark/scripts/compHeavyTransaction.cdc b/integration/benchmark/scripts/compHeavyTransaction.cdc
index 2fc698c3cad..555d5938b9e 100644
--- a/integration/benchmark/scripts/compHeavyTransaction.cdc
+++ b/integration/benchmark/scripts/compHeavyTransaction.cdc
@@ -1,8 +1,8 @@
-import MyFavContract from 0x%s
+import ComputationHeavy from 0x%s
 
 transaction {
   prepare(acct: AuthAccount) {}
   execute {
-    MyFavContract.ComputationHeavy(15000)
+    ComputationHeavy.ComputationHeavy(1500)
   }
 }
diff --git a/integration/benchmark/scripts/dataHeavyContract.cdc b/integration/benchmark/scripts/dataHeavyContract.cdc
new file mode 100644
index 00000000000..e5b12462005
--- /dev/null
+++ b/integration/benchmark/scripts/dataHeavyContract.cdc
@@ -0,0 +1,63 @@
+access(all) contract DataHeavy {
+
+    init() {
+        self.itemCounter = UInt32(0)
+        self.items = []
+    }
+
+    // items
+    access(all) event NewItemAddedEvent(id: UInt32, metadata: {String: String})
+
+    access(self) var itemCounter: UInt32
+
+    access(all) struct Item {
+
+            pub let itemID: UInt32
+
+            pub let metadata: {String: String}
+
+            init(_ metadata: {String: String}) {
+                self.itemID = DataHeavy.itemCounter
+                self.metadata = metadata
+
+                // inc the counter
+                DataHeavy.itemCounter = DataHeavy.itemCounter + UInt32(1)
+
+                // emit event
+                emit NewItemAddedEvent(id: self.itemID, metadata: self.metadata)
+            }
+    }
+
+    access(self) var items: [Item]
+
+    access(all) fun AddItem(_ metadata: {String: String}){
+        let item = Item(metadata)
+        self.items.append(item)
+    }
+
+    access(all) fun AddManyRandomItems(_ n: Int){
+        var i = 0
+        while i < n {
+            DataHeavy.AddItem({"data": "ABCDEFGHIJKLMNOP"})
+            i = i + 1
+        }
+    }
+
+
+    access(all) event LargeEvent(value: Int256, str: String, list: [UInt256], dic: {String: String})
+
+    access(all) fun EventHeavy(_ n: Int) {
+        var s: Int256 = 1024102410241024
+        var i = 0
+
+        while i < n {
+            emit LargeEvent(value: s, str: s.toString(), list:[], dic:{s.toString():s.toString()})
+            i = i + 1
+        }
+        log(i)
+    }
+
+    access(all) fun LedgerInteractionHeavy(_ n: Int) {
+        DataHeavy.AddManyRandomItems(n)
+    }
+}
diff --git a/integration/benchmark/scripts/dataHeavyTransaction.cdc b/integration/benchmark/scripts/dataHeavyTransaction.cdc
new file mode 100644
index 00000000000..8d0deaecf3c
--- /dev/null
+++ b/integration/benchmark/scripts/dataHeavyTransaction.cdc
@@ -0,0 +1,9 @@
+import DataHeavy from 0x%s
+
+transaction {
+  prepare(acct: AuthAccount) {}
+  execute {
+    DataHeavy.LedgerInteractionHeavy(100)
+    DataHeavy.EventHeavy(100)
+  }
+}
diff --git a/integration/benchmark/scripts/eventHeavyContract.cdc b/integration/benchmark/scripts/eventHeavyContract.cdc
new file mode 100644
index 00000000000..eca1475071c
--- /dev/null
+++ b/integration/benchmark/scripts/eventHeavyContract.cdc
@@ -0,0 +1,14 @@
+access(all) contract EventHeavy {
+    access(all) event LargeEvent(value: Int256, str: String, list: [UInt256], dic: {String: String})
+
+    access(all) fun EventHeavy(_ n: Int) {
+        var s: Int256 = 1024102410241024
+        var i = 0
+
+        while i < n {
+            emit LargeEvent(value: s, str: s.toString(), list:[], dic:{s.toString():s.toString()})
+            i = i + 1
+        }
+        log(i)
+    }
+}
diff --git a/integration/benchmark/scripts/eventHeavyTransaction.cdc b/integration/benchmark/scripts/eventHeavyTransaction.cdc
index a78edc4522c..0ab76cac970 100644
--- a/integration/benchmark/scripts/eventHeavyTransaction.cdc
+++ b/integration/benchmark/scripts/eventHeavyTransaction.cdc
@@ -1,8 +1,8 @@
-import MyFavContract from 0x%s
+import EventHeavy from 0x%s
 
 transaction {
   prepare(acct: AuthAccount) {}
   execute {
-    MyFavContract.EventHeavy(220)
+    EventHeavy.EventHeavy(220)
   }
 }
diff --git a/integration/benchmark/scripts/ledgerHeavyContract.cdc b/integration/benchmark/scripts/ledgerHeavyContract.cdc
new file mode 100644
index 00000000000..353547924c7
--- /dev/null
+++ b/integration/benchmark/scripts/ledgerHeavyContract.cdc
@@ -0,0 +1,48 @@
+access(all) contract LedgerHeavy {
+    access(all) fun LedgerInteractionHeavy(_ n: Int) {
+        LedgerHeavy.AddManyRandomItems(n)
+    }
+
+    access(self) var items: [Item]
+
+    // items
+    access(all) event NewItemAddedEvent(id: UInt32, metadata: {String: String})
+
+    access(self) var itemCounter: UInt32
+
+    access(all) struct Item {
+
+            pub let itemID: UInt32
+
+            pub let metadata: {String: String}
+
+            init(_ metadata: {String: String}) {
+                self.itemID = LedgerHeavy.itemCounter
+                self.metadata = metadata
+
+                // inc the counter
+                LedgerHeavy.itemCounter = LedgerHeavy.itemCounter + UInt32(1)
+
+                // emit event
+                emit NewItemAddedEvent(id: self.itemID, metadata: self.metadata)
+            }
+    }
+
+    access(all) fun AddItem(_ metadata: {String: String}){
+        let item = Item(metadata)
+        self.items.append(item)
+    }
+
+    access(all) fun AddManyRandomItems(_ n: Int){
+        var i = 0
+        while i < n {
+            LedgerHeavy.AddItem({"data": "ABCDEFGHIJKLMNOP"})
+            i = i + 1
+        }
+    }
+
+    init() {
+        self.itemCounter = UInt32(0)
+        self.items = []
+    }
+}
diff --git a/integration/benchmark/scripts/ledgerHeavyTransaction.cdc b/integration/benchmark/scripts/ledgerHeavyTransaction.cdc
index 7fe6698736d..b41389c955a 100644
--- a/integration/benchmark/scripts/ledgerHeavyTransaction.cdc
+++ b/integration/benchmark/scripts/ledgerHeavyTransaction.cdc
@@ -1,8 +1,8 @@
-import MyFavContract from 0x%s
+import LedgerHeavy from 0x%s
 
 transaction {
   prepare(acct: AuthAccount) {}
   execute {
-    MyFavContract.LedgerInteractionHeavy(700)
+    LedgerHeavy.LedgerInteractionHeavy(700)
   }
 }
diff --git a/integration/benchmark/scripts/scripts.go b/integration/benchmark/scripts/scripts.go
new file mode 100644
index 00000000000..d38f6a842b7
--- /dev/null
+++ b/integration/benchmark/scripts/scripts.go
@@ -0,0 +1,70 @@
+package scripts
+
+import (
+	_ "embed"
+	"fmt"
+	"strings"
+
+	"github.com/onflow/cadence"
+
+	flowsdk "github.com/onflow/flow-go-sdk"
+	"github.com/onflow/flow-go/model/flow"
+)
+
+//go:embed addKeysToAccountTransaction.cdc
+var AddKeysToAccountTransaction []byte
+
+//go:embed createAccountsTransaction.cdc
+var createAccountsTransactionTemplate string
+
+func CreateAccountsTransaction(fungibleToken, flowToken flowsdk.Address) []byte {
+	return []byte(fmt.Sprintf(createAccountsTransactionTemplate, fungibleToken, flowToken))
+}
+
+//go:embed compHeavyTransaction.cdc
+var ComputationHeavyScriptTemplate string
+
+//go:embed compHeavyContract.cdc
+var ComputationHeavyContractTemplate string
+
+//go:embed eventHeavyTransaction.cdc
+var EventHeavyScriptTemplate string
+
+//go:embed eventHeavyContract.cdc
+var EventHeavyContractTemplate string
+
+//go:embed ledgerHeavyTransaction.cdc
+var LedgerHeavyScriptTemplate string
+
+//go:embed ledgerHeavyContract.cdc
+var LedgerHeavyContractTemplate string
+
+//go:embed dataHeavyTransaction.cdc
+var DataHeavyScriptTemplate string
+
+//go:embed dataHeavyContract.cdc
+var DataHeavyContractTemplate string
+
+//go:embed tokenTransferTransaction.cdc
+var tokenTransferTransactionTemplate string
+
+// TokenTransferTransaction returns a transaction script for transferring `amount` flow tokens to `toAddr` address
+func TokenTransferTransaction(ftAddr, flowToken, toAddr flow.Address, amount cadence.UFix64) (*flowsdk.Transaction, error) {
+
+	withFTAddr := strings.Replace(tokenTransferTransactionTemplate, "0xFUNGIBLETOKENADDRESS", "0x"+ftAddr.Hex(), 1)
+	withFlowTokenAddr := strings.Replace(withFTAddr, "0xTOKENADDRESS", "0x"+flowToken.Hex(), 1)
+
+	tx := flowsdk.NewTransaction().
+		SetScript([]byte(withFlowTokenAddr))
+
+	err := tx.AddArgument(amount)
+	if err != nil {
+		return nil, err
+	}
+	err = tx.AddArgument(cadence.BytesToAddress(toAddr.Bytes()))
+	if err != nil {
+		return nil, err
+	}
+
+	return tx, nil
+}
diff --git a/integration/benchmark/server/bench.sh b/integration/benchmark/server/bench.sh
index 8c87214a3b1..161549aba0f 100755
--- a/integration/benchmark/server/bench.sh
+++ b/integration/benchmark/server/bench.sh
@@ -7,14 +7,17 @@ set -o pipefail
 # this will keep the TPS automation code separate from the code that's being tested so we won't run into issues
 # of having old versions of automation code just because we happen to be testing an older version flow-go
 git clone https://github.com/onflow/flow-go.git
-cd flow-go/integration/localnet
+cd flow-go/integration/localnet || exit
 
 git fetch
 git fetch --tags
 
-while read -r branch_hash; do
-    hash="${branch_hash##*:}"
-    branch="${branch_hash%%:*}"
+while read -r input; do
+
+    remainder="$input"
+    branch="${remainder%%:*}"; remainder="${remainder#*:}"
+    hash="${remainder%%:*}"; remainder="${remainder#*:}"
+    load="${remainder%%:*}"; remainder="${remainder#*:}"
 
     git checkout "$branch" || continue
     git reset --hard "$hash"  || continue
@@ -34,7 +37,7 @@ while read -r branch_hash; do
 
     # sleep is workaround for slow initialization of some node types, so that benchmark does not quit immediately with "connection refused"
     sleep 30;
-    go run ../benchmark/cmd/ci -log-level debug -git-repo-path ../../ -tps-initial 800 -tps-min 1 -tps-max 1200 -duration 30m
+    go run ../benchmark/cmd/ci -log-level info -git-repo-path ../../ -tps-initial 800 -tps-min 1 -tps-max 1200 -duration 30m -load-type "$load" -load-config "../benchmark/server/load-config.yml"
 
     # instead of running "make stop" which uses docker-compose for a lot of older versions,
     # we explicitly run the command here with "docker compose"
@@ -42,4 +45,5 @@ while read -r branch_hash; do
 
     docker system prune -a -f
     make clean-data
-done </opt/master.recent
+done </opt/commits.recent
+
diff --git a/integration/benchmark/server/control.sh b/integration/benchmark/server/control.sh
index c1efd42ac68..26ecad5a289 100755
--- a/integration/benchmark/server/control.sh
+++ b/integration/benchmark/server/control.sh
@@ -4,15 +4,27 @@
 
 # need to add this, otherwise will get the following error when systemd executes git commands
 # fatal: detected dubious ownership in repository at '/tmp/flow-go'
-git config --system --add safe.directory /opt/flow-go
+# git config --system --add safe.directory /opt/flow-go
 
 git fetch
 
-# /opt/master.recent stores a list of git merge commit hashes of the master branch that will each be tested via benchmarking
+commits_file="/opt/commits.recent"
+# the commits_file stores a list of git merge commit hashes of any branches that will each be tested via benchmarking
+# and the load they will be tested with
 # Sample:
-# master:2735ae8dd46ea4d44131284747db849884126712
-# master:c93a080ee384ee45e4ad9d414129a88829c26a49
-# master:0fc9b0575494258ac3fdcfe00878ee78b2ce0630
-# master:cb8564afbe23cffba03b0a40e2737ebe74e76138
-# master:991b9a692156aa6258505024e4b18cafeac051de
-git log  --merges --first-parent  --format=master:%H origin/master --since '1 week' | sort -R  | tee /opt/master.recent
+# master:2735ae8dd46ea4d44131284747db849884126712:token-transfer
+
+# clear the file
+: > $commits_file
+
+# the load_types array stores the different types of loads that will be run on the commits
+load_types=("token-transfer" "create-account" "ledger-heavy" "evm-transfer")
+
+# get the merge commits from the last week from master ordered by author date
+for commit in $(git log  --merges --first-parent  --format="%S:%H" origin/master --since '1 week' --author-date-order )
+do
+  for load in "${load_types[@]}"
+  do
+    echo "$commit:$load" | tee -a $commits_file
+  done
+done
diff --git a/integration/benchmark/server/load-config.yml b/integration/benchmark/server/load-config.yml
new file mode 100644
index 00000000000..f7c62d31729
--- /dev/null
+++ b/integration/benchmark/server/load-config.yml
@@ -0,0 +1,20 @@
+token-transfer:
+  load_type: token-transfer
+  tps_initial: 800
+  tps_min: 1
+  tps_max: 1200
+create-account:
+  load_type: create-account
+  tps_initial: 600
+  tps_min: 1
+  tps_max: 1200
+ledger-heavy:
+  load_type: ledger-heavy
+  tps_initial: 3
+  tps_min: 1
+  tps_max: 1200
+evm-transfer:
+  load_type: evm-transfer
+  tps_initial: 500
+  tps_min: 1
+  tps_max: 1200
diff --git a/integration/benchmark/worker.go b/integration/benchmark/worker.go
index ad2a42ccc5b..09fe652a006 100644
--- a/integration/benchmark/worker.go
+++ b/integration/benchmark/worker.go
@@ -19,9 +19,13 @@ type Worker struct {
 	wg sync.WaitGroup
 }
 
-func NewWorker(workerID int, interval time.Duration, work workFunc) *Worker {
-	// TODO(rbtz): pass in real context
-	ctx, cancel := context.WithCancel(context.TODO())
+func NewWorker(
+	ctx context.Context,
+	workerID int,
+	interval time.Duration,
+	work workFunc,
+) *Worker {
+	ctx, cancel := context.WithCancel(ctx)
 
 	return &Worker{
 		workerID: workerID,
diff --git a/integration/benchmark/worker_stats_tracker.go b/integration/benchmark/worker_stats_tracker.go
index a568fd7d1b9..cd582a2c2bf 100644
--- a/integration/benchmark/worker_stats_tracker.go
+++ b/integration/benchmark/worker_stats_tracker.go
@@ -83,7 +83,7 @@ func (st *WorkerStatsTracker) Stop() {
 	st.wg.Wait()
 }
 
-func (st *WorkerStatsTracker) IncTxTimedout() {
+func (st *WorkerStatsTracker) IncTxTimedOut() {
 	st.mux.Lock()
 	defer st.mux.Unlock()
 
@@ -125,18 +125,27 @@ func (st *WorkerStatsTracker) GetStats() WorkerStats {
 	return st.stats
 }
 
-func NewPeriodicStatsLogger(st *WorkerStatsTracker, log zerolog.Logger) *Worker {
-	w := NewWorker(0, 1*time.Second, func(workerID int) {
-		stats := st.GetStats()
-		log.Info().
-			Int("Workers", stats.Workers).
-			Int("TxsSent", stats.TxsSent).
-			Int("TxsTimedout", stats.TxsTimedout).
-			Int("TxsExecuted", stats.TxsExecuted).
-			Float64("TxsSentMovingAverage", stats.TxsSentMovingAverage).
-			Float64("TxsExecutedMovingAverage", stats.TxsExecutedMovingAverage).
-			Msg("worker stats")
-	})
+func NewPeriodicStatsLogger(
+	ctx context.Context,
+	st *WorkerStatsTracker,
+	log zerolog.Logger,
+) *Worker {
+	w := NewWorker(
+		ctx,
+		0,
+		3*time.Second,
+		func(workerID int) {
+			stats := st.GetStats()
+			log.Info().
+				Int("Workers", stats.Workers).
+				Int("TxsSent", stats.TxsSent).
+				Int("TxsTimedout", stats.TxsTimedout).
+				Int("TxsExecuted", stats.TxsExecuted).
+				Float64("TxsSentMovingAverage", stats.TxsSentMovingAverage).
+				Float64("TxsExecutedMovingAverage", stats.TxsExecutedMovingAverage).
+				Msg("worker stats")
+		},
+	)
 
 	return w
 }
diff --git a/integration/benchmark/worker_test.go b/integration/benchmark/worker_test.go
index 3fd6a31b844..3a51063970c 100644
--- a/integration/benchmark/worker_test.go
+++ b/integration/benchmark/worker_test.go
@@ -1,6 +1,7 @@
 package benchmark
 
 import (
+	"context"
 	"testing"
 	"time"
 
@@ -15,7 +16,12 @@ func TestWorkerImmediate(t *testing.T) {
 	t.Parallel()
 	t.Run("immediate", func(t *testing.T) {
 		done := make(chan struct{})
-		w := NewWorker(0, time.Hour, func(workerID int) { close(done) })
+		w := NewWorker(
+			context.Background(),
+			0,
+			time.Hour,
+			func(workerID int) { close(done) },
+		)
 		w.Start()
 
 		unittest.AssertClosesBefore(t, done, 5*time.Second)
@@ -30,6 +36,7 @@ func TestWorker(t *testing.T) {
 		i := atomic.NewInt64(0)
 		done := make(chan struct{})
 		w := NewWorker(
+			context.Background(),
 			0,
 			time.Millisecond,
 			func(workerID int) {
@@ -49,11 +56,13 @@ func TestWorker(t *testing.T) {
 func TestWorkerStartStop(t *testing.T) {
 	t.Parallel()
 	t.Run("stop w/o start", func(t *testing.T) {
-		w := NewWorker(0, time.Second, func(workerID int) {})
+		w := NewWorker(
+			context.Background(), 0, time.Second, func(workerID int) {})
 		w.Stop()
 	})
 	t.Run("stop and start", func(t *testing.T) {
-		w := NewWorker(0, time.Second, func(workerID int) {})
+		w := NewWorker(
+			context.Background(), 0, time.Second, func(workerID int) {})
 		w.Start()
 		w.Stop()
 	})
diff --git a/integration/benchnet2/Makefile b/integration/benchnet2/Makefile
index 53473ffa590..028e1d186bc 100644
--- a/integration/benchnet2/Makefile
+++ b/integration/benchnet2/Makefile
@@ -29,15 +29,55 @@ endif
 # assumes there is a checked out version of flow-go in a "flow-go" sub-folder at this level so that the bootstrap executable
 # for the checked out version will be run in the sub folder but the bootstrap folder will be created here (outside of the checked out flow-go in the sub folder)
 gen-bootstrap: clone-flow
-	cd flow-go/cmd/bootstrap && go run . genconfig --address-format "%s%d-${NETWORK_ID}.${NAMESPACE}:3569" --access $(ACCESS) --collection $(COLLECTION) --consensus $(CONSENSUS) --execution $(EXECUTION) --verification $(VERIFICATION) --weight 100 -o ./ --config ../../../bootstrap/conf/node-config.json
-	cd flow-go/cmd/bootstrap && go run . keygen --machine-account --config ../../../bootstrap/conf/node-config.json -o ../../../bootstrap/keys
+	cd flow-go/cmd/bootstrap && go run . genconfig \
+		--address-format "%s%d-${NETWORK_ID}.${NAMESPACE}:3569" \
+		--access $(ACCESS) \
+		--collection $(COLLECTION) \
+		--consensus $(CONSENSUS) \
+		--execution $(EXECUTION) \
+		--verification $(VERIFICATION) \
+		--weight 100 \
+		-o ./ \
+		--config ../../../bootstrap/conf/node-config.json
+	cd flow-go/cmd/bootstrap && go run . keygen \
+		--machine-account \
+		--config ../../../bootstrap/conf/node-config.json \
+		-o ../../../bootstrap/keys
 	echo {} > ./bootstrap/conf/partner-stakes.json
 	mkdir ./bootstrap/partner-nodes
-	cd flow-go/cmd/bootstrap && go run . rootblock  --root-chain bench --root-height 0 --root-parent 0000000000000000000000000000000000000000000000000000000000000000 --config ../../../bootstrap/conf/node-config.json -o ../../../bootstrap/ --partner-dir ../../../bootstrap/partner-nodes --partner-weights ../../../bootstrap/conf/partner-stakes.json --internal-priv-dir ../../../bootstrap/keys/private-root-information
-	cd flow-go/cmd/bootstrap && go run . finalize --root-commit 0000000000000000000000000000000000000000000000000000000000000000 --service-account-public-key-json "{\"PublicKey\":\"R7MTEDdLclRLrj2MI1hcp4ucgRTpR15PCHAWLM5nks6Y3H7+PGkfZTP2di2jbITooWO4DD1yqaBSAVK8iQ6i0A==\",\"SignAlgo\":2,\"HashAlgo\":1,\"SeqNumber\":0,\"Weight\":1000}" --config ../../../bootstrap/conf/node-config.json -o ../../../bootstrap/ --partner-dir ../../../bootstrap/partner-nodes --partner-weights ../../../bootstrap/conf/partner-stakes.json --collection-clusters 1 --epoch-counter 0 --epoch-length 30000 --epoch-staking-phase-length 20000 --epoch-dkg-phase-length 2000 --genesis-token-supply="1000000000.0" --protocol-version=0 --internal-priv-dir ../../../bootstrap/keys/private-root-information --dkg-data ../../../bootstrap/private-root-information/root-dkg-data.priv.json --root-block ../../../bootstrap/public-root-information/root-block.json --root-block-votes-dir ../../../bootstrap/public-root-information/root-block-votes/ --epoch-commit-safety-threshold=1000
+	cd flow-go/cmd/bootstrap && go run . rootblock  \
+		--root-chain bench \
+		--root-height 0 \
+		--root-parent 0000000000000000000000000000000000000000000000000000000000000000 \
+		--epoch-counter 0 \
+		--epoch-length 5000 \
+		--epoch-staking-phase-length 500 \
+		--epoch-dkg-phase-length 1000 \
+		--collection-clusters 1 \
+		--protocol-version=0 \
+		--epoch-commit-safety-threshold=500 \
+		--use-default-epoch-timing \
+		--config ../../../bootstrap/conf/node-config.json \
+		-o ../../../bootstrap/ \
+		--partner-dir ../../../bootstrap/partner-nodes \
+		--partner-weights ../../../bootstrap/conf/partner-stakes.json \
+		--internal-priv-dir ../../../bootstrap/keys/private-root-information
+	cd flow-go/cmd/bootstrap && go run . finalize \
+		--config ../../../bootstrap/conf/node-config.json \
+		-o ../../../bootstrap/  \
+		--partner-dir ../../../bootstrap/partner-nodes \
+		--partner-weights ../../../bootstrap/conf/partner-stakes.json \
+		--internal-priv-dir ../../../bootstrap/keys/private-root-information \
+		--dkg-data ../../../bootstrap/private-root-information/root-dkg-data.priv.json \
+		--root-block ../../../bootstrap/public-root-information/root-block.json \
+		--intermediary-bootstrapping-data ../../../bootstrap/public-root-information/intermediary-bootstrapping-data.json \
+		--root-commit 0000000000000000000000000000000000000000000000000000000000000000 \
+		--genesis-token-supply="1000000000.0" \
+		--service-account-public-key-json "{\"PublicKey\":\"R7MTEDdLclRLrj2MI1hcp4ucgRTpR15PCHAWLM5nks6Y3H7+PGkfZTP2di2jbITooWO4DD1yqaBSAVK8iQ6i0A==\",\"SignAlgo\":2,\"HashAlgo\":1,\"SeqNumber\":0,\"Weight\":1000}" \
+		--root-block-votes-dir ../../../bootstrap/public-root-information/root-block-votes/
 
 gen-helm-l1:
-	go run automate/cmd/level1/bootstrap.go --data bootstrap/public-root-information/root-protocol-state-snapshot.json --dockerTag $(NETWORK_ID) --dockerRegistry $(DOCKER_REGISTRY)
+	go run automate/cmd/level1/bootstrap.go --data bootstrap/public-root-information/root-protocol-state-snapshot.json --dockerTag $(DOCKER_TAG) --dockerRegistry $(DOCKER_REGISTRY)
 
 gen-helm-l2:
 	go run automate/cmd/level2/template.go --data template-data.json --template automate/templates/helm-values-all-nodes.yml --outPath="./values.yml"
diff --git a/integration/benchnet2/automate/level1/bootstrap.go b/integration/benchnet2/automate/level1/bootstrap.go
index bfc5f4466bf..f9e614ecb37 100644
--- a/integration/benchnet2/automate/level1/bootstrap.go
+++ b/integration/benchnet2/automate/level1/bootstrap.go
@@ -44,7 +44,7 @@ func (b *Bootstrap) GenTemplateData(outputToFile bool, dockerTag string, dockerR
 	}
 
 	// examine "Identities" section for list of node data to extract and build out node data list
-	identities := dataMap["Identities"].([]interface{})
+	identities := dataMap["Epochs"].(map[string]any)["Current"].(map[string]any)["InitialIdentities"].([]any)
 	var nodeDataList []NodeData
 
 	for _, identity := range identities {
diff --git a/integration/dkg/dkg_emulator_suite.go b/integration/dkg/dkg_emulator_suite.go
index 8e301c95078..63be1b5dc80 100644
--- a/integration/dkg/dkg_emulator_suite.go
+++ b/integration/dkg/dkg_emulator_suite.go
@@ -64,9 +64,10 @@ func (s *EmulatorSuite) SetupTest() {
 	s.deployDKGContract()
 	s.setupDKGAdmin()
 
-	s.netIDs = unittest.IdentityListFixture(numberOfNodes, unittest.WithRole(flow.RoleConsensus))
-	for _, id := range s.netIDs {
+	boostrapNodesInfo := unittest.PrivateNodeInfosFixture(numberOfNodes, unittest.WithRole(flow.RoleConsensus))
+	for _, id := range boostrapNodesInfo {
 		s.nodeAccounts = append(s.nodeAccounts, s.createAndFundAccount(id))
+		s.netIDs = append(s.netIDs, id.Identity())
 	}
 
 	for _, acc := range s.nodeAccounts {
@@ -88,6 +89,7 @@ func (s *EmulatorSuite) BeforeTest(_, testName string) {
 	}
 	// We need to initialise the nodes with a list of identities that contain
 	// all roles, otherwise there would be an error initialising the first epoch
+
 	identities := unittest.CompleteIdentitySet(s.netIDs...)
 	for _, node := range s.nodes {
 		s.initEngines(node, identities)
@@ -175,7 +177,7 @@ func (s *EmulatorSuite) setupDKGAdmin() {
 }
 
 // createAndFundAccount creates a nodeAccount and funds it in the emulator
-func (s *EmulatorSuite) createAndFundAccount(netID *flow.Identity) *nodeAccount {
+func (s *EmulatorSuite) createAndFundAccount(netID bootstrap.NodeInfo) *nodeAccount {
 	accountPrivateKey := lib.RandomPrivateKey()
 	accountKey := sdk.NewAccountKey().
 		FromPrivateKey(accountPrivateKey).
diff --git a/integration/dkg/dkg_emulator_test.go b/integration/dkg/dkg_emulator_test.go
index cb5b4c36fee..2243e44f9cc 100644
--- a/integration/dkg/dkg_emulator_test.go
+++ b/integration/dkg/dkg_emulator_test.go
@@ -51,7 +51,7 @@ func (s *EmulatorSuite) runTest(goodNodes int, emulatorProblems bool) {
 		DKGPhase2FinalView: 200,
 		DKGPhase3FinalView: 250,
 		FinalView:          300,
-		Participants:       s.netIDs,
+		Participants:       s.netIDs.ToSkeleton(),
 		RandomSource:       unittest.EpochSetupRandomSourceFixture(),
 	}
 
@@ -59,7 +59,7 @@ func (s *EmulatorSuite) runTest(goodNodes int, emulatorProblems bool) {
 	// desired parameters
 	nextEpochSetup := flow.EpochSetup{
 		Counter:      currentCounter + 1,
-		Participants: s.netIDs,
+		Participants: s.netIDs.ToSkeleton(),
 		RandomSource: unittest.EpochSetupRandomSourceFixture(),
 		FirstView:    301,
 		FinalView:    600,
diff --git a/integration/dkg/dkg_whiteboard_test.go b/integration/dkg/dkg_whiteboard_test.go
index 64a05c6fbb7..42cd5f6c32b 100644
--- a/integration/dkg/dkg_whiteboard_test.go
+++ b/integration/dkg/dkg_whiteboard_test.go
@@ -14,6 +14,7 @@ import (
 
 	dkgeng "github.com/onflow/flow-go/engine/consensus/dkg"
 	"github.com/onflow/flow-go/engine/testutil"
+	"github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module"
 	"github.com/onflow/flow-go/module/dkg"
@@ -35,14 +36,19 @@ func createNodes(
 	hub *stub.Hub,
 	chainID flow.ChainID,
 	whiteboard *whiteboard,
-	conIdentities flow.IdentityList,
+	conIdentities []bootstrap.NodeInfo,
 	currentEpochSetup flow.EpochSetup,
 	nextEpochSetup flow.EpochSetup,
-	firstBlock *flow.Header) ([]*node, flow.IdentityList) {
+	firstBlock *flow.Header) []*node {
+
+	identities := make(flow.IdentityList, 0, len(conIdentities))
+	for _, identity := range conIdentities {
+		identities = append(identities, identity.Identity())
+	}
 
 	// We need to initialise the nodes with a list of identities that contain
 	// all roles, otherwise there would be an error initialising the first epoch
-	identities := unittest.CompleteIdentitySet(conIdentities...)
+	identities = unittest.CompleteIdentitySet(identities...)
 
 	nodes := []*node{}
 	for _, id := range conIdentities {
@@ -57,14 +63,14 @@ func createNodes(
 			firstBlock))
 	}
 
-	return nodes, conIdentities
+	return nodes
 }
 
 // createNode instantiates a node with a network hub, a whiteboard reference,
 // and a pre-set EpochSetup that will be used to trigger the next DKG run.
 func createNode(
 	t *testing.T,
-	id *flow.Identity,
+	id bootstrap.NodeInfo,
 	ids []*flow.Identity,
 	hub *stub.Hub,
 	chainID flow.ChainID,
@@ -187,7 +193,11 @@ func TestWithWhiteboard(t *testing.T) {
 
 	// we run the DKG protocol with N consensus nodes
 	N := 10
-	conIdentities := unittest.IdentityListFixture(N, unittest.WithRole(flow.RoleConsensus))
+	bootstrapNodesInfo := unittest.PrivateNodeInfosFixture(N, unittest.WithRole(flow.RoleConsensus))
+	conIdentities := make(flow.IdentitySkeletonList, 0, len(bootstrapNodesInfo))
+	for _, identity := range bootstrapNodesInfo {
+		conIdentities = append(conIdentities, &identity.Identity().IdentitySkeleton)
+	}
 
 	// The EpochSetup event is received at view 100. The phase transitions are
 	// at views 150, 200, and 250. In between phase transitions, the controller
@@ -220,7 +230,7 @@ func TestWithWhiteboard(t *testing.T) {
 		DKGPhase2FinalView: 200,
 		DKGPhase3FinalView: 250,
 		FinalView:          300,
-		Participants:       conIdentities,
+		Participants:       conIdentities.ToSkeleton(),
 		RandomSource:       unittest.EpochSetupRandomSourceFixture(),
 	}
 
@@ -228,16 +238,16 @@ func TestWithWhiteboard(t *testing.T) {
 	// desired parameters
 	nextEpochSetup := flow.EpochSetup{
 		Counter:      currentCounter + 1,
-		Participants: conIdentities,
+		Participants: conIdentities.ToSkeleton(),
 		RandomSource: unittest.EpochSetupRandomSourceFixture(),
 	}
 
-	nodes, _ := createNodes(
+	nodes := createNodes(
 		t,
 		hub,
 		chainID,
 		whiteboard,
-		conIdentities,
+		bootstrapNodesInfo,
 		currentEpochSetup,
 		nextEpochSetup,
 		firstBlock)
diff --git a/integration/dkg/node.go b/integration/dkg/node.go
index acd288e53dd..64887a41d04 100644
--- a/integration/dkg/node.go
+++ b/integration/dkg/node.go
@@ -19,7 +19,7 @@ import (
 )
 
 type nodeAccount struct {
-	netID          *flow.Identity
+	netID          bootstrap.NodeInfo
 	privKey        crypto.PrivateKey
 	accountKey     *sdk.AccountKey
 	accountID      string
@@ -77,7 +77,7 @@ func (n *node) setEpochs(t *testing.T, currentSetup flow.EpochSetup, nextSetup f
 	nextEpoch.On("Counter").Return(nextSetup.Counter, nil)
 	nextEpoch.On("InitialIdentities").Return(nextSetup.Participants, nil)
 	nextEpoch.On("RandomSource").Return(nextSetup.RandomSource, nil)
-	nextEpoch.On("DKG").Return(nil, nil) // no error means didn't run into EECC
+	nextEpoch.On("DKG").Return(nil, nil) // no error means didn't run into EFM
 	nextEpoch.On("FirstView").Return(nextSetup.FirstView, nil)
 	nextEpoch.On("FinalView").Return(nextSetup.FinalView, nil)
 
diff --git a/integration/epochs/cluster_epoch_test.go b/integration/epochs/cluster_epoch_test.go
index 565ef9889ee..c4a629acc48 100644
--- a/integration/epochs/cluster_epoch_test.go
+++ b/integration/epochs/cluster_epoch_test.go
@@ -81,10 +81,10 @@ func (s *Suite) deployEpochQCContract() {
 }
 
 // CreateClusterList creates a clustering with the nodes split evenly and returns the resulting `ClusterList`
-func (s *Suite) CreateClusterList(clusterCount, nodesPerCluster int) (flow.ClusterList, flow.IdentityList) {
+func (s *Suite) CreateClusterList(clusterCount, nodesPerCluster int) (flow.ClusterList, flow.IdentitySkeletonList) {
 
 	// create list of nodes to be used for the clustering
-	nodes := unittest.IdentityListFixture(clusterCount*nodesPerCluster, unittest.WithRole(flow.RoleCollection))
+	nodes := unittest.IdentityListFixture(clusterCount*nodesPerCluster, unittest.WithRole(flow.RoleCollection)).ToSkeleton()
 	// create cluster assignment
 	clusterAssignment := unittest.ClusterAssignment(uint(clusterCount), nodes)
 
@@ -145,7 +145,7 @@ func (s *Suite) StartVoting(clustering flow.ClusterList, clusterCount, nodesPerC
 			cdcNodeID, err := cadence.NewString(node.NodeID.String())
 			require.NoError(s.T(), err)
 			nodeIDs = append(nodeIDs, cdcNodeID)
-			nodeWeights = append(nodeWeights, cadence.NewUInt64(node.Weight))
+			nodeWeights = append(nodeWeights, cadence.NewUInt64(node.InitialWeight))
 		}
 
 		clusterNodeIDs[index] = cadence.NewArray(nodeIDs)
diff --git a/integration/go.mod b/integration/go.mod
index b837825cafd..215e20f7307 100644
--- a/integration/go.mod
+++ b/integration/go.mod
@@ -3,7 +3,7 @@ module github.com/onflow/flow-go/integration
 go 1.20
 
 require (
-	cloud.google.com/go/bigquery v1.56.0
+	cloud.google.com/go/bigquery v1.57.1
 	github.com/VividCortex/ewma v1.2.0
 	github.com/btcsuite/btcd/chaincfg/chainhash v1.0.2
 	github.com/coreos/go-semver v0.3.0
@@ -19,34 +19,37 @@ require (
 	github.com/ipfs/go-datastore v0.6.0
 	github.com/ipfs/go-ds-badger2 v0.1.3
 	github.com/ipfs/go-ipfs-blockstore v1.3.0
-	github.com/onflow/cadence v1.0.0-preview.1.0.20231213191345-0ff20e15e7e1
-	github.com/onflow/crypto v0.25.0
-	github.com/onflow/flow-core-contracts/lib/go/contracts v1.2.4-0.20231016154253-a00dbf7c061f
-	github.com/onflow/flow-core-contracts/lib/go/templates v1.2.4-0.20231016154253-a00dbf7c061f
-	github.com/onflow/flow-emulator v0.58.1-0.20240118140159-d334a0fcd380
-	github.com/onflow/flow-go v0.32.7
-	github.com/onflow/flow-go-sdk v0.44.0
+	github.com/libp2p/go-libp2p v0.32.2
+	github.com/onflow/cadence v0.42.10
+	github.com/onflow/crypto v0.25.1
+	github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1
+	github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1
+	github.com/onflow/flow-emulator v0.61.2-0.20240404201132-f53137a8e4cb
+	github.com/onflow/flow-go v0.33.2-0.20240404171354-0b0592cc5bba
+	github.com/onflow/flow-go-sdk v0.46.0
 	github.com/onflow/flow-go/insecure v0.0.0-00010101000000-000000000000
-	github.com/onflow/flow/protobuf/go/flow v0.3.2-0.20231213135419-ae911cc351a2
+	github.com/onflow/flow/protobuf/go/flow v0.3.7-0.20240404170900-c321c1475f1e
+	github.com/onflow/go-ethereum v1.13.4
 	github.com/plus3it/gorecurcopy v0.0.1
-	github.com/prometheus/client_golang v1.16.0
+	github.com/prometheus/client_golang v1.18.0
 	github.com/prometheus/client_model v0.5.0
-	github.com/prometheus/common v0.42.0
+	github.com/prometheus/common v0.46.0
 	github.com/rs/zerolog v1.29.0
 	github.com/stretchr/testify v1.8.4
 	go.einride.tech/pid v0.1.0
 	go.uber.org/atomic v1.11.0
-	golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc
-	golang.org/x/sync v0.5.0
-	google.golang.org/grpc v1.59.0
-	google.golang.org/protobuf v1.31.0
+	golang.org/x/exp v0.0.0-20240119083558-1b970713d09a
+	golang.org/x/sync v0.6.0
+	google.golang.org/grpc v1.60.1
+	google.golang.org/protobuf v1.32.0
+	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
-	cloud.google.com/go v0.110.8 // indirect
-	cloud.google.com/go/compute v1.23.1 // indirect
+	cloud.google.com/go v0.111.0 // indirect
+	cloud.google.com/go/compute v1.23.3 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	cloud.google.com/go/iam v1.1.3 // indirect
+	cloud.google.com/go/iam v1.1.5 // indirect
 	cloud.google.com/go/storage v1.30.1 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/DataDog/zstd v1.5.2 // indirect
@@ -76,7 +79,7 @@ require (
 	github.com/aws/smithy-go v1.17.0 // indirect
 	github.com/benbjohnson/clock v1.3.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/bits-and-blooms/bitset v1.7.0 // indirect
+	github.com/bits-and-blooms/bitset v1.10.0 // indirect
 	github.com/btcsuite/btcd/btcec/v2 v2.2.1 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
@@ -113,13 +116,13 @@ require (
 	github.com/elastic/gosigar v0.14.2 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/ethereum/c-kzg-4844 v0.4.0 // indirect
-	github.com/ethereum/go-ethereum v1.13.5 // indirect
-	github.com/flynn/noise v1.0.0 // indirect
+	github.com/ethereum/go-ethereum v1.13.10 // indirect
+	github.com/flynn/noise v1.0.1 // indirect
 	github.com/francoispqt/gojay v1.2.13 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.4.1-0.20230228173756-c0c9f774e40c // indirect
 	github.com/fxamacker/circlehash v0.3.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
 	github.com/gammazero/deque v0.1.0 // indirect
 	github.com/gammazero/workerpool v1.1.2 // indirect
 	github.com/getsentry/sentry-go v0.18.0 // indirect
@@ -129,7 +132,7 @@ require (
 	github.com/go-kit/kit v0.12.0 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
-	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
@@ -149,29 +152,29 @@ require (
 	github.com/golang/snappy v0.0.5-0.20220116011046-fa5810519dcb // indirect
 	github.com/google/flatbuffers v2.0.8+incompatible // indirect
 	github.com/google/gopacket v1.1.19 // indirect
-	github.com/google/pprof v0.0.0-20230602150820-91b7bce49751 // indirect
+	github.com/google/pprof v0.0.0-20231229205709-960ae82b1e42 // indirect
 	github.com/google/s2a-go v0.1.7 // indirect
-	github.com/google/uuid v1.4.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/providers/zerolog/v2 v2.0.0-rc.2 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.0-rc.2 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/golang-lru v0.5.5-0.20210104140557-80c98217689d // indirect
-	github.com/hashicorp/golang-lru/v2 v2.0.2 // indirect
+	github.com/hashicorp/golang-lru v1.0.2 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/holiman/bloomfilter/v2 v2.0.3 // indirect
-	github.com/holiman/uint256 v1.2.3 // indirect
+	github.com/holiman/uint256 v1.2.4 // indirect
 	github.com/huin/goupnp v1.3.0 // indirect
 	github.com/imdario/mergo v0.3.13 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
-	github.com/ipfs/boxo v0.10.0 // indirect
-	github.com/ipfs/go-block-format v0.1.2 // indirect
+	github.com/ipfs/boxo v0.17.0 // indirect
+	github.com/ipfs/go-block-format v0.2.0 // indirect
 	github.com/ipfs/go-cidutil v0.1.0 // indirect
 	github.com/ipfs/go-fetcher v1.5.0 // indirect
 	github.com/ipfs/go-ipfs-delay v0.0.1 // indirect
@@ -179,14 +182,14 @@ require (
 	github.com/ipfs/go-ipfs-exchange-interface v0.2.0 // indirect
 	github.com/ipfs/go-ipfs-pq v0.0.3 // indirect
 	github.com/ipfs/go-ipfs-provider v0.7.0 // indirect
-	github.com/ipfs/go-ipfs-util v0.0.2 // indirect
-	github.com/ipfs/go-ipld-format v0.5.0 // indirect
+	github.com/ipfs/go-ipfs-util v0.0.3 // indirect
+	github.com/ipfs/go-ipld-format v0.6.0 // indirect
 	github.com/ipfs/go-log v1.0.5 // indirect
 	github.com/ipfs/go-log/v2 v2.5.1 // indirect
 	github.com/ipfs/go-metrics-interface v0.0.1 // indirect
 	github.com/ipfs/go-peertaskqueue v0.8.1 // indirect
 	github.com/ipfs/go-verifcid v0.0.1 // indirect
-	github.com/ipld/go-ipld-prime v0.20.0 // indirect
+	github.com/ipld/go-ipld-prime v0.21.0 // indirect
 	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jbenet/go-temp-err-catcher v0.1.0 // indirect
@@ -196,8 +199,8 @@ require (
 	github.com/kevinburke/go-bindata v3.24.0+incompatible // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
 	github.com/klauspost/asmfmt v1.3.2 // indirect
-	github.com/klauspost/compress v1.16.5 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.5 // indirect
+	github.com/klauspost/compress v1.17.4 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.6 // indirect
 	github.com/koron/go-ssdp v0.0.4 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
@@ -206,28 +209,27 @@ require (
 	github.com/libp2p/go-buffer-pool v0.1.0 // indirect
 	github.com/libp2p/go-cidranger v1.1.0 // indirect
 	github.com/libp2p/go-flow-metrics v0.1.0 // indirect
-	github.com/libp2p/go-libp2p v0.28.1 // indirect
-	github.com/libp2p/go-libp2p-asn-util v0.3.0 // indirect
+	github.com/libp2p/go-libp2p-asn-util v0.4.1 // indirect
 	github.com/libp2p/go-libp2p-core v0.20.1 // indirect
-	github.com/libp2p/go-libp2p-kad-dht v0.24.2 // indirect
+	github.com/libp2p/go-libp2p-kad-dht v0.25.2 // indirect
 	github.com/libp2p/go-libp2p-kbucket v0.6.3 // indirect
-	github.com/libp2p/go-libp2p-pubsub v0.9.3 // indirect
+	github.com/libp2p/go-libp2p-pubsub v0.10.0 // indirect
 	github.com/libp2p/go-libp2p-record v0.2.0 // indirect
+	github.com/libp2p/go-libp2p-routing-helpers v0.7.3 // indirect
 	github.com/libp2p/go-msgio v0.3.0 // indirect
 	github.com/libp2p/go-nat v0.2.0 // indirect
 	github.com/libp2p/go-netroute v0.2.1 // indirect
-	github.com/libp2p/go-reuseport v0.3.0 // indirect
-	github.com/libp2p/go-yamux/v4 v4.0.0 // indirect
+	github.com/libp2p/go-reuseport v0.4.0 // indirect
+	github.com/libp2p/go-yamux/v4 v4.0.1 // indirect
 	github.com/logrusorgru/aurora v2.0.3+incompatible // indirect
 	github.com/logrusorgru/aurora/v4 v4.0.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/marten-seemann/tcp v0.0.0-20210406111302-dfbc87cc63fd // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.19 // indirect
-	github.com/mattn/go-runewidth v0.0.14 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/miekg/dns v1.1.54 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
+	github.com/miekg/dns v1.1.57 // indirect
 	github.com/mikioh/tcpinfo v0.0.0-20190314235526-30a79bb1804b // indirect
 	github.com/mikioh/tcpopt v0.0.0-20190314235656-172688c1accc // indirect
 	github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8 // indirect
@@ -241,27 +243,25 @@ require (
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/multiformats/go-base32 v0.1.0 // indirect
 	github.com/multiformats/go-base36 v0.2.0 // indirect
-	github.com/multiformats/go-multiaddr v0.9.0 // indirect
+	github.com/multiformats/go-multiaddr v0.12.2 // indirect
 	github.com/multiformats/go-multiaddr-dns v0.3.1 // indirect
 	github.com/multiformats/go-multiaddr-fmt v0.1.0 // indirect
 	github.com/multiformats/go-multibase v0.2.0 // indirect
 	github.com/multiformats/go-multicodec v0.9.0 // indirect
 	github.com/multiformats/go-multihash v0.2.3 // indirect
-	github.com/multiformats/go-multistream v0.4.1 // indirect
+	github.com/multiformats/go-multistream v0.5.0 // indirect
 	github.com/multiformats/go-varint v0.0.7 // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
 	github.com/onflow/atree v0.6.1-0.20230711151834-86040b30171f // indirect
-	github.com/onflow/flow-ft/lib/go/contracts v0.7.1-0.20231212194336-a2802ba36596 // indirect
-	github.com/onflow/flow-go/crypto v0.25.0 // indirect
-	github.com/onflow/flow-nft/lib/go/contracts v1.1.1-0.20231213195450-0b951b342b14 // indirect
-	github.com/onflow/go-bitswap v0.0.0-20230703214630-6d3db958c73d // indirect
+	github.com/onflow/flow-ft/lib/go/contracts v0.7.1-0.20230711213910-baad011d2b13 // indirect
+	github.com/onflow/flow-nft/lib/go/contracts v1.1.0 // indirect
 	github.com/onflow/nft-storefront/lib/go/contracts v0.0.0-20221222181731-14b90207cead // indirect
-	github.com/onflow/sdks v0.5.1-0.20230912225508-b35402f12bba // indirect
-	github.com/onflow/wal v0.0.0-20230529184820-bc9f8244608d // indirect
-	github.com/onsi/ginkgo/v2 v2.9.7 // indirect
+	github.com/onflow/sdks v0.5.0 // indirect
+	github.com/onflow/wal v0.0.0-20240208022732-d756cd497d3b // indirect
+	github.com/onsi/ginkgo/v2 v2.13.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.0.2 // indirect
-	github.com/opencontainers/runtime-spec v1.0.2 // indirect
+	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.6 // indirect
@@ -276,14 +276,13 @@ require (
 	github.com/psiemens/graceland v1.0.0 // indirect
 	github.com/psiemens/sconfig v0.1.0 // indirect
 	github.com/quic-go/qpack v0.4.0 // indirect
-	github.com/quic-go/qtls-go1-19 v0.3.2 // indirect
-	github.com/quic-go/qtls-go1-20 v0.2.2 // indirect
-	github.com/quic-go/quic-go v0.33.0 // indirect
-	github.com/quic-go/webtransport-go v0.5.3 // indirect
+	github.com/quic-go/qtls-go1-20 v0.4.1 // indirect
+	github.com/quic-go/quic-go v0.40.1 // indirect
+	github.com/quic-go/webtransport-go v0.6.0 // indirect
 	github.com/raulk/go-watchdog v1.3.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
-	github.com/rogpeppe/go-internal v1.9.0 // indirect
+	github.com/rogpeppe/go-internal v1.10.0 // indirect
 	github.com/rootless-containers/rootlesskit v1.1.1 // indirect
 	github.com/schollz/progressbar/v3 v3.13.1 // indirect
 	github.com/sergi/go-diff v1.2.0 // indirect
@@ -315,43 +314,42 @@ require (
 	github.com/whyrusleeping/go-keyspace v0.0.0-20160322163242-5b898ac5add1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20230703223453-544e2fe28a26 // indirect
+	github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20240220190333-03695dea34a3 // indirect
 	github.com/yusufpapurcu/wmi v1.2.2 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/otel v1.16.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0 // indirect
-	go.opentelemetry.io/otel/metric v1.16.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.16.0 // indirect
-	go.opentelemetry.io/otel/trace v1.16.0 // indirect
-	go.opentelemetry.io/proto/otlp v0.19.0 // indirect
-	go.uber.org/dig v1.17.0 // indirect
-	go.uber.org/fx v1.19.2 // indirect
+	go.opentelemetry.io/otel v1.22.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.22.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.21.0 // indirect
+	go.opentelemetry.io/otel/trace v1.22.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
+	go.uber.org/dig v1.17.1 // indirect
+	go.uber.org/fx v1.20.1 // indirect
+	go.uber.org/mock v0.4.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.24.0 // indirect
-	golang.org/x/crypto v0.17.0 // indirect
+	go.uber.org/zap v1.26.0 // indirect
+	golang.org/x/crypto v0.18.0 // indirect
 	golang.org/x/mod v0.14.0 // indirect
-	golang.org/x/net v0.19.0 // indirect
-	golang.org/x/oauth2 v0.13.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
-	golang.org/x/term v0.15.0 // indirect
+	golang.org/x/net v0.20.0 // indirect
+	golang.org/x/oauth2 v0.16.0 // indirect
+	golang.org/x/sys v0.16.0 // indirect
+	golang.org/x/term v0.16.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.16.0 // indirect
-	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	gonum.org/v1/gonum v0.13.0 // indirect
+	golang.org/x/tools v0.17.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
+	gonum.org/v1/gonum v0.14.0 // indirect
 	google.golang.org/api v0.151.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto v0.0.0-20240102182953-50ed04b92917 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240108191215-35c7eff3a6b1 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240108191215-35c7eff3a6b1 // indirect
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 	lukechampine.com/blake3 v1.2.1 // indirect
 	modernc.org/libc v1.22.3 // indirect
 	modernc.org/mathutil v1.5.0 // indirect
@@ -363,15 +361,3 @@ require (
 replace github.com/onflow/flow-go => ../
 
 replace github.com/onflow/flow-go/insecure => ../insecure
-
-// the replaces below should not be needed once flow-go and all the repos are updated
-// to use Cadence 1.0
-replace github.com/onflow/cadence => github.com/onflow/cadence v0.42.7
-
-replace github.com/onflow/flow-ft/lib/go/contracts => github.com/onflow/flow-ft/lib/go/contracts v0.7.1-0.20230711213910-baad011d2b13
-
-replace github.com/onflow/flow-nft/lib/go/contracts => github.com/onflow/flow-nft/lib/go/contracts v1.1.0
-
-replace github.com/onflow/sdks => github.com/onflow/sdks v0.5.0
-
-replace github.com/onflow/flow-core-contracts/lib/go/contracts => github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1-0.20231219201108-fbdb10b0a2da
diff --git a/integration/go.sum b/integration/go.sum
index 915266fe312..3cc3f03a335 100644
--- a/integration/go.sum
+++ b/integration/go.sum
@@ -29,27 +29,27 @@ cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aD
 cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
 cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
 cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
-cloud.google.com/go v0.110.8 h1:tyNdfIxjzaWctIiLYOTalaLKZ17SI44SKFW26QbOhME=
-cloud.google.com/go v0.110.8/go.mod h1:Iz8AkXJf1qmxC3Oxoep8R1T36w8B92yU29PcBhHO5fk=
+cloud.google.com/go v0.111.0 h1:YHLKNupSD1KqjDbQ3+LVdQ81h/UJbJyZG203cEfnQgM=
+cloud.google.com/go v0.111.0/go.mod h1:0mibmpKP1TyOOFYQY5izo0LnT+ecvOQ0Sg3OdmMiNRU=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/bigquery v1.56.0 h1:LHIc9E7Kw+ftFpQFKzZYBB88IAFz7qONawXXx0F3QBo=
-cloud.google.com/go/bigquery v1.56.0/go.mod h1:KDcsploXTEY7XT3fDQzMUZlpQLHzE4itubHrnmhUrZA=
-cloud.google.com/go/compute v1.23.1 h1:V97tBoDaZHb6leicZ1G6DLK2BAaZLJ/7+9BB/En3hR0=
-cloud.google.com/go/compute v1.23.1/go.mod h1:CqB3xpmPKKt3OJpW2ndFIXnA9A4xAy/F3Xp1ixncW78=
+cloud.google.com/go/bigquery v1.57.1 h1:FiULdbbzUxWD0Y4ZGPSVCDLvqRSyCIO6zKV7E2nf5uA=
+cloud.google.com/go/bigquery v1.57.1/go.mod h1:iYzC0tGVWt1jqSzBHqCr3lrRn0u13E8e+AqowBsDgug=
+cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
+cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-cloud.google.com/go/datacatalog v1.18.1 h1:xJp9mZrc2HPaoxIz3sP9pCmf/impifweQ/yGG9VBfio=
+cloud.google.com/go/datacatalog v1.19.0 h1:rbYNmHwvAOOwnW2FPXYkaK3Mf1MmGqRzK0mMiIEyLdo=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/iam v1.1.3 h1:18tKG7DzydKWUnLjonWcJO6wjSCAtzh4GcRKlH/Hrzc=
-cloud.google.com/go/iam v1.1.3/go.mod h1:3khUlaBXfPKKe7huYgEpDn6FtgRyMEqbkvBxrQyY5SE=
+cloud.google.com/go/iam v1.1.5 h1:1jTsCu4bcsNsE4iiqNT5SHwrDRCfRmIaaaVFhRveTJI=
+cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXEbzv8=
 cloud.google.com/go/kms v1.0.0/go.mod h1:nhUehi+w7zht2XrUfvTRNpxrfayBHqP4lu2NSywui/0=
-cloud.google.com/go/longrunning v0.5.2 h1:u+oFqfEwwU7F9dIELigxbe0XVnBAo9wqMuQLA50CZ5k=
+cloud.google.com/go/longrunning v0.5.4 h1:w8xEcbZodnA2BbW6sVirkkoC+1gP8wS57EUUgGS0GVg=
 cloud.google.com/go/profiler v0.3.0 h1:R6y/xAeifaUXxd2x6w+jIwKxoKl8Cv5HJvcvASTPWJo=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
@@ -206,9 +206,8 @@ github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+Ce
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bits-and-blooms/bitset v1.5.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
-github.com/bits-and-blooms/bitset v1.7.0 h1:YjAGVd3XmtK9ktAbX8Zg2g2PwLIMjGREZJHlV4j7NEo=
-github.com/bits-and-blooms/bitset v1.7.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
+github.com/bits-and-blooms/bitset v1.10.0 h1:ePXTeiPEazB5+opbv5fr8umg2R/1NlzgDsyepwsSr88=
+github.com/bits-and-blooms/bitset v1.10.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
 github.com/btcsuite/btcd v0.0.0-20171128150713-2e60448ffcc6/go.mod h1:Dmm/EzmjnCiweXmzRIAiUWCInVmPgjkzgv5k4tVyXiQ=
 github.com/btcsuite/btcd v0.0.0-20190213025234-306aecffea32/go.mod h1:DrZx5ec/dmnfpw9KyYoQyYo7d0KEvTkk/5M/vbZjAr8=
@@ -234,8 +233,8 @@ github.com/btcsuite/websocket v0.0.0-20150119174127-31079b680792/go.mod h1:ghJtE
 github.com/btcsuite/winsvc v1.0.0/go.mod h1:jsenWakMcC0zFBFurPLEAyrnc/teJEM1O46fmI40EZs=
 github.com/buger/jsonparser v0.0.0-20181115193947-bf1c66bbce23/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
 github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
-github.com/bytecodealliance/wasmtime-go/v7 v7.0.0/go.mod h1:bu6fic7trDt20w+LMooX7j3fsOwv4/ln6j8gAdP6vmA=
-github.com/c-bata/go-prompt v0.2.6/go.mod h1:/LMAke8wD2FsNu9EXNdHxNLbd9MedkPnCdfpU9wwHfY=
+github.com/bytecodealliance/wasmtime-go v0.22.0/go.mod h1:q320gUxqyI8yB+ZqRuaJOEnGkAnHh6WtJjMaT2CW4wI=
+github.com/c-bata/go-prompt v0.2.5/go.mod h1:vFnjEGDIIA/Lib7giyE4E9c50Lvl8j0S+7FVlAwDAVw=
 github.com/casbin/casbin/v2 v2.1.2/go.mod h1:YcPU1XXisHhLzuxH9coDNf2FbKpjGlbCg3n9yuLkIJQ=
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
@@ -262,11 +261,7 @@ github.com/cloudflare/cloudflare-go v0.10.2-0.20190916151808-a80f83b9add9/go.mod
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
 github.com/cockroachdb/datadriven v1.0.2/go.mod h1:a9RdTaap04u637JoCzcUoIcDmvwSUtcUFtT/C3kJlTU=
 github.com/cockroachdb/datadriven v1.0.3-0.20230413201302-be42291fc80f h1:otljaYPt5hWxV3MUfO5dFPFiOXg9CyG5/kCfayTqsJ4=
@@ -323,15 +318,6 @@ github.com/cskr/pubsub v1.0.2/go.mod h1:/8MzYXk/NJAz782G8RPkFzXTZVu63VotefPnR9TI
 github.com/danieljoos/wincred v1.2.0/go.mod h1:FzQLLMKBFdvu+osBrnFODiv32YGwCfx0SkRa/eYHgec=
 github.com/dapperlabs/testingdock v0.4.5-0.20231020233342-a2853fe18724 h1:zOOpPLu5VvH8ixyoDWHnQHWoEHtryT1ne31vwz0G7Fo=
 github.com/dapperlabs/testingdock v0.4.5-0.20231020233342-a2853fe18724/go.mod h1:U0cEcbf9hAwPSuuoPVqXKhcWV+IU4CStK75cJ52f2/A=
-github.com/dave/astrid v0.0.0-20170323122508-8c2895878b14/go.mod h1:Sth2QfxfATb/nW4EsrSi2KyJmbcniZ8TgTaji17D6ms=
-github.com/dave/brenda v1.1.0/go.mod h1:4wCUr6gSlu5/1Tk7akE5X7UorwiQ8Rij0SKH3/BGMOM=
-github.com/dave/courtney v0.3.0/go.mod h1:BAv3hA06AYfNUjfjQr+5gc6vxeBVOupLqrColj+QSD8=
-github.com/dave/dst v0.27.2/go.mod h1:jHh6EOibnHgcUW3WjKHisiooEkYwqpHLBSX1iOBhEyc=
-github.com/dave/gopackages v0.0.0-20170318123100-46e7023ec56e/go.mod h1:i00+b/gKdIDIxuLDFob7ustLAVqhsZRk2qVZrArELGQ=
-github.com/dave/jennifer v1.5.0/go.mod h1:4MnyiFIlZS3l5tSDn8VnzE6ffAhYBMB2SZntBsZGUok=
-github.com/dave/kerr v0.0.0-20170318121727-bc25dd6abe8e/go.mod h1:qZqlPyPvfsDJt+3wHJ1EvSXDuVjFTK0j2p/ca+gtsb8=
-github.com/dave/patsy v0.0.0-20210517141501-957256f50cba/go.mod h1:qfR88CgEGLoiqDaE+xxDCi5QA5v4vUoW0UCX2Nd5Tlc=
-github.com/dave/rebecca v0.9.1/go.mod h1:N6XYdMD/OKw3lkF3ywh8Z6wPGuwNFDNtWYEMFWEmXBA=
 github.com/davecgh/go-spew v0.0.0-20171005155431-ecdeabc65495/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -409,14 +395,13 @@ github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5y
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/etcd-io/bbolt v1.3.3/go.mod h1:ZF2nL25h33cCyBtcyWeZ2/I3HQOfTP+0PIEvHjkjCrw=
 github.com/ethereum/c-kzg-4844 v0.4.0 h1:3MS1s4JtA868KpJxroZoepdV0ZKBp3u/O5HcZ7R3nlY=
 github.com/ethereum/c-kzg-4844 v0.4.0/go.mod h1:VewdlzQmpT5QSrVhbBuGoCdFJkpaJlO1aQputP83wc0=
 github.com/ethereum/go-ethereum v1.9.9/go.mod h1:a9TqabFudpDu1nucId+k9S8R9whYaHnGBLKFouA5EAo=
-github.com/ethereum/go-ethereum v1.13.5 h1:U6TCRciCqZRe4FPXmy1sMGxTfuk8P7u2UoinF3VbaFk=
-github.com/ethereum/go-ethereum v1.13.5/go.mod h1:yMTu38GSuyxaYzQMViqNmQ1s3cE84abZexQmTgenWk0=
+github.com/ethereum/go-ethereum v1.13.10 h1:Ppdil79nN+Vc+mXfge0AuUgmKWuVv4eMqzoIVSdqZek=
+github.com/ethereum/go-ethereum v1.13.10/go.mod h1:sc48XYQxCzH3fG9BcrXCOOgQk2JfZzNAmIKnceogzsA=
 github.com/fanliao/go-promise v0.0.0-20141029170127-1890db352a72/go.mod h1:PjfxuH4FZdUyfMdtBio2lsRr1AKEaVPwelzuHuh8Lqc=
 github.com/fasthttp-contrib/websocket v0.0.0-20160511215533-1f3b11f56072/go.mod h1:duJ4Jxv5lDcvg4QuQr0oowTf7dz4/CR8NtyCooz9HL8=
 github.com/fatih/color v1.3.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
@@ -425,26 +410,28 @@ github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga
 github.com/fjl/memsize v0.0.0-20180418122429-ca190fb6ffbc/go.mod h1:VvhXpOYNQvB+uIk2RvXzuaQtkQJzzIx6lSBe1xv7hi0=
 github.com/flynn/go-shlex v0.0.0-20150515145356-3f9db97f8568/go.mod h1:xEzjJPgXI435gkrCt3MPfRiAkVrwSbHsst4LCFVfpJc=
 github.com/flynn/noise v0.0.0-20180327030543-2492fe189ae6/go.mod h1:1i71OnUq3iUe1ma7Lr6yG6/rjvM3emb6yoL7xLFzcVQ=
-github.com/flynn/noise v1.0.0 h1:DlTHqmzmvcEiKj+4RYo/imoswx/4r6iBlCMfVtrMXpQ=
 github.com/flynn/noise v1.0.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
+github.com/flynn/noise v1.0.1 h1:vPp/jdQLXC6ppsXSj/pM3W1BIJ5FEHE2TulSJBpb43Y=
+github.com/flynn/noise v1.0.1/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
 github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
 github.com/francoispqt/gojay v1.2.13 h1:d2m3sFjloqoIUQU3TsHBgj6qg/BVGlTBeHDUmyJnXKk=
 github.com/francoispqt/gojay v1.2.13/go.mod h1:ehT5mTG4ua4581f1++1WLG0vPdaA9HaiDsoyrBGkyDY=
 github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
 github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
 github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
-github.com/frankban/quicktest v1.14.4 h1:g2rn0vABPOOXmZUj+vbmUp0lPoXEMuhTpIluN0XL9UY=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
-github.com/fxamacker/cbor/v2 v2.4.1-0.20220515183430-ad2eae63303f/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
+github.com/fxamacker/cbor/v2 v2.2.1-0.20210927235116-3d6d5d1de29b/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
 github.com/fxamacker/cbor/v2 v2.4.1-0.20230228173756-c0c9f774e40c h1:5tm/Wbs9d9r+qZaUFXk59CWDD0+77PBqDREffYkyi5c=
 github.com/fxamacker/cbor/v2 v2.4.1-0.20230228173756-c0c9f774e40c/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo=
+github.com/fxamacker/circlehash v0.1.0/go.mod h1:3aq3OfVvsWtkWMb6A1owjOQFA+TLsD5FgJflnaQwtMM=
 github.com/fxamacker/circlehash v0.3.0 h1:XKdvTtIJV9t7DDUtsf0RIpC1OcxZtPbmgIH7ekx28WA=
 github.com/fxamacker/circlehash v0.3.0/go.mod h1:3aq3OfVvsWtkWMb6A1owjOQFA+TLsD5FgJflnaQwtMM=
-github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
-github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
+github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
+github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
 github.com/gammazero/deque v0.1.0 h1:f9LnNmq66VDeuAlSAapemq/U7hJ2jpIWa4c09q8Dlik=
 github.com/gammazero/deque v0.1.0/go.mod h1:KQw7vFau1hHuM8xmI9RbgKFbAsQFWmBpqQ2KenFLk6M=
 github.com/gammazero/workerpool v1.1.2 h1:vuioDQbgrz4HoaCi2q1HLlOXdpbap5AET7xu5/qj87g=
@@ -490,9 +477,8 @@ github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG
 github.com/go-logfmt/logfmt v0.5.1 h1:otpy5pqBCBZ1ng9RQ0dPu4PN7ba75Y/aA+UpowDyNVA=
 github.com/go-logfmt/logfmt v0.5.1/go.mod h1:WYhtIu8zTZfxdn5+rREduYbwxfcBr/Vr6KEVveWlfTs=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
-github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-martini/martini v0.0.0-20170121215854-22fa46961aab/go.mod h1:/P9AEU963A2AYjv4d1V5eVL1CQbEJq6aCNHDDjibzu8=
@@ -515,6 +501,7 @@ github.com/go-stack/stack v1.8.1 h1:ntEHSVwIt7PNXNpgPmVfMrNhLtgjlmnZha2kOpuRiDw=
 github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4=
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
+github.com/go-test/deep v1.0.5/go.mod h1:QV8Hv/iy04NyLBxAdO9njL0iVPN1S4d/A3NVv1V36o8=
 github.com/go-yaml/yaml v2.1.0+incompatible h1:RYi2hDdss1u4YE7GwixGzWwVo47T8UQwnTLB6vQiq+o=
 github.com/go-yaml/yaml v2.1.0+incompatible/go.mod h1:w2MrLa16VYP0jy6N7M5kHaCkaLENm+P+Tv+MfurjSw0=
 github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
@@ -542,7 +529,6 @@ github.com/gogo/status v1.1.0/go.mod h1:BFv9nrluPLmrS0EmGVvLaPNmRosr9KapBYd5/hpY
 github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
 github.com/golang/glog v1.1.2 h1:DVjP2PbBOzHyzA+dn3WhHIq4NdVu3Q+pvivFICf/7fo=
 github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
 github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -638,8 +624,8 @@ github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLe
 github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
 github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20230602150820-91b7bce49751 h1:hR7/MlvK23p6+lIw9SN1TigNLn9ZnF3W4SYRKq2gAHs=
-github.com/google/pprof v0.0.0-20230602150820-91b7bce49751/go.mod h1:Jh3hGz2jkYak8qXPD19ryItVnUgpgeqzdkY/D0EaeuA=
+github.com/google/pprof v0.0.0-20231229205709-960ae82b1e42 h1:dHLYa5D8/Ta0aLR2XcPsrkpAgGeFs6thhMcQK0oQ0n8=
+github.com/google/pprof v0.0.0-20231229205709-960ae82b1e42/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
 github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
@@ -649,8 +635,8 @@ github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4=
-github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
 github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
 github.com/googleapis/gax-go v2.0.0+incompatible/go.mod h1:SFVmujtThgffbyetf+mdk2eWhX2bMyUtNHzFKcPA9HY=
@@ -692,9 +678,8 @@ github.com/grpc-ecosystem/grpc-gateway v1.5.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpg
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 h1:lLT7ZLSzGLI08vc9cpd+tYmNWjdKDqyr/2L+f6U12Fk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 h1:Wqo399gCIufwto+VfwCSvsnfGpF/w5E9CNxSwbpD6No=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0/go.mod h1:qmOFXW2epJhM0qSnUUYpldc7gVz2KMQwJ/QYCDIa7XU=
 github.com/gxed/hashland/keccakpg v0.0.1/go.mod h1:kRzw3HkwxFU1mpmPP8v1WyQzwdGfmKFJ6tItnhQ67kU=
 github.com/gxed/hashland/murmur3 v0.0.1/go.mod h1:KjXop02n4/ckmZSnY2+HKcLud/tcmvhST0bie/0lS48=
 github.com/hashicorp/consul/api v1.3.0/go.mod h1:MmDNSzIMUjNpY/mQ398R4bk2FnqQLoPndWW5VkKPlCE=
@@ -719,10 +704,10 @@ github.com/hashicorp/golang-lru v0.0.0-20160813221303-0a025b7e63ad/go.mod h1:/m3
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/hashicorp/golang-lru v0.5.5-0.20210104140557-80c98217689d h1:dg1dEPuWpEqDnvIw251EVy4zlP8gWbsGj4BsUKCRpYs=
-github.com/hashicorp/golang-lru v0.5.5-0.20210104140557-80c98217689d/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/hashicorp/golang-lru/v2 v2.0.2 h1:Dwmkdr5Nc/oBiXgJS3CDHNhJtIHkuZ3DZF5twqnfBdU=
-github.com/hashicorp/golang-lru/v2 v2.0.2/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
+github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
@@ -731,8 +716,8 @@ github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2p
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
 github.com/holiman/bloomfilter/v2 v2.0.3 h1:73e0e/V0tCydx14a0SCYS/EWCxgwLZ18CZcZKVu0fao=
 github.com/holiman/bloomfilter/v2 v2.0.3/go.mod h1:zpoh+gs7qcpqrHr3dB55AMiJwo0iURXE7ZOP9L9hSkA=
-github.com/holiman/uint256 v1.2.3 h1:K8UWO1HUJpRMXBxbmaY1Y8IAMZC/RsKB+ArEnnK4l5o=
-github.com/holiman/uint256 v1.2.3/go.mod h1:SC8Ryt4n+UBbPbIBKaG9zbbDlp4jOru9xFZmPzLUTxw=
+github.com/holiman/uint256 v1.2.4 h1:jUc4Nk8fm9jZabQuqr2JzednajVmBpC+oiTiXZJEApU=
+github.com/holiman/uint256 v1.2.4/go.mod h1:EOMSn4q6Nyt9P6efbI3bueV4e1b3dGlUCXeiRV4ng7E=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/hudl/fargo v1.3.0/go.mod h1:y3CKSmjA+wD2gak7sUSXTAoopbhU08POFhmITJgmKTg=
 github.com/hugelgupf/socketpair v0.0.0-20190730060125-05d35a94e714/go.mod h1:2Goc3h8EklBH5mspfHFxBnEoURQCGzQQH1ga9Myjvis=
@@ -756,8 +741,8 @@ github.com/insomniacslk/dhcp v0.0.0-20230516061539-49801966e6cb/go.mod h1:7474bZ
 github.com/ipfs/bbloom v0.0.1/go.mod h1:oqo8CVWsJFMOZqTglBG4wydCE4IQA/G2/SEofB0rjUI=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
-github.com/ipfs/boxo v0.10.0 h1:tdDAxq8jrsbRkYoF+5Rcqyeb91hgWe2hp7iLu7ORZLY=
-github.com/ipfs/boxo v0.10.0/go.mod h1:Fg+BnfxZ0RPzR0nOodzdIq3A7KgoWAOWsEIImrIQdBM=
+github.com/ipfs/boxo v0.17.0 h1:fVXAb12dNbraCX1Cdid5BB6Kl62gVLNVA+e0EYMqAU0=
+github.com/ipfs/boxo v0.17.0/go.mod h1:pIZgTWdm3k3pLF9Uq6MB8JEcW07UDwNJjlXW1HELW80=
 github.com/ipfs/go-bitswap v0.1.8/go.mod h1:TOWoxllhccevbWFUR2N7B1MTSVVge1s6XSMiCSA4MzM=
 github.com/ipfs/go-bitswap v0.3.4/go.mod h1:4T7fvNv/LmOys+21tnLzGKncMeeXUYUd1nUiJ2teMvI=
 github.com/ipfs/go-bitswap v0.5.0/go.mod h1:WwyyYD33RHCpczgHjpx+xjWYIy8l41K+l5EMy4/ctSM=
@@ -765,8 +750,8 @@ github.com/ipfs/go-bitswap v0.9.0 h1:/dZi/XhUN/aIk78pI4kaZrilUglJ+7/SCmOHWIpiy8E
 github.com/ipfs/go-block-format v0.0.1/go.mod h1:DK/YYcsSUIVAFNwo/KZCdIIbpN0ROH/baNLgayt4pFc=
 github.com/ipfs/go-block-format v0.0.2/go.mod h1:AWR46JfpcObNfg3ok2JHDUfdiHRgWhJgCQF+KIgOPJY=
 github.com/ipfs/go-block-format v0.0.3/go.mod h1:4LmD4ZUw0mhO+JSKdpWwrzATiEfM7WWgQ8H5l6P8MVk=
-github.com/ipfs/go-block-format v0.1.2 h1:GAjkfhVx1f4YTODS6Esrj1wt2HhrtwTnhEr+DyPUaJo=
-github.com/ipfs/go-block-format v0.1.2/go.mod h1:mACVcrxarQKstUU3Yf/RdwbC4DzPV6++rO2a3d+a/KE=
+github.com/ipfs/go-block-format v0.2.0 h1:ZqrkxBA2ICbDRbK8KJs/u0O3dlp6gmAuuXUJNiW1Ycs=
+github.com/ipfs/go-block-format v0.2.0/go.mod h1:+jpL11nFx5A/SPpsoBn6Bzkra/zaArfSmsknbPMYgzM=
 github.com/ipfs/go-blockservice v0.1.4/go.mod h1:OTZhFpkgY48kNzbgyvcexW9cHrpjBYIjSR0KoDOFOLU=
 github.com/ipfs/go-blockservice v0.2.0/go.mod h1:Vzvj2fAnbbyly4+T7D5+p9n3+ZKVHA2bRMMo1QoILtQ=
 github.com/ipfs/go-blockservice v0.4.0 h1:7MUijAW5SqdsqEW/EhnNFRJXVF8mGU5aGhZ3CQaCWbY=
@@ -839,10 +824,11 @@ github.com/ipfs/go-ipfs-routing v0.1.0/go.mod h1:hYoUkJLyAUKhF58tysKpids8RNDPO42
 github.com/ipfs/go-ipfs-routing v0.2.0/go.mod h1:384byD/LHKhAgKE3NmwOjXCpDzhczROMBzidoYV7tfM=
 github.com/ipfs/go-ipfs-routing v0.2.1 h1:E+whHWhJkdN9YeoHZNj5itzc+OR292AJ2uE9FFiW0BY=
 github.com/ipfs/go-ipfs-util v0.0.1/go.mod h1:spsl5z8KUnrve+73pOhSVZND1SIxPW5RyBCNzQxlJBc=
-github.com/ipfs/go-ipfs-util v0.0.2 h1:59Sswnk1MFaiq+VcaknX7aYEyGyGDAA73ilhEK2POp8=
 github.com/ipfs/go-ipfs-util v0.0.2/go.mod h1:CbPtkWJzjLdEcezDns2XYaehFVNXG9zrdrtMecczcsQ=
-github.com/ipfs/go-ipld-format v0.5.0 h1:WyEle9K96MSrvr47zZHKKcDxJ/vlpET6PSiQsAFO+Ds=
-github.com/ipfs/go-ipld-format v0.5.0/go.mod h1:ImdZqJQaEouMjCvqCe0ORUS+uoBmf7Hf+EO/jh+nk3M=
+github.com/ipfs/go-ipfs-util v0.0.3 h1:2RFdGez6bu2ZlZdI+rWfIdbQb1KudQp3VGwPtdNCmE0=
+github.com/ipfs/go-ipfs-util v0.0.3/go.mod h1:LHzG1a0Ig4G+iZ26UUOMjHd+lfM84LZCrn17xAKWBvs=
+github.com/ipfs/go-ipld-format v0.6.0 h1:VEJlA2kQ3LqFSIm5Vu6eIlSxD/Ze90xtc4Meten1F5U=
+github.com/ipfs/go-ipld-format v0.6.0/go.mod h1:g4QVMTn3marU3qXchwjpKPKgJv+zF+OlaKMyhJ4LHPg=
 github.com/ipfs/go-log v0.0.1/go.mod h1:kL1d2/hzSpI0thNYjiKfjanbVNU+IIGA/WnNESY9leM=
 github.com/ipfs/go-log v1.0.2/go.mod h1:1MNjMxe0u6xvJZgeqbJ8vdo2TKaGwZ1a0Bpza+sr2Sk=
 github.com/ipfs/go-log v1.0.3/go.mod h1:OsLySYkwIbiSUR/yBTdv1qPtcE4FW3WPWk/ewz9Ru+A=
@@ -868,8 +854,8 @@ github.com/ipfs/go-peertaskqueue v0.8.1/go.mod h1:Oxxd3eaK279FxeydSPPVGHzbwVeHja
 github.com/ipfs/go-verifcid v0.0.1 h1:m2HI7zIuR5TFyQ1b79Da5N9dnnCP1vcu2QqawmWlK2E=
 github.com/ipfs/go-verifcid v0.0.1/go.mod h1:5Hrva5KBeIog4A+UpqlaIU+DEstipcJYQQZc0g37pY0=
 github.com/ipld/go-ipld-prime v0.11.0/go.mod h1:+WIAkokurHmZ/KwzDOMUuoeJgaRQktHtEaLglS3ZeV8=
-github.com/ipld/go-ipld-prime v0.20.0 h1:Ud3VwE9ClxpO2LkCYP7vWPc0Fo+dYdYzgxUJZ3uRG4g=
-github.com/ipld/go-ipld-prime v0.20.0/go.mod h1:PzqZ/ZR981eKbgdr3y2DJYeD/8bgMawdGVlJDE8kK+M=
+github.com/ipld/go-ipld-prime v0.21.0 h1:n4JmcpOlPDIxBcY037SVfpd1G+Sj1nKZah0m6QH9C2E=
+github.com/ipld/go-ipld-prime v0.21.0/go.mod h1:3RLqy//ERg/y5oShXXdx5YIp50cFGOanyMctpPjsvxQ=
 github.com/iris-contrib/blackfriday v2.0.0+incompatible/go.mod h1:UzZ2bDEoaSGPbkg6SAB4att1aAwTmVIx/5gCVqeyUdI=
 github.com/iris-contrib/go.uuid v2.0.0+incompatible/go.mod h1:iz2lgM/1UnEf1kP0L/+fafWORmlnuysV2EMP8MW+qe0=
 github.com/iris-contrib/jade v1.1.3/go.mod h1:H/geBymxJhShH5kecoiOCSssPX7QWYH7UaeZTSWddIk=
@@ -949,16 +935,15 @@ github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j
 github.com/klauspost/compress v1.8.2/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
 github.com/klauspost/compress v1.9.7/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
 github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
-github.com/klauspost/compress v1.16.5 h1:IFV2oUNUzZaz+XyusxpLzpzS8Pt5rh0Z16For/djlyI=
-github.com/klauspost/compress v1.16.5/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
+github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
 github.com/klauspost/cpuid v1.2.1/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek=
 github.com/klauspost/cpuid/v2 v2.0.4/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.6/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
-github.com/klauspost/cpuid/v2 v2.2.4/go.mod h1:RVVoqg1df56z8g3pUjL/3lE5UfnlrJX8tyFgg4nqhuY=
-github.com/klauspost/cpuid/v2 v2.2.5 h1:0E5MSMDEoAulmXNFquVs//DdoomxaoTY1kUhbc/qbZg=
-github.com/klauspost/cpuid/v2 v2.2.5/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/klauspost/cpuid/v2 v2.2.6 h1:ndNyv040zDGIDh8thGkXYjnFtiN02M1PVVF+JE/48xc=
+github.com/klauspost/cpuid/v2 v2.2.6/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/koron/go-ssdp v0.0.0-20180514024734-4a0ed625a78b/go.mod h1:5Ky9EC2xfoUKUor0Hjgi2BJhCSXJfMOFlmyYrVKGQMk=
@@ -975,7 +960,6 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
@@ -984,7 +968,6 @@ github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+
 github.com/labstack/echo/v4 v4.5.0/go.mod h1:czIriw4a0C1dFun+ObrXp7ok03xON0N1awStJ6ArI7Y=
 github.com/labstack/gommon v0.3.0/go.mod h1:MULnywXg0yavhxWKc+lOruYdAhDwPK9wf0OL7NoOu+k=
 github.com/leanovate/gopter v0.2.9 h1:fQjYxZaynp97ozCzfOyOuAGOU4aU/z37zf/tOujFk7c=
-github.com/leanovate/gopter v0.2.9/go.mod h1:U2L/78B+KVFIx2VmW6onHJQzXtFb+p5y3y2Sh+Jxxv8=
 github.com/leodido/go-urn v1.2.4 h1:XlAE/cm/ms7TE/VMVoduSpNBoyc2dOxHs5MZSwAN63Q=
 github.com/leodido/go-urn v1.2.4/go.mod h1:7ZrI8mTSeBSHl/UaRyKQW1qZeMgak41ANeCNaVckg+4=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
@@ -1015,10 +998,10 @@ github.com/libp2p/go-libp2p v0.7.4/go.mod h1:oXsBlTLF1q7pxr+9w6lqzS1ILpyHsaBPniV
 github.com/libp2p/go-libp2p v0.8.1/go.mod h1:QRNH9pwdbEBpx5DTJYg+qxcVaDMAz3Ee/qDKwXujH5o=
 github.com/libp2p/go-libp2p v0.13.0/go.mod h1:pM0beYdACRfHO1WcJlp65WXyG2A6NqYM+t2DTVAJxMo=
 github.com/libp2p/go-libp2p v0.14.3/go.mod h1:d12V4PdKbpL0T1/gsUNN8DfgMuRPDX8bS2QxCZlwRH0=
-github.com/libp2p/go-libp2p v0.28.1 h1:YurK+ZAI6cKfASLJBVFkpVBdl3wGhFi6fusOt725ii8=
-github.com/libp2p/go-libp2p v0.28.1/go.mod h1:s3Xabc9LSwOcnv9UD4nORnXKTsWkPMkIMB/JIGXVnzk=
-github.com/libp2p/go-libp2p-asn-util v0.3.0 h1:gMDcMyYiZKkocGXDQ5nsUQyquC9+H+iLEQHwOCZ7s8s=
-github.com/libp2p/go-libp2p-asn-util v0.3.0/go.mod h1:B1mcOrKUE35Xq/ASTmQ4tN3LNzVVaMNmq2NACuqyB9w=
+github.com/libp2p/go-libp2p v0.32.2 h1:s8GYN4YJzgUoyeYNPdW7JZeZ5Ee31iNaIBfGYMAY4FQ=
+github.com/libp2p/go-libp2p v0.32.2/go.mod h1:E0LKe+diV/ZVJVnOJby8VC5xzHF0660osg71skcxJvk=
+github.com/libp2p/go-libp2p-asn-util v0.4.1 h1:xqL7++IKD9TBFMgnLPZR6/6iYhawHKHl950SO9L6n94=
+github.com/libp2p/go-libp2p-asn-util v0.4.1/go.mod h1:d/NI6XZ9qxw67b4e+NgpQexCIiFYJjErASrYW4PFDN8=
 github.com/libp2p/go-libp2p-autonat v0.1.0/go.mod h1:1tLf2yXxiE/oKGtDwPYWTSYG3PtvYlJmg7NeVtPRqH8=
 github.com/libp2p/go-libp2p-autonat v0.1.1/go.mod h1:OXqkeGOY2xJVWKAGV2inNF5aKN/djNA3fdpCWloIudE=
 github.com/libp2p/go-libp2p-autonat v0.2.0/go.mod h1:DX+9teU4pEEoZUqR1PiMlqliONQdNbfzE1C718tcViI=
@@ -1062,8 +1045,8 @@ github.com/libp2p/go-libp2p-discovery v0.1.0/go.mod h1:4F/x+aldVHjHDHuX85x1zWoFT
 github.com/libp2p/go-libp2p-discovery v0.2.0/go.mod h1:s4VGaxYMbw4+4+tsoQTqh7wfxg97AEdo4GYBt6BadWg=
 github.com/libp2p/go-libp2p-discovery v0.3.0/go.mod h1:o03drFnz9BVAZdzC/QUQ+NeQOu38Fu7LJGEOK2gQltw=
 github.com/libp2p/go-libp2p-discovery v0.5.0/go.mod h1:+srtPIU9gDaBNu//UHvcdliKBIcr4SfDcm0/PfPJLug=
-github.com/libp2p/go-libp2p-kad-dht v0.24.2 h1:zd7myKBKCmtZBhI3I0zm8xBkb28v3gmSEtQfBdAdFwc=
-github.com/libp2p/go-libp2p-kad-dht v0.24.2/go.mod h1:BShPzRbK6+fN3hk8a0WGAYKpb8m4k+DtchkqouGTrSg=
+github.com/libp2p/go-libp2p-kad-dht v0.25.2 h1:FOIk9gHoe4YRWXTu8SY9Z1d0RILol0TrtApsMDPjAVQ=
+github.com/libp2p/go-libp2p-kad-dht v0.25.2/go.mod h1:6za56ncRHYXX4Nc2vn8z7CZK0P4QiMcrn77acKLM2Oo=
 github.com/libp2p/go-libp2p-kbucket v0.6.3 h1:p507271wWzpy2f1XxPzCQG9NiN6R6lHL9GiSErbQQo0=
 github.com/libp2p/go-libp2p-kbucket v0.6.3/go.mod h1:RCseT7AH6eJWxxk2ol03xtP9pEHetYSPXOaJnOiD8i0=
 github.com/libp2p/go-libp2p-loggables v0.1.0 h1:h3w8QFfCt2UJl/0/NW4K829HX/0S4KD31PQ7m8UXXO8=
@@ -1090,12 +1073,14 @@ github.com/libp2p/go-libp2p-peerstore v0.2.2/go.mod h1:NQxhNjWxf1d4w6PihR8btWIRj
 github.com/libp2p/go-libp2p-peerstore v0.2.6/go.mod h1:ss/TWTgHZTMpsU/oKVVPQCGuDHItOpf2W8RxAi50P2s=
 github.com/libp2p/go-libp2p-peerstore v0.2.7/go.mod h1:ss/TWTgHZTMpsU/oKVVPQCGuDHItOpf2W8RxAi50P2s=
 github.com/libp2p/go-libp2p-pnet v0.2.0/go.mod h1:Qqvq6JH/oMZGwqs3N1Fqhv8NVhrdYcO0BW4wssv21LA=
-github.com/libp2p/go-libp2p-pubsub v0.9.3 h1:ihcz9oIBMaCK9kcx+yHWm3mLAFBMAUsM4ux42aikDxo=
-github.com/libp2p/go-libp2p-pubsub v0.9.3/go.mod h1:RYA7aM9jIic5VV47WXu4GkcRxRhrdElWf8xtyli+Dzc=
+github.com/libp2p/go-libp2p-pubsub v0.10.0 h1:wS0S5FlISavMaAbxyQn3dxMOe2eegMfswM471RuHJwA=
+github.com/libp2p/go-libp2p-pubsub v0.10.0/go.mod h1:1OxbaT/pFRO5h+Dpze8hdHQ63R0ke55XTs6b6NwLLkw=
 github.com/libp2p/go-libp2p-quic-transport v0.10.0/go.mod h1:RfJbZ8IqXIhxBRm5hqUEJqjiiY8xmEuq3HUDS993MkA=
 github.com/libp2p/go-libp2p-record v0.1.0/go.mod h1:ujNc8iuE5dlKWVy6wuL6dd58t0n7xI4hAIl8pE6wu5Q=
 github.com/libp2p/go-libp2p-record v0.2.0 h1:oiNUOCWno2BFuxt3my4i1frNrt7PerzB3queqa1NkQ0=
 github.com/libp2p/go-libp2p-record v0.2.0/go.mod h1:I+3zMkvvg5m2OcSdoL0KPljyJyvNDFGKX7QdlpYUcwk=
+github.com/libp2p/go-libp2p-routing-helpers v0.7.3 h1:u1LGzAMVRK9Nqq5aYDVOiq/HaB93U9WWczBzGyAC5ZY=
+github.com/libp2p/go-libp2p-routing-helpers v0.7.3/go.mod h1:cN4mJAD/7zfPKXBcs9ze31JGYAZgzdABEm+q/hkswb8=
 github.com/libp2p/go-libp2p-secio v0.1.0/go.mod h1:tMJo2w7h3+wN4pgU2LSYeiKPrfqBgkOsdiKK77hE7c8=
 github.com/libp2p/go-libp2p-secio v0.2.0/go.mod h1:2JdZepB8J5V9mBp79BmwsaPQhRPNN2NrnB2lKQcdy6g=
 github.com/libp2p/go-libp2p-secio v0.2.1/go.mod h1:cWtZpILJqkqrSkiYcDBh5lA3wbT2Q+hz3rJQq3iftD8=
@@ -1164,8 +1149,8 @@ github.com/libp2p/go-openssl v0.0.5/go.mod h1:unDrJpgy3oFr+rqXsarWifmJuNnJR4chtO
 github.com/libp2p/go-openssl v0.0.7/go.mod h1:unDrJpgy3oFr+rqXsarWifmJuNnJR4chtO1HmaZjggc=
 github.com/libp2p/go-reuseport v0.0.1/go.mod h1:jn6RmB1ufnQwl0Q1f+YxAj8isJgDCQzaaxIFYDhcYEA=
 github.com/libp2p/go-reuseport v0.0.2/go.mod h1:SPD+5RwGC7rcnzngoYC86GjPzjSywuQyMVAheVBD9nQ=
-github.com/libp2p/go-reuseport v0.3.0 h1:iiZslO5byUYZEg9iCwJGf5h+sf1Agmqx2V2FDjPyvUw=
-github.com/libp2p/go-reuseport v0.3.0/go.mod h1:laea40AimhtfEqysZ71UpYj4S+R9VpH8PgqLo7L+SwI=
+github.com/libp2p/go-reuseport v0.4.0 h1:nR5KU7hD0WxXCJbmw7r2rhRYruNRl2koHw8fQscQm2s=
+github.com/libp2p/go-reuseport v0.4.0/go.mod h1:ZtI03j/wO5hZVDFo2jKywN6bYKWLOy8Se6DrI2E1cLU=
 github.com/libp2p/go-reuseport-transport v0.0.2/go.mod h1:YkbSDrvjUVDL6b8XqriyA20obEtsW9BLkuOUyQAOCbs=
 github.com/libp2p/go-reuseport-transport v0.0.3/go.mod h1:Spv+MPft1exxARzP2Sruj2Wb5JSyHNncjf1Oi2dEbzM=
 github.com/libp2p/go-reuseport-transport v0.0.4/go.mod h1:trPa7r/7TJK/d+0hdBLOCGvpQQVOU74OXbNCIMkufGw=
@@ -1194,10 +1179,11 @@ github.com/libp2p/go-yamux v1.4.0/go.mod h1:fr7aVgmdNGJK+N1g+b6DW6VxzbRCjCOejR/h
 github.com/libp2p/go-yamux v1.4.1/go.mod h1:fr7aVgmdNGJK+N1g+b6DW6VxzbRCjCOejR/hkmpooHE=
 github.com/libp2p/go-yamux/v2 v2.0.0/go.mod h1:NVWira5+sVUIU6tu1JWvaRn1dRnG+cawOJiflsAM+7U=
 github.com/libp2p/go-yamux/v2 v2.2.0/go.mod h1:3So6P6TV6r75R9jiBpiIKgU/66lOarCZjqROGxzPpPQ=
-github.com/libp2p/go-yamux/v4 v4.0.0 h1:+Y80dV2Yx/kv7Y7JKu0LECyVdMXm1VUoko+VQ9rBfZQ=
-github.com/libp2p/go-yamux/v4 v4.0.0/go.mod h1:NWjl8ZTLOGlozrXSOZ/HlfG++39iKNnM5wwmtQP1YB4=
+github.com/libp2p/go-yamux/v4 v4.0.1 h1:FfDR4S1wj6Bw2Pqbc8Uz7pCxeRBPbwsBbEdfwiCypkQ=
+github.com/libp2p/go-yamux/v4 v4.0.1/go.mod h1:NWjl8ZTLOGlozrXSOZ/HlfG++39iKNnM5wwmtQP1YB4=
 github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM=
 github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
+github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
 github.com/logrusorgru/aurora v2.0.3+incompatible h1:tOpm7WcpBTn4fjmVfgpQq0EfczGlG91VSDkswnjF5A8=
 github.com/logrusorgru/aurora v2.0.3+incompatible/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
 github.com/logrusorgru/aurora/v4 v4.0.0 h1:sRjfPpun/63iADiSvGGjgA1cAYegEWMPCJdUpJYn9JA=
@@ -1245,23 +1231,20 @@ github.com/mattn/go-isatty v0.0.13/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Ky
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.18/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
-github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.3/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.6/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-runewidth v0.0.7/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU=
+github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
+github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-tty v0.0.3/go.mod h1:ihxohKRERHTVzN+aSVRwACLCeqIoZAWpoICkkvrWyR0=
-github.com/mattn/go-tty v0.0.4/go.mod h1:u5GGXBtZU6RQoKV8gY5W6UhMudbR5vXnUe7j3pxse28=
 github.com/mattn/goveralls v0.0.2/go.mod h1:8d1ZMHsd7fW6IRPKQh46F2WRpyib5/X4FOpevwGNQEw=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
-github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
 github.com/mdlayher/netlink v0.0.0-20190409211403-11939a169225/go.mod h1:eQB3mZE4aiYnlUsyGGCOpPETfdQq4Jhsgf1fk3cwQaA=
 github.com/mdlayher/netlink v1.0.0/go.mod h1:KxeJAFOFLG6AjpyDkQ/iIhxygIUKD+vcwqcnu43w/+M=
 github.com/mdlayher/netlink v1.1.0/go.mod h1:H4WCitaheIsdF9yOYu8CFmCgQthAPIWZmcKp9uZHgmY=
@@ -1277,8 +1260,8 @@ github.com/miekg/dns v1.1.12/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3N
 github.com/miekg/dns v1.1.28/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
 github.com/miekg/dns v1.1.31/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
-github.com/miekg/dns v1.1.54 h1:5jon9mWcb0sFJGpnI99tOMhCPyJ+RPVz5b63MQG0VWI=
-github.com/miekg/dns v1.1.54/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
+github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM=
+github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk=
 github.com/mikioh/tcp v0.0.0-20190314235350-803a9b46060c h1:bzE/A84HN25pxAuk9Eej1Kz9OUelF97nAc82bDquQI8=
 github.com/mikioh/tcp v0.0.0-20190314235350-803a9b46060c/go.mod h1:0SQS9kMwD2VsyFEB++InYyBJroV/FRmBgcydeSUcJms=
 github.com/mikioh/tcpinfo v0.0.0-20190314235526-30a79bb1804b h1:z78hV3sbSMAUoyUMM0I83AUIT6Hu17AWfgjzIbtrYFc=
@@ -1348,8 +1331,8 @@ github.com/multiformats/go-multiaddr v0.2.2/go.mod h1:NtfXiOtHvghW9KojvtySjH5y0u
 github.com/multiformats/go-multiaddr v0.3.0/go.mod h1:dF9kph9wfJ+3VLAaeBqo9Of8x4fJxp6ggJGteB8HQTI=
 github.com/multiformats/go-multiaddr v0.3.1/go.mod h1:uPbspcUPd5AfaP6ql3ujFY+QWzmBD8uLLL4bXW0XfGc=
 github.com/multiformats/go-multiaddr v0.3.3/go.mod h1:lCKNGP1EQ1eZ35Za2wlqnabm9xQkib3fyB+nZXHLag0=
-github.com/multiformats/go-multiaddr v0.9.0 h1:3h4V1LHIk5w4hJHekMKWALPXErDfz/sggzwC/NcqbDQ=
-github.com/multiformats/go-multiaddr v0.9.0/go.mod h1:mI67Lb1EeTOYb8GQfL/7wpIZwc46ElrvzhYnoJOmTT0=
+github.com/multiformats/go-multiaddr v0.12.2 h1:9G9sTY/wCYajKa9lyfWPmpZAwe6oV+Wb1zcmMS1HG24=
+github.com/multiformats/go-multiaddr v0.12.2/go.mod h1:GKyaTYjZRdcUhyOetrxTk9z0cW+jA/YrnqTOvKgi44M=
 github.com/multiformats/go-multiaddr-dns v0.0.1/go.mod h1:9kWcqw/Pj6FwxAwW38n/9403szc57zJPs45fmnznu3Q=
 github.com/multiformats/go-multiaddr-dns v0.0.2/go.mod h1:9kWcqw/Pj6FwxAwW38n/9403szc57zJPs45fmnznu3Q=
 github.com/multiformats/go-multiaddr-dns v0.2.0/go.mod h1:TJ5pr5bBO7Y1B18djPuRsVkduhQH2YqYSbxWJzYGdK0=
@@ -1387,8 +1370,8 @@ github.com/multiformats/go-multistream v0.1.1/go.mod h1:KmHZ40hzVxiaiwlj3MEbYgK9
 github.com/multiformats/go-multistream v0.2.0/go.mod h1:5GZPQZbkWOLOn3J2y4Y99vVW7vOfsAflxARk3x14o6k=
 github.com/multiformats/go-multistream v0.2.1/go.mod h1:5GZPQZbkWOLOn3J2y4Y99vVW7vOfsAflxARk3x14o6k=
 github.com/multiformats/go-multistream v0.2.2/go.mod h1:UIcnm7Zuo8HKG+HkWgfQsGL+/MIEhyTqbODbIUwSXKs=
-github.com/multiformats/go-multistream v0.4.1 h1:rFy0Iiyn3YT0asivDUIR05leAdwZq3de4741sbiSdfo=
-github.com/multiformats/go-multistream v0.4.1/go.mod h1:Mz5eykRVAjJWckE2U78c6xqdtyNUEhKSM0Lwar2p77Q=
+github.com/multiformats/go-multistream v0.5.0 h1:5htLSLl7lvJk3xx3qT/8Zm9J4K8vEOf/QGkvOGQAyiE=
+github.com/multiformats/go-multistream v0.5.0/go.mod h1:n6tMZiwiP2wUsR8DgfDWw1dydlEqV3l6N3/GBsX6ILA=
 github.com/multiformats/go-varint v0.0.1/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
 github.com/multiformats/go-varint v0.0.2/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
 github.com/multiformats/go-varint v0.0.5/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
@@ -1419,40 +1402,39 @@ github.com/olekukonko/tablewriter v0.0.1/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXW
 github.com/olekukonko/tablewriter v0.0.2-0.20190409134802-7e037d187b0c/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
 github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY=
-github.com/onflow/atree v0.6.0/go.mod h1:gBHU0M05qCbv9NN0kijLWMgC47gHVNBIp4KmsVFi0tc=
+github.com/onflow/atree v0.1.0-beta1.0.20211027184039-559ee654ece9/go.mod h1:+6x071HgCF/0v5hQcaE5qqjc2UqN5gCU8h5Mk6uqpOg=
 github.com/onflow/atree v0.6.1-0.20230711151834-86040b30171f h1:Z8/PgTqOgOg02MTRpTBYO2k16FE6z4wEOtaC2WBR9Xo=
 github.com/onflow/atree v0.6.1-0.20230711151834-86040b30171f/go.mod h1:xvP61FoOs95K7IYdIYRnNcYQGf4nbF/uuJ0tHf4DRuM=
-github.com/onflow/cadence v0.42.7 h1:Qp9VYX901saO7wPwF/rwV4cMS+0mfWxnm9EqbYElYy4=
-github.com/onflow/cadence v0.42.7/go.mod h1:raU8va8QRyTa/eUbhej4mbyW2ETePfSaywoo36MddgE=
-github.com/onflow/crypto v0.25.0 h1:BeWbLsh3ZD13Ej+Uky6kg1PL1ZIVBDVX+2MVBNwqddg=
-github.com/onflow/crypto v0.25.0/go.mod h1:C8FbaX0x8y+FxWjbkHy0Q4EASCDR9bSPWZqlpCLYyVI=
-github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1-0.20231219201108-fbdb10b0a2da h1:8CEioYNnP0rwjnRbKDgs8SmiQTsdaroeX4d/Q3pQuh4=
-github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1-0.20231219201108-fbdb10b0a2da/go.mod h1:WHp24VkUQfcfZi0XjI1uRVRt5alM5SHVkwOil1U2Tpc=
-github.com/onflow/flow-core-contracts/lib/go/templates v1.2.4-0.20231016154253-a00dbf7c061f h1:Ep+Mpo2miWMe4pjPGIaEvEzshRep30dvNgxqk+//FrQ=
-github.com/onflow/flow-core-contracts/lib/go/templates v1.2.4-0.20231016154253-a00dbf7c061f/go.mod h1:ZeLxwaBkzuSInESGjL8/IPZWezF+YOYsYbMrZlhN+q4=
-github.com/onflow/flow-emulator v0.58.1-0.20240118140159-d334a0fcd380 h1:bne/jKVCNEB9IhAT1QoRHzPkcNA06qN+rnIyYlFc3vk=
-github.com/onflow/flow-emulator v0.58.1-0.20240118140159-d334a0fcd380/go.mod h1:YBUnOmciqFV5ADgzY08/YkPyuuIv96hHmSt9tOzm4vg=
+github.com/onflow/cadence v0.20.1/go.mod h1:7mzUvPZUIJztIbr9eTvs+fQjWWHTF8veC+yk4ihcNIA=
+github.com/onflow/cadence v0.42.10 h1:3oC5ceeXhdCrhHcf9H0yYXQKW3Tw/vkSXLe+PUZa4i0=
+github.com/onflow/cadence v0.42.10/go.mod h1:1wFd+LiNiN6qoZXof3MBdpM6d8BsxbVIxOA77LbIYmE=
+github.com/onflow/crypto v0.25.1 h1:0txy2PKPMM873JbpxQNbJmuOJtD56bfs48RQfm0ts5A=
+github.com/onflow/crypto v0.25.1/go.mod h1:C8FbaX0x8y+FxWjbkHy0Q4EASCDR9bSPWZqlpCLYyVI=
+github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1 h1:xF5wHug6H8vKfz7p1LYy9jck6eD9K1HLjTdi6o4kg1k=
+github.com/onflow/flow-core-contracts/lib/go/contracts v0.15.1/go.mod h1:WHp24VkUQfcfZi0XjI1uRVRt5alM5SHVkwOil1U2Tpc=
+github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1 h1:EjWjbyVEA+bMxXbM44dE6MsYeqOu5a9q/EwSWa4ma2M=
+github.com/onflow/flow-core-contracts/lib/go/templates v0.15.1/go.mod h1:c09d6sNyF/j5/pAynK7sNPb1XKqJqk1rxZPEqEL+dUo=
+github.com/onflow/flow-emulator v0.61.2-0.20240404201132-f53137a8e4cb h1:A2R42Vvw+HdAi3DnH2U/AFK4ziOk/wNkVB1lrhEzai8=
+github.com/onflow/flow-emulator v0.61.2-0.20240404201132-f53137a8e4cb/go.mod h1:DicO8yliaj+0AFldfwa5No2FfZRQja1R7/abxSHqqDE=
 github.com/onflow/flow-ft/lib/go/contracts v0.7.1-0.20230711213910-baad011d2b13 h1:B4ll7e3j+MqTJv2122Enq3RtDNzmIGRu9xjV7fo7un0=
 github.com/onflow/flow-ft/lib/go/contracts v0.7.1-0.20230711213910-baad011d2b13/go.mod h1:kTMFIySzEJJeupk+7EmXs0EJ6CBWY/MV9fv9iYQk+RU=
 github.com/onflow/flow-go-sdk v0.24.0/go.mod h1:IoptMLPyFXWvyd9yYA6/4EmSeeozl6nJoIv4FaEMg74=
-github.com/onflow/flow-go-sdk v0.44.0 h1:gVRLcZ6LUNs/5mzHDx0mp4mEnBAWD62O51P4/nYm4rE=
-github.com/onflow/flow-go-sdk v0.44.0/go.mod h1:mm1Fi2hiMrexNMwRzTrAN2zwTvlP8iQ5CF2JSAgJR8U=
+github.com/onflow/flow-go-sdk v0.46.0 h1:mrIQziCDe6Oi5HH/aPFvYluh1XUwO6lYpoXLWrBZc2s=
+github.com/onflow/flow-go-sdk v0.46.0/go.mod h1:azVWF0yHI8wT1erF0vuYGqQZybl6Frbc+0Zu3rIPeHc=
 github.com/onflow/flow-go/crypto v0.21.3/go.mod h1:vI6V4CY3R6c4JKBxdcRiR/AnjBfL8OSD97bJc60cLuQ=
-github.com/onflow/flow-go/crypto v0.25.0 h1:6lmoiAQ3APCF+nV7f4f2AXL3PuDKqQiWqRJXmjrMEq4=
-github.com/onflow/flow-go/crypto v0.25.0/go.mod h1:OOb2vYcS8AOCajBClhHTJ0NKftFl1RQgTQ0+Vh4nbqk=
 github.com/onflow/flow-nft/lib/go/contracts v1.1.0 h1:rhUDeD27jhLwOqQKI/23008CYfnqXErrJvc4EFRP2a0=
 github.com/onflow/flow-nft/lib/go/contracts v1.1.0/go.mod h1:YsvzYng4htDgRB9sa9jxdwoTuuhjK8WYWXTyLkIigZY=
 github.com/onflow/flow/protobuf/go/flow v0.2.2/go.mod h1:gQxYqCfkI8lpnKsmIjwtN2mV/N2PIwc1I+RUK4HPIc8=
-github.com/onflow/flow/protobuf/go/flow v0.3.2-0.20231213135419-ae911cc351a2 h1:+rT+UsfTR39JZO8ht2+4fkaWfHw74SCj1fyz1lWuX8A=
-github.com/onflow/flow/protobuf/go/flow v0.3.2-0.20231213135419-ae911cc351a2/go.mod h1:NA2pX2nw8zuaxfKphhKsk00kWLwfd+tv8mS23YXO4Sk=
-github.com/onflow/go-bitswap v0.0.0-20230703214630-6d3db958c73d h1:QcOAeEyF3iAUHv21LQ12sdcsr0yFrJGoGLyCAzYYtvI=
-github.com/onflow/go-bitswap v0.0.0-20230703214630-6d3db958c73d/go.mod h1:GCPpiyRoHncdqPj++zPr9ZOYBX4hpJ0pYZRYqSE8VKk=
+github.com/onflow/flow/protobuf/go/flow v0.3.7-0.20240404170900-c321c1475f1e h1:r4+gVDDMOOc04Y1qjCZULAdgoaxSMsqSdE1EyviG76U=
+github.com/onflow/flow/protobuf/go/flow v0.3.7-0.20240404170900-c321c1475f1e/go.mod h1:NA2pX2nw8zuaxfKphhKsk00kWLwfd+tv8mS23YXO4Sk=
+github.com/onflow/go-ethereum v1.13.4 h1:iNO86fm8RbBbhZ87ZulblInqCdHnAQVY8okBrNsTevc=
+github.com/onflow/go-ethereum v1.13.4/go.mod h1:cE/gEUkAffhwbVmMJYz+t1dAfVNHNwZCgc3BWtZxBGY=
 github.com/onflow/nft-storefront/lib/go/contracts v0.0.0-20221222181731-14b90207cead h1:2j1Unqs76Z1b95Gu4C3Y28hzNUHBix7wL490e61SMSw=
 github.com/onflow/nft-storefront/lib/go/contracts v0.0.0-20221222181731-14b90207cead/go.mod h1:E3ScfQb5XcWJCIAdtIeEnr5i5l2y60GT0BTXeIHseWg=
 github.com/onflow/sdks v0.5.0 h1:2HCRibwqDaQ1c9oUApnkZtEAhWiNY2GTpRD5+ftdkN8=
 github.com/onflow/sdks v0.5.0/go.mod h1:F0dj0EyHC55kknLkeD10js4mo14yTdMotnWMslPirrU=
-github.com/onflow/wal v0.0.0-20230529184820-bc9f8244608d h1:gAEqYPn3DS83rHIKEpsajnppVD1+zwuYPFyeDVFaQvg=
-github.com/onflow/wal v0.0.0-20230529184820-bc9f8244608d/go.mod h1:iMC8gkLqu4nkbkAla5HkSBb+FGyQOZiWz3DYm2wSXCk=
+github.com/onflow/wal v0.0.0-20240208022732-d756cd497d3b h1:6O/BEmA99PDT5QVjoJgrYlGsWnpxGJTAMmsC+V9gyds=
+github.com/onflow/wal v0.0.0-20240208022732-d756cd497d3b/go.mod h1:iMC8gkLqu4nkbkAla5HkSBb+FGyQOZiWz3DYm2wSXCk=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
@@ -1461,22 +1443,23 @@ github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
-github.com/onsi/ginkgo/v2 v2.9.7 h1:06xGQy5www2oN160RtEZoTvnP2sPhEfePYmCDc2szss=
-github.com/onsi/ginkgo/v2 v2.9.7/go.mod h1:cxrmXWykAwTwhQsJOPfdIDiJ+l2RYq7U8hFU+M/1uw0=
+github.com/onsi/ginkgo/v2 v2.13.2 h1:Bi2gGVkfn6gQcjNjZJVO8Gf0FHzMPf2phUei9tejVMs=
+github.com/onsi/ginkgo/v2 v2.13.2/go.mod h1:XStQ8QcGwLyF4HdfcZB8SFOS/MWCgDuXMSBe6zrvLgM=
 github.com/onsi/gomega v1.4.1/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
-github.com/onsi/gomega v1.27.7 h1:fVih9JD6ogIiHUN6ePK7HJidyEDpWGVB5mzM7cWNXoU=
+github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.0.2 h1:9yCKha/T5XdGtO0q9Q9a6T5NUCsTn/DrBg0D7ufOcFM=
 github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/runtime-spec v1.0.2 h1:UfAcuLBJB9Coz72x1hgl8O5RVzTdNiaglX6v2DM6FI0=
 github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.1.0 h1:HHUyrt9mwHUjtasSbXSMvs4cyFxh+Bll4AjJ9odEGpg=
+github.com/opencontainers/runtime-spec v1.1.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=
 github.com/opentracing/basictracer-go v1.0.0/go.mod h1:QfBfYuafItcjQuMwinw9GhYKwFXS9KnPs5lxoYwgW74=
 github.com/opentracing/opentracing-go v1.0.2/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
@@ -1517,7 +1500,7 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
 github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
-github.com/pkg/term v1.2.0-beta.2/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw=
+github.com/pkg/term v1.1.0/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw=
 github.com/plus3it/gorecurcopy v0.0.1 h1:H7AgvM0N/uIo7o1PQRlewEGQ92BNr7DqbPy5lnR3uJI=
 github.com/plus3it/gorecurcopy v0.0.1/go.mod h1:NvVTm4RX68A1vQbHmHunDO4OtBLVroT6CrsiqAzNyJA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -1537,8 +1520,8 @@ github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQ
 github.com/prometheus/client_golang v1.3.0/go.mod h1:hJaj2vgQTGQmVCsAACORcieXFeDPbaTKGT+JTgUa3og=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
 github.com/prometheus/client_golang v1.10.0/go.mod h1:WJM3cc3yu7XKBKa/I8WeZm+V3eltZnBwfENSU7mdogU=
-github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8=
-github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc=
+github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
+github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -1556,8 +1539,8 @@ github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+
 github.com/prometheus/common v0.7.0/go.mod h1:DjGbpBbp5NYNiECxcL/VnbXCCaQpKd3tt26CguLLsqA=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
 github.com/prometheus/common v0.18.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
-github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM=
-github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc=
+github.com/prometheus/common v0.46.0 h1:doXzt5ybi1HBKpsZOL0sSkaNHJJqkyfEWZGGqqScV0Y=
+github.com/prometheus/common v0.46.0/go.mod h1:Tp0qkxpb9Jsg54QMe+EAmqXkSV7Evdy1BTn+g2pa/hQ=
 github.com/prometheus/procfs v0.0.0-20180725123919-05ee40e3a273/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
@@ -1577,14 +1560,12 @@ github.com/psiemens/sconfig v0.1.0 h1:xfWqW+TRpih7mXZIqKYTmpRhlZLQ1kbxV8EjllPv76
 github.com/psiemens/sconfig v0.1.0/go.mod h1:+MLKqdledP/8G3rOBpknbLh0IclCf4WneJUtS26JB2U=
 github.com/quic-go/qpack v0.4.0 h1:Cr9BXA1sQS2SmDUWjSofMPNKmvF6IiIfDRmgU0w1ZCo=
 github.com/quic-go/qpack v0.4.0/go.mod h1:UZVnYIfi5GRk+zI9UMaCPsmZ2xKJP7XBUvVyT1Knj9A=
-github.com/quic-go/qtls-go1-19 v0.3.2 h1:tFxjCFcTQzK+oMxG6Zcvp4Dq8dx4yD3dDiIiyc86Z5U=
-github.com/quic-go/qtls-go1-19 v0.3.2/go.mod h1:ySOI96ew8lnoKPtSqx2BlI5wCpUVPT05RMAlajtnyOI=
-github.com/quic-go/qtls-go1-20 v0.2.2 h1:WLOPx6OY/hxtTxKV1Zrq20FtXtDEkeY00CGQm8GEa3E=
-github.com/quic-go/qtls-go1-20 v0.2.2/go.mod h1:JKtK6mjbAVcUTN/9jZpvLbGxvdWIKS8uT7EiStoU1SM=
-github.com/quic-go/quic-go v0.33.0 h1:ItNoTDN/Fm/zBlq769lLJc8ECe9gYaW40veHCCco7y0=
-github.com/quic-go/quic-go v0.33.0/go.mod h1:YMuhaAV9/jIu0XclDXwZPAsP/2Kgr5yMYhe9oxhhOFA=
-github.com/quic-go/webtransport-go v0.5.3 h1:5XMlzemqB4qmOlgIus5zB45AcZ2kCgCy2EptUrfOPWU=
-github.com/quic-go/webtransport-go v0.5.3/go.mod h1:OhmmgJIzTTqXK5xvtuX0oBpLV2GkLWNDA+UeTGJXErU=
+github.com/quic-go/qtls-go1-20 v0.4.1 h1:D33340mCNDAIKBqXuAvexTNMUByrYmFYVfKfDN5nfFs=
+github.com/quic-go/qtls-go1-20 v0.4.1/go.mod h1:X9Nh97ZL80Z+bX/gUXMbipO6OxdiDi58b/fMC9mAL+k=
+github.com/quic-go/quic-go v0.40.1 h1:X3AGzUNFs0jVuO3esAGnTfvdgvL4fq655WaOi1snv1Q=
+github.com/quic-go/quic-go v0.40.1/go.mod h1:PeN7kuVJ4xZbxSv/4OX6S1USOX8MJvydwpTx31vx60c=
+github.com/quic-go/webtransport-go v0.6.0 h1:CvNsKqc4W2HljHJnoT+rMmbRJybShZ0YPFDD3NxaZLY=
+github.com/quic-go/webtransport-go v0.6.0/go.mod h1:9KjU4AEBqEQidGHNDkZrb8CAa1abRaosM2yGOyiikEc=
 github.com/raulk/go-watchdog v1.3.0 h1:oUmdlHxdkXRJlwfG0O9omj8ukerm8MEQavSiDTEtBsk=
 github.com/raulk/go-watchdog v1.3.0/go.mod h1:fIvOnLbF0b0ZwkB9YU4mOW9Did//4vPZtDqv66NfsMU=
 github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
@@ -1601,8 +1582,9 @@ github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6L
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.8.1/go.mod h1:JeRgkft04UBgHMgCIwADu4Pn6Mtm5d4nPKWu0nJ5d+o=
-github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/rootless-containers/rootlesskit v1.1.1 h1:F5psKWoWY9/VjZ3ifVcaosjvFZJOagX85U22M0/EQZE=
 github.com/rootless-containers/rootlesskit v1.1.1/go.mod h1:UD5GoA3dqKCJrnvnhVgQQnweMF2qZnf9KLw8EewcMZI=
 github.com/rs/cors v0.0.0-20160617231935-a62a804a8a00/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
@@ -1619,6 +1601,7 @@ github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb
 github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E=
 github.com/schollz/closestmatch v2.1.0+incompatible/go.mod h1:RtP1ddjLong6gTkbtmuhtR2uUrrJOpYzYRvbcPAid+g=
+github.com/schollz/progressbar/v3 v3.8.3/go.mod h1:pWnVCjSBZsT2X3nx9HfRdnCDrpbevliMeoEVhStwHko=
 github.com/schollz/progressbar/v3 v3.13.1 h1:o8rySDYiQ59Mwzy2FELeHY5ZARXZTVJC7iHD6PEFUiE=
 github.com/schollz/progressbar/v3 v3.13.1/go.mod h1:xvrbki8kfT1fzWzBT/UZd9L6GA+jdL7HAgq2RFnO6fQ=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
@@ -1743,7 +1726,6 @@ github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7/go.mod h1:q4W45
 github.com/tarm/serial v0.0.0-20180830185346-98f6abe2eb07/go.mod h1:kDXzergiv9cbyO7IOYJZWg1U88JhDg3PB6klq9Hg2pA=
 github.com/texttheater/golang-levenshtein/levenshtein v0.0.0-20200805054039-cae8b0eaed6c h1:HelZ2kAFadG0La9d+4htN4HzQ68Bm2iM9qKMSMES6xg=
 github.com/texttheater/golang-levenshtein/levenshtein v0.0.0-20200805054039-cae8b0eaed6c/go.mod h1:JlzghshsemAMDGZLytTFY8C1JQxQPhnatWqNwUXjggo=
-github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tklauser/go-sysconf v0.3.9/go.mod h1:11DU/5sG7UexIrp/O6g35hrWzu0JxlwQ3LSFUzyeuhs=
 github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
 github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
@@ -1781,7 +1763,7 @@ github.com/vmihailenco/msgpack/v4 v4.3.12/go.mod h1:gborTTJjAo/GWTqqRjrLCn9pgNN+
 github.com/vmihailenco/tagparser v0.1.1/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
 github.com/vmihailenco/tagparser v0.1.2 h1:gnjoVuB/kljJ5wICEEOpx98oXMWPLj22G67Vbd1qPqc=
 github.com/vmihailenco/tagparser v0.1.2/go.mod h1:OeAg3pn3UbLjkWt+rN9oFYB6u/cQgqMEUPoW2WPyhdI=
-github.com/warpfork/go-testmark v0.11.0 h1:J6LnV8KpceDvo7spaNU4+DauH2n1x+6RaO2rJrmpQ9U=
+github.com/warpfork/go-testmark v0.12.1 h1:rMgCpJfwy1sJ50x0M0NgyphxYYPMOODIJHhsXyEHU0s=
 github.com/warpfork/go-wish v0.0.0-20200122115046-b9ea61034e4a/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0 h1:GDDkbFiaK8jsSDJfjId/PEGEShv6ugrt4kYsC5UIDaQ=
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
@@ -1807,8 +1789,8 @@ github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
 github.com/yalp/jsonpath v0.0.0-20180802001716-5cc68e5049a0/go.mod h1:/LWChgwKmvncFJFHJ7Gvn9wZArjbV5/FppcK2fKk/tI=
-github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20230703223453-544e2fe28a26 h1:C7wI5fYoMlSMEGEVi/PH3Toh9TzpIWlvX9DTLIco52Y=
-github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20230703223453-544e2fe28a26/go.mod h1:bZmV+V29p09ee2aWv/1WCAfHKIwWlwYmNeMspQ2CzJc=
+github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20240220190333-03695dea34a3 h1:GyrwPbleN4FGHa/Ku1aiNKowV4l4FCKRzZfCbvbv5P4=
+github.com/yhassanzadeh13/go-libp2p-pubsub v0.6.11-flow-expose-msg.0.20240220190333-03695dea34a3/go.mod h1:Irbd2TlWD6Bk0i9ggIqd+WPz0Axp8wP9VuNCm2+Ibrg=
 github.com/yudai/gojsondiff v1.0.0/go.mod h1:AY32+k2cwILAkW1fbgxQ5mUmMiZFgLIV+FBNExI05xg=
 github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82/go.mod h1:lgjkn3NuSvDfVJdfcVVdX+jpBxNmX4rDAzaS45IcYoM=
 github.com/yudai/pp v2.0.1+incompatible/go.mod h1:PuxR/8QJ7cyCkFp/aUDS+JY727OFEZkTdatxwunjIkc=
@@ -1817,15 +1799,15 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.2 h1:KBNDSne4vP5mbSWnJbO+51IMOXJB67QiYCSBrubbPRg=
 github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
 github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
-github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
+github.com/zeebo/blake3 v0.2.0/go.mod h1:G9pM4qQwjRzF1/v7+vabMj/c5mWpGZ2Wzo3Eb4z0pb4=
 github.com/zeebo/blake3 v0.2.3 h1:TFoLXsjeXqRNFxSbk35Dk4YtszE/MQQGK10BH4ptoTg=
 github.com/zeebo/blake3 v0.2.3/go.mod h1:mjJjZpnsyIVtVgTOSpJ9vmRE4wgDeyt2HU3qXvvKCaQ=
+github.com/zeebo/pcg v1.0.0/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
 github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
@@ -1848,25 +1830,21 @@ go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
 go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
-go.opentelemetry.io/otel v1.14.0/go.mod h1:o4buv+dJzx8rohcUeRmWUZhqupFvzWis188WlggnNeU=
-go.opentelemetry.io/otel v1.16.0 h1:Z7GVAX/UkAXPKsy94IU+i6thsQS4nb7LviLpnaNeW8s=
-go.opentelemetry.io/otel v1.16.0/go.mod h1:vl0h9NUa1D5s1nv3A5vZOYWn8av4K8Ml6JDeHrT/bx4=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0 h1:t4ZwRPU+emrcvM2e9DHd0Fsf0JTPVcbfa/BhTDF03d0=
-go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.16.0/go.mod h1:vLarbg68dH2Wa77g71zmKQqlQ8+8Rq3GRG31uc0WcWI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0 h1:cbsD4cUcviQGXdw8+bo5x2wazq10SKz8hEbtCRPcU78=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.16.0/go.mod h1:JgXSGah17croqhJfhByOLVY719k1emAXC8MVhCIJlRs=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0 h1:ap+y8RXX3Mu9apKVtOkM6WSFESLM8K3wNQyOU8sWHcc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.14.0/go.mod h1:5w41DY6S9gZrbjuq6Y+753e96WfPha5IcsOSZTtullM=
-go.opentelemetry.io/otel/metric v1.16.0 h1:RbrpwVG1Hfv85LgnZ7+txXioPDoh6EdbZHo26Q3hqOo=
-go.opentelemetry.io/otel/metric v1.16.0/go.mod h1:QE47cpOmkwipPiefDwo2wDzwJrlfxxNYodqc4xnGCo4=
-go.opentelemetry.io/otel/sdk v1.16.0 h1:Z1Ok1YsijYL0CSJpHt4cS3wDDh7p572grzNrBMiMWgE=
-go.opentelemetry.io/otel/sdk v1.16.0/go.mod h1:tMsIuKXuuIWPBAOrH+eHtvhTL+SntFtXF9QD68aP6p4=
-go.opentelemetry.io/otel/trace v1.14.0/go.mod h1:8avnQLK+CG77yNLUae4ea2JDQ6iT+gozhnZjy/rw9G8=
-go.opentelemetry.io/otel/trace v1.16.0 h1:8JRpaObFoW0pxuVPapkgH8UhHQj+bJW8jJsCZEu5MQs=
-go.opentelemetry.io/otel/trace v1.16.0/go.mod h1:Yt9vYq1SdNz3xdjZZK7wcXv1qv2pwLkqr2QVwea0ef0=
+go.opentelemetry.io/otel v1.22.0 h1:xS7Ku+7yTFvDfDraDIJVpw7XPyuHlB9MCiqqX5mcJ6Y=
+go.opentelemetry.io/otel v1.22.0/go.mod h1:eoV4iAi3Ea8LkAEI9+GFT44O6T/D0GWAVFyZVCC6pMI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 h1:tIqheXEFWAZ7O8A7m+J0aPTmpJN3YQ7qetUAdkkkKpk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0/go.mod h1:nUeKExfxAQVbiVFn32YXpXZZHZ61Cc3s3Rn1pDBGAb0=
+go.opentelemetry.io/otel/metric v1.22.0 h1:lypMQnGyJYeuYPhOM/bgjbFM6WE44W1/T45er4d8Hhg=
+go.opentelemetry.io/otel/metric v1.22.0/go.mod h1:evJGjVpZv0mQ5QBRJoBF64yMuOf4xCWdXjK8pzFvliY=
+go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
+go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
+go.opentelemetry.io/otel/trace v1.22.0 h1:Hg6pPujv0XG9QaVbGOBVHunyuLcCC3jN7WEhPx83XD0=
+go.opentelemetry.io/otel/trace v1.22.0/go.mod h1:RbbHXVqKES9QhzZq/fE5UnOSILqRt40a21sPw2He1xo=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v0.19.0 h1:IVN6GR+mhC4s5yfcTbmzHYODqvWAp3ZedA2SJPI1Nnw=
-go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
+go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
+go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
@@ -1874,14 +1852,16 @@ go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
 go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-go.uber.org/dig v1.17.0 h1:5Chju+tUvcC+N7N6EV08BJz41UZuO3BmHcN4A287ZLI=
-go.uber.org/dig v1.17.0/go.mod h1:rTxpf7l5I0eBTlE6/9RL+lDybC7WFwY2QH55ZSjy1mU=
-go.uber.org/fx v1.19.2 h1:SyFgYQFr1Wl0AYstE8vyYIzP4bFz2URrScjwC4cwUvY=
-go.uber.org/fx v1.19.2/go.mod h1:43G1VcqSzbIv77y00p1DRAsyZS8WdzuYdhZXmEUkMyQ=
+go.uber.org/dig v1.17.1 h1:Tga8Lz8PcYNsWsyHMZ1Vm0OQOUaJNDyvPImgbAu9YSc=
+go.uber.org/dig v1.17.1/go.mod h1:Us0rSJiThwCv2GteUN0Q7OKvU7n5J4dxZ9JKUXozFdE=
+go.uber.org/fx v1.20.1 h1:zVwVQGS8zYvhh9Xxcu4w1M6ESyeMzebzj2NbSayZ4Mk=
+go.uber.org/fx v1.20.1/go.mod h1:iSYNbHf2y55acNCwCXKx7LbWb5WG1Bnue5RDXz1OREg=
 go.uber.org/goleak v1.0.0/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
+go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.1.11-0.20210813005559-691160354723/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
-go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
+go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/multierr v1.3.0/go.mod h1:VgVr7evmIr6uPjLBxg28wmKNXyqE9akIJ5XnfpiKl+4=
 go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
@@ -1896,8 +1876,8 @@ go.uber.org/zap v1.14.1/go.mod h1:Mb2vm2krFEG5DV0W9qcHBYFtp/Wku1cvYaqPsS/WYfc=
 go.uber.org/zap v1.15.0/go.mod h1:Mb2vm2krFEG5DV0W9qcHBYFtp/Wku1cvYaqPsS/WYfc=
 go.uber.org/zap v1.16.0/go.mod h1:MA8QOfq0BHJwdXa996Y4dYkAqRKB8/1K1QMMZVaNZjQ=
 go.uber.org/zap v1.19.1/go.mod h1:j3DNczoxDZroyBnOT1L/Q79cfUMGZxlv/9dzN7SM1rI=
-go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
-go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
+go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
+go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
 go4.org v0.0.0-20180809161055-417644f6feb5/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
 golang.org/x/build v0.0.0-20190111050920-041ab4dc3f9d/go.mod h1:OWs+y06UdEOHN4y+MfF/py+xQ/tYqIWW03b70/CG9Rw=
 golang.org/x/crypto v0.0.0-20170930174604-9419663f5a44/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -1932,6 +1912,7 @@ golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm
 golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210506145944-38f3c27a63bf/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
 golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
+golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
@@ -1939,9 +1920,8 @@ golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.0.0-20220826181053-bd7e27e6170d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1955,8 +1935,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc h1:ao2WRsKSzW6KuUY9IWPwWahcHCgR0s52IfwutMfEbdM=
-golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
+golang.org/x/exp v0.0.0-20240119083558-1b970713d09a h1:Q8/wZp0KX97QFTc2ywcOE0YRjZPVIx+MXInMzdvQqcA=
+golang.org/x/exp v0.0.0-20240119083558-1b970713d09a/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
@@ -1984,11 +1964,9 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180719180050-a680a1efc54d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -2052,7 +2030,6 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210423184538-5f58ad60dda6/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211008194852-3b03d305991f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220826154423-83b083e8dc8b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
@@ -2060,10 +2037,9 @@ golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
+golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181017192945-9dcd33a902f4/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181203162652-d668ce993890/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -2081,9 +2057,8 @@ golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ
 golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
 golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.13.0 h1:jDDenyj+WgFtmV3zYVoi8aE2BwtXFLWOA67ZfNWftiY=
-golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
+golang.org/x/oauth2 v0.16.0 h1:aDkGMBSYxElaoP81NpoUoz2oo2R2wHdZpGToUxfyQrQ=
+golang.org/x/oauth2 v0.16.0/go.mod h1:hqZ+0LWXsiVoZpeld6jVt06P3adbS2Uu911W1SsJv2o=
 golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852/go.mod h1:JLpeXjPJfIyPr5TlbXLkXWLhP8nz10XfvxElABhCtcw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -2099,8 +2074,8 @@ golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180810173357-98c5dad5d1a0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -2172,6 +2147,7 @@ golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200918174421-af09f7315aff/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201009025420-dfb3f7c4e634/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201014080544-cc95f250f6bc/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201101102859-da207088b7d1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -2202,17 +2178,16 @@ golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210816074244-15123e1e1f71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210910150752-751e447fb3d0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210917161153-d61c044b1678/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025112917-711f33c9992c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220111092808-5a964db01320/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220622161953-175b2fd9d664/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -2227,10 +2202,11 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.0.0-20220722155259-a9ba230a4035/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -2238,8 +2214,8 @@ golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
+golang.org/x/term v0.16.0 h1:m+B6fahuftsE9qjo0VWp2FW0mB3MTJvR0BaMQrq0pmE=
+golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2249,9 +2225,9 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
@@ -2320,6 +2296,7 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200828161849-5deb26317202/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
 golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
@@ -2333,23 +2310,21 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
-golang.org/x/tools v0.16.0 h1:GO788SKMRunPIBCXiQyo2AaexLstOrVhuAL5YwsckQM=
-golang.org/x/tools v0.16.0/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
+golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
+golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 gonum.org/v1/gonum v0.0.0-20180816165407-929014505bf4/go.mod h1:Y+Yx5eoAFn32cQvJDxZx5Dpnq+c3wtXuadVZAcxbbBo=
 gonum.org/v1/gonum v0.6.1/go.mod h1:9mxDZsDKxgMAuccQkewq682L+0eCu4dCN2yonUJTCLU=
-gonum.org/v1/gonum v0.13.0 h1:a0T3bh+7fhRyqeNbiC3qVHYmkiQgit3wnNan/2c0HMM=
-gonum.org/v1/gonum v0.13.0/go.mod h1:/WPYRckkfWrhWefxyYTfrTtQR0KH4iyHNuzxqXAKyAU=
+gonum.org/v1/gonum v0.14.0 h1:2NiG67LD1tEH0D7kM+ps2V+fXmsAnpUeec7n8tcr4S0=
+gonum.org/v1/gonum v0.14.0/go.mod h1:AoWeoz0becf9QMWtE8iWXNXc27fK4fNeHNf/oMejGfU=
 gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
 gonum.org/v1/plot v0.0.0-20190515093506-e2840ee46a6b/go.mod h1:Wt8AAjI+ypCyYX3nZBvf6cAIx93T+c/OS2HFAYskSZc=
 google.golang.org/api v0.0.0-20180910000450-7ca32eb868bf/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
@@ -2396,8 +2371,9 @@ google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7
 google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
 google.golang.org/genproto v0.0.0-20180518175338-11a468237815/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20180831171423-11092d34479b/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
@@ -2465,14 +2441,13 @@ google.golang.org/genproto v0.0.0-20210917145530-b395a37504d4/go.mod h1:eFjDcFEc
 google.golang.org/genproto v0.0.0-20210921142501-181ce0d877f6/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
 google.golang.org/genproto v0.0.0-20211007155348-82e027067bd4/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b h1:+YaDE2r2OG8t/z5qmsh7Y+XXwCbvadxxZ0YY6mTdrVA=
-google.golang.org/genproto v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:CgAqfJo+Xmu0GwA0411Ht3OU3OntXwsGmrmjI8ioGXI=
-google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b h1:CIC2YMXmIhYw6evmhPxBKJ4fmLbOFtXQN/GV3XOZR8k=
-google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:IBQ646DjkDkvUIsVq/cc03FUFQ9wbZu7yE396YcL870=
+google.golang.org/genproto v0.0.0-20240102182953-50ed04b92917 h1:nz5NESFLZbJGPFxDT/HCn+V1mZ8JGNoY4nUpmW/Y2eg=
+google.golang.org/genproto v0.0.0-20240102182953-50ed04b92917/go.mod h1:pZqR+glSb11aJ+JQcczCvgf47+duRuzNSKqE8YAQnV0=
+google.golang.org/genproto/googleapis/api v0.0.0-20240108191215-35c7eff3a6b1 h1:OPXtXn7fNMaXwO3JvOmF1QyTc00jsSFFz1vXXBOdCDo=
+google.golang.org/genproto/googleapis/api v0.0.0-20240108191215-35c7eff3a6b1/go.mod h1:B5xPO//w8qmBDjGReYLpR6UJPnkldGkCSMoH/2vxJeg=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20231030173426-d783a09b4405 h1:o4S3HvTUEXgRsNSUQsALDVog0O9F/U1JJlHmmUN8Uas=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405 h1:AB/lmRny7e2pLhFEYIbl5qkDAUt2h0ZRO4wGPhZf+ik=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405/go.mod h1:67X1fPuzjcrkymZzZV1vvkFeTn2Rvc6lYF9MYFGCcwE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240108191215-35c7eff3a6b1 h1:gphdwh0npgs8elJ4T6J+DQJHPVF7RsuJHCfwztUb4J4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240108191215-35c7eff3a6b1/go.mod h1:daQN87bsDqDoe316QbbvX60nMoJQa4r6Ds0ZuoAe5yA=
 google.golang.org/grpc v1.12.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.16.0/go.mod h1:0JHn/cJsOMiMfNA9+DeHDlAU7KAAB5GDlYFpa9MZMio=
@@ -2507,9 +2482,8 @@ google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQ
 google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.59.0 h1:Z5Iec2pjwb+LEOqzpB2MR12/eKFhDPhuqW91O+4bwUk=
-google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
+google.golang.org/grpc v1.60.1 h1:26+wFr+cNqSGFcOXcabYC0lUVJVRa2Sb2ortSK7VrEU=
+google.golang.org/grpc v1.60.1/go.mod h1:OlCHIeLYqSSsLi6i49B5QGdzaMZK9+M7LXN2FKz4eGM=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0 h1:TLkBREm4nIsEcexnCjgQd5GQWaHcqMzwQV0TX9pq8S0=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.2.0/go.mod h1:DNq5QpG7LJqD2AamLZ7zvKE0DEpVl2BSEVjFycAAjRY=
@@ -2526,14 +2500,14 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
 google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
+google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
@@ -2551,7 +2525,6 @@ gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce/go.mod h1:5AcXVHN
 gopkg.in/olebedev/go-duktape.v3 v3.0.0-20190213234257-ec84240a7772/go.mod h1:uAJfkITjFhyEEuUfm7bsmCZRbW5WRq8s9EY8HZ6hCns=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
 gopkg.in/sourcemap.v1 v1.0.5/go.mod h1:2RlvNNSMglmRrcvhfuzp4hQHwOtjxlbjX7UPY/GXb78=
-gopkg.in/src-d/go-billy.v4 v4.3.2/go.mod h1:nDjArDMp+XMs1aFAESLRjfGSgfvoYN0hDfzEk0GjC98=
 gopkg.in/src-d/go-cli.v0 v0.0.0-20181105080154-d492247bbc0d/go.mod h1:z+K8VcOYVYcSwSjGebuDL6176A1XskgbtNl64NSg+n8=
 gopkg.in/src-d/go-log.v1 v1.0.1/go.mod h1:GN34hKP0g305ysm2/hctJ0Y8nWP3zxXXJ8GFabTyABE=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
@@ -2589,7 +2562,6 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-lukechampine.com/blake3 v1.1.7/go.mod h1:tkKEOtDkNtklkXtLNEOGNq5tcV90tJiA1vAA12R78LA=
 lukechampine.com/blake3 v1.2.1 h1:YuqqRuaqsGV71BV/nm9xlI0MKUv4QC54jQnBChWbGnI=
 lukechampine.com/blake3 v1.2.1/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1LM6k=
 modernc.org/libc v1.22.3 h1:D/g6O5ftAfavceqlLOFwaZuA5KYafKwmr30A6iSqoyY=
@@ -2600,8 +2572,8 @@ modernc.org/memory v1.5.0 h1:N+/8c5rE6EqugZwHii4IFsaJ7MUhoWX07J5tC/iI5Ds=
 modernc.org/memory v1.5.0/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
 modernc.org/sqlite v1.21.1 h1:GyDFqNnESLOhwwDRaHGdp2jKLDzpyT/rNLglX3ZkMSU=
 modernc.org/sqlite v1.21.1/go.mod h1:XwQ0wZPIh1iKb5mkvCJ3szzbhk+tykC8ZWqTRTgYRwI=
-pgregory.net/rapid v0.4.7 h1:MTNRktPuv5FNqOO151TM9mDTa+XHcX6ypYeISDVD14g=
 pgregory.net/rapid v0.4.7/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
+pgregory.net/rapid v1.1.0 h1:CMa0sjHSru3puNx+J0MIAuiiEV4N0qj8/cMWGBBCsjw=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
diff --git a/integration/localnet/Makefile b/integration/localnet/Makefile
index 34e4a687e77..a98c415ca55 100644
--- a/integration/localnet/Makefile
+++ b/integration/localnet/Makefile
@@ -3,6 +3,7 @@ CONSENSUS = 2
 VALID_CONSENSUS := $(shell test $(CONSENSUS) -ge 2; echo $$?)
 EXECUTION = 2
 VALID_EXECUTION := $(shell test $(EXECUTION) -ge 2; echo $$?)
+TEST_EXECUTION = 0
 VERIFICATION = 1
 ACCESS = 1
 OBSERVER = 0
@@ -59,6 +60,7 @@ else
 		-verification=$(VERIFICATION) \
 		-access=$(ACCESS) \
 		-observer=$(OBSERVER) \
+		-test-execution=$(TEST_EXECUTION) \
 		-nclusters=$(NCLUSTERS) \
 		-epoch-length=$(EPOCHLEN) \
 		-epoch-staking-phase-length=$(STAKINGLEN) \
@@ -79,6 +81,9 @@ endif
 bootstrap-light:
 	$(MAKE) -e COLLECTION=1 CONSENSUS=2 EXECUTION=2 VERIFICATION=1 ACCESS=1 NCLUSTERS=1 bootstrap
 
+bootstrap-test-en:
+	$(MAKE) -e COLLECTION=1 CONSENSUS=2 EXECUTION=2 VERIFICATION=1 ACCESS=1 NCLUSTERS=1 TEST_EXECUTION=1 bootstrap
+
 # CI tests have a larger number of nodes
 .PHONY: bootstrap-ci
 bootstrap-ci:
@@ -125,7 +130,7 @@ stop:
 
 .PHONY: load
 load:
-	go run ../benchmark/cmd/manual -log-level info -tps 1,10,100 -tps-durations 30s,30s
+	go run ../benchmark/cmd/manual -log-level info -tps 1,1,1 -tps-durations 30s,30s
 
 .PHONY: tps-ci-smoke
 tps-ci-smoke:
@@ -138,7 +143,7 @@ tps-ci: bootstrap-ci build-flow start-flow
 .PHONY: clean-data
 clean-data:
 	DOCKER_BUILDKIT=1 docker build -t environment-clean ../../cmd
-	docker run --mount=type=bind,source="$(CURRENT_DIRECTORY)"/data,target=/data environment-clean chmod -R 777 /data
+	docker run --rm --mount=type=bind,source="$(CURRENT_DIRECTORY)"/data,target=/data environment-clean chmod -R 777 /data
 
 	# deletes all generated files and folders from bootstrap and test running
 	rm -rf ./data
diff --git a/integration/localnet/builder/bootstrap.go b/integration/localnet/builder/bootstrap.go
index f505ee0a952..f41b5682b95 100644
--- a/integration/localnet/builder/bootstrap.go
+++ b/integration/localnet/builder/bootstrap.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	crand "crypto/rand"
 	"encoding/json"
 	"errors"
 	"flag"
@@ -22,32 +23,33 @@ import (
 )
 
 const (
-	BootstrapDir             = "./bootstrap"
-	ProfilerDir              = "./profiler"
-	DataDir                  = "./data"
-	TrieDir                  = "./trie"
-	DockerComposeFile        = "./docker-compose.nodes.yml"
-	DockerComposeFileVersion = "3.7"
-	PrometheusTargetsFile    = "./targets.nodes.json"
-	PortMapFile              = "./ports.nodes.json"
-	DefaultObserverRole      = "observer"
-	DefaultLogLevel          = "DEBUG"
-	DefaultGOMAXPROCS        = 8
-	DefaultMaxObservers      = 100
-	DefaultCollectionCount   = 3
-	DefaultConsensusCount    = 3
-	DefaultExecutionCount    = 1
-	DefaultVerificationCount = 1
-	DefaultAccessCount       = 1
-	DefaultObserverCount     = 0
-	DefaultNClusters         = 1
-	DefaultProfiler          = false
-	DefaultProfileUploader   = false
-	DefaultTracing           = true
-	DefaultCadenceTracing    = false
-	DefaultExtensiveTracing  = false
-	DefaultConsensusDelay    = 800 * time.Millisecond
-	DefaultCollectionDelay   = 950 * time.Millisecond
+	BootstrapDir              = "./bootstrap"
+	ProfilerDir               = "./profiler"
+	DataDir                   = "./data"
+	TrieDir                   = "./trie"
+	DockerComposeFile         = "./docker-compose.nodes.yml"
+	DockerComposeFileVersion  = "3.7"
+	PrometheusTargetsFile     = "./targets.nodes.json"
+	PortMapFile               = "./ports.nodes.json"
+	DefaultObserverRole       = "observer"
+	DefaultLogLevel           = "DEBUG"
+	DefaultGOMAXPROCS         = 8
+	DefaultMaxObservers       = 100
+	DefaultCollectionCount    = 3
+	DefaultConsensusCount     = 3
+	DefaultExecutionCount     = 1
+	DefaultVerificationCount  = 1
+	DefaultAccessCount        = 1
+	DefaultObserverCount      = 0
+	DefaultTestExecutionCount = 0
+	DefaultNClusters          = 1
+	DefaultProfiler           = false
+	DefaultProfileUploader    = false
+	DefaultTracing            = true
+	DefaultCadenceTracing     = false
+	DefaultExtensiveTracing   = false
+	DefaultConsensusDelay     = 800 * time.Millisecond
+	DefaultCollectionDelay    = 950 * time.Millisecond
 )
 
 var (
@@ -57,6 +59,7 @@ var (
 	verificationCount          int
 	accessCount                int
 	observerCount              int
+	testExecutionCount         int
 	nClusters                  uint
 	numViewsInStakingPhase     uint64
 	numViewsInDKGPhase         uint64
@@ -81,6 +84,7 @@ func init() {
 	flag.IntVar(&verificationCount, "verification", DefaultVerificationCount, "number of verification nodes")
 	flag.IntVar(&accessCount, "access", DefaultAccessCount, "number of staked access nodes")
 	flag.IntVar(&observerCount, "observer", DefaultObserverCount, "number of observers")
+	flag.IntVar(&testExecutionCount, "test-execution", DefaultTestExecutionCount, "number of test execution")
 	flag.UintVar(&nClusters, "nclusters", DefaultNClusters, "number of collector clusters")
 	flag.Uint64Var(&numViewsEpoch, "epoch-length", 10000, "number of views in epoch")
 	flag.Uint64Var(&numViewsInStakingPhase, "epoch-staking-phase-length", 2000, "number of views in epoch staking phase")
@@ -150,6 +154,7 @@ func main() {
 	}
 
 	dockerServices = prepareObserverServices(dockerServices, flowNodeContainerConfigs)
+	dockerServices = prepareTestExecutionService(dockerServices, flowNodeContainerConfigs)
 
 	err = writeDockerComposeConfig(dockerServices)
 	if err != nil {
@@ -429,7 +434,12 @@ func prepareAccessService(container testnet.ContainerConfig, i int, n int) Servi
 		"--log-tx-time-to-finalized-executed",
 		"--execution-data-sync-enabled=true",
 		"--execution-data-dir=/data/execution-data",
-		fmt.Sprintf("--state-stream-addr=%s:%s", container.ContainerName, testnet.ExecutionStatePort),
+		"--public-network-execution-data-sync-enabled=true",
+		"--execution-data-indexing-enabled=true",
+		"--execution-state-dir=/data/execution-state",
+		"--script-execution-mode=execution-nodes-only",
+		"--event-query-mode=execution-nodes-only",
+		"--tx-result-query-mode=execution-nodes-only",
 	)
 
 	service.AddExposedPorts(
@@ -460,6 +470,12 @@ func prepareObserverService(i int, observerName string, agPublicKey string) Serv
 		fmt.Sprintf("--secure-rpc-addr=%s:%s", observerName, testnet.GRPCSecurePort),
 		fmt.Sprintf("--http-addr=%s:%s", observerName, testnet.GRPCWebPort),
 		fmt.Sprintf("--rest-addr=%s:%s", observerName, testnet.RESTPort),
+		fmt.Sprintf("--state-stream-addr=%s:%s", observerName, testnet.ExecutionStatePort),
+		"--execution-data-dir=/data/execution-data",
+		"--execution-data-sync-enabled=true",
+		"--execution-data-indexing-enabled=true",
+		"--execution-state-dir=/data/execution-state",
+		"--event-query-mode=execution-nodes-only",
 	)
 
 	service.AddExposedPorts(
@@ -467,6 +483,7 @@ func prepareObserverService(i int, observerName string, agPublicKey string) Serv
 		testnet.GRPCSecurePort,
 		testnet.GRPCWebPort,
 		testnet.RESTPort,
+		testnet.ExecutionStatePort,
 	)
 
 	// observer services rely on the access gateway
@@ -644,6 +661,15 @@ func getAccessGatewayPublicKey(flowNodeContainerConfigs []testnet.ContainerConfi
 	return "", fmt.Errorf("Unable to find public key for Access Gateway expected in container '%s'", testnet.PrimaryAN)
 }
 
+func getExecutionNodeConfig(flowNodeContainerConfigs []testnet.ContainerConfig) (testnet.ContainerConfig, error) {
+	for _, container := range flowNodeContainerConfigs {
+		if container.Role == flow.RoleExecution {
+			return container, nil
+		}
+	}
+	return testnet.ContainerConfig{}, fmt.Errorf("Unable to find execution node")
+}
+
 func prepareObserverServices(dockerServices Services, flowNodeContainerConfigs []testnet.ContainerConfig) Services {
 	if observerCount == 0 {
 		return dockerServices
@@ -671,14 +697,62 @@ func prepareObserverServices(dockerServices Services, flowNodeContainerConfigs [
 		dockerServices[observerName] = observerService
 
 		// Generate observer private key (localnet only, not for production)
-		err := testnet.WriteObserverPrivateKey(observerName, BootstrapDir)
+		_, err := testnet.WriteObserverPrivateKey(observerName, BootstrapDir)
 		if err != nil {
 			panic(err)
 		}
 	}
+
 	fmt.Println()
 	fmt.Println("Observer services bootstrapping data generated...")
 	fmt.Printf("Access Gateway (%s) public network libp2p key: %s\n\n", testnet.PrimaryAN, agPublicKey)
 
 	return dockerServices
 }
+
+func prepareTestExecutionService(dockerServices Services, flowNodeContainerConfigs []testnet.ContainerConfig) Services {
+	if testExecutionCount == 0 {
+		return dockerServices
+	}
+
+	agPublicKey, err := getAccessGatewayPublicKey(flowNodeContainerConfigs)
+	if err != nil {
+		panic(err)
+	}
+
+	containerConfig, err := getExecutionNodeConfig(flowNodeContainerConfigs)
+	if err != nil {
+		panic(err)
+	}
+
+	var nodeid flow.Identifier
+	_, _ = crand.Read(nodeid[:])
+	address := "test_execution_1:2137"
+
+	observerName := fmt.Sprintf("%s_%d", "test_execution", 1)
+	// Generate observer private key (localnet only, not for production)
+	nodeinfo, err := testnet.WriteTestExecutionService(nodeid, address, observerName, BootstrapDir)
+	if err != nil {
+		panic(err)
+	}
+
+	containerConfig.NodeInfo = nodeinfo
+	containerConfig.ContainerName = observerName
+	fmt.Println("NodeID: ", containerConfig)
+
+	observerService := prepareExecutionService(containerConfig, 1, 1)
+	observerService.Command = append(observerService.Command,
+		"--observer-mode=true",
+		fmt.Sprintf("--observer-mode-bootstrap-node-addresses=%s:%s", testnet.PrimaryAN, testnet.PublicNetworkPort),
+		fmt.Sprintf("--observer-mode-bootstrap-node-public-keys=%s", agPublicKey),
+	)
+
+	// Add a docker container for this named Observer
+	dockerServices[observerName] = observerService
+
+	fmt.Println()
+	fmt.Println("Test execution services bootstrapping data generated...")
+	fmt.Printf("Access Gateway (%s) public network libp2p key: %s\n\n", testnet.PrimaryAN, agPublicKey)
+
+	return dockerServices
+}
diff --git a/integration/localnet/builder/ports.go b/integration/localnet/builder/ports.go
index 2bea33701fb..995f215e01b 100644
--- a/integration/localnet/builder/ports.go
+++ b/integration/localnet/builder/ports.go
@@ -29,7 +29,7 @@ var config = map[string]*portConfig{
 		portCount: 10,
 	},
 	"observer": {
-		start:     5000, // 5000-6000 => 100 nodes
+		start:     5001, // 5001-6000 => 100 nodes
 		end:       6000,
 		portCount: 10,
 	},
diff --git a/integration/testnet/container.go b/integration/testnet/container.go
index 4fc1f44a7d5..8c61668298f 100644
--- a/integration/testnet/container.go
+++ b/integration/testnet/container.go
@@ -395,7 +395,8 @@ func (c *Container) OpenState() (*state.State, error) {
 	qcs := storage.NewQuorumCertificates(metrics, db, storage.DefaultCacheSize)
 	setups := storage.NewEpochSetups(metrics, db)
 	commits := storage.NewEpochCommits(metrics, db)
-	statuses := storage.NewEpochStatuses(metrics, db)
+	protocolState := storage.NewProtocolState(metrics, setups, commits, db,
+		storage.DefaultProtocolStateCacheSize, storage.DefaultProtocolStateByBlockIDCacheSize)
 	versionBeacons := storage.NewVersionBeacons(db)
 
 	return state.OpenState(
@@ -408,7 +409,7 @@ func (c *Container) OpenState() (*state.State, error) {
 		qcs,
 		setups,
 		commits,
-		statuses,
+		protocolState,
 		versionBeacons,
 	)
 }
diff --git a/integration/testnet/network.go b/integration/testnet/network.go
index 0bd4a215827..ab2b942055a 100644
--- a/integration/testnet/network.go
+++ b/integration/testnet/network.go
@@ -109,6 +109,9 @@ const (
 	// PrimaryAN is the container name for the primary access node to use for API requests
 	PrimaryAN = "access_1"
 
+	// PrimaryON is the container name for the primary observer node to use for API requests
+	PrimaryON = "observer_1"
+
 	DefaultViewsInStakingAuction      uint64 = 5
 	DefaultViewsInDKGPhase            uint64 = 50
 	DefaultViewsInEpoch               uint64 = 200
@@ -180,10 +183,10 @@ func (net *FlowNetwork) Identities() flow.IdentityList {
 }
 
 // ContainersByRole returns all the containers in the network with the specified role
-func (net *FlowNetwork) ContainersByRole(role flow.Role) []*Container {
+func (net *FlowNetwork) ContainersByRole(role flow.Role, ghost bool) []*Container {
 	cl := make([]*Container, 0, len(net.Containers))
 	for _, c := range net.Containers {
-		if c.Config.Role == role {
+		if c.Config.Role == role && c.Config.Ghost == ghost {
 			cl = append(cl, c)
 		}
 	}
@@ -271,7 +274,7 @@ func (net *FlowNetwork) RemoveContainers() {
 
 // DropDBs resets the protocol state database for all containers in the network
 // matching the given filter.
-func (net *FlowNetwork) DropDBs(filter flow.IdentityFilter) {
+func (net *FlowNetwork) DropDBs(filter flow.IdentityFilter[flow.Identity]) {
 	if net == nil || net.suite == nil {
 		return
 	}
@@ -654,10 +657,11 @@ func (net *FlowNetwork) addConsensusFollower(t *testing.T, rootProtocolSnapshotP
 
 	// create a follower-specific directory for the bootstrap files
 	followerBootstrapDir := makeDir(t, tmpdir, DefaultBootstrapDir)
+	makeDir(t, followerBootstrapDir, bootstrap.DirnamePublicBootstrap)
 
-	// strip out the node addresses from root-protocol-state-snapshot.json and copy it to the follower-specific
+	// copy root protocol snapshot to the follower-specific folder
 	// bootstrap/public-root-information directory
-	err := rootProtocolJsonWithoutAddresses(rootProtocolSnapshotPath, filepath.Join(followerBootstrapDir, bootstrap.PathRootProtocolStateSnapshot))
+	err := io.Copy(rootProtocolSnapshotPath, filepath.Join(followerBootstrapDir, bootstrap.PathRootProtocolStateSnapshot))
 	require.NoError(t, err)
 
 	// consensus follower
@@ -726,7 +730,7 @@ func (net *FlowNetwork) addObserver(t *testing.T, conf ObserverConfig) {
 	accessPublicKey := hex.EncodeToString(accessNode.Config.NetworkPubKey().Encode())
 	require.NotEmptyf(t, accessPublicKey, "failed to find the staked conf for access node with container name '%s'", conf.BootstrapAccessName)
 
-	err = WriteObserverPrivateKey(conf.ContainerName, nodeBootstrapDir)
+	_, err = WriteObserverPrivateKey(conf.ContainerName, nodeBootstrapDir)
 	require.NoError(t, err)
 
 	containerOpts := testingdock.ContainerOpts{
@@ -779,6 +783,9 @@ func (net *FlowNetwork) addObserver(t *testing.T, conf ObserverConfig) {
 	nodeContainer.exposePort(RESTPort, testingdock.RandomPort(t))
 	nodeContainer.AddFlag("rest-addr", nodeContainer.ContainerAddr(RESTPort))
 
+	nodeContainer.exposePort(ExecutionStatePort, testingdock.RandomPort(t))
+	nodeContainer.AddFlag("state-stream-addr", nodeContainer.ContainerAddr(ExecutionStatePort))
+
 	nodeContainer.opts.HealthCheck = testingdock.HealthCheckCustom(nodeContainer.HealthcheckCallback())
 
 	suiteContainer := net.suite.Container(containerOpts)
@@ -1044,7 +1051,7 @@ func BootstrapNetwork(networkConf NetworkConfig, bootstrapDir string, chainID fl
 
 	// IMPORTANT: we must use this ordering when writing the DKG keys as
 	//            this ordering defines the DKG participant's indices
-	stakedNodeInfos := bootstrap.Sort(toNodeInfos(stakedConfs), flow.Canonical)
+	stakedNodeInfos := bootstrap.Sort(toNodeInfos(stakedConfs), flow.Canonical[flow.Identity])
 
 	dkg, err := runBeaconKG(stakedConfs)
 	if err != nil {
@@ -1093,25 +1100,7 @@ func BootstrapNetwork(networkConf NetworkConfig, bootstrapDir string, chainID fl
 	participants := bootstrap.ToIdentityList(stakedNodeInfos)
 
 	// generate root block
-	root := run.GenerateRootBlock(chainID, parentID, height, timestamp)
-
-	// generate QC
-	signerData, err := run.GenerateQCParticipantData(consensusNodes, consensusNodes, dkg)
-	if err != nil {
-		return nil, err
-	}
-	votes, err := run.GenerateRootBlockVotes(root, signerData)
-	if err != nil {
-		return nil, err
-	}
-	qc, invalidVotesErr, err := run.GenerateRootQC(root, votes, signerData, signerData.Identities())
-	if err != nil {
-		return nil, err
-	}
-
-	if len(invalidVotesErr) > 0 {
-		return nil, fmt.Errorf("has invalid votes: %v", invalidVotesErr)
-	}
+	rootHeader := run.GenerateRootHeader(chainID, parentID, height, timestamp)
 
 	// generate root blocks for each collector cluster
 	clusterRootBlocks, clusterAssignments, clusterQCs, err := setupClusterGenesisBlockQCs(networkConf.NClusters, epochCounter, stakedConfs)
@@ -1141,19 +1130,21 @@ func BootstrapNetwork(networkConf NetworkConfig, bootstrapDir string, chainID fl
 		return nil, err
 	}
 
-	dkgOffsetView := root.Header.View + networkConf.ViewsInStakingAuction - 1
+	dkgOffsetView := rootHeader.View + networkConf.ViewsInStakingAuction - 1
 
 	// generate epoch service events
 	epochSetup := &flow.EpochSetup{
 		Counter:            epochCounter,
-		FirstView:          root.Header.View,
+		FirstView:          rootHeader.View,
 		DKGPhase1FinalView: dkgOffsetView + networkConf.ViewsInDKGPhase,
 		DKGPhase2FinalView: dkgOffsetView + networkConf.ViewsInDKGPhase*2,
 		DKGPhase3FinalView: dkgOffsetView + networkConf.ViewsInDKGPhase*3,
-		FinalView:          root.Header.View + networkConf.ViewsInEpoch - 1,
-		Participants:       participants,
+		FinalView:          rootHeader.View + networkConf.ViewsInEpoch - 1,
+		Participants:       participants.ToSkeleton(),
 		Assignments:        clusterAssignments,
 		RandomSource:       randomSource,
+		TargetDuration:     networkConf.ViewsInEpoch, // 1view/s
+		TargetEndTime:      uint64(time.Now().Unix()) + networkConf.ViewsInEpoch,
 	}
 
 	epochCommit := &flow.EpochCommit{
@@ -1162,6 +1153,11 @@ func BootstrapNetwork(networkConf NetworkConfig, bootstrapDir string, chainID fl
 		DKGGroupKey:        dkg.PubGroupKey,
 		DKGParticipantKeys: dkg.PubKeyShares,
 	}
+	root := &flow.Block{
+		Header: rootHeader,
+	}
+	root.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(
+		inmem.ProtocolStateFromEpochServiceEvents(epochSetup, epochCommit).ID())))
 
 	cdcRandomSource, err := cadence.NewString(hex.EncodeToString(randomSource))
 	if err != nil {
@@ -1178,7 +1174,7 @@ func BootstrapNetwork(networkConf NetworkConfig, bootstrapDir string, chainID fl
 		RandomSource:                 cdcRandomSource,
 		CollectorClusters:            clusterAssignments,
 		ClusterQCs:                   clusterQCs,
-		DKGPubKeys:                   dkg.PubKeyShares,
+		DKGPubKeys:                   encodable.WrapRandomBeaconPubKeys(dkg.PubKeyShares),
 	}
 
 	// generate the initial execution state
@@ -1187,6 +1183,7 @@ func BootstrapNetwork(networkConf NetworkConfig, bootstrapDir string, chainID fl
 		trieDir,
 		unittest.ServiceAccountPublicKey,
 		chain,
+		fvm.WithRootBlock(root.Header),
 		fvm.WithInitialTokenSupply(unittest.GenesisTokenSupply),
 		fvm.WithAccountCreationFee(fvm.DefaultAccountCreationFee),
 		fvm.WithMinimumStorageReservation(fvm.DefaultMinimumStorageReservation),
@@ -1206,6 +1203,24 @@ func BootstrapNetwork(networkConf NetworkConfig, bootstrapDir string, chainID fl
 		return nil, fmt.Errorf("generating root seal failed: %w", err)
 	}
 
+	// generate QC
+	signerData, err := run.GenerateQCParticipantData(consensusNodes, consensusNodes, dkg)
+	if err != nil {
+		return nil, err
+	}
+	votes, err := run.GenerateRootBlockVotes(root, signerData)
+	if err != nil {
+		return nil, err
+	}
+	qc, invalidVotesErr, err := run.GenerateRootQC(root, votes, signerData, signerData.Identities())
+	if err != nil {
+		return nil, err
+	}
+
+	if len(invalidVotesErr) > 0 {
+		return nil, fmt.Errorf("has invalid votes: %v", invalidVotesErr)
+	}
+
 	snapshot, err := inmem.SnapshotFromBootstrapStateWithParams(root, result, seal, qc, flow.DefaultProtocolVersion, networkConf.EpochCommitSafetyThreshold)
 	if err != nil {
 		return nil, fmt.Errorf("could not create bootstrap state snapshot: %w", err)
@@ -1311,8 +1326,8 @@ func runBeaconKG(confs []ContainerConfig) (dkgmod.DKGData, error) {
 func setupClusterGenesisBlockQCs(nClusters uint, epochCounter uint64, confs []ContainerConfig) ([]*cluster.Block, flow.AssignmentList, []*flow.QuorumCertificate, error) {
 
 	participantsUnsorted := toParticipants(confs)
-	participants := participantsUnsorted.Sort(flow.Canonical)
-	collectors := participants.Filter(filter.HasRole(flow.RoleCollection))
+	participants := participantsUnsorted.Sort(flow.Canonical[flow.Identity])
+	collectors := participants.Filter(filter.HasRole[flow.Identity](flow.RoleCollection)).ToSkeleton()
 	assignments := unittest.ClusterAssignment(nClusters, collectors)
 	clusters, err := factory.NewClusterList(assignments, collectors)
 	if err != nil {
@@ -1344,7 +1359,7 @@ func setupClusterGenesisBlockQCs(nClusters uint, epochCounter uint64, confs []Co
 		}
 
 		// must order in canonical ordering otherwise decoding signer indices from cluster QC would fail
-		clusterCommittee := bootstrap.ToIdentityList(clusterNodeInfos).Sort(flow.Canonical)
+		clusterCommittee := bootstrap.ToIdentityList(clusterNodeInfos).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
 		qc, err := run.GenerateClusterRootQC(clusterNodeInfos, clusterCommittee, block)
 		if err != nil {
 			return nil, nil, nil, fmt.Errorf("fail to generate cluster root QC with clusterNodeInfos %v, %w",
diff --git a/integration/testnet/util.go b/integration/testnet/util.go
index 181e6dddd4e..c48d9bc0afd 100644
--- a/integration/testnet/util.go
+++ b/integration/testnet/util.go
@@ -11,15 +11,19 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/libp2p/go-libp2p/core/peer"
 	"github.com/onflow/crypto"
+	"github.com/rs/zerolog/log"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/cmd/bootstrap/cmd"
 	"github.com/onflow/flow-go/cmd/bootstrap/utils"
 	"github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/state/protocol/inmem"
+	"github.com/onflow/flow-go/network/p2p/keyutils"
+	"github.com/onflow/flow-go/network/p2p/translator"
 	"github.com/onflow/flow-go/utils/io"
+	"github.com/onflow/flow-go/utils/unittest"
 )
 
 func makeDir(t *testing.T, base string, subdir string) string {
@@ -99,33 +103,37 @@ func WriteFile(path string, data []byte) error {
 	return err
 }
 
-// rootProtocolJsonWithoutAddresses strips out all node addresses from the root protocol json file specified as srcFile
-// and creates the dstFile with the modified contents
-func rootProtocolJsonWithoutAddresses(srcfile string, dstFile string) error {
-
-	data, err := io.ReadFile(filepath.Join(srcfile))
+func WriteObserverPrivateKey(observerName, bootstrapDir string) (crypto.PrivateKey, error) {
+	// make the observer private key for named observer
+	// only used for localnet, not for use with production
+	networkSeed := cmd.GenerateRandomSeed(crypto.KeyGenSeedMinLen)
+	networkKey, err := utils.GeneratePublicNetworkingKey(networkSeed)
 	if err != nil {
-		return err
+		return nil, fmt.Errorf("could not generate networking key: %w", err)
 	}
 
-	var rootSnapshot inmem.EncodableSnapshot
-	err = json.Unmarshal(data, &rootSnapshot)
+	// hex encode
+	keyBytes := networkKey.Encode()
+	output := make([]byte, hex.EncodedLen(len(keyBytes)))
+	hex.Encode(output, keyBytes)
+
+	// write to file
+	outputFile := fmt.Sprintf("%s/private-root-information/%s_key", bootstrapDir, observerName)
+	err = os.WriteFile(outputFile, output, 0600)
 	if err != nil {
-		return err
+		return nil, fmt.Errorf("could not write private key to file: %w", err)
 	}
 
-	strippedSnapshot := inmem.StrippedInmemSnapshot(rootSnapshot)
-
-	return WriteJSON(dstFile, strippedSnapshot)
+	return networkKey, nil
 }
 
-func WriteObserverPrivateKey(observerName, bootstrapDir string) error {
+func WriteTestExecutionService(_ flow.Identifier, address, observerName, bootstrapDir string) (bootstrap.NodeInfo, error) {
 	// make the observer private key for named observer
 	// only used for localnet, not for use with production
 	networkSeed := cmd.GenerateRandomSeed(crypto.KeyGenSeedMinLen)
 	networkKey, err := utils.GeneratePublicNetworkingKey(networkSeed)
 	if err != nil {
-		return fmt.Errorf("could not generate networking key: %w", err)
+		return bootstrap.NodeInfo{}, fmt.Errorf("could not generate networking key: %w", err)
 	}
 
 	// hex encode
@@ -133,12 +141,71 @@ func WriteObserverPrivateKey(observerName, bootstrapDir string) error {
 	output := make([]byte, hex.EncodedLen(len(keyBytes)))
 	hex.Encode(output, keyBytes)
 
-	// write to file
-	outputFile := fmt.Sprintf("%s/private-root-information/%s_key", bootstrapDir, observerName)
+	encryptionKey, err := utils.GenerateSecretsDBEncryptionKey()
+	if err != nil {
+		return bootstrap.NodeInfo{}, err
+	}
+
+	pubKey, err := keyutils.LibP2PPublicKeyFromFlow(networkKey.PublicKey())
+	if err != nil {
+		return bootstrap.NodeInfo{}, fmt.Errorf("could not get libp2p public key from flow public key: %w", err)
+	}
+
+	peerID, err := peer.IDFromPublicKey(pubKey)
+	if err != nil {
+		return bootstrap.NodeInfo{}, fmt.Errorf("could not get peer ID from public key: %w", err)
+	}
+
+	nodeID, err := translator.NewPublicNetworkIDTranslator().GetFlowID(peerID)
+	if err != nil {
+		return bootstrap.NodeInfo{}, fmt.Errorf("could not get flow node ID: %w", err)
+	}
+
+	k, err := pubKey.Raw()
+	if err != nil {
+		return bootstrap.NodeInfo{}, err
+	}
+
+	ks := unittest.StakingKeys(1)
+	stakingKey := ks[0]
+
+	log.Info().Msgf("test execution node private key: %v, public key: %x, peerID: %v, nodeID: %v", networkKey, k, peerID, nodeID)
+
+	nodeInfo := bootstrap.NewPrivateNodeInfo(
+		nodeID,
+		flow.RoleExecution,
+		address,
+		0,
+		networkKey,
+		stakingKey,
+	)
+
+	path := fmt.Sprintf("%s/private-root-information/private-node-info_%v/%vjson",
+		bootstrapDir, nodeID, bootstrap.PathPrivNodeInfoPrefix)
+
+	private, err := nodeInfo.Private()
+	if err != nil {
+		return bootstrap.NodeInfo{}, err
+	}
+
+	err = io.WriteJSON(path, private)
+	if err != nil {
+		return bootstrap.NodeInfo{}, err
+	}
+
+	path = fmt.Sprintf("%s/private-root-information/private-node-info_%v/%v",
+		bootstrapDir, nodeID, bootstrap.FilenameSecretsEncryptionKey)
+	err = os.WriteFile(path, encryptionKey, 0644)
+	if err != nil {
+		return bootstrap.NodeInfo{}, err
+	}
+
+	// write network private key
+	outputFile := fmt.Sprintf("%s/private-root-information/private-node-info_%v/network_private_key", bootstrapDir, nodeID)
 	err = os.WriteFile(outputFile, output, 0600)
 	if err != nil {
-		return fmt.Errorf("could not write private key to file: %w", err)
+		return bootstrap.NodeInfo{}, fmt.Errorf("could not write private key to file: %w", err)
 	}
 
-	return nil
+	return nodeInfo, nil
 }
diff --git a/integration/tests/access/cohort1/access_api_test.go b/integration/tests/access/cohort1/access_api_test.go
index d849c8bef90..1cbf5b191c4 100644
--- a/integration/tests/access/cohort1/access_api_test.go
+++ b/integration/tests/access/cohort1/access_api_test.go
@@ -2,9 +2,18 @@ package cohort1
 
 import (
 	"context"
+	"io"
 	"testing"
 	"time"
 
+	"github.com/onflow/flow-go-sdk/templates"
+	"github.com/onflow/flow-go-sdk/test"
+
+	accessproto "github.com/onflow/flow/protobuf/go/flow/access"
+	"github.com/onflow/flow/protobuf/go/flow/entities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
 	"github.com/onflow/flow-go/integration/tests/mvp"
 
 	"github.com/rs/zerolog"
@@ -73,6 +82,7 @@ func (s *AccessAPISuite) SetupTest() {
 		testnet.WithLogLevel(zerolog.FatalLevel),
 		// make sure test continues to test as expected if the default config changes
 		testnet.WithAdditionalFlagf("--script-execution-mode=%s", backend.IndexQueryModeExecutionNodesOnly),
+		testnet.WithAdditionalFlagf("--tx-result-query-mode=%s", backend.IndexQueryModeExecutionNodesOnly),
 	)
 
 	indexingAccessConfig := testnet.NewNodeConfig(
@@ -190,6 +200,116 @@ func (s *AccessAPISuite) TestMVPScriptExecutionLocalStorage() {
 	mvp.RunMVPTest(s.T(), s.ctx, s.net, s.accessNode2)
 }
 
+// TestSendAndSubscribeTransactionStatuses tests the functionality of sending and subscribing to transaction statuses.
+//
+// This test verifies that a transaction can be created, signed, sent to the access API, and then the status of the transaction
+// can be subscribed to. It performs the following steps:
+// 1. Establishes a connection to the access API.
+// 2. Creates a new account key and prepares a transaction for account creation.
+// 3. Signs the transaction.
+// 4. Sends and subscribes to the transaction status using the access API.
+// 5. Verifies the received transaction statuses, ensuring they are received in order and the final status is "SEALED".
+func (s *AccessAPISuite) TestSendAndSubscribeTransactionStatuses() {
+	accessNodeContainer := s.net.ContainerByName(testnet.PrimaryAN)
+
+	// Establish a gRPC connection to the access API
+	conn, err := grpc.Dial(accessNodeContainer.Addr(testnet.GRPCPort), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	s.Require().NoError(err)
+	s.Require().NotNil(conn)
+
+	// Create a client for the access API
+	accessClient := accessproto.NewAccessAPIClient(conn)
+	serviceClient, err := accessNodeContainer.TestnetClient()
+	s.Require().NoError(err)
+	s.Require().NotNil(serviceClient)
+
+	// Get the latest block ID
+	latestBlockID, err := serviceClient.GetLatestBlockID(s.ctx)
+	s.Require().NoError(err)
+
+	// Generate a new account transaction
+	accountKey := test.AccountKeyGenerator().New()
+	payer := serviceClient.SDKServiceAddress()
+
+	tx, err := templates.CreateAccount([]*sdk.AccountKey{accountKey}, nil, payer)
+	s.Require().NoError(err)
+	tx.SetComputeLimit(1000).
+		SetReferenceBlockID(sdk.HexToID(latestBlockID.String())).
+		SetProposalKey(payer, 0, serviceClient.GetSeqNumber()).
+		SetPayer(payer)
+
+	tx, err = serviceClient.SignTransaction(tx)
+	s.Require().NoError(err)
+
+	// Convert the transaction to a message format expected by the access API
+	authorizers := make([][]byte, len(tx.Authorizers))
+	for i, auth := range tx.Authorizers {
+		authorizers[i] = auth.Bytes()
+	}
+
+	convertToMessageSig := func(sigs []sdk.TransactionSignature) []*entities.Transaction_Signature {
+		msgSigs := make([]*entities.Transaction_Signature, len(sigs))
+		for i, sig := range sigs {
+			msgSigs[i] = &entities.Transaction_Signature{
+				Address:   sig.Address.Bytes(),
+				KeyId:     uint32(sig.KeyIndex),
+				Signature: sig.Signature,
+			}
+		}
+
+		return msgSigs
+	}
+
+	transactionMsg := &entities.Transaction{
+		Script:           tx.Script,
+		Arguments:        tx.Arguments,
+		ReferenceBlockId: tx.ReferenceBlockID.Bytes(),
+		GasLimit:         tx.GasLimit,
+		ProposalKey: &entities.Transaction_ProposalKey{
+			Address:        tx.ProposalKey.Address.Bytes(),
+			KeyId:          uint32(tx.ProposalKey.KeyIndex),
+			SequenceNumber: tx.ProposalKey.SequenceNumber,
+		},
+		Payer:              tx.Payer.Bytes(),
+		Authorizers:        authorizers,
+		PayloadSignatures:  convertToMessageSig(tx.PayloadSignatures),
+		EnvelopeSignatures: convertToMessageSig(tx.EnvelopeSignatures),
+	}
+
+	// Send and subscribe to the transaction status using the access API
+	subClient, err := accessClient.SendAndSubscribeTransactionStatuses(s.ctx, &accessproto.SendAndSubscribeTransactionStatusesRequest{
+		Transaction: transactionMsg,
+	})
+	s.Require().NoError(err)
+
+	expectedCounter := uint64(0)
+	var finalTxStatus entities.TransactionStatus
+	var txID sdk.Identifier
+
+	for {
+		resp, err := subClient.Recv()
+		if err != nil {
+			if err == io.EOF {
+				break
+			}
+
+			s.Require().NoError(err)
+		}
+
+		if txID == sdk.EmptyID {
+			txID = sdk.Identifier(resp.GetId())
+		}
+
+		s.Assert().Equal(expectedCounter, resp.GetMessageIndex())
+		s.Assert().Equal(txID, sdk.Identifier(resp.GetId()))
+
+		expectedCounter++
+		finalTxStatus = resp.Status
+	}
+
+	s.Assert().Equal(entities.TransactionStatus_SEALED, finalTxStatus)
+}
+
 func (s *AccessAPISuite) testGetAccount(client *client.Client) {
 	header, err := client.GetLatestBlockHeader(s.ctx, true)
 	s.Require().NoError(err)
diff --git a/integration/tests/access/cohort2/observer_indexer_enabled_test.go b/integration/tests/access/cohort2/observer_indexer_enabled_test.go
new file mode 100644
index 00000000000..29b7c7df3ae
--- /dev/null
+++ b/integration/tests/access/cohort2/observer_indexer_enabled_test.go
@@ -0,0 +1,739 @@
+package cohort2
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	sdk "github.com/onflow/flow-go-sdk"
+	sdkcrypto "github.com/onflow/flow-go-sdk/crypto"
+	"github.com/onflow/flow-go-sdk/templates"
+	"github.com/onflow/flow-go/engine/access/rpc/backend"
+	"github.com/onflow/flow-go/engine/common/rpc/convert"
+	"github.com/onflow/flow-go/integration/testnet"
+	"github.com/onflow/flow-go/integration/tests/lib"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/utils/unittest"
+
+	accessproto "github.com/onflow/flow/protobuf/go/flow/access"
+	"github.com/onflow/flow/protobuf/go/flow/entities"
+)
+
+var (
+	simpleScript = `pub fun main(): Int { return 42; }`
+)
+
+func TestObserverIndexerEnabled(t *testing.T) {
+	suite.Run(t, new(ObserverIndexerEnabledSuite))
+}
+
+// ObserverIndexerEnabledSuite tests the observer with the indexer enabled.
+// It uses ObserverSuite as a base to reuse the test cases that need to be run for any observer variation.
+type ObserverIndexerEnabledSuite struct {
+	ObserverSuite
+}
+
+// SetupTest sets up the test suite by starting the network and preparing the observers client.
+// By overriding this function, we can ensure that the observers are started with correct parameters and select
+// the RPCs and REST endpoints that are tested.
+func (s *ObserverIndexerEnabledSuite) SetupTest() {
+	s.localRpc = map[string]struct{}{
+		"Ping":                           {},
+		"GetLatestBlockHeader":           {},
+		"GetBlockHeaderByID":             {},
+		"GetBlockHeaderByHeight":         {},
+		"GetLatestBlock":                 {},
+		"GetBlockByID":                   {},
+		"GetBlockByHeight":               {},
+		"GetLatestProtocolStateSnapshot": {},
+		"GetNetworkParameters":           {},
+		"GetTransactionsByBlockID":       {},
+		"GetTransaction":                 {},
+		"GetCollectionByID":              {},
+		"ExecuteScriptAtBlockID":         {},
+		"ExecuteScriptAtLatestBlock":     {},
+		"ExecuteScriptAtBlockHeight":     {},
+		"GetAccount":                     {},
+		"GetAccountAtLatestBlock":        {},
+		"GetAccountAtBlockHeight":        {},
+	}
+
+	s.localRest = map[string]struct{}{
+		"getBlocksByIDs":       {},
+		"getBlocksByHeight":    {},
+		"getBlockPayloadByID":  {},
+		"getNetworkParameters": {},
+		"getNodeVersionInfo":   {},
+	}
+
+	s.testedRPCs = s.getRPCs
+	s.testedRestEndpoints = s.getRestEndpoints
+
+	consensusConfigs := []func(config *testnet.NodeConfig){
+		// `cruise-ctl-fallback-proposal-duration` is set to 250ms instead to of 100ms
+		// to purposely slow down the block rate. This is needed since the crypto module
+		// update providing faster BLS operations.
+		// TODO: fix the access integration test logic to function without slowing down
+		// the block rate
+		testnet.WithAdditionalFlag("--cruise-ctl-fallback-proposal-duration=250ms"),
+		testnet.WithAdditionalFlagf("--required-verification-seal-approvals=%d", 1),
+		testnet.WithAdditionalFlagf("--required-construction-seal-approvals=%d", 1),
+		testnet.WithLogLevel(zerolog.FatalLevel),
+	}
+
+	nodeConfigs := []testnet.NodeConfig{
+		// access node with unstaked nodes supported
+		testnet.NewNodeConfig(flow.RoleAccess, testnet.WithLogLevel(zerolog.InfoLevel),
+			testnet.WithAdditionalFlag("--supports-observer=true"),
+			testnet.WithAdditionalFlagf("--public-network-execution-data-sync-enabled=true"),
+			testnet.WithAdditionalFlagf("--script-execution-mode=%s", backend.IndexQueryModeExecutionNodesOnly),
+			testnet.WithAdditionalFlagf("--tx-result-query-mode=%s", backend.IndexQueryModeExecutionNodesOnly),
+			testnet.WithAdditionalFlag("--event-query-mode=execution-nodes-only"),
+		),
+
+		testnet.NewNodeConfig(flow.RoleCollection, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testnet.NewNodeConfig(flow.RoleCollection, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testnet.NewNodeConfig(flow.RoleExecution, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testnet.NewNodeConfig(flow.RoleExecution, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
+		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
+		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
+		testnet.NewNodeConfig(flow.RoleVerification, testnet.WithLogLevel(zerolog.FatalLevel)),
+	}
+
+	observers := []testnet.ObserverConfig{
+		{
+			LogLevel: zerolog.InfoLevel,
+			AdditionalFlags: []string{
+				fmt.Sprintf("--execution-data-dir=%s", testnet.DefaultExecutionDataServiceDir),
+				fmt.Sprintf("--execution-state-dir=%s", testnet.DefaultExecutionStateDir),
+				"--execution-data-sync-enabled=true",
+				"--execution-data-indexing-enabled=true",
+				"--local-service-api-enabled=true",
+				"--event-query-mode=execution-nodes-only",
+			},
+		},
+		{
+			ContainerName: "observer_2",
+			LogLevel:      zerolog.InfoLevel,
+		},
+	}
+
+	// prepare the network
+	conf := testnet.NewNetworkConfig("observer_indexing_enabled_test", nodeConfigs, testnet.WithObservers(observers...))
+	s.net = testnet.PrepareFlowNetwork(s.T(), conf, flow.Localnet)
+
+	// start the network
+	ctx, cancel := context.WithCancel(context.Background())
+	s.cancel = cancel
+
+	s.net.Start(ctx)
+}
+
+// TestObserverIndexedRPCsHappyPath tests RPCs that are handled by the observer by using a dedicated indexer for the events.
+// To ensure that the observer is handling these RPCs, we stop the upstream access node and verify that the observer client
+// returns success for valid requests and errors for invalid ones.
+func (s *ObserverIndexerEnabledSuite) TestObserverIndexedRPCsHappyPath() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	t := s.T()
+
+	// prepare environment to create a new account
+	serviceAccountClient, err := s.net.ContainerByName(testnet.PrimaryAN).TestnetClient()
+	require.NoError(t, err)
+
+	latestBlockID, err := serviceAccountClient.GetLatestBlockID(ctx)
+	require.NoError(t, err)
+
+	// create new account to deploy Counter to
+	accountPrivateKey := lib.RandomPrivateKey()
+
+	accountKey := sdk.NewAccountKey().
+		FromPrivateKey(accountPrivateKey).
+		SetHashAlgo(sdkcrypto.SHA3_256).
+		SetWeight(sdk.AccountKeyWeightThreshold)
+
+	serviceAddress := sdk.Address(serviceAccountClient.Chain.ServiceAddress())
+
+	// Generate the account creation transaction
+	createAccountTx, err := templates.CreateAccount(
+		[]*sdk.AccountKey{accountKey},
+		[]templates.Contract{
+			{
+				Name:   lib.CounterContract.Name,
+				Source: lib.CounterContract.ToCadence(),
+			},
+		}, serviceAddress)
+	require.NoError(t, err)
+	createAccountTx.
+		SetReferenceBlockID(sdk.Identifier(latestBlockID)).
+		SetProposalKey(serviceAddress, 0, serviceAccountClient.GetSeqNumber()).
+		SetPayer(serviceAddress).
+		SetComputeLimit(9999)
+
+	// send the create account tx
+	childCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	err = serviceAccountClient.SignAndSendTransaction(childCtx, createAccountTx)
+	require.NoError(t, err)
+
+	cancel()
+
+	// wait for account to be created
+	var accountCreationTxRes *sdk.TransactionResult
+	unittest.RequireReturnsBefore(t, func() {
+		accountCreationTxRes, err = serviceAccountClient.WaitForSealed(context.Background(), createAccountTx.ID())
+		require.NoError(t, err)
+	}, 20*time.Second, "has to seal before timeout")
+
+	// obtain the account address
+	var accountCreatedPayload []byte
+	var newAccountAddress sdk.Address
+	for _, event := range accountCreationTxRes.Events {
+		if event.Type == sdk.EventAccountCreated {
+			accountCreatedEvent := sdk.AccountCreatedEvent(event)
+			accountCreatedPayload = accountCreatedEvent.Payload
+			newAccountAddress = accountCreatedEvent.Address()
+			break
+		}
+	}
+	require.NotEqual(t, sdk.EmptyAddress, newAccountAddress)
+
+	// now we can query events using observer to data which has to be locally indexed
+
+	// get an observer client
+	observer, err := s.getObserverClient()
+	require.NoError(t, err)
+
+	// wait for data to be synced by observer
+	require.Eventually(t, func() bool {
+		_, err := observer.GetAccountAtBlockHeight(ctx, &accessproto.GetAccountAtBlockHeightRequest{
+			Address:     newAccountAddress.Bytes(),
+			BlockHeight: accountCreationTxRes.BlockHeight,
+		})
+		statusErr, ok := status.FromError(err)
+		if !ok || err == nil {
+			return true
+		}
+		return statusErr.Code() != codes.OutOfRange
+	}, 30*time.Second, 1*time.Second)
+
+	blockWithAccount, err := observer.GetBlockHeaderByID(ctx, &accessproto.GetBlockHeaderByIDRequest{
+		Id: accountCreationTxRes.BlockID[:],
+	})
+	require.NoError(t, err)
+
+	// stop the upstream access container
+	err = s.net.StopContainerByName(ctx, testnet.PrimaryAN)
+	require.NoError(t, err)
+
+	eventsByBlockID, err := observer.GetEventsForBlockIDs(ctx, &accessproto.GetEventsForBlockIDsRequest{
+		Type:                 sdk.EventAccountCreated,
+		BlockIds:             [][]byte{blockWithAccount.Block.Id},
+		EventEncodingVersion: entities.EventEncodingVersion_JSON_CDC_V0,
+	})
+	require.NoError(t, err)
+
+	eventsByHeight, err := observer.GetEventsForHeightRange(ctx, &accessproto.GetEventsForHeightRangeRequest{
+		Type:                 sdk.EventAccountCreated,
+		StartHeight:          blockWithAccount.Block.Height,
+		EndHeight:            blockWithAccount.Block.Height,
+		EventEncodingVersion: entities.EventEncodingVersion_JSON_CDC_V0,
+	})
+	require.NoError(t, err)
+
+	// validate that there is an event that we are looking for
+	require.Equal(t, eventsByHeight.Results, eventsByBlockID.Results)
+	found := false
+	for _, eventsInBlock := range eventsByHeight.Results {
+		for _, event := range eventsInBlock.Events {
+			if event.Type == sdk.EventAccountCreated {
+				if bytes.Equal(event.Payload, accountCreatedPayload) {
+					found = true
+				}
+			}
+		}
+	}
+	require.True(t, found)
+}
+
+// TestAllObserverIndexedRPCsHappyPath tests the observer with the indexer enabled,
+// observer configured to proxy requests to an access node and access node itself. All responses are compared
+// to ensure all of the endpoints are working as expected.
+// For now the observer only supports the following RPCs:
+// -GetAccountAtBlockHeight
+// -GetEventsForHeightRange
+// -GetEventsForBlockIDs
+// -GetSystemTransaction
+// -GetTransactionsByBlockID
+// -GetTransactionResultsByBlockID
+// -ExecuteScriptAtBlockID
+// -ExecuteScriptAtBlockHeight
+// -GetExecutionResultByID
+// -GetCollectionByID
+// -GetTransaction
+// -GetTransactionResult
+// -GetTransactionResultByIndex
+func (s *ObserverIndexerEnabledSuite) TestAllObserverIndexedRPCsHappyPath() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	t := s.T()
+
+	// prepare environment to create a new account
+	serviceAccountClient, err := s.net.ContainerByName(testnet.PrimaryAN).TestnetClient()
+	require.NoError(t, err)
+
+	latestBlockID, err := serviceAccountClient.GetLatestBlockID(ctx)
+	require.NoError(t, err)
+
+	// create new account to deploy Counter to
+	accountPrivateKey := lib.RandomPrivateKey()
+
+	accountKey := sdk.NewAccountKey().
+		FromPrivateKey(accountPrivateKey).
+		SetHashAlgo(sdkcrypto.SHA3_256).
+		SetWeight(sdk.AccountKeyWeightThreshold)
+
+	serviceAddress := sdk.Address(serviceAccountClient.Chain.ServiceAddress())
+
+	// Generate the account creation transaction
+	createAccountTx, err := templates.CreateAccount(
+		[]*sdk.AccountKey{accountKey},
+		[]templates.Contract{
+			{
+				Name:   lib.CounterContract.Name,
+				Source: lib.CounterContract.ToCadence(),
+			},
+		}, serviceAddress)
+	require.NoError(t, err)
+
+	createAccountTx.
+		SetReferenceBlockID(sdk.Identifier(latestBlockID)).
+		SetProposalKey(serviceAddress, 0, serviceAccountClient.GetSeqNumber()).
+		SetPayer(serviceAddress).
+		SetComputeLimit(9999)
+
+	// send the create account tx
+	childCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	err = serviceAccountClient.SignAndSendTransaction(childCtx, createAccountTx)
+	require.NoError(t, err)
+
+	cancel()
+
+	// wait for account to be created
+	var accountCreationTxRes *sdk.TransactionResult
+	unittest.RequireReturnsBefore(t, func() {
+		accountCreationTxRes, err = serviceAccountClient.WaitForSealed(context.Background(), createAccountTx.ID())
+		require.NoError(t, err)
+	}, 20*time.Second, "has to seal before timeout")
+
+	// obtain the account address
+	var accountCreatedPayload []byte
+	var newAccountAddress sdk.Address
+	for _, event := range accountCreationTxRes.Events {
+		if event.Type == sdk.EventAccountCreated {
+			accountCreatedEvent := sdk.AccountCreatedEvent(event)
+			accountCreatedPayload = accountCreatedEvent.Payload
+			newAccountAddress = accountCreatedEvent.Address()
+			break
+		}
+	}
+	require.NotEqual(t, sdk.EmptyAddress, newAccountAddress)
+
+	// now we can query events using observerLocal to data which has to be locally indexed
+
+	// get an access node client
+	accessNode, err := s.getClient(s.net.ContainerByName(testnet.PrimaryAN).Addr(testnet.GRPCPort))
+	require.NoError(t, err)
+
+	// get an observer with indexer enabled client
+	observerLocal, err := s.getObserverClient()
+	require.NoError(t, err)
+
+	// get an upstream observer client
+	observerUpstream, err := s.getClient(s.net.ContainerByName("observer_2").Addr(testnet.GRPCPort))
+	require.NoError(t, err)
+
+	// wait for data to be synced by observerLocal
+	require.Eventually(t, func() bool {
+		_, err := observerLocal.GetAccountAtBlockHeight(ctx, &accessproto.GetAccountAtBlockHeightRequest{
+			Address:     newAccountAddress.Bytes(),
+			BlockHeight: accountCreationTxRes.BlockHeight,
+		})
+		statusErr, ok := status.FromError(err)
+		if !ok || err == nil {
+			return true
+		}
+		return statusErr.Code() != codes.OutOfRange
+	}, 30*time.Second, 1*time.Second)
+
+	blockWithAccount, err := observerLocal.GetBlockByID(ctx, &accessproto.GetBlockByIDRequest{
+		Id:                accountCreationTxRes.BlockID[:],
+		FullBlockResponse: true,
+	})
+	require.NoError(t, err)
+
+	checkRPC := func(rpcCall func(client accessproto.AccessAPIClient) (any, error)) {
+		observerRes, err := rpcCall(observerLocal)
+		require.NoError(s.T(), err)
+		observerUpstreamRes, err := rpcCall(observerUpstream)
+		require.NoError(s.T(), err)
+		accessRes, err := rpcCall(accessNode)
+		require.NoError(s.T(), err)
+
+		require.Equal(s.T(), observerRes, observerUpstreamRes)
+		require.Equal(s.T(), observerRes, accessRes)
+	}
+
+	// GetEventsForBlockIDs
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		res, err := client.GetEventsForBlockIDs(ctx, &accessproto.GetEventsForBlockIDsRequest{
+			Type:                 sdk.EventAccountCreated,
+			BlockIds:             [][]byte{blockWithAccount.Block.Id},
+			EventEncodingVersion: entities.EventEncodingVersion_JSON_CDC_V0,
+		})
+		return res.Results, err
+	})
+
+	var txIndex uint32
+	found := false
+
+	// GetEventsForHeightRange
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		res, err := client.GetEventsForHeightRange(ctx, &accessproto.GetEventsForHeightRangeRequest{
+			Type:                 sdk.EventAccountCreated,
+			StartHeight:          blockWithAccount.Block.Height,
+			EndHeight:            blockWithAccount.Block.Height,
+			EventEncodingVersion: entities.EventEncodingVersion_JSON_CDC_V0,
+		})
+
+		// Iterating through response Results to get txIndex of event
+		for _, eventsInBlock := range res.Results {
+			for _, event := range eventsInBlock.Events {
+				if event.Type == sdk.EventAccountCreated {
+					if bytes.Equal(event.Payload, accountCreatedPayload) {
+						found = true
+						txIndex = event.TransactionIndex
+					}
+				}
+			}
+		}
+		require.True(t, found)
+		return res.Results, err
+	})
+
+	// GetSystemTransaction
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		res, err := client.GetSystemTransaction(ctx, &accessproto.GetSystemTransactionRequest{
+			BlockId: blockWithAccount.Block.Id,
+		})
+		return res.Transaction, err
+	})
+
+	// GetExecutionResultByID
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		converted, err := convert.MessageToBlock(blockWithAccount.Block)
+		require.NoError(t, err)
+
+		resultId := converted.Payload.Results[0].ID()
+		res, err := client.GetExecutionResultByID(ctx, &accessproto.GetExecutionResultByIDRequest{
+			Id: convert.IdentifierToMessage(resultId),
+		})
+		return res.ExecutionResult, err
+	})
+
+	// GetTransaction
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		res, err := client.GetTransaction(ctx, &accessproto.GetTransactionRequest{
+			Id:           accountCreationTxRes.TransactionID.Bytes(),
+			BlockId:      blockWithAccount.Block.Id,
+			CollectionId: nil,
+		})
+		return res.Transaction, err
+	})
+
+	// GetTransactionResult
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		res, err := client.GetTransactionResult(ctx, &accessproto.GetTransactionRequest{
+			Id:           accountCreationTxRes.TransactionID.Bytes(),
+			BlockId:      blockWithAccount.Block.Id,
+			CollectionId: accountCreationTxRes.CollectionID.Bytes(),
+		})
+		return res.Events, err
+	})
+
+	// GetTransactionResultByIndex
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		res, err := client.GetTransactionResultByIndex(ctx, &accessproto.GetTransactionByIndexRequest{
+			BlockId:              blockWithAccount.Block.Id,
+			Index:                txIndex,
+			EventEncodingVersion: entities.EventEncodingVersion_JSON_CDC_V0,
+		})
+		return res.Events, err
+	})
+
+	// GetTransactionResultsByBlockID
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		res, err := client.GetTransactionResultsByBlockID(ctx, &accessproto.GetTransactionsByBlockIDRequest{
+			BlockId:              blockWithAccount.Block.Id,
+			EventEncodingVersion: entities.EventEncodingVersion_JSON_CDC_V0,
+		})
+		return res.TransactionResults, err
+	})
+
+	// GetTransactionsByBlockID
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		res, err := client.GetTransactionsByBlockID(ctx, &accessproto.GetTransactionsByBlockIDRequest{
+			BlockId: blockWithAccount.Block.Id,
+		})
+		return res.Transactions, err
+	})
+
+	// GetCollectionByID
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		res, err := client.GetCollectionByID(ctx, &accessproto.GetCollectionByIDRequest{
+			Id: accountCreationTxRes.CollectionID.Bytes(),
+		})
+		return res.Collection, err
+	})
+
+	// ExecuteScriptAtBlockHeight
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		res, err := client.ExecuteScriptAtBlockHeight(ctx, &accessproto.ExecuteScriptAtBlockHeightRequest{
+			BlockHeight: blockWithAccount.Block.Height,
+			Script:      []byte(simpleScript),
+			Arguments:   make([][]byte, 0),
+		})
+		return res.Value, err
+	})
+
+	// ExecuteScriptAtBlockID
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		res, err := client.ExecuteScriptAtBlockID(ctx, &accessproto.ExecuteScriptAtBlockIDRequest{
+			BlockId:   blockWithAccount.Block.Id,
+			Script:    []byte(simpleScript),
+			Arguments: make([][]byte, 0),
+		})
+		return res.Value, err
+	})
+
+	// GetAccountAtBlockHeight
+	checkRPC(func(client accessproto.AccessAPIClient) (any, error) {
+		res, err := client.GetAccountAtBlockHeight(ctx, &accessproto.GetAccountAtBlockHeightRequest{
+			Address:     newAccountAddress.Bytes(),
+			BlockHeight: accountCreationTxRes.BlockHeight,
+		})
+		return res.Account, err
+	})
+}
+
+func (s *ObserverIndexerEnabledSuite) getRPCs() []RPCTest {
+	return []RPCTest{
+		{name: "Ping", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.Ping(ctx, &accessproto.PingRequest{})
+			return err
+		}},
+		{name: "GetLatestBlockHeader", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetLatestBlockHeader(ctx, &accessproto.GetLatestBlockHeaderRequest{})
+			return err
+		}},
+		{name: "GetBlockHeaderByID", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetBlockHeaderByID(ctx, &accessproto.GetBlockHeaderByIDRequest{
+				Id: make([]byte, 32),
+			})
+			return err
+		}},
+		{name: "GetBlockHeaderByHeight", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetBlockHeaderByHeight(ctx, &accessproto.GetBlockHeaderByHeightRequest{})
+			return err
+		}},
+		{name: "GetLatestBlock", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetLatestBlock(ctx, &accessproto.GetLatestBlockRequest{})
+			return err
+		}},
+		{name: "GetBlockByID", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetBlockByID(ctx, &accessproto.GetBlockByIDRequest{Id: make([]byte, 32)})
+			return err
+		}},
+		{name: "GetBlockByHeight", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetBlockByHeight(ctx, &accessproto.GetBlockByHeightRequest{})
+			return err
+		}},
+		{name: "GetCollectionByID", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetCollectionByID(ctx, &accessproto.GetCollectionByIDRequest{Id: make([]byte, 32)})
+			return err
+		}},
+		{name: "SendTransaction", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.SendTransaction(ctx, &accessproto.SendTransactionRequest{})
+			return err
+		}},
+		{name: "GetTransaction", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetTransaction(ctx, &accessproto.GetTransactionRequest{Id: make([]byte, 32)})
+			return err
+		}},
+		{name: "GetTransactionResult", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetTransactionResult(ctx, &accessproto.GetTransactionRequest{})
+			return err
+		}},
+		{name: "GetTransactionResultByIndex", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetTransactionResultByIndex(ctx, &accessproto.GetTransactionByIndexRequest{})
+			return err
+		}},
+		{name: "GetTransactionResultsByBlockID", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetTransactionResultsByBlockID(ctx, &accessproto.GetTransactionsByBlockIDRequest{})
+			return err
+		}},
+		{name: "GetTransactionsByBlockID", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetTransactionsByBlockID(ctx, &accessproto.GetTransactionsByBlockIDRequest{BlockId: make([]byte, 32)})
+			return err
+		}},
+		{name: "GetAccount", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetAccount(ctx, &accessproto.GetAccountRequest{
+				Address: flow.Localnet.Chain().ServiceAddress().Bytes(),
+			})
+			return err
+		}},
+		{name: "GetAccountAtLatestBlock", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetAccountAtLatestBlock(ctx, &accessproto.GetAccountAtLatestBlockRequest{
+				Address: flow.Localnet.Chain().ServiceAddress().Bytes(),
+			})
+			return err
+		}},
+		{name: "GetAccountAtBlockHeight", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetAccountAtBlockHeight(ctx, &accessproto.GetAccountAtBlockHeightRequest{
+				Address:     flow.Localnet.Chain().ServiceAddress().Bytes(),
+				BlockHeight: 0,
+			})
+			return err
+		}},
+		{name: "ExecuteScriptAtLatestBlock", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.ExecuteScriptAtLatestBlock(ctx, &accessproto.ExecuteScriptAtLatestBlockRequest{
+				Script:    []byte(simpleScript),
+				Arguments: make([][]byte, 0),
+			})
+			return err
+		}},
+		{name: "ExecuteScriptAtBlockID", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.ExecuteScriptAtBlockID(ctx, &accessproto.ExecuteScriptAtBlockIDRequest{
+				BlockId:   make([]byte, 32),
+				Script:    []byte("dummy script"),
+				Arguments: make([][]byte, 0),
+			})
+			return err
+		}},
+		{name: "ExecuteScriptAtBlockHeight", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.ExecuteScriptAtBlockHeight(ctx, &accessproto.ExecuteScriptAtBlockHeightRequest{
+				BlockHeight: 0,
+				Script:      []byte(simpleScript),
+				Arguments:   make([][]byte, 0),
+			})
+			return err
+		}},
+		{name: "GetNetworkParameters", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetNetworkParameters(ctx, &accessproto.GetNetworkParametersRequest{})
+			return err
+		}},
+		{name: "GetLatestProtocolStateSnapshot", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetLatestProtocolStateSnapshot(ctx, &accessproto.GetLatestProtocolStateSnapshotRequest{})
+			return err
+		}},
+		{name: "GetExecutionResultForBlockID", call: func(ctx context.Context, client accessproto.AccessAPIClient) error {
+			_, err := client.GetExecutionResultForBlockID(ctx, &accessproto.GetExecutionResultForBlockIDRequest{})
+			return err
+		}},
+	}
+}
+
+func (s *ObserverIndexerEnabledSuite) getRestEndpoints() []RestEndpointTest {
+	transactionId := unittest.IdentifierFixture().String()
+	account := flow.Localnet.Chain().ServiceAddress().String()
+	block := unittest.BlockFixture()
+	executionResult := unittest.ExecutionResultFixture()
+	collection := unittest.CollectionFixture(2)
+	eventType := unittest.EventTypeFixture(flow.Localnet)
+
+	return []RestEndpointTest{
+		{
+			name:   "getTransactionByID",
+			method: http.MethodGet,
+			path:   "/transactions/" + transactionId,
+		},
+		{
+			name:   "createTransaction",
+			method: http.MethodPost,
+			path:   "/transactions",
+			body:   createTx(s.net),
+		},
+		{
+			name:   "getTransactionResultByID",
+			method: http.MethodGet,
+			path:   fmt.Sprintf("/transaction_results/%s?block_id=%s&collection_id=%s", transactionId, block.ID().String(), collection.ID().String()),
+		},
+		{
+			name:   "getBlocksByIDs",
+			method: http.MethodGet,
+			path:   "/blocks/" + block.ID().String(),
+		},
+		{
+			name:   "getBlocksByHeight",
+			method: http.MethodGet,
+			path:   "/blocks?height=1",
+		},
+		{
+			name:   "getBlockPayloadByID",
+			method: http.MethodGet,
+			path:   "/blocks/" + block.ID().String() + "/payload",
+		},
+		{
+			name:   "getExecutionResultByID",
+			method: http.MethodGet,
+			path:   "/execution_results/" + executionResult.ID().String(),
+		},
+		{
+			name:   "getExecutionResultByBlockID",
+			method: http.MethodGet,
+			path:   "/execution_results?block_id=" + block.ID().String(),
+		},
+		{
+			name:   "getCollectionByID",
+			method: http.MethodGet,
+			path:   "/collections/" + collection.ID().String(),
+		},
+		{
+			name:   "executeScript",
+			method: http.MethodPost,
+			path:   "/scripts",
+			body:   createScript(),
+		},
+		{
+			name:   "getAccount",
+			method: http.MethodGet,
+			path:   "/accounts/" + account + "?block_height=1",
+		},
+		{
+			name:   "getEvents",
+			method: http.MethodGet,
+			path:   fmt.Sprintf("/events?type=%s&start_height=%d&end_height=%d", eventType, 0, 3),
+		},
+		{
+			name:   "getNetworkParameters",
+			method: http.MethodGet,
+			path:   "/network/parameters",
+		},
+		{
+			name:   "getNodeVersionInfo",
+			method: http.MethodGet,
+			path:   "/node_version_info",
+		},
+	}
+}
diff --git a/integration/tests/access/cohort2/observer_test.go b/integration/tests/access/cohort2/observer_test.go
index c73d3999a95..a073b03cb8e 100644
--- a/integration/tests/access/cohort2/observer_test.go
+++ b/integration/tests/access/cohort2/observer_test.go
@@ -30,12 +30,18 @@ func TestObserver(t *testing.T) {
 	suite.Run(t, new(ObserverSuite))
 }
 
+// ObserverSuite is a general test suite for observer nodes APIs.
+// It is used to test the observer node's RPC and REST APIs.
+// It verified that the observer's API behaves similarly to the access node's API.
 type ObserverSuite struct {
 	suite.Suite
 	net       *testnet.FlowNetwork
-	teardown  func()
-	localRpc  map[string]struct{}
-	localRest map[string]struct{}
+	localRpc  map[string]struct{} // RPC methods handled locally by observer
+	localRest map[string]struct{} // REST endpoints handled locally by observer
+
+	// we use functors to allow reusing the same test suite for different sets of RPCs and REST endpoints
+	testedRPCs          func() []RPCTest          // RPC methods to test
+	testedRestEndpoints func() []RestEndpointTest // REST endpoints to test
 
 	cancel context.CancelFunc
 }
@@ -72,6 +78,9 @@ func (s *ObserverSuite) SetupTest() {
 		"getNodeVersionInfo":   {},
 	}
 
+	s.testedRPCs = s.getRPCs
+	s.testedRestEndpoints = s.getRestEndpoints
+
 	nodeConfigs := []testnet.NodeConfig{
 		// access node with unstaked nodes supported
 		testnet.NewNodeConfig(flow.RoleAccess, testnet.WithLogLevel(zerolog.InfoLevel),
@@ -127,7 +136,7 @@ func (s *ObserverSuite) TestObserverRPC() {
 
 	t.Run("CompareRPCs", func(t *testing.T) {
 		// verify that both clients return the same errors for proxied rpcs
-		for _, rpc := range s.getRPCs() {
+		for _, rpc := range s.testedRPCs() {
 			// skip rpcs handled locally by observer
 			if _, local := s.localRpc[rpc.name]; local {
 				continue
@@ -146,7 +155,7 @@ func (s *ObserverSuite) TestObserverRPC() {
 
 	t.Run("HandledByUpstream", func(t *testing.T) {
 		// verify that we receive Unavailable errors from all rpcs handled upstream
-		for _, rpc := range s.getRPCs() {
+		for _, rpc := range s.testedRPCs() {
 			if _, local := s.localRpc[rpc.name]; local {
 				continue
 			}
@@ -159,7 +168,7 @@ func (s *ObserverSuite) TestObserverRPC() {
 
 	t.Run("HandledByObserver", func(t *testing.T) {
 		// verify that we receive NotFound or no error from all rpcs handled locally
-		for _, rpc := range s.getRPCs() {
+		for _, rpc := range s.testedRPCs() {
 			if _, local := s.localRpc[rpc.name]; !local {
 				continue
 			}
@@ -204,7 +213,7 @@ func (s *ObserverSuite) TestObserverRest() {
 
 	t.Run("CompareEndpoints", func(t *testing.T) {
 		// verify that both clients return the same errors for proxied rests
-		for _, endpoint := range s.getRestEndpoints() {
+		for _, endpoint := range s.testedRestEndpoints() {
 			// skip rest handled locally by observer
 			if _, local := s.localRest[endpoint.name]; local {
 				continue
@@ -230,7 +239,7 @@ func (s *ObserverSuite) TestObserverRest() {
 
 	t.Run("HandledByUpstream", func(t *testing.T) {
 		// verify that we receive StatusServiceUnavailable errors from all rests handled upstream
-		for _, endpoint := range s.getRestEndpoints() {
+		for _, endpoint := range s.testedRestEndpoints() {
 			if _, local := s.localRest[endpoint.name]; local {
 				continue
 			}
@@ -245,7 +254,7 @@ func (s *ObserverSuite) TestObserverRest() {
 
 	t.Run("HandledByObserver", func(t *testing.T) {
 		// verify that we receive NotFound or no error from all rests handled locally
-		for _, endpoint := range s.getRestEndpoints() {
+		for _, endpoint := range s.testedRestEndpoints() {
 			if _, local := s.localRest[endpoint.name]; !local {
 				continue
 			}
diff --git a/integration/tests/access/cohort3/execution_state_sync_test.go b/integration/tests/access/cohort3/execution_state_sync_test.go
index 62126b57623..38a156549db 100644
--- a/integration/tests/access/cohort3/execution_state_sync_test.go
+++ b/integration/tests/access/cohort3/execution_state_sync_test.go
@@ -33,8 +33,9 @@ type ExecutionStateSyncSuite struct {
 
 	log zerolog.Logger
 
-	bridgeID flow.Identifier
-	ghostID  flow.Identifier
+	bridgeID     flow.Identifier
+	ghostID      flow.Identifier
+	observerName string
 
 	// root context for the current test
 	ctx    context.Context
@@ -75,11 +76,12 @@ func (s *ExecutionStateSyncSuite) buildNetworkConfig() {
 	bridgeANConfig := testnet.NewNodeConfig(
 		flow.RoleAccess,
 		testnet.WithID(s.bridgeID),
-		testnet.WithLogLevel(zerolog.DebugLevel),
+		testnet.WithLogLevel(zerolog.InfoLevel),
 		testnet.WithAdditionalFlag("--supports-observer=true"),
 		testnet.WithAdditionalFlag("--execution-data-sync-enabled=true"),
 		testnet.WithAdditionalFlag(fmt.Sprintf("--execution-data-dir=%s", testnet.DefaultExecutionDataServiceDir)),
 		testnet.WithAdditionalFlag("--execution-data-retry-delay=1s"),
+		testnet.WithAdditionalFlagf("--public-network-execution-data-sync-enabled=true"),
 	)
 
 	// add the ghost (access) node config
@@ -108,10 +110,21 @@ func (s *ExecutionStateSyncSuite) buildNetworkConfig() {
 		testnet.NewNodeConfig(flow.RoleVerification, testnet.WithLogLevel(zerolog.FatalLevel)),
 		bridgeANConfig,
 		ghostNode,
-		// TODO: add observer
 	}
 
-	conf := testnet.NewNetworkConfig("execution state sync test", net)
+	// add the observer node config
+	s.observerName = testnet.PrimaryON
+	observers := []testnet.ObserverConfig{{
+		ContainerName: s.observerName,
+		LogLevel:      zerolog.DebugLevel,
+		AdditionalFlags: []string{
+			fmt.Sprintf("--execution-data-dir=%s", testnet.DefaultExecutionDataServiceDir),
+			"--execution-data-sync-enabled=true",
+			"--event-query-mode=execution-nodes-only",
+		},
+	}}
+
+	conf := testnet.NewNetworkConfig("execution state sync test", net, testnet.WithObservers(observers...))
 	s.net = testnet.PrepareFlowNetwork(s.T(), conf, flow.Localnet)
 }
 
@@ -119,7 +132,7 @@ func (s *ExecutionStateSyncSuite) buildNetworkConfig() {
 // successfully sync the data
 func (s *ExecutionStateSyncSuite) TestHappyPath() {
 	// Let the network run for this many blocks
-	runBlocks := uint64(20)
+	runBlocks := uint64(60)
 
 	// We will check that execution data was downloaded for this many blocks
 	// It has to be less than runBlocks since it's not possible to see which height the AN stopped
@@ -135,31 +148,55 @@ func (s *ExecutionStateSyncSuite) TestHappyPath() {
 	s.BlockState.WaitForSealed(s.T(), blockA.Header.Height+runBlocks)
 	s.net.StopContainers()
 
+	metrics := metrics.NewNoopCollector()
+
 	// start an execution data service using the Access Node's execution data db
 	an := s.net.ContainerByID(s.bridgeID)
-	eds := s.nodeExecutionDataStore(an)
+	anEds := s.nodeExecutionDataStore(an)
 
 	// setup storage objects needed to get the execution data id
-	db, err := an.DB()
+	anDB, err := an.DB()
 	require.NoError(s.T(), err, "could not open db")
 
-	metrics := metrics.NewNoopCollector()
-	headers := storage.NewHeaders(metrics, db)
-	results := storage.NewExecutionResults(metrics, db)
+	anHeaders := storage.NewHeaders(metrics, anDB)
+	anResults := storage.NewExecutionResults(metrics, anDB)
+
+	// start an execution data service using the Observer Node's execution data db
+	on := s.net.ContainerByName(s.observerName)
+	onEds := s.nodeExecutionDataStore(on)
+
+	// setup storage objects needed to get the execution data id
+	onDB, err := on.DB()
+	require.NoError(s.T(), err, "could not open db")
+
+	onHeaders := storage.NewHeaders(metrics, onDB)
+	onResults := storage.NewExecutionResults(metrics, onDB)
 
 	// Loop through checkBlocks and verify the execution data was downloaded correctly
 	for i := blockA.Header.Height; i <= blockA.Header.Height+checkBlocks; i++ {
-		header, err := headers.ByHeight(i)
-		require.NoError(s.T(), err, "could not get header")
+		// access node
+		header, err := anHeaders.ByHeight(i)
+		require.NoError(s.T(), err, "%s: could not get header", testnet.PrimaryAN)
+
+		result, err := anResults.ByBlockID(header.ID())
+		require.NoError(s.T(), err, "%s: could not get sealed result", testnet.PrimaryAN)
 
-		result, err := results.ByBlockID(header.ID())
-		require.NoError(s.T(), err, "could not get sealed result")
+		ed, err := anEds.Get(s.ctx, result.ExecutionDataID)
+		if assert.NoError(s.T(), err, "%s: could not get execution data for height %v", testnet.PrimaryAN, i) {
+			s.T().Logf("%s: got execution data for height %d", testnet.PrimaryAN, i)
+			assert.Equal(s.T(), header.ID(), ed.BlockID)
+		}
 
-		s.T().Logf("getting execution data for height %d, block %s, execution_data %s", header.Height, header.ID(), result.ExecutionDataID)
+		// observer node
+		header, err = onHeaders.ByHeight(i)
+		require.NoError(s.T(), err, "%s: could not get header", testnet.PrimaryON)
 
-		ed, err := eds.Get(s.ctx, result.ExecutionDataID)
-		if assert.NoError(s.T(), err, "could not get execution data for height %v", i) {
-			s.T().Logf("got execution data for height %d", i)
+		result, err = onResults.ByID(result.ID())
+		require.NoError(s.T(), err, "%s: could not get sealed result from ON`s storage", testnet.PrimaryON)
+
+		ed, err = onEds.Get(s.ctx, result.ExecutionDataID)
+		if assert.NoError(s.T(), err, "%s: could not get execution data for height %v", testnet.PrimaryON, i) {
+			s.T().Logf("%s: got execution data for height %d", testnet.PrimaryON, i)
 			assert.Equal(s.T(), header.ID(), ed.BlockID)
 		}
 	}
@@ -169,12 +206,5 @@ func (s *ExecutionStateSyncSuite) nodeExecutionDataStore(node *testnet.Container
 	ds, err := badgerds.NewDatastore(filepath.Join(node.ExecutionDataDBPath(), "blobstore"), &badgerds.DefaultOptions)
 	require.NoError(s.T(), err, "could not get execution datastore")
 
-	go func() {
-		<-s.ctx.Done()
-		if err := ds.Close(); err != nil {
-			s.T().Logf("could not close execution data datastore: %v", err)
-		}
-	}()
-
 	return execution_data.NewExecutionDataStore(blobs.NewBlobstore(ds), execution_data.DefaultSerializer)
 }
diff --git a/integration/tests/access/cohort3/grpc_state_stream_test.go b/integration/tests/access/cohort3/grpc_state_stream_test.go
new file mode 100644
index 00000000000..be6f0840b99
--- /dev/null
+++ b/integration/tests/access/cohort3/grpc_state_stream_test.go
@@ -0,0 +1,524 @@
+package cohort3
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"log"
+	"sync"
+	"testing"
+
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	jsoncdc "github.com/onflow/cadence/encoding/json"
+
+	"github.com/onflow/flow-go-sdk/test"
+	"github.com/onflow/flow-go/engine/access/state_stream/backend"
+	"github.com/onflow/flow-go/engine/common/rpc/convert"
+	"github.com/onflow/flow-go/engine/ghost/client"
+	"github.com/onflow/flow-go/integration/testnet"
+	"github.com/onflow/flow-go/integration/tests/lib"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/counters"
+	"github.com/onflow/flow-go/utils/unittest"
+
+	sdk "github.com/onflow/flow-go-sdk"
+
+	"github.com/onflow/flow/protobuf/go/flow/entities"
+	"github.com/onflow/flow/protobuf/go/flow/executiondata"
+)
+
+var (
+	jsonOptions = []jsoncdc.Option{jsoncdc.WithAllowUnstructuredStaticTypes(true)}
+)
+
+// SubscribeEventsResponse represents the subscription response containing events for a specific block and messageIndex
+type SubscribeEventsResponse struct {
+	backend.EventsResponse
+	MessageIndex uint64
+}
+
+func TestGrpcStateStream(t *testing.T) {
+	suite.Run(t, new(GrpcStateStreamSuite))
+}
+
+type GrpcStateStreamSuite struct {
+	suite.Suite
+	lib.TestnetStateTracker
+
+	log zerolog.Logger
+
+	// root context for the current test
+	ctx    context.Context
+	cancel context.CancelFunc
+
+	net *testnet.FlowNetwork
+
+	// RPC methods to test
+	testedRPCs func() []subscribeEventsRPCTest
+
+	ghostID flow.Identifier
+}
+
+func (s *GrpcStateStreamSuite) TearDownTest() {
+	s.log.Info().Msg("================> Start TearDownTest")
+	s.net.Remove()
+	s.cancel()
+	s.log.Info().Msg("================> Finish TearDownTest")
+}
+
+func (s *GrpcStateStreamSuite) SetupTest() {
+	s.log = unittest.LoggerForTest(s.Suite.T(), zerolog.InfoLevel)
+	s.log.Info().Msg("================> SetupTest")
+	defer func() {
+		s.log.Info().Msg("================> Finish SetupTest")
+	}()
+
+	// access node
+	testANConfig := testnet.NewNodeConfig(
+		flow.RoleAccess,
+		testnet.WithLogLevel(zerolog.InfoLevel),
+		testnet.WithAdditionalFlag("--execution-data-sync-enabled=true"),
+		testnet.WithAdditionalFlagf("--execution-data-dir=%s", testnet.DefaultExecutionDataServiceDir),
+		testnet.WithAdditionalFlag("--execution-data-retry-delay=1s"),
+		testnet.WithAdditionalFlag("--execution-data-indexing-enabled=true"),
+		testnet.WithAdditionalFlagf("--execution-state-dir=%s", testnet.DefaultExecutionStateDir),
+		testnet.WithAdditionalFlag("--event-query-mode=local-only"),
+		testnet.WithAdditionalFlag("--supports-observer=true"),
+		testnet.WithAdditionalFlagf("--public-network-execution-data-sync-enabled=true"),
+	)
+	controlANConfig := testnet.NewNodeConfig(
+		flow.RoleAccess,
+		testnet.WithLogLevel(zerolog.InfoLevel),
+		testnet.WithAdditionalFlag("--execution-data-sync-enabled=true"),
+		testnet.WithAdditionalFlagf("--execution-data-dir=%s", testnet.DefaultExecutionDataServiceDir),
+		testnet.WithAdditionalFlag("--execution-data-retry-delay=1s"),
+		testnet.WithAdditionalFlag("--execution-data-indexing-enabled=true"),
+		testnet.WithAdditionalFlagf("--execution-state-dir=%s", testnet.DefaultExecutionStateDir),
+		testnet.WithAdditionalFlag("--event-query-mode=execution-nodes-only"),
+	)
+
+	// add the ghost (access) node config
+	s.ghostID = unittest.IdentifierFixture()
+	ghostNode := testnet.NewNodeConfig(
+		flow.RoleAccess,
+		testnet.WithID(s.ghostID),
+		testnet.WithLogLevel(zerolog.FatalLevel),
+		testnet.AsGhost())
+
+	consensusConfigs := []func(config *testnet.NodeConfig){
+		testnet.WithAdditionalFlag("--cruise-ctl-fallback-proposal-duration=400ms"),
+		testnet.WithAdditionalFlag(fmt.Sprintf("--required-verification-seal-approvals=%d", 1)),
+		testnet.WithAdditionalFlag(fmt.Sprintf("--required-construction-seal-approvals=%d", 1)),
+		testnet.WithLogLevel(zerolog.FatalLevel),
+	}
+
+	nodeConfigs := []testnet.NodeConfig{
+		testnet.NewNodeConfig(flow.RoleCollection, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testnet.NewNodeConfig(flow.RoleCollection, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testnet.NewNodeConfig(flow.RoleExecution, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testnet.NewNodeConfig(flow.RoleExecution, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
+		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
+		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
+		testnet.NewNodeConfig(flow.RoleVerification, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testANConfig,    // access_1
+		controlANConfig, // access_2
+		ghostNode,       // access ghost
+	}
+
+	// add the observer node config
+	observers := []testnet.ObserverConfig{{
+		ContainerName: testnet.PrimaryON,
+		LogLevel:      zerolog.DebugLevel,
+		AdditionalFlags: []string{
+			fmt.Sprintf("--execution-data-dir=%s", testnet.DefaultExecutionDataServiceDir),
+			fmt.Sprintf("--execution-state-dir=%s", testnet.DefaultExecutionStateDir),
+			"--execution-data-sync-enabled=true",
+			"--event-query-mode=execution-nodes-only",
+			"--execution-data-indexing-enabled=true",
+		},
+	}}
+
+	conf := testnet.NewNetworkConfig("access_event_streaming_test", nodeConfigs, testnet.WithObservers(observers...))
+	s.net = testnet.PrepareFlowNetwork(s.T(), conf, flow.Localnet)
+
+	// start the network
+	s.T().Logf("starting flow network with docker containers")
+	s.ctx, s.cancel = context.WithCancel(context.Background())
+
+	s.testedRPCs = s.getRPCs
+
+	s.net.Start(s.ctx)
+	s.Track(s.T(), s.ctx, s.Ghost())
+}
+
+func (s *GrpcStateStreamSuite) Ghost() *client.GhostClient {
+	client, err := s.net.ContainerByID(s.ghostID).GhostClient()
+	require.NoError(s.T(), err, "could not get ghost client")
+	return client
+}
+
+// TestRestEventStreaming tests gRPC event streaming
+func (s *GrpcStateStreamSuite) TestHappyPath() {
+	testANURL := fmt.Sprintf("localhost:%s", s.net.ContainerByName(testnet.PrimaryAN).Port(testnet.ExecutionStatePort))
+	sdkClientTestAN, err := getClient(testANURL)
+	s.Require().NoError(err)
+
+	controlANURL := fmt.Sprintf("localhost:%s", s.net.ContainerByName("access_2").Port(testnet.ExecutionStatePort))
+	sdkClientControlAN, err := getClient(controlANURL)
+	s.Require().NoError(err)
+
+	testONURL := fmt.Sprintf("localhost:%s", s.net.ContainerByName(testnet.PrimaryON).Port(testnet.ExecutionStatePort))
+	sdkClientTestON, err := getClient(testONURL)
+	s.Require().NoError(err)
+
+	// get the first block height
+	currentFinalized := s.BlockState.HighestFinalizedHeight()
+	blockA := s.BlockState.WaitForHighestFinalizedProgress(s.T(), currentFinalized)
+
+	// Let the network run for this many blocks
+	blockCount := uint64(5)
+	// wait for the requested number of sealed blocks
+	s.BlockState.WaitForSealed(s.T(), blockA.Header.Height+blockCount)
+
+	txGenerator, err := s.net.ContainerByName(testnet.PrimaryAN).TestnetClient()
+	s.Require().NoError(err)
+
+	var startValue interface{}
+	txCount := 10
+
+	for _, rpc := range s.testedRPCs() {
+		s.T().Run(rpc.name, func(t *testing.T) {
+			if rpc.name == "SubscribeEventsFromStartBlockID" {
+				startValue = convert.IdentifierToMessage(blockA.ID())
+			} else {
+				startValue = blockA.Header.Height
+			}
+
+			testANRecv := rpc.call(s.ctx, sdkClientTestAN, startValue, &executiondata.EventFilter{})
+			testANEvents, testANErrs, err := SubscribeHandler(s.ctx, testANRecv, eventsResponseHandler)
+			s.Require().NoError(err)
+
+			controlANRecv := rpc.call(s.ctx, sdkClientControlAN, startValue, &executiondata.EventFilter{})
+			controlANEvents, controlANErrs, err := SubscribeHandler(s.ctx, controlANRecv, eventsResponseHandler)
+			s.Require().NoError(err)
+
+			testONRecv := rpc.call(s.ctx, sdkClientTestON, startValue, &executiondata.EventFilter{})
+			testONEvents, testONErrs, err := SubscribeHandler(s.ctx, testONRecv, eventsResponseHandler)
+			s.Require().NoError(err)
+
+			if rpc.generateEvents {
+				// generate events
+				go func() {
+					s.generateEvents(txGenerator, txCount)
+				}()
+			}
+
+			has := func(events []flow.Event, eventType flow.EventType) bool {
+				for _, event := range events {
+					if event.Type == eventType {
+						return true
+					}
+				}
+				return false
+			}
+
+			targetEvent := flow.EventType("flow.AccountCreated")
+
+			foundANTxCount := 0
+			foundONTxCount := 0
+			messageIndex := counters.NewMonotonousCounter(0)
+
+			r := NewResponseTracker(compareEventsResponse, 3)
+
+			for {
+				select {
+				case err := <-testANErrs:
+					s.Require().NoErrorf(err, "unexpected test AN error")
+				case err := <-controlANErrs:
+					s.Require().NoErrorf(err, "unexpected control AN error")
+				case err := <-testONErrs:
+					s.Require().NoErrorf(err, "unexpected test ON error")
+				case event := <-testANEvents:
+					if has(event.Events, targetEvent) {
+						s.T().Logf("adding access test events: %d %d %v", event.Height, len(event.Events), event.Events)
+						r.Add(s.T(), event.Height, "access_test", event)
+						foundANTxCount++
+					}
+				case event := <-controlANEvents:
+					if has(event.Events, targetEvent) {
+						if ok := messageIndex.Set(event.MessageIndex); !ok {
+							s.Require().NoErrorf(err, "messageIndex isn`t sequential")
+						}
+
+						s.T().Logf("adding control events: %d %d %v", event.Height, len(event.Events), event.Events)
+						r.Add(s.T(), event.Height, "access_control", event)
+					}
+				case event := <-testONEvents:
+					if has(event.Events, targetEvent) {
+						s.T().Logf("adding observer test events: %d %d %v", event.Height, len(event.Events), event.Events)
+						r.Add(s.T(), event.Height, "observer_test", event)
+						foundONTxCount++
+					}
+				}
+
+				if foundANTxCount >= txCount && foundONTxCount >= txCount {
+					break
+				}
+			}
+
+			r.AssertAllResponsesHandled(t, txCount)
+		})
+	}
+}
+
+// generateEvents is a helper function for generating AccountCreated events
+func (s *GrpcStateStreamSuite) generateEvents(client *testnet.Client, txCount int) {
+	refBlockID, err := client.GetLatestBlockID(s.ctx)
+	s.Require().NoError(err)
+
+	for i := 0; i < txCount; i++ {
+		accountKey := test.AccountKeyGenerator().New()
+		address, err := client.CreateAccount(s.ctx, accountKey, sdk.HexToID(refBlockID.String()))
+		if err != nil {
+			i--
+			continue
+		}
+		s.T().Logf("created account: %s", address)
+	}
+}
+
+type subscribeEventsRPCTest struct {
+	name           string
+	call           func(ctx context.Context, client executiondata.ExecutionDataAPIClient, startValue interface{}, filter *executiondata.EventFilter) func() (*executiondata.SubscribeEventsResponse, error)
+	generateEvents bool // add ability to integration test generate new events or use old events to decrease running test time
+}
+
+func (s *GrpcStateStreamSuite) getRPCs() []subscribeEventsRPCTest {
+	return []subscribeEventsRPCTest{
+		{
+			name: "SubscribeEventsFromLatest",
+			call: func(ctx context.Context, client executiondata.ExecutionDataAPIClient, _ interface{}, filter *executiondata.EventFilter) func() (*executiondata.SubscribeEventsResponse, error) {
+				stream, err := client.SubscribeEventsFromLatest(ctx, &executiondata.SubscribeEventsFromLatestRequest{
+					EventEncodingVersion: entities.EventEncodingVersion_CCF_V0,
+					Filter:               filter,
+					HeartbeatInterval:    1,
+				})
+				s.Require().NoError(err)
+				return stream.Recv
+			},
+			generateEvents: true,
+		},
+		{
+			name: "SubscribeEvents",
+			call: func(ctx context.Context, client executiondata.ExecutionDataAPIClient, _ interface{}, filter *executiondata.EventFilter) func() (*executiondata.SubscribeEventsResponse, error) {
+				//nolint: staticcheck
+				stream, err := client.SubscribeEvents(ctx, &executiondata.SubscribeEventsRequest{
+					StartBlockId:         convert.IdentifierToMessage(flow.ZeroID),
+					StartBlockHeight:     0,
+					EventEncodingVersion: entities.EventEncodingVersion_CCF_V0,
+					Filter:               filter,
+					HeartbeatInterval:    1,
+				})
+				s.Require().NoError(err)
+				return stream.Recv
+			},
+			generateEvents: true,
+		},
+		{
+			name: "SubscribeEventsFromStartBlockID",
+			call: func(ctx context.Context, client executiondata.ExecutionDataAPIClient, startValue interface{}, filter *executiondata.EventFilter) func() (*executiondata.SubscribeEventsResponse, error) {
+				stream, err := client.SubscribeEventsFromStartBlockID(ctx, &executiondata.SubscribeEventsFromStartBlockIDRequest{
+					StartBlockId:         startValue.([]byte),
+					EventEncodingVersion: entities.EventEncodingVersion_CCF_V0,
+					Filter:               filter,
+					HeartbeatInterval:    1,
+				})
+				s.Require().NoError(err)
+				return stream.Recv
+			},
+			generateEvents: false, // use previous events
+		},
+		{
+			name: "SubscribeEventsFromStartHeight",
+			call: func(ctx context.Context, client executiondata.ExecutionDataAPIClient, startValue interface{}, filter *executiondata.EventFilter) func() (*executiondata.SubscribeEventsResponse, error) {
+				stream, err := client.SubscribeEventsFromStartHeight(ctx, &executiondata.SubscribeEventsFromStartHeightRequest{
+					StartBlockHeight:     startValue.(uint64),
+					EventEncodingVersion: entities.EventEncodingVersion_CCF_V0,
+					Filter:               filter,
+					HeartbeatInterval:    1,
+				})
+				s.Require().NoError(err)
+				return stream.Recv
+			},
+			generateEvents: false, // use previous events
+		},
+	}
+}
+
+// ResponseTracker is a generic tracker for responses.
+type ResponseTracker[T any] struct {
+	r                       map[uint64]map[string]T
+	mu                      sync.RWMutex
+	compare                 func(t *testing.T, responses map[uint64]map[string]T, blockHeight uint64) error
+	checkCount              int // actual common count of responses we want to check
+	responsesCountToCompare int // count of responses that we want to compare with each other
+}
+
+// NewResponseTracker creates a new ResponseTracker.
+func NewResponseTracker[T any](
+	compare func(t *testing.T, responses map[uint64]map[string]T, blockHeight uint64) error,
+	responsesCountToCompare int,
+) *ResponseTracker[T] {
+	return &ResponseTracker[T]{
+		r:                       make(map[uint64]map[string]T),
+		compare:                 compare,
+		responsesCountToCompare: responsesCountToCompare,
+	}
+}
+
+func (r *ResponseTracker[T]) AssertAllResponsesHandled(t *testing.T, expectedCheckCount int) {
+	assert.Equal(t, expectedCheckCount, r.checkCount)
+
+	// we check if response tracker has some responses which were not checked, but should be checked
+	hasNotComparedResponses := false
+	for _, valueMap := range r.r {
+		if len(valueMap) == r.responsesCountToCompare {
+			hasNotComparedResponses = true
+			break
+		}
+	}
+	assert.False(t, hasNotComparedResponses)
+}
+
+func (r *ResponseTracker[T]) Add(t *testing.T, blockHeight uint64, name string, response T) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if _, ok := r.r[blockHeight]; !ok {
+		r.r[blockHeight] = make(map[string]T)
+	}
+	r.r[blockHeight][name] = response
+
+	if len(r.r[blockHeight]) != r.responsesCountToCompare {
+		return
+	}
+
+	r.checkCount += 1
+	err := r.compare(t, r.r, blockHeight)
+	if err != nil {
+		log.Fatalf("comparison error at block height %d: %v", blockHeight, err)
+	}
+
+	delete(r.r, blockHeight)
+}
+
+func eventsResponseHandler(msg *executiondata.SubscribeEventsResponse) (*SubscribeEventsResponse, error) {
+	events := convert.MessagesToEvents(msg.GetEvents())
+
+	return &SubscribeEventsResponse{
+		EventsResponse: backend.EventsResponse{
+			Height:         msg.GetBlockHeight(),
+			BlockID:        convert.MessageToIdentifier(msg.GetBlockId()),
+			Events:         events,
+			BlockTimestamp: msg.GetBlockTimestamp().AsTime(),
+		},
+		MessageIndex: msg.MessageIndex,
+	}, nil
+}
+
+func compareEventsResponse(t *testing.T, responses map[uint64]map[string]*SubscribeEventsResponse, blockHeight uint64) error {
+
+	accessControlData := responses[blockHeight]["access_control"]
+	accessTestData := responses[blockHeight]["access_test"]
+	observerTestData := responses[blockHeight]["observer_test"]
+
+	// Compare access_control with access_test
+	compareEvents(t, accessControlData, accessTestData)
+
+	// Compare access_control with observer_test
+	compareEvents(t, accessControlData, observerTestData)
+
+	return nil
+}
+
+func compareEvents(t *testing.T, controlData, testData *SubscribeEventsResponse) {
+	require.Equal(t, controlData.BlockID, testData.BlockID)
+	require.Equal(t, controlData.Height, testData.Height)
+	require.Equal(t, controlData.BlockTimestamp, testData.BlockTimestamp)
+	require.Equal(t, controlData.MessageIndex, testData.MessageIndex)
+	require.Equal(t, len(controlData.Events), len(testData.Events))
+
+	for i := range controlData.Events {
+		require.Equal(t, controlData.Events[i].Type, testData.Events[i].Type)
+		require.Equal(t, controlData.Events[i].TransactionID, testData.Events[i].TransactionID)
+		require.Equal(t, controlData.Events[i].TransactionIndex, testData.Events[i].TransactionIndex)
+		require.Equal(t, controlData.Events[i].EventIndex, testData.Events[i].EventIndex)
+		require.True(t, bytes.Equal(controlData.Events[i].Payload, testData.Events[i].Payload))
+	}
+}
+
+// TODO: switch to SDK versions once crypto library is fixed to support the latest SDK version
+
+func getClient(address string) (executiondata.ExecutionDataAPIClient, error) {
+	conn, err := grpc.Dial(address, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		return nil, err
+	}
+
+	return executiondata.NewExecutionDataAPIClient(conn), nil
+}
+
+func SubscribeHandler[T any, V any](
+	ctx context.Context,
+	recv func() (T, error),
+	responseHandler func(T) (V, error),
+) (<-chan V, <-chan error, error) {
+	sub := make(chan V)
+	errChan := make(chan error)
+
+	sendErr := func(err error) {
+		select {
+		case <-ctx.Done():
+		case errChan <- err:
+		}
+	}
+
+	go func() {
+		defer close(sub)
+		defer close(errChan)
+
+		for {
+			resp, err := recv()
+			if err != nil {
+				if err == io.EOF {
+					return
+				}
+
+				sendErr(fmt.Errorf("error receiving response: %w", err))
+				return
+			}
+
+			response, err := responseHandler(resp)
+			if err != nil {
+				sendErr(fmt.Errorf("error converting response: %w", err))
+				return
+			}
+
+			select {
+			case <-ctx.Done():
+				return
+			case sub <- response:
+			}
+		}
+	}()
+
+	return sub, errChan, nil
+}
diff --git a/integration/tests/access/cohort3/grpc_streaming_blocks_test.go b/integration/tests/access/cohort3/grpc_streaming_blocks_test.go
new file mode 100644
index 00000000000..82e1c23cf28
--- /dev/null
+++ b/integration/tests/access/cohort3/grpc_streaming_blocks_test.go
@@ -0,0 +1,278 @@
+package cohort3
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/onflow/flow-go/engine/common/rpc/convert"
+	"github.com/onflow/flow-go/engine/ghost/client"
+	"github.com/onflow/flow-go/integration/testnet"
+	"github.com/onflow/flow-go/integration/tests/lib"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/utils/unittest"
+
+	accessproto "github.com/onflow/flow/protobuf/go/flow/access"
+	"github.com/onflow/flow/protobuf/go/flow/entities"
+)
+
+func TestGrpcBlocksStream(t *testing.T) {
+	suite.Run(t, new(GrpcBlocksStreamSuite))
+}
+
+type GrpcBlocksStreamSuite struct {
+	suite.Suite
+	lib.TestnetStateTracker
+
+	log zerolog.Logger
+
+	// root context for the current test
+	ctx    context.Context
+	cancel context.CancelFunc
+
+	net *testnet.FlowNetwork
+
+	// RPC methods to test
+	testedRPCs func() []subscribeBlocksRPCTest
+
+	ghostID flow.Identifier
+}
+
+func (s *GrpcBlocksStreamSuite) TearDownTest() {
+	s.log.Info().Msg("================> Start TearDownTest")
+	s.net.Remove()
+	s.cancel()
+	s.log.Info().Msg("================> Finish TearDownTest")
+}
+
+func (s *GrpcBlocksStreamSuite) SetupTest() {
+	s.log = unittest.LoggerForTest(s.Suite.T(), zerolog.InfoLevel)
+	s.log.Info().Msg("================> SetupTest")
+	defer func() {
+		s.log.Info().Msg("================> Finish SetupTest")
+	}()
+
+	// access node
+	accessConfig := testnet.NewNodeConfig(
+		flow.RoleAccess,
+		testnet.WithLogLevel(zerolog.InfoLevel),
+		testnet.WithAdditionalFlag("--execution-data-sync-enabled=true"),
+		testnet.WithAdditionalFlagf("--execution-data-dir=%s", testnet.DefaultExecutionDataServiceDir),
+		testnet.WithAdditionalFlag("--execution-data-retry-delay=1s"),
+		testnet.WithAdditionalFlag("--execution-data-indexing-enabled=true"),
+		testnet.WithAdditionalFlagf("--execution-state-dir=%s", testnet.DefaultExecutionStateDir),
+		testnet.WithAdditionalFlag("--event-query-mode=local-only"),
+		testnet.WithAdditionalFlag("--supports-observer=true"),
+		testnet.WithAdditionalFlagf("--public-network-execution-data-sync-enabled=true"),
+	)
+
+	consensusConfigs := []func(config *testnet.NodeConfig){
+		testnet.WithAdditionalFlag("--cruise-ctl-fallback-proposal-duration=400ms"),
+		testnet.WithAdditionalFlag(fmt.Sprintf("--required-verification-seal-approvals=%d", 1)),
+		testnet.WithAdditionalFlag(fmt.Sprintf("--required-construction-seal-approvals=%d", 1)),
+		testnet.WithLogLevel(zerolog.FatalLevel),
+	}
+
+	// add the ghost (access) node config
+	s.ghostID = unittest.IdentifierFixture()
+	ghostNode := testnet.NewNodeConfig(
+		flow.RoleAccess,
+		testnet.WithID(s.ghostID),
+		testnet.WithLogLevel(zerolog.FatalLevel),
+		testnet.AsGhost())
+
+	nodeConfigs := []testnet.NodeConfig{
+		testnet.NewNodeConfig(flow.RoleCollection, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testnet.NewNodeConfig(flow.RoleCollection, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testnet.NewNodeConfig(flow.RoleExecution, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testnet.NewNodeConfig(flow.RoleExecution, testnet.WithLogLevel(zerolog.FatalLevel)),
+		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
+		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
+		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
+		testnet.NewNodeConfig(flow.RoleVerification, testnet.WithLogLevel(zerolog.FatalLevel)),
+		accessConfig,
+		ghostNode, // access ghost
+	}
+
+	// add the observer node config
+	observers := []testnet.ObserverConfig{{
+		ContainerName: testnet.PrimaryON,
+		LogLevel:      zerolog.DebugLevel,
+		AdditionalFlags: []string{
+			fmt.Sprintf("--execution-data-dir=%s", testnet.DefaultExecutionDataServiceDir),
+			fmt.Sprintf("--execution-state-dir=%s", testnet.DefaultExecutionStateDir),
+			"--execution-data-sync-enabled=true",
+			"--event-query-mode=execution-nodes-only",
+			"--execution-data-indexing-enabled=true",
+		},
+	}}
+
+	conf := testnet.NewNetworkConfig("access_blocks_streaming_test", nodeConfigs, testnet.WithObservers(observers...))
+	s.net = testnet.PrepareFlowNetwork(s.T(), conf, flow.Localnet)
+
+	// start the network
+	s.T().Logf("starting flow network with docker containers")
+	s.ctx, s.cancel = context.WithCancel(context.Background())
+
+	s.testedRPCs = s.getRPCs
+
+	s.net.Start(s.ctx)
+	s.Track(s.T(), s.ctx, s.Ghost())
+}
+
+func (s *GrpcBlocksStreamSuite) Ghost() *client.GhostClient {
+	client, err := s.net.ContainerByID(s.ghostID).GhostClient()
+	require.NoError(s.T(), err, "could not get ghost client")
+	return client
+}
+
+// TestRestEventStreaming tests gRPC event streaming
+func (s *GrpcBlocksStreamSuite) TestHappyPath() {
+	accessUrl := fmt.Sprintf("localhost:%s", s.net.ContainerByName(testnet.PrimaryAN).Port(testnet.GRPCPort))
+	accessClient, err := getAccessAPIClient(accessUrl)
+	s.Require().NoError(err)
+
+	observerURL := fmt.Sprintf("localhost:%s", s.net.ContainerByName(testnet.PrimaryON).Port(testnet.GRPCPort))
+	observerClient, err := getAccessAPIClient(observerURL)
+	s.Require().NoError(err)
+
+	// get the first block height
+	currentFinalized := s.BlockState.HighestFinalizedHeight()
+	blockA := s.BlockState.WaitForHighestFinalizedProgress(s.T(), currentFinalized)
+
+	// Let the network run for this many blocks
+	blockCount := uint64(5)
+	// wait for the requested number of sealed blocks
+	s.BlockState.WaitForSealed(s.T(), blockA.Header.Height+blockCount)
+
+	var startValue interface{}
+	txCount := 10
+
+	for _, rpc := range s.testedRPCs() {
+		s.T().Run(rpc.name, func(t *testing.T) {
+			if rpc.name == "SubscribeBlocksFromStartBlockID" {
+				startValue = convert.IdentifierToMessage(blockA.ID())
+			} else {
+				startValue = blockA.Header.Height
+			}
+
+			accessRecv := rpc.call(s.ctx, accessClient, startValue)
+			accessBlocks, accessBlockErrs, err := SubscribeHandler(s.ctx, accessRecv, blockResponseHandler)
+			s.Require().NoError(err)
+
+			observerRecv := rpc.call(s.ctx, observerClient, startValue)
+			observerBlocks, observerBlockErrs, err := SubscribeHandler(s.ctx, observerRecv, blockResponseHandler)
+			s.Require().NoError(err)
+
+			foundANTxCount := 0
+			foundONTxCount := 0
+
+			r := NewResponseTracker(compareBlocksResponse, 2)
+
+			for {
+				select {
+				case err := <-accessBlockErrs:
+					s.Require().NoErrorf(err, "unexpected AN error")
+				case err := <-observerBlockErrs:
+					s.Require().NoErrorf(err, "unexpected ON error")
+				case block := <-accessBlocks:
+					s.T().Logf("AN block received: height: %d", block.Header.Height)
+					r.Add(s.T(), block.Header.Height, "access", block)
+					foundANTxCount++
+				case block := <-observerBlocks:
+					s.T().Logf("ON block received: height: %d", block.Header.Height)
+					r.Add(s.T(), block.Header.Height, "observer", block)
+					foundONTxCount++
+				}
+
+				if foundANTxCount >= txCount && foundONTxCount >= txCount {
+					break
+				}
+			}
+
+			r.AssertAllResponsesHandled(t, txCount)
+		})
+	}
+}
+
+func blockResponseHandler(msg *accessproto.SubscribeBlocksResponse) (*flow.Block, error) {
+	return convert.MessageToBlock(msg.GetBlock())
+}
+
+func compareBlocksResponse(t *testing.T, responses map[uint64]map[string]*flow.Block, blockHeight uint64) error {
+	accessData := responses[blockHeight]["access"]
+	observerData := responses[blockHeight]["observer"]
+
+	// Compare access with observer
+	compareBlocks(t, accessData, observerData)
+
+	return nil
+}
+
+func compareBlocks(t *testing.T, accessBlock *flow.Block, observerBlock *flow.Block) {
+	require.Equal(t, accessBlock.ID(), observerBlock.ID())
+	require.Equal(t, accessBlock.Header.Height, observerBlock.Header.Height)
+	require.Equal(t, accessBlock.Header.Timestamp, observerBlock.Header.Timestamp)
+	require.Equal(t, accessBlock.Payload.Hash(), observerBlock.Payload.Hash())
+}
+
+type subscribeBlocksRPCTest struct {
+	name string
+	call func(ctx context.Context, client accessproto.AccessAPIClient, startValue interface{}) func() (*accessproto.SubscribeBlocksResponse, error)
+}
+
+func (s *GrpcBlocksStreamSuite) getRPCs() []subscribeBlocksRPCTest {
+	return []subscribeBlocksRPCTest{
+		{
+			name: "SubscribeBlocksFromLatest",
+			call: func(ctx context.Context, client accessproto.AccessAPIClient, _ interface{}) func() (*accessproto.SubscribeBlocksResponse, error) {
+				stream, err := client.SubscribeBlocksFromLatest(ctx, &accessproto.SubscribeBlocksFromLatestRequest{
+					BlockStatus:       entities.BlockStatus_BLOCK_FINALIZED,
+					FullBlockResponse: true,
+				})
+				s.Require().NoError(err)
+				return stream.Recv
+			},
+		},
+		{
+			name: "SubscribeBlocksFromStartBlockID",
+			call: func(ctx context.Context, client accessproto.AccessAPIClient, startValue interface{}) func() (*accessproto.SubscribeBlocksResponse, error) {
+				stream, err := client.SubscribeBlocksFromStartBlockID(ctx, &accessproto.SubscribeBlocksFromStartBlockIDRequest{
+					StartBlockId:      startValue.([]byte),
+					BlockStatus:       entities.BlockStatus_BLOCK_FINALIZED,
+					FullBlockResponse: true,
+				})
+				s.Require().NoError(err)
+				return stream.Recv
+			},
+		},
+		{
+			name: "SubscribeBlocksFromStartHeight",
+			call: func(ctx context.Context, client accessproto.AccessAPIClient, startValue interface{}) func() (*accessproto.SubscribeBlocksResponse, error) {
+				stream, err := client.SubscribeBlocksFromStartHeight(ctx, &accessproto.SubscribeBlocksFromStartHeightRequest{
+					StartBlockHeight:  startValue.(uint64),
+					BlockStatus:       entities.BlockStatus_BLOCK_FINALIZED,
+					FullBlockResponse: true,
+				})
+				s.Require().NoError(err)
+				return stream.Recv
+			},
+		},
+	}
+}
+
+func getAccessAPIClient(address string) (accessproto.AccessAPIClient, error) {
+	conn, err := grpc.Dial(address, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		return nil, err
+	}
+
+	return accessproto.NewAccessAPIClient(conn), nil
+}
diff --git a/integration/tests/collection/suite.go b/integration/tests/collection/suite.go
index 608f8cdf4fb..75ecda1854f 100644
--- a/integration/tests/collection/suite.go
+++ b/integration/tests/collection/suite.go
@@ -142,7 +142,7 @@ func (suite *CollectorSuite) Clusters() flow.ClusterList {
 	setup, ok := result.ServiceEvents[0].Event.(*flow.EpochSetup)
 	suite.Require().True(ok)
 
-	collectors := suite.net.Identities().Filter(filter.HasRole(flow.RoleCollection))
+	collectors := suite.net.Identities().Filter(filter.HasRole[flow.Identity](flow.RoleCollection)).ToSkeleton()
 	clusters, err := factory.NewClusterList(setup.Assignments, collectors)
 	suite.Require().Nil(err)
 	return clusters
@@ -170,7 +170,7 @@ func (suite *CollectorSuite) NextTransaction(opts ...func(*sdk.Transaction)) *sd
 	return tx
 }
 
-func (suite *CollectorSuite) TxForCluster(target flow.IdentityList) *sdk.Transaction {
+func (suite *CollectorSuite) TxForCluster(target flow.IdentitySkeletonList) *sdk.Transaction {
 	acct := suite.acct
 
 	tx := suite.NextTransaction()
@@ -331,7 +331,7 @@ func (suite *CollectorSuite) Collector(clusterIdx, nodeIdx uint) *testnet.Contai
 	node, ok := cluster.ByIndex(nodeIdx)
 	require.True(suite.T(), ok, "invalid node index")
 
-	return suite.net.ContainerByID(node.ID())
+	return suite.net.ContainerByID(node.NodeID)
 }
 
 // ClusterStateFor returns a cluster state instance for the collector node with the given ID.
diff --git a/integration/tests/epochs/base_suite.go b/integration/tests/epochs/base_suite.go
new file mode 100644
index 00000000000..2fb8200cc0a
--- /dev/null
+++ b/integration/tests/epochs/base_suite.go
@@ -0,0 +1,158 @@
+// Package epochs contains common functionality for the epoch integration test suite.
+// Individual tests exist in sub-directories of this: cohort1, cohort2...
+// Each cohort is run as a separate, sequential CI job. Since the epoch tests are long
+// and resource-heavy, we split them into several cohorts, which can be run in parallel.
+//
+// If a new cohort is added in the future, it must be added to:
+//   - ci.yml, flaky-test-monitor.yml, bors.toml (ensure new cohort of tests is run)
+//   - Makefile (include new cohort in integration-test directive, etc.)
+package epochs
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/onflow/flow-go/engine/ghost/client"
+	"github.com/onflow/flow-go/integration/testnet"
+	"github.com/onflow/flow-go/integration/tests/lib"
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+// BaseSuite encapsulates common functionality for epoch integration tests.
+type BaseSuite struct {
+	suite.Suite
+	lib.TestnetStateTracker
+	cancel  context.CancelFunc
+	log     zerolog.Logger
+	net     *testnet.FlowNetwork
+	ghostID flow.Identifier
+
+	Client *testnet.Client
+	Ctx    context.Context
+
+	// Epoch config (lengths in views)
+	StakingAuctionLen          uint64
+	DKGPhaseLen                uint64
+	EpochLen                   uint64
+	EpochCommitSafetyThreshold uint64
+	// Whether approvals are required for sealing (we only enable for VN tests because
+	// requiring approvals requires a longer DKG period to avoid flakiness)
+	RequiredSealApprovals uint // defaults to 0 (no approvals required)
+	// Consensus Node proposal duration
+	ConsensusProposalDuration time.Duration
+}
+
+// SetupTest is run automatically by the testing framework before each test case.
+func (s *BaseSuite) SetupTest() {
+	// If unset, use default value 100ms
+	if s.ConsensusProposalDuration == 0 {
+		s.ConsensusProposalDuration = time.Millisecond * 100
+	}
+
+	minEpochLength := s.StakingAuctionLen + s.DKGPhaseLen*3 + 20
+	// ensure epoch lengths are set correctly
+	require.Greater(s.T(), s.EpochLen, minEpochLength+s.EpochCommitSafetyThreshold, "epoch too short")
+
+	s.Ctx, s.cancel = context.WithCancel(context.Background())
+	s.log = unittest.LoggerForTest(s.Suite.T(), zerolog.InfoLevel)
+	s.log.Info().Msg("================> SetupTest")
+	defer func() {
+		s.log.Info().Msg("================> Finish SetupTest")
+	}()
+
+	collectionConfigs := []func(*testnet.NodeConfig){
+		testnet.WithAdditionalFlag("--hotstuff-proposal-duration=100ms"),
+		testnet.WithLogLevel(zerolog.WarnLevel)}
+
+	consensusConfigs := []func(config *testnet.NodeConfig){
+		testnet.WithAdditionalFlag(fmt.Sprintf("--cruise-ctl-fallback-proposal-duration=%s", s.ConsensusProposalDuration)),
+		testnet.WithAdditionalFlag("--cruise-ctl-enabled=false"), // disable cruise control for integration tests
+		testnet.WithAdditionalFlag(fmt.Sprintf("--required-verification-seal-approvals=%d", s.RequiredSealApprovals)),
+		testnet.WithAdditionalFlag(fmt.Sprintf("--required-construction-seal-approvals=%d", s.RequiredSealApprovals)),
+		testnet.WithLogLevel(zerolog.DebugLevel)}
+
+	// a ghost node masquerading as an access node
+	s.ghostID = unittest.IdentifierFixture()
+	ghostNode := testnet.NewNodeConfig(
+		flow.RoleAccess,
+		testnet.WithLogLevel(zerolog.FatalLevel),
+		testnet.WithID(s.ghostID),
+		testnet.AsGhost())
+
+	confs := []testnet.NodeConfig{
+		testnet.NewNodeConfig(flow.RoleAccess, testnet.WithLogLevel(zerolog.WarnLevel)),
+		testnet.NewNodeConfig(flow.RoleAccess, testnet.WithLogLevel(zerolog.WarnLevel)),
+		testnet.NewNodeConfig(flow.RoleCollection, collectionConfigs...),
+		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
+		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
+		testnet.NewNodeConfig(flow.RoleExecution, testnet.WithLogLevel(zerolog.WarnLevel), testnet.WithAdditionalFlag("--extensive-logging=true")),
+		testnet.NewNodeConfig(flow.RoleExecution, testnet.WithLogLevel(zerolog.WarnLevel)),
+		testnet.NewNodeConfig(flow.RoleVerification, testnet.WithLogLevel(zerolog.WarnLevel)),
+		ghostNode,
+	}
+
+	netConf := testnet.NewNetworkConfigWithEpochConfig("epochs-tests", confs, s.StakingAuctionLen, s.DKGPhaseLen, s.EpochLen, s.EpochCommitSafetyThreshold)
+
+	// initialize the network
+	s.net = testnet.PrepareFlowNetwork(s.T(), netConf, flow.Localnet)
+
+	// start the network
+	s.net.Start(s.Ctx)
+
+	// start tracking blocks
+	s.Track(s.T(), s.Ctx, s.Ghost())
+
+	// use AN1 for test-related queries - the AN join/leave test will replace AN2
+	client, err := s.net.ContainerByName(testnet.PrimaryAN).TestnetClient()
+	require.NoError(s.T(), err)
+
+	s.Client = client
+
+	// log network info periodically to aid in debugging future flaky tests
+	go lib.LogStatusPeriodically(s.T(), s.Ctx, s.log, s.Client, 5*time.Second)
+}
+
+func (s *BaseSuite) Ghost() *client.GhostClient {
+	client, err := s.net.ContainerByID(s.ghostID).GhostClient()
+	require.NoError(s.T(), err, "could not get ghost Client")
+	return client
+}
+
+// TimedLogf logs the message using t.Log and the suite logger, but prefixes the current time.
+// This enables viewing logs inline with Docker logs as well as other test logs.
+func (s *BaseSuite) TimedLogf(msg string, args ...interface{}) {
+	s.log.Info().Msgf(msg, args...)
+	args = append([]interface{}{time.Now().String()}, args...)
+	s.T().Logf("%s - "+msg, args...)
+}
+
+// AwaitEpochPhase waits for the given phase, in the given epoch.
+func (s *BaseSuite) AwaitEpochPhase(ctx context.Context, expectedEpoch uint64, expectedPhase flow.EpochPhase, waitFor, tick time.Duration) {
+	var actualEpoch uint64
+	var actualPhase flow.EpochPhase
+	condition := func() bool {
+		snapshot, err := s.Client.GetLatestProtocolSnapshot(ctx)
+		require.NoError(s.T(), err)
+
+		actualEpoch, err = snapshot.Epochs().Current().Counter()
+		require.NoError(s.T(), err)
+		actualPhase, err = snapshot.Phase()
+		require.NoError(s.T(), err)
+
+		return actualEpoch == expectedEpoch && actualPhase == expectedPhase
+	}
+	require.Eventuallyf(s.T(), condition, waitFor, tick, "did not reach expectedEpoch %d phase %s within %s. Last saw epoch=%d and phase=%s", expectedEpoch, expectedPhase, waitFor, actualEpoch, actualPhase)
+}
+
+// GetContainersByRole returns all containers from the network for the specified role, making sure the containers are not ghost nodes.
+func (s *BaseSuite) GetContainersByRole(role flow.Role) []*testnet.Container {
+	nodes := s.net.ContainersByRole(role, false)
+	require.True(s.T(), len(nodes) > 0)
+	return nodes
+}
diff --git a/integration/tests/epochs/cohort1/epoch_static_transition_test.go b/integration/tests/epochs/cohort1/epoch_static_transition_test.go
index ae1708f514e..6c8ab6d6d3c 100644
--- a/integration/tests/epochs/cohort1/epoch_static_transition_test.go
+++ b/integration/tests/epochs/cohort1/epoch_static_transition_test.go
@@ -18,7 +18,7 @@ func TestEpochStaticTransition(t *testing.T) {
 // StaticEpochTransitionSuite is the suite used for epoch transition tests
 // with a static identity table.
 type StaticEpochTransitionSuite struct {
-	epochs.Suite
+	epochs.DynamicEpochTransitionSuite
 }
 
 func (s *StaticEpochTransitionSuite) SetupTest() {
@@ -30,7 +30,7 @@ func (s *StaticEpochTransitionSuite) SetupTest() {
 	s.EpochCommitSafetyThreshold = 50
 
 	// run the generic setup, which starts up the network
-	s.Suite.SetupTest()
+	s.BaseSuite.SetupTest()
 }
 
 // TestStaticEpochTransition asserts epoch state transitions over full epoch
diff --git a/integration/tests/epochs/cohort2/epoch_join_and_leave_vn_test.go b/integration/tests/epochs/cohort2/epoch_join_and_leave_vn_test.go
index ed8f7ef1ae1..f94066eb14e 100644
--- a/integration/tests/epochs/cohort2/epoch_join_and_leave_vn_test.go
+++ b/integration/tests/epochs/cohort2/epoch_join_and_leave_vn_test.go
@@ -32,7 +32,7 @@ func (s *EpochJoinAndLeaveVNSuite) SetupTest() {
 	s.DKGPhaseLen = 100
 	s.EpochLen = 450
 	s.EpochCommitSafetyThreshold = 20
-	s.Suite.SetupTest()
+	s.BaseSuite.SetupTest()
 }
 
 // TestEpochJoinAndLeaveVN should update verification nodes and assert healthy network conditions
diff --git a/integration/tests/epochs/suite.go b/integration/tests/epochs/dynamic_epoch_transition_suite.go
similarity index 71%
rename from integration/tests/epochs/suite.go
rename to integration/tests/epochs/dynamic_epoch_transition_suite.go
index a11b1127958..192d931339f 100644
--- a/integration/tests/epochs/suite.go
+++ b/integration/tests/epochs/dynamic_epoch_transition_suite.go
@@ -14,21 +14,17 @@ import (
 	"strings"
 	"time"
 
-	"github.com/rs/zerolog"
-	"github.com/stretchr/testify/require"
-	"github.com/stretchr/testify/suite"
-
 	"github.com/onflow/cadence"
 	"github.com/onflow/crypto"
 	"github.com/onflow/flow-core-contracts/lib/go/templates"
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
 
 	sdk "github.com/onflow/flow-go-sdk"
 	sdkcrypto "github.com/onflow/flow-go-sdk/crypto"
 
-	"github.com/onflow/flow-go/engine/ghost/client"
 	"github.com/onflow/flow-go/fvm/blueprints"
 	"github.com/onflow/flow-go/integration/testnet"
-	"github.com/onflow/flow-go/integration/tests/lib"
 	"github.com/onflow/flow-go/integration/utils"
 	"github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/encodable"
@@ -44,118 +40,24 @@ import (
 // NOTE: The snapshot must reference a block within the second epoch.
 type nodeUpdateValidation func(ctx context.Context, env templates.Environment, snapshot *inmem.Snapshot, info *StakedNodeOperationInfo)
 
-// Suite encapsulates common functionality for epoch integration tests.
-type Suite struct {
-	suite.Suite
-	lib.TestnetStateTracker
-	cancel  context.CancelFunc
-	log     zerolog.Logger
-	net     *testnet.FlowNetwork
-	ghostID flow.Identifier
-
-	Client *testnet.Client
-	Ctx    context.Context
-
-	// Epoch config (lengths in views)
-	StakingAuctionLen          uint64
-	DKGPhaseLen                uint64
-	EpochLen                   uint64
-	EpochCommitSafetyThreshold uint64
-	// Whether approvals are required for sealing (we only enable for VN tests because
-	// requiring approvals requires a longer DKG period to avoid flakiness)
-	RequiredSealApprovals uint // defaults to 0 (no approvals required)
-	// Consensus Node proposal duration
-	ConsensusProposalDuration time.Duration
-}
-
-// SetupTest is run automatically by the testing framework before each test case.
-func (s *Suite) SetupTest() {
-	// If unset, use default value 100ms
-	if s.ConsensusProposalDuration == 0 {
-		s.ConsensusProposalDuration = time.Millisecond * 100
-	}
-
-	minEpochLength := s.StakingAuctionLen + s.DKGPhaseLen*3 + 20
-	// ensure epoch lengths are set correctly
-	require.Greater(s.T(), s.EpochLen, minEpochLength+s.EpochCommitSafetyThreshold, "epoch too short")
-
-	s.Ctx, s.cancel = context.WithCancel(context.Background())
-	s.log = unittest.LoggerForTest(s.Suite.T(), zerolog.InfoLevel)
-	s.log.Info().Msg("================> SetupTest")
-	defer func() {
-		s.log.Info().Msg("================> Finish SetupTest")
-	}()
-
-	collectionConfigs := []func(*testnet.NodeConfig){
-		testnet.WithAdditionalFlag("--hotstuff-proposal-duration=100ms"),
-		testnet.WithLogLevel(zerolog.WarnLevel)}
-
-	consensusConfigs := []func(config *testnet.NodeConfig){
-		testnet.WithAdditionalFlag(fmt.Sprintf("--cruise-ctl-fallback-proposal-duration=%s", s.ConsensusProposalDuration)),
-		testnet.WithAdditionalFlag(fmt.Sprintf("--required-verification-seal-approvals=%d", s.RequiredSealApprovals)),
-		testnet.WithAdditionalFlag(fmt.Sprintf("--required-construction-seal-approvals=%d", s.RequiredSealApprovals)),
-		testnet.WithLogLevel(zerolog.WarnLevel)}
-
-	// a ghost node masquerading as an access node
-	s.ghostID = unittest.IdentifierFixture()
-	ghostNode := testnet.NewNodeConfig(
-		flow.RoleAccess,
-		testnet.WithLogLevel(zerolog.FatalLevel),
-		testnet.WithID(s.ghostID),
-		testnet.AsGhost())
-
-	confs := []testnet.NodeConfig{
-		testnet.NewNodeConfig(flow.RoleAccess, testnet.WithLogLevel(zerolog.WarnLevel)),
-		testnet.NewNodeConfig(flow.RoleAccess, testnet.WithLogLevel(zerolog.WarnLevel)),
-		testnet.NewNodeConfig(flow.RoleCollection, collectionConfigs...),
-		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
-		testnet.NewNodeConfig(flow.RoleConsensus, consensusConfigs...),
-		testnet.NewNodeConfig(flow.RoleExecution, testnet.WithLogLevel(zerolog.WarnLevel), testnet.WithAdditionalFlag("--extensive-logging=true")),
-		testnet.NewNodeConfig(flow.RoleExecution, testnet.WithLogLevel(zerolog.WarnLevel)),
-		testnet.NewNodeConfig(flow.RoleVerification, testnet.WithLogLevel(zerolog.WarnLevel)),
-		ghostNode,
-	}
-
-	netConf := testnet.NewNetworkConfigWithEpochConfig("epochs-tests", confs, s.StakingAuctionLen, s.DKGPhaseLen, s.EpochLen, s.EpochCommitSafetyThreshold)
-
-	// initialize the network
-	s.net = testnet.PrepareFlowNetwork(s.T(), netConf, flow.Localnet)
-
-	// start the network
-	s.net.Start(s.Ctx)
-
-	// start tracking blocks
-	s.Track(s.T(), s.Ctx, s.Ghost())
-
-	// use AN1 for test-related queries - the AN join/leave test will replace AN2
-	client, err := s.net.ContainerByName(testnet.PrimaryAN).TestnetClient()
-	require.NoError(s.T(), err)
-
-	s.Client = client
-
-	// log network info periodically to aid in debugging future flaky tests
-	go lib.LogStatusPeriodically(s.T(), s.Ctx, s.log, s.Client, 5*time.Second)
-}
-
-func (s *Suite) Ghost() *client.GhostClient {
-	client, err := s.net.ContainerByID(s.ghostID).GhostClient()
-	require.NoError(s.T(), err, "could not get ghost Client")
-	return client
+// DynamicEpochTransitionSuite  is the suite used for epoch transitions tests
+// with a dynamic identity table.
+type DynamicEpochTransitionSuite struct {
+	BaseSuite
 }
 
-// TimedLogf logs the message using t.Log and the suite logger, but prefixes the current time.
-// This enables viewing logs inline with Docker logs as well as other test logs.
-func (s *Suite) TimedLogf(msg string, args ...interface{}) {
-	s.log.Info().Msgf(msg, args...)
-	args = append([]interface{}{time.Now().String()}, args...)
-	s.T().Logf("%s - "+msg, args...)
-}
+func (s *DynamicEpochTransitionSuite) SetupTest() {
+	// use a longer staking auction length to accommodate staking operations for joining/leaving nodes
+	// NOTE: this value is set fairly aggressively to ensure shorter test times.
+	// If flakiness due to failure to complete staking operations in time is observed,
+	// try increasing (by 10-20 views).
+	s.StakingAuctionLen = 50
+	s.DKGPhaseLen = 50
+	s.EpochLen = 250
+	s.EpochCommitSafetyThreshold = 20
 
-func (s *Suite) TearDownTest() {
-	s.log.Info().Msg("================> Start TearDownTest")
-	s.net.Remove()
-	s.cancel()
-	s.log.Info().Msg("================> Finish TearDownTest")
+	// run the generic setup, which starts up the network
+	s.BaseSuite.SetupTest()
 }
 
 // StakedNodeOperationInfo struct contains all the node information needed to
@@ -188,7 +90,7 @@ type StakedNodeOperationInfo struct {
 // NOTE 2: This function performs steps 1-6 in one custom transaction, to reduce
 // the time taken by each test case. Individual transactions for each step can be
 // found in Git history, for example: 9867056a8b7246655047bc457f9000398f6687c0.
-func (s *Suite) StakeNode(ctx context.Context, env templates.Environment, role flow.Role) *StakedNodeOperationInfo {
+func (s *DynamicEpochTransitionSuite) StakeNode(ctx context.Context, env templates.Environment, role flow.Role) *StakedNodeOperationInfo {
 
 	stakingAccountKey, networkingKey, stakingKey, machineAccountKey, machineAccountPubKey := s.generateAccountKeys(role)
 	nodeID := flow.MakeID(stakingKey.PublicKey().Encode())
@@ -256,7 +158,7 @@ func (s *Suite) StakeNode(ctx context.Context, env templates.Environment, role f
 }
 
 // generates initial keys needed to bootstrap account
-func (s *Suite) generateAccountKeys(role flow.Role) (
+func (s *DynamicEpochTransitionSuite) generateAccountKeys(role flow.Role) (
 	operatorAccountKey,
 	networkingKey,
 	stakingKey,
@@ -284,7 +186,7 @@ func (s *Suite) generateAccountKeys(role flow.Role) (
 
 // removeNodeFromProtocol removes the given node from the protocol.
 // NOTE: assumes staking occurs in first epoch (counter 0)
-func (s *Suite) removeNodeFromProtocol(ctx context.Context, env templates.Environment, nodeID flow.Identifier) {
+func (s *DynamicEpochTransitionSuite) removeNodeFromProtocol(ctx context.Context, env templates.Environment, nodeID flow.Identifier) {
 	result, err := s.submitAdminRemoveNodeTx(ctx, env, nodeID)
 	require.NoError(s.T(), err)
 	require.NoError(s.T(), result.Error)
@@ -294,7 +196,7 @@ func (s *Suite) removeNodeFromProtocol(ctx context.Context, env templates.Enviro
 }
 
 // submitAdminRemoveNodeTx will submit the admin remove node transaction
-func (s *Suite) submitAdminRemoveNodeTx(ctx context.Context,
+func (s *DynamicEpochTransitionSuite) submitAdminRemoveNodeTx(ctx context.Context,
 	env templates.Environment,
 	nodeID flow.Identifier,
 ) (*sdk.TransactionResult, error) {
@@ -319,14 +221,14 @@ func (s *Suite) submitAdminRemoveNodeTx(ctx context.Context,
 	return result, nil
 }
 
-func (s *Suite) ExecuteGetProposedTableScript(ctx context.Context, env templates.Environment, nodeID flow.Identifier) cadence.Value {
+func (s *DynamicEpochTransitionSuite) ExecuteGetProposedTableScript(ctx context.Context, env templates.Environment, nodeID flow.Identifier) cadence.Value {
 	v, err := s.Client.ExecuteScriptBytes(ctx, templates.GenerateReturnProposedTableScript(env), []cadence.Value{})
 	require.NoError(s.T(), err)
 	return v
 }
 
 // ExecuteGetNodeInfoScript executes a script to get staking info about the given node.
-func (s *Suite) ExecuteGetNodeInfoScript(ctx context.Context, env templates.Environment, nodeID flow.Identifier) cadence.Value {
+func (s *DynamicEpochTransitionSuite) ExecuteGetNodeInfoScript(ctx context.Context, env templates.Environment, nodeID flow.Identifier) cadence.Value {
 	cdcNodeID, err := cadence.NewString(nodeID.String())
 	require.NoError(s.T(), err)
 	v, err := s.Client.ExecuteScriptBytes(ctx, templates.GenerateGetNodeInfoScript(env), []cadence.Value{cdcNodeID})
@@ -335,7 +237,7 @@ func (s *Suite) ExecuteGetNodeInfoScript(ctx context.Context, env templates.Envi
 }
 
 // SubmitSetApprovedListTx adds a node to the approved node list, this must be done when a node joins the protocol during the epoch staking phase
-func (s *Suite) SubmitSetApprovedListTx(ctx context.Context, env templates.Environment, identities ...flow.Identifier) *sdk.TransactionResult {
+func (s *DynamicEpochTransitionSuite) SubmitSetApprovedListTx(ctx context.Context, env templates.Environment, identities ...flow.Identifier) *sdk.TransactionResult {
 	latestBlockID, err := s.Client.GetLatestBlockID(ctx)
 	require.NoError(s.T(), err)
 
@@ -361,7 +263,7 @@ func (s *Suite) SubmitSetApprovedListTx(ctx context.Context, env templates.Envir
 }
 
 // ExecuteReadApprovedNodesScript executes the return proposal table script and returns a list of approved nodes
-func (s *Suite) ExecuteReadApprovedNodesScript(ctx context.Context, env templates.Environment) cadence.Value {
+func (s *DynamicEpochTransitionSuite) ExecuteReadApprovedNodesScript(ctx context.Context, env templates.Environment) cadence.Value {
 	v, err := s.Client.ExecuteScriptBytes(ctx, templates.GenerateGetApprovedNodesScript(env), []cadence.Value{})
 	require.NoError(s.T(), err)
 
@@ -369,14 +271,14 @@ func (s *Suite) ExecuteReadApprovedNodesScript(ctx context.Context, env template
 }
 
 // getTestContainerName returns a name for a test container in the form of ${role}_${nodeID}_test
-func (s *Suite) getTestContainerName(role flow.Role) string {
-	i := len(s.net.ContainersByRole(role)) + 1
+func (s *DynamicEpochTransitionSuite) getTestContainerName(role flow.Role) string {
+	i := len(s.net.ContainersByRole(role, false)) + 1
 	return fmt.Sprintf("%s_test_%d", role, i)
 }
 
 // assertNodeApprovedAndProposed executes the read approved nodes list and get proposed table scripts
 // and checks that the info.NodeID is in both list
-func (s *Suite) assertNodeApprovedAndProposed(ctx context.Context, env templates.Environment, info *StakedNodeOperationInfo) {
+func (s *DynamicEpochTransitionSuite) assertNodeApprovedAndProposed(ctx context.Context, env templates.Environment, info *StakedNodeOperationInfo) {
 	// ensure node ID in approved list
 	//approvedNodes := s.ExecuteReadApprovedNodesScript(Ctx, env)
 	//require.Containsf(s.T(), approvedNodes.(cadence.Array).Values, cadence.String(info.NodeID.String()), "expected new node to be in approved nodes list: %x", info.NodeID)
@@ -394,7 +296,7 @@ func (s *Suite) assertNodeApprovedAndProposed(ctx context.Context, env templates
 }
 
 // newTestContainerOnNetwork configures a new container on the suites network
-func (s *Suite) newTestContainerOnNetwork(role flow.Role, info *StakedNodeOperationInfo) *testnet.Container {
+func (s *DynamicEpochTransitionSuite) newTestContainerOnNetwork(role flow.Role, info *StakedNodeOperationInfo) *testnet.Container {
 	containerConfigs := []func(config *testnet.NodeConfig){
 		testnet.WithLogLevel(zerolog.WarnLevel),
 		testnet.WithID(info.NodeID),
@@ -416,10 +318,8 @@ func (s *Suite) newTestContainerOnNetwork(role flow.Role, info *StakedNodeOperat
 		nodeContainer.AddFlag("insecure-access-api", "false")
 
 		accessNodeIDS := make([]string, 0)
-		for _, c := range s.net.ContainersByRole(flow.RoleAccess) {
-			if c.Config.Role == flow.RoleAccess && !c.Config.Ghost {
-				accessNodeIDS = append(accessNodeIDS, c.Config.NodeID.String())
-			}
+		for _, c := range s.net.ContainersByRole(flow.RoleAccess, false) {
+			accessNodeIDS = append(accessNodeIDS, c.Config.NodeID.String())
 		}
 		nodeContainer.AddFlag("access-node-ids", strings.Join(accessNodeIDS, ","))
 	}
@@ -428,7 +328,7 @@ func (s *Suite) newTestContainerOnNetwork(role flow.Role, info *StakedNodeOperat
 }
 
 // StakeNewNode will stake a new node, and create the corresponding docker container for that node
-func (s *Suite) StakeNewNode(ctx context.Context, env templates.Environment, role flow.Role) (*StakedNodeOperationInfo, *testnet.Container) {
+func (s *DynamicEpochTransitionSuite) StakeNewNode(ctx context.Context, env templates.Environment, role flow.Role) (*StakedNodeOperationInfo, *testnet.Container) {
 	// stake our new node
 	info := s.StakeNode(ctx, env, role)
 
@@ -441,40 +341,27 @@ func (s *Suite) StakeNewNode(ctx context.Context, env templates.Environment, rol
 	return info, testContainer
 }
 
-// getContainerToReplace return a container from the network, make sure the container is not a ghost
-func (s *Suite) getContainerToReplace(role flow.Role) *testnet.Container {
-	nodes := s.net.ContainersByRole(role)
-	require.True(s.T(), len(nodes) > 0)
-
-	for _, c := range nodes {
-		if !c.Config.Ghost {
-			return c
-		}
-	}
-
-	return nil
+// AwaitFinalizedView polls until it observes that the latest finalized block has a view
+// greater than or equal to the input view. This is used to wait until when an epoch
+// transition must have happened.
+func (s *DynamicEpochTransitionSuite) AwaitFinalizedView(ctx context.Context, view uint64, waitFor, tick time.Duration) {
+	require.Eventually(s.T(), func() bool {
+		sealed := s.getLatestFinalizedHeader(ctx)
+		return sealed.View >= view
+	}, waitFor, tick)
 }
 
-// AwaitEpochPhase waits for the given phase, in the given epoch.
-func (s *Suite) AwaitEpochPhase(ctx context.Context, expectedEpoch uint64, expectedPhase flow.EpochPhase, waitFor, tick time.Duration) {
-	var actualEpoch uint64
-	var actualPhase flow.EpochPhase
-	condition := func() bool {
-		snapshot, err := s.Client.GetLatestProtocolSnapshot(ctx)
-		require.NoError(s.T(), err)
-
-		actualEpoch, err = snapshot.Epochs().Current().Counter()
-		require.NoError(s.T(), err)
-		actualPhase, err = snapshot.Phase()
-		require.NoError(s.T(), err)
-
-		return actualEpoch == expectedEpoch && actualPhase == expectedPhase
-	}
-	require.Eventuallyf(s.T(), condition, waitFor, tick, "did not reach expectedEpoch %d phase %s within %s. Last saw epoch=%d and phase=%s", expectedEpoch, expectedPhase, waitFor, actualEpoch, actualPhase)
+// getLatestFinalizedHeader retrieves the latest finalized block, as reported in LatestSnapshot.
+func (s *DynamicEpochTransitionSuite) getLatestFinalizedHeader(ctx context.Context) *flow.Header {
+	snapshot, err := s.Client.GetLatestProtocolSnapshot(ctx)
+	require.NoError(s.T(), err)
+	finalized, err := snapshot.Head()
+	require.NoError(s.T(), err)
+	return finalized
 }
 
 // AssertInEpochPhase checks if we are in the phase of the given epoch.
-func (s *Suite) AssertInEpochPhase(ctx context.Context, expectedEpoch uint64, expectedPhase flow.EpochPhase) {
+func (s *DynamicEpochTransitionSuite) AssertInEpochPhase(ctx context.Context, expectedEpoch uint64, expectedPhase flow.EpochPhase) {
 	snapshot, err := s.Client.GetLatestProtocolSnapshot(ctx)
 	require.NoError(s.T(), err)
 	actualEpoch, err := snapshot.Epochs().Current().Counter()
@@ -490,7 +377,7 @@ func (s *Suite) AssertInEpochPhase(ctx context.Context, expectedEpoch uint64, ex
 }
 
 // AssertInEpoch requires actual epoch counter is equal to counter provided.
-func (s *Suite) AssertInEpoch(ctx context.Context, expectedEpoch uint64) {
+func (s *DynamicEpochTransitionSuite) AssertInEpoch(ctx context.Context, expectedEpoch uint64) {
 	snapshot, err := s.Client.GetLatestProtocolSnapshot(ctx)
 	require.NoError(s.T(), err)
 	actualEpoch, err := snapshot.Epochs().Current().Counter()
@@ -500,7 +387,7 @@ func (s *Suite) AssertInEpoch(ctx context.Context, expectedEpoch uint64) {
 
 // AssertNodeNotParticipantInEpoch asserts that the given node ID does not exist
 // in the epoch's identity table.
-func (s *Suite) AssertNodeNotParticipantInEpoch(epoch protocol.Epoch, nodeID flow.Identifier) {
+func (s *DynamicEpochTransitionSuite) AssertNodeNotParticipantInEpoch(epoch protocol.Epoch, nodeID flow.Identifier) {
 	identities, err := epoch.InitialIdentities()
 	require.NoError(s.T(), err)
 	require.NotContains(s.T(), identities.NodeIDs(), nodeID)
@@ -509,7 +396,7 @@ func (s *Suite) AssertNodeNotParticipantInEpoch(epoch protocol.Epoch, nodeID flo
 // AwaitSealedBlockHeightExceedsSnapshot polls until it observes that the latest
 // sealed block height has exceeded the snapshot height by numOfBlocks
 // the snapshot height and latest finalized height is greater than numOfBlocks.
-func (s *Suite) AwaitSealedBlockHeightExceedsSnapshot(ctx context.Context, snapshot *inmem.Snapshot, threshold uint64, waitFor, tick time.Duration) {
+func (s *DynamicEpochTransitionSuite) AwaitSealedBlockHeightExceedsSnapshot(ctx context.Context, snapshot *inmem.Snapshot, threshold uint64, waitFor, tick time.Duration) {
 	header, err := snapshot.Head()
 	require.NoError(s.T(), err)
 	snapshotHeight := header.Height
@@ -521,18 +408,8 @@ func (s *Suite) AwaitSealedBlockHeightExceedsSnapshot(ctx context.Context, snaps
 	}, waitFor, tick)
 }
 
-// AwaitFinalizedView polls until it observes that the latest finalized block has a view
-// greater than or equal to the input view. This is used to wait until when an epoch
-// transition must have happened.
-func (s *Suite) AwaitFinalizedView(ctx context.Context, view uint64, waitFor, tick time.Duration) {
-	require.Eventually(s.T(), func() bool {
-		sealed := s.getLatestFinalizedHeader(ctx)
-		return sealed.View >= view
-	}, waitFor, tick)
-}
-
 // getLatestSealedHeader retrieves the latest sealed block, as reported in LatestSnapshot.
-func (s *Suite) getLatestSealedHeader(ctx context.Context) *flow.Header {
+func (s *DynamicEpochTransitionSuite) getLatestSealedHeader(ctx context.Context) *flow.Header {
 	snapshot, err := s.Client.GetLatestProtocolSnapshot(ctx)
 	require.NoError(s.T(), err)
 	segment, err := snapshot.SealingSegment()
@@ -541,18 +418,9 @@ func (s *Suite) getLatestSealedHeader(ctx context.Context) *flow.Header {
 	return sealed.Header
 }
 
-// getLatestFinalizedHeader retrieves the latest finalized block, as reported in LatestSnapshot.
-func (s *Suite) getLatestFinalizedHeader(ctx context.Context) *flow.Header {
-	snapshot, err := s.Client.GetLatestProtocolSnapshot(ctx)
-	require.NoError(s.T(), err)
-	finalized, err := snapshot.Head()
-	require.NoError(s.T(), err)
-	return finalized
-}
-
 // SubmitSmokeTestTransaction will submit a create account transaction to smoke test network
 // This ensures a single transaction can be sealed by the network.
-func (s *Suite) SubmitSmokeTestTransaction(ctx context.Context) {
+func (s *DynamicEpochTransitionSuite) SubmitSmokeTestTransaction(ctx context.Context) {
 	_, err := utils.CreateFlowAccount(ctx, s.Client)
 	require.NoError(s.T(), err)
 }
@@ -564,7 +432,7 @@ func (s *Suite) SubmitSmokeTestTransaction(ctx context.Context) {
 //  3. Check that we can execute a script on the AN
 //
 // TODO test sending and observing result of a transaction via the new AN (blocked by https://github.com/onflow/flow-go/issues/3642)
-func (s *Suite) AssertNetworkHealthyAfterANChange(ctx context.Context, env templates.Environment, snapshotInSecondEpoch *inmem.Snapshot, info *StakedNodeOperationInfo) {
+func (s *DynamicEpochTransitionSuite) AssertNetworkHealthyAfterANChange(ctx context.Context, env templates.Environment, snapshotInSecondEpoch *inmem.Snapshot, info *StakedNodeOperationInfo) {
 
 	// get snapshot directly from new AN and compare head with head from the
 	// snapshot that was used to bootstrap the node
@@ -585,14 +453,14 @@ func (s *Suite) AssertNetworkHealthyAfterANChange(ctx context.Context, env templ
 // AssertNetworkHealthyAfterVNChange performs a basic network health check after replacing a verification node.
 //  1. Ensure sealing continues into the second epoch (post-replacement) by observing
 //     at least 10 blocks of sealing progress within the epoch
-func (s *Suite) AssertNetworkHealthyAfterVNChange(ctx context.Context, _ templates.Environment, snapshotInSecondEpoch *inmem.Snapshot, _ *StakedNodeOperationInfo) {
+func (s *DynamicEpochTransitionSuite) AssertNetworkHealthyAfterVNChange(ctx context.Context, _ templates.Environment, snapshotInSecondEpoch *inmem.Snapshot, _ *StakedNodeOperationInfo) {
 	s.AwaitSealedBlockHeightExceedsSnapshot(ctx, snapshotInSecondEpoch, 10, 30*time.Second, time.Millisecond*100)
 }
 
 // AssertNetworkHealthyAfterLNChange performs a basic network health check after replacing a collection node.
 //  1. Submit transaction to network that will target the newly staked LN by making
 //     sure the reference block ID is after the first epoch.
-func (s *Suite) AssertNetworkHealthyAfterLNChange(ctx context.Context, _ templates.Environment, _ *inmem.Snapshot, _ *StakedNodeOperationInfo) {
+func (s *DynamicEpochTransitionSuite) AssertNetworkHealthyAfterLNChange(ctx context.Context, _ templates.Environment, _ *inmem.Snapshot, _ *StakedNodeOperationInfo) {
 	// At this point we have reached the second epoch and our new LN is the only LN in the network.
 	// To validate the LN joined the network successfully and is processing transactions we create
 	// an account, which submits a transaction and verifies it is sealed.
@@ -608,7 +476,7 @@ func (s *Suite) AssertNetworkHealthyAfterLNChange(ctx context.Context, _ templat
 // therefore the newly joined consensus node must be participating in consensus.
 //
 // In addition, here, we submit a transaction and verify that it is sealed.
-func (s *Suite) AssertNetworkHealthyAfterSNChange(ctx context.Context, _ templates.Environment, _ *inmem.Snapshot, _ *StakedNodeOperationInfo) {
+func (s *DynamicEpochTransitionSuite) AssertNetworkHealthyAfterSNChange(ctx context.Context, _ templates.Environment, _ *inmem.Snapshot, _ *StakedNodeOperationInfo) {
 	s.SubmitSmokeTestTransaction(ctx)
 }
 
@@ -620,7 +488,7 @@ func (s *Suite) AssertNetworkHealthyAfterSNChange(ctx context.Context, _ templat
 // * that nodes can stake and join the network at an epoch boundary
 // * that nodes can unstake and leave the network at an epoch boundary
 // * role-specific network health validation after the swap has completed
-func (s *Suite) RunTestEpochJoinAndLeave(role flow.Role, checkNetworkHealth nodeUpdateValidation) {
+func (s *DynamicEpochTransitionSuite) RunTestEpochJoinAndLeave(role flow.Role, checkNetworkHealth nodeUpdateValidation) {
 
 	env := utils.LocalnetEnv()
 
@@ -632,7 +500,7 @@ func (s *Suite) RunTestEpochJoinAndLeave(role flow.Role, checkNetworkHealth node
 		require.NotNil(s.T(), containerToReplace)
 	} else {
 		// grab the first container of this node role type, this is the container we will replace
-		containerToReplace = s.getContainerToReplace(role)
+		containerToReplace = s.GetContainersByRole(role)[0]
 		require.NotNil(s.T(), containerToReplace)
 	}
 
@@ -693,23 +561,3 @@ func (s *Suite) RunTestEpochJoinAndLeave(role flow.Role, checkNetworkHealth node
 	// make sure the network is healthy after adding new node
 	checkNetworkHealth(s.Ctx, env, secondEpochSnapshot, info)
 }
-
-// DynamicEpochTransitionSuite  is the suite used for epoch transitions tests
-// with a dynamic identity table.
-type DynamicEpochTransitionSuite struct {
-	Suite
-}
-
-func (s *DynamicEpochTransitionSuite) SetupTest() {
-	// use a longer staking auction length to accommodate staking operations for joining/leaving nodes
-	// NOTE: this value is set fairly aggressively to ensure shorter test times.
-	// If flakiness due to failure to complete staking operations in time is observed,
-	// try increasing (by 10-20 views).
-	s.StakingAuctionLen = 50
-	s.DKGPhaseLen = 50
-	s.EpochLen = 250
-	s.EpochCommitSafetyThreshold = 20
-
-	// run the generic setup, which starts up the network
-	s.Suite.SetupTest()
-}
diff --git a/integration/tests/epochs/recover_epoch/recover_epoch_efm_test.go b/integration/tests/epochs/recover_epoch/recover_epoch_efm_test.go
new file mode 100644
index 00000000000..6de2caaba21
--- /dev/null
+++ b/integration/tests/epochs/recover_epoch/recover_epoch_efm_test.go
@@ -0,0 +1,34 @@
+package recover_epoch
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/suite"
+
+	"github.com/onflow/flow-go/model/flow"
+)
+
+func TestRecoverEpoch(t *testing.T) {
+	suite.Run(t, new(RecoverEpochSuite))
+}
+
+type RecoverEpochSuite struct {
+	Suite
+}
+
+// TestRecoverEpoch ensures that the recover_epoch transaction flow works as expected. This test will simulate the network going
+// into EFM by taking a consensus node offline before completing the DKG. While in EFM mode the test will execute the efm-recover-tx-args
+// CLI command to generate transaction arguments to submit a recover_epoch transaction, after submitting the transaction the test will
+// ensure the network is healthy.
+func (s *RecoverEpochSuite) TestRecoverEpoch() {
+	s.AwaitEpochPhase(context.Background(), 0, flow.EpochPhaseSetup, 20*time.Second, time.Second)
+	fmt.Println("in epoch phase setup")
+
+	sns := s.GetContainersByRole(flow.RoleConsensus)
+	_ = sns[0].Pause()
+
+	// @TODO: trigger EFM manually
+}
diff --git a/integration/tests/epochs/recover_epoch/suite.go b/integration/tests/epochs/recover_epoch/suite.go
new file mode 100644
index 00000000000..49e5a3ace58
--- /dev/null
+++ b/integration/tests/epochs/recover_epoch/suite.go
@@ -0,0 +1,21 @@
+package recover_epoch
+
+import (
+	"github.com/onflow/flow-go/integration/tests/epochs"
+)
+
+// Suite encapsulates common functionality for epoch integration tests.
+type Suite struct {
+	epochs.BaseSuite
+}
+
+func (s *Suite) SetupTest() {
+	// use a shorter staking auction because we don't have staking operations in this case
+	s.StakingAuctionLen = 2
+	s.DKGPhaseLen = 50
+	s.EpochLen = 250
+	s.EpochCommitSafetyThreshold = 20
+
+	// run the generic setup, which starts up the network
+	s.BaseSuite.SetupTest()
+}
diff --git a/integration/tests/lib/testnet_state_tracker.go b/integration/tests/lib/testnet_state_tracker.go
index 5036ac1f373..f00553d27a7 100644
--- a/integration/tests/lib/testnet_state_tracker.go
+++ b/integration/tests/lib/testnet_state_tracker.go
@@ -109,6 +109,11 @@ func (tst *TestnetStateTracker) Track(t *testing.T, ctx context.Context, ghost *
 					finalState,
 					m.ExecutionResult.ID(),
 					len(m.ExecutionResult.Chunks))
+			case *messages.ChunkDataResponse:
+				// consuming this explicitly to avoid logging full msg which is usually very large because of proof
+				t.Logf("%x chunk data pack received from %x\n",
+					m.ChunkDataPack.ChunkID,
+					sender)
 
 			default:
 				t.Logf("%v other msg received from %s: %T\n", time.Now().UTC(), sender, msg)
diff --git a/integration/tests/mvp/mvp_test.go b/integration/tests/mvp/mvp_test.go
index 777043e836c..fc18372c3c5 100644
--- a/integration/tests/mvp/mvp_test.go
+++ b/integration/tests/mvp/mvp_test.go
@@ -81,14 +81,14 @@ func TestMVP_Bootstrap(t *testing.T) {
 	flowNetwork.RemoveContainers()
 
 	// pick 1 consensus node to restart with empty database and downloaded snapshot
-	cons := flowNetwork.Identities().Filter(filter.HasRole(flow.RoleConsensus))
+	cons := flowNetwork.Identities().Filter(filter.HasRole[flow.Identity](flow.RoleConsensus))
 	random, err := rand.Uintn(uint(len(cons)))
 	require.NoError(t, err)
 	con1 := cons[random]
 
 	t.Log("@@ booting from non-root state on consensus node ", con1.NodeID)
 
-	flowNetwork.DropDBs(filter.HasNodeID(con1.NodeID))
+	flowNetwork.DropDBs(filter.HasNodeID[flow.Identity](con1.NodeID))
 	con1Container := flowNetwork.ContainerByID(con1.NodeID)
 	con1Container.DropDB()
 	con1Container.WriteRootSnapshot(snapshot)
diff --git a/integration/utils/temp_dep_test.go b/integration/utils/temp_dep_test.go
new file mode 100644
index 00000000000..05fc5b87e1f
--- /dev/null
+++ b/integration/utils/temp_dep_test.go
@@ -0,0 +1,8 @@
+package utils
+
+import "github.com/btcsuite/btcd/chaincfg/chainhash"
+
+// this is added to resolve the issue with chainhash ambiguous import,
+// the code is not used, but it's needed to force go.mod to specify and retain chainhash version
+// workaround for issue: https://github.com/golang/go/issues/27899
+var _ = chainhash.Hash{}
diff --git a/ledger/complete/compactor.go b/ledger/complete/compactor.go
index ef603900af1..a08a36d2232 100644
--- a/ledger/complete/compactor.go
+++ b/ledger/complete/compactor.go
@@ -13,6 +13,7 @@ import (
 	"github.com/onflow/flow-go/ledger"
 	"github.com/onflow/flow-go/ledger/complete/mtrie/trie"
 	realWAL "github.com/onflow/flow-go/ledger/complete/wal"
+	"github.com/onflow/flow-go/module"
 	"github.com/onflow/flow-go/module/lifecycle"
 	"github.com/onflow/flow-go/module/observable"
 )
@@ -57,6 +58,7 @@ type Compactor struct {
 	stopCh                               chan chan struct{}
 	trieUpdateCh                         <-chan *WALTrieUpdate
 	triggerCheckpointOnNextSegmentFinish *atomic.Bool // to trigger checkpoint manually
+	metrics                              module.WALMetrics
 }
 
 // NewCompactor creates new Compactor which writes WAL record and triggers
@@ -76,6 +78,7 @@ func NewCompactor(
 	checkpointDistance uint,
 	checkpointsToKeep uint,
 	triggerCheckpointOnNextSegmentFinish *atomic.Bool,
+	metrics module.WALMetrics,
 ) (*Compactor, error) {
 	if checkpointDistance < 1 {
 		checkpointDistance = 1
@@ -114,6 +117,7 @@ func NewCompactor(
 		checkpointDistance:                   checkpointDistance,
 		checkpointsToKeep:                    checkpointsToKeep,
 		triggerCheckpointOnNextSegmentFinish: triggerCheckpointOnNextSegmentFinish,
+		metrics:                              metrics,
 	}, nil
 }
 
@@ -288,7 +292,7 @@ Loop:
 // Since this function is only for checkpointing, Compactor isn't affected by returned error.
 func (c *Compactor) checkpoint(ctx context.Context, tries []*trie.MTrie, checkpointNum int) error {
 
-	err := createCheckpoint(c.checkpointer, c.logger, tries, checkpointNum)
+	err := createCheckpoint(c.checkpointer, c.logger, tries, checkpointNum, c.metrics)
 	if err != nil {
 		return &createCheckpointError{num: checkpointNum, err: err}
 	}
@@ -325,7 +329,7 @@ func (c *Compactor) checkpoint(ctx context.Context, tries []*trie.MTrie, checkpo
 // createCheckpoint creates checkpoint with given checkpointNum and tries.
 // Errors indicate that checkpoint file can't be created.
 // Caller should handle returned errors by retrying checkpointing when appropriate.
-func createCheckpoint(checkpointer *realWAL.Checkpointer, logger zerolog.Logger, tries []*trie.MTrie, checkpointNum int) error {
+func createCheckpoint(checkpointer *realWAL.Checkpointer, logger zerolog.Logger, tries []*trie.MTrie, checkpointNum int, metrics module.WALMetrics) error {
 
 	logger.Info().Msgf("serializing checkpoint %d with %v tries", checkpointNum, len(tries))
 
@@ -337,6 +341,13 @@ func createCheckpoint(checkpointer *realWAL.Checkpointer, logger zerolog.Logger,
 		return fmt.Errorf("error serializing checkpoint (%d): %w", checkpointNum, err)
 	}
 
+	size, err := realWAL.ReadCheckpointFileSize(checkpointer.Dir(), fileName)
+	if err != nil {
+		return fmt.Errorf("error reading checkpoint file size (%d): %w", checkpointNum, err)
+	}
+
+	metrics.ExecutionCheckpointSize(size)
+
 	duration := time.Since(startTime)
 	logger.Info().Float64("total_time_s", duration.Seconds()).Msgf("created checkpoint %d", checkpointNum)
 
diff --git a/ledger/complete/compactor_test.go b/ledger/complete/compactor_test.go
index e06eff54ec1..15cf89a446f 100644
--- a/ledger/complete/compactor_test.go
+++ b/ledger/complete/compactor_test.go
@@ -90,7 +90,7 @@ func TestCompactorCreation(t *testing.T) {
 			// WAL segments are 32kB, so here we generate 2 keys 64kB each, times `size`
 			// so we should get at least `size` segments
 
-			compactor, err := NewCompactor(l, wal, unittest.Logger(), forestCapacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+			compactor, err := NewCompactor(l, wal, unittest.Logger(), forestCapacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 			require.NoError(t, err)
 
 			co := CompactorObserver{fromBound: 8, done: make(chan struct{})}
@@ -316,7 +316,7 @@ func TestCompactorSkipCheckpointing(t *testing.T) {
 		// WAL segments are 32kB, so here we generate 2 keys 64kB each, times `size`
 		// so we should get at least `size` segments
 
-		compactor, err := NewCompactor(l, wal, unittest.Logger(), forestCapacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+		compactor, err := NewCompactor(l, wal, unittest.Logger(), forestCapacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 		require.NoError(t, err)
 
 		co := CompactorObserver{fromBound: 8, done: make(chan struct{})}
@@ -442,7 +442,7 @@ func TestCompactorAccuracy(t *testing.T) {
 			l, err := NewLedger(wal, forestCapacity, metricsCollector, zerolog.Logger{}, DefaultPathFinderVersion)
 			require.NoError(t, err)
 
-			compactor, err := NewCompactor(l, wal, unittest.Logger(), forestCapacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+			compactor, err := NewCompactor(l, wal, unittest.Logger(), forestCapacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 			require.NoError(t, err)
 
 			fromBound := lastCheckpointNum + (size / 2)
@@ -552,7 +552,7 @@ func TestCompactorTriggeredByAdminTool(t *testing.T) {
 		l, err := NewLedger(wal, forestCapacity, metricsCollector, unittest.LoggerWithName("ledger"), DefaultPathFinderVersion)
 		require.NoError(t, err)
 
-		compactor, err := NewCompactor(l, wal, unittest.LoggerWithName("compactor"), forestCapacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(true))
+		compactor, err := NewCompactor(l, wal, unittest.LoggerWithName("compactor"), forestCapacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(true), metrics.NewNoopCollector())
 		require.NoError(t, err)
 
 		fmt.Println("should stop as soon as segment 5 is generated, which should trigger checkpoint 5 to be created")
@@ -656,7 +656,7 @@ func TestCompactorConcurrency(t *testing.T) {
 		l, err := NewLedger(wal, forestCapacity, metricsCollector, zerolog.Logger{}, DefaultPathFinderVersion)
 		require.NoError(t, err)
 
-		compactor, err := NewCompactor(l, wal, unittest.Logger(), forestCapacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+		compactor, err := NewCompactor(l, wal, unittest.Logger(), forestCapacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 		require.NoError(t, err)
 
 		fromBound := lastCheckpointNum + (size / 2 * numGoroutine)
@@ -816,7 +816,7 @@ func replaySegments(
 	updateFn func(update *ledger.TrieUpdate) error,
 	deleteFn func(rootHash ledger.RootHash) error,
 ) error {
-	sr, err := prometheusWAL.NewSegmentsRangeReader(prometheusWAL.SegmentRange{
+	sr, err := prometheusWAL.NewSegmentsRangeReader(unittest.Logger(), prometheusWAL.SegmentRange{
 		Dir:   dir,
 		First: 0,
 		Last:  to,
diff --git a/ledger/complete/ledger_benchmark_test.go b/ledger/complete/ledger_benchmark_test.go
index 6c0855be914..a97257ac2a6 100644
--- a/ledger/complete/ledger_benchmark_test.go
+++ b/ledger/complete/ledger_benchmark_test.go
@@ -47,7 +47,7 @@ func benchmarkStorage(steps int, b *testing.B) {
 	led, err := complete.NewLedger(diskWal, steps+1, &metrics.NoopCollector{}, zerolog.Logger{}, complete.DefaultPathFinderVersion)
 	require.NoError(b, err)
 
-	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), uint(steps+1), checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), uint(steps+1), checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 	require.NoError(b, err)
 
 	<-compactor.Ready()
@@ -160,7 +160,7 @@ func BenchmarkTrieUpdate(b *testing.B) {
 	led, err := complete.NewLedger(diskWal, capacity, &metrics.NoopCollector{}, zerolog.Logger{}, complete.DefaultPathFinderVersion)
 	require.NoError(b, err)
 
-	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 	require.NoError(b, err)
 
 	<-compactor.Ready()
@@ -212,7 +212,7 @@ func BenchmarkTrieRead(b *testing.B) {
 	led, err := complete.NewLedger(diskWal, capacity, &metrics.NoopCollector{}, zerolog.Logger{}, complete.DefaultPathFinderVersion)
 	require.NoError(b, err)
 
-	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 	require.NoError(b, err)
 
 	<-compactor.Ready()
@@ -273,7 +273,7 @@ func BenchmarkLedgerGetOneValue(b *testing.B) {
 	led, err := complete.NewLedger(diskWal, capacity, &metrics.NoopCollector{}, zerolog.Logger{}, complete.DefaultPathFinderVersion)
 	require.NoError(b, err)
 
-	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 	require.NoError(b, err)
 
 	<-compactor.Ready()
@@ -351,7 +351,7 @@ func BenchmarkTrieProve(b *testing.B) {
 	led, err := complete.NewLedger(diskWal, capacity, &metrics.NoopCollector{}, zerolog.Logger{}, complete.DefaultPathFinderVersion)
 	require.NoError(b, err)
 
-	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+	compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 	require.NoError(b, err)
 
 	<-compactor.Ready()
diff --git a/ledger/complete/ledger_test.go b/ledger/complete/ledger_test.go
index b0685fb7ef4..f429aa851f4 100644
--- a/ledger/complete/ledger_test.go
+++ b/ledger/complete/ledger_test.go
@@ -514,7 +514,7 @@ func Test_WAL(t *testing.T) {
 		led, err := complete.NewLedger(diskWal, size, metricsCollector, logger, complete.DefaultPathFinderVersion)
 		require.NoError(t, err)
 
-		compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), size, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+		compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), size, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 		require.NoError(t, err)
 
 		<-compactor.Ready()
@@ -551,7 +551,7 @@ func Test_WAL(t *testing.T) {
 		led2, err := complete.NewLedger(diskWal2, size+10, metricsCollector, logger, complete.DefaultPathFinderVersion)
 		require.NoError(t, err)
 
-		compactor2, err := complete.NewCompactor(led2, diskWal2, zerolog.Nop(), uint(size), checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+		compactor2, err := complete.NewCompactor(led2, diskWal2, zerolog.Nop(), uint(size), checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 		require.NoError(t, err)
 
 		<-compactor2.Ready()
@@ -613,7 +613,7 @@ func TestLedgerFunctionality(t *testing.T) {
 			require.NoError(t, err)
 			led, err := complete.NewLedger(diskWal, activeTries, metricsCollector, logger, complete.DefaultPathFinderVersion)
 			assert.NoError(t, err)
-			compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), uint(activeTries), checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+			compactor, err := complete.NewCompactor(led, diskWal, zerolog.Nop(), uint(activeTries), checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 			require.NoError(t, err)
 			<-compactor.Ready()
 
@@ -730,7 +730,7 @@ func TestWALUpdateFailuresBubbleUp(t *testing.T) {
 		led, err := complete.NewLedger(w, capacity, &metrics.NoopCollector{}, zerolog.Logger{}, complete.DefaultPathFinderVersion)
 		require.NoError(t, err)
 
-		compactor, err := complete.NewCompactor(led, w, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+		compactor, err := complete.NewCompactor(led, w, zerolog.Nop(), capacity, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 		require.NoError(t, err)
 
 		<-compactor.Ready()
diff --git a/ledger/complete/mtrie/trie/trie.go b/ledger/complete/mtrie/trie/trie.go
index 7f03e3558bd..064e7f157e3 100644
--- a/ledger/complete/mtrie/trie/trie.go
+++ b/ledger/complete/mtrie/trie/trie.go
@@ -78,7 +78,7 @@ func (mt *MTrie) AllocatedRegCount() uint64 {
 	return mt.regCount
 }
 
-// AllocatedRegSize returns the size of allocated registers in the trie.
+// AllocatedRegSize returns the size (number of bytes) of allocated registers in the trie.
 // Concurrency safe (as Tries are immutable structures by convention)
 func (mt *MTrie) AllocatedRegSize() uint64 {
 	return mt.regSize
diff --git a/ledger/complete/wal/checkpoint_v6_reader.go b/ledger/complete/wal/checkpoint_v6_reader.go
index 2b8f626d80c..8408b2a1683 100644
--- a/ledger/complete/wal/checkpoint_v6_reader.go
+++ b/ledger/complete/wal/checkpoint_v6_reader.go
@@ -20,7 +20,17 @@ import (
 // ErrEOFNotReached for indicating end of file not reached error
 var ErrEOFNotReached = errors.New("expect to reach EOF, but actually didn't")
 
-var ReadTriesRootHash = readTriesRootHash
+func ReadTriesRootHash(logger zerolog.Logger, dir string, fileName string) (
+	[]ledger.RootHash,
+	error,
+) {
+	err := validateCheckpointFile(logger, dir, fileName)
+	if err != nil {
+		return nil, err
+	}
+	return readTriesRootHash(logger, dir, fileName)
+}
+
 var CheckpointHasRootHash = checkpointHasRootHash
 
 // readCheckpointV6 reads checkpoint file from a main file and 17 file parts.
@@ -105,6 +115,34 @@ func OpenAndReadCheckpointV6(dir string, fileName string, logger zerolog.Logger)
 	return triesToReturn, errToReturn
 }
 
+// ReadCheckpointFileSize returns the total size of the checkpoint file
+func ReadCheckpointFileSize(dir string, fileName string) (uint64, error) {
+	paths := allFilePaths(dir, fileName)
+	totalSize := uint64(0)
+	for _, path := range paths {
+		fileInfo, err := os.Stat(path)
+		if err != nil {
+			return 0, fmt.Errorf("could not get file info for %v: %w", path, err)
+		}
+
+		totalSize += uint64(fileInfo.Size())
+	}
+
+	return totalSize, nil
+}
+
+func allFilePaths(dir string, fileName string) []string {
+	paths := make([]string, 0, 1+subtrieCount+1)
+	paths = append(paths, filePathCheckpointHeader(dir, fileName))
+	for i := 0; i < subtrieCount; i++ {
+		subTriePath, _, _ := filePathSubTries(dir, fileName, i)
+		paths = append(paths, subTriePath)
+	}
+	topTriePath, _ := filePathTopTries(dir, fileName)
+	paths = append(paths, topTriePath)
+	return paths
+}
+
 func filePathCheckpointHeader(dir string, fileName string) string {
 	return path.Join(dir, fileName)
 }
@@ -820,3 +858,58 @@ func ensureReachedEOF(reader io.Reader) error {
 
 	return fmt.Errorf("fail to check if reached EOF: %w", err)
 }
+
+func validateCheckpointFile(logger zerolog.Logger, dir, fileName string) error {
+	headerPath := filePathCheckpointHeader(dir, fileName)
+	// validate header file
+	subtrieChecksums, topTrieChecksum, err := readCheckpointHeader(headerPath, logger)
+	if err != nil {
+		return err
+	}
+
+	// validate subtrie files
+	for index, expectedSum := range subtrieChecksums {
+		filepath, _, err := filePathSubTries(dir, fileName, index)
+		if err != nil {
+			return err
+		}
+		err = withFile(logger, filepath, func(f *os.File) error {
+			_, checksum, err := readSubTriesFooter(f)
+			if err != nil {
+				return fmt.Errorf("cannot read sub trie node count: %w", err)
+			}
+
+			if checksum != expectedSum {
+				return fmt.Errorf("mismatch checksum in subtrie file. checksum from checkpoint header %v does not "+
+					"match with the checksum in subtrie file %v", checksum, expectedSum)
+			}
+			return nil
+		})
+
+		if err != nil {
+			return err
+		}
+	}
+
+	// validate top trie file
+	filepath, _ := filePathTopTries(dir, fileName)
+	err = withFile(logger, filepath, func(file *os.File) error {
+		// read subtrie Node count and validate
+		_, _, checkSum, err := readTopTriesFooter(file)
+		if err != nil {
+			return err
+		}
+
+		if topTrieChecksum != checkSum {
+			return fmt.Errorf("mismatch top trie checksum, header file has %v, toptrie file has %v",
+				topTrieChecksum, checkSum)
+		}
+
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/ledger/complete/wal/checkpoint_v6_test.go b/ledger/complete/wal/checkpoint_v6_test.go
index 1bf95e17419..ded3acf3e13 100644
--- a/ledger/complete/wal/checkpoint_v6_test.go
+++ b/ledger/complete/wal/checkpoint_v6_test.go
@@ -608,6 +608,33 @@ func TestReadCheckpointRootHash(t *testing.T) {
 	})
 }
 
+func TestReadCheckpointRootHashValidateChecksum(t *testing.T) {
+	unittest.RunWithTempDir(t, func(dir string) {
+		tries := createSimpleTrie(t)
+		fileName := "checkpoint"
+		logger := unittest.Logger()
+		require.NoErrorf(t, StoreCheckpointV6Concurrently(tries, dir, fileName, logger), "fail to store checkpoint")
+
+		// add a wrong checksum to top trie file
+		topTrieFilePath, _ := filePathTopTries(dir, fileName)
+		file, err := os.OpenFile(topTrieFilePath, os.O_RDWR, 0644)
+		require.NoError(t, err)
+
+		fileInfo, err := file.Stat()
+		require.NoError(t, err)
+		fileSize := fileInfo.Size()
+
+		invalidSum := encodeCRC32Sum(10)
+		_, err = file.WriteAt(invalidSum, fileSize-crc32SumSize)
+		require.NoError(t, err)
+		require.NoError(t, file.Close())
+
+		// ReadTriesRootHash will first validate the checksum and detect the error
+		_, err = ReadTriesRootHash(logger, dir, fileName)
+		require.Error(t, err)
+	})
+}
+
 func TestReadCheckpointRootHashMulti(t *testing.T) {
 	unittest.RunWithTempDir(t, func(dir string) {
 		tries := createMultipleRandomTries(t)
diff --git a/ledger/complete/wal/checkpoint_v6_writer.go b/ledger/complete/wal/checkpoint_v6_writer.go
index 93f97151b0e..5c420b8842d 100644
--- a/ledger/complete/wal/checkpoint_v6_writer.go
+++ b/ledger/complete/wal/checkpoint_v6_writer.go
@@ -10,6 +10,7 @@ import (
 	"path"
 	"path/filepath"
 
+	"github.com/docker/go-units"
 	"github.com/hashicorp/go-multierror"
 	"github.com/rs/zerolog"
 
@@ -79,8 +80,10 @@ func storeCheckpointV6(
 	lg.Info().
 		Str("first_hash", first.RootHash().String()).
 		Uint64("first_reg_count", first.AllocatedRegCount()).
+		Str("first_reg_size", units.BytesSize(float64(first.AllocatedRegSize()))).
 		Str("last_hash", last.RootHash().String()).
 		Uint64("last_reg_count", last.AllocatedRegCount()).
+		Str("last_reg_size", units.BytesSize(float64(last.AllocatedRegSize()))).
 		Msg("storing checkpoint")
 
 	// make sure a checkpoint file with same name doesn't exist
diff --git a/ledger/complete/wal/checkpointer.go b/ledger/complete/wal/checkpointer.go
index 1c6aaa0aef3..601651eb64e 100644
--- a/ledger/complete/wal/checkpointer.go
+++ b/ledger/complete/wal/checkpointer.go
@@ -13,6 +13,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/docker/go-units"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"golang.org/x/sync/errgroup"
@@ -30,9 +31,12 @@ import (
 
 const checkpointFilenamePrefix = "checkpoint."
 
-const MagicBytesCheckpointHeader uint16 = 0x2137
-const MagicBytesCheckpointSubtrie uint16 = 0x2136
-const MagicBytesCheckpointToptrie uint16 = 0x2135
+const (
+	MagicBytesCheckpointHeader  uint16 = 0x2137
+	MagicBytesCheckpointSubtrie uint16 = 0x2136
+	MagicBytesCheckpointToptrie uint16 = 0x2135
+	MagicBytesPayloadHeader     uint16 = 0x2138
+)
 
 const VersionV1 uint16 = 0x01
 
@@ -252,7 +256,14 @@ func (c *Checkpointer) Checkpoint(to int) (err error) {
 		return fmt.Errorf("could not create checkpoint for %v: %w", to, err)
 	}
 
-	c.wal.log.Info().Msgf("created checkpoint %d with %d tries", to, len(tries))
+	checkpointFileSize, err := ReadCheckpointFileSize(c.wal.dir, fileName)
+	if err != nil {
+		return fmt.Errorf("could not read checkpoint file size: %w", err)
+	}
+
+	c.wal.log.Info().
+		Str("checkpoint_file_size", units.BytesSize(float64(checkpointFileSize))).
+		Msgf("created checkpoint %d with %d tries", to, len(tries))
 
 	return nil
 }
diff --git a/ledger/complete/wal/checkpointer_test.go b/ledger/complete/wal/checkpointer_test.go
index a0a828748d3..dd46ffdb85e 100644
--- a/ledger/complete/wal/checkpointer_test.go
+++ b/ledger/complete/wal/checkpointer_test.go
@@ -59,7 +59,7 @@ func Test_WAL(t *testing.T) {
 		led, err := complete.NewLedger(diskWal, size*10, metricsCollector, logger, complete.DefaultPathFinderVersion)
 		require.NoError(t, err)
 
-		compactor, err := complete.NewCompactor(led, diskWal, unittest.Logger(), size, checkpointDistance, checkpointsToKeep, atomic.NewBool(false))
+		compactor, err := complete.NewCompactor(led, diskWal, unittest.Logger(), size, checkpointDistance, checkpointsToKeep, atomic.NewBool(false), metrics.NewNoopCollector())
 		require.NoError(t, err)
 
 		<-compactor.Ready()
diff --git a/ledger/complete/wal/wal.go b/ledger/complete/wal/wal.go
index 8471079680f..4f8d04082c2 100644
--- a/ledger/complete/wal/wal.go
+++ b/ledger/complete/wal/wal.go
@@ -262,7 +262,7 @@ func (w *DiskWAL) replay(
 		Int("loaded_checkpoint", loadedCheckpoint).
 		Msgf("replaying segments from %d to %d", startSegment, to)
 
-	sr, err := prometheusWAL.NewSegmentsRangeReader(prometheusWAL.SegmentRange{
+	sr, err := prometheusWAL.NewSegmentsRangeReader(w.log, prometheusWAL.SegmentRange{
 		Dir:   w.wal.Dir(),
 		First: startSegment,
 		Last:  to,
diff --git a/model/bootstrap/filenames.go b/model/bootstrap/filenames.go
index 8933aa31563..8da9f564fd4 100644
--- a/model/bootstrap/filenames.go
+++ b/model/bootstrap/filenames.go
@@ -23,8 +23,9 @@ var (
 	DirnameRootBlockVotes     = filepath.Join(DirnamePublicBootstrap, "root-block-votes")
 	FileNamePartnerWeights    = "partner-weights.json"
 
-	PathRootBlockData             = filepath.Join(DirnamePublicBootstrap, "root-block.json")
-	PathRootProtocolStateSnapshot = filepath.Join(DirnamePublicBootstrap, "root-protocol-state-snapshot.json")
+	PathRootBlockData                 = filepath.Join(DirnamePublicBootstrap, "root-block.json")
+	PathIntermediaryBootstrappingData = filepath.Join(DirnamePublicBootstrap, "intermediary-bootstrapping-data.json")
+	PathRootProtocolStateSnapshot     = filepath.Join(DirnamePublicBootstrap, "root-protocol-state-snapshot.json")
 
 	FilenameWALRootCheckpoint = "root.checkpoint"
 	PathRootCheckpoint        = filepath.Join(DirnameExecutionState, FilenameWALRootCheckpoint) // only available on an execution node
diff --git a/model/bootstrap/node_info.go b/model/bootstrap/node_info.go
index d47ec559781..12b35fabe86 100644
--- a/model/bootstrap/node_info.go
+++ b/model/bootstrap/node_info.go
@@ -360,12 +360,17 @@ func (node NodeInfo) PartnerPublic() PartnerNodeInfoPub {
 // Identity returns the node info as a public Flow identity.
 func (node NodeInfo) Identity() *flow.Identity {
 	identity := &flow.Identity{
-		NodeID:        node.NodeID,
-		Address:       node.Address,
-		Role:          node.Role,
-		Weight:        node.Weight,
-		StakingPubKey: node.StakingPubKey(),
-		NetworkPubKey: node.NetworkPubKey(),
+		IdentitySkeleton: flow.IdentitySkeleton{
+			NodeID:        node.NodeID,
+			Address:       node.Address,
+			Role:          node.Role,
+			InitialWeight: node.Weight,
+			StakingPubKey: node.stakingPubKey,
+			NetworkPubKey: node.networkPubKey,
+		},
+		DynamicIdentity: flow.DynamicIdentity{
+			EpochParticipationStatus: flow.EpochParticipationStatusActive,
+		},
 	}
 	return identity
 }
@@ -376,7 +381,7 @@ func NodeInfoFromIdentity(identity *flow.Identity) NodeInfo {
 		identity.NodeID,
 		identity.Role,
 		identity.Address,
-		identity.Weight,
+		identity.InitialWeight,
 		identity.NetworkPubKey,
 		identity.StakingPubKey)
 }
@@ -386,7 +391,7 @@ func PrivateNodeInfoFromIdentity(identity *flow.Identity, networkKey, stakingKey
 		identity.NodeID,
 		identity.Role,
 		identity.Address,
-		identity.Weight,
+		identity.InitialWeight,
 		networkKey,
 		stakingKey,
 	)
@@ -403,10 +408,10 @@ func FilterByRole(nodes []NodeInfo, role flow.Role) []NodeInfo {
 	return filtered
 }
 
-// Sort sorts the NodeInfo list using the given order.
+// Sort sorts the NodeInfo list using the given ordering.
 //
 // The sorted list is returned and the original list is untouched.
-func Sort(nodes []NodeInfo, order flow.IdentityOrder) []NodeInfo {
+func Sort(nodes []NodeInfo, order flow.IdentityOrder[flow.Identity]) []NodeInfo {
 	dup := make([]NodeInfo, len(nodes))
 	copy(dup, nodes)
 	slices.SortFunc(dup, func(i, j NodeInfo) int {
diff --git a/model/bootstrap/node_info_test.go b/model/bootstrap/node_info_test.go
index b00f6cd986a..635826dd43c 100644
--- a/model/bootstrap/node_info_test.go
+++ b/model/bootstrap/node_info_test.go
@@ -25,7 +25,7 @@ func TestIdentityListCanonical(t *testing.T) {
 	nodesCopy := make([]bootstrap.NodeInfo, len(nodes))
 	copy(nodesCopy, nodes)
 
-	sortedNodes := bootstrap.Sort(nodes, flow.Canonical)
+	sortedNodes := bootstrap.Sort(nodes, flow.Canonical[flow.Identity])
 	sortedIds := bootstrap.ToIdentityList(sortedNodes)
 	require.True(t, flow.IsIdentityListCanonical(sortedIds))
 	// make sure original list didn't change
@@ -34,7 +34,7 @@ func TestIdentityListCanonical(t *testing.T) {
 	// check `IsIdentityListCanonical` detects order equality in a sorted list
 	nodes[1] = nodes[10] // add a duplication
 	copy(nodesCopy, nodes)
-	sortedNodes = bootstrap.Sort(nodes, flow.Canonical)
+	sortedNodes = bootstrap.Sort(nodes, flow.Canonical[flow.Identity])
 	sortedIds = bootstrap.ToIdentityList(sortedNodes)
 	assert.False(t, flow.IsIdentityListCanonical(sortedIds))
 	// make sure original list didn't change
diff --git a/model/chainsync/range.go b/model/chainsync/range.go
index 98d970641e1..0294593a485 100644
--- a/model/chainsync/range.go
+++ b/model/chainsync/range.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package chainsync
 
 import "github.com/onflow/flow-go/model/flow"
diff --git a/model/convert/fixtures_test.go b/model/convert/fixtures_test.go
index 7ebcd21277c..73cc2ca4e26 100644
--- a/model/convert/fixtures_test.go
+++ b/model/convert/fixtures_test.go
@@ -43,14 +43,14 @@ func EpochSetupFixture(chain flow.ChainID) (flow.Event, *flow.EpochSetup) {
 				flow.MustHexStringToIdentifier("0000000000000000000000000000000000000000000000000000000000000004"),
 			},
 		},
-		Participants: flow.IdentityList{
+		Participants: flow.IdentitySkeletonList{
 			{
 				Role:          flow.RoleCollection,
 				NodeID:        flow.MustHexStringToIdentifier("0000000000000000000000000000000000000000000000000000000000000001"),
 				Address:       "1.flow.com",
 				NetworkPubKey: unittest.MustDecodePublicKeyHex(crypto.ECDSAP256, "378dbf45d85c614feb10d8bd4f78f4b6ef8eec7d987b937e123255444657fb3da031f232a507e323df3a6f6b8f50339c51d188e80c0e7a92420945cc6ca893fc"),
 				StakingPubKey: unittest.MustDecodePublicKeyHex(crypto.BLSBLS12381, "af4aade26d76bb2ab15dcc89adcef82a51f6f04b3cb5f4555214b40ec89813c7a5f95776ea4fe449de48166d0bbc59b919b7eabebaac9614cf6f9461fac257765415f4d8ef1376a2365ec9960121888ea5383d88a140c24c29962b0a14e4e4e7"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 			{
 				Role:          flow.RoleCollection,
@@ -58,7 +58,7 @@ func EpochSetupFixture(chain flow.ChainID) (flow.Event, *flow.EpochSetup) {
 				Address:       "2.flow.com",
 				NetworkPubKey: unittest.MustDecodePublicKeyHex(crypto.ECDSAP256, "378dbf45d85c614feb10d8bd4f78f4b6ef8eec7d987b937e123255444657fb3da031f232a507e323df3a6f6b8f50339c51d188e80c0e7a92420945cc6ca893fc"),
 				StakingPubKey: unittest.MustDecodePublicKeyHex(crypto.BLSBLS12381, "af4aade26d76bb2ab15dcc89adcef82a51f6f04b3cb5f4555214b40ec89813c7a5f95776ea4fe449de48166d0bbc59b919b7eabebaac9614cf6f9461fac257765415f4d8ef1376a2365ec9960121888ea5383d88a140c24c29962b0a14e4e4e7"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 			{
 				Role:          flow.RoleCollection,
@@ -66,7 +66,7 @@ func EpochSetupFixture(chain flow.ChainID) (flow.Event, *flow.EpochSetup) {
 				Address:       "3.flow.com",
 				NetworkPubKey: unittest.MustDecodePublicKeyHex(crypto.ECDSAP256, "378dbf45d85c614feb10d8bd4f78f4b6ef8eec7d987b937e123255444657fb3da031f232a507e323df3a6f6b8f50339c51d188e80c0e7a92420945cc6ca893fc"),
 				StakingPubKey: unittest.MustDecodePublicKeyHex(crypto.BLSBLS12381, "af4aade26d76bb2ab15dcc89adcef82a51f6f04b3cb5f4555214b40ec89813c7a5f95776ea4fe449de48166d0bbc59b919b7eabebaac9614cf6f9461fac257765415f4d8ef1376a2365ec9960121888ea5383d88a140c24c29962b0a14e4e4e7"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 			{
 				Role:          flow.RoleCollection,
@@ -74,7 +74,7 @@ func EpochSetupFixture(chain flow.ChainID) (flow.Event, *flow.EpochSetup) {
 				Address:       "4.flow.com",
 				NetworkPubKey: unittest.MustDecodePublicKeyHex(crypto.ECDSAP256, "378dbf45d85c614feb10d8bd4f78f4b6ef8eec7d987b937e123255444657fb3da031f232a507e323df3a6f6b8f50339c51d188e80c0e7a92420945cc6ca893fc"),
 				StakingPubKey: unittest.MustDecodePublicKeyHex(crypto.BLSBLS12381, "af4aade26d76bb2ab15dcc89adcef82a51f6f04b3cb5f4555214b40ec89813c7a5f95776ea4fe449de48166d0bbc59b919b7eabebaac9614cf6f9461fac257765415f4d8ef1376a2365ec9960121888ea5383d88a140c24c29962b0a14e4e4e7"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 			{
 				Role:          flow.RoleConsensus,
@@ -82,7 +82,7 @@ func EpochSetupFixture(chain flow.ChainID) (flow.Event, *flow.EpochSetup) {
 				Address:       "11.flow.com",
 				NetworkPubKey: unittest.MustDecodePublicKeyHex(crypto.ECDSAP256, "cfdfe8e4362c8f79d11772cb7277ab16e5033a63e8dd5d34caf1b041b77e5b2d63c2072260949ccf8907486e4cfc733c8c42ca0e4e208f30470b0d950856cd47"),
 				StakingPubKey: unittest.MustDecodePublicKeyHex(crypto.BLSBLS12381, "8207559cd7136af378bba53a8f0196dee3849a3ab02897c1995c3e3f6ca0c4a776c3ae869d1ddbb473090054be2400ad06d7910aa2c5d1780220fdf3765a3c1764bce10c6fe66a5a2be51a422e878518bd750424bb56b8a0ecf0f8ad2057e83f"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 			{
 				Role:          flow.RoleExecution,
@@ -90,7 +90,7 @@ func EpochSetupFixture(chain flow.ChainID) (flow.Event, *flow.EpochSetup) {
 				Address:       "21.flow.com",
 				NetworkPubKey: unittest.MustDecodePublicKeyHex(crypto.ECDSAP256, "d64318ba0dbf68f3788fc81c41d507c5822bf53154530673127c66f50fe4469ccf1a054a868a9f88506a8999f2386d86fcd2b901779718cba4fb53c2da258f9e"),
 				StakingPubKey: unittest.MustDecodePublicKeyHex(crypto.BLSBLS12381, "880b162b7ec138b36af401d07868cb08d25746d905395edbb4625bdf105d4bb2b2f4b0f4ae273a296a6efefa7ce9ccb914e39947ce0e83745125cab05d62516076ff0173ed472d3791ccef937597c9ea12381d76f547a092a4981d77ff3fba83"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 			{
 				Role:          flow.RoleVerification,
@@ -98,7 +98,7 @@ func EpochSetupFixture(chain flow.ChainID) (flow.Event, *flow.EpochSetup) {
 				Address:       "31.flow.com",
 				NetworkPubKey: unittest.MustDecodePublicKeyHex(crypto.ECDSAP256, "697241208dcc9142b6f53064adc8ff1c95760c68beb2ba083c1d005d40181fd7a1b113274e0163c053a3addd47cd528ec6a1f190cf465aac87c415feaae011ae"),
 				StakingPubKey: unittest.MustDecodePublicKeyHex(crypto.BLSBLS12381, "b1f97d0a06020eca97352e1adde72270ee713c7daf58da7e74bf72235321048b4841bdfc28227964bf18e371e266e32107d238358848bcc5d0977a0db4bda0b4c33d3874ff991e595e0f537c7b87b4ddce92038ebc7b295c9ea20a1492302aa7"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 		},
 	}
diff --git a/model/convert/service_event.go b/model/convert/service_event.go
index a414b2c60b3..e7b137af2cd 100644
--- a/model/convert/service_event.go
+++ b/model/convert/service_event.go
@@ -12,7 +12,6 @@ import (
 
 	"github.com/onflow/flow-go/fvm/systemcontracts"
 	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/model/flow/assignment"
 )
 
 // ServiceEvent converts a service event encoded as the generic flow.Event
@@ -37,8 +36,10 @@ func ServiceEvent(chainID flow.ChainID, event flow.Event) (*flow.ServiceEvent, e
 
 // convertServiceEventEpochSetup converts a service event encoded as the generic
 // flow.Event type to a ServiceEvent type for an EpochSetup event
+// CONVENTION: in the returned `EpochSetup` event,
+//   - Node identities listed in `EpochSetup.Participants` are in CANONICAL ORDER
+//   - for each cluster assignment (i.e. element in `EpochSetup.Assignments`), the nodeIDs are listed in CANONICAL ORDER
 func convertServiceEventEpochSetup(event flow.Event) (*flow.ServiceEvent, error) {
-
 	// decode bytes using ccf
 	payload, err := ccf.Decode(nil, event.Payload)
 	if err != nil {
@@ -51,7 +52,7 @@ func convertServiceEventEpochSetup(event flow.Event) (*flow.ServiceEvent, error)
 		return nil, invalidCadenceTypeError("payload", payload, cadence.Event{})
 	}
 
-	const expectedFieldCount = 9
+	const expectedFieldCount = 11
 	if len(cdcEvent.Fields) < expectedFieldCount {
 		return nil, fmt.Errorf(
 			"insufficient fields in EpochSetup event (%d < %d)",
@@ -75,6 +76,9 @@ func convertServiceEventEpochSetup(event flow.Event) (*flow.ServiceEvent, error)
 	var dkgPhase3FinalView cadence.UInt64
 	var cdcClusters cadence.Array
 	var cdcParticipants cadence.Array
+	var targetDuration cadence.UInt64    // Epoch duration [seconds]
+	var targetEndTimeUnix cadence.UInt64 // Unix time [seconds]
+
 	var foundFieldCount int
 
 	evt := cdcEvent.Type().(*cadence.EventType)
@@ -147,6 +151,28 @@ func convertServiceEventEpochSetup(event flow.Event) (*flow.ServiceEvent, error)
 				)
 			}
 
+		case "targetDuration":
+			foundFieldCount++
+			targetDuration, ok = cdcEvent.Fields[i].(cadence.UInt64)
+			if !ok {
+				return nil, invalidCadenceTypeError(
+					"targetDuration",
+					cdcEvent.Fields[i],
+					cadence.UInt64(0),
+				)
+			}
+
+		case "targetEndTime":
+			foundFieldCount++
+			targetEndTimeUnix, ok = cdcEvent.Fields[i].(cadence.UInt64)
+			if !ok {
+				return nil, invalidCadenceTypeError(
+					"targetEndTime",
+					cdcEvent.Fields[i],
+					cadence.UInt64(0),
+				)
+			}
+
 		case "DKGPhase1FinalView":
 			foundFieldCount++
 			dkgPhase1FinalView, ok = cdcEvent.Fields[i].(cadence.UInt64)
@@ -197,6 +223,8 @@ func convertServiceEventEpochSetup(event flow.Event) (*flow.ServiceEvent, error)
 		DKGPhase1FinalView: uint64(dkgPhase1FinalView),
 		DKGPhase2FinalView: uint64(dkgPhase2FinalView),
 		DKGPhase3FinalView: uint64(dkgPhase3FinalView),
+		TargetDuration:     uint64(targetDuration),
+		TargetEndTime:      uint64(targetEndTimeUnix),
 	}
 
 	// random source from the event must be a hex string
@@ -218,13 +246,13 @@ func convertServiceEventEpochSetup(event flow.Event) (*flow.ServiceEvent, error)
 		)
 	}
 
-	// parse cluster assignments
+	// parse cluster assignments; returned assignments are in canonical order
 	setup.Assignments, err = convertClusterAssignments(cdcClusters.Values)
 	if err != nil {
 		return nil, fmt.Errorf("could not convert cluster assignments: %w", err)
 	}
 
-	// parse epoch participants
+	// parse epoch participants; returned node identities are in canonical order
 	setup.Participants, err = convertParticipants(cdcParticipants.Values)
 	if err != nil {
 		return nil, fmt.Errorf("could not convert participants: %w", err)
@@ -242,7 +270,6 @@ func convertServiceEventEpochSetup(event flow.Event) (*flow.ServiceEvent, error)
 // convertServiceEventEpochCommit converts a service event encoded as the generic
 // flow.Event type to a ServiceEvent type for an EpochCommit event
 func convertServiceEventEpochCommit(event flow.Event) (*flow.ServiceEvent, error) {
-
 	// decode bytes using ccf
 	payload, err := ccf.Decode(nil, event.Payload)
 	if err != nil {
@@ -352,15 +379,14 @@ func convertServiceEventEpochCommit(event flow.Event) (*flow.ServiceEvent, error
 // convertClusterAssignments converts the Cadence representation of cluster
 // assignments included in the EpochSetup into the protocol AssignmentList
 // representation.
+// CONVENTION: for each cluster assignment (i.e. element in `AssignmentList`), the nodeIDs are listed in CANONICAL ORDER
 func convertClusterAssignments(cdcClusters []cadence.Value) (flow.AssignmentList, error) {
-
 	// ensure we don't have duplicate cluster indices
 	indices := make(map[uint]struct{})
 
 	// parse cluster assignments to Go types
-	identifierLists := make([]flow.IdentifierList, len(cdcClusters))
+	clusterAssignments := make([]flow.IdentifierList, len(cdcClusters))
 	for _, value := range cdcClusters {
-
 		cdcCluster, ok := value.(cadence.Struct)
 		if !ok {
 			return nil, invalidCadenceTypeError("cluster", cdcCluster, cadence.Struct{})
@@ -434,8 +460,8 @@ func convertClusterAssignments(cdcClusters []cadence.Value) (flow.AssignmentList
 		}
 
 		// read weights to retrieve node IDs of cdcCluster members
+		clusterMembers := make(flow.IdentifierList, 0, len(weightsByNodeID.Pairs))
 		for _, pair := range weightsByNodeID.Pairs {
-
 			nodeIDString, ok := pair.Key.(cadence.String)
 			if !ok {
 				return nil, invalidCadenceTypeError(
@@ -451,26 +477,25 @@ func convertClusterAssignments(cdcClusters []cadence.Value) (flow.AssignmentList
 					err,
 				)
 			}
-
-			identifierLists[clusterIndex] = append(identifierLists[clusterIndex], nodeID)
+			clusterMembers = append(clusterMembers, nodeID)
 		}
-	}
 
-	// sort identifier lists in Canonical order
-	assignments := assignment.FromIdentifierLists(identifierLists)
+		// IMPORTANT: for each cluster, node IDs must be in *canonical order*
+		clusterAssignments[clusterIndex] = clusterMembers.Sort(flow.IdentifierCanonical)
+	}
 
-	return assignments, nil
+	return clusterAssignments, nil
 }
 
 // convertParticipants converts the network participants specified in the
 // EpochSetup event into an IdentityList.
-func convertParticipants(cdcParticipants []cadence.Value) (flow.IdentityList, error) {
-
-	participants := make(flow.IdentityList, 0, len(cdcParticipants))
+// CONVENTION: returned IdentityList is in CANONICAL ORDER
+func convertParticipants(cdcParticipants []cadence.Value) (flow.IdentitySkeletonList, error) {
+	participants := make(flow.IdentitySkeletonList, 0, len(cdcParticipants))
 	var err error
 
 	for _, value := range cdcParticipants {
-
+		// checking compliance with expected format
 		cdcNodeInfoStruct, ok := value.(cadence.Struct)
 		if !ok {
 			return nil, invalidCadenceTypeError(
@@ -479,7 +504,6 @@ func convertParticipants(cdcParticipants []cadence.Value) (flow.IdentityList, er
 				cadence.Struct{},
 			)
 		}
-
 		const expectedFieldCount = 14
 		if len(cdcNodeInfoStruct.Fields) < expectedFieldCount {
 			return nil, fmt.Errorf(
@@ -488,7 +512,6 @@ func convertParticipants(cdcParticipants []cadence.Value) (flow.IdentityList, er
 				expectedFieldCount,
 			)
 		}
-
 		if cdcNodeInfoStruct.Type() == nil {
 			return nil, fmt.Errorf("nodeInfo struct doesn't have type")
 		}
@@ -587,10 +610,10 @@ func convertParticipants(cdcParticipants []cadence.Value) (flow.IdentityList, er
 			return nil, fmt.Errorf("invalid role %d", role)
 		}
 
-		identity := &flow.Identity{
-			Address: string(address),
-			Weight:  uint64(initialWeight),
-			Role:    flow.Role(role),
+		identity := &flow.IdentitySkeleton{
+			InitialWeight: uint64(initialWeight),
+			Address:       string(address),
+			Role:          flow.Role(role),
 		}
 
 		// convert nodeID string into identifier
@@ -634,7 +657,8 @@ func convertParticipants(cdcParticipants []cadence.Value) (flow.IdentityList, er
 		participants = append(participants, identity)
 	}
 
-	participants = participants.Sort(flow.Canonical)
+	// IMPORTANT: returned identities must be in *canonical order*
+	participants = participants.Sort(flow.Canonical[flow.IdentitySkeleton])
 	return participants, nil
 }
 
diff --git a/model/encodable/keys.go b/model/encodable/keys.go
index 513456e26cc..f942438668e 100644
--- a/model/encodable/keys.go
+++ b/model/encodable/keys.go
@@ -162,6 +162,14 @@ type RandomBeaconPubKey struct {
 	crypto.PublicKey
 }
 
+func WrapRandomBeaconPubKeys(keys []crypto.PublicKey) []RandomBeaconPubKey {
+	encodables := make([]RandomBeaconPubKey, len(keys))
+	for i := range keys {
+		encodables[i] = RandomBeaconPubKey{PublicKey: keys[i]}
+	}
+	return encodables
+}
+
 func (pub RandomBeaconPubKey) MarshalJSON() ([]byte, error) {
 	if pub.PublicKey == nil {
 		return json.Marshal(nil)
diff --git a/model/events/parse.go b/model/events/parse.go
index 8c7eebfdf4f..1ddcfda2f30 100644
--- a/model/events/parse.go
+++ b/model/events/parse.go
@@ -23,15 +23,16 @@ type ParsedEvent struct {
 	Name         string
 }
 
-// ParseEvent parses an event type into its parts. There are 2 valid EventType formats:
+// ParseEvent parses an event type into its parts. There are 3 valid EventType formats:
 // - flow.[EventName]
+// - evm.[EventName]
 // - A.[Address].[Contract].[EventName]
 // Any other format results in an error.
 func ParseEvent(eventType flow.EventType) (*ParsedEvent, error) {
 	parts := strings.Split(string(eventType), ".")
 
 	switch parts[0] {
-	case "flow":
+	case "flow", flow.EVMLocationPrefix:
 		if len(parts) == 2 {
 			return &ParsedEvent{
 				Type:         ProtocolEventType,
diff --git a/model/events/parse_test.go b/model/events/parse_test.go
index 053bbd3ec92..fed421c86bc 100644
--- a/model/events/parse_test.go
+++ b/model/events/parse_test.go
@@ -43,6 +43,17 @@ func TestParseEvent(t *testing.T) {
 				Name:         "EventA",
 			},
 		},
+		{
+			name:      "evm event",
+			eventType: "evm.BlockExecuted",
+			expected: events.ParsedEvent{
+				Type:         events.ProtocolEventType,
+				EventType:    "evm.BlockExecuted",
+				Contract:     "evm",
+				ContractName: "evm",
+				Name:         "BlockExecuted",
+			},
+		},
 	}
 
 	for _, test := range tests {
@@ -69,6 +80,8 @@ func TestParseEvent_Invalid(t *testing.T) {
 		"B.0000000000000001.invalid.event", // invalid first part
 		"flow",                             // incorrect number of parts for protocol event
 		"flow.invalid.event",               // incorrect number of parts for protocol event
+		"evm",                              // incorrect number of parts for protocol event
+		"evm.invalid.event",                // incorrect number of parts for protocol event
 		"A.0000000000000001.invalid",       // incorrect number of parts for account event
 		"A.0000000000000001.invalid.a.b",   // incorrect number of parts for account event
 
@@ -111,6 +124,17 @@ func TestValidateEvent(t *testing.T) {
 				Name:         "EventA",
 			},
 		},
+		{
+			name:      "evm event",
+			eventType: "evm.BlockExecuted",
+			expected: events.ParsedEvent{
+				Type:         events.ProtocolEventType,
+				EventType:    "evm.BlockExecuted",
+				Contract:     "evm",
+				ContractName: "evm",
+				Name:         "BlockExecuted",
+			},
+		},
 	}
 
 	for _, test := range tests {
@@ -137,6 +161,8 @@ func TestValidateEvent_Invalid(t *testing.T) {
 		"B.0000000000000001.invalid.event", // invalid first part
 		"flow",                             // incorrect number of parts for protocol event
 		"flow.invalid.event",               // incorrect number of parts for protocol event
+		"evm",                              // incorrect number of parts for protocol event
+		"evm.invalid.event",                // incorrect number of parts for protocol event
 		"A.0000000000000001.invalid",       // incorrect number of parts for account event
 		"A.0000000000000001.invalid.a.b",   // incorrect number of parts for account event
 		flow.EventType(fmt.Sprintf("A.%s.Contract1.EventA", unittest.RandomAddressFixture())), // address from wrong chain
diff --git a/model/flow/account.go b/model/flow/account.go
index f9747f632da..0d714cbec11 100644
--- a/model/flow/account.go
+++ b/model/flow/account.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package flow
 
 import (
diff --git a/model/flow/address.go b/model/flow/address.go
index a0b054f28fb..129464fbd7e 100644
--- a/model/flow/address.go
+++ b/model/flow/address.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package flow
 
 import (
@@ -25,12 +23,21 @@ func ConvertAddress(b [AddressLength]byte) Address {
 
 // HexToAddress converts a hex string to an Address.
 func HexToAddress(h string) Address {
+	addr, _ := StringToAddress(h)
+	return addr
+}
+
+// StringToAddress converts a string to an Address and return an error if the string is malformed
+func StringToAddress(h string) (Address, error) {
 	trimmed := strings.TrimPrefix(h, "0x")
 	if len(trimmed)%2 == 1 {
 		trimmed = "0" + trimmed
 	}
-	b, _ := hex.DecodeString(trimmed)
-	return BytesToAddress(b)
+	b, err := hex.DecodeString(trimmed)
+	if err != nil {
+		return EmptyAddress, fmt.Errorf("can not decode hex string (%v) to address: %w", h, err)
+	}
+	return BytesToAddress(b), nil
 }
 
 // BytesToAddress returns Address with value b.
diff --git a/model/flow/assignment/sort.go b/model/flow/assignment/sort.go
index 8e590a86089..e0ff3824832 100644
--- a/model/flow/assignment/sort.go
+++ b/model/flow/assignment/sort.go
@@ -10,7 +10,7 @@ func FromIdentifierLists(identifierLists []flow.IdentifierList) flow.AssignmentL
 	assignments := make(flow.AssignmentList, 0, len(identifierLists))
 	// in place sort to order the assignment in canonical order
 	for _, identities := range identifierLists {
-		assignment := flow.IdentifierList(identities).Sort(flow.IdentifierCanonical)
+		assignment := identities.Sort(flow.IdentifierCanonical)
 		assignments = append(assignments, assignment)
 	}
 	return assignments
diff --git a/model/flow/block.go b/model/flow/block.go
index abd62ff8595..415721a8843 100644
--- a/model/flow/block.go
+++ b/model/flow/block.go
@@ -1,8 +1,9 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package flow
 
-import "fmt"
+import (
+	"fmt"
+	"time"
+)
 
 func Genesis(chainID ChainID) *Block {
 
@@ -111,3 +112,28 @@ func (b *CertifiedBlock) View() uint64 {
 func (b *CertifiedBlock) Height() uint64 {
 	return b.Block.Header.Height
 }
+
+// BlockDigest holds lightweight block information which includes only block id, block height and block timestamp
+type BlockDigest struct {
+	id        Identifier
+	Height    uint64
+	Timestamp time.Time
+}
+
+// NewBlockDigest constructs a new block digest.
+func NewBlockDigest(
+	id Identifier,
+	height uint64,
+	timestamp time.Time,
+) *BlockDigest {
+	return &BlockDigest{
+		id:        id,
+		Height:    height,
+		Timestamp: timestamp,
+	}
+}
+
+// ID returns the id of the BlockDigest.
+func (b *BlockDigest) ID() Identifier {
+	return b.id
+}
diff --git a/model/flow/chunk.go b/model/flow/chunk.go
index 6baf6e193c3..aab8179eb05 100644
--- a/model/flow/chunk.go
+++ b/model/flow/chunk.go
@@ -60,14 +60,25 @@ func (ch *Chunk) Checksum() Identifier {
 
 // ChunkDataPack holds all register touches (any read, or write).
 //
-// Note that we have to capture a read proof for each write before updating the registers.
-// `Proof` includes proofs for all registers read to execute the chunk.
+// Note that we have to include merkle paths as storage proof for all registers touched (read or written) for
+// the _starting_ state of the chunk (i.e. before the chunk computation updates the registers).
+// For instance, if an execution state contains three registers: { A: 1, B: 2, C: 3}, and a certain
+// chunk has a tx that assigns A = A + B, then its chunk data pack should include the merkle
+// paths for { A: 1, B: 2 } as storage proof.
+// C is not included because it's neither read or written by the chunk.
+// B is included because it's read by the chunk.
+// A is included because it's updated by the chunk, and its value 1 is included because it's
+// the value before the chunk computation.
+// This is necessary for Verification Nodes to (i) check that the read register values are
+// consistent with the starting state's root hash and (ii) verify the correctness of the resulting
+// state after the chunk computation. `Proof` includes merkle proofs for all touched registers
+// during the execution of the chunk.
 // Register proofs order must not be correlated to the order of register reads during
 // the chunk execution in order to enforce the SPoCK secret high entropy.
 type ChunkDataPack struct {
 	ChunkID    Identifier      // ID of the chunk this data pack is for
 	StartState StateCommitment // commitment for starting state
-	Proof      StorageProof    // proof for all registers read during the chunk execution
+	Proof      StorageProof    // proof for all registers touched (read or written) during the chunk execution
 	Collection *Collection     // collection executed in this chunk
 
 	// ExecutionDataRoot is the root data structure of an execution_data.BlockExecutionData.
diff --git a/model/flow/cluster.go b/model/flow/cluster.go
index 9e4eb289ff6..7696d834184 100644
--- a/model/flow/cluster.go
+++ b/model/flow/cluster.go
@@ -11,7 +11,7 @@ type AssignmentList []IdentifierList
 
 // ClusterList is a list of identity lists. Each `IdentityList` represents the
 // nodes assigned to a specific cluster.
-type ClusterList []IdentityList
+type ClusterList []IdentitySkeletonList
 
 func (al AssignmentList) EqualTo(other AssignmentList) bool {
 	if len(al) != len(other) {
@@ -45,10 +45,10 @@ func (cl ClusterList) Assignments() AssignmentList {
 
 // NewClusterList creates a new cluster list based on the given cluster assignment
 // and the provided list of identities.
-func NewClusterList(assignments AssignmentList, collectors IdentityList) (ClusterList, error) {
+func NewClusterList(assignments AssignmentList, collectors IdentitySkeletonList) (ClusterList, error) {
 
 	// build a lookup for all the identities by node identifier
-	lookup := make(map[Identifier]*Identity)
+	lookup := make(map[Identifier]*IdentitySkeleton)
 	for _, collector := range collectors {
 		_, ok := lookup[collector.NodeID]
 		if ok {
@@ -60,7 +60,7 @@ func NewClusterList(assignments AssignmentList, collectors IdentityList) (Cluste
 	// replicate the identifier list but use identities instead
 	clusters := make(ClusterList, 0, len(assignments))
 	for _, participants := range assignments {
-		cluster := make(IdentityList, 0, len(participants))
+		cluster := make(IdentitySkeletonList, 0, len(participants))
 		for _, participantID := range participants {
 			participant, found := lookup[participantID]
 			if !found {
@@ -81,7 +81,7 @@ func NewClusterList(assignments AssignmentList, collectors IdentityList) (Cluste
 }
 
 // ByIndex retrieves the list of identities that are part of the given cluster.
-func (cl ClusterList) ByIndex(index uint) (IdentityList, bool) {
+func (cl ClusterList) ByIndex(index uint) (IdentitySkeletonList, bool) {
 	if index >= uint(len(cl)) {
 		return nil, false
 	}
@@ -93,7 +93,7 @@ func (cl ClusterList) ByIndex(index uint) (IdentityList, bool) {
 //
 // For evenly distributed transaction IDs, this will evenly distribute
 // transactions between clusters.
-func (cl ClusterList) ByTxID(txID Identifier) (IdentityList, bool) {
+func (cl ClusterList) ByTxID(txID Identifier) (IdentitySkeletonList, bool) {
 	bigTxID := new(big.Int).SetBytes(txID[:])
 	bigIndex := new(big.Int).Mod(bigTxID, big.NewInt(int64(len(cl))))
 	return cl.ByIndex(uint(bigIndex.Uint64()))
@@ -103,7 +103,7 @@ func (cl ClusterList) ByTxID(txID Identifier) (IdentityList, bool) {
 //
 // Nodes will be divided into equally sized clusters as far as possible.
 // The last return value will indicate if the look up was successful
-func (cl ClusterList) ByNodeID(nodeID Identifier) (IdentityList, uint, bool) {
+func (cl ClusterList) ByNodeID(nodeID Identifier) (IdentitySkeletonList, uint, bool) {
 	for index, cluster := range cl {
 		for _, participant := range cluster {
 			if participant.NodeID == nodeID {
@@ -115,7 +115,7 @@ func (cl ClusterList) ByNodeID(nodeID Identifier) (IdentityList, uint, bool) {
 }
 
 // IndexOf returns the index of the given cluster.
-func (cl ClusterList) IndexOf(cluster IdentityList) (uint, bool) {
+func (cl ClusterList) IndexOf(cluster IdentitySkeletonList) (uint, bool) {
 	clusterFingerprint := cluster.ID()
 	for index, other := range cl {
 		if other.ID() == clusterFingerprint {
diff --git a/model/flow/cluster_test.go b/model/flow/cluster_test.go
index 52d8f39e72c..9bd245cafb9 100644
--- a/model/flow/cluster_test.go
+++ b/model/flow/cluster_test.go
@@ -15,10 +15,10 @@ import (
 func TestClusterAssignments(t *testing.T) {
 
 	identities := unittest.IdentityListFixture(100, unittest.WithRole(flow.RoleCollection))
-	assignments := unittest.ClusterAssignment(10, identities)
+	assignments := unittest.ClusterAssignment(10, identities.ToSkeleton())
 	assert.Len(t, assignments, 10)
 
-	clusters, err := factory.NewClusterList(assignments, identities)
+	clusters, err := factory.NewClusterList(assignments, identities.ToSkeleton())
 	require.NoError(t, err)
 	assert.Equal(t, assignments, clusters.Assignments())
 }
diff --git a/model/flow/collectionGuarantee.go b/model/flow/collectionGuarantee.go
index 393505a6de2..58651726a8a 100644
--- a/model/flow/collectionGuarantee.go
+++ b/model/flow/collectionGuarantee.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package flow
 
 import (
diff --git a/model/flow/constants.go b/model/flow/constants.go
index 6b03c36a6db..987f817cd6a 100644
--- a/model/flow/constants.go
+++ b/model/flow/constants.go
@@ -28,10 +28,6 @@ const DefaultTransactionExpiryBuffer = 30
 // DefaultMaxTransactionGasLimit is the default maximum value for the transaction gas limit.
 const DefaultMaxTransactionGasLimit = 9999
 
-// EstimatedComputationPerMillisecond is the approximate number of computation units that can be performed in a millisecond.
-// this was calibrated during the Variable Transaction Fees: Execution Effort FLIP https://github.com/onflow/flow/pull/753
-const EstimatedComputationPerMillisecond = 9999.0 / 200.0
-
 // DefaultMaxTransactionByteSize is the default maximum transaction byte size. (~1.5MB)
 const DefaultMaxTransactionByteSize = 1_500_000
 
@@ -103,3 +99,19 @@ func paddedDomainTag(s string) [DomainTagLength]byte {
 
 	return tag
 }
+
+// EstimatedComputationPerMillisecond is the approximate number of computation units that can be performed in a millisecond.
+// this was calibrated during the Variable Transaction Fees: Execution Effort FLIP https://github.com/onflow/flow/pull/753
+const EstimatedComputationPerMillisecond = 9999.0 / 200.0
+
+// NormalizedExecutionTimePerComputationUnit returns the normalized time per computation unit
+// If the computation estimation is correct (as per the FLIP https://github.com/onflow/flow/pull/753) the value should be 1.
+// If the value is greater than 1, the computation estimation is too low; we are underestimating transaction complexity (and thus undercharging).
+// If the value is less than 1, the computation estimation is too high; we are overestimating transaction complexity (and thus overcharging).
+func NormalizedExecutionTimePerComputationUnit(execTime time.Duration, computationUsed uint64) float64 {
+	if computationUsed == 0 {
+		return 0
+	}
+
+	return (float64(execTime.Milliseconds()) / float64(computationUsed)) * EstimatedComputationPerMillisecond
+}
diff --git a/model/flow/entity.go b/model/flow/entity.go
index 963d0b15791..f106e22eebb 100644
--- a/model/flow/entity.go
+++ b/model/flow/entity.go
@@ -1,5 +1,11 @@
 package flow
 
+type IDEntity interface {
+	// ID returns a unique id for this entity using a hash of the immutable
+	// fields of the entity.
+	ID() Identifier
+}
+
 // Entity defines how flow entities should be defined
 // Entities are flat data structures holding multiple data fields.
 // Entities don't include nested entities, they only include pointers to
@@ -7,10 +13,7 @@ package flow
 // of keeping a slice of entity object itself. This simplifies storage, signature and validation
 // of entities.
 type Entity interface {
-
-	// ID returns a unique id for this entity using a hash of the immutable
-	// fields of the entity.
-	ID() Identifier
+	IDEntity
 
 	// Checksum returns a unique checksum for the entity, including the mutable
 	// data such as signatures.
@@ -24,3 +27,26 @@ func EntitiesToIDs[T Entity](entities []T) []Identifier {
 	}
 	return ids
 }
+
+// Deduplicate entities in a slice by the ID method
+// The original order of the entities is preserved.
+func Deduplicate[T IDEntity](entities []T) []T {
+	if entities == nil {
+		return nil
+	}
+
+	seen := make(map[Identifier]struct{}, len(entities))
+	result := make([]T, 0, len(entities))
+
+	for _, entity := range entities {
+		id := entity.ID()
+		if _, ok := seen[id]; ok {
+			continue
+		}
+
+		seen[id] = struct{}{}
+		result = append(result, entity)
+	}
+
+	return result
+}
diff --git a/model/flow/entity_test.go b/model/flow/entity_test.go
new file mode 100644
index 00000000000..bb926159675
--- /dev/null
+++ b/model/flow/entity_test.go
@@ -0,0 +1,24 @@
+package flow_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+func TestDeduplicate(t *testing.T) {
+	require.Nil(t, flow.Deduplicate[*flow.Collection](nil))
+
+	cols := unittest.CollectionListFixture(5)
+	require.Equal(t, cols, flow.Deduplicate(cols))
+
+	// create duplicates, and validate
+	require.Equal(t, cols, flow.Deduplicate[*flow.Collection](append(cols, cols...)))
+
+	// verify the original order should be preserved
+	require.Equal(t, cols, flow.Deduplicate[*flow.Collection](
+		append(cols, cols[3], cols[1], cols[4], cols[2], cols[0])))
+}
diff --git a/model/flow/epoch.go b/model/flow/epoch.go
index 2e4c16ff14b..b60fa3dfcb4 100644
--- a/model/flow/epoch.go
+++ b/model/flow/epoch.go
@@ -63,15 +63,17 @@ const EpochSetupRandomSourceLength = 16
 // for the upcoming epoch. It contains the participants in the epoch, the
 // length, the cluster assignment, and the seed for leader selection.
 type EpochSetup struct {
-	Counter            uint64         // the number of the epoch
-	FirstView          uint64         // the first view of the epoch
-	DKGPhase1FinalView uint64         // the final view of DKG phase 1
-	DKGPhase2FinalView uint64         // the final view of DKG phase 2
-	DKGPhase3FinalView uint64         // the final view of DKG phase 3
-	FinalView          uint64         // the final view of the epoch
-	Participants       IdentityList   // all participants of the epoch
-	Assignments        AssignmentList // cluster assignment for the epoch
-	RandomSource       []byte         // source of randomness for epoch-specific setup tasks
+	Counter            uint64               // the number of the epoch
+	FirstView          uint64               // the first view of the epoch
+	DKGPhase1FinalView uint64               // the final view of DKG phase 1
+	DKGPhase2FinalView uint64               // the final view of DKG phase 2
+	DKGPhase3FinalView uint64               // the final view of DKG phase 3
+	FinalView          uint64               // the final view of the epoch
+	Participants       IdentitySkeletonList // all participants of the epoch in canonical order
+	Assignments        AssignmentList       // cluster assignment for the epoch
+	RandomSource       []byte               // source of randomness for epoch-specific setup tasks
+	TargetDuration     uint64               // desired real-world duration for the epoch [seconds]
+	TargetEndTime      uint64               // desired real-world end time for the epoch in UNIX time [seconds]
 }
 
 func (setup *EpochSetup) ServiceEvent() ServiceEvent {
@@ -105,7 +107,13 @@ func (setup *EpochSetup) EqualTo(other *EpochSetup) bool {
 	if setup.FinalView != other.FinalView {
 		return false
 	}
-	if !setup.Participants.EqualTo(other.Participants) {
+	if setup.TargetDuration != other.TargetDuration {
+		return false
+	}
+	if setup.TargetEndTime != other.TargetEndTime {
+		return false
+	}
+	if !IdentitySkeletonListEqualTo(setup.Participants, other.Participants) {
 		return false
 	}
 	if !setup.Assignments.EqualTo(other.Assignments) {
@@ -312,7 +320,7 @@ func (commit *EpochCommit) EqualTo(other *EpochCommit) bool {
 // ToDKGParticipantLookup constructs a DKG participant lookup from an identity
 // list and a key list. The identity list must be EXACTLY the same (order and
 // contents) as that used when initializing the corresponding DKG instance.
-func ToDKGParticipantLookup(participants IdentityList, keys []crypto.PublicKey) (map[Identifier]DKGParticipant, error) {
+func ToDKGParticipantLookup(participants IdentitySkeletonList, keys []crypto.PublicKey) (map[Identifier]DKGParticipant, error) {
 	if len(participants) != len(keys) {
 		return nil, fmt.Errorf("participant list (len=%d) does not match key list (len=%d)", len(participants), len(keys))
 	}
@@ -403,29 +411,6 @@ func (part DKGParticipant) EncodeRLP(w io.Writer) error {
 	return rlp.Encode(w, encodableFromDKGParticipant(part))
 }
 
-// EpochStatus represents the status of the current and next epoch with respect
-// to a reference block. Concretely, it contains the IDs for all relevant
-// service events emitted as of the reference block. Events not yet emitted are
-// represented by ZeroID.
-type EpochStatus struct {
-	PreviousEpoch EventIDs // EpochSetup and EpochCommit events for the previous epoch
-	CurrentEpoch  EventIDs // EpochSetup and EpochCommit events for the current epoch
-	NextEpoch     EventIDs // EpochSetup and EpochCommit events for the next epoch
-	// InvalidServiceEventIncorporated encodes whether an invalid service event is
-	// incorporated in this fork. When this happens, epoch fallback is triggered
-	// AFTER the fork is finalized.
-	InvalidServiceEventIncorporated bool
-}
-
-// Copy returns a copy of the epoch status.
-func (es *EpochStatus) Copy() *EpochStatus {
-	return &EpochStatus{
-		PreviousEpoch: es.PreviousEpoch,
-		CurrentEpoch:  es.CurrentEpoch,
-		NextEpoch:     es.NextEpoch,
-	}
-}
-
 // EventIDs is a container for IDs of epoch service events.
 type EventIDs struct {
 	// SetupID is the ID of the EpochSetup event for the respective Epoch
@@ -434,68 +419,7 @@ type EventIDs struct {
 	CommitID Identifier
 }
 
-func NewEpochStatus(previousSetup, previousCommit, currentSetup, currentCommit, nextSetup, nextCommit Identifier) (*EpochStatus, error) {
-	status := &EpochStatus{
-		PreviousEpoch: EventIDs{
-			SetupID:  previousSetup,
-			CommitID: previousCommit,
-		},
-		CurrentEpoch: EventIDs{
-			SetupID:  currentSetup,
-			CommitID: currentCommit,
-		},
-		NextEpoch: EventIDs{
-			SetupID:  nextSetup,
-			CommitID: nextCommit,
-		},
-	}
-
-	err := status.Check()
-	if err != nil {
-		return nil, err
-	}
-	return status, nil
-}
-
-// Check checks that the status is well-formed, returning an error if it is not.
-// All errors indicate a malformed EpochStatus.
-func (es *EpochStatus) Check() error {
-
-	if es == nil {
-		return fmt.Errorf("nil epoch status")
-	}
-	// must reference either both or neither event IDs for previous epoch
-	if (es.PreviousEpoch.SetupID == ZeroID) != (es.PreviousEpoch.CommitID == ZeroID) {
-		return fmt.Errorf("epoch status with only setup or only commit service event")
-	}
-	// must reference event IDs for current epoch
-	if es.CurrentEpoch.SetupID == ZeroID || es.CurrentEpoch.CommitID == ZeroID {
-		return fmt.Errorf("epoch status with empty current epoch service events")
-	}
-	// must not reference a commit without a setup
-	if es.NextEpoch.SetupID == ZeroID && es.NextEpoch.CommitID != ZeroID {
-		return fmt.Errorf("epoch status with commit but no setup service event")
-	}
-	return nil
-}
-
-// Phase returns the phase for the CURRENT epoch, given this epoch status.
-// All errors indicate a malformed EpochStatus.
-func (es *EpochStatus) Phase() (EpochPhase, error) {
-
-	err := es.Check()
-	if err != nil {
-		return EpochPhaseUndefined, err
-	}
-	if es.NextEpoch.SetupID == ZeroID {
-		return EpochPhaseStaking, nil
-	}
-	if es.NextEpoch.CommitID == ZeroID {
-		return EpochPhaseSetup, nil
-	}
-	return EpochPhaseCommitted, nil
-}
-
-func (es *EpochStatus) HasPrevious() bool {
-	return es.PreviousEpoch.SetupID != ZeroID && es.PreviousEpoch.CommitID != ZeroID
+// ID returns hash of the event IDs.
+func (e *EventIDs) ID() Identifier {
+	return MakeID(e)
 }
diff --git a/model/flow/epoch_test.go b/model/flow/epoch_test.go
index 0803e807a0a..00594064d61 100644
--- a/model/flow/epoch_test.go
+++ b/model/flow/epoch_test.go
@@ -179,8 +179,8 @@ func TestEpochCommit_EqualTo(t *testing.T) {
 
 func TestEpochSetup_EqualTo(t *testing.T) {
 
-	identityA := unittest.IdentityFixture()
-	identityB := unittest.IdentityFixture()
+	identityA := &unittest.IdentityFixture().IdentitySkeleton
+	identityB := &unittest.IdentityFixture().IdentitySkeleton
 
 	assignmentA := flow.AssignmentList{[]flow.Identifier{[32]byte{1, 2, 3}, [32]byte{2, 2, 2}}}
 	assignmentB := flow.AssignmentList{[]flow.Identifier{[32]byte{1, 2, 3}, [32]byte{}}}
@@ -243,8 +243,8 @@ func TestEpochSetup_EqualTo(t *testing.T) {
 
 	t.Run("Participants length differ", func(t *testing.T) {
 
-		a := &flow.EpochSetup{Participants: flow.IdentityList{identityA}}
-		b := &flow.EpochSetup{Participants: flow.IdentityList{}}
+		a := &flow.EpochSetup{Participants: flow.IdentitySkeletonList{identityA}}
+		b := &flow.EpochSetup{Participants: flow.IdentitySkeletonList{}}
 
 		require.False(t, a.EqualTo(b))
 		require.False(t, b.EqualTo(a))
@@ -252,8 +252,8 @@ func TestEpochSetup_EqualTo(t *testing.T) {
 
 	t.Run("Participants length same but different data", func(t *testing.T) {
 
-		a := &flow.EpochSetup{Participants: flow.IdentityList{identityA}}
-		b := &flow.EpochSetup{Participants: flow.IdentityList{identityB}}
+		a := &flow.EpochSetup{Participants: flow.IdentitySkeletonList{identityA}}
+		b := &flow.EpochSetup{Participants: flow.IdentitySkeletonList{identityB}}
 
 		require.False(t, a.EqualTo(b))
 		require.False(t, b.EqualTo(a))
@@ -261,8 +261,8 @@ func TestEpochSetup_EqualTo(t *testing.T) {
 
 	t.Run("Participants length same with same data", func(t *testing.T) {
 
-		a := &flow.EpochSetup{Participants: flow.IdentityList{identityA}}
-		b := &flow.EpochSetup{Participants: flow.IdentityList{identityA}}
+		a := &flow.EpochSetup{Participants: flow.IdentitySkeletonList{identityA}}
+		b := &flow.EpochSetup{Participants: flow.IdentitySkeletonList{identityA}}
 
 		require.True(t, a.EqualTo(b))
 		require.True(t, b.EqualTo(a))
diff --git a/model/flow/event.go b/model/flow/event.go
index c645bf22603..f151e8c5f01 100644
--- a/model/flow/event.go
+++ b/model/flow/event.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package flow
 
 import (
@@ -17,6 +15,8 @@ const (
 	EventAccountUpdated EventType = "flow.AccountUpdated"
 )
 
+const EVMLocationPrefix = "evm"
+
 type EventType string
 
 type Event struct {
diff --git a/model/flow/factory/cluster_list.go b/model/flow/factory/cluster_list.go
index 9ff7e0c7464..6063b9e2f0d 100644
--- a/model/flow/factory/cluster_list.go
+++ b/model/flow/factory/cluster_list.go
@@ -6,48 +6,59 @@ import (
 	"github.com/onflow/flow-go/model/flow"
 )
 
-// NewClusterList creates a new cluster list based on the given cluster assignment
-// and the provided list of identities.
+// NewClusterList creates a new cluster list based on the given cluster assignment and the provided list of identities.
+// The implementation enforces the following protocol rules and errors in case they are violated:
 //
-// The caller must ensure the following prerequisites:
-//   - each assignment contains identities ordered in canonical order
-//   - every collector has a unique NodeID, i.e. there are no two elements in `collectors` with the same NodeID
+//	(a) input `collectors` only contains collector nodes with positive weight
+//	(b) collectors have unique node IDs
+//	(c) each collector is assigned exactly to one cluster and is only listed once within that cluster
 //
-// These prerequisites ensures that each cluster in the returned cluster list is ordered in canonical order as well.
-// This function checks that the prerequisites are satisfied and errors otherwise.
-func NewClusterList(assignments flow.AssignmentList, collectors flow.IdentityList) (flow.ClusterList, error) {
-
+// Furthermore, for each cluster (i.e. element in `assignments`) we enforce:
+//
+//	(d) cluster contains at least one collector (i.e. is not empty)
+//	(e) cluster is composed of known nodes, i.e. for each nodeID in `assignments` an IdentitySkeleton is given in `collectors`
+//	(f) cluster assignment lists the nodes in canonical ordering
+//
+// The caller must ensure each assignment contains identities ordered in canonical order, so that
+// each cluster in the returned cluster list is ordered in canonical order as well. If not,
+// an error will be returned.
+// This is a side-effect-free function. Any error return indicates that the input violate protocol rules.
+func NewClusterList(assignments flow.AssignmentList, collectors flow.IdentitySkeletonList) (flow.ClusterList, error) {
 	// build a lookup for all the identities by node identifier
-	lookup := make(map[flow.Identifier]*flow.Identity)
-	for _, collector := range collectors {
+	lookup := collectors.Lookup()
+	for _, collector := range collectors { // enforce (a): `collectors` only contains collector nodes with positive weight
+		if collector.Role != flow.RoleCollection {
+			return nil, fmt.Errorf("node %v is not a collector", collector.NodeID)
+		}
+		if collector.InitialWeight == 0 {
+			return nil, fmt.Errorf("node %v has zero weight", collector.NodeID)
+		}
 		lookup[collector.NodeID] = collector
 	}
-	if len(lookup) != len(collectors) {
+	if len(lookup) != len(collectors) { // enforce (b): collectors have unique node IDs
 		return nil, fmt.Errorf("duplicate collector in list")
 	}
 
-	// replicate the identifier list but use identities instead
+	// assignments only contains the NodeIDs for each cluster. In the following, we substitute them with the respective IdentitySkeletons.
 	clusters := make(flow.ClusterList, 0, len(assignments))
 	for i, participants := range assignments {
-		cluster := make(flow.IdentityList, 0, len(participants))
-		if len(participants) == 0 {
-			return nil, fmt.Errorf("participants in assignment list is empty, cluster index %v", i)
+		cluster := make(flow.IdentitySkeletonList, 0, len(participants))
+		if len(participants) == 0 { // enforce (d): each cluster contains at least one collector (i.e. is not empty)
+			return nil, fmt.Errorf("particpants in assignment list is empty, cluster index %v", i)
 		}
 
-		// Check assignments is sorted in canonical order
-		prev := participants[0]
-
+		prev := participants[0] // for checking that cluster participants are listed in canonical order
 		for i, participantID := range participants {
-			participant, found := lookup[participantID]
+			participant, found := lookup[participantID] // enforce (e): for each nodeID in assignments an IdentitySkeleton is given in `collectors`
 			if !found {
 				return nil, fmt.Errorf("could not find collector identity (%x)", participantID)
 			}
 			cluster = append(cluster, participant)
-			delete(lookup, participantID)
+			delete(lookup, participantID) // enforce (c) part 1: reject repeated assignment of the same node
 
-			if i > 0 {
+			if i > 0 { // enforce (f): canonical ordering
 				if !flow.IsIdentifierCanonical(prev, participantID) {
-					return nil, fmt.Errorf("the assignments is not sorted in canonical order or there are duplicates in cluster index %v, prev %v, next %v",
+					return nil, fmt.Errorf("the assignments is not sorted in canonical order in cluster index %v, prev %v, next %v",
 						i, prev, participantID)
 				}
 			}
@@ -57,8 +68,7 @@ func NewClusterList(assignments flow.AssignmentList, collectors flow.IdentityLis
 		clusters = append(clusters, cluster)
 	}
 
-	// check that every collector was assigned
-	if len(lookup) != 0 {
+	if len(lookup) != 0 { // enforce (c) part 2: every collector was assigned
 		return nil, fmt.Errorf("missing collector assignments (%s)", lookup)
 	}
 
diff --git a/model/flow/factory/cluster_list_test.go b/model/flow/factory/cluster_list_test.go
index 0c938d5e8da..894c416d456 100644
--- a/model/flow/factory/cluster_list_test.go
+++ b/model/flow/factory/cluster_list_test.go
@@ -10,16 +10,67 @@ import (
 	"github.com/onflow/flow-go/utils/unittest"
 )
 
-// NewClusterList assumes the input assignments are sorted, and fail if not.
-// This tests verifies that NewClusterList has implemented the check on the assumption.
-func TestNewClusterListFail(t *testing.T) {
+// TestNewClusterList ensures that implementation enforces the following protocol rules in case they are violated:
+//
+//	(a) input `collectors` only contains collector nodes with positive weight
+//	(b) collectors have unique node IDs
+//	(c) each collector is assigned exactly to one cluster and is only listed once within that cluster
+//	(d) cluster contains at least one collector (i.e. is not empty)
+//	(e) cluster is composed of known nodes, i.e. for each nodeID in `assignments` an IdentitySkeleton is given in `collectors`
+//	(f) cluster assignment lists the nodes in canonical ordering
+func TestNewClusterList(t *testing.T) {
 	identities := unittest.IdentityListFixture(100, unittest.WithRole(flow.RoleCollection))
-	assignments := unittest.ClusterAssignment(10, identities)
 
-	tmp := assignments[1][0]
-	assignments[1][0] = assignments[1][1]
-	assignments[1][1] = tmp
-
-	_, err := factory.NewClusterList(assignments, identities)
-	require.Error(t, err)
+	t.Run("valid inputs", func(t *testing.T) {
+		assignments := unittest.ClusterAssignment(10, identities.ToSkeleton())
+		_, err := factory.NewClusterList(assignments, identities.ToSkeleton())
+		require.NoError(t, err)
+	})
+	t.Run("(a) input `collectors` only contains collector nodes with positive weight", func(t *testing.T) {
+		identities := identities.Copy()
+		identities[0].InitialWeight = 0
+		assignments := unittest.ClusterAssignment(10, identities.ToSkeleton())
+		_, err := factory.NewClusterList(assignments, identities.ToSkeleton())
+		require.Error(t, err)
+	})
+	t.Run("(b) collectors have unique node IDs", func(t *testing.T) {
+		identities := identities.Copy()
+		identities[0].NodeID = identities[1].NodeID
+		assignments := unittest.ClusterAssignment(10, identities.ToSkeleton())
+		_, err := factory.NewClusterList(assignments, identities.ToSkeleton())
+		require.Error(t, err)
+	})
+	t.Run("(c) each collector is assigned exactly to one cluster", func(t *testing.T) {
+		assignments := unittest.ClusterAssignment(10, identities.ToSkeleton())
+		assignments[1][0] = assignments[0][0]
+		_, err := factory.NewClusterList(assignments, identities.ToSkeleton())
+		require.Error(t, err)
+	})
+	t.Run("(c) each collector is only listed once within that cluster", func(t *testing.T) {
+		assignments := unittest.ClusterAssignment(10, identities.ToSkeleton())
+		assignments[0][0] = assignments[0][1]
+		_, err := factory.NewClusterList(assignments, identities.ToSkeleton())
+		require.Error(t, err)
+	})
+	t.Run("(d) cluster contains at least one collector (i.e. is not empty)", func(t *testing.T) {
+		assignments := unittest.ClusterAssignment(10, identities.ToSkeleton())
+		assignments[0] = flow.IdentifierList{}
+		_, err := factory.NewClusterList(assignments, identities.ToSkeleton())
+		require.Error(t, err)
+	})
+	t.Run("(e) cluster is composed of known nodes, i.e. for each nodeID in `assignments` an IdentitySkeleton is given in `collectors` ", func(t *testing.T) {
+		assignments := unittest.ClusterAssignment(10, identities.ToSkeleton())
+		assignments[0][0] = unittest.IdentifierFixture()
+		_, err := factory.NewClusterList(assignments, identities.ToSkeleton())
+		require.Error(t, err)
+	})
+	t.Run("(f) cluster assignment lists the nodes in canonical ordering", func(t *testing.T) {
+		assignments := unittest.ClusterAssignment(10, identities.ToSkeleton())
+		// sort in non-canonical order
+		assignments[0] = assignments[0].Sort(func(lhs flow.Identifier, rhs flow.Identifier) int {
+			return -flow.IdentifierCanonical(lhs, rhs)
+		})
+		_, err := factory.NewClusterList(assignments, identities.ToSkeleton())
+		require.Error(t, err)
+	})
 }
diff --git a/model/flow/filter/id/identifier.go b/model/flow/filter/id/identifier.go
index 63b7f61e6b9..749edbe575d 100644
--- a/model/flow/filter/id/identifier.go
+++ b/model/flow/filter/id/identifier.go
@@ -1,4 +1,3 @@
-// (c) 2021 Dapper Labs - ALL RIGHTS RESERVED
 package id
 
 import "github.com/onflow/flow-go/model/flow"
diff --git a/model/flow/filter/identity.go b/model/flow/filter/identity.go
index 03ee618bc52..2afca5e2212 100644
--- a/model/flow/filter/identity.go
+++ b/model/flow/filter/identity.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package filter
 
 import (
@@ -8,14 +6,23 @@ import (
 	"github.com/onflow/flow-go/model/flow"
 )
 
+// Adapt takes an IdentityFilter on the domain of IdentitySkeletons
+// and adapts the filter to the domain of full Identities. In other words, it converts
+// flow.IdentityFilter[flow.IdentitySkeleton] to flow.IdentityFilter[flow.Identity].
+func Adapt(f flow.IdentityFilter[flow.IdentitySkeleton]) flow.IdentityFilter[flow.Identity] {
+	return func(i *flow.Identity) bool {
+		return f(&i.IdentitySkeleton)
+	}
+}
+
 // Any will always be true.
 func Any(*flow.Identity) bool {
 	return true
 }
 
 // And combines two or more filters that all need to be true.
-func And(filters ...flow.IdentityFilter) flow.IdentityFilter {
-	return func(identity *flow.Identity) bool {
+func And[T flow.GenericIdentity](filters ...flow.IdentityFilter[T]) flow.IdentityFilter[T] {
+	return func(identity *T) bool {
 		for _, filter := range filters {
 			if !filter(identity) {
 				return false
@@ -26,8 +33,8 @@ func And(filters ...flow.IdentityFilter) flow.IdentityFilter {
 }
 
 // Or combines two or more filters and only needs one of them to be true.
-func Or(filters ...flow.IdentityFilter) flow.IdentityFilter {
-	return func(identity *flow.Identity) bool {
+func Or[T flow.GenericIdentity](filters ...flow.IdentityFilter[T]) flow.IdentityFilter[T] {
+	return func(identity *T) bool {
 		for _, filter := range filters {
 			if filter(identity) {
 				return true
@@ -38,34 +45,37 @@ func Or(filters ...flow.IdentityFilter) flow.IdentityFilter {
 }
 
 // Not returns a filter equivalent to the inverse of the input filter.
-func Not(filter flow.IdentityFilter) flow.IdentityFilter {
-	return func(identity *flow.Identity) bool {
+func Not[T flow.GenericIdentity](filter flow.IdentityFilter[T]) flow.IdentityFilter[T] {
+	return func(identity *T) bool {
 		return !filter(identity)
 	}
 }
 
-// In returns a filter for identities within the input list. This is equivalent
-// to HasNodeID, but for list-typed inputs.
-func In(list flow.IdentityList) flow.IdentityFilter {
-	return HasNodeID(list.NodeIDs()...)
+// In returns a filter for identities within the input list. For an input identity i,
+// the filter returns true if and only if i ∈ list.
+// Caution: The filter solely operates on NodeIDs. Other identity fields are not compared.
+// This function is just a compact representation of `HasNodeID[T](list.NodeIDs()...)`
+// which behaves algorithmically the same way.
+func In[T flow.GenericIdentity](list flow.GenericIdentityList[T]) flow.IdentityFilter[T] {
+	return HasNodeID[T](list.NodeIDs()...)
 }
 
 // HasNodeID returns a filter that returns true for any identity with an ID
 // matching any of the inputs.
-func HasNodeID(nodeIDs ...flow.Identifier) flow.IdentityFilter {
+func HasNodeID[T flow.GenericIdentity](nodeIDs ...flow.Identifier) flow.IdentityFilter[T] {
 	lookup := make(map[flow.Identifier]struct{})
 	for _, nodeID := range nodeIDs {
 		lookup[nodeID] = struct{}{}
 	}
-	return func(identity *flow.Identity) bool {
-		_, ok := lookup[identity.NodeID]
+	return func(identity *T) bool {
+		_, ok := lookup[(*identity).GetNodeID()]
 		return ok
 	}
 }
 
 // HasNetworkingKey returns a filter that returns true for any identity with a
 // networking public key matching any of the inputs.
-func HasNetworkingKey(keys ...crypto.PublicKey) flow.IdentityFilter {
+func HasNetworkingKey(keys ...crypto.PublicKey) flow.IdentityFilter[flow.Identity] {
 	return func(identity *flow.Identity) bool {
 		for _, key := range keys {
 			if key.Equals(identity.NetworkPubKey) {
@@ -76,45 +86,79 @@ func HasNetworkingKey(keys ...crypto.PublicKey) flow.IdentityFilter {
 	}
 }
 
-// HasWeight returns a filter for nodes with non-zero weight.
-func HasWeight(hasWeight bool) flow.IdentityFilter {
-	return func(identity *flow.Identity) bool {
-		return (identity.Weight > 0) == hasWeight
+// HasInitialWeight returns a filter for nodes with non-zero initial weight.
+func HasInitialWeight[T flow.GenericIdentity](hasWeight bool) flow.IdentityFilter[T] {
+	return func(identity *T) bool {
+		return ((*identity).GetInitialWeight() > 0) == hasWeight
 	}
 }
 
-// Ejected is a filter that returns true if the node is ejected.
-func Ejected(identity *flow.Identity) bool {
-	return identity.Ejected
+// HasParticipationStatus is a filter that returns true if the node epoch participation status matches the input.
+func HasParticipationStatus(status flow.EpochParticipationStatus) flow.IdentityFilter[flow.Identity] {
+	return func(identity *flow.Identity) bool {
+		return identity.EpochParticipationStatus == status
+	}
 }
 
 // HasRole returns a filter for nodes with one of the input roles.
-func HasRole(roles ...flow.Role) flow.IdentityFilter {
+func HasRole[T flow.GenericIdentity](roles ...flow.Role) flow.IdentityFilter[T] {
 	lookup := make(map[flow.Role]struct{})
 	for _, role := range roles {
 		lookup[role] = struct{}{}
 	}
-	return func(identity *flow.Identity) bool {
-		_, ok := lookup[identity.Role]
+	return func(identity *T) bool {
+		_, ok := lookup[(*identity).GetRole()]
 		return ok
 	}
 }
 
 // IsValidCurrentEpochParticipant is an identity filter for members of the
 // current epoch in good standing.
-var IsValidCurrentEpochParticipant = And(
-	HasWeight(true),
-	Not(Ejected), // ejection will change signer index
+// Effective it means that node is an active identity in current epoch and has not been ejected.
+var IsValidCurrentEpochParticipant = HasParticipationStatus(flow.EpochParticipationStatusActive)
+
+// IsValidCurrentEpochParticipantOrJoining is an identity filter for members of the current epoch or that are going to join in next epoch.
+var IsValidCurrentEpochParticipantOrJoining = Or(IsValidCurrentEpochParticipant, HasParticipationStatus(flow.EpochParticipationStatusJoining))
+
+// IsConsensusCommitteeMember is an identity filter for all members of the consensus committee.
+// Formally, a Node X is a Consensus Committee Member if and only if X is a consensus node with
+// positive initial weight. This is specified by the EpochSetup Event and remains static
+// throughout the epoch.
+var IsConsensusCommitteeMember = And(
+	HasRole[flow.IdentitySkeleton](flow.RoleConsensus),
+	HasInitialWeight[flow.IdentitySkeleton](true),
 )
 
-// IsVotingConsensusCommitteeMember is a identity filter for all members of
+// IsVotingConsensusCommitteeMember is an identity filter for all members of
 // the consensus committee allowed to vote.
-var IsVotingConsensusCommitteeMember = And(
-	HasRole(flow.RoleConsensus),
-	IsValidCurrentEpochParticipant,
+// Formally, a Node X has authority to vote in the consensus process, if and only if
+//  1. Node X is an active member of the current epoch AND
+//  2. X is a consensus node with positive initial weight in the current Epoch. This
+//     is specified by the EpochSetup Event for the current epoch and remains static
+//     throughout the epoch.
+var IsVotingConsensusCommitteeMember = And[flow.Identity](
+	IsValidCurrentEpochParticipant,    // enforces 1.
+	Adapt(IsConsensusCommitteeMember), // enforces 2.
 )
 
 // IsValidDKGParticipant is an identity filter for all DKG participants. It is
 // equivalent to the filter for consensus committee members, as these are
 // the same group for now.
-var IsValidDKGParticipant = IsVotingConsensusCommitteeMember
+var IsValidDKGParticipant = IsConsensusCommitteeMember
+
+// NotEjectedFilter is an identity filter for peers that are not ejected.
+var NotEjectedFilter = Not(HasParticipationStatus(flow.EpochParticipationStatusEjected))
+
+// HasWeightGreaterThanZero returns a filter for nodes with a weight greater than zero.
+func HasWeightGreaterThanZero[T flow.GenericIdentity](identity *T) bool {
+	return (*identity).GetInitialWeight() > 0
+}
+
+// IsValidProtocolParticipant is an identity filter for all valid protocol participants.
+// A protocol participant is considered valid if and only if the following are both true.
+// 1. The node is not ejected.
+// 2. The node has a weight greater than 0.
+var IsValidProtocolParticipant = And[flow.Identity](
+	NotEjectedFilter,                        // enforces 1
+	HasWeightGreaterThanZero[flow.Identity], // enforces 2
+)
diff --git a/model/flow/identifier.go b/model/flow/identifier.go
index 1ebc2dc1c77..1da0132557d 100644
--- a/model/flow/identifier.go
+++ b/model/flow/identifier.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package flow
 
 import (
diff --git a/model/flow/identifierList_test.go b/model/flow/identifierList_test.go
index 166b6dcbd5a..754c78a2d97 100644
--- a/model/flow/identifierList_test.go
+++ b/model/flow/identifierList_test.go
@@ -16,7 +16,7 @@ import (
 func TestCanonicalOrderingMatch(t *testing.T) {
 	identities := unittest.IdentityListFixture(100)
 	require.Equal(t,
-		identities.Sort(flow.Canonical).NodeIDs(),
+		identities.Sort(flow.Canonical[flow.Identity]).NodeIDs(),
 		identities.NodeIDs().Sort(flow.IdentifierCanonical))
 }
 
diff --git a/model/flow/identifier_order.go b/model/flow/identifier_order.go
index af258f531bc..74ad37a314d 100644
--- a/model/flow/identifier_order.go
+++ b/model/flow/identifier_order.go
@@ -27,7 +27,7 @@ func IdentifierCanonical(id1 Identifier, id2 Identifier) int {
 	return bytes.Compare(id1[:], id2[:])
 }
 
-// IsCanonical returns true if and only if the given identifiers are in canonical order.
+// IsIdentifierCanonical returns true if and only if the given identifiers are in canonical order.
 //
 // By convention, two identifiers (i1, i2) are in canonical order if i1's bytes
 // are lexicographically _strictly_ smaller than i2's bytes.
@@ -38,7 +38,7 @@ func IsIdentifierCanonical(i1, i2 Identifier) bool {
 	return IdentifierCanonical(i1, i2) < 0
 }
 
-// IsIdentityListCanonical returns true if and only if the given list is
+// IsIdentifierListCanonical returns true if and only if the given list is
 // _strictly_ sorted with regards to the canonical order.
 //
 // The strictness is important here, meaning that a list with 2 equal identifiers
diff --git a/model/flow/identity.go b/model/flow/identity.go
index 171abf9ed42..c4b149c08e2 100644
--- a/model/flow/identity.go
+++ b/model/flow/identity.go
@@ -4,30 +4,19 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"math"
-	"regexp"
-	"strconv"
-
-	"golang.org/x/exp/slices"
 
 	"github.com/ethereum/go-ethereum/rlp"
 	"github.com/fxamacker/cbor/v2"
 	"github.com/onflow/crypto"
-	"github.com/pkg/errors"
 	"github.com/vmihailenco/msgpack"
-
-	"github.com/onflow/flow-go/utils/rand"
 )
 
 // DefaultInitialWeight is the default initial weight for a node identity.
 // It is equal to the default initial weight in the FlowIDTableStaking smart contract.
 const DefaultInitialWeight = 100
 
-// rxid is the regex for parsing node identity entries.
-var rxid = regexp.MustCompile(`^(collection|consensus|execution|verification|access)-([0-9a-fA-F]{64})@([\w\d]+|[\w\d][\w\d\-]*[\w\d](?:\.*[\w\d][\w\d\-]*[\w\d])*|[\w\d][\w\d\-]*[\w\d])(:[\d]+)?=(\d{1,20})$`)
-
-// Identity represents the public identity of one network participant (node).
-type Identity struct {
+// IdentitySkeleton represents the static part of a network participant's (i.e. node's) public identity.
+type IdentitySkeleton struct {
 	// NodeID uniquely identifies a particular node. A node's ID is fixed for
 	// the duration of that node's participation in the network.
 	NodeID Identifier
@@ -36,76 +25,111 @@ type Identity struct {
 	// Role is the node's role in the network and defines its abilities and
 	// responsibilities.
 	Role Role
-	// Weight represents the node's authority to perform certain tasks relative
-	// to other nodes. For example, in the consensus committee, the node's weight
-	// represents the weight assigned to its votes.
-	//
-	// A node's weight is distinct from its stake. Stake represents the quantity
-	// of FLOW tokens held by the network in escrow during the course of the node's
-	// participation in the network. The stake is strictly managed by the service
-	// account smart contracts.
-	//
-	// Nodes which are registered to join at the next epoch will appear in the
-	// identity table but are considered to have zero weight up until their first
-	// epoch begins. Likewise nodes which were registered in the previous epoch
-	// but have left at the most recent epoch boundary will appear in the identity
-	// table with zero weight.
-	Weight uint64
-	// Ejected represents whether a node has been permanently removed from the
-	// network. A node may be ejected for either:
-	// * committing one protocol felony
-	// * committing a series of protocol misdemeanours
-	Ejected       bool
+	// InitialWeight is a 'trust score' initially assigned by EpochSetup event after
+	// the staking phase. The initial weights define the supermajority thresholds for
+	// the cluster and security node consensus throughout the Epoch.
+	InitialWeight uint64
 	StakingPubKey crypto.PublicKey
 	NetworkPubKey crypto.PublicKey
 }
 
-func (id *Identity) Equals(other *Identity) bool {
-	if other == nil {
-		return false
-	}
-	return id.NodeID == other.NodeID &&
-		id.Address == other.Address &&
-		id.Role == other.Role &&
-		id.Weight == other.Weight &&
-		id.Ejected == other.Ejected &&
-		id.StakingPubKey.Equals(other.StakingPubKey) &&
-		id.NetworkPubKey.Equals(other.NetworkPubKey)
-}
-
-// ParseIdentity parses a string representation of an identity.
-func ParseIdentity(identity string) (*Identity, error) {
-
-	// use the regex to match the four parts of an identity
-	matches := rxid.FindStringSubmatch(identity)
-	if len(matches) != 6 {
-		return nil, errors.New("invalid identity string format")
-	}
+// EpochParticipationStatus represents the status of a node's participation. Depending on what
+// changes were applied to the protocol state, a node may be in one of four states:
+// /   - joining - the node is not active in the current epoch and will be active in the next epoch.
+// /   - active - the node was included in the EpochSetup event for the current epoch and is actively participating in the current epoch.
+// /   - leaving - the node was active in the previous epoch but is not active in the current epoch.
+// /   - ejected - the node has been permanently removed from the network.
+//
+// /            EpochSetup
+// /	      ┌────────────⬤ unregistered ◯◄───────────┐
+// /	┌─────▼─────┐        ┌───────────┐        ┌─────┴─────┐
+// /	│  JOINING  ├───────►│  ACTIVE   ├───────►│  LEAVING  │
+// /	└─────┬─────┘        └─────┬─────┘        └─────┬─────┘
+// /	      │              ┌─────▼─────┐              │
+// /          └─────────────►│  EJECTED  │◄─────────────┘
+// /                         └───────────┘
+//
+// Only active nodes are allowed to perform certain tasks relative to other nodes.
+// Nodes which are registered to join at the next epoch will appear in the
+// identity table but aren't considered active until their first
+// epoch begins. Likewise, nodes which were registered in the previous epoch
+// but have left at the most recent epoch boundary will appear in the identity
+// table with leaving participation status.
+// A node may be ejected by either:
+//   - requesting self-ejection to protect its stake in case the node operator suspects
+//     the node's keys to be compromised
+//   - committing a serious protocol violation or multiple smaller misdemeanours.
+type EpochParticipationStatus int
+
+const (
+	EpochParticipationStatusJoining EpochParticipationStatus = iota
+	EpochParticipationStatusActive
+	EpochParticipationStatusLeaving
+	EpochParticipationStatusEjected
+)
 
-	// none of these will error as they are checked by the regex
-	var nodeID Identifier
-	nodeID, err := HexStringToIdentifier(matches[2])
+// String returns string representation of enum value.
+func (s EpochParticipationStatus) String() string {
+	return [...]string{
+		"EpochParticipationStatusJoining",
+		"EpochParticipationStatusActive",
+		"EpochParticipationStatusLeaving",
+		"EpochParticipationStatusEjected",
+	}[s]
+}
+
+// ParseEpochParticipationStatus converts string representation of EpochParticipationStatus into a typed value.
+// An exception will be returned if failed to convert.
+func ParseEpochParticipationStatus(s string) (EpochParticipationStatus, error) {
+	switch s {
+	case EpochParticipationStatusJoining.String():
+		return EpochParticipationStatusJoining, nil
+	case EpochParticipationStatusActive.String():
+		return EpochParticipationStatusActive, nil
+	case EpochParticipationStatusLeaving.String():
+		return EpochParticipationStatusLeaving, nil
+	case EpochParticipationStatusEjected.String():
+		return EpochParticipationStatusEjected, nil
+	default:
+		return 0, fmt.Errorf("invalid epoch participation status")
+	}
+}
+
+// EncodeRLP performs RLP encoding of custom type, it's need to be able to hash structures that include EpochParticipationStatus.
+// No errors are expected during normal operations.
+func (s EpochParticipationStatus) EncodeRLP(w io.Writer) error {
+	encodable := s.String()
+	err := rlp.Encode(w, encodable)
 	if err != nil {
-		return nil, err
+		return fmt.Errorf("could not encode rlp: %w", err)
 	}
-	address := matches[3] + matches[4]
-	role, _ := ParseRole(matches[1])
-	weight, _ := strconv.ParseUint(matches[5], 10, 64)
+	return nil
+}
 
-	// create the identity
-	iy := Identity{
-		NodeID:  nodeID,
-		Address: address,
-		Role:    role,
-		Weight:  weight,
-	}
+// DynamicIdentity represents the dynamic part of public identity of one network participant (node).
+type DynamicIdentity struct {
+	EpochParticipationStatus
+}
+
+// Identity is combined from static and dynamic part and represents the full public identity of one network participant (node).
+type Identity struct {
+	IdentitySkeleton
+	DynamicIdentity
+}
 
-	return &iy, nil
+// IsEjected returns true if the node is ejected from the network.
+func (iy *DynamicIdentity) IsEjected() bool {
+	return iy.EpochParticipationStatus == EpochParticipationStatusEjected
 }
 
 // String returns a string representation of the identity.
 func (iy Identity) String() string {
-	return fmt.Sprintf("%s-%s@%s=%d", iy.Role, iy.NodeID.String(), iy.Address, iy.Weight)
+	return fmt.Sprintf("%s-%s@%s=%s", iy.Role, iy.NodeID.String(), iy.Address, iy.EpochParticipationStatus.String())
+}
+
+// String returns a string representation of the identity.
+func (iy IdentitySkeleton) String() string {
+	return fmt.Sprintf("%s-%s@%s", iy.Role, iy.NodeID.String(), iy.Address)
 }
 
 // ID returns a unique, persistent identifier for the identity.
@@ -119,41 +143,75 @@ func (iy Identity) Checksum() Identifier {
 	return MakeID(iy)
 }
 
-type encodableIdentity struct {
+// GetNodeID returns node ID for the identity. It is needed to satisfy GenericIdentity constraint.
+func (iy IdentitySkeleton) GetNodeID() Identifier {
+	return iy.NodeID
+}
+
+// GetRole returns a node role for the identity. It is needed to satisfy GenericIdentity constraint.
+func (iy IdentitySkeleton) GetRole() Role {
+	return iy.Role
+}
+
+// GetStakingPubKey returns staking public key for the identity. It is needed to satisfy GenericIdentity constraint.
+func (iy IdentitySkeleton) GetStakingPubKey() crypto.PublicKey {
+	return iy.StakingPubKey
+}
+
+// GetNetworkPubKey returns network public key for the identity. It is needed to satisfy GenericIdentity constraint.
+func (iy IdentitySkeleton) GetNetworkPubKey() crypto.PublicKey {
+	return iy.NetworkPubKey
+}
+
+// GetInitialWeight returns initial weight for the identity. It is needed to satisfy GenericIdentity constraint.
+func (iy IdentitySkeleton) GetInitialWeight() uint64 {
+	return iy.InitialWeight
+}
+
+// GetSkeleton returns the skeleton part for the identity. It is needed to satisfy GenericIdentity constraint.
+func (iy IdentitySkeleton) GetSkeleton() IdentitySkeleton {
+	return iy
+}
+
+type encodableIdentitySkeleton struct {
 	NodeID        Identifier
 	Address       string `json:",omitempty"`
 	Role          Role
-	Weight        uint64
+	InitialWeight uint64
 	StakingPubKey []byte
 	NetworkPubKey []byte
 }
 
-// decodableIdentity provides backward-compatible decoding of old models
-// which use the Stake field in place of Weight.
-type decodableIdentity struct {
-	encodableIdentity
-	// Stake previously was used in place of the Weight field.
-	// Deprecated: supported in decoding for backward-compatibility
-	Stake uint64
+type encodableIdentity struct {
+	encodableIdentitySkeleton
+	ParticipationStatus string
 }
 
-func encodableFromIdentity(iy Identity) (encodableIdentity, error) {
-	ie := encodableIdentity{iy.NodeID, iy.Address, iy.Role, iy.Weight, nil, nil}
+func encodableSkeletonFromIdentity(iy IdentitySkeleton) encodableIdentitySkeleton {
+	ie := encodableIdentitySkeleton{
+		NodeID:        iy.NodeID,
+		Address:       iy.Address,
+		Role:          iy.Role,
+		InitialWeight: iy.InitialWeight,
+	}
 	if iy.StakingPubKey != nil {
 		ie.StakingPubKey = iy.StakingPubKey.Encode()
 	}
 	if iy.NetworkPubKey != nil {
 		ie.NetworkPubKey = iy.NetworkPubKey.Encode()
 	}
-	return ie, nil
+	return ie
 }
 
-func (iy Identity) MarshalJSON() ([]byte, error) {
-	encodable, err := encodableFromIdentity(iy)
-	if err != nil {
-		return nil, fmt.Errorf("could not convert identity to encodable: %w", err)
+func encodableFromIdentity(iy Identity) encodableIdentity {
+	return encodableIdentity{
+		encodableIdentitySkeleton: encodableSkeletonFromIdentity(iy.IdentitySkeleton),
+		ParticipationStatus:       iy.EpochParticipationStatus.String(),
 	}
+}
 
+func (iy IdentitySkeleton) MarshalJSON() ([]byte, error) {
+	encodable := encodableSkeletonFromIdentity(iy)
 	data, err := json.Marshal(encodable)
 	if err != nil {
 		return nil, fmt.Errorf("could not encode json: %w", err)
@@ -161,11 +219,44 @@ func (iy Identity) MarshalJSON() ([]byte, error) {
 	return data, nil
 }
 
-func (iy Identity) MarshalCBOR() ([]byte, error) {
-	encodable, err := encodableFromIdentity(iy)
+func (iy IdentitySkeleton) MarshalCBOR() ([]byte, error) {
+	encodable := encodableSkeletonFromIdentity(iy)
+	data, err := cbor.Marshal(encodable)
+	if err != nil {
+		return nil, fmt.Errorf("could not encode cbor: %w", err)
+	}
+	return data, nil
+}
+
+func (iy IdentitySkeleton) MarshalMsgpack() ([]byte, error) {
+	encodable := encodableSkeletonFromIdentity(iy)
+	data, err := msgpack.Marshal(encodable)
 	if err != nil {
-		return nil, fmt.Errorf("could not convert identity to encodable: %w", err)
+		return nil, fmt.Errorf("could not encode msgpack: %w", err)
 	}
+	return data, nil
+}
+
+func (iy IdentitySkeleton) EncodeRLP(w io.Writer) error {
+	encodable := encodableSkeletonFromIdentity(iy)
+	err := rlp.Encode(w, encodable)
+	if err != nil {
+		return fmt.Errorf("could not encode rlp: %w", err)
+	}
+	return nil
+}
+
+func (iy Identity) MarshalJSON() ([]byte, error) {
+	encodable := encodableFromIdentity(iy)
+	data, err := json.Marshal(encodable)
+	if err != nil {
+		return nil, fmt.Errorf("could not encode json: %w", err)
+	}
+	return data, nil
+}
+
+func (iy Identity) MarshalCBOR() ([]byte, error) {
+	encodable := encodableFromIdentity(iy)
 	data, err := cbor.Marshal(encodable)
 	if err != nil {
 		return nil, fmt.Errorf("could not encode cbor: %w", err)
@@ -174,10 +265,7 @@ func (iy Identity) MarshalCBOR() ([]byte, error) {
 }
 
 func (iy Identity) MarshalMsgpack() ([]byte, error) {
-	encodable, err := encodableFromIdentity(iy)
-	if err != nil {
-		return nil, fmt.Errorf("could not convert to encodable: %w", err)
-	}
+	encodable := encodableFromIdentity(iy)
 	data, err := msgpack.Marshal(encodable)
 	if err != nil {
 		return nil, fmt.Errorf("could not encode msgpack: %w", err)
@@ -186,22 +274,19 @@ func (iy Identity) MarshalMsgpack() ([]byte, error) {
 }
 
 func (iy Identity) EncodeRLP(w io.Writer) error {
-	encodable, err := encodableFromIdentity(iy)
-	if err != nil {
-		return fmt.Errorf("could not convert to encodable: %w", err)
-	}
-	err = rlp.Encode(w, encodable)
+	encodable := encodableFromIdentity(iy)
+	err := rlp.Encode(w, encodable)
 	if err != nil {
 		return fmt.Errorf("could not encode rlp: %w", err)
 	}
 	return nil
 }
 
-func identityFromEncodable(ie encodableIdentity, identity *Identity) error {
+func identitySkeletonFromEncodable(ie encodableIdentitySkeleton, identity *IdentitySkeleton) error {
 	identity.NodeID = ie.NodeID
 	identity.Address = ie.Address
 	identity.Role = ie.Role
-	identity.Weight = ie.Weight
+	identity.InitialWeight = ie.InitialWeight
 	var err error
 	if ie.StakingPubKey != nil {
 		if identity.StakingPubKey, err = crypto.DecodePublicKey(crypto.BLSBLS12381, ie.StakingPubKey); err != nil {
@@ -216,20 +301,65 @@ func identityFromEncodable(ie encodableIdentity, identity *Identity) error {
 	return nil
 }
 
-func (iy *Identity) UnmarshalJSON(b []byte) error {
-	var decodable decodableIdentity
+func identityFromEncodable(ie encodableIdentity, identity *Identity) error {
+	err := identitySkeletonFromEncodable(ie.encodableIdentitySkeleton, &identity.IdentitySkeleton)
+	if err != nil {
+		return fmt.Errorf("could not decode identity skeleton: %w", err)
+	}
+	participationStatus, err := ParseEpochParticipationStatus(ie.ParticipationStatus)
+	if err != nil {
+		return fmt.Errorf("could not decode epoch participation status: %w", err)
+	}
+	identity.EpochParticipationStatus = participationStatus
+	return nil
+}
+
+func (iy *IdentitySkeleton) UnmarshalJSON(b []byte) error {
+	var decodable encodableIdentitySkeleton
 	err := json.Unmarshal(b, &decodable)
 	if err != nil {
 		return fmt.Errorf("could not decode json: %w", err)
 	}
-	// compat: translate Stake fields to Weight
-	if decodable.Stake != 0 {
-		if decodable.Weight != 0 {
-			return fmt.Errorf("invalid identity with both Stake and Weight fields")
-		}
-		decodable.Weight = decodable.Stake
+	err = identitySkeletonFromEncodable(decodable, iy)
+	if err != nil {
+		return fmt.Errorf("could not convert from encodable json: %w", err)
+	}
+	return nil
+}
+
+func (iy *IdentitySkeleton) UnmarshalCBOR(b []byte) error {
+	var encodable encodableIdentitySkeleton
+	err := cbor.Unmarshal(b, &encodable)
+	if err != nil {
+		return fmt.Errorf("could not decode json: %w", err)
+	}
+	err = identitySkeletonFromEncodable(encodable, iy)
+	if err != nil {
+		return fmt.Errorf("could not convert from encodable cbor: %w", err)
+	}
+	return nil
+}
+
+func (iy *IdentitySkeleton) UnmarshalMsgpack(b []byte) error {
+	var encodable encodableIdentitySkeleton
+	err := msgpack.Unmarshal(b, &encodable)
+	if err != nil {
+		return fmt.Errorf("could not decode json: %w", err)
 	}
-	err = identityFromEncodable(decodable.encodableIdentity, iy)
+	err = identitySkeletonFromEncodable(encodable, iy)
+	if err != nil {
+		return fmt.Errorf("could not convert from encodable msgpack: %w", err)
+	}
+	return nil
+}
+
+func (iy *Identity) UnmarshalJSON(b []byte) error {
+	var decodable encodableIdentity
+	err := json.Unmarshal(b, &decodable)
+	if err != nil {
+		return fmt.Errorf("could not decode json: %w", err)
+	}
+	err = identityFromEncodable(decodable, iy)
 	if err != nil {
 		return fmt.Errorf("could not convert from encodable json: %w", err)
 	}
@@ -262,7 +392,7 @@ func (iy *Identity) UnmarshalMsgpack(b []byte) error {
 	return nil
 }
 
-func (iy *Identity) EqualTo(other *Identity) bool {
+func (iy *IdentitySkeleton) EqualTo(other *IdentitySkeleton) bool {
 	if iy.NodeID != other.NodeID {
 		return false
 	}
@@ -272,10 +402,7 @@ func (iy *Identity) EqualTo(other *Identity) bool {
 	if iy.Role != other.Role {
 		return false
 	}
-	if iy.Weight != other.Weight {
-		return false
-	}
-	if iy.Ejected != other.Ejected {
+	if iy.InitialWeight != other.InitialWeight {
 		return false
 	}
 	if (iy.StakingPubKey != nil && other.StakingPubKey == nil) ||
@@ -297,284 +424,16 @@ func (iy *Identity) EqualTo(other *Identity) bool {
 	return true
 }
 
-// IdentityFilter is a filter on identities.
-type IdentityFilter func(*Identity) bool
-
-// IdentityOrder is an order function for identities.
-//
-// It defines a strict weak ordering between identities.
-// It returns a negative number if the first identity is "strictly less" than the second,
-// a positive number if the second identity is "strictly less" than the first,
-// and zero if the two identities are equal.
-//
-// `IdentityOrder` can be used to sort identities with
-// https://pkg.go.dev/golang.org/x/exp/slices#SortFunc.
-type IdentityOrder func(*Identity, *Identity) int
-
-// IdentityMapFunc is a modifier function for map operations for identities.
-// Identities are COPIED from the source slice.
-type IdentityMapFunc func(Identity) Identity
-
-// IdentityList is a list of nodes.
-type IdentityList []*Identity
-
-// Filter will apply a filter to the identity list.
-func (il IdentityList) Filter(filter IdentityFilter) IdentityList {
-	var dup IdentityList
-IDLoop:
-	for _, identity := range il {
-		if !filter(identity) {
-			continue IDLoop
-		}
-		dup = append(dup, identity)
-	}
-	return dup
-}
-
-// Map returns a new identity list with the map function f applied to a copy of
-// each identity.
-//
-// CAUTION: this relies on structure copy semantics. Map functions that modify
-// an object referenced by the input Identity structure will modify identities
-// in the source slice as well.
-func (il IdentityList) Map(f IdentityMapFunc) IdentityList {
-	dup := make(IdentityList, 0, len(il))
-	for _, identity := range il {
-		next := f(*identity)
-		dup = append(dup, &next)
-	}
-	return dup
-}
-
-// Copy returns a copy of the receiver. The resulting slice uses a different
-// backing array, meaning appends and insert operations on either slice are
-// guaranteed to only affect that slice.
-//
-// Copy should be used when modifying an existing identity list by either
-// appending new elements, re-ordering, or inserting new elements in an
-// existing index.
-func (il IdentityList) Copy() IdentityList {
-	dup := make(IdentityList, 0, len(il))
-
-	lenList := len(il)
-
-	// performance tests show this is faster than 'range'
-	for i := 0; i < lenList; i++ {
-		// copy the object
-		next := *(il[i])
-		dup = append(dup, &next)
-	}
-	return dup
-}
-
-// Selector returns an identity filter function that selects only identities
-// within this identity list.
-func (il IdentityList) Selector() IdentityFilter {
-
-	lookup := il.Lookup()
-	return func(identity *Identity) bool {
-		_, exists := lookup[identity.NodeID]
-		return exists
-	}
-}
-
-func (il IdentityList) Lookup() map[Identifier]*Identity {
-	lookup := make(map[Identifier]*Identity, len(il))
-	for _, identity := range il {
-		lookup[identity.NodeID] = identity
-	}
-	return lookup
-}
-
-// Sort will sort the list using the given ordering.  This is
-// not recommended for performance.  Expand the 'less' function
-// in place for best performance, and don't use this function.
-func (il IdentityList) Sort(less IdentityOrder) IdentityList {
-	dup := il.Copy()
-	slices.SortFunc(dup, less)
-	return dup
-}
-
-// NodeIDs returns the NodeIDs of the nodes in the list.
-func (il IdentityList) NodeIDs() IdentifierList {
-	nodeIDs := make([]Identifier, 0, len(il))
-	for _, id := range il {
-		nodeIDs = append(nodeIDs, id.NodeID)
-	}
-	return nodeIDs
-}
-
-// PublicStakingKeys returns a list with the public staking keys (order preserving).
-func (il IdentityList) PublicStakingKeys() []crypto.PublicKey {
-	pks := make([]crypto.PublicKey, 0, len(il))
-	for _, id := range il {
-		pks = append(pks, id.StakingPubKey)
-	}
-	return pks
-}
-
-// ID uniquely identifies a list of identities, by node ID. This can be used
-// to perpetually identify a group of nodes, even if mutable fields of some nodes
-// are changed, as node IDs are immutable.
-// CAUTION:
-//   - An IdentityList's ID is a cryptographic commitment to only node IDs. A node operator
-//     can freely choose the ID for their node. There is no relationship whatsoever between
-//     a node's ID and keys.
-//   - To generate a cryptographic commitment for the full IdentityList, use method `Checksum()`.
-//   - The outputs of `IdentityList.ID()` and `IdentityList.Checksum()` are both order-sensitive.
-//     Therefore, the `IdentityList` must be in canonical order, unless explicitly specified
-//     otherwise by the protocol.
-func (il IdentityList) ID() Identifier {
-	return il.NodeIDs().ID()
-}
-
-// Checksum generates a cryptographic commitment to the full IdentityList, including mutable fields.
-// The checksum for the same group of identities (by NodeID) may change from block to block.
-func (il IdentityList) Checksum() Identifier {
-	return MakeID(il)
-}
-
-// TotalWeight returns the total weight of all given identities.
-func (il IdentityList) TotalWeight() uint64 {
-	var total uint64
-	for _, identity := range il {
-		total += identity.Weight
-	}
-	return total
-}
-
-// Count returns the count of identities.
-func (il IdentityList) Count() uint {
-	return uint(len(il))
-}
-
-// ByIndex returns the node at the given index.
-func (il IdentityList) ByIndex(index uint) (*Identity, bool) {
-	if index >= uint(len(il)) {
-		return nil, false
-	}
-	return il[int(index)], true
-}
-
-// ByNodeID gets a node from the list by node ID.
-func (il IdentityList) ByNodeID(nodeID Identifier) (*Identity, bool) {
-	for _, identity := range il {
-		if identity.NodeID == nodeID {
-			return identity, true
-		}
-	}
-	return nil, false
-}
-
-// ByNetworkingKey gets a node from the list by network public key.
-func (il IdentityList) ByNetworkingKey(key crypto.PublicKey) (*Identity, bool) {
-	for _, identity := range il {
-		if identity.NetworkPubKey.Equals(key) {
-			return identity, true
-		}
-	}
-	return nil, false
-}
-
-// Sample returns non-deterministic random sample from the `IdentityList`
-func (il IdentityList) Sample(size uint) (IdentityList, error) {
-	n := uint(len(il))
-	dup := make([]*Identity, 0, n)
-	dup = append(dup, il...)
-	if n < size {
-		size = n
-	}
-	swap := func(i, j uint) {
-		dup[i], dup[j] = dup[j], dup[i]
-	}
-	err := rand.Samples(n, size, swap)
-	if err != nil {
-		return nil, fmt.Errorf("failed to sample identity list: %w", err)
-	}
-	return dup[:size], nil
-}
-
-// Shuffle randomly shuffles the identity list (non-deterministic),
-// and returns the shuffled list without modifying the receiver.
-func (il IdentityList) Shuffle() (IdentityList, error) {
-	return il.Sample(uint(len(il)))
+func (iy *DynamicIdentity) EqualTo(other *DynamicIdentity) bool {
+	return iy.EpochParticipationStatus == other.EpochParticipationStatus
 }
 
-// SamplePct returns a random sample from the receiver identity list. The
-// sample contains `pct` percentage of the list. The sample is rounded up
-// if `pct>0`, so this will always select at least one identity.
-//
-// NOTE: The input must be between 0-1.
-func (il IdentityList) SamplePct(pct float64) (IdentityList, error) {
-	if pct <= 0 {
-		return IdentityList{}, nil
-	}
-
-	count := float64(il.Count()) * pct
-	size := uint(math.Round(count))
-	// ensure we always select at least 1, for non-zero input
-	if size == 0 {
-		size = 1
-	}
-
-	return il.Sample(size)
-}
-
-// Union returns a new identity list containing every identity that occurs in
-// either `il`, or `other`, or both. There are no duplicates in the output,
-// where duplicates are identities with the same node ID.
-// The returned IdentityList is sorted canonically.
-func (il IdentityList) Union(other IdentityList) IdentityList {
-	maxLen := len(il) + len(other)
-
-	union := make(IdentityList, 0, maxLen)
-	set := make(map[Identifier]struct{}, maxLen)
-
-	for _, list := range []IdentityList{il, other} {
-		for _, id := range list {
-			if _, isDuplicate := set[id.NodeID]; !isDuplicate {
-				set[id.NodeID] = struct{}{}
-				union = append(union, id)
-			}
-		}
+func (iy *Identity) EqualTo(other *Identity) bool {
+	if !iy.IdentitySkeleton.EqualTo(&other.IdentitySkeleton) {
+		return false
 	}
-
-	slices.SortFunc(union, Canonical)
-	return union
-}
-
-// EqualTo checks if the other list if the same, that it contains the same elements
-// in the same order
-func (il IdentityList) EqualTo(other IdentityList) bool {
-	return slices.EqualFunc(il, other, func(a, b *Identity) bool {
-		return a.EqualTo(b)
-	})
-}
-
-// Exists takes a previously sorted Identity list and searches it for the target value
-// This code is optimized, so the coding style will be different
-// target:  value to search for
-// CAUTION:  The identity list MUST be sorted prior to calling this method
-func (il IdentityList) Exists(target *Identity) bool {
-	return il.IdentifierExists(target.NodeID)
-}
-
-// IdentifierExists takes a previously sorted Identity list and searches it for the target value
-// target:  value to search for
-// CAUTION:  The identity list MUST be sorted prior to calling this method
-func (il IdentityList) IdentifierExists(target Identifier) bool {
-	_, ok := slices.BinarySearchFunc(il, &Identity{NodeID: target}, Canonical)
-	return ok
-}
-
-// GetIndex returns the index of the identifier in the IdentityList and true
-// if the identifier is found.
-func (il IdentityList) GetIndex(target Identifier) (uint, bool) {
-	i := slices.IndexFunc(il, func(a *Identity) bool {
-		return a.NodeID == target
-	})
-	if i == -1 {
-		return 0, false
+	if !iy.DynamicIdentity.EqualTo(&other.DynamicIdentity) {
+		return false
 	}
-	return uint(i), true
+	return true
 }
diff --git a/model/flow/identity_list.go b/model/flow/identity_list.go
new file mode 100644
index 00000000000..50cac6c22be
--- /dev/null
+++ b/model/flow/identity_list.go
@@ -0,0 +1,364 @@
+package flow
+
+import (
+	"bytes"
+	"fmt"
+	"math"
+
+	"github.com/onflow/crypto"
+	"golang.org/x/exp/slices"
+
+	"github.com/onflow/flow-go/utils/rand"
+)
+
+// Notes on runtime EFFICIENCY of GENERIC TYPES:
+// DO NOT pass an interface to a generic function (100x runtime cost as of go 1.20).
+// For example, consider the function
+//
+//    func f[T GenericIdentity]()
+//
+// The call `f(identity)` is completely ok and doesn't introduce overhead when `identity` is a struct type,
+// such as `var identity *flow.Identity`.
+// In contrast `f(identity)` where identity is declared as an interface `var identity GenericIdentity` is drastically slower,
+// since golang involves a global hash table lookup for every method call to dispatch the underlying type behind the interface.
+
+// GenericIdentity defines a constraint for generic identities.
+// Golang doesn't support constraint with fields(for time being) so we have to define this interface
+// with getter methods.
+// Details here: https://github.com/golang/go/issues/51259.
+type GenericIdentity interface {
+	Identity | IdentitySkeleton
+	GetNodeID() Identifier
+	GetRole() Role
+	GetStakingPubKey() crypto.PublicKey
+	GetNetworkPubKey() crypto.PublicKey
+	GetInitialWeight() uint64
+	GetSkeleton() IdentitySkeleton
+}
+
+// IdentityFilter is a filter on identities. Mathematically, an IdentityFilter F
+// can be described as a function F: 𝓘 → 𝐼, where 𝓘 denotes the set of all identities
+// and 𝐼 ⊆ 𝓘. For an input identity i, F(i) returns true if and only if i passed the
+// filter, i.e. i ∈ 𝐼. Returning false means that some necessary criterion was violated
+// and identity i should be dropped, i.e. i ∉ 𝐼.
+type IdentityFilter[T GenericIdentity] func(*T) bool
+
+// IdentityOrder is an order function for identities.
+//
+// It defines a strict weak ordering between identities.
+// It returns a negative number if the first identity is "strictly less" than the second,
+// a positive number if the second identity is "strictly less" than the first,
+// and zero if the two identities are equal.
+//
+// `IdentityOrder` can be used to sort identities with
+// https://pkg.go.dev/golang.org/x/exp/slices#SortFunc.
+type IdentityOrder[T GenericIdentity] func(*T, *T) int
+
+// IdentityMapFunc is a modifier function for map operations for identities.
+// Identities are COPIED from the source slice.
+type IdentityMapFunc[T GenericIdentity] func(T) T
+
+// IdentitySkeletonList is a list of nodes skeletons. We use a type alias instead of defining a new type
+// since go generics doesn't support implicit conversion between types.
+type IdentitySkeletonList = GenericIdentityList[IdentitySkeleton]
+
+// IdentityList is a list of nodes. We use a type alias instead of defining a new type
+// since go generics doesn't support implicit conversion between types.
+type IdentityList = GenericIdentityList[Identity]
+
+type GenericIdentityList[T GenericIdentity] []*T
+
+// Filter will apply a filter to the identity list.
+// The resulting list will only contain entries that match the filtering criteria.
+func (il GenericIdentityList[T]) Filter(filter IdentityFilter[T]) GenericIdentityList[T] {
+	var dup GenericIdentityList[T]
+	for _, identity := range il {
+		if filter(identity) {
+			dup = append(dup, identity)
+		}
+	}
+	return dup
+}
+
+// Map returns a new identity list with the map function f applied to a copy of
+// each identity.
+//
+// CAUTION: this relies on structure copy semantics. Map functions that modify
+// an object referenced by the input Identity structure will modify identities
+// in the source slice as well.
+func (il GenericIdentityList[T]) Map(f IdentityMapFunc[T]) GenericIdentityList[T] {
+	dup := make(GenericIdentityList[T], 0, len(il))
+	for _, identity := range il {
+		next := f(*identity)
+		dup = append(dup, &next)
+	}
+	return dup
+}
+
+// Copy returns a copy of IdentityList. The resulting slice uses a different
+// backing array, meaning appends and insert operations on either slice are
+// guaranteed to only affect that slice.
+//
+// Copy should be used when modifying an existing identity list by either
+// appending new elements, re-ordering, or inserting new elements in an
+// existing index.
+//
+// CAUTION:
+// All Identity fields are deep-copied, _except_ for their keys, which
+// are copied by reference as they are treated as immutable by convention.
+func (il GenericIdentityList[T]) Copy() GenericIdentityList[T] {
+	dup := make(GenericIdentityList[T], 0, len(il))
+	lenList := len(il)
+	for i := 0; i < lenList; i++ { // performance tests show this is faster than 'range'
+		next := *(il[i]) // copy the object
+		dup = append(dup, &next)
+	}
+	return dup
+}
+
+// Selector returns an identity filter function that selects only identities
+// within this identity list.
+func (il GenericIdentityList[T]) Selector() IdentityFilter[T] {
+	lookup := il.Lookup()
+	return func(identity *T) bool {
+		_, exists := lookup[(*identity).GetNodeID()]
+		return exists
+	}
+}
+
+// Lookup converts the identity slice to a map using the NodeIDs as keys. This
+// is useful when _repeatedly_ querying identities by their NodeIDs. The
+// conversation from slice to map incurs cost O(n), for `n` the slice length.
+// For a _single_ lookup, use method `ByNodeID(Identifier)` (avoiding conversion).
+func (il GenericIdentityList[T]) Lookup() map[Identifier]*T {
+	lookup := make(map[Identifier]*T, len(il))
+	for _, identity := range il {
+		lookup[(*identity).GetNodeID()] = identity
+	}
+	return lookup
+}
+
+// Sort will sort the list using the given ordering.  This is
+// not recommended for performance.  Expand the 'less' function
+// in place for best performance, and don't use this function.
+func (il GenericIdentityList[T]) Sort(less IdentityOrder[T]) GenericIdentityList[T] {
+	dup := il.Copy()
+	slices.SortFunc(dup, less)
+	return dup
+}
+
+// Sorted returns whether the list is sorted by the input ordering.
+func (il GenericIdentityList[T]) Sorted(less IdentityOrder[T]) bool {
+	return slices.IsSortedFunc(il, less)
+}
+
+// NodeIDs returns the NodeIDs of the nodes in the list (order preserving).
+func (il GenericIdentityList[T]) NodeIDs() IdentifierList {
+	nodeIDs := make([]Identifier, 0, len(il))
+	for _, id := range il {
+		nodeIDs = append(nodeIDs, (*id).GetNodeID())
+	}
+	return nodeIDs
+}
+
+// PublicStakingKeys returns a list with the public staking keys (order preserving).
+func (il GenericIdentityList[T]) PublicStakingKeys() []crypto.PublicKey {
+	pks := make([]crypto.PublicKey, 0, len(il))
+	for _, id := range il {
+		pks = append(pks, (*id).GetStakingPubKey())
+	}
+	return pks
+}
+
+// ID uniquely identifies a list of identities, by node ID. This can be used
+// to perpetually identify a group of nodes, even if mutable fields of some nodes
+// are changed, as node IDs are immutable.
+// CAUTION:
+//   - An IdentityList's ID is a cryptographic commitment to only node IDs. A node operator
+//     can freely choose the ID for their node. There is no relationship whatsoever between
+//     a node's ID and keys.
+//   - To generate a cryptographic commitment for the full IdentityList, use method `Checksum()`.
+//   - The outputs of `IdentityList.ID()` and `IdentityList.Checksum()` are both order-sensitive.
+//     Therefore, the `IdentityList` must be in canonical order, unless explicitly specified
+//     otherwise by the protocol.
+func (il GenericIdentityList[T]) ID() Identifier {
+	return il.NodeIDs().ID()
+}
+
+// Checksum generates a cryptographic commitment to the full IdentityList, including mutable fields.
+// The checksum for the same group of identities (by NodeID) may change from block to block.
+func (il GenericIdentityList[T]) Checksum() Identifier {
+	return MakeID(il)
+}
+
+// TotalWeight returns the total weight of all given identities.
+func (il GenericIdentityList[T]) TotalWeight() uint64 {
+	var total uint64
+	for _, identity := range il {
+		total += (*identity).GetInitialWeight()
+	}
+	return total
+}
+
+// Count returns the count of identities.
+func (il GenericIdentityList[T]) Count() uint {
+	return uint(len(il))
+}
+
+// ByIndex returns the node at the given index.
+func (il GenericIdentityList[T]) ByIndex(index uint) (*T, bool) {
+	if index >= uint(len(il)) {
+		return nil, false
+	}
+	return il[int(index)], true
+}
+
+// ByNodeID gets a node from the list by node ID.
+func (il GenericIdentityList[T]) ByNodeID(nodeID Identifier) (*T, bool) {
+	for _, identity := range il {
+		if (*identity).GetNodeID() == nodeID {
+			return identity, true
+		}
+	}
+	return nil, false
+}
+
+// ByNetworkingKey gets a node from the list by network public key.
+func (il GenericIdentityList[T]) ByNetworkingKey(key crypto.PublicKey) (*T, bool) {
+	for _, identity := range il {
+		if (*identity).GetNetworkPubKey().Equals(key) {
+			return identity, true
+		}
+	}
+	return nil, false
+}
+
+// Sample returns non-deterministic random sample from the `IdentityList`
+func (il GenericIdentityList[T]) Sample(size uint) (GenericIdentityList[T], error) {
+	n := uint(len(il))
+	dup := make(GenericIdentityList[T], 0, n)
+	dup = append(dup, il...)
+	if n < size {
+		size = n
+	}
+	swap := func(i, j uint) {
+		dup[i], dup[j] = dup[j], dup[i]
+	}
+	err := rand.Samples(n, size, swap)
+	if err != nil {
+		return nil, fmt.Errorf("failed to sample identity list: %w", err)
+	}
+	return dup[:size], nil
+}
+
+// Shuffle randomly shuffles the identity list (non-deterministic),
+// and returns the shuffled list without modifying the receiver.
+func (il GenericIdentityList[T]) Shuffle() (GenericIdentityList[T], error) {
+	return il.Sample(uint(len(il)))
+}
+
+// SamplePct returns a random sample from the receiver identity list. The
+// sample contains `pct` percentage of the list. The sample is rounded up
+// if `pct>0`, so this will always select at least one identity.
+//
+// NOTE: The input must be between in the interval [0, 1.0]
+func (il GenericIdentityList[T]) SamplePct(pct float64) (GenericIdentityList[T], error) {
+	if pct <= 0 {
+		return GenericIdentityList[T]{}, nil
+	}
+
+	count := float64(il.Count()) * pct
+	size := uint(math.Round(count))
+	// ensure we always select at least 1, for non-zero input
+	if size == 0 {
+		size = 1
+	}
+
+	return il.Sample(size)
+}
+
+// Union returns a new identity list containing every identity that occurs in
+// either `il`, or `other`, or both. There are no duplicates in the output,
+// where duplicates are identities with the same node ID. In case an entry
+// with the same NodeID exists in the receiver `il` as well as in `other`,
+// the identity from `il` is included in the output.
+// Receiver `il` and/or method input `other` can be nil or empty.
+// The returned IdentityList is sorted in canonical order.
+func (il GenericIdentityList[T]) Union(other GenericIdentityList[T]) GenericIdentityList[T] {
+	maxLen := len(il) + len(other)
+
+	union := make(GenericIdentityList[T], 0, maxLen)
+	set := make(map[Identifier]struct{}, maxLen)
+
+	for _, list := range []GenericIdentityList[T]{il, other} {
+		for _, id := range list {
+			if _, isDuplicate := set[(*id).GetNodeID()]; !isDuplicate {
+				set[(*id).GetNodeID()] = struct{}{}
+				union = append(union, id)
+			}
+		}
+	}
+
+	slices.SortFunc(union, Canonical[T])
+	return union
+}
+
+// IdentityListEqualTo checks if the other list if the same, that it contains the same elements
+// in the same order.
+// NOTE: currently a generic comparison is not possible, so we have to use a specific function.
+func IdentityListEqualTo(lhs, rhs IdentityList) bool {
+	return slices.EqualFunc(lhs, rhs, func(a, b *Identity) bool {
+		return a.EqualTo(b)
+	})
+}
+
+// IdentitySkeletonListEqualTo checks if the other list if the same, that it contains the same elements
+// in the same order.
+// NOTE: currently a generic comparison is not possible, so we have to use a specific function.
+func IdentitySkeletonListEqualTo(lhs, rhs IdentitySkeletonList) bool {
+	return slices.EqualFunc(lhs, rhs, func(a, b *IdentitySkeleton) bool {
+		return a.EqualTo(b)
+	})
+}
+
+// Exists takes a previously sorted Identity list and searches it for the target
+// identity by its NodeID.
+// CAUTION:
+//   - Other identity fields are not compared.
+//   - The identity list MUST be sorted prior to calling this method.
+func (il GenericIdentityList[T]) Exists(target *T) bool {
+	return il.IdentifierExists((*target).GetNodeID())
+}
+
+// IdentifierExists takes a previously sorted Identity list and searches it for the target value
+// target:  value to search for
+// CAUTION:  The identity list MUST be sorted prior to calling this method
+func (il GenericIdentityList[T]) IdentifierExists(target Identifier) bool {
+	_, ok := slices.BinarySearchFunc(il, target, func(a *T, b Identifier) int {
+		lhs := (*a).GetNodeID()
+		return bytes.Compare(lhs[:], b[:])
+	})
+	return ok
+}
+
+// GetIndex returns the index of the identifier in the IdentityList and true
+// if the identifier is found.
+func (il GenericIdentityList[T]) GetIndex(target Identifier) (uint, bool) {
+	i := slices.IndexFunc(il, func(a *T) bool {
+		return (*a).GetNodeID() == target
+	})
+	if i == -1 {
+		return 0, false
+	}
+	return uint(i), true
+}
+
+// ToSkeleton converts the identity list to a list of identity skeletons.
+func (il GenericIdentityList[T]) ToSkeleton() IdentitySkeletonList {
+	skeletons := make(IdentitySkeletonList, len(il))
+	for i, id := range il {
+		v := (*id).GetSkeleton()
+		skeletons[i] = &v
+	}
+	return skeletons
+}
diff --git a/model/flow/identity_order.go b/model/flow/identity_order.go
index 17930d79d82..d46653d1dbf 100644
--- a/model/flow/identity_order.go
+++ b/model/flow/identity_order.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package flow
 
 // Canonical is a function that defines a weak strict ordering "<" for identities.
@@ -15,8 +13,8 @@ package flow
 // Use `IsCanonical` for canonical order checks.
 //
 // The current function is based on the identifiers bytes lexicographic comparison.
-func Canonical(identity1 *Identity, identity2 *Identity) int {
-	return IdentifierCanonical(identity1.NodeID, identity2.NodeID)
+func Canonical[T GenericIdentity](identity1 *T, identity2 *T) int {
+	return IdentifierCanonical((*identity1).GetNodeID(), (*identity2).GetNodeID())
 }
 
 // IsCanonical returns true if and only if the given Identities are in canonical order.
@@ -27,7 +25,7 @@ func Canonical(identity1 *Identity, identity2 *Identity) int {
 // The strictness is important, meaning that two identities with the same
 // NodeID do not satisfy the canonical order.
 // This also implies that the canonical order is irreflexive ((i,i) isn't in canonical order).
-func IsCanonical(i1, i2 *Identity) bool {
+func IsCanonical[T GenericIdentity](i1, i2 *T) bool {
 	return Canonical(i1, i2) < 0
 }
 
@@ -52,7 +50,7 @@ func ByReferenceOrder(nodeIDs []Identifier) func(*Identity, *Identity) int {
 //
 // The strictness is important here, meaning that a list with 2 successive entities
 // with equal NodeID isn't considered well sorted.
-func IsIdentityListCanonical(il IdentityList) bool {
+func IsIdentityListCanonical[T GenericIdentity](il GenericIdentityList[T]) bool {
 	for i := 0; i < len(il)-1; i++ {
 		if !IsCanonical(il[i], il[i+1]) {
 			return false
diff --git a/model/flow/identity_test.go b/model/flow/identity_test.go
index c3350ab94e2..731c2ed1c0d 100644
--- a/model/flow/identity_test.go
+++ b/model/flow/identity_test.go
@@ -57,7 +57,7 @@ func TestIdentityEncodingJSON(t *testing.T) {
 		var dec flow.Identity
 		err = json.Unmarshal(enc, &dec)
 		require.NoError(t, err)
-		require.True(t, identity.Equals(&dec))
+		require.True(t, identity.EqualTo(&dec))
 	})
 
 	t.Run("empty address should be omitted", func(t *testing.T) {
@@ -70,19 +70,7 @@ func TestIdentityEncodingJSON(t *testing.T) {
 		var dec flow.Identity
 		err = json.Unmarshal(enc, &dec)
 		require.NoError(t, err)
-		require.True(t, identity.Equals(&dec))
-	})
-
-	t.Run("compat: should accept old files using Stake field", func(t *testing.T) {
-		identity := unittest.IdentityFixture(unittest.WithRandomPublicKeys())
-		enc, err := json.Marshal(identity)
-		require.NoError(t, err)
-		// emulate the old encoding by replacing the new field with old field name
-		enc = []byte(strings.Replace(string(enc), "Weight", "Stake", 1))
-		var dec flow.Identity
-		err = json.Unmarshal(enc, &dec)
-		require.NoError(t, err)
-		require.True(t, identity.Equals(&dec))
+		require.True(t, identity.EqualTo(&dec))
 	})
 }
 
@@ -93,7 +81,7 @@ func TestIdentityEncodingMsgpack(t *testing.T) {
 	var dec flow.Identity
 	err = msgpack.Unmarshal(enc, &dec)
 	require.NoError(t, err)
-	require.True(t, identity.Equals(&dec))
+	require.True(t, identity.EqualTo(&dec))
 }
 
 func TestIdentityList_Exists(t *testing.T) {
@@ -102,7 +90,7 @@ func TestIdentityList_Exists(t *testing.T) {
 		il2 := unittest.IdentityListFixture(1)
 
 		// sort the first list
-		il1 = il1.Sort(flow.Canonical)
+		il1 = il1.Sort(flow.Canonical[flow.Identity])
 
 		for i := 0; i < 10; i++ {
 			assert.True(t, il1.Exists(il1[i]))
@@ -117,7 +105,7 @@ func TestIdentityList_IdentifierExists(t *testing.T) {
 		il2 := unittest.IdentityListFixture(1)
 
 		// sort the first list
-		il1 = il1.Sort(flow.Canonical)
+		il1 = il1.Sort(flow.Canonical[flow.Identity])
 
 		for i := 0; i < 10; i++ {
 			assert.True(t, il1.IdentifierExists(il1[i].NodeID))
@@ -247,12 +235,12 @@ func TestIdentity_Sort(t *testing.T) {
 	require.False(t, flow.IsCanonical(il[0], il[1]))
 	assert.False(t, flow.IsIdentityListCanonical(il))
 
-	canonical := il.Sort(flow.Canonical)
+	canonical := il.Sort(flow.Canonical[flow.Identity])
 	assert.True(t, flow.IsIdentityListCanonical(canonical))
 
 	// check `IsIdentityListCanonical` detects order equality in a sorted list
 	il[1] = il[10] // add a duplication
-	canonical = il.Sort(flow.Canonical)
+	canonical = il.Sort(flow.Canonical[flow.Identity])
 	assert.False(t, flow.IsIdentityListCanonical(canonical))
 }
 
@@ -269,56 +257,56 @@ func TestIdentity_EqualTo(t *testing.T) {
 	})
 
 	t.Run("NodeID diff", func(t *testing.T) {
-		a := &flow.Identity{NodeID: [32]byte{1, 2, 3}}
-		b := &flow.Identity{NodeID: [32]byte{2, 2, 2}}
+		a := &flow.Identity{IdentitySkeleton: flow.IdentitySkeleton{NodeID: [32]byte{1, 2, 3}}}
+		b := &flow.Identity{IdentitySkeleton: flow.IdentitySkeleton{NodeID: [32]byte{2, 2, 2}}}
 
 		require.False(t, a.EqualTo(b))
 		require.False(t, b.EqualTo(a))
 	})
 
 	t.Run("Address diff", func(t *testing.T) {
-		a := &flow.Identity{Address: "b"}
-		b := &flow.Identity{Address: "c"}
+		a := &flow.Identity{IdentitySkeleton: flow.IdentitySkeleton{Address: "b"}}
+		b := &flow.Identity{IdentitySkeleton: flow.IdentitySkeleton{Address: "c"}}
 
 		require.False(t, a.EqualTo(b))
 		require.False(t, b.EqualTo(a))
 	})
 
 	t.Run("Role diff", func(t *testing.T) {
-		a := &flow.Identity{Role: flow.RoleCollection}
-		b := &flow.Identity{Role: flow.RoleExecution}
+		a := &flow.Identity{IdentitySkeleton: flow.IdentitySkeleton{Role: flow.RoleCollection}}
+		b := &flow.Identity{IdentitySkeleton: flow.IdentitySkeleton{Role: flow.RoleExecution}}
 
 		require.False(t, a.EqualTo(b))
 		require.False(t, b.EqualTo(a))
 	})
 
-	t.Run("Weight diff", func(t *testing.T) {
-		a := &flow.Identity{Weight: 1}
-		b := &flow.Identity{Weight: 2}
+	t.Run("Initial weight diff", func(t *testing.T) {
+		a := &flow.Identity{IdentitySkeleton: flow.IdentitySkeleton{InitialWeight: 1}}
+		b := &flow.Identity{IdentitySkeleton: flow.IdentitySkeleton{InitialWeight: 2}}
 
 		require.False(t, a.EqualTo(b))
 		require.False(t, b.EqualTo(a))
 	})
 
-	t.Run("Ejected diff", func(t *testing.T) {
-		a := &flow.Identity{Ejected: true}
-		b := &flow.Identity{Ejected: false}
+	t.Run("status diff", func(t *testing.T) {
+		a := &flow.Identity{DynamicIdentity: flow.DynamicIdentity{EpochParticipationStatus: flow.EpochParticipationStatusActive}}
+		b := &flow.Identity{DynamicIdentity: flow.DynamicIdentity{EpochParticipationStatus: flow.EpochParticipationStatusLeaving}}
 
 		require.False(t, a.EqualTo(b))
 		require.False(t, b.EqualTo(a))
 	})
 
 	t.Run("StakingPubKey diff", func(t *testing.T) {
-		a := &flow.Identity{StakingPubKey: pks[0]}
-		b := &flow.Identity{StakingPubKey: pks[1]}
+		a := &flow.Identity{IdentitySkeleton: flow.IdentitySkeleton{StakingPubKey: pks[0]}}
+		b := &flow.Identity{IdentitySkeleton: flow.IdentitySkeleton{StakingPubKey: pks[1]}}
 
 		require.False(t, a.EqualTo(b))
 		require.False(t, b.EqualTo(a))
 	})
 
 	t.Run("NetworkPubKey diff", func(t *testing.T) {
-		a := &flow.Identity{NetworkPubKey: pks[0]}
-		b := &flow.Identity{NetworkPubKey: pks[1]}
+		a := &flow.Identity{IdentitySkeleton: flow.IdentitySkeleton{NetworkPubKey: pks[0]}}
+		b := &flow.Identity{IdentitySkeleton: flow.IdentitySkeleton{NetworkPubKey: pks[1]}}
 
 		require.False(t, a.EqualTo(b))
 		require.False(t, b.EqualTo(a))
@@ -326,22 +314,30 @@ func TestIdentity_EqualTo(t *testing.T) {
 
 	t.Run("Same data equals", func(t *testing.T) {
 		a := &flow.Identity{
-			NodeID:        flow.Identifier{1, 2, 3},
-			Address:       "address",
-			Role:          flow.RoleCollection,
-			Weight:        23,
-			Ejected:       false,
-			StakingPubKey: pks[0],
-			NetworkPubKey: pks[1],
+			IdentitySkeleton: flow.IdentitySkeleton{
+				NodeID:        flow.Identifier{1, 2, 3},
+				Address:       "address",
+				Role:          flow.RoleCollection,
+				InitialWeight: 23,
+				StakingPubKey: pks[0],
+				NetworkPubKey: pks[1],
+			},
+			DynamicIdentity: flow.DynamicIdentity{
+				EpochParticipationStatus: flow.EpochParticipationStatusActive,
+			},
 		}
 		b := &flow.Identity{
-			NodeID:        flow.Identifier{1, 2, 3},
-			Address:       "address",
-			Role:          flow.RoleCollection,
-			Weight:        23,
-			Ejected:       false,
-			StakingPubKey: pks[0],
-			NetworkPubKey: pks[1],
+			IdentitySkeleton: flow.IdentitySkeleton{
+				NodeID:        flow.Identifier{1, 2, 3},
+				Address:       "address",
+				Role:          flow.RoleCollection,
+				InitialWeight: 23,
+				StakingPubKey: pks[0],
+				NetworkPubKey: pks[1],
+			},
+			DynamicIdentity: flow.DynamicIdentity{
+				EpochParticipationStatus: flow.EpochParticipationStatusActive,
+			},
 		}
 
 		require.True(t, a.EqualTo(b))
@@ -355,8 +351,8 @@ func TestIdentityList_EqualTo(t *testing.T) {
 		a := flow.IdentityList{}
 		b := flow.IdentityList{}
 
-		require.True(t, a.EqualTo(b))
-		require.True(t, b.EqualTo(a))
+		require.True(t, flow.IdentityListEqualTo(a, b))
+		require.True(t, flow.IdentityListEqualTo(b, a))
 	})
 
 	t.Run("different len arent equal", func(t *testing.T) {
@@ -365,8 +361,8 @@ func TestIdentityList_EqualTo(t *testing.T) {
 		a := flow.IdentityList{identityA}
 		b := flow.IdentityList{}
 
-		require.False(t, a.EqualTo(b))
-		require.False(t, b.EqualTo(a))
+		require.False(t, flow.IdentityListEqualTo(a, b))
+		require.False(t, flow.IdentityListEqualTo(b, a))
 	})
 
 	t.Run("different data means not equal", func(t *testing.T) {
@@ -376,8 +372,8 @@ func TestIdentityList_EqualTo(t *testing.T) {
 		a := flow.IdentityList{identityA}
 		b := flow.IdentityList{identityB}
 
-		require.False(t, a.EqualTo(b))
-		require.False(t, b.EqualTo(a))
+		require.False(t, flow.IdentityListEqualTo(a, b))
+		require.False(t, flow.IdentityListEqualTo(b, a))
 	})
 
 	t.Run("same data means equal", func(t *testing.T) {
@@ -386,8 +382,8 @@ func TestIdentityList_EqualTo(t *testing.T) {
 		a := flow.IdentityList{identityA, identityA}
 		b := flow.IdentityList{identityA, identityA}
 
-		require.True(t, a.EqualTo(b))
-		require.True(t, b.EqualTo(a))
+		require.True(t, flow.IdentityListEqualTo(a, b))
+		require.True(t, flow.IdentityListEqualTo(b, a))
 	})
 }
 
diff --git a/model/flow/index.go b/model/flow/index.go
index 6f71575aa51..6d98412dc46 100644
--- a/model/flow/index.go
+++ b/model/flow/index.go
@@ -1,8 +1,9 @@
 package flow
 
 type Index struct {
-	CollectionIDs []Identifier
-	SealIDs       []Identifier
-	ReceiptIDs    []Identifier
-	ResultIDs     []Identifier
+	CollectionIDs   []Identifier
+	SealIDs         []Identifier
+	ReceiptIDs      []Identifier
+	ResultIDs       []Identifier
+	ProtocolStateID Identifier
 }
diff --git a/model/flow/mapfunc/identity.go b/model/flow/mapfunc/identity.go
index 89fc568b039..3e21793b43a 100644
--- a/model/flow/mapfunc/identity.go
+++ b/model/flow/mapfunc/identity.go
@@ -4,9 +4,22 @@ import (
 	"github.com/onflow/flow-go/model/flow"
 )
 
-func WithWeight(weight uint64) flow.IdentityMapFunc {
+// WithInitialWeight returns an anonymous function that assigns the given weight value
+// to `Identity.InitialWeight`. This function is primarily intended for testing, as
+// Identity structs should be immutable by convention.
+func WithInitialWeight(weight uint64) flow.IdentityMapFunc[flow.Identity] {
 	return func(identity flow.Identity) flow.Identity {
-		identity.Weight = weight
+		identity.InitialWeight = weight
+		return identity
+	}
+}
+
+// WithEpochParticipationStatus returns an anonymous function that assigns the given epoch participation status value
+// to `Identity.EpochParticipationStatus`. This function is primarily intended for testing, as
+// Identity structs should be immutable by convention.
+func WithEpochParticipationStatus(status flow.EpochParticipationStatus) flow.IdentityMapFunc[flow.Identity] {
+	return func(identity flow.Identity) flow.Identity {
+		identity.EpochParticipationStatus = status
 		return identity
 	}
 }
diff --git a/model/flow/payload.go b/model/flow/payload.go
index a6af04000a3..1d16afe445d 100644
--- a/model/flow/payload.go
+++ b/model/flow/payload.go
@@ -16,6 +16,11 @@ type Payload struct {
 	Seals    []*Seal
 	Receipts ExecutionReceiptMetaList
 	Results  ExecutionResultList
+	// ProtocolStateID is the root hash of protocol state. Per convention, this is the resulting
+	// state after applying all identity-changing operations potentially contained in the block.
+	// The block payload itself is validated wrt to the protocol state committed to by its parent.
+	// Thereby, we are only  accepting protocol states that have been certified by a valid QC.
+	ProtocolStateID Identifier
 }
 
 // EmptyPayload returns an empty block payload.
@@ -51,16 +56,17 @@ func (p Payload) Hash() Identifier {
 	sealHash := MerkleRoot(GetIDs(p.Seals)...)
 	recHash := MerkleRoot(GetIDs(p.Receipts)...)
 	resHash := MerkleRoot(GetIDs(p.Results)...)
-	return ConcatSum(collHash, sealHash, recHash, resHash)
+	return ConcatSum(collHash, sealHash, recHash, resHash, p.ProtocolStateID)
 }
 
 // Index returns the index for the payload.
 func (p Payload) Index() *Index {
 	idx := &Index{
-		CollectionIDs: GetIDs(p.Guarantees),
-		SealIDs:       GetIDs(p.Seals),
-		ReceiptIDs:    GetIDs(p.Receipts),
-		ResultIDs:     GetIDs(p.Results),
+		CollectionIDs:   GetIDs(p.Guarantees),
+		SealIDs:         GetIDs(p.Seals),
+		ReceiptIDs:      GetIDs(p.Receipts),
+		ResultIDs:       GetIDs(p.Results),
+		ProtocolStateID: p.ProtocolStateID,
 	}
 	return idx
 }
diff --git a/model/flow/payload_test.go b/model/flow/payload_test.go
index 52bf8369b86..06ddf7dbab3 100644
--- a/model/flow/payload_test.go
+++ b/model/flow/payload_test.go
@@ -29,7 +29,7 @@ func TestPayloadEncodeEmptyJSON(t *testing.T) {
 	payloadHash2 := payload.Hash()
 	assert.Equal(t, payloadHash2, payloadHash1)
 	encoded2, err := json.Marshal(payload)
-	assert.Equal(t, `{"Guarantees":null,"Seals":null,"Receipts":null,"Results":null}`, string(encoded2))
+	assert.Equal(t, `{"Guarantees":null,"Seals":null,"Receipts":null,"Results":null,"ProtocolStateID":"0000000000000000000000000000000000000000000000000000000000000000"}`, string(encoded2))
 	assert.Equal(t, string(encoded1), string(encoded2))
 	require.NoError(t, err)
 	err = json.Unmarshal(encoded2, &decoded)
diff --git a/model/flow/protocol_state.go b/model/flow/protocol_state.go
new file mode 100644
index 00000000000..55ea1e59a14
--- /dev/null
+++ b/model/flow/protocol_state.go
@@ -0,0 +1,450 @@
+package flow
+
+import (
+	"fmt"
+
+	"golang.org/x/exp/slices"
+)
+
+// DynamicIdentityEntry encapsulates nodeID and dynamic portion of identity.
+type DynamicIdentityEntry struct {
+	NodeID  Identifier
+	Ejected bool
+}
+
+type DynamicIdentityEntryList []*DynamicIdentityEntry
+
+// ProtocolStateEntry represents a snapshot of the identity table (incl. the set of all notes authorized to
+// be part of the network) at some point in time. It allows to reconstruct the state of identity table using
+// epoch setup events and dynamic identities. It tracks attempts of invalid state transitions.
+// It also holds information about the next epoch, if it has been already committed.
+// This structure is used to persist protocol state in the database.
+//
+// Note that the current implementation does not store the identity table directly. Instead, we store
+// the original events that constituted the _initial_ identity table at the beginning of the epoch
+// plus some modifiers. We intend to restructure this code soon.
+type ProtocolStateEntry struct {
+	PreviousEpoch *EpochStateContainer // minimal dynamic properties for previous epoch [optional, nil for first epoch after spork, genesis]
+	CurrentEpoch  EpochStateContainer  // minimal dynamic properties for current epoch
+	NextEpoch     *EpochStateContainer // minimal dynamic properties for next epoch [optional, nil iff we are in staking phase]
+
+	// InvalidEpochTransitionAttempted encodes whether an invalid epoch transition
+	// has been detected in this fork. Under normal operations, this value is false.
+	// Node-internally, the EpochFallback notification is emitted when a block is
+	// finalized that changes this flag from false to true.
+	//
+	// Currently, the only possible state transition is false → true.
+	// TODO for 'leaving Epoch Fallback via special service event'
+	InvalidEpochTransitionAttempted bool
+}
+
+// EpochStateContainer holds the data pertaining to a _single_ epoch but no information about
+// any adjacent epochs. To perform a transition from epoch N to N+1, EpochStateContainers for
+// both epochs are necessary.
+type EpochStateContainer struct {
+	// ID of setup event for this epoch, never nil.
+	SetupID Identifier
+	// ID of commit event for this epoch. Could be ZeroID if epoch was not committed.
+	CommitID Identifier
+	// ActiveIdentities contains the dynamic identity properties for the nodes that
+	// are active in this epoch. Active means that these nodes are authorized to contribute to
+	// extending the chain. Nodes are listed in `ActiveIdentities` if and only if
+	// they are part of the EpochSetup event for the respective epoch.
+	// The dynamic identity properties can change from block to block. Each non-deferred
+	// identity-mutating operation is applied independently to the `ActiveIdentities`
+	// of the relevant epoch's EpochStateContainer separately.
+	// Identities are always sorted in canonical order.
+	//
+	// Context: In comparison, nodes that are joining in the next epoch or left as of this
+	// epoch are only allowed to listen to the network but not actively contribute. Such
+	// nodes are _not_ part of `Identities`.
+	ActiveIdentities DynamicIdentityEntryList
+}
+
+// ID returns an identifier for this EpochStateContainer by hashing internal fields.
+// Per convention, the ID of a `nil` EpochStateContainer is `flow.ZeroID`.
+func (c *EpochStateContainer) ID() Identifier {
+	if c == nil {
+		return ZeroID
+	}
+	return MakeID(c)
+}
+
+// EventIDs returns the `flow.EventIDs` with the hashes of the EpochSetup and EpochCommit events.
+// Per convention, for a `nil` EpochStateContainer, we return `flow.ZeroID` for both events.
+func (c *EpochStateContainer) EventIDs() EventIDs {
+	if c == nil {
+		return EventIDs{ZeroID, ZeroID}
+	}
+	return EventIDs{c.SetupID, c.CommitID}
+}
+
+// Copy returns a full copy of the entry.
+// Embedded Identities are deep-copied, _except_ for their keys, which are copied by reference.
+// Per convention, the ID of a `nil` EpochStateContainer is `flow.ZeroID`.
+func (c *EpochStateContainer) Copy() *EpochStateContainer {
+	if c == nil {
+		return nil
+	}
+	return &EpochStateContainer{
+		SetupID:          c.SetupID,
+		CommitID:         c.CommitID,
+		ActiveIdentities: c.ActiveIdentities.Copy(),
+	}
+}
+
+// RichProtocolStateEntry is a ProtocolStateEntry which has additional fields that are cached
+// from storage layer for convenience.
+// Using this structure instead of ProtocolStateEntry allows us to avoid querying
+// the database for epoch setups and commits and full identity table.
+// It holds several invariants, such as:
+//   - CurrentEpochSetup and CurrentEpochCommit are for the same epoch. Never nil.
+//   - PreviousEpochSetup and PreviousEpochCommit are for the same epoch. Can be nil.
+//   - CurrentEpochIdentityTable is the full (dynamic) identity table for the current epoch.
+//     Identities are sorted in canonical order. Without duplicates. Never nil.
+//   - NextEpochIdentityTable is the full (dynamic) identity table for the next epoch. Can be nil.
+//
+// NOTE regarding `CurrentEpochIdentityTable` and `NextEpochIdentityTable`:
+// The Identity Table is generally a super-set of the identities listed in the Epoch
+// Service Events for the respective epoch. This is because the service events only list
+// nodes that are authorized to _actively_ contribute to extending the chain. In contrast,
+// the Identity Table additionally contains nodes (with weight zero) from the previous or
+// upcoming epoch, which are transitioning into / out of the network and are only allowed
+// to listen but not to actively contribute.
+type RichProtocolStateEntry struct {
+	*ProtocolStateEntry
+
+	PreviousEpochSetup        *EpochSetup
+	PreviousEpochCommit       *EpochCommit
+	CurrentEpochSetup         *EpochSetup
+	CurrentEpochCommit        *EpochCommit
+	NextEpochSetup            *EpochSetup
+	NextEpochCommit           *EpochCommit
+	CurrentEpochIdentityTable IdentityList
+	NextEpochIdentityTable    IdentityList
+}
+
+// NewRichProtocolStateEntry constructs a rich protocol state entry from a protocol state entry and additional data.
+// No errors are expected during normal operation. All errors indicate inconsistent or invalid inputs.
+func NewRichProtocolStateEntry(
+	protocolState *ProtocolStateEntry,
+	previousEpochSetup *EpochSetup,
+	previousEpochCommit *EpochCommit,
+	currentEpochSetup *EpochSetup,
+	currentEpochCommit *EpochCommit,
+	nextEpochSetup *EpochSetup,
+	nextEpochCommit *EpochCommit,
+) (*RichProtocolStateEntry, error) {
+	result := &RichProtocolStateEntry{
+		ProtocolStateEntry:        protocolState,
+		PreviousEpochSetup:        previousEpochSetup,
+		PreviousEpochCommit:       previousEpochCommit,
+		CurrentEpochSetup:         currentEpochSetup,
+		CurrentEpochCommit:        currentEpochCommit,
+		NextEpochSetup:            nextEpochSetup,
+		NextEpochCommit:           nextEpochCommit,
+		CurrentEpochIdentityTable: IdentityList{},
+		NextEpochIdentityTable:    IdentityList{},
+	}
+
+	// If previous epoch is specified: ensure respective epoch service events are not nil and consistent with commitments in `ProtocolStateEntry.PreviousEpoch`
+	if protocolState.PreviousEpoch != nil {
+		if protocolState.PreviousEpoch.SetupID != previousEpochSetup.ID() { // calling ID() will panic is EpochSetup event is nil
+			return nil, fmt.Errorf("supplied previous epoch's setup event (%x) does not match commitment (%x) in ProtocolStateEntry", previousEpochSetup.ID(), protocolState.PreviousEpoch.SetupID)
+		}
+		if protocolState.PreviousEpoch.CommitID != previousEpochCommit.ID() { // calling ID() will panic is EpochCommit event is nil
+			return nil, fmt.Errorf("supplied previous epoch's commit event (%x) does not match commitment (%x) in ProtocolStateEntry", previousEpochCommit.ID(), protocolState.PreviousEpoch.CommitID)
+		}
+	}
+
+	// For current epoch: ensure respective epoch service events are not nil and consistent with commitments in `ProtocolStateEntry.CurrentEpoch`
+	if protocolState.CurrentEpoch.SetupID != currentEpochSetup.ID() { // calling ID() will panic is EpochSetup event is nil
+		return nil, fmt.Errorf("supplied current epoch's setup event (%x) does not match commitment (%x) in ProtocolStateEntry", currentEpochSetup.ID(), protocolState.CurrentEpoch.SetupID)
+	}
+	if protocolState.CurrentEpoch.CommitID != currentEpochCommit.ID() { // calling ID() will panic is EpochCommit event is nil
+		return nil, fmt.Errorf("supplied current epoch's commit event (%x) does not match commitment (%x) in ProtocolStateEntry", currentEpochCommit.ID(), protocolState.CurrentEpoch.CommitID)
+	}
+
+	// If we are in staking phase (i.e. protocolState.NextEpoch == nil):
+	//  (1) Full identity table contains active identities from current epoch.
+	//      If previous epoch exists, we add nodes from previous epoch that are leaving in the current epoch with `EpochParticipationStatusLeaving` status.
+	// Otherwise, we are in epoch setup or epoch commit phase (i.e. protocolState.NextEpoch ≠ nil):
+	//  (2a) Full identity table contains active identities from current epoch + nodes joining in next epoch with `EpochParticipationStatusJoining` status.
+	//  (2b) Furthermore, we also build the full identity table for the next epoch's staking phase:
+	//       active identities from next epoch + nodes from current epoch that are leaving at the end of the current epoch with `flow.EpochParticipationStatusLeaving` status.
+	var err error
+	nextEpoch := protocolState.NextEpoch
+	if nextEpoch == nil { // in staking phase: build full identity table for current epoch according to (1)
+		var previousEpochIdentitySkeletons IdentitySkeletonList
+		var previousEpochDynamicIdentities DynamicIdentityEntryList
+		if previousEpochSetup != nil {
+			previousEpochIdentitySkeletons = previousEpochSetup.Participants
+			previousEpochDynamicIdentities = protocolState.PreviousEpoch.ActiveIdentities
+		}
+		result.CurrentEpochIdentityTable, err = BuildIdentityTable(
+			currentEpochSetup.Participants,
+			protocolState.CurrentEpoch.ActiveIdentities,
+			previousEpochIdentitySkeletons,
+			previousEpochDynamicIdentities,
+			EpochParticipationStatusLeaving,
+		)
+		if err != nil {
+			return nil, fmt.Errorf("could not build identity table for staking phase: %w", err)
+		}
+	} else { // protocolState.NextEpoch ≠ nil, i.e. we are in epoch setup or epoch commit phase
+		// ensure respective epoch service events are not nil and consistent with commitments in `ProtocolStateEntry.NextEpoch`
+		if nextEpoch.SetupID != nextEpochSetup.ID() {
+			return nil, fmt.Errorf("supplied next epoch's setup event (%x) does not match commitment (%x) in ProtocolStateEntry", nextEpoch.SetupID, nextEpochSetup.ID())
+		}
+		if nextEpoch.CommitID != ZeroID {
+			if nextEpoch.CommitID != nextEpochCommit.ID() {
+				return nil, fmt.Errorf("supplied next epoch's commit event (%x) does not match commitment (%x) in ProtocolStateEntry", nextEpoch.CommitID, nextEpochCommit.ID())
+			}
+		}
+
+		result.CurrentEpochIdentityTable, err = BuildIdentityTable(
+			currentEpochSetup.Participants,
+			protocolState.CurrentEpoch.ActiveIdentities,
+			nextEpochSetup.Participants,
+			nextEpoch.ActiveIdentities,
+			EpochParticipationStatusJoining,
+		)
+		if err != nil {
+			return nil, fmt.Errorf("could not build identity table for setup/commit phase: %w", err)
+		}
+
+		result.NextEpochIdentityTable, err = BuildIdentityTable(
+			nextEpochSetup.Participants,
+			nextEpoch.ActiveIdentities,
+			currentEpochSetup.Participants,
+			protocolState.CurrentEpoch.ActiveIdentities,
+			EpochParticipationStatusLeaving,
+		)
+		if err != nil {
+			return nil, fmt.Errorf("could not build next epoch identity table: %w", err)
+		}
+	}
+	return result, nil
+}
+
+// ID returns hash of entry by hashing all fields.
+func (e *ProtocolStateEntry) ID() Identifier {
+	if e == nil {
+		return ZeroID
+	}
+	body := struct {
+		PreviousEpochID                 Identifier
+		CurrentEpochID                  Identifier
+		NextEpochID                     Identifier
+		InvalidEpochTransitionAttempted bool
+	}{
+		PreviousEpochID:                 e.PreviousEpoch.ID(),
+		CurrentEpochID:                  e.CurrentEpoch.ID(),
+		NextEpochID:                     e.NextEpoch.ID(),
+		InvalidEpochTransitionAttempted: e.InvalidEpochTransitionAttempted,
+	}
+	return MakeID(body)
+}
+
+// Copy returns a full copy of the entry.
+// Embedded Identities are deep-copied, _except_ for their keys, which are copied by reference.
+func (e *ProtocolStateEntry) Copy() *ProtocolStateEntry {
+	if e == nil {
+		return nil
+	}
+	return &ProtocolStateEntry{
+		PreviousEpoch:                   e.PreviousEpoch.Copy(),
+		CurrentEpoch:                    *e.CurrentEpoch.Copy(),
+		NextEpoch:                       e.NextEpoch.Copy(),
+		InvalidEpochTransitionAttempted: e.InvalidEpochTransitionAttempted,
+	}
+}
+
+// Copy returns a full copy of rich protocol state entry.
+//   - Embedded service events are copied by reference (not deep-copied).
+//   - CurrentEpochIdentityTable and NextEpochIdentityTable are deep-copied, _except_ for their keys, which are copied by reference.
+func (e *RichProtocolStateEntry) Copy() *RichProtocolStateEntry {
+	if e == nil {
+		return nil
+	}
+	return &RichProtocolStateEntry{
+		ProtocolStateEntry:        e.ProtocolStateEntry.Copy(),
+		PreviousEpochSetup:        e.PreviousEpochSetup,
+		PreviousEpochCommit:       e.PreviousEpochCommit,
+		CurrentEpochSetup:         e.CurrentEpochSetup,
+		CurrentEpochCommit:        e.CurrentEpochCommit,
+		NextEpochSetup:            e.NextEpochSetup,
+		NextEpochCommit:           e.NextEpochCommit,
+		CurrentEpochIdentityTable: e.CurrentEpochIdentityTable.Copy(),
+		NextEpochIdentityTable:    e.NextEpochIdentityTable.Copy(),
+	}
+}
+
+// EpochPhase returns the current epoch phase.
+// The receiver ProtocolStateEntry must be properly constructed.
+func (e *ProtocolStateEntry) EpochPhase() EpochPhase {
+	// The epoch phase is determined by how much information we have about the next epoch
+	if e.NextEpoch == nil {
+		return EpochPhaseStaking // if no information about the next epoch is known, we are in the Staking Phase
+	}
+	// Per convention, NextEpoch ≠ nil if and only if NextEpoch.SetupID is specified.
+	if e.NextEpoch.CommitID == ZeroID {
+		return EpochPhaseSetup // if only the Setup event is known for the next epoch but not the Commit event, we are in the Setup Phase
+	}
+	return EpochPhaseCommitted // if the Setup and Commit events are known for the next epoch, we are in the Committed Phase
+}
+
+func (ll DynamicIdentityEntryList) Lookup() map[Identifier]*DynamicIdentityEntry {
+	result := make(map[Identifier]*DynamicIdentityEntry, len(ll))
+	for _, entry := range ll {
+		result[entry.NodeID] = entry
+	}
+	return result
+}
+
+// Sorted returns whether the list is sorted by the input ordering.
+func (ll DynamicIdentityEntryList) Sorted(less IdentifierOrder) bool {
+	return slices.IsSortedFunc(ll, func(lhs, rhs *DynamicIdentityEntry) int {
+		return less(lhs.NodeID, rhs.NodeID)
+	})
+}
+
+// ByNodeID gets a node from the list by node ID.
+func (ll DynamicIdentityEntryList) ByNodeID(nodeID Identifier) (*DynamicIdentityEntry, bool) {
+	for _, identity := range ll {
+		if identity.NodeID == nodeID {
+			return identity, true
+		}
+	}
+	return nil, false
+}
+
+// Copy returns a copy of the DynamicIdentityEntryList. The resulting slice uses
+// a different backing array, meaning appends and insert operations on either slice
+// are guaranteed to only affect that slice.
+//
+// Copy should be used when modifying an existing identity list by either
+// appending new elements, re-ordering, or inserting new elements in an
+// existing index.
+//
+// CAUTION:
+// All Identity fields are deep-copied, _except_ for their keys, which
+// are copied by reference.
+func (ll DynamicIdentityEntryList) Copy() DynamicIdentityEntryList {
+	lenList := len(ll)
+	dup := make(DynamicIdentityEntryList, 0, lenList)
+	for i := 0; i < lenList; i++ {
+		// copy the object
+		next := *(ll[i])
+		dup = append(dup, &next)
+	}
+	return dup
+}
+
+// Sort sorts the list by the input ordering. Returns a new, sorted list without modifying the input.
+// CAUTION:
+// All Identity fields are deep-copied, _except_ for their keys, which are copied by reference.
+func (ll DynamicIdentityEntryList) Sort(less IdentifierOrder) DynamicIdentityEntryList {
+	dup := ll.Copy()
+	slices.SortFunc(dup, func(lhs, rhs *DynamicIdentityEntry) int {
+		return less(lhs.NodeID, rhs.NodeID)
+	})
+	return dup
+}
+
+// BuildIdentityTable constructs the full identity table for the target epoch by combining data from:
+//  1. The IdentitySkeletons for the nodes that are _active_ in the target epoch
+//     (recorded in EpochSetup event and immutable throughout the epoch).
+//  2. The Dynamic Identities for the nodes that are _active_ in the target epoch (i.e. the dynamic identity
+//     fields for the IdentitySkeletons contained in the EpochSetup event for the respective epoch).
+//
+// Optionally, identity information for an adjacent epoch is given if and only if an adjacent epoch exists. For
+// a target epoch N, the epochs N-1 and N+1 are defined to be adjacent. Adjacent epochs do not necessarily exist
+// (e.g. consider a spork comprising only a single epoch), in which case the respective inputs are nil or empty.
+//  3. [optional] An adjacent epoch's IdentitySkeletons as recorded in the adjacent epoch's setup event.
+//  4. [optional] An adjacent epoch's Dynamic Identities.
+//  5. An adjacent epoch's identities participation status, this could be joining or leaving depending on epoch phase.
+//
+// The function enforces that the input slices pertaining to the same epoch contain the same identities
+// (compared by nodeID) in the same order. Otherwise, an exception is returned.
+// No errors are expected during normal operation. All errors indicate inconsistent or invalid inputs.
+func BuildIdentityTable(
+	targetEpochIdentitySkeletons IdentitySkeletonList,
+	targetEpochDynamicIdentities DynamicIdentityEntryList,
+	adjacentEpochIdentitySkeletons IdentitySkeletonList,
+	adjacentEpochDynamicIdentities DynamicIdentityEntryList,
+	adjacentIdentitiesStatus EpochParticipationStatus,
+) (IdentityList, error) {
+	if adjacentIdentitiesStatus != EpochParticipationStatusLeaving &&
+		adjacentIdentitiesStatus != EpochParticipationStatusJoining {
+		return nil, fmt.Errorf("invalid adjacent identity status, expect %s or %s, got %s",
+			EpochParticipationStatusLeaving.String(),
+			EpochParticipationStatusJoining.String(),
+			adjacentIdentitiesStatus)
+	}
+	targetEpochParticipants, err := ComposeFullIdentities(targetEpochIdentitySkeletons, targetEpochDynamicIdentities, EpochParticipationStatusActive)
+	if err != nil {
+		return nil, fmt.Errorf("could not reconstruct participants for target epoch: %w", err)
+	}
+	adjacentEpochParticipants, err := ComposeFullIdentities(adjacentEpochIdentitySkeletons, adjacentEpochDynamicIdentities, adjacentIdentitiesStatus)
+	if err != nil {
+		return nil, fmt.Errorf("could not reconstruct participants for adjacent epoch: %w", err)
+	}
+
+	// Combine the participants of the current and adjacent epoch. The method `GenericIdentityList.Union`
+	// already implements the following required conventions:
+	//  1. Preference for IdentitySkeleton of the target epoch:
+	//     In case an IdentitySkeleton with the same NodeID exists in the target epoch as well as
+	//     in the adjacent epoch, we use the IdentitySkeleton for the target epoch (for example,
+	//     to account for changes of keys, address, initial weight, etc).
+	//  2. Canonical ordering
+	return targetEpochParticipants.Union(adjacentEpochParticipants), nil
+}
+
+// DynamicIdentityEntryListFromIdentities converts IdentityList to DynamicIdentityEntryList.
+func DynamicIdentityEntryListFromIdentities(identities IdentityList) DynamicIdentityEntryList {
+	dynamicIdentities := make(DynamicIdentityEntryList, 0, len(identities))
+	for _, identity := range identities {
+		dynamicIdentities = append(dynamicIdentities, &DynamicIdentityEntry{
+			NodeID:  identity.NodeID,
+			Ejected: identity.IsEjected(),
+		})
+	}
+	return dynamicIdentities
+}
+
+// ComposeFullIdentities combines identity skeletons and dynamic identities to produce a flow.IdentityList.
+// It enforces that the input slices `skeletons` and `dynamics` list the same identities (compared by nodeID)
+// in the same order. Otherwise, an exception is returned. For each identity i, we set
+// `i.EpochParticipationStatus` to the `defaultEpochParticipationStatus` _unless_ i is ejected.
+// No errors are expected during normal operations.
+func ComposeFullIdentities(
+	skeletons IdentitySkeletonList,
+	dynamics DynamicIdentityEntryList,
+	defaultEpochParticipationStatus EpochParticipationStatus,
+) (IdentityList, error) {
+	// sanity check: list of skeletons and dynamic should be the same
+	if len(skeletons) != len(dynamics) {
+		return nil, fmt.Errorf("invalid number of identities to reconstruct: expected %d, got %d", len(skeletons), len(dynamics))
+	}
+
+	// reconstruct identities from skeleton and dynamic parts
+	var result IdentityList
+	for i := range dynamics {
+		// sanity check: identities should be sorted in the same order
+		if dynamics[i].NodeID != skeletons[i].NodeID {
+			return nil, fmt.Errorf("identites in protocol state are not consistently ordered: expected %s, got %s", skeletons[i].NodeID, dynamics[i].NodeID)
+		}
+		status := defaultEpochParticipationStatus
+		if dynamics[i].Ejected {
+			status = EpochParticipationStatusEjected
+		}
+		result = append(result, &Identity{
+			IdentitySkeleton: *skeletons[i],
+			DynamicIdentity: DynamicIdentity{
+				EpochParticipationStatus: status,
+			},
+		})
+	}
+	return result, nil
+}
diff --git a/model/flow/protocol_state_test.go b/model/flow/protocol_state_test.go
new file mode 100644
index 00000000000..595e5f3f910
--- /dev/null
+++ b/model/flow/protocol_state_test.go
@@ -0,0 +1,392 @@
+package flow_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+// TestNewRichProtocolStateEntry checks that NewRichProtocolStateEntry creates valid identity tables depending on the state
+// of epoch which is derived from the protocol state entry.
+func TestNewRichProtocolStateEntry(t *testing.T) {
+	// Conditions right after a spork:
+	//  * no previous epoch exists from the perspective of the freshly-sporked protocol state
+	//  * network is currently in the staking phase for the next epoch, hence no service events for the next epoch exist
+	t.Run("staking-root-protocol-state", func(t *testing.T) {
+		setup := unittest.EpochSetupFixture()
+		currentEpochCommit := unittest.EpochCommitFixture()
+		identities := make(flow.DynamicIdentityEntryList, 0, len(setup.Participants))
+		for _, identity := range setup.Participants {
+			identities = append(identities, &flow.DynamicIdentityEntry{
+				NodeID:  identity.NodeID,
+				Ejected: false,
+			})
+		}
+		stateEntry := &flow.ProtocolStateEntry{
+			PreviousEpoch: nil,
+			CurrentEpoch: flow.EpochStateContainer{
+				SetupID:          setup.ID(),
+				CommitID:         currentEpochCommit.ID(),
+				ActiveIdentities: identities,
+			},
+			InvalidEpochTransitionAttempted: false,
+		}
+		entry, err := flow.NewRichProtocolStateEntry(
+			stateEntry,
+			nil,
+			nil,
+			setup,
+			currentEpochCommit,
+			nil,
+			nil,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, flow.EpochPhaseStaking, entry.EpochPhase())
+
+		expectedIdentities, err := flow.BuildIdentityTable(
+			setup.Participants,
+			identities,
+			nil,
+			nil,
+			flow.EpochParticipationStatusLeaving,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, expectedIdentities, entry.CurrentEpochIdentityTable, "should be equal to current epoch setup participants")
+	})
+
+	// Common situation during the staking phase for epoch N+1
+	//  * we are currently in Epoch N
+	//  * previous epoch N-1 is known (specifically EpochSetup and EpochCommit events)
+	//  * network is currently in the staking phase for the next epoch, hence no service events for the next epoch exist
+	t.Run("staking-phase", func(t *testing.T) {
+		stateEntry := unittest.ProtocolStateFixture()
+		richEntry, err := flow.NewRichProtocolStateEntry(
+			stateEntry.ProtocolStateEntry,
+			stateEntry.PreviousEpochSetup,
+			stateEntry.PreviousEpochCommit,
+			stateEntry.CurrentEpochSetup,
+			stateEntry.CurrentEpochCommit,
+			nil,
+			nil,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, flow.EpochPhaseStaking, richEntry.EpochPhase())
+
+		expectedIdentities, err := flow.BuildIdentityTable(
+			stateEntry.CurrentEpochSetup.Participants,
+			stateEntry.CurrentEpoch.ActiveIdentities,
+			stateEntry.PreviousEpochSetup.Participants,
+			stateEntry.PreviousEpoch.ActiveIdentities,
+			flow.EpochParticipationStatusLeaving,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, expectedIdentities, richEntry.CurrentEpochIdentityTable, "should be equal to current epoch setup participants + previous epoch setup participants")
+		assert.Nil(t, richEntry.NextEpoch)
+	})
+
+	// Common situation during the epoch setup phase for epoch N+1
+	//  * we are currently in Epoch N
+	//  * previous epoch N-1 is known (specifically EpochSetup and EpochCommit events)
+	//  * network is currently in the setup phase for the next epoch, i.e. EpochSetup event (starting setup phase) has already been observed
+	t.Run("setup-phase", func(t *testing.T) {
+		stateEntry := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState(), func(entry *flow.RichProtocolStateEntry) {
+			entry.NextEpochCommit = nil
+			entry.NextEpoch.CommitID = flow.ZeroID
+		})
+
+		richEntry, err := flow.NewRichProtocolStateEntry(
+			stateEntry.ProtocolStateEntry,
+			stateEntry.PreviousEpochSetup,
+			stateEntry.PreviousEpochCommit,
+			stateEntry.CurrentEpochSetup,
+			stateEntry.CurrentEpochCommit,
+			stateEntry.NextEpochSetup,
+			nil,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, flow.EpochPhaseSetup, richEntry.EpochPhase())
+
+		expectedIdentities, err := flow.BuildIdentityTable(
+			stateEntry.CurrentEpochSetup.Participants,
+			stateEntry.CurrentEpoch.ActiveIdentities,
+			stateEntry.NextEpochSetup.Participants,
+			stateEntry.NextEpoch.ActiveIdentities,
+			flow.EpochParticipationStatusJoining,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, expectedIdentities, richEntry.CurrentEpochIdentityTable, "should be equal to current epoch setup participants + next epoch setup participants")
+		assert.Nil(t, richEntry.NextEpochCommit)
+		expectedIdentities, err = flow.BuildIdentityTable(
+			stateEntry.NextEpochSetup.Participants,
+			stateEntry.NextEpoch.ActiveIdentities,
+			stateEntry.CurrentEpochSetup.Participants,
+			stateEntry.CurrentEpoch.ActiveIdentities,
+			flow.EpochParticipationStatusLeaving,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, expectedIdentities, richEntry.NextEpochIdentityTable, "should be equal to next epoch setup participants + current epoch setup participants")
+	})
+
+	t.Run("setup-after-spork", func(t *testing.T) {
+		stateEntry := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState(), func(entry *flow.RichProtocolStateEntry) {
+			// no previous epoch since we are in the first epoch
+			entry.PreviousEpochSetup = nil
+			entry.PreviousEpochCommit = nil
+			entry.PreviousEpoch = nil
+
+			// next epoch is setup but not committed
+			entry.NextEpochCommit = nil
+			entry.NextEpoch.CommitID = flow.ZeroID
+		})
+		// sanity check that previous epoch is not populated in `stateEntry`
+		assert.Nil(t, stateEntry.PreviousEpoch)
+		assert.Nil(t, stateEntry.PreviousEpochSetup)
+		assert.Nil(t, stateEntry.PreviousEpochCommit)
+
+		richEntry, err := flow.NewRichProtocolStateEntry(
+			stateEntry.ProtocolStateEntry,
+			stateEntry.PreviousEpochSetup,
+			stateEntry.PreviousEpochCommit,
+			stateEntry.CurrentEpochSetup,
+			stateEntry.CurrentEpochCommit,
+			stateEntry.NextEpochSetup,
+			nil,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, flow.EpochPhaseSetup, richEntry.EpochPhase())
+
+		expectedIdentities, err := flow.BuildIdentityTable(
+			stateEntry.CurrentEpochSetup.Participants,
+			stateEntry.CurrentEpoch.ActiveIdentities,
+			stateEntry.NextEpochSetup.Participants,
+			stateEntry.NextEpoch.ActiveIdentities,
+			flow.EpochParticipationStatusJoining,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, expectedIdentities, richEntry.CurrentEpochIdentityTable, "should be equal to current epoch setup participants + next epoch setup participants")
+		assert.Nil(t, richEntry.NextEpochCommit)
+		expectedIdentities, err = flow.BuildIdentityTable(
+			stateEntry.NextEpochSetup.Participants,
+			stateEntry.NextEpoch.ActiveIdentities,
+			stateEntry.CurrentEpochSetup.Participants,
+			stateEntry.CurrentEpoch.ActiveIdentities,
+			flow.EpochParticipationStatusLeaving,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, expectedIdentities, richEntry.NextEpochIdentityTable, "should be equal to next epoch setup participants + current epoch setup participants")
+	})
+
+	// Common situation during the epoch commit phase for epoch N+1
+	//  * we are currently in Epoch N
+	//  * previous epoch N-1 is known (specifically EpochSetup and EpochCommit events)
+	//  * The network has completed the epoch setup phase, i.e. published the EpochSetup and EpochCommit events for epoch N+1.
+	t.Run("commit-phase", func(t *testing.T) {
+		stateEntry := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState())
+
+		richEntry, err := flow.NewRichProtocolStateEntry(
+			stateEntry.ProtocolStateEntry,
+			stateEntry.PreviousEpochSetup,
+			stateEntry.PreviousEpochCommit,
+			stateEntry.CurrentEpochSetup,
+			stateEntry.CurrentEpochCommit,
+			stateEntry.NextEpochSetup,
+			stateEntry.NextEpochCommit,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, flow.EpochPhaseCommitted, richEntry.EpochPhase())
+
+		expectedIdentities, err := flow.BuildIdentityTable(
+			stateEntry.CurrentEpochSetup.Participants,
+			stateEntry.CurrentEpoch.ActiveIdentities,
+			stateEntry.NextEpochSetup.Participants,
+			stateEntry.NextEpoch.ActiveIdentities,
+			flow.EpochParticipationStatusJoining,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, expectedIdentities, richEntry.CurrentEpochIdentityTable, "should be equal to current epoch setup participants + next epoch setup participants")
+		expectedIdentities, err = flow.BuildIdentityTable(
+			stateEntry.NextEpochSetup.Participants,
+			stateEntry.NextEpoch.ActiveIdentities,
+			stateEntry.CurrentEpochSetup.Participants,
+			stateEntry.CurrentEpoch.ActiveIdentities,
+			flow.EpochParticipationStatusLeaving,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, expectedIdentities, richEntry.NextEpochIdentityTable, "should be equal to next epoch setup participants + current epoch setup participants")
+	})
+
+	t.Run("commit-after-spork", func(t *testing.T) {
+		stateEntry := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState(), func(entry *flow.RichProtocolStateEntry) {
+			// no previous epoch since we are in the first epoch
+			entry.PreviousEpochSetup = nil
+			entry.PreviousEpochCommit = nil
+			entry.PreviousEpoch = nil
+		})
+		// sanity check that previous epoch is not populated in `stateEntry`
+		assert.Nil(t, stateEntry.PreviousEpoch)
+		assert.Nil(t, stateEntry.PreviousEpochSetup)
+		assert.Nil(t, stateEntry.PreviousEpochCommit)
+
+		richEntry, err := flow.NewRichProtocolStateEntry(
+			stateEntry.ProtocolStateEntry,
+			stateEntry.PreviousEpochSetup,
+			stateEntry.PreviousEpochCommit,
+			stateEntry.CurrentEpochSetup,
+			stateEntry.CurrentEpochCommit,
+			stateEntry.NextEpochSetup,
+			stateEntry.NextEpochCommit,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, flow.EpochPhaseCommitted, richEntry.EpochPhase())
+
+		expectedIdentities, err := flow.BuildIdentityTable(
+			stateEntry.CurrentEpochSetup.Participants,
+			stateEntry.CurrentEpoch.ActiveIdentities,
+			stateEntry.NextEpochSetup.Participants,
+			stateEntry.NextEpoch.ActiveIdentities,
+			flow.EpochParticipationStatusJoining,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, expectedIdentities, richEntry.CurrentEpochIdentityTable, "should be equal to current epoch setup participants + next epoch setup participants")
+		expectedIdentities, err = flow.BuildIdentityTable(
+			stateEntry.NextEpochSetup.Participants,
+			stateEntry.NextEpoch.ActiveIdentities,
+			stateEntry.CurrentEpochSetup.Participants,
+			stateEntry.CurrentEpoch.ActiveIdentities,
+			flow.EpochParticipationStatusLeaving,
+		)
+		assert.NoError(t, err)
+		assert.Equal(t, expectedIdentities, richEntry.NextEpochIdentityTable, "should be equal to next epoch setup participants + current epoch setup participants")
+	})
+}
+
+// TestProtocolStateEntry_Copy tests if the copy method returns a deep copy of the entry.
+// All changes to copy shouldn't affect the original entry -- except for key changes.
+func TestProtocolStateEntry_Copy(t *testing.T) {
+	entry := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState()).ProtocolStateEntry
+	cpy := entry.Copy()
+	assert.Equal(t, entry, cpy)
+	assert.NotSame(t, entry.NextEpoch, cpy.NextEpoch)
+	assert.NotSame(t, entry.PreviousEpoch, cpy.PreviousEpoch)
+	assert.NotSame(t, entry.CurrentEpoch, cpy.CurrentEpoch)
+
+	cpy.InvalidEpochTransitionAttempted = !entry.InvalidEpochTransitionAttempted
+	assert.NotEqual(t, entry, cpy)
+
+	assert.Equal(t, entry.CurrentEpoch.ActiveIdentities[0], cpy.CurrentEpoch.ActiveIdentities[0])
+	cpy.CurrentEpoch.ActiveIdentities[0].Ejected = true
+	assert.NotEqual(t, entry.CurrentEpoch.ActiveIdentities[0], cpy.CurrentEpoch.ActiveIdentities[0])
+
+	cpy.CurrentEpoch.ActiveIdentities = append(cpy.CurrentEpoch.ActiveIdentities, &flow.DynamicIdentityEntry{
+		NodeID:  unittest.IdentifierFixture(),
+		Ejected: false,
+	})
+	assert.NotEqual(t, entry.CurrentEpoch.ActiveIdentities, cpy.CurrentEpoch.ActiveIdentities)
+}
+
+// TestBuildIdentityTable tests if BuildIdentityTable returns a correct identity, whenever we pass arguments with or without
+// overlap. It also tests if the function returns an error when the arguments are not ordered in the same order.
+func TestBuildIdentityTable(t *testing.T) {
+	t.Run("invalid-adjacent-identity-status", func(t *testing.T) {
+		targetEpochIdentities := unittest.IdentityListFixture(10).Sort(flow.Canonical[flow.Identity])
+		adjacentEpochIdentities := unittest.IdentityListFixture(10).Sort(flow.Canonical[flow.Identity])
+
+		// Per convention, BuildIdentityTable only accepts EpochParticipationStatusLeaving or EpochParticipationStatusJoining
+		// for the *adjacent* epoch, because these are the only sensible values.
+		for _, status := range []flow.EpochParticipationStatus{flow.EpochParticipationStatusActive, flow.EpochParticipationStatusEjected} {
+			identityList, err := flow.BuildIdentityTable(
+				targetEpochIdentities.ToSkeleton(),
+				flow.DynamicIdentityEntryListFromIdentities(targetEpochIdentities),
+				adjacentEpochIdentities.ToSkeleton(),
+				flow.DynamicIdentityEntryListFromIdentities(adjacentEpochIdentities),
+				status,
+			)
+			assert.Error(t, err)
+			assert.Empty(t, identityList)
+		}
+	})
+	t.Run("happy-path-no-identities-overlap", func(t *testing.T) {
+		targetEpochIdentities := unittest.IdentityListFixture(10).Sort(flow.Canonical[flow.Identity])
+		adjacentEpochIdentities := unittest.IdentityListFixture(10).Sort(flow.Canonical[flow.Identity])
+
+		identityList, err := flow.BuildIdentityTable(
+			targetEpochIdentities.ToSkeleton(),
+			flow.DynamicIdentityEntryListFromIdentities(targetEpochIdentities),
+			adjacentEpochIdentities.ToSkeleton(),
+			flow.DynamicIdentityEntryListFromIdentities(adjacentEpochIdentities),
+			flow.EpochParticipationStatusLeaving,
+		)
+		assert.NoError(t, err)
+
+		expectedIdentities := targetEpochIdentities.Union(adjacentEpochIdentities.Map(func(identity flow.Identity) flow.Identity {
+			identity.EpochParticipationStatus = flow.EpochParticipationStatusLeaving
+			return identity
+		}))
+		assert.Equal(t, expectedIdentities, identityList)
+	})
+	t.Run("happy-path-identities-overlap", func(t *testing.T) {
+		targetEpochIdentities := unittest.IdentityListFixture(10).Sort(flow.Canonical[flow.Identity])
+		adjacentEpochIdentities := unittest.IdentityListFixture(10)
+		sampledIdentities, err := targetEpochIdentities.Sample(2)
+		// change address so we can assert that we take identities from target epoch and not adjacent epoch
+		for i, identity := range sampledIdentities.Copy() {
+			identity.Address = fmt.Sprintf("%d", i)
+			adjacentEpochIdentities = append(adjacentEpochIdentities, identity)
+		}
+		assert.NoError(t, err)
+		adjacentEpochIdentities = adjacentEpochIdentities.Sort(flow.Canonical[flow.Identity])
+
+		identityList, err := flow.BuildIdentityTable(
+			targetEpochIdentities.ToSkeleton(),
+			flow.DynamicIdentityEntryListFromIdentities(targetEpochIdentities),
+			adjacentEpochIdentities.ToSkeleton(),
+			flow.DynamicIdentityEntryListFromIdentities(adjacentEpochIdentities),
+			flow.EpochParticipationStatusJoining,
+		)
+		assert.NoError(t, err)
+
+		expectedIdentities := targetEpochIdentities.Union(adjacentEpochIdentities.Map(func(identity flow.Identity) flow.Identity {
+			identity.EpochParticipationStatus = flow.EpochParticipationStatusJoining
+			return identity
+		}))
+		assert.Equal(t, expectedIdentities, identityList)
+	})
+	t.Run("target-epoch-identities-not-ordered", func(t *testing.T) {
+		targetEpochIdentities := unittest.IdentityListFixture(10).Sort(flow.Canonical[flow.Identity])
+		targetEpochIdentitySkeletons, err := targetEpochIdentities.ToSkeleton().Shuffle()
+		assert.NoError(t, err)
+		targetEpochDynamicIdentities := flow.DynamicIdentityEntryListFromIdentities(targetEpochIdentities)
+
+		adjacentEpochIdentities := unittest.IdentityListFixture(10).Sort(flow.Canonical[flow.Identity])
+		identityList, err := flow.BuildIdentityTable(
+			targetEpochIdentitySkeletons,
+			targetEpochDynamicIdentities,
+			adjacentEpochIdentities.ToSkeleton(),
+			flow.DynamicIdentityEntryListFromIdentities(adjacentEpochIdentities),
+			flow.EpochParticipationStatusLeaving,
+		)
+		assert.Error(t, err)
+		assert.Empty(t, identityList)
+	})
+	t.Run("adjacent-epoch-identities-not-ordered", func(t *testing.T) {
+		adjacentEpochIdentities := unittest.IdentityListFixture(10).Sort(flow.Canonical[flow.Identity])
+		adjacentEpochIdentitySkeletons, err := adjacentEpochIdentities.ToSkeleton().Shuffle()
+		assert.NoError(t, err)
+		adjacentEpochDynamicIdentities := flow.DynamicIdentityEntryListFromIdentities(adjacentEpochIdentities)
+
+		targetEpochIdentities := unittest.IdentityListFixture(10).Sort(flow.Canonical[flow.Identity])
+		identityList, err := flow.BuildIdentityTable(
+			targetEpochIdentities.ToSkeleton(),
+			flow.DynamicIdentityEntryListFromIdentities(targetEpochIdentities),
+			adjacentEpochIdentitySkeletons,
+			adjacentEpochDynamicIdentities,
+			flow.EpochParticipationStatusLeaving,
+		)
+		assert.Error(t, err)
+		assert.Empty(t, identityList)
+	})
+}
diff --git a/model/flow/role.go b/model/flow/role.go
index f138a185d75..7ea3d26cda8 100644
--- a/model/flow/role.go
+++ b/model/flow/role.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package flow
 
 import (
diff --git a/model/flow/seal.go b/model/flow/seal.go
index 0828fb10662..300dea2b79f 100644
--- a/model/flow/seal.go
+++ b/model/flow/seal.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package flow
 
 import "encoding/json"
diff --git a/model/flow/sealing_segment.go b/model/flow/sealing_segment.go
index dffd5a9cef5..590f423f2e8 100644
--- a/model/flow/sealing_segment.go
+++ b/model/flow/sealing_segment.go
@@ -33,7 +33,8 @@ type SealingSegment struct {
 	// (see sealing_segment.md for details):
 	//  (ii) All blocks that are sealed by `head`. This is relevant if `head` contains _multiple_ seals.
 	// (iii) The sealing segment holds the history of all non-expired collection guarantees, i.e.
-	//       limitHeight := max(head.Height - flow.DefaultTransactionExpiry, SporkRootBlockHeight)
+	//       limitHeight := max(blockSealedAtHead.Height - flow.DefaultTransactionExpiry, SporkRootBlockHeight)
+	//       where blockSealedAtHead is the block sealed by `head` block.
 	// (Potentially longer history is permitted)
 	ExtraBlocks []*Block
 
diff --git a/model/flow/sealing_segment.md b/model/flow/sealing_segment.md
index 1cc6544ec37..cc956754d85 100644
--- a/model/flow/sealing_segment.md
+++ b/model/flow/sealing_segment.md
@@ -2,15 +2,15 @@
 
 The `SealingSegment` is a section of the finalized chain. It is part of the data need to
 initialize a new node to join the network. Informally, the `SealingSegment` is continuous section
-of recently finalized blocks that is long enough for the new node to execute its business logic.   
+of recently finalized blocks that is long enough for the new node to execute its business logic.
 
-## History length covered by the Sealing Segment 
+## History length covered by the Sealing Segment
 
 The `SealingSegment` is created from a `protocol.Snapshot` via the method `SealingSegment`.
-Lets denote the block that the `protocol.Snapshot` refers to as `head`. Per convention, 
-`head` must be a finalized block. 
+Lets denote the block that the `protocol.Snapshot` refers to as `head`. Per convention,
+`head` must be a finalized block.
 
-### Part 1: from `head` back to the latest sealed block 
+### Part 1: from `head` back to the latest sealed block
 
 The SealingSegment is a chain segment such that the last block (greatest height)
 is this snapshot's reference block (i.e. `head`) and the first (least height) is the most
@@ -40,10 +40,10 @@ type SealingSegment struct {
    Blocks []*Block
 
    ⋮
-}	
+}
 ```
 
-**Minimality Requirement for `SealingSegment.Blocks`**: 
+**Minimality Requirement for `SealingSegment.Blocks`**:
 In example 3, note that block `B` is the highest sealed block as of `E`. Therefore, the
 lowest block in `SealingSegment.Blocks` must be `B`. Essentially, this is a minimality
 requirement for the history: it shouldn't be longer than necessary. So
@@ -68,10 +68,10 @@ ExtraBlocks []*Block
 ```
 
 **In case `head` contains multiple seals, we need _all_ the sealed blocks**, for the following reason:
-* All nodes locally maintain a copy of the protocol state. A service event may change the state of the protocol state. 
+* All nodes locally maintain a copy of the protocol state. A service event may change the state of the protocol state.
 * For Byzantine resilience, we don't want protocol-state changes to take effect immediately. Therefore, we process
   system events only after receiving a QC for the block.
-  
+
   Now let us consider the situation where a newly initialized node comes online and processes the first child of `head`.
   Lets reuse the example from above, where our head was block `E` and we are now processing the child `X`
   ```
@@ -80,14 +80,14 @@ ExtraBlocks []*Block
    ExtraBlocks              Blocks          block
   ```
   `X` carries the QC for `E`, hence the protocol-state changes in `E` take effect for `X`. Therefore, when processing `X`,
-  we go through the seals in `E` and look through the sealed execution results for service events. 
+  we go through the seals in `E` and look through the sealed execution results for service events.
 * As the service events are order-sensitive, we need to process the seals in the correct order, which is by increasing height
-  of the sealed block. The seals don't contain the block's height information, hence we need to resolve the block. 
+  of the sealed block. The seals don't contain the block's height information, hence we need to resolve the block.
 
 **Extended history to check for duplicated collection guarantees in blocks** is required by nodes that _validate_ block
 payloads (e.g. consensus nodes). Also Access Nodes require these blocks. Collections expire after `flow.DefaultTransactionExpiry` blocks.
 Hence, we desire a history of `flow.DefaultTransactionExpiry` blocks. However, there is the edge case of a recent spork (or genesis),
-where the history is simply less that `flow.DefaultTransactionExpiry`. 
+where the history is simply less that `flow.DefaultTransactionExpiry`.
 
 ### Formal definition
 
@@ -98,10 +98,11 @@ The descriptions from the previous section can be formalized as follows
 * (ii) All blocks that are sealed by `head`. This is relevant if `head` contains _multiple_ seals.
 * (iii) The sealing segment should contain the history back to (including):
   ```
-  limitHeight := max(head.Height - flow.DefaultTransactionExpiry, SporkRootBlockHeight)
+  limitHeight := max(blockSealedAtHead.Height - flow.DefaultTransactionExpiry, SporkRootBlockHeight)
   ```
+   where blockSealedAtHead is the block sealed by `head` block.
 Note that all three conditions have to be satisfied by a sealing segment. Therefore, it must contain the longest history
-required by any of the three conditions. The 'Spork Root Block' is the cutoff. 
+required by any of the three conditions. The 'Spork Root Block' is the cutoff.
 
 Per convention, we include the blocks for (i) in the `SealingSegment.Blocks`, while the
 additional blocks for (ii) and optionally (iii) are contained in as `SealingSegment.ExtraBlocks`.
@@ -147,5 +148,5 @@ In its current state, the sealing segment has been evolving driven by different
 and other improvements. However, an important aspect of the sealing segment is to allow newly-joining nodes to build an internal representation
 of the protocol state, in particular the identity table. There are large changes coming around when we move to the dynamic identity table.
 Therefore, we accept that the Sealing Segment currently has some technical debt and unnecessary complexity. Once we have implemented the
-dynamic identity table, we will have a much more solidified understanding of the data in the sealing segment. 
+dynamic identity table, we will have a much more solidified understanding of the data in the sealing segment.
 
diff --git a/model/flow/transaction_result.go b/model/flow/transaction_result.go
index c8e710e0769..3a327118165 100644
--- a/model/flow/transaction_result.go
+++ b/model/flow/transaction_result.go
@@ -1,4 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
 package flow
 
 import (
diff --git a/model/libp2p/peer/filters.go b/model/libp2p/peer/filters.go
index dc42ac44d99..eaa2d954299 100644
--- a/model/libp2p/peer/filters.go
+++ b/model/libp2p/peer/filters.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package peer
 
 import (
diff --git a/model/messages/consensus.go b/model/messages/consensus.go
index 85c2730d1fc..eeaa34cf9b4 100644
--- a/model/messages/consensus.go
+++ b/model/messages/consensus.go
@@ -56,10 +56,11 @@ func UntrustedExecutionResultFromInternal(internal *flow.ExecutionResult) Untrus
 // Deprecated: Please update flow.Payload to use []flow.Guarantee etc., then
 // replace instances of this type with flow.Payload
 type UntrustedBlockPayload struct {
-	Guarantees []flow.CollectionGuarantee
-	Seals      []flow.Seal
-	Receipts   []flow.ExecutionReceiptMeta
-	Results    []UntrustedExecutionResult
+	Guarantees      []flow.CollectionGuarantee
+	Seals           []flow.Seal
+	Receipts        []flow.ExecutionReceiptMeta
+	Results         []UntrustedExecutionResult
+	ProtocolStateID flow.Identifier
 }
 
 // UntrustedBlock is a duplicate of flow.Block used within
@@ -76,8 +77,10 @@ type UntrustedBlock struct {
 // ToInternal returns the internal representation of the type.
 func (ub *UntrustedBlock) ToInternal() *flow.Block {
 	block := flow.Block{
-		Header:  &ub.Header,
-		Payload: &flow.Payload{},
+		Header: &ub.Header,
+		Payload: &flow.Payload{
+			ProtocolStateID: ub.Payload.ProtocolStateID,
+		},
 	}
 	for _, guarantee := range ub.Payload.Guarantees {
 		guarantee := guarantee
@@ -104,6 +107,9 @@ func (ub *UntrustedBlock) ToInternal() *flow.Block {
 func UntrustedBlockFromInternal(flowBlock *flow.Block) UntrustedBlock {
 	block := UntrustedBlock{
 		Header: *flowBlock.Header,
+		Payload: UntrustedBlockPayload{
+			ProtocolStateID: flowBlock.Payload.ProtocolStateID,
+		},
 	}
 	for _, guarantee := range flowBlock.Payload.Guarantees {
 		block.Payload.Guarantees = append(block.Payload.Guarantees, *guarantee)
diff --git a/model/verification/chunkDataPackRequest.go b/model/verification/chunkDataPackRequest.go
index 9f2bf42c52c..f613750cbcb 100644
--- a/model/verification/chunkDataPackRequest.go
+++ b/model/verification/chunkDataPackRequest.go
@@ -28,7 +28,7 @@ type ChunkDataPackRequestInfo struct {
 func (c ChunkDataPackRequestInfo) SampleTargets(count int) (flow.IdentifierList, error) {
 	// if there are enough receipts produced the same result (agrees), we sample from them.
 	if len(c.Agrees) >= count {
-		sample, err := c.Targets.Filter(filter.HasNodeID(c.Agrees...)).Sample(uint(count))
+		sample, err := c.Targets.Filter(filter.HasNodeID[flow.Identity](c.Agrees...)).Sample(uint(count))
 		if err != nil {
 			return nil, fmt.Errorf("sampling target failed: %w", err)
 		}
@@ -41,7 +41,7 @@ func (c ChunkDataPackRequestInfo) SampleTargets(count int) (flow.IdentifierList,
 	// fetch from the one produced the same result (the only agree)
 	need := uint(count - len(c.Agrees))
 
-	nonResponders, err := c.Targets.Filter(filter.Not(filter.HasNodeID(c.Disagrees...))).Sample(need)
+	nonResponders, err := c.Targets.Filter(filter.Not(filter.HasNodeID[flow.Identity](c.Disagrees...))).Sample(need)
 	if err != nil {
 		return nil, fmt.Errorf("sampling target failed: %w", err)
 	}
diff --git a/model/verification/chunkDataPackRequest_test.go b/model/verification/chunkDataPackRequest_test.go
index 6bb6bfe419e..89e65c39824 100644
--- a/model/verification/chunkDataPackRequest_test.go
+++ b/model/verification/chunkDataPackRequest_test.go
@@ -55,7 +55,7 @@ func TestChunkDataPackRequestList_UniqueRequestInfo(t *testing.T) {
 		return bytes.Compare(thisChunkIDReqInfo.Disagrees[p][:], thisChunkIDReqInfo.Disagrees[q][:]) < 0
 	})
 
-	thisChunkIDReqInfo.Targets = thisChunkIDReqInfo.Targets.Sort(flow.Canonical)
+	thisChunkIDReqInfo.Targets = thisChunkIDReqInfo.Targets.Sort(flow.Canonical[flow.Identity])
 
 	require.Equal(t, thisChunkIDReqInfo.Agrees, thisReq1.Agrees.Union(thisReq2.Agrees))
 	require.Equal(t, thisChunkIDReqInfo.Disagrees, thisReq1.Disagrees.Union(thisReq2.Disagrees))
diff --git a/module/builder.go b/module/builder.go
index 2138134ec89..59877c56b4c 100644
--- a/module/builder.go
+++ b/module/builder.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package module
 
 import (
@@ -18,6 +16,6 @@ type Builder interface {
 	// before returning it.
 	//
 	// NOTE: Since the block is stored within Builder, HotStuff MUST propose the
-	// block once BuildOn succcessfully returns.
-	BuildOn(parentID flow.Identifier, setter func(*flow.Header) error) (*flow.Header, error)
+	// block once BuildOn successfully returns.
+	BuildOn(parentID flow.Identifier, setter func(*flow.Header) error, sign func(*flow.Header) error) (*flow.Header, error)
 }
diff --git a/module/builder/collection/builder.go b/module/builder/collection/builder.go
index 91f7fe93e37..fb37de87362 100644
--- a/module/builder/collection/builder.go
+++ b/module/builder/collection/builder.go
@@ -94,7 +94,7 @@ func NewBuilder(
 
 // BuildOn creates a new block built on the given parent. It produces a payload
 // that is valid with respect to the un-finalized chain it extends.
-func (b *Builder) BuildOn(parentID flow.Identifier, setter func(*flow.Header) error) (*flow.Header, error) {
+func (b *Builder) BuildOn(parentID flow.Identifier, setter func(*flow.Header) error, sign func(*flow.Header) error) (*flow.Header, error) {
 	parentSpan, ctx := b.tracer.StartSpanFromContext(context.Background(), trace.COLBuildOn)
 	defer parentSpan.End()
 
@@ -180,7 +180,7 @@ func (b *Builder) BuildOn(parentID flow.Identifier, setter func(*flow.Header) er
 	// STEP 3: we have a set of transactions that are valid to include on this fork.
 	// Now we create the header for the cluster block.
 	span, _ = b.tracer.StartSpanFromContext(ctx, trace.COLBuildOnCreateHeader)
-	header, err := b.buildHeader(buildCtx, payload, setter)
+	header, err := b.buildHeader(buildCtx, payload, setter, sign)
 	span.End()
 	if err != nil {
 		return nil, fmt.Errorf("could not build header: %w", err)
@@ -487,7 +487,12 @@ func (b *Builder) buildPayload(buildCtx *blockBuildContext) (*cluster.Payload, e
 // buildHeader constructs the header for the cluster block being built.
 // It invokes the HotStuff setter to set fields related to HotStuff (QC, etc.).
 // No errors are expected during normal operation.
-func (b *Builder) buildHeader(ctx *blockBuildContext, payload *cluster.Payload, setter func(header *flow.Header) error) (*flow.Header, error) {
+func (b *Builder) buildHeader(
+	ctx *blockBuildContext,
+	payload *cluster.Payload,
+	setter func(header *flow.Header) error,
+	sign func(*flow.Header) error,
+) (*flow.Header, error) {
 
 	header := &flow.Header{
 		ChainID:     ctx.parent.ChainID,
@@ -505,6 +510,10 @@ func (b *Builder) buildHeader(ctx *blockBuildContext, payload *cluster.Payload,
 	if err != nil {
 		return nil, fmt.Errorf("could not set fields to header: %w", err)
 	}
+	err = sign(header)
+	if err != nil {
+		return nil, fmt.Errorf("could not sign proposal: %w", err)
+	}
 	return header, nil
 }
 
diff --git a/module/builder/collection/builder_test.go b/module/builder/collection/builder_test.go
index 9641b7c934a..9dd495440c0 100644
--- a/module/builder/collection/builder_test.go
+++ b/module/builder/collection/builder_test.go
@@ -35,6 +35,7 @@ import (
 )
 
 var noopSetter = func(*flow.Header) error { return nil }
+var noopSigner = func(*flow.Header) error { return nil }
 
 type BuilderSuite struct {
 	suite.Suite
@@ -85,11 +86,19 @@ func (suite *BuilderSuite) SetupTest() {
 	// ensure we don't enter a new epoch for tests that build many blocks
 	result.ServiceEvents[0].Event.(*flow.EpochSetup).FinalView = root.Header.View + 100000
 	seal.ResultID = result.ID()
+	root.Payload.ProtocolStateID = inmem.ProtocolStateFromEpochServiceEvents(
+		result.ServiceEvents[0].Event.(*flow.EpochSetup),
+		result.ServiceEvents[1].Event.(*flow.EpochCommit),
+	).ID()
 	rootSnapshot, err := inmem.SnapshotFromBootstrapState(root, result, seal, unittest.QuorumCertificateFixture(unittest.QCWithRootBlockID(root.ID())))
 	require.NoError(suite.T(), err)
 	suite.epochCounter = rootSnapshot.Encodable().Epochs.Current.Counter
 
 	clusterQC := unittest.QuorumCertificateFixture(unittest.QCWithRootBlockID(suite.genesis.ID()))
+	root.Payload.ProtocolStateID = inmem.ProtocolStateFromEpochServiceEvents(
+		result.ServiceEvents[0].Event.(*flow.EpochSetup),
+		result.ServiceEvents[1].Event.(*flow.EpochCommit),
+	).ID()
 	clusterStateRoot, err := clusterkv.NewStateRoot(suite.genesis, clusterQC, suite.epochCounter)
 	suite.Require().NoError(err)
 	clusterState, err := clusterkv.Bootstrap(suite.db, clusterStateRoot)
@@ -108,7 +117,7 @@ func (suite *BuilderSuite) SetupTest() {
 		all.QuorumCertificates,
 		all.Setups,
 		all.EpochCommits,
-		all.Statuses,
+		all.ProtocolState,
 		all.VersionBeacons,
 		rootSnapshot,
 	)
@@ -179,9 +188,7 @@ func (suite *BuilderSuite) Payload(transactions ...*flow.TransactionBody) model.
 
 // ProtoStateRoot returns the root block of the protocol state.
 func (suite *BuilderSuite) ProtoStateRoot() *flow.Header {
-	root, err := suite.protoState.Params().FinalizedRoot()
-	suite.Require().NoError(err)
-	return root
+	return suite.protoState.Params().FinalizedRoot()
 }
 
 // ClearPool removes all items from the pool
@@ -208,7 +215,7 @@ func (suite *BuilderSuite) TestBuildOn_NonExistentParent() {
 	// use a non-existent parent ID
 	parentID := unittest.IdentifierFixture()
 
-	_, err := suite.builder.BuildOn(parentID, noopSetter)
+	_, err := suite.builder.BuildOn(parentID, noopSetter, noopSigner)
 	suite.Assert().Error(err)
 }
 
@@ -220,7 +227,7 @@ func (suite *BuilderSuite) TestBuildOn_Success() {
 		return nil
 	}
 
-	header, err := suite.builder.BuildOn(suite.genesis.ID(), setter)
+	header, err := suite.builder.BuildOn(suite.genesis.ID(), setter, noopSigner)
 	suite.Require().NoError(err)
 
 	// setter should have been run
@@ -255,7 +262,7 @@ func (suite *BuilderSuite) TestBuildOn_WithUnknownReferenceBlock() {
 	unknownReferenceTx.ReferenceBlockID = unittest.IdentifierFixture()
 	suite.pool.Add(&unknownReferenceTx)
 
-	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter)
+	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter, noopSigner)
 	suite.Require().NoError(err)
 
 	// should be able to retrieve built block from storage
@@ -280,8 +287,12 @@ func (suite *BuilderSuite) TestBuildOn_WithUnfinalizedReferenceBlock() {
 	// add an unfinalized block to the protocol state
 	genesis, err := suite.protoState.Final().Head()
 	suite.Require().NoError(err)
+	protocolState, err := suite.protoState.Final().ProtocolState()
+	suite.Require().NoError(err)
+	protocolStateID := protocolState.Entry().ID()
+
 	unfinalizedReferenceBlock := unittest.BlockWithParentFixture(genesis)
-	unfinalizedReferenceBlock.SetPayload(flow.EmptyPayload())
+	unfinalizedReferenceBlock.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(protocolStateID)))
 	err = suite.protoState.ExtendCertified(context.Background(), unfinalizedReferenceBlock,
 		unittest.CertifyBlock(unfinalizedReferenceBlock.Header))
 	suite.Require().NoError(err)
@@ -291,7 +302,7 @@ func (suite *BuilderSuite) TestBuildOn_WithUnfinalizedReferenceBlock() {
 	unfinalizedReferenceTx.ReferenceBlockID = unfinalizedReferenceBlock.ID()
 	suite.pool.Add(&unfinalizedReferenceTx)
 
-	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter)
+	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter, noopSigner)
 	suite.Require().NoError(err)
 
 	// should be able to retrieve built block from storage
@@ -316,14 +327,18 @@ func (suite *BuilderSuite) TestBuildOn_WithOrphanedReferenceBlock() {
 	// add an orphaned block to the protocol state
 	genesis, err := suite.protoState.Final().Head()
 	suite.Require().NoError(err)
+	protocolState, err := suite.protoState.Final().ProtocolState()
+	suite.Require().NoError(err)
+	protocolStateID := protocolState.Entry().ID()
+
 	// create a block extending genesis which will be orphaned
 	orphan := unittest.BlockWithParentFixture(genesis)
-	orphan.SetPayload(flow.EmptyPayload())
+	orphan.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(protocolStateID)))
 	err = suite.protoState.ExtendCertified(context.Background(), orphan, unittest.CertifyBlock(orphan.Header))
 	suite.Require().NoError(err)
 	// create and finalize a block on top of genesis, orphaning `orphan`
 	block1 := unittest.BlockWithParentFixture(genesis)
-	block1.SetPayload(flow.EmptyPayload())
+	block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(protocolStateID)))
 	err = suite.protoState.ExtendCertified(context.Background(), block1, unittest.CertifyBlock(block1.Header))
 	suite.Require().NoError(err)
 	err = suite.protoState.Finalize(context.Background(), block1.ID())
@@ -334,7 +349,7 @@ func (suite *BuilderSuite) TestBuildOn_WithOrphanedReferenceBlock() {
 	orphanedReferenceTx.ReferenceBlockID = orphan.ID()
 	suite.pool.Add(&orphanedReferenceTx)
 
-	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter)
+	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter, noopSigner)
 	suite.Require().NoError(err)
 
 	// should be able to retrieve built block from storage
@@ -377,7 +392,7 @@ func (suite *BuilderSuite) TestBuildOn_WithForks() {
 	suite.InsertBlock(block2)
 
 	// build on top of fork 1
-	header, err := suite.builder.BuildOn(block1.ID(), noopSetter)
+	header, err := suite.builder.BuildOn(block1.ID(), noopSetter, noopSigner)
 	require.NoError(t, err)
 
 	// should be able to retrieve built block from storage
@@ -420,7 +435,7 @@ func (suite *BuilderSuite) TestBuildOn_ConflictingFinalizedBlock() {
 	suite.FinalizeBlock(finalizedBlock)
 
 	// build on the un-finalized block
-	header, err := suite.builder.BuildOn(unFinalizedBlock.ID(), noopSetter)
+	header, err := suite.builder.BuildOn(unFinalizedBlock.ID(), noopSetter, noopSigner)
 	require.NoError(t, err)
 
 	// retrieve the built block from storage
@@ -469,7 +484,7 @@ func (suite *BuilderSuite) TestBuildOn_ConflictingInvalidatedForks() {
 	suite.FinalizeBlock(finalizedBlock)
 
 	// build on the finalized block
-	header, err := suite.builder.BuildOn(finalizedBlock.ID(), noopSetter)
+	header, err := suite.builder.BuildOn(finalizedBlock.ID(), noopSetter, noopSigner)
 	require.NoError(t, err)
 
 	// retrieve the built block from storage
@@ -553,7 +568,7 @@ func (suite *BuilderSuite) TestBuildOn_LargeHistory() {
 	t.Log("conflicting: ", len(invalidatedTxIds))
 
 	// build on the head block
-	header, err := suite.builder.BuildOn(head.ID(), noopSetter)
+	header, err := suite.builder.BuildOn(head.ID(), noopSetter, noopSigner)
 	require.NoError(t, err)
 
 	// retrieve the built block from storage
@@ -572,7 +587,7 @@ func (suite *BuilderSuite) TestBuildOn_MaxCollectionSize() {
 	suite.builder, _ = builder.NewBuilder(suite.db, trace.NewNoopTracer(), suite.protoState, suite.state, suite.headers, suite.headers, suite.payloads, suite.pool, unittest.Logger(), suite.epochCounter, builder.WithMaxCollectionSize(1))
 
 	// build a block
-	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter)
+	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter, noopSigner)
 	suite.Require().NoError(err)
 
 	// retrieve the built block from storage
@@ -590,7 +605,7 @@ func (suite *BuilderSuite) TestBuildOn_MaxCollectionByteSize() {
 	suite.builder, _ = builder.NewBuilder(suite.db, trace.NewNoopTracer(), suite.protoState, suite.state, suite.headers, suite.headers, suite.payloads, suite.pool, unittest.Logger(), suite.epochCounter, builder.WithMaxCollectionByteSize(400))
 
 	// build a block
-	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter)
+	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter, noopSigner)
 	suite.Require().NoError(err)
 
 	// retrieve the built block from storage
@@ -608,7 +623,7 @@ func (suite *BuilderSuite) TestBuildOn_MaxCollectionTotalGas() {
 	suite.builder, _ = builder.NewBuilder(suite.db, trace.NewNoopTracer(), suite.protoState, suite.state, suite.headers, suite.headers, suite.payloads, suite.pool, unittest.Logger(), suite.epochCounter, builder.WithMaxCollectionTotalGas(20000))
 
 	// build a block
-	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter)
+	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter, noopSigner)
 	suite.Require().NoError(err)
 
 	// retrieve the built block from storage
@@ -626,13 +641,14 @@ func (suite *BuilderSuite) TestBuildOn_ExpiredTransaction() {
 	// create enough main-chain blocks that an expired transaction is possible
 	genesis, err := suite.protoState.Final().Head()
 	suite.Require().NoError(err)
+	protocolState, err := suite.protoState.Final().ProtocolState()
+	suite.Require().NoError(err)
+	protocolStateID := protocolState.Entry().ID()
 
 	head := genesis
 	for i := 0; i < flow.DefaultTransactionExpiry+1; i++ {
 		block := unittest.BlockWithParentFixture(head)
-		block.Payload.Guarantees = nil
-		block.Payload.Seals = nil
-		block.Header.PayloadHash = block.Payload.Hash()
+		block.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(protocolStateID)))
 		err = suite.protoState.ExtendCertified(context.Background(), block, unittest.CertifyBlock(block.Header))
 		suite.Require().NoError(err)
 		err = suite.protoState.Finalize(context.Background(), block.ID())
@@ -664,7 +680,7 @@ func (suite *BuilderSuite) TestBuildOn_ExpiredTransaction() {
 	suite.T().Log("tx2: ", tx2.ID())
 
 	// build a block
-	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter)
+	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter, noopSigner)
 	suite.Require().NoError(err)
 
 	// retrieve the built block from storage
@@ -686,7 +702,7 @@ func (suite *BuilderSuite) TestBuildOn_EmptyMempool() {
 	suite.pool = herocache.NewTransactions(1000, unittest.Logger(), metrics.NewNoopCollector())
 	suite.builder, _ = builder.NewBuilder(suite.db, trace.NewNoopTracer(), suite.protoState, suite.state, suite.headers, suite.headers, suite.payloads, suite.pool, unittest.Logger(), suite.epochCounter)
 
-	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter)
+	header, err := suite.builder.BuildOn(suite.genesis.ID(), noopSetter, noopSigner)
 	suite.Require().NoError(err)
 
 	var built model.Block
@@ -729,7 +745,7 @@ func (suite *BuilderSuite) TestBuildOn_NoRateLimiting() {
 	// since we have no rate limiting we should fill all collections and in 10 blocks
 	parentID := suite.genesis.ID()
 	for i := 0; i < 10; i++ {
-		header, err := suite.builder.BuildOn(parentID, noopSetter)
+		header, err := suite.builder.BuildOn(parentID, noopSetter, noopSigner)
 		suite.Require().NoError(err)
 		parentID = header.ID()
 
@@ -776,7 +792,7 @@ func (suite *BuilderSuite) TestBuildOn_RateLimitNonPayer() {
 	// since rate limiting does not apply to non-payer keys, we should fill all collections in 10 blocks
 	parentID := suite.genesis.ID()
 	for i := 0; i < 10; i++ {
-		header, err := suite.builder.BuildOn(parentID, noopSetter)
+		header, err := suite.builder.BuildOn(parentID, noopSetter, noopSigner)
 		suite.Require().NoError(err)
 		parentID = header.ID()
 
@@ -814,7 +830,7 @@ func (suite *BuilderSuite) TestBuildOn_HighRateLimit() {
 	// rate-limiting should be applied, resulting in half-full collections (5/10)
 	parentID := suite.genesis.ID()
 	for i := 0; i < 10; i++ {
-		header, err := suite.builder.BuildOn(parentID, noopSetter)
+		header, err := suite.builder.BuildOn(parentID, noopSetter, noopSigner)
 		suite.Require().NoError(err)
 		parentID = header.ID()
 
@@ -853,7 +869,7 @@ func (suite *BuilderSuite) TestBuildOn_LowRateLimit() {
 	// having one transaction and empty collections otherwise
 	parentID := suite.genesis.ID()
 	for i := 0; i < 10; i++ {
-		header, err := suite.builder.BuildOn(parentID, noopSetter)
+		header, err := suite.builder.BuildOn(parentID, noopSetter, noopSigner)
 		suite.Require().NoError(err)
 		parentID = header.ID()
 
@@ -894,7 +910,7 @@ func (suite *BuilderSuite) TestBuildOn_UnlimitedPayer() {
 	// rate-limiting should not be applied, since the payer is marked as unlimited
 	parentID := suite.genesis.ID()
 	for i := 0; i < 10; i++ {
-		header, err := suite.builder.BuildOn(parentID, noopSetter)
+		header, err := suite.builder.BuildOn(parentID, noopSetter, noopSigner)
 		suite.Require().NoError(err)
 		parentID = header.ID()
 
@@ -935,7 +951,7 @@ func (suite *BuilderSuite) TestBuildOn_RateLimitDryRun() {
 	// rate-limiting should not be applied, since dry-run setting is enabled
 	parentID := suite.genesis.ID()
 	for i := 0; i < 10; i++ {
-		header, err := suite.builder.BuildOn(parentID, noopSetter)
+		header, err := suite.builder.BuildOn(parentID, noopSetter, noopSigner)
 		suite.Require().NoError(err)
 		parentID = header.ID()
 
@@ -1042,7 +1058,7 @@ func benchmarkBuildOn(b *testing.B, size int) {
 
 	b.StartTimer()
 	for n := 0; n < b.N; n++ {
-		_, err := suite.builder.BuildOn(final.ID(), noopSetter)
+		_, err := suite.builder.BuildOn(final.ID(), noopSetter, noopSigner)
 		assert.NoError(b, err)
 	}
 }
diff --git a/module/builder/consensus/builder.go b/module/builder/consensus/builder.go
index b9a279a0dcc..a65f1326625 100644
--- a/module/builder/consensus/builder.go
+++ b/module/builder/consensus/builder.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package consensus
 
 import (
@@ -25,20 +23,21 @@ import (
 // Builder is the builder for consensus block payloads. Upon providing a payload
 // hash, it also memorizes which entities were included into the payload.
 type Builder struct {
-	metrics    module.MempoolMetrics
-	tracer     module.Tracer
-	db         *badger.DB
-	state      protocol.ParticipantState
-	seals      storage.Seals
-	headers    storage.Headers
-	index      storage.Index
-	blocks     storage.Blocks
-	resultsDB  storage.ExecutionResults
-	receiptsDB storage.ExecutionReceipts
-	guarPool   mempool.Guarantees
-	sealPool   mempool.IncorporatedResultSeals
-	recPool    mempool.ExecutionTree
-	cfg        Config
+	metrics              module.MempoolMetrics
+	tracer               module.Tracer
+	db                   *badger.DB
+	state                protocol.ParticipantState
+	seals                storage.Seals
+	headers              storage.Headers
+	index                storage.Index
+	blocks               storage.Blocks
+	resultsDB            storage.ExecutionResults
+	receiptsDB           storage.ExecutionReceipts
+	guarPool             mempool.Guarantees
+	sealPool             mempool.IncorporatedResultSeals
+	recPool              mempool.ExecutionTree
+	mutableProtocolState protocol.MutableProtocolState
+	cfg                  Config
 }
 
 // NewBuilder creates a new block builder.
@@ -52,6 +51,7 @@ func NewBuilder(
 	blocks storage.Blocks,
 	resultsDB storage.ExecutionResults,
 	receiptsDB storage.ExecutionReceipts,
+	mutableProtocolState protocol.MutableProtocolState,
 	guarPool mempool.Guarantees,
 	sealPool mempool.IncorporatedResultSeals,
 	recPool mempool.ExecutionTree,
@@ -79,20 +79,21 @@ func NewBuilder(
 	}
 
 	b := &Builder{
-		metrics:    metrics,
-		db:         db,
-		tracer:     tracer,
-		state:      state,
-		headers:    headers,
-		seals:      seals,
-		index:      index,
-		blocks:     blocks,
-		resultsDB:  resultsDB,
-		receiptsDB: receiptsDB,
-		guarPool:   guarPool,
-		sealPool:   sealPool,
-		recPool:    recPool,
-		cfg:        cfg,
+		metrics:              metrics,
+		db:                   db,
+		tracer:               tracer,
+		state:                state,
+		headers:              headers,
+		seals:                seals,
+		index:                index,
+		blocks:               blocks,
+		resultsDB:            resultsDB,
+		receiptsDB:           receiptsDB,
+		guarPool:             guarPool,
+		sealPool:             sealPool,
+		recPool:              recPool,
+		mutableProtocolState: mutableProtocolState,
+		cfg:                  cfg,
 	}
 
 	err = b.repopulateExecutionTree()
@@ -106,7 +107,7 @@ func NewBuilder(
 // BuildOn creates a new block header on top of the provided parent, using the
 // given view and applying the custom setter function to allow the caller to
 // make changes to the header before storing it.
-func (b *Builder) BuildOn(parentID flow.Identifier, setter func(*flow.Header) error) (*flow.Header, error) {
+func (b *Builder) BuildOn(parentID flow.Identifier, setter func(*flow.Header) error, sign func(*flow.Header) error) (*flow.Header, error) {
 
 	// since we don't know the blockID when building the block we track the
 	// time indirectly and insert the span directly at the end
@@ -136,7 +137,8 @@ func (b *Builder) BuildOn(parentID flow.Identifier, setter func(*flow.Header) er
 		insertableGuarantees,
 		insertableSeals,
 		insertableReceipts,
-		setter)
+		setter,
+		sign)
 	if err != nil {
 		return nil, fmt.Errorf("could not assemble proposal: %w", err)
 	}
@@ -606,15 +608,9 @@ func (b *Builder) createProposal(parentID flow.Identifier,
 	guarantees []*flow.CollectionGuarantee,
 	seals []*flow.Seal,
 	insertableReceipts *InsertableReceipts,
-	setter func(*flow.Header) error) (*flow.Block, error) {
-
-	// build the payload so we can get the hash
-	payload := &flow.Payload{
-		Guarantees: guarantees,
-		Seals:      seals,
-		Receipts:   insertableReceipts.receipts,
-		Results:    insertableReceipts.results,
-	}
+	setter func(*flow.Header) error,
+	sign func(*flow.Header) error,
+) (*flow.Block, error) {
 
 	parent, err := b.headers.ByBlockID(parentID)
 	if err != nil {
@@ -629,18 +625,44 @@ func (b *Builder) createProposal(parentID flow.Identifier,
 		ParentID:    parentID,
 		Height:      parent.Height + 1,
 		Timestamp:   timestamp,
-		PayloadHash: payload.Hash(),
+		PayloadHash: flow.ZeroID,
 	}
 
-	// apply the custom fields setter of the consensus algorithm
+	// apply the custom fields setter of the consensus algorithm, we must do this before applying service events
+	// since we need to know the correct view of the block.
 	err = setter(header)
 	if err != nil {
 		return nil, fmt.Errorf("could not apply setter: %w", err)
 	}
 
+	stateMutator, err := b.mutableProtocolState.Mutator(header.View, header.ParentID)
+	if err != nil {
+		return nil, fmt.Errorf("could not create protocol state stateMutator for view %d: %w", header.View, err)
+	}
+	err = stateMutator.ApplyServiceEventsFromValidatedSeals(seals)
+	if err != nil {
+		return nil, fmt.Errorf("could not apply service events as leader: %w", err)
+	}
+	_, _, protocolStateID, _ := stateMutator.Build()
+	if err != nil {
+		return nil, fmt.Errorf("could not build updated protocol state: %w", err)
+	}
+
 	proposal := &flow.Block{
-		Header:  header,
-		Payload: payload,
+		Header: header,
+	}
+	proposal.SetPayload(flow.Payload{
+		Guarantees:      guarantees,
+		Seals:           seals,
+		Receipts:        insertableReceipts.receipts,
+		Results:         insertableReceipts.results,
+		ProtocolStateID: protocolStateID,
+	})
+
+	// sign the proposal
+	err = sign(header)
+	if err != nil {
+		return nil, fmt.Errorf("could not sign the proposal: %w", err)
 	}
 
 	return proposal, nil
diff --git a/module/builder/consensus/builder_test.go b/module/builder/consensus/builder_test.go
index d8f82c8eda8..bec649d1e9f 100644
--- a/module/builder/consensus/builder_test.go
+++ b/module/builder/consensus/builder_test.go
@@ -66,15 +66,17 @@ type BuilderSuite struct {
 	db       *badger.DB
 	sentinel uint64
 	setter   func(*flow.Header) error
+	sign     func(*flow.Header) error
 
 	// mocked dependencies
-	state      *protocol.ParticipantState
-	headerDB   *storage.Headers
-	sealDB     *storage.Seals
-	indexDB    *storage.Index
-	blockDB    *storage.Blocks
-	resultDB   *storage.ExecutionResults
-	receiptsDB *storage.ExecutionReceipts
+	state        *protocol.ParticipantState
+	headerDB     *storage.Headers
+	sealDB       *storage.Seals
+	indexDB      *storage.Index
+	blockDB      *storage.Blocks
+	resultDB     *storage.ExecutionResults
+	receiptsDB   *storage.ExecutionReceipts
+	stateMutator *protocol.MutableProtocolState
 
 	guarPool *mempool.Guarantees
 	sealPool *mempool.IncorporatedResultSeals
@@ -265,6 +267,9 @@ func (bs *BuilderSuite) SetupTest() {
 		header.View = 1337
 		return nil
 	}
+	bs.sign = func(_ *flow.Header) error {
+		return nil
+	}
 
 	bs.state = &protocol.ParticipantState{}
 	bs.state.On("Extend", mock.Anything, mock.Anything).Run(func(args mock.Arguments) {
@@ -409,6 +414,19 @@ func (bs *BuilderSuite) SetupTest() {
 		nil,
 	)
 
+	// setup mock state mutator, we don't need a real once since we are using mocked participant state.
+	bs.stateMutator = protocol.NewMutableProtocolState(bs.T())
+	bs.stateMutator.On("Mutator", mock.Anything, mock.Anything).Return(
+		func(_ uint64, _ flow.Identifier) realproto.StateMutator {
+			stateMutator := protocol.NewStateMutator(bs.T())
+			stateMutator.On("ApplyServiceEventsFromValidatedSeals", mock.Anything).Return(nil)
+			stateMutator.On("Build").Return(false, nil, flow.Identifier{}, nil, nil)
+			return stateMutator
+		}, func(_ uint64, _ flow.Identifier) error {
+			return nil
+		},
+	)
+
 	// initialize the builder
 	bs.build, err = NewBuilder(
 		noopMetrics,
@@ -420,6 +438,7 @@ func (bs *BuilderSuite) SetupTest() {
 		bs.blockDB,
 		bs.resultDB,
 		bs.receiptsDB,
+		bs.stateMutator,
 		bs.guarPool,
 		bs.sealPool,
 		bs.recPool,
@@ -440,7 +459,7 @@ func (bs *BuilderSuite) TearDownTest() {
 func (bs *BuilderSuite) TestPayloadEmptyValid() {
 
 	// we should build an empty block with default setup
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.Assert().Empty(bs.assembled.Guarantees, "should have no guarantees in payload with empty mempool")
 	bs.Assert().Empty(bs.assembled.Seals, "should have no seals in payload with empty mempool")
@@ -450,7 +469,7 @@ func (bs *BuilderSuite) TestPayloadGuaranteeValid() {
 
 	// add sixteen guarantees to the pool
 	bs.pendingGuarantees = unittest.CollectionGuaranteesFixture(16, unittest.WithCollRef(bs.finalID))
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.Assert().ElementsMatch(bs.pendingGuarantees, bs.assembled.Guarantees, "should have guarantees from mempool in payload")
 }
@@ -473,7 +492,7 @@ func (bs *BuilderSuite) TestPayloadGuaranteeDuplicate() {
 
 	// add sixteen guarantees to the pool
 	bs.pendingGuarantees = append(valid, duplicated...)
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.Assert().ElementsMatch(valid, bs.assembled.Guarantees, "should have valid guarantees from mempool in payload")
 }
@@ -488,7 +507,7 @@ func (bs *BuilderSuite) TestPayloadGuaranteeReferenceUnknown() {
 
 	// add all guarantees to the pool
 	bs.pendingGuarantees = append(valid, unknown...)
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.Assert().ElementsMatch(valid, bs.assembled.Guarantees, "should have valid from mempool in payload")
 }
@@ -506,7 +525,7 @@ func (bs *BuilderSuite) TestPayloadGuaranteeReferenceExpired() {
 
 	// add all guarantees to the pool
 	bs.pendingGuarantees = append(valid, expired...)
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.Assert().ElementsMatch(valid, bs.assembled.Guarantees, "should have valid from mempool in payload")
 }
@@ -532,7 +551,7 @@ func (bs *BuilderSuite) TestPayloadSeals_AllValid() {
 	//	Populate seals mempool with valid chain of seals for blocks [F0], ..., [A2]
 	bs.pendingSeals = bs.irsMap
 
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.Assert().Empty(bs.assembled.Guarantees, "should have no guarantees in payload with empty mempool")
 	bs.Assert().ElementsMatch(bs.chain, bs.assembled.Seals, "should have included valid chain of seals")
@@ -547,7 +566,7 @@ func (bs *BuilderSuite) TestPayloadSeals_Limit() {
 	limit := uint(2)
 	bs.build.cfg.maxSealCount = limit
 
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.Assert().Empty(bs.assembled.Guarantees, "should have no guarantees in payload with empty mempool")
 	bs.Assert().Equal(bs.chain[:limit], bs.assembled.Seals, "should have excluded seals above maxSealCount")
@@ -573,7 +592,7 @@ func (bs *BuilderSuite) TestPayloadSeals_OnlyFork() {
 	}
 
 	bs.pendingSeals = bs.irsMap
-	_, err := bs.build.BuildOn(forkHead.ID(), bs.setter)
+	_, err := bs.build.BuildOn(forkHead.ID(), bs.setter, bs.sign)
 	bs.Require().NoError(err)
 
 	// expected seals: [F0] <- ... <- [final] <- [B0] <- ... <- [B5]
@@ -654,7 +673,7 @@ func (bs *BuilderSuite) TestPayloadSeals_EnforceGap() {
 	bs.T().Run("Build on top of B4 and check that no seals are included", func(t *testing.T) {
 		bs.sealDB.On("HighestInFork", b4.ID()).Return(b0seal, nil)
 
-		_, err := bs.build.BuildOn(b4.ID(), bs.setter)
+		_, err := bs.build.BuildOn(b4.ID(), bs.setter, bs.sign)
 		require.NoError(t, err)
 		bs.recPool.AssertExpectations(t)
 		require.Empty(t, bs.assembled.Seals, "should not include any seals")
@@ -665,7 +684,7 @@ func (bs *BuilderSuite) TestPayloadSeals_EnforceGap() {
 		bs.storeBlock(b5)
 		bs.sealDB.On("HighestInFork", b5.ID()).Return(b0seal, nil)
 
-		_, err := bs.build.BuildOn(b5.ID(), bs.setter)
+		_, err := bs.build.BuildOn(b5.ID(), bs.setter, bs.sign)
 		require.NoError(t, err)
 		bs.recPool.AssertExpectations(t)
 		require.Equal(t, 1, len(bs.assembled.Seals), "only seal for B1 expected")
@@ -694,7 +713,7 @@ func (bs *BuilderSuite) TestPayloadSeals_Duplicate() {
 	// seals for all blocks [F0], ..., [A3] are still in the mempool:
 	bs.pendingSeals = bs.irsMap
 
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.Assert().Equal(bs.chain[n:], bs.assembled.Seals, "should have rejected duplicate seals")
 }
@@ -717,7 +736,7 @@ func (bs *BuilderSuite) TestPayloadSeals_MissingNextSeal() {
 	delete(bs.irsMap, firstSeal.ID())
 	bs.pendingSeals = bs.irsMap
 
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.Assert().Empty(bs.assembled.Guarantees, "should have no guarantees in payload with empty mempool")
 	bs.Assert().Empty(bs.assembled.Seals, "should not have included any seals from cutoff chain")
@@ -741,7 +760,7 @@ func (bs *BuilderSuite) TestPayloadSeals_MissingInterimSeal() {
 	delete(bs.irsMap, seal.ID())
 	bs.pendingSeals = bs.irsMap
 
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.Assert().Empty(bs.assembled.Guarantees, "should have no guarantees in payload with empty mempool")
 	bs.Assert().ElementsMatch(bs.chain[:3], bs.assembled.Seals, "should have included only beginning of broken chain")
@@ -813,7 +832,7 @@ func (bs *BuilderSuite) TestValidatePayloadSeals_ExecutionForks() {
 		bs.pendingSeals = make(map[flow.Identifier]*flow.IncorporatedResultSeal)
 		storeSealForIncorporatedResult(&receiptChain2[1].ExecutionResult, blocks[2].ID(), bs.pendingSeals)
 
-		_, err := bs.build.BuildOn(blocks[4].ID(), bs.setter)
+		_, err := bs.build.BuildOn(blocks[4].ID(), bs.setter, bs.sign)
 		require.NoError(t, err)
 		require.Empty(t, bs.assembled.Seals, "should not have included seal for conflicting execution fork")
 	})
@@ -825,7 +844,7 @@ func (bs *BuilderSuite) TestValidatePayloadSeals_ExecutionForks() {
 		storeSealForIncorporatedResult(&receiptChain2[1].ExecutionResult, blocks[2].ID(), bs.pendingSeals)
 		storeSealForIncorporatedResult(&receiptChain2[2].ExecutionResult, blocks[3].ID(), bs.pendingSeals)
 
-		_, err := bs.build.BuildOn(blocks[4].ID(), bs.setter)
+		_, err := bs.build.BuildOn(blocks[4].ID(), bs.setter, bs.sign)
 		require.NoError(t, err)
 		require.ElementsMatch(t, []*flow.Seal{sealResultA_1.Seal, sealResultB_1.Seal}, bs.assembled.Seals, "valid fork should have been sealed")
 	})
@@ -864,21 +883,21 @@ func (bs *BuilderSuite) TestPayloadReceipts_TraverseExecutionTreeFromLastSealedR
 	// building on top of X0: latest finalized block in fork is [lastSeal]; expect search to start with sealed result
 	bs.sealDB.On("HighestInFork", x0.ID()).Return(bs.lastSeal, nil)
 	bs.recPool.On("ReachableReceipts", bs.lastSeal.ResultID, mock.Anything, mock.Anything).Return([]*flow.ExecutionReceipt{}, nil).Once()
-	_, err := bs.build.BuildOn(x0.ID(), bs.setter)
+	_, err := bs.build.BuildOn(x0.ID(), bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.recPool.AssertExpectations(bs.T())
 
 	// building on top of X1: latest finalized block in fork is [F4]; expect search to start with sealed result
 	bs.sealDB.On("HighestInFork", x1.ID()).Return(f4Seal, nil)
 	bs.recPool.On("ReachableReceipts", f4Seal.ResultID, mock.Anything, mock.Anything).Return([]*flow.ExecutionReceipt{}, nil).Once()
-	_, err = bs.build.BuildOn(x1.ID(), bs.setter)
+	_, err = bs.build.BuildOn(x1.ID(), bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.recPool.AssertExpectations(bs.T())
 
 	// building on top of A3 (with ID bs.parentID): latest finalized block in fork is [F4]; expect search to start with sealed result
 	bs.sealDB.On("HighestInFork", bs.parentID).Return(f2eal, nil)
 	bs.recPool.On("ReachableReceipts", f2eal.ResultID, mock.Anything, mock.Anything).Return([]*flow.ExecutionReceipt{}, nil).Once()
-	_, err = bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err = bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.recPool.AssertExpectations(bs.T())
 }
@@ -936,7 +955,7 @@ func (bs *BuilderSuite) TestPayloadReceipts_IncludeOnlyReceiptsForCurrentFork()
 		}).Return([]*flow.ExecutionReceipt{}, nil).Once()
 	bs.build.recPool = bs.recPool
 
-	_, err := bs.build.BuildOn(b5.ID(), bs.setter)
+	_, err := bs.build.BuildOn(b5.ID(), bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.recPool.AssertExpectations(bs.T())
 }
@@ -973,7 +992,7 @@ func (bs *BuilderSuite) TestPayloadReceipts_SkipDuplicatedReceipts() {
 		}).Return([]*flow.ExecutionReceipt{}, nil).Once()
 	bs.build.recPool = bs.recPool
 
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.recPool.AssertExpectations(bs.T())
 }
@@ -1003,7 +1022,7 @@ func (bs *BuilderSuite) TestPayloadReceipts_SkipReceiptsForSealedBlock() {
 		}).Return([]*flow.ExecutionReceipt{}, nil).Once()
 	bs.build.recPool = bs.recPool
 
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.recPool.AssertExpectations(bs.T())
 }
@@ -1031,7 +1050,7 @@ func (bs *BuilderSuite) TestPayloadReceipts_BlockLimit() {
 	bs.build.cfg.maxReceiptCount = limit
 
 	// ensure that only 3 of the 5 receipts were included
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.Assert().ElementsMatch(metas[:limit], bs.assembled.Receipts, "should have excluded receipts above maxReceiptCount")
 	bs.Assert().ElementsMatch(expectedResults[:limit], bs.assembled.Results, "should have excluded results above maxReceiptCount")
@@ -1054,7 +1073,7 @@ func (bs *BuilderSuite) TestPayloadReceipts_AsProvidedByReceiptForest() {
 	bs.recPool.On("ReachableReceipts", mock.Anything, mock.Anything, mock.Anything).Return(expectedReceipts, nil).Once()
 	bs.build.recPool = bs.recPool
 
-	_, err := bs.build.BuildOn(bs.parentID, bs.setter)
+	_, err := bs.build.BuildOn(bs.parentID, bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	bs.Assert().ElementsMatch(expectedMetas, bs.assembled.Receipts, "should include receipts as returned by ExecutionTree")
 	bs.Assert().ElementsMatch(expectedResults, bs.assembled.Results, "should include results as returned by ExecutionTree")
@@ -1110,7 +1129,7 @@ func (bs *BuilderSuite) TestIntegration_PayloadReceiptNoParentResult() {
 	_, _ = bs.build.recPool.AddReceipt(receiptSABC[1], blockSABC[1].Header)
 	_, _ = bs.build.recPool.AddReceipt(receiptSABC[3], blockSABC[3].Header)
 
-	_, err := bs.build.BuildOn(blockSABC[3].ID(), bs.setter)
+	_, err := bs.build.BuildOn(blockSABC[3].ID(), bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	expectedReceipts := flow.ExecutionReceiptMetaList{receiptSABC[1].Meta()}
 	expectedResults := flow.ExecutionResultList{&receiptSABC[1].ExecutionResult}
@@ -1173,7 +1192,7 @@ func (bs *BuilderSuite) TestIntegration_ExtendDifferentExecutionPathsOnSameFork(
 	_, _ = bs.build.recPool.AddReceipt(recB1, B.Header)
 	_, _ = bs.build.recPool.AddReceipt(recB2, B.Header)
 
-	_, err := bs.build.BuildOn(B.ID(), bs.setter)
+	_, err := bs.build.BuildOn(B.ID(), bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	expectedReceipts := flow.ExecutionReceiptMetaList{recB1.Meta(), recB2.Meta()}
 	expectedResults := flow.ExecutionResultList{&recB1.ExecutionResult, &recB2.ExecutionResult}
@@ -1257,7 +1276,7 @@ func (bs *BuilderSuite) TestIntegration_ExtendDifferentExecutionPathsOnDifferent
 	_, err = bs.build.recPool.AddReceipt(recB2, B.Header)
 	bs.Require().NoError(err)
 
-	_, err = bs.build.BuildOn(B.ID(), bs.setter)
+	_, err = bs.build.BuildOn(B.ID(), bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	expectedReceipts := []*flow.ExecutionReceiptMeta{recA2.Meta(), recB1.Meta(), recB2.Meta()}
 	expectedResults := []*flow.ExecutionResult{&recA2.ExecutionResult, &recB1.ExecutionResult, &recB2.ExecutionResult}
@@ -1302,7 +1321,7 @@ func (bs *BuilderSuite) TestIntegration_DuplicateReceipts() {
 		}
 	}
 
-	_, err := bs.build.BuildOn(B.ID(), bs.setter)
+	_, err := bs.build.BuildOn(B.ID(), bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	expectedReceipts := []*flow.ExecutionReceiptMeta{}
 	expectedResults := []*flow.ExecutionResult{}
@@ -1342,7 +1361,7 @@ func (bs *BuilderSuite) TestIntegration_ResultAlreadyIncorporated() {
 	_, err := bs.build.recPool.AddReceipt(recP_B, bs.blocks[recP_B.ExecutionResult.BlockID].Header)
 	bs.NoError(err)
 
-	_, err = bs.build.BuildOn(A.ID(), bs.setter)
+	_, err = bs.build.BuildOn(A.ID(), bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	expectedReceipts := []*flow.ExecutionReceiptMeta{recP_B.Meta()}
 	expectedResults := []*flow.ExecutionResult{}
@@ -1431,6 +1450,7 @@ func (bs *BuilderSuite) TestIntegration_RepopulateExecutionTreeAtStartup() {
 		bs.blockDB,
 		bs.resultDB,
 		bs.receiptsDB,
+		bs.stateMutator,
 		bs.guarPool,
 		bs.sealPool,
 		recPool,
@@ -1454,7 +1474,7 @@ func (bs *BuilderSuite) TestIntegration_RepopulateExecutionTreeAtStartup() {
 	_, _ = bs.build.recPool.AddReceipt(recB2, B.Header)
 	_, _ = bs.build.recPool.AddReceipt(recC, C.Header)
 
-	_, err = bs.build.BuildOn(C.ID(), bs.setter)
+	_, err = bs.build.BuildOn(C.ID(), bs.setter, bs.sign)
 	bs.Require().NoError(err)
 	expectedReceipts := flow.ExecutionReceiptMetaList{recB1.Meta(), recB2.Meta(), recC.Meta()}
 	expectedResults := flow.ExecutionResultList{&recB1.ExecutionResult, &recB2.ExecutionResult, &recC.ExecutionResult}
diff --git a/module/builder/consensus/config.go b/module/builder/consensus/config.go
index 8c1df13b213..f97350cbdf9 100644
--- a/module/builder/consensus/config.go
+++ b/module/builder/consensus/config.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package consensus
 
 import (
diff --git a/module/chainsync/core_rapid_test.go b/module/chainsync/core_rapid_test.go
index 649fce871d8..2554577caa3 100644
--- a/module/chainsync/core_rapid_test.go
+++ b/module/chainsync/core_rapid_test.go
@@ -25,8 +25,8 @@ func populatedBlockStore(t *rapid.T) []*flow.Header {
 	store := []*flow.Header{unittest.BlockHeaderFixture()}
 	for i := 1; i < NUM_BLOCKS; i++ {
 		// we sample from the store 2/3 times to get deeper trees
-		b := rapid.OneOf(rapid.Just(unittest.BlockHeaderFixture()), rapid.SampledFrom(store), rapid.SampledFrom(store)).Draw(t, "parent").(flow.Header)
-		store = append(store, unittest.BlockHeaderWithParentFixture(&b))
+		b := rapid.OneOf(rapid.Just(unittest.BlockHeaderFixture()), rapid.SampledFrom(store), rapid.SampledFrom(store)).Draw(t, "parent")
+		store = append(store, unittest.BlockHeaderWithParentFixture(b))
 	}
 	return store
 }
@@ -38,8 +38,8 @@ type rapidSync struct {
 	heightRequests map[uint64]bool          // depth 1 pushdown automaton to track height requests
 }
 
-// Init is an action for initializing a rapidSync instance.
-func (r *rapidSync) Init(t *rapid.T) {
+// init is an action for initializing a rapidSync instance.
+func (r *rapidSync) init(t *rapid.T) {
 	var err error
 
 	r.core, err = New(zerolog.New(io.Discard), DefaultConfig(), metrics.NewNoopCollector(), flow.Localnet)
@@ -52,7 +52,7 @@ func (r *rapidSync) Init(t *rapid.T) {
 
 // RequestByID is an action that requests a block by its ID.
 func (r *rapidSync) RequestByID(t *rapid.T) {
-	b := rapid.SampledFrom(r.store).Draw(t, "id_request").(*flow.Header)
+	b := rapid.SampledFrom(r.store).Draw(t, "id_request")
 	r.core.RequestBlock(b.ID(), b.Height)
 	// Re-queueing by ID should always succeed
 	r.idRequests[b.ID()] = true
@@ -62,7 +62,7 @@ func (r *rapidSync) RequestByID(t *rapid.T) {
 
 // RequestByHeight is an action that requests a specific height
 func (r *rapidSync) RequestByHeight(t *rapid.T) {
-	b := rapid.SampledFrom(r.store).Draw(t, "height_request").(*flow.Header)
+	b := rapid.SampledFrom(r.store).Draw(t, "height_request")
 	r.core.RequestHeight(b.Height)
 	// Re-queueing by height should always succeed
 	r.heightRequests[b.Height] = true
@@ -71,8 +71,8 @@ func (r *rapidSync) RequestByHeight(t *rapid.T) {
 // HandleHeight is an action that requests a heights
 // upon receiving an argument beyond a certain tolerance
 func (r *rapidSync) HandleHeight(t *rapid.T) {
-	b := rapid.SampledFrom(r.store).Draw(t, "height_hint_request").(*flow.Header)
-	incr := rapid.IntRange(0, (int)(DefaultConfig().Tolerance)+1).Draw(t, "height increment").(int)
+	b := rapid.SampledFrom(r.store).Draw(t, "height_hint_request")
+	incr := rapid.IntRange(0, (int)(DefaultConfig().Tolerance)+1).Draw(t, "height increment")
 	requestHeight := b.Height + (uint64)(incr)
 	r.core.HandleHeight(b, requestHeight)
 	// Re-queueing by height should always succeed if beyond tolerance
@@ -85,7 +85,7 @@ func (r *rapidSync) HandleHeight(t *rapid.T) {
 
 // HandleByID is an action that provides a block header to the sync engine
 func (r *rapidSync) HandleByID(t *rapid.T) {
-	b := rapid.SampledFrom(r.store).Draw(t, "id_handling").(*flow.Header)
+	b := rapid.SampledFrom(r.store).Draw(t, "id_handling")
 	success := r.core.HandleBlock(b)
 	assert.True(t, success || r.idRequests[b.ID()] == false)
 
@@ -174,7 +174,11 @@ func (r *rapidSync) Check(t *rapid.T) {
 func TestRapidSync(t *testing.T) {
 	unittest.SkipUnless(t, unittest.TEST_FLAKY, "flaky test")
 
-	rapid.Check(t, rapid.Run(&rapidSync{}))
+	rapid.Check(t, func(t *rapid.T) {
+		sm := new(rapidSync)
+		sm.init(t)
+		t.Repeat(rapid.StateMachineActions(sm))
+	})
 }
 
 // utility functions
diff --git a/module/chunks/chunk_assigner.go b/module/chunks/chunk_assigner.go
index 6491081141b..ad93a6f329d 100644
--- a/module/chunks/chunk_assigner.go
+++ b/module/chunks/chunk_assigner.go
@@ -67,9 +67,12 @@ func (p *ChunkAssigner) Assign(result *flow.ExecutionResult, blockID flow.Identi
 	}
 
 	// Get a list of verifiers at block that is being sealed
-	verifiers, err := p.protocolState.AtBlockID(result.BlockID).Identities(filter.And(filter.HasRole(flow.RoleVerification),
-		filter.HasWeight(true),
-		filter.Not(filter.Ejected)))
+	verifiers, err := p.protocolState.AtBlockID(result.BlockID).Identities(
+		filter.And(
+			filter.HasInitialWeight[flow.Identity](true),
+			filter.HasRole[flow.Identity](flow.RoleVerification),
+			filter.IsValidCurrentEpochParticipant,
+		))
 	if err != nil {
 		return nil, fmt.Errorf("could not get verifiers: %w", err)
 	}
diff --git a/module/component/component_manager_test.go b/module/component/component_manager_test.go
index fc99ca92af3..5fe55ae5460 100644
--- a/module/component/component_manager_test.go
+++ b/module/component/component_manager_test.go
@@ -345,7 +345,7 @@ func StartStateTransition() (func(t func()), func(*rapid.T)) {
 
 	executeTransitions := func(t *rapid.T) {
 		for i := 0; i < len(transitions); i++ {
-			j := rapid.IntRange(0, len(transitions)-i-1).Draw(t, "").(int)
+			j := rapid.IntRange(0, len(transitions)-i-1).Draw(t, "")
 			transitions[i], transitions[j+i] = transitions[j+i], transitions[i]
 			transitions[i]()
 		}
@@ -390,35 +390,34 @@ type ComponentManagerMachine struct {
 	assertErrorThrownMatches func(t *rapid.T, err error, msgAndArgs ...interface{})
 	assertErrorNotThrown     func(t *rapid.T)
 
-	cancelGenerator     *rapid.Generator
+	cancelGenerator     *rapid.Generator[bool]
 	drawStateTransition func(t *rapid.T) *StateTransition
 }
 
-func (c *ComponentManagerMachine) Init(t *rapid.T) {
-	numWorkers := rapid.IntRange(0, 5).Draw(t, "num_workers").(int)
-	pCancel := rapid.Float64Range(0, 100).Draw(t, "p_cancel").(float64)
+func (c *ComponentManagerMachine) init(t *rapid.T) {
+	numWorkers := rapid.IntRange(0, 5).Draw(t, "num_workers")
+	pCancel := rapid.Float64Range(0, 100).Draw(t, "p_cancel")
 
-	c.cancelGenerator = rapid.Float64Range(0, 100).
-		Map(func(n float64) bool {
-			return pCancel == 100 || n < pCancel
-		})
+	c.cancelGenerator = rapid.Map(rapid.Float64Range(0, 100), func(n float64) bool {
+		return pCancel == 100 || n < pCancel
+	})
 
 	c.drawStateTransition = func(t *rapid.T) *StateTransition {
 		st := &StateTransition{}
 
 		if !c.canceled {
-			st.cancel = c.cancelGenerator.Draw(t, "cancel").(bool)
+			st.cancel = c.cancelGenerator.Draw(t, "cancel")
 		}
 
 		for workerId, state := range c.workerStates {
 			if allowedTransitions, ok := WorkerStateTransitions[state]; ok {
 				label := fmt.Sprintf("worker_transition_%v", workerId)
 				st.workerIDs = append(st.workerIDs, workerId)
-				st.workerTransitions = append(st.workerTransitions, rapid.SampledFrom(allowedTransitions).Draw(t, label).(WorkerStateTransition))
+				st.workerTransitions = append(st.workerTransitions, rapid.SampledFrom(allowedTransitions).Draw(t, label))
 			}
 		}
 
-		return rapid.Just(st).Draw(t, "state_transition").(*StateTransition)
+		return rapid.Just(st).Draw(t, "state_transition")
 	}
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -625,7 +624,11 @@ func (c *ComponentManagerMachine) Check(t *rapid.T) {
 func TestComponentManager(t *testing.T) {
 	unittest.SkipUnless(t, unittest.TEST_LONG_RUNNING, "skip because this test takes too long")
 
-	rapid.Check(t, rapid.Run(&ComponentManagerMachine{}))
+	rapid.Check(t, func(t *rapid.T) {
+		sm := new(ComponentManagerMachine)
+		sm.init(t)
+		t.Repeat(rapid.StateMachineActions(sm))
+	})
 }
 
 func TestComponentManagerShutdown(t *testing.T) {
diff --git a/module/dkg.go b/module/dkg.go
index 0f6a83cc9a8..23d783037e0 100644
--- a/module/dkg.go
+++ b/module/dkg.go
@@ -82,5 +82,5 @@ type DKGController interface {
 type DKGControllerFactory interface {
 
 	// Create instantiates a new DKGController.
-	Create(dkgInstanceID string, participants flow.IdentityList, seed []byte) (DKGController, error)
+	Create(dkgInstanceID string, participants flow.IdentitySkeletonList, seed []byte) (DKGController, error)
 }
diff --git a/module/dkg/broker.go b/module/dkg/broker.go
index 62458613a1b..e4fe3f4cad3 100644
--- a/module/dkg/broker.go
+++ b/module/dkg/broker.go
@@ -59,7 +59,7 @@ type Broker struct {
 	log                       zerolog.Logger
 	unit                      *engine.Unit
 	dkgInstanceID             string                            // unique identifier of the current dkg run (prevent replay attacks)
-	committee                 flow.IdentityList                 // identities of DKG members
+	committee                 flow.IdentitySkeletonList         // identities of DKG members
 	me                        module.Local                      // used for signing broadcast messages
 	myIndex                   int                               // index of this instance in the committee
 	dkgContractClients        []module.DKGContractClient        // array of clients to communicate with the DKG smart contract in priority order for fallbacks during retries
@@ -84,7 +84,7 @@ var _ module.DKGBroker = (*Broker)(nil)
 func NewBroker(
 	log zerolog.Logger,
 	dkgInstanceID string,
-	committee flow.IdentityList,
+	committee flow.IdentitySkeletonList,
 	me module.Local,
 	myIndex int,
 	dkgContractClients []module.DKGContractClient,
@@ -345,7 +345,7 @@ func (b *Broker) Poll(referenceBlock flow.Identifier) error {
 			continue
 		}
 		if !ok {
-			b.log.Error().Msg("invalid signature on broadcast dkg message")
+			b.log.Error().Err(err).Msg("invalid signature on broadcast dkg message")
 			continue
 		}
 		b.log.Debug().Msgf("forwarding broadcast message to controller")
@@ -470,7 +470,7 @@ func (b *Broker) prepareBroadcastMessage(data []byte) (messages.BroadcastDKGMess
 func (b *Broker) verifyBroadcastMessage(bcastMsg messages.BroadcastDKGMessage) (bool, error) {
 	err := b.hasValidDKGInstanceID(bcastMsg.DKGMessage)
 	if err != nil {
-		return false, err
+		return false, fmt.Errorf("invalid dkg instance: %w", err)
 	}
 	origin := b.committee[bcastMsg.CommitteeMemberIndex]
 	signData := fingerprint.Fingerprint(bcastMsg.DKGMessage)
diff --git a/module/dkg/broker_test.go b/module/dkg/broker_test.go
index 85b744a913d..95d517e5e01 100644
--- a/module/dkg/broker_test.go
+++ b/module/dkg/broker_test.go
@@ -27,12 +27,12 @@ var (
 	dkgInstanceID = "flow-testnet-42"     // dkg instance identifier
 )
 
-func initCommittee(n int) (identities flow.IdentityList, locals []module.Local) {
+func initCommittee(n int) (identities flow.IdentitySkeletonList, locals []module.Local) {
 	privateStakingKeys := unittest.StakingKeys(n)
 	for i, key := range privateStakingKeys {
 		id := unittest.IdentityFixture(unittest.WithStakingPubKey(key.PublicKey()))
-		identities = append(identities, id)
-		local, _ := local.New(id, privateStakingKeys[i])
+		identities = append(identities, &id.IdentitySkeleton)
+		local, _ := local.New(id.IdentitySkeleton, privateStakingKeys[i])
 		locals = append(locals, local)
 	}
 	return identities, locals
diff --git a/module/dkg/controller_factory.go b/module/dkg/controller_factory.go
index b1e01b8e592..5b3a015c95b 100644
--- a/module/dkg/controller_factory.go
+++ b/module/dkg/controller_factory.go
@@ -44,7 +44,7 @@ func NewControllerFactory(
 // is capable of communicating with other nodes.
 func (f *ControllerFactory) Create(
 	dkgInstanceID string,
-	participants flow.IdentityList,
+	participants flow.IdentitySkeletonList,
 	seed []byte) (module.DKGController, error) {
 
 	myIndex, ok := participants.GetIndex(f.me.NodeID())
diff --git a/module/epochs/epoch_config.go b/module/epochs/epoch_config.go
index 6e6c350e70d..67de2ae6837 100644
--- a/module/epochs/epoch_config.go
+++ b/module/epochs/epoch_config.go
@@ -3,8 +3,8 @@ package epochs
 import (
 	"github.com/onflow/cadence"
 	jsoncdc "github.com/onflow/cadence/encoding/json"
-	"github.com/onflow/crypto"
 
+	"github.com/onflow/flow-go/model/encodable"
 	"github.com/onflow/flow-go/model/flow"
 )
 
@@ -22,7 +22,7 @@ type EpochConfig struct {
 	RandomSource                 cadence.String
 	CollectorClusters            flow.AssignmentList
 	ClusterQCs                   []*flow.QuorumCertificate
-	DKGPubKeys                   []crypto.PublicKey
+	DKGPubKeys                   []encodable.RandomBeaconPubKey
 }
 
 // DefaultEpochConfig returns an EpochConfig with default values used for
diff --git a/module/epochs/qc_voter_test.go b/module/epochs/qc_voter_test.go
index 47a54483200..b8a16641207 100644
--- a/module/epochs/qc_voter_test.go
+++ b/module/epochs/qc_voter_test.go
@@ -75,8 +75,8 @@ func (suite *Suite) SetupTest() {
 	})
 
 	var err error
-	assignments := unittest.ClusterAssignment(2, suite.nodes)
-	suite.clustering, err = factory.NewClusterList(assignments, suite.nodes)
+	assignments := unittest.ClusterAssignment(2, suite.nodes.ToSkeleton())
+	suite.clustering, err = factory.NewClusterList(assignments, suite.nodes.ToSkeleton())
 	suite.Require().NoError(err)
 
 	suite.epoch.On("Counter").Return(suite.counter, nil)
diff --git a/module/execution/registers_async.go b/module/execution/registers_async.go
index 37043704c52..13f507bb6c9 100644
--- a/module/execution/registers_async.go
+++ b/module/execution/registers_async.go
@@ -6,23 +6,26 @@ import (
 	"go.uber.org/atomic"
 
 	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/state_synchronization/indexer"
 	"github.com/onflow/flow-go/storage"
 )
 
-// RegistersAsyncStore has the same basic structure as access/backend.ScriptExecutor
-// TODO: use this implementation in the `scripts.ScriptExecutor` passed into the AccessAPI
+// RegistersAsyncStore wraps an underlying register store so it can be used before the index is
+// initialized.
 type RegistersAsyncStore struct {
-	registerIndex atomic.Pointer[storage.RegisterIndex]
+	registerIndex *atomic.Pointer[storage.RegisterIndex]
 }
 
 func NewRegistersAsyncStore() *RegistersAsyncStore {
-	return &RegistersAsyncStore{atomic.Pointer[storage.RegisterIndex]{}}
+	return &RegistersAsyncStore{
+		registerIndex: atomic.NewPointer[storage.RegisterIndex](nil),
+	}
 }
 
-// InitDataAvailable initializes the underlying storage.RegisterIndex
-// This method can be called at any time after the RegistersAsyncStore object is created and before RegisterValues is called
+// Initialize initializes the underlying storage.RegisterIndex
+// This method can be called at any time after the RegisterStore object is created. and before RegisterValues is called
 // since we can't disambiguate between the underlying store before bootstrapping or just simply being behind sync
-func (r *RegistersAsyncStore) InitDataAvailable(registers storage.RegisterIndex) error {
+func (r *RegistersAsyncStore) Initialize(registers storage.RegisterIndex) error {
 	if r.registerIndex.CompareAndSwap(nil, &registers) {
 		return nil
 	}
@@ -31,16 +34,22 @@ func (r *RegistersAsyncStore) InitDataAvailable(registers storage.RegisterIndex)
 
 // RegisterValues gets the register values from the underlying storage.RegisterIndex
 // Expected errors:
-//   - storage.ErrHeightNotIndexed if the store is still bootstrapping or if the values at the height is not indexed yet
+//   - indexer.ErrIndexNotInitialized if the store is still bootstrapping
+//   - storage.ErrHeightNotIndexed if the values at the height is not indexed yet
 //   - storage.ErrNotFound if the register does not exist at the height
 func (r *RegistersAsyncStore) RegisterValues(ids flow.RegisterIDs, height uint64) ([]flow.RegisterValue, error) {
-	registerStore, isAvailable := r.isDataAvailable(height)
-	if !isAvailable {
+	registerStore, err := r.getRegisterStore()
+	if err != nil {
+		return nil, err
+	}
+
+	if height > registerStore.LatestHeight() || height < registerStore.FirstHeight() {
 		return nil, storage.ErrHeightNotIndexed
 	}
+
 	result := make([]flow.RegisterValue, len(ids))
-	for i, regId := range ids {
-		val, err := registerStore.Get(regId, height)
+	for i, regID := range ids {
+		val, err := registerStore.Get(regID, height)
 		if err != nil {
 			return nil, fmt.Errorf("failed to get register value for id %d: %w", i, err)
 		}
@@ -49,11 +58,11 @@ func (r *RegistersAsyncStore) RegisterValues(ids flow.RegisterIDs, height uint64
 	return result, nil
 }
 
-func (r *RegistersAsyncStore) isDataAvailable(height uint64) (storage.RegisterIndex, bool) {
-	str := r.registerIndex.Load()
-	if str != nil {
-		registerStore := *str
-		return registerStore, height <= registerStore.LatestHeight() && height >= registerStore.FirstHeight()
+func (r *RegistersAsyncStore) getRegisterStore() (storage.RegisterIndex, error) {
+	registerStore := r.registerIndex.Load()
+	if registerStore == nil {
+		return nil, indexer.ErrIndexNotInitialized
 	}
-	return nil, false
+
+	return *registerStore, nil
 }
diff --git a/module/execution/registers_async_test.go b/module/execution/registers_async_test.go
index 0db7b38233a..f4b2cf783d3 100644
--- a/module/execution/registers_async_test.go
+++ b/module/execution/registers_async_test.go
@@ -6,12 +6,13 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/state_synchronization/indexer"
 	"github.com/onflow/flow-go/storage"
 	storagemock "github.com/onflow/flow-go/storage/mock"
 	"github.com/onflow/flow-go/utils/unittest"
 )
 
-func TestInitDataAvailable(t *testing.T) {
+func TestInitialize(t *testing.T) {
 	rootBlockHeight := uint64(1)
 	// test data available on init
 	registerID := unittest.RegisterIDFixture()
@@ -34,7 +35,7 @@ func TestInitDataAvailable(t *testing.T) {
 		registers.On("FirstHeight").Return(firstHeight)
 		registers.On("LatestHeight").Return(latestHeight)
 
-		require.NoError(t, registersAsync.InitDataAvailable(registers))
+		require.NoError(t, registersAsync.Initialize(registers))
 		val1, err := registersAsync.RegisterValues([]flow.RegisterID{registerID}, firstHeight)
 		require.NoError(t, err)
 		require.Equal(t, val1[0], registerValue1)
@@ -49,7 +50,7 @@ func TestInitDataAvailable(t *testing.T) {
 		registers := storagemock.NewRegisterIndex(t)
 		registers.On("LatestHeight").Return(latestHeight)
 
-		require.NoError(t, registersAsync.InitDataAvailable(registers))
+		require.NoError(t, registersAsync.Initialize(registers))
 		_, err := registersAsync.RegisterValues([]flow.RegisterID{registerID}, latestHeight+1)
 		require.ErrorIs(t, err, storage.ErrHeightNotIndexed)
 	})
@@ -61,7 +62,7 @@ func TestInitDataAvailable(t *testing.T) {
 		registers.On("FirstHeight").Return(firstHeight)
 		registers.On("LatestHeight").Return(latestHeight)
 
-		require.NoError(t, registersAsync.InitDataAvailable(registers))
+		require.NoError(t, registersAsync.Initialize(registers))
 		_, err := registersAsync.RegisterValues([]flow.RegisterID{invalidRegisterID}, latestHeight)
 		require.ErrorIs(t, err, storage.ErrNotFound)
 	})
@@ -73,7 +74,7 @@ func TestRegisterValuesDataUnAvailable(t *testing.T) {
 	// registerDB not bootstrapped, correct error returned
 	registerID := unittest.RegisterIDFixture()
 	_, err := registersAsync.RegisterValues([]flow.RegisterID{registerID}, rootBlockHeight)
-	require.ErrorIs(t, err, storage.ErrHeightNotIndexed)
+	require.ErrorIs(t, err, indexer.ErrIndexNotInitialized)
 }
 
 func TestInitDataRepeatedCalls(t *testing.T) {
@@ -81,6 +82,6 @@ func TestInitDataRepeatedCalls(t *testing.T) {
 	registers1 := storagemock.NewRegisterIndex(t)
 	registers2 := storagemock.NewRegisterIndex(t)
 
-	require.NoError(t, registersAsync.InitDataAvailable(registers1))
-	require.Error(t, registersAsync.InitDataAvailable(registers2))
+	require.NoError(t, registersAsync.Initialize(registers1))
+	require.Error(t, registersAsync.Initialize(registers2))
 }
diff --git a/module/execution/scripts.go b/module/execution/scripts.go
index 471fee0c8a4..f7d44e4f58b 100644
--- a/module/execution/scripts.go
+++ b/module/execution/scripts.go
@@ -2,7 +2,6 @@ package execution
 
 import (
 	"context"
-	"errors"
 
 	"github.com/onflow/flow-go/fvm/environment"
 
@@ -18,12 +17,6 @@ import (
 	"github.com/onflow/flow-go/storage"
 )
 
-// ErrDataNotAvailable indicates that the data for a given block was not available
-//
-// This generally indicates a request was made for execution data at a block height that was not
-// not locally indexed
-var ErrDataNotAvailable = errors.New("data for block is not available")
-
 // RegisterAtHeight returns register value for provided register ID at the block height.
 // Even if the register wasn't indexed at the provided height, returns the highest height the register was indexed at.
 // If the register with the ID was not indexed at all return nil value and no error.
@@ -37,7 +30,7 @@ type ScriptExecutor interface {
 	// doesn't successfully execute.
 	// Expected errors:
 	// - storage.ErrNotFound if block or register value at height was not found.
-	// - ErrDataNotAvailable if the data for the block height is not available
+	// - storage.ErrHeightNotIndexed if the data for the block height is not available
 	ExecuteAtBlockHeight(
 		ctx context.Context,
 		script []byte,
@@ -47,7 +40,7 @@ type ScriptExecutor interface {
 
 	// GetAccountAtBlockHeight returns a Flow account by the provided address and block height.
 	// Expected errors:
-	// - ErrDataNotAvailable if the data for the block height is not available
+	// - storage.ErrHeightNotIndexed if the data for the block height is not available
 	GetAccountAtBlockHeight(ctx context.Context, address flow.Address, height uint64) (*flow.Account, error)
 }
 
@@ -102,7 +95,7 @@ func NewScripts(
 // doesn't successfully execute.
 // Expected errors:
 // - Script execution related errors
-// - ErrDataNotAvailable if the data for the block height is not available
+// - storage.ErrHeightNotIndexed if the data for the block height is not available
 func (s *Scripts) ExecuteAtBlockHeight(
 	ctx context.Context,
 	script []byte,
@@ -115,13 +108,16 @@ func (s *Scripts) ExecuteAtBlockHeight(
 		return nil, err
 	}
 
-	return s.executor.ExecuteScript(ctx, script, arguments, header, snap)
+	value, compUsage, err := s.executor.ExecuteScript(ctx, script, arguments, header, snap)
+	// TODO: return compUsage when upstream can handle it
+	_ = compUsage
+	return value, err
 }
 
 // GetAccountAtBlockHeight returns a Flow account by the provided address and block height.
 // Expected errors:
 // - Script execution related errors
-// - ErrDataNotAvailable if the data for the block height is not available
+// - storage.ErrHeightNotIndexed if the data for the block height is not available
 func (s *Scripts) GetAccountAtBlockHeight(ctx context.Context, address flow.Address, height uint64) (*flow.Account, error) {
 	snap, header, err := s.snapshotWithBlock(height)
 	if err != nil {
@@ -140,11 +136,7 @@ func (s *Scripts) snapshotWithBlock(height uint64) (snapshot.StorageSnapshot, *f
 	}
 
 	storageSnapshot := snapshot.NewReadFuncStorageSnapshot(func(ID flow.RegisterID) (flow.RegisterValue, error) {
-		register, err := s.registerAtHeight(ID, height)
-		if errors.Is(err, storage.ErrHeightNotIndexed) {
-			return nil, errors.Join(ErrDataNotAvailable, err)
-		}
-		return register, err
+		return s.registerAtHeight(ID, height)
 	})
 
 	return storageSnapshot, header, nil
diff --git a/module/execution/scripts_test.go b/module/execution/scripts_test.go
index 9088403770f..0b50cd1a59d 100644
--- a/module/execution/scripts_test.go
+++ b/module/execution/scripts_test.go
@@ -156,7 +156,18 @@ func (s *scriptTestSuite) SetupTest() {
 	s.Require().NoError(err)
 	s.registerIndex = pebbleRegisters
 
-	index, err := indexer.New(logger, metrics.NewNoopCollector(), nil, s.registerIndex, headers, nil, nil, func(originID flow.Identifier, entity flow.Entity) {})
+	index, err := indexer.New(
+		logger,
+		metrics.NewNoopCollector(),
+		nil,
+		s.registerIndex,
+		headers,
+		nil,
+		nil,
+		nil,
+		nil,
+		nil,
+	)
 	s.Require().NoError(err)
 
 	scripts, err := NewScripts(
diff --git a/module/executiondatasync/provider/provider.go b/module/executiondatasync/provider/provider.go
index ac5c3fe700d..c67ddb81a76 100644
--- a/module/executiondatasync/provider/provider.go
+++ b/module/executiondatasync/provider/provider.go
@@ -51,6 +51,10 @@ func NewProvider(
 	storage tracker.Storage,
 	opts ...ProviderOption,
 ) *ExecutionDataProvider {
+	if storage == nil {
+		storage = &tracker.NoopStorage{}
+	}
+
 	p := &ExecutionDataProvider{
 		logger:       logger.With().Str("component", "execution_data_provider").Logger(),
 		metrics:      metrics,
diff --git a/module/executiondatasync/tracker/noop.go b/module/executiondatasync/tracker/noop.go
new file mode 100644
index 00000000000..552c1cbf2ca
--- /dev/null
+++ b/module/executiondatasync/tracker/noop.go
@@ -0,0 +1,29 @@
+package tracker
+
+import "github.com/ipfs/go-cid"
+
+type NoopStorage struct{}
+
+var _ Storage = (*NoopStorage)(nil)
+
+func (s *NoopStorage) Update(update UpdateFn) error {
+	return update(func(blockHeight uint64, cids ...cid.Cid) error {
+		return nil
+	})
+}
+
+func (s *NoopStorage) GetFulfilledHeight() (uint64, error) {
+	return 0, nil
+}
+
+func (s *NoopStorage) SetFulfilledHeight(uint64) error {
+	return nil
+}
+
+func (s *NoopStorage) GetPrunedHeight() (uint64, error) {
+	return 0, nil
+}
+
+func (s *NoopStorage) PruneUpToHeight(height uint64) error {
+	return nil
+}
diff --git a/module/executiondatasync/tracker/storage.go b/module/executiondatasync/tracker/storage.go
index ad8ab613c5e..4c47ccad5ca 100644
--- a/module/executiondatasync/tracker/storage.go
+++ b/module/executiondatasync/tracker/storage.go
@@ -189,6 +189,7 @@ func WithPruneCallback(callback PruneCallback) StorageOption {
 }
 
 func OpenStorage(dbPath string, startHeight uint64, logger zerolog.Logger, opts ...StorageOption) (*storage, error) {
+	lg := logger.With().Str("module", "tracker_storage").Logger()
 	db, err := badger.Open(badger.LSMOnlyOptions(dbPath))
 	if err != nil {
 		return nil, fmt.Errorf("could not open tracker db: %w", err)
@@ -197,17 +198,21 @@ func OpenStorage(dbPath string, startHeight uint64, logger zerolog.Logger, opts
 	storage := &storage{
 		db:            db,
 		pruneCallback: func(c cid.Cid) error { return nil },
-		logger:        logger.With().Str("module", "tracker_storage").Logger(),
+		logger:        lg,
 	}
 
 	for _, opt := range opts {
 		opt(storage)
 	}
 
+	lg.Info().Msgf("initialize storage with start height: %d", startHeight)
+
 	if err := storage.init(startHeight); err != nil {
 		return nil, fmt.Errorf("failed to initialize storage: %w", err)
 	}
 
+	lg.Info().Msgf("storage initialized")
+
 	return storage, nil
 }
 
@@ -224,10 +229,12 @@ func (s *storage) init(startHeight uint64) error {
 			)
 		}
 
+		s.logger.Info().Msgf("prune from height %v up to height %d", fulfilledHeight, prunedHeight)
 		// replay pruning in case it was interrupted during previous shutdown
 		if err := s.PruneUpToHeight(prunedHeight); err != nil {
 			return fmt.Errorf("failed to replay pruning: %w", err)
 		}
+		s.logger.Info().Msgf("finished pruning")
 	} else if errors.Is(fulfilledHeightErr, badger.ErrKeyNotFound) && errors.Is(prunedHeightErr, badger.ErrKeyNotFound) {
 		// db is empty, we need to bootstrap it
 		if err := s.bootstrap(startHeight); err != nil {
diff --git a/module/finalizer.go b/module/finalizer.go
index 274ef9b853a..8f6a1120f02 100644
--- a/module/finalizer.go
+++ b/module/finalizer.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package module
 
 import (
diff --git a/module/finalizer/consensus/finalizer.go b/module/finalizer/consensus/finalizer.go
index b5fd97de564..6bf8bfdf2dd 100644
--- a/module/finalizer/consensus/finalizer.go
+++ b/module/finalizer/consensus/finalizer.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package consensus
 
 import (
diff --git a/module/id/filtered_provider.go b/module/id/filtered_provider.go
index f3703f0d9ff..7b98c14be06 100644
--- a/module/id/filtered_provider.go
+++ b/module/id/filtered_provider.go
@@ -8,11 +8,11 @@ import (
 // IdentityFilterIdentifierProvider implements an IdentifierProvider which provides the identifiers
 // resulting from applying a filter to an IdentityProvider.
 type IdentityFilterIdentifierProvider struct {
-	filter           flow.IdentityFilter
+	filter           flow.IdentityFilter[flow.Identity]
 	identityProvider module.IdentityProvider
 }
 
-func NewIdentityFilterIdentifierProvider(filter flow.IdentityFilter, identityProvider module.IdentityProvider) *IdentityFilterIdentifierProvider {
+func NewIdentityFilterIdentifierProvider(filter flow.IdentityFilter[flow.Identity], identityProvider module.IdentityProvider) *IdentityFilterIdentifierProvider {
 	return &IdentityFilterIdentifierProvider{filter, identityProvider}
 }
 
diff --git a/module/id/fixed_provider.go b/module/id/fixed_provider.go
index d26adc0f375..e6f3713d47c 100644
--- a/module/id/fixed_provider.go
+++ b/module/id/fixed_provider.go
@@ -34,7 +34,7 @@ func NewFixedIdentityProvider(identities flow.IdentityList) *FixedIdentityProvid
 	return &FixedIdentityProvider{identities}
 }
 
-func (p *FixedIdentityProvider) Identities(filter flow.IdentityFilter) flow.IdentityList {
+func (p *FixedIdentityProvider) Identities(filter flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 	return p.identities.Filter(filter)
 }
 
diff --git a/module/id_provider.go b/module/id_provider.go
index b5544f09bc9..3b84181fce2 100644
--- a/module/id_provider.go
+++ b/module/id_provider.go
@@ -20,7 +20,7 @@ type IdentityProvider interface {
 	// protocol that pass the provided filter. Caution, this includes ejected nodes.
 	// Please check the `Ejected` flag in the identities (or provide a filter for
 	// removing ejected nodes).
-	Identities(flow.IdentityFilter) flow.IdentityList
+	Identities(flow.IdentityFilter[flow.Identity]) flow.IdentityList
 
 	// ByNodeID returns the full identity for the node with the given Identifier,
 	// where Identifier is the way the protocol refers to the node. The function
diff --git a/module/jobqueue/README.md b/module/jobqueue/README.md
index 15562a89703..e36bc060144 100644
--- a/module/jobqueue/README.md
+++ b/module/jobqueue/README.md
@@ -37,7 +37,7 @@ Job consumer provides the `Check` method for users to notify new jobs available.
 
 Once called, job consumer will iterate through each height with the `AtIndex` method. It stops when one of the following condition is true:
 1. no job was found at a index
-2. no more workers to work on them, which is limitted by the config item `maxProcessing`
+2. no more workers to work on them, which is limited by the config item `maxProcessing`
 
 `Check` method is concurrent safe, meaning even if job consumer is notified concurrently about new jobs available, job consumer will check at most once to find new jobs.
 
diff --git a/module/jobqueue/finalized_block_reader_test.go b/module/jobqueue/finalized_block_reader_test.go
index 8349828d272..9427d2ee557 100644
--- a/module/jobqueue/finalized_block_reader_test.go
+++ b/module/jobqueue/finalized_block_reader_test.go
@@ -62,11 +62,15 @@ func withReader(
 		// blocks (i.e., containing guarantees), and Cs are container blocks for their preceding reference block,
 		// Container blocks only contain receipts of their preceding reference blocks. But they do not
 		// hold any guarantees.
-		root, err := s.State.Params().FinalizedRoot()
+		root, err := s.State.Final().Head()
 		require.NoError(t, err)
-		clusterCommittee := participants.Filter(filter.HasRole(flow.RoleCollection))
+		protocolState, err := s.State.Final().ProtocolState()
+		require.NoError(t, err)
+		protocolStateID := protocolState.Entry().ID()
+
+		clusterCommittee := participants.Filter(filter.HasRole[flow.Identity](flow.RoleCollection))
 		sources := unittest.RandomSourcesFixture(10)
-		results := vertestutils.CompleteExecutionReceiptChainFixture(t, root, blockCount/2, sources, vertestutils.WithClusterCommittee(clusterCommittee))
+		results := vertestutils.CompleteExecutionReceiptChainFixture(t, root, protocolStateID, blockCount/2, sources, vertestutils.WithClusterCommittee(clusterCommittee))
 		blocks := vertestutils.ExtendStateWithFinalizedBlocks(t, results, s.State)
 
 		withBlockReader(reader, blocks)
diff --git a/module/local.go b/module/local.go
index 7e3621acc70..cb7ec0b8f2e 100644
--- a/module/local.go
+++ b/module/local.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package module
 
 import (
@@ -24,7 +22,7 @@ type Local interface {
 	Sign([]byte, hash.Hasher) (crypto.Signature, error)
 
 	// NotMeFilter returns handy not-me filter for searching identity
-	NotMeFilter() flow.IdentityFilter
+	NotMeFilter() flow.IdentityFilter[flow.Identity]
 
 	// SignFunc provides a signature oracle that given a message, a hasher, and a signing function, it
 	// generates and returns a signature over the message using the node's private key
diff --git a/module/local/me.go b/module/local/me.go
index 468681d4da9..5cdb4275a6f 100644
--- a/module/local/me.go
+++ b/module/local/me.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package local
 
 import (
@@ -13,11 +11,11 @@ import (
 )
 
 type Local struct {
-	me *flow.Identity
+	me flow.IdentitySkeleton
 	sk crypto.PrivateKey // instance of the node's private staking key
 }
 
-func New(id *flow.Identity, sk crypto.PrivateKey) (*Local, error) {
+func New(id flow.IdentitySkeleton, sk crypto.PrivateKey) (*Local, error) {
 	if !sk.PublicKey().Equals(id.StakingPubKey) {
 		return nil, fmt.Errorf("cannot initialize with mismatching keys, expect %v, but got %v",
 			id.StakingPubKey, sk.PublicKey())
@@ -42,8 +40,8 @@ func (l *Local) Sign(msg []byte, hasher hash.Hasher) (crypto.Signature, error) {
 	return l.sk.Sign(msg, hasher)
 }
 
-func (l *Local) NotMeFilter() flow.IdentityFilter {
-	return filter.Not(filter.HasNodeID(l.NodeID()))
+func (l *Local) NotMeFilter() flow.IdentityFilter[flow.Identity] {
+	return filter.Not(filter.HasNodeID[flow.Identity](l.NodeID()))
 }
 
 // SignFunc provides a signature oracle that given a message, a hasher, and a signing function, it
diff --git a/module/local/me_nokey.go b/module/local/me_nokey.go
index 3027184f1a1..7f697aec1ae 100644
--- a/module/local/me_nokey.go
+++ b/module/local/me_nokey.go
@@ -11,10 +11,10 @@ import (
 )
 
 type LocalNoKey struct {
-	me *flow.Identity
+	me flow.IdentitySkeleton
 }
 
-func NewNoKey(id *flow.Identity) (*LocalNoKey, error) {
+func NewNoKey(id flow.IdentitySkeleton) (*LocalNoKey, error) {
 	l := &LocalNoKey{
 		me: id,
 	}
@@ -33,8 +33,8 @@ func (l *LocalNoKey) Sign(msg []byte, hasher hash.Hasher) (crypto.Signature, err
 	return nil, fmt.Errorf("no private key")
 }
 
-func (l *LocalNoKey) NotMeFilter() flow.IdentityFilter {
-	return filter.Not(filter.HasNodeID(l.NodeID()))
+func (l *LocalNoKey) NotMeFilter() flow.IdentityFilter[flow.Identity] {
+	return filter.Not(filter.HasNodeID[flow.Identity](l.NodeID()))
 }
 
 // SignFunc provides a signature oracle that given a message, a hasher, and a signing function, it
diff --git a/module/local/me_test.go b/module/local/me_test.go
index 42e46ae8c2f..825f1e9aa03 100644
--- a/module/local/me_test.go
+++ b/module/local/me_test.go
@@ -15,7 +15,7 @@ func TestInitializeWithMatchingKey(t *testing.T) {
 	nodeID := unittest.IdentityFixture()
 	nodeID.StakingPubKey = stakingPriv.PublicKey()
 
-	me, err := New(nodeID, stakingPriv)
+	me, err := New(nodeID.IdentitySkeleton, stakingPriv)
 	require.NoError(t, err)
 	require.Equal(t, nodeID.NodeID, me.NodeID())
 }
@@ -29,6 +29,6 @@ func TestInitializeWithMisMatchingKey(t *testing.T) {
 	nodeID := unittest.IdentityFixture()
 	nodeID.StakingPubKey = badPriv.PublicKey()
 
-	_, err := New(nodeID, stakingPriv)
+	_, err := New(nodeID.IdentitySkeleton, stakingPriv)
 	require.Error(t, err)
 }
diff --git a/module/mempool/assignments.go b/module/mempool/assignments.go
index 0c1b934804c..209282e3bd5 100644
--- a/module/mempool/assignments.go
+++ b/module/mempool/assignments.go
@@ -1,4 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
 package mempool
 
 import (
diff --git a/module/mempool/blocks.go b/module/mempool/blocks.go
index a91c65b9f29..0af40ed6976 100644
--- a/module/mempool/blocks.go
+++ b/module/mempool/blocks.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package mempool
 
 import (
diff --git a/module/mempool/chunk_data_packs.go b/module/mempool/chunk_data_packs.go
index 9e04725c905..cc6eb15f0af 100644
--- a/module/mempool/chunk_data_packs.go
+++ b/module/mempool/chunk_data_packs.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package mempool
 
 import (
diff --git a/module/mempool/collections.go b/module/mempool/collections.go
index f09d9b6e5b2..2d6bcee8537 100644
--- a/module/mempool/collections.go
+++ b/module/mempool/collections.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package mempool
 
 import (
diff --git a/module/mempool/execution_tree.go b/module/mempool/execution_tree.go
index 14fa0ff6707..76e46b8d039 100644
--- a/module/mempool/execution_tree.go
+++ b/module/mempool/execution_tree.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package mempool
 
 import (
diff --git a/module/mempool/guarantees.go b/module/mempool/guarantees.go
index a6ff0560a4b..96c557f6c6a 100644
--- a/module/mempool/guarantees.go
+++ b/module/mempool/guarantees.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package mempool
 
 import (
diff --git a/module/mempool/incorporated_result_seals.go b/module/mempool/incorporated_result_seals.go
index 50e800bacac..9034d7dab79 100644
--- a/module/mempool/incorporated_result_seals.go
+++ b/module/mempool/incorporated_result_seals.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package mempool
 
 import (
diff --git a/module/mempool/queue/heroStore.go b/module/mempool/queue/heroStore.go
index 03c478e1893..11a2f93405f 100644
--- a/module/mempool/queue/heroStore.go
+++ b/module/mempool/queue/heroStore.go
@@ -5,39 +5,36 @@ import (
 
 	"github.com/onflow/flow-go/engine"
 	"github.com/onflow/flow-go/module"
-	"github.com/onflow/flow-go/module/mempool/queue/internal"
 )
 
-type HeroStoreConfig struct {
-	SizeLimit uint32
-	Collector module.HeroCacheMetrics
-}
-
-type HeroStoreConfigOption func(builder *HeroStoreConfig)
+var defaultMsgEntityFactoryFunc = NewMessageEntity
 
-func WithHeroStoreSizeLimit(sizeLimit uint32) HeroStoreConfigOption {
-	return func(builder *HeroStoreConfig) {
-		builder.SizeLimit = sizeLimit
-	}
-}
+type HeroStoreOption func(heroStore *HeroStore)
 
-func WithHeroStoreCollector(collector module.HeroCacheMetrics) HeroStoreConfigOption {
-	return func(builder *HeroStoreConfig) {
-		builder.Collector = collector
+func WithMessageEntityFactory(f func(message *engine.Message) MessageEntity) HeroStoreOption {
+	return func(heroStore *HeroStore) {
+		heroStore.msgEntityFactory = f
 	}
 }
 
 // HeroStore is a FIFO (first-in-first-out) size-bound queue for maintaining engine.Message types.
 // It is based on HeroQueue.
 type HeroStore struct {
-	q *HeroQueue
+	q                *HeroQueue
+	msgEntityFactory func(message *engine.Message) MessageEntity
 }
 
-func NewHeroStore(sizeLimit uint32, logger zerolog.Logger, collector module.HeroCacheMetrics,
-) *HeroStore {
-	return &HeroStore{
-		q: NewHeroQueue(sizeLimit, logger, collector),
+func NewHeroStore(sizeLimit uint32, logger zerolog.Logger, collector module.HeroCacheMetrics, opts ...HeroStoreOption) *HeroStore {
+	h := &HeroStore{
+		q:                NewHeroQueue(sizeLimit, logger, collector),
+		msgEntityFactory: defaultMsgEntityFactoryFunc,
 	}
+
+	for _, opt := range opts {
+		opt(h)
+	}
+
+	return h
 }
 
 // Put enqueues the message into the message store.
@@ -45,7 +42,7 @@ func NewHeroStore(sizeLimit uint32, logger zerolog.Logger, collector module.Hero
 // Boolean returned variable determines whether enqueuing was successful, i.e.,
 // put may be dropped if queue is full or already exists.
 func (c *HeroStore) Put(message *engine.Message) bool {
-	return c.q.Push(internal.NewMessageEntity(message))
+	return c.q.Push(c.msgEntityFactory(message))
 }
 
 // Get pops the queue, i.e., it returns the head of queue, and updates the head to the next element.
@@ -56,6 +53,6 @@ func (c *HeroStore) Get() (*engine.Message, bool) {
 		return nil, false
 	}
 
-	msg := head.(internal.MessageEntity).Msg
+	msg := head.(MessageEntity).Msg
 	return &msg, true
 }
diff --git a/module/mempool/queue/internal/messageEntity.go b/module/mempool/queue/internal/messageEntity.go
deleted file mode 100644
index 295da05da49..00000000000
--- a/module/mempool/queue/internal/messageEntity.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package internal
-
-import (
-	"github.com/onflow/flow-go/engine"
-	"github.com/onflow/flow-go/model/flow"
-)
-
-// MessageEntity is an internal data structure for storing messages in HeroQueue.
-type MessageEntity struct {
-	Msg engine.Message
-	id  flow.Identifier
-}
-
-var _ flow.Entity = (*MessageEntity)(nil)
-
-func NewMessageEntity(msg *engine.Message) MessageEntity {
-	id := identifierOfMessage(msg)
-	return MessageEntity{
-		Msg: *msg,
-		id:  id,
-	}
-}
-
-func (m MessageEntity) ID() flow.Identifier {
-	return m.id
-}
-
-func (m MessageEntity) Checksum() flow.Identifier {
-	return m.id
-}
-
-func identifierOfMessage(msg *engine.Message) flow.Identifier {
-	return flow.MakeID(msg)
-}
diff --git a/module/mempool/queue/messageEntity.go b/module/mempool/queue/messageEntity.go
new file mode 100644
index 00000000000..69ceb76656f
--- /dev/null
+++ b/module/mempool/queue/messageEntity.go
@@ -0,0 +1,53 @@
+package queue
+
+import (
+	"time"
+
+	"github.com/onflow/flow-go/engine"
+	"github.com/onflow/flow-go/model/flow"
+)
+
+// MessageEntity is a data structure for storing messages in HeroQueue.
+type MessageEntity struct {
+	Msg engine.Message
+	id  flow.Identifier
+}
+
+var _ flow.Entity = (*MessageEntity)(nil)
+
+// NewMessageEntity returns a new message entity.
+func NewMessageEntity(msg *engine.Message) MessageEntity {
+	id := identifierOfMessage(msg)
+	return MessageEntity{
+		Msg: *msg,
+		id:  id,
+	}
+}
+
+// NewMessageEntityWithNonce creates a new message entity adding a nonce to the id calculation.
+// This prevents unexpected de-duplication of otherwise identical messages stored in the queue.
+func NewMessageEntityWithNonce(msg *engine.Message) MessageEntity {
+	id := identifierOfMessage(struct {
+		*engine.Message
+		Nonce uint64
+	}{
+		msg,
+		uint64(time.Now().UnixNano()),
+	})
+	return MessageEntity{
+		Msg: *msg,
+		id:  id,
+	}
+}
+
+func (m MessageEntity) ID() flow.Identifier {
+	return m.id
+}
+
+func (m MessageEntity) Checksum() flow.Identifier {
+	return m.id
+}
+
+func identifierOfMessage(msg interface{}) flow.Identifier {
+	return flow.MakeID(msg)
+}
diff --git a/module/mempool/queue/internal/rpcInspectionRequest_test.go b/module/mempool/queue/rpcInspectionRequest_test.go
similarity index 87%
rename from module/mempool/queue/internal/rpcInspectionRequest_test.go
rename to module/mempool/queue/rpcInspectionRequest_test.go
index 39060a5a73f..bad1ce93c62 100644
--- a/module/mempool/queue/internal/rpcInspectionRequest_test.go
+++ b/module/mempool/queue/rpcInspectionRequest_test.go
@@ -1,4 +1,4 @@
-package internal_test
+package queue_test
 
 import (
 	"testing"
@@ -7,7 +7,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/engine"
-	"github.com/onflow/flow-go/module/mempool/queue/internal"
+	"github.com/onflow/flow-go/module/mempool/queue"
 	"github.com/onflow/flow-go/network/p2p/inspector/validation"
 	p2ptest "github.com/onflow/flow-go/network/p2p/test"
 	"github.com/onflow/flow-go/utils/unittest"
@@ -46,9 +46,9 @@ func TestMessageEntity_InspectRPCRequest_ID(t *testing.T) {
 	req3.Nonce = req1.Nonce
 
 	// now convert to MessageEntity
-	entity1 := internal.NewMessageEntity(&engine.Message{Payload: req1})
-	entity2 := internal.NewMessageEntity(&engine.Message{Payload: req2})
-	entity3 := internal.NewMessageEntity(&engine.Message{Payload: req3})
+	entity1 := queue.NewMessageEntity(&engine.Message{Payload: req1})
+	entity2 := queue.NewMessageEntity(&engine.Message{Payload: req2})
+	entity3 := queue.NewMessageEntity(&engine.Message{Payload: req3})
 
 	// as the Nonce and PeerID fields are the same, the ID of the MessageEntity should be the same accross all three
 	// in other words, the RPC field should not affect the ID
diff --git a/module/mempool/stdmap/backend.go b/module/mempool/stdmap/backend.go
index f7dfc7de323..73d1b18dd0f 100644
--- a/module/mempool/stdmap/backend.go
+++ b/module/mempool/stdmap/backend.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap
 
 import (
diff --git a/module/mempool/stdmap/backend_test.go b/module/mempool/stdmap/backend_test.go
index 5a83d3e385f..47bce3fc798 100644
--- a/module/mempool/stdmap/backend_test.go
+++ b/module/mempool/stdmap/backend_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap_test
 
 import (
diff --git a/module/mempool/stdmap/blockbycollections.go b/module/mempool/stdmap/blockbycollections.go
index 3b710ad6488..3b4e66d9156 100644
--- a/module/mempool/stdmap/blockbycollections.go
+++ b/module/mempool/stdmap/blockbycollections.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap
 
 import (
diff --git a/module/mempool/stdmap/blocks.go b/module/mempool/stdmap/blocks.go
index cb48877a861..6f76ae230a7 100644
--- a/module/mempool/stdmap/blocks.go
+++ b/module/mempool/stdmap/blocks.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap
 
 import (
diff --git a/module/mempool/stdmap/chunk_data_packs.go b/module/mempool/stdmap/chunk_data_packs.go
index 2a2ba5753e8..d2b2503942b 100644
--- a/module/mempool/stdmap/chunk_data_packs.go
+++ b/module/mempool/stdmap/chunk_data_packs.go
@@ -1,4 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
 package stdmap
 
 import (
diff --git a/module/mempool/stdmap/collections.go b/module/mempool/stdmap/collections.go
index 51b91739191..ef217c77f12 100644
--- a/module/mempool/stdmap/collections.go
+++ b/module/mempool/stdmap/collections.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap
 
 import (
diff --git a/module/mempool/stdmap/eject.go b/module/mempool/stdmap/eject.go
index 7cea5214b3d..9dd825fd8a4 100644
--- a/module/mempool/stdmap/eject.go
+++ b/module/mempool/stdmap/eject.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap
 
 import (
diff --git a/module/mempool/stdmap/guarantees.go b/module/mempool/stdmap/guarantees.go
index f8e2dbefb8d..5204d567bb2 100644
--- a/module/mempool/stdmap/guarantees.go
+++ b/module/mempool/stdmap/guarantees.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap
 
 import (
diff --git a/module/mempool/stdmap/guarantees_test.go b/module/mempool/stdmap/guarantees_test.go
index 7bc356dd21b..22beebdd72e 100644
--- a/module/mempool/stdmap/guarantees_test.go
+++ b/module/mempool/stdmap/guarantees_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap_test
 
 import (
diff --git a/module/mempool/stdmap/incorporated_result_seals_test.go b/module/mempool/stdmap/incorporated_result_seals_test.go
index fb1a4b450b9..2f83fb0c128 100644
--- a/module/mempool/stdmap/incorporated_result_seals_test.go
+++ b/module/mempool/stdmap/incorporated_result_seals_test.go
@@ -18,14 +18,14 @@ type icrSealsMachine struct {
 	state []*flow.IncorporatedResultSeal // model of the icrSeals
 }
 
-// Init is an action for initializing a icrSeals instance.
-func (m *icrSealsMachine) Init(t *rapid.T) {
+// init is an action for initializing a icrSeals instance.
+func (m *icrSealsMachine) init(t *rapid.T) {
 	m.icrs = NewIncorporatedResultSeals(1000)
 }
 
 // Add is a conditional action which adds an item to the icrSeals.
 func (m *icrSealsMachine) Add(t *rapid.T) {
-	i := rapid.Uint64().Draw(t, "i").(uint64)
+	i := rapid.Uint64().Draw(t, "i")
 
 	seal := unittest.IncorporatedResultSeal.Fixture(func(s *flow.IncorporatedResultSeal) {
 		s.Header.Height = i
@@ -49,7 +49,7 @@ func (m *icrSealsMachine) Add(t *rapid.T) {
 
 // Prune is a Conditional action that removes elements of height strictly lower than its argument
 func (m *icrSealsMachine) PruneUpToHeight(t *rapid.T) {
-	h := rapid.Uint64().Draw(t, "h").(uint64)
+	h := rapid.Uint64().Draw(t, "h")
 	err := m.icrs.PruneUpToHeight(h)
 	if h >= m.icrs.lowestHeight {
 		require.NoError(t, err)
@@ -72,7 +72,7 @@ func (m *icrSealsMachine) Get(t *rapid.T) {
 	if n == 0 {
 		return
 	}
-	i := rapid.IntRange(0, n-1).Draw(t, "i").(int)
+	i := rapid.IntRange(0, n-1).Draw(t, "i")
 
 	s := m.state[i]
 	actual, ok := m.icrs.ByID(s.ID())
@@ -89,7 +89,7 @@ func (m *icrSealsMachine) GetUnknown(t *rapid.T) {
 	if n == 0 {
 		return
 	}
-	i := rapid.IntRange(0, n-1).Draw(t, "i").(int)
+	i := rapid.IntRange(0, n-1).Draw(t, "i")
 	seal := unittest.IncorporatedResultSeal.Fixture(func(s *flow.IncorporatedResultSeal) {
 		s.Header.Height = uint64(i)
 	})
@@ -117,7 +117,7 @@ func (m *icrSealsMachine) Remove(t *rapid.T) {
 	if n == 0 {
 		return
 	}
-	i := rapid.IntRange(0, n-1).Draw(t, "i").(int)
+	i := rapid.IntRange(0, n-1).Draw(t, "i")
 
 	s := m.state[i]
 	ok := m.icrs.Remove(s.ID())
@@ -137,7 +137,7 @@ func (m *icrSealsMachine) RemoveUnknown(t *rapid.T) {
 	if n == 0 {
 		return
 	}
-	i := rapid.IntRange(0, n-1).Draw(t, "i").(int)
+	i := rapid.IntRange(0, n-1).Draw(t, "i")
 	seal := unittest.IncorporatedResultSeal.Fixture(func(s *flow.IncorporatedResultSeal) {
 		s.Header.Height = uint64(i)
 	})
@@ -168,7 +168,11 @@ func (m *icrSealsMachine) Check(t *rapid.T) {
 
 // Run the icrSeals state machine and test it against its model
 func TestIcrs(t *testing.T) {
-	rapid.Check(t, rapid.Run(&icrSealsMachine{}))
+	rapid.Check(t, func(t *rapid.T) {
+		sm := new(icrSealsMachine)
+		sm.init(t)
+		t.Repeat(rapid.StateMachineActions(sm))
+	})
 }
 
 func TestIncorporatedResultSeals(t *testing.T) {
diff --git a/module/mempool/stdmap/options.go b/module/mempool/stdmap/options.go
index a32ca3e7749..3d30da3525c 100644
--- a/module/mempool/stdmap/options.go
+++ b/module/mempool/stdmap/options.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap
 
 import (
diff --git a/module/mempool/stdmap/receipts.go b/module/mempool/stdmap/receipts.go
index 9e416972814..01d2008c5aa 100644
--- a/module/mempool/stdmap/receipts.go
+++ b/module/mempool/stdmap/receipts.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap
 
 import (
diff --git a/module/mempool/stdmap/receipts_test.go b/module/mempool/stdmap/receipts_test.go
index a664126caaf..4439b488cee 100644
--- a/module/mempool/stdmap/receipts_test.go
+++ b/module/mempool/stdmap/receipts_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap_test
 
 import (
diff --git a/module/mempool/stdmap/times.go b/module/mempool/stdmap/times.go
index e5e7c33218f..d1405fa5ee6 100644
--- a/module/mempool/stdmap/times.go
+++ b/module/mempool/stdmap/times.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap
 
 import (
diff --git a/module/mempool/stdmap/times_test.go b/module/mempool/stdmap/times_test.go
index 40ca4b18bae..c04aae63eca 100644
--- a/module/mempool/stdmap/times_test.go
+++ b/module/mempool/stdmap/times_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap_test
 
 import (
diff --git a/module/mempool/stdmap/transaction_timings.go b/module/mempool/stdmap/transaction_timings.go
index 407347304ea..4264ef3cfad 100644
--- a/module/mempool/stdmap/transaction_timings.go
+++ b/module/mempool/stdmap/transaction_timings.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap
 
 import (
diff --git a/module/mempool/stdmap/transaction_timings_test.go b/module/mempool/stdmap/transaction_timings_test.go
index dc2d818b7ef..3ad1fce0aeb 100644
--- a/module/mempool/stdmap/transaction_timings_test.go
+++ b/module/mempool/stdmap/transaction_timings_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap_test
 
 import (
diff --git a/module/mempool/stdmap/transactions.go b/module/mempool/stdmap/transactions.go
index ea59e35b289..c06e9d3dbbf 100644
--- a/module/mempool/stdmap/transactions.go
+++ b/module/mempool/stdmap/transactions.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap
 
 import (
diff --git a/module/mempool/stdmap/transactions_test.go b/module/mempool/stdmap/transactions_test.go
index f16da60d505..b2aefd3544d 100644
--- a/module/mempool/stdmap/transactions_test.go
+++ b/module/mempool/stdmap/transactions_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package stdmap_test
 
 import (
diff --git a/module/mempool/transaction_timings.go b/module/mempool/transaction_timings.go
index f64f07d59d1..8809bfa06f4 100644
--- a/module/mempool/transaction_timings.go
+++ b/module/mempool/transaction_timings.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package mempool
 
 import (
diff --git a/module/mempool/transactions.go b/module/mempool/transactions.go
index a30292e4b73..3c2697a26f7 100644
--- a/module/mempool/transactions.go
+++ b/module/mempool/transactions.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package mempool
 
 import (
diff --git a/module/metrics.go b/module/metrics.go
index 4315d6c017b..4d6fcb22178 100644
--- a/module/metrics.go
+++ b/module/metrics.go
@@ -84,6 +84,17 @@ type GossipSubRpcInspectorMetrics interface {
 	OnIncomingRpcReceived(iHaveCount, iWantCount, graftCount, pruneCount, msgCount int)
 }
 
+// GossipSubScoringRegistryMetrics encapsulates the metrics collectors for collecting metrics related to the Gossipsub scoring registry.
+// GossipSubScoringRegistryMetrics encapsulates various metrics collectors offering insights into penalties and
+// other factors used by the scoring registry to compute the application-specific score. It focuses on tracking internal
+// aspects of the application-specific score, distinguishing itself from GossipSubScoringMetrics.
+type GossipSubScoringRegistryMetrics interface {
+	// DuplicateMessagePenalties tracks the duplicate message penalty for a node.
+	DuplicateMessagePenalties(penalty float64)
+	// DuplicateMessagesCounts tracks the duplicate message count for a node.
+	DuplicateMessagesCounts(count float64)
+}
+
 // LocalGossipSubRouterMetrics encapsulates the metrics collectors for GossipSub router of the local node.
 // It gives a lens into the local GossipSub node's view of the GossipSub protocol.
 // LocalGossipSubRouterMetrics differs from GossipSubRpcInspectorMetrics in that the former tracks the local node's view
@@ -218,6 +229,7 @@ type LibP2PMetrics interface {
 	rcmgr.MetricsReporter
 	LibP2PConnectionMetrics
 	UnicastManagerMetrics
+	GossipSubScoringRegistryMetrics
 }
 
 // GossipSubScoringMetrics encapsulates the metrics collectors for the peer scoring module of GossipSub protocol.
@@ -298,12 +310,17 @@ type GossipSubRpcValidationInspectorMetrics interface {
 	//
 	//	duplicateTopicIds: the total number of duplicate topic ids received by the node on the iHave messages at the end of the async inspection of the RPC.
 	//	duplicateMessageIds: the number of duplicate message ids received by the node on the iHave messages at the end of the async inspection of the RPC.
-	OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds int)
+	//	invalidTopicIds: the number of invalid message ids received by the node on the iHave messages at the end of the async inspection of the RPC.
+	OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds, invalidTopicIds int)
 
 	// OnIHaveDuplicateTopicIdsExceedThreshold tracks the number of times that the async inspection of iHave messages of a single RPC failed due to the total number of duplicate topic ids
 	// received by the node on the iHave messages of that RPC exceeding the threshold, which results in a misbehaviour report.
 	OnIHaveDuplicateTopicIdsExceedThreshold()
 
+	// OnIHaveInvalidTopicIdsExceedThreshold tracks the number of times that the async inspection of iHave messages of a single RPC failed due to the total number of invalid topic ids
+	// received by the node on the iHave messages of that RPC exceeding the threshold, which results in a misbehaviour report.
+	OnIHaveInvalidTopicIdsExceedThreshold()
+
 	// OnIHaveDuplicateMessageIdsExceedThreshold tracks the number of times that the async inspection of iHave messages of a single RPC failed due to the total number of duplicate message ids
 	// received by the node on an iHave message exceeding the threshold, which results in a misbehaviour report.
 	OnIHaveDuplicateMessageIdsExceedThreshold()
@@ -324,6 +341,9 @@ type GossipSubRpcValidationInspectorMetrics interface {
 	// OnInvalidControlMessageNotificationSent tracks the number of times that the async inspection of a control message failed and resulted in dissemination of an invalid control message was sent.
 	OnInvalidControlMessageNotificationSent()
 
+	// OnRpcRejectedFromUnknownSender tracks the number of rpc's rejected from unstaked nodes.
+	OnRpcRejectedFromUnknownSender()
+
 	// OnPublishMessagesInspectionErrorExceedsThreshold tracks the number of times that async inspection of publish messages failed due to the number of errors.
 	OnPublishMessagesInspectionErrorExceedsThreshold()
 
@@ -331,19 +351,29 @@ type GossipSubRpcValidationInspectorMetrics interface {
 	// received by the node on prune messages of the same RPC excesses threshold, which results in a misbehaviour report.
 	OnPruneDuplicateTopicIdsExceedThreshold()
 
+	// OnPruneInvalidTopicIdsExceedThreshold tracks the number of times that the async inspection of prune messages for an RPC failed due to the number of invalid topic ids
+	// received by the node on prune messages of the same RPC excesses threshold, which results in a misbehaviour report.
+	OnPruneInvalidTopicIdsExceedThreshold()
+
 	// OnPruneMessageInspected is called at the end of the async inspection of prune messages of the RPC, regardless of the result of the inspection.
 	// Args:
 	// 	duplicateTopicIds: the number of duplicate topic ids received by the node on the prune messages of the RPC at the end of the async inspection prunes.
-	OnPruneMessageInspected(duplicateTopicIds int)
+	// 	invalidTopicIds: the number of invalid topic ids received by the node on the prune messages at the end of the async inspection of a single RPC.
+	OnPruneMessageInspected(duplicateTopicIds, invalidTopicIds int)
 
 	// OnGraftDuplicateTopicIdsExceedThreshold tracks the number of times that the async inspection of the graft messages of a single RPC failed due to the number of duplicate topic ids
 	// received by the node on graft messages of the same RPC excesses threshold, which results in a misbehaviour report.
 	OnGraftDuplicateTopicIdsExceedThreshold()
 
+	// OnGraftInvalidTopicIdsExceedThreshold tracks the number of times that the async inspection of the graft messages of a single RPC failed due to the number of invalid topic ids
+	// received by the node on graft messages of the same RPC excesses threshold, which results in a misbehaviour report.
+	OnGraftInvalidTopicIdsExceedThreshold()
+
 	// OnGraftMessageInspected is called at the end of the async inspection of graft messages of a single RPC, regardless of the result of the inspection.
 	// Args:
 	// 	duplicateTopicIds: the number of duplicate topic ids received by the node on the graft messages at the end of the async inspection of a single RPC.
-	OnGraftMessageInspected(duplicateTopicIds int)
+	// 	invalidTopicIds: the number of invalid topic ids received by the node on the graft messages at the end of the async inspection of a single RPC.
+	OnGraftMessageInspected(duplicateTopicIds, invalidTopicIds int)
 
 	// OnPublishMessageInspected is called at the end of the async inspection of publish messages of a single RPC, regardless of the result of the inspection.
 	// It tracks the total number of errors detected during the async inspection of the rpc together with their individual breakdown.
@@ -440,7 +470,6 @@ type EngineMetrics interface {
 
 type ComplianceMetrics interface {
 	FinalizedHeight(height uint64)
-	CommittedEpochFinalView(view uint64)
 	EpochTransitionHeight(height uint64)
 	SealedHeight(height uint64)
 	BlockFinalized(*flow.Block)
@@ -718,6 +747,8 @@ type LedgerMetrics interface {
 }
 
 type WALMetrics interface {
+	// ExecutionCheckpointSize reports the size of a checkpoint in bytes
+	ExecutionCheckpointSize(bytes uint64)
 }
 
 type RateLimitedBlockstoreMetrics interface {
@@ -1071,3 +1102,11 @@ type DHTMetrics interface {
 	RoutingTablePeerAdded()
 	RoutingTablePeerRemoved()
 }
+
+type CollectionExecutedMetric interface {
+	CollectionFinalized(light flow.LightCollection)
+	CollectionExecuted(light flow.LightCollection)
+	BlockFinalized(block *flow.Block)
+	ExecutionReceiptReceived(r *flow.ExecutionReceipt)
+	UpdateLastFullBlockHeight(height uint64)
+}
diff --git a/module/metrics/compliance.go b/module/metrics/compliance.go
index 196dc8bdbe5..30f563b7a97 100644
--- a/module/metrics/compliance.go
+++ b/module/metrics/compliance.go
@@ -19,7 +19,6 @@ type ComplianceCollector struct {
 	sealedPayload                   *prometheus.CounterVec
 	lastBlockFinalizedAt            time.Time
 	finalizedBlocksPerSecond        prometheus.Summary
-	committedEpochFinalView         prometheus.Gauge
 	lastEpochTransitionHeight       prometheus.Gauge
 	currentEpochCounter             prometheus.Gauge
 	currentEpochPhase               prometheus.Gauge
@@ -50,13 +49,6 @@ func NewComplianceCollector() *ComplianceCollector {
 			Help:      "the current epoch's phase",
 		}),
 
-		committedEpochFinalView: promauto.NewGauge(prometheus.GaugeOpts{
-			Name:      "committed_epoch_final_view",
-			Namespace: namespaceConsensus,
-			Subsystem: subsystemCompliance,
-			Help:      "the final view of the committed epoch with the greatest counter",
-		}),
-
 		lastEpochTransitionHeight: promauto.NewGauge(prometheus.GaugeOpts{
 			Name:      "last_epoch_transition_height",
 			Namespace: namespaceConsensus,
@@ -191,10 +183,6 @@ func (cc *ComplianceCollector) BlockSealed(block *flow.Block) {
 	cc.sealedPayload.With(prometheus.Labels{LabelResource: ResourceSeal}).Add(float64(len(block.Payload.Seals)))
 }
 
-func (cc *ComplianceCollector) CommittedEpochFinalView(view uint64) {
-	cc.committedEpochFinalView.Set(float64(view))
-}
-
 func (cc *ComplianceCollector) EpochTransitionHeight(height uint64) {
 	// An epoch transition comprises a block in epoch N followed by a block in epoch N+1.
 	// height here refers to the height of the first block in epoch N+1.
diff --git a/module/metrics/execution.go b/module/metrics/execution.go
index 90fc9ea27f4..1eba13d8ace 100644
--- a/module/metrics/execution.go
+++ b/module/metrics/execution.go
@@ -22,6 +22,7 @@ type ExecutionCollector struct {
 	lastFinalizedExecutedBlockHeightGauge   prometheus.Gauge
 	stateStorageDiskTotal                   prometheus.Gauge
 	storageStateCommitment                  prometheus.Gauge
+	checkpointSize                          prometheus.Gauge
 	forestApproxMemorySize                  prometheus.Gauge
 	forestNumberOfTrees                     prometheus.Gauge
 	latestTrieRegCount                      prometheus.Gauge
@@ -650,6 +651,7 @@ func NewExecutionCollector(tracer module.Tracer) *ExecutionCollector {
 			Help:      "the execution state size on disk in bytes",
 		}),
 
+		// TODO: remove
 		storageStateCommitment: promauto.NewGauge(prometheus.GaugeOpts{
 			Namespace: namespaceExecution,
 			Subsystem: subsystemStateStorage,
@@ -657,6 +659,13 @@ func NewExecutionCollector(tracer module.Tracer) *ExecutionCollector {
 			Help:      "the storage size of a state commitment in bytes",
 		}),
 
+		checkpointSize: promauto.NewGauge(prometheus.GaugeOpts{
+			Namespace: namespaceExecution,
+			Subsystem: subsystemStateStorage,
+			Name:      "checkpoint_size_bytes",
+			Help:      "the size of a checkpoint in bytes",
+		}),
+
 		stateSyncActive: promauto.NewGauge(prometheus.GaugeOpts{
 			Namespace: namespaceExecution,
 			Subsystem: subsystemIngestion,
@@ -746,7 +755,7 @@ func (ec *ExecutionCollector) ExecutionBlockCachedPrograms(programs int) {
 	ec.blockCachedPrograms.Set(float64(programs))
 }
 
-// TransactionExecuted reports stats for executing a transaction
+// ExecutionTransactionExecuted reports stats for executing a transaction
 func (ec *ExecutionCollector) ExecutionTransactionExecuted(
 	dur time.Duration,
 	numConflictRetries int,
@@ -760,11 +769,8 @@ func (ec *ExecutionCollector) ExecutionTransactionExecuted(
 	ec.transactionExecutionTime.Observe(float64(dur.Milliseconds()))
 	ec.transactionConflictRetries.Observe(float64(numConflictRetries))
 	ec.transactionComputationUsed.Observe(float64(compUsed))
-	if compUsed > 0 {
-		// normalize so the value should be around 1
-		ec.transactionNormalizedTimePerComputation.Observe(
-			(float64(dur.Milliseconds()) / float64(compUsed)) * flow.EstimatedComputationPerMillisecond)
-	}
+	ec.transactionNormalizedTimePerComputation.Observe(
+		flow.NormalizedExecutionTimePerComputationUnit(dur, compUsed))
 	ec.transactionMemoryEstimate.Observe(float64(memoryUsed))
 	ec.transactionEmittedEvents.Observe(float64(eventCounts))
 	ec.transactionEventSize.Observe(float64(eventSize))
@@ -799,6 +805,11 @@ func (ec *ExecutionCollector) ExecutionStorageStateCommitment(bytes int64) {
 	ec.storageStateCommitment.Set(float64(bytes))
 }
 
+// ExecutionCheckpointSize reports the size of a checkpoint in bytes
+func (ec *ExecutionCollector) ExecutionCheckpointSize(bytes uint64) {
+	ec.checkpointSize.Set(float64(bytes))
+}
+
 // ExecutionLastExecutedBlockHeight reports last executed block height
 func (ec *ExecutionCollector) ExecutionLastExecutedBlockHeight(height uint64) {
 	ec.lastExecutedBlockHeightGauge.Set(float64(height))
diff --git a/module/metrics/gossipsub_rpc_validation_inspector.go b/module/metrics/gossipsub_rpc_validation_inspector.go
index 6b79e8c477d..d8c20fccc81 100644
--- a/module/metrics/gossipsub_rpc_validation_inspector.go
+++ b/module/metrics/gossipsub_rpc_validation_inspector.go
@@ -33,17 +33,23 @@ type GossipSubRpcValidationInspectorMetrics struct {
 
 	// graft inspection
 	graftDuplicateTopicIdsHistogram            prometheus.Histogram
+	graftInvalidTopicIdsHistogram              prometheus.Histogram
 	graftDuplicateTopicIdsExceedThresholdCount prometheus.Counter
+	graftInvalidTopicIdsExceedThresholdCount   prometheus.Counter
 
 	// prune inspection
 	pruneDuplicateTopicIdsHistogram            prometheus.Histogram
+	pruneInvalidTopicIdsHistogram              prometheus.Histogram
 	pruneDuplicateTopicIdsExceedThresholdCount prometheus.Counter
+	pruneInvalidTopicIdsExceedThresholdCount   prometheus.Counter
 
 	// iHave inspection
 	iHaveDuplicateMessageIdHistogram            prometheus.Histogram
 	iHaveDuplicateTopicIdHistogram              prometheus.Histogram
+	iHaveInvalidTopicIdHistogram                prometheus.Histogram
 	iHaveDuplicateMessageIdExceedThresholdCount prometheus.Counter
 	iHaveDuplicateTopicIdExceedThresholdCount   prometheus.Counter
+	iHaveInvalidTopicIdExceedThresholdCount     prometheus.Counter
 
 	// iWant inspection
 	iWantDuplicateMessageIdHistogram            prometheus.Histogram
@@ -55,6 +61,7 @@ type GossipSubRpcValidationInspectorMetrics struct {
 	errActiveClusterIdsNotSetCount             prometheus.Counter
 	errUnstakedPeerInspectionFailedCount       prometheus.Counter
 	invalidControlMessageNotificationSentCount prometheus.Counter
+	unstakedNodeRPCRejectedCount               prometheus.Counter
 
 	// publish messages
 	publishMessageInspectionErrExceedThresholdCount prometheus.Counter
@@ -167,6 +174,14 @@ func NewGossipSubRPCValidationInspectorMetrics(prefix string) *GossipSubRpcValid
 		Help:      "number of duplicate topic ids received from gossipsub protocol during the async inspection of a single RPC",
 	})
 
+	gc.iHaveInvalidTopicIdHistogram = promauto.NewHistogram(prometheus.HistogramOpts{
+		Namespace: namespaceNetwork,
+		Subsystem: subsystemGossip,
+		Buckets:   []float64{1, 100, 1000},
+		Name:      gc.prefix + "rpc_inspection_ihave_invalid_topic_ids_count",
+		Help:      "number of invalid topic ids received from gossipsub protocol during the async inspection of a single RPC",
+	})
+
 	gc.iHaveDuplicateMessageIdExceedThresholdCount = promauto.NewCounter(prometheus.CounterOpts{
 		Namespace: namespaceNetwork,
 		Subsystem: subsystemGossip,
@@ -181,6 +196,13 @@ func NewGossipSubRPCValidationInspectorMetrics(prefix string) *GossipSubRpcValid
 		Help:      "total number of times that the async inspection of iHave messages failed due to the number of duplicate topic ids exceeding the threshold",
 	})
 
+	gc.iHaveInvalidTopicIdExceedThresholdCount = promauto.NewCounter(prometheus.CounterOpts{
+		Namespace: namespaceNetwork,
+		Subsystem: subsystemGossip,
+		Name:      gc.prefix + "rpc_inspection_ihave_invalid_topic_ids_exceed_threshold_total",
+		Help:      "total number of times that the async inspection of iHave messages failed due to the number of invalid topic ids exceeding the threshold",
+	})
+
 	gc.iWantDuplicateMessageIdHistogram = promauto.NewHistogram(prometheus.HistogramOpts{
 		Namespace: namespaceNetwork,
 		Subsystem: subsystemGossip,
@@ -239,6 +261,13 @@ func NewGossipSubRPCValidationInspectorMetrics(prefix string) *GossipSubRpcValid
 		Help:      "number of invalid control message notifications (i.e., misbehavior report) sent due to async inspection of rpcs failure",
 	})
 
+	gc.unstakedNodeRPCRejectedCount = promauto.NewCounter(prometheus.CounterOpts{
+		Namespace: namespaceNetwork,
+		Subsystem: subsystemGossip,
+		Name:      gc.prefix + "unstaked_node_rejection_total",
+		Help:      "number of rpcs rejected from unstaked node",
+	})
+
 	gc.graftDuplicateTopicIdsHistogram = promauto.NewHistogram(prometheus.HistogramOpts{
 		Namespace: namespaceNetwork,
 		Subsystem: subsystemGossip,
@@ -247,6 +276,14 @@ func NewGossipSubRPCValidationInspectorMetrics(prefix string) *GossipSubRpcValid
 		Help:      "number of duplicate topic ids on graft messages of a single RPC during the async inspection, regardless of the result of the inspection",
 	})
 
+	gc.graftInvalidTopicIdsHistogram = promauto.NewHistogram(prometheus.HistogramOpts{
+		Namespace: namespaceNetwork,
+		Subsystem: subsystemGossip,
+		Name:      gc.prefix + "rpc_inspection_graft_invalid_topic_ids_count",
+		Buckets:   []float64{1, 100, 1000},
+		Help:      "number of invalid topic ids on graft messages of a single RPC during the async inspection, regardless of the result of the inspection",
+	})
+
 	gc.graftDuplicateTopicIdsExceedThresholdCount = promauto.NewCounter(prometheus.CounterOpts{
 		Namespace: namespaceNetwork,
 		Subsystem: subsystemGossip,
@@ -254,6 +291,13 @@ func NewGossipSubRPCValidationInspectorMetrics(prefix string) *GossipSubRpcValid
 		Help:      "number of times that the async inspection of graft messages of an rpc failed due to the number of duplicate topic ids exceeding the threshold",
 	})
 
+	gc.graftInvalidTopicIdsExceedThresholdCount = promauto.NewCounter(prometheus.CounterOpts{
+		Namespace: namespaceNetwork,
+		Subsystem: subsystemGossip,
+		Name:      gc.prefix + "rpc_inspection_graft_invalid_topic_ids_exceed_threshold_total",
+		Help:      "number of times that the async inspection of graft messages of an rpc failed due to the number of invalid topic ids exceeding the threshold",
+	})
+
 	gc.pruneDuplicateTopicIdsHistogram = promauto.NewHistogram(prometheus.HistogramOpts{
 		Namespace: namespaceNetwork,
 		Subsystem: subsystemGossip,
@@ -262,6 +306,14 @@ func NewGossipSubRPCValidationInspectorMetrics(prefix string) *GossipSubRpcValid
 		Help:      "number of duplicate topic ids on prune messages of a single RPC during the async inspection, regardless of the result of the inspection",
 	})
 
+	gc.pruneInvalidTopicIdsHistogram = promauto.NewHistogram(prometheus.HistogramOpts{
+		Namespace: namespaceNetwork,
+		Subsystem: subsystemGossip,
+		Buckets:   []float64{1, 100, 1000},
+		Name:      gc.prefix + "rpc_inspection_prune_invalid_topic_ids_count",
+		Help:      "number of invalid topic ids on prune messages of a single RPC during the async inspection, regardless of the result of the inspection",
+	})
+
 	gc.pruneDuplicateTopicIdsExceedThresholdCount = promauto.NewCounter(prometheus.CounterOpts{
 		Namespace: namespaceNetwork,
 		Subsystem: subsystemGossip,
@@ -269,6 +321,13 @@ func NewGossipSubRPCValidationInspectorMetrics(prefix string) *GossipSubRpcValid
 		Help:      "number of times that the async inspection of prune messages failed due to the number of duplicate topic ids exceeding the threshold",
 	})
 
+	gc.pruneInvalidTopicIdsExceedThresholdCount = promauto.NewCounter(prometheus.CounterOpts{
+		Namespace: namespaceNetwork,
+		Subsystem: subsystemGossip,
+		Name:      gc.prefix + "rpc_inspection_prune_invalid_topic_ids_exceed_threshold_total",
+		Help:      "number of times that the async inspection of prune messages failed due to the number of invalid topic ids exceeding the threshold",
+	})
+
 	gc.publishMessageInspectedErrHistogram = promauto.NewHistogram(prometheus.HistogramOpts{
 		Namespace: namespaceNetwork,
 		Subsystem: subsystemGossip,
@@ -323,7 +382,7 @@ func (c *GossipSubRpcValidationInspectorMetrics) AsyncProcessingFinished(duratio
 	c.rpcCtrlMsgAsyncProcessingTimeHistogram.Observe(duration.Seconds())
 }
 
-// OnControlMessageIDsTruncated tracks the number of times a control message was truncated.
+// OnControlMessagesTruncated tracks the number of times a control message was truncated.
 // Args:
 //
 //	messageType: the type of the control message that was truncated
@@ -407,9 +466,11 @@ func (c *GossipSubRpcValidationInspectorMetrics) OnIWantCacheMissMessageIdsExcee
 //
 //	duplicateTopicIds: the total number of duplicate topic ids received by the node on the iHave messages at the end of the async inspection of the RPC.
 //	duplicateMessageIds: the number of duplicate message ids received by the node on the iHave messages at the end of the async inspection of the RPC.
-func (c *GossipSubRpcValidationInspectorMetrics) OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds int) {
+//	invalidTopicIds: the number of invalid message ids received by the node on the iHave messages at the end of the async inspection of the RPC.
+func (c *GossipSubRpcValidationInspectorMetrics) OnIHaveMessagesInspected(duplicateTopicIds, duplicateMessageIds, invalidTopicIds int) {
 	c.iHaveDuplicateTopicIdHistogram.Observe(float64(duplicateTopicIds))
 	c.iHaveDuplicateMessageIdHistogram.Observe(float64(duplicateMessageIds))
+	c.iHaveInvalidTopicIdHistogram.Observe(float64(invalidTopicIds))
 }
 
 // OnIHaveDuplicateTopicIdsExceedThreshold tracks the number of times that the async inspection of iHave messages of a single RPC failed due to the total number of duplicate topic ids
@@ -424,6 +485,12 @@ func (c *GossipSubRpcValidationInspectorMetrics) OnIHaveDuplicateMessageIdsExcee
 	c.iHaveDuplicateMessageIdExceedThresholdCount.Inc()
 }
 
+// OnIHaveInvalidTopicIdsExceedThreshold tracks the number of times that the async inspection of iHave messages of a single RPC failed due to the total number of invalid topic ids
+// received by the node on the iHave messages of that RPC exceeding the threshold, which results in a misbehaviour report.
+func (c *GossipSubRpcValidationInspectorMetrics) OnIHaveInvalidTopicIdsExceedThreshold() {
+	c.iHaveInvalidTopicIdExceedThresholdCount.Inc()
+}
+
 // OnInvalidTopicIdDetectedForControlMessage tracks the number of times that the async inspection of a control message type on a single RPC failed due to an invalid topic id.
 // Args:
 // - messageType: the type of the control message that was truncated.
@@ -449,18 +516,31 @@ func (c *GossipSubRpcValidationInspectorMetrics) OnInvalidControlMessageNotifica
 	c.invalidControlMessageNotificationSentCount.Inc()
 }
 
+// OnRpcRejectedFromUnknownSender tracks the number of rpc's rejected from unstaked nodes.
+func (c *GossipSubRpcValidationInspectorMetrics) OnRpcRejectedFromUnknownSender() {
+	c.unstakedNodeRPCRejectedCount.Inc()
+}
+
 // OnPruneDuplicateTopicIdsExceedThreshold tracks the number of times that the async inspection of prune messages for an RPC failed due to the number of duplicate topic ids
 // received by the node on prune messages of the same RPC excesses threshold, which results in a misbehaviour report.
 func (c *GossipSubRpcValidationInspectorMetrics) OnPruneDuplicateTopicIdsExceedThreshold() {
 	c.pruneDuplicateTopicIdsExceedThresholdCount.Inc()
 }
 
+// OnPruneInvalidTopicIdsExceedThreshold tracks the number of times that the async inspection of prune messages for an RPC failed due to the number of invalid topic ids
+// received by the node on prune messages of the same RPC excesses threshold, which results in a misbehaviour report.
+func (c *GossipSubRpcValidationInspectorMetrics) OnPruneInvalidTopicIdsExceedThreshold() {
+	c.pruneInvalidTopicIdsExceedThresholdCount.Inc()
+}
+
 // OnPruneMessageInspected is called at the end of the async inspection of prune messages of the RPC, regardless of the result of the inspection.
 // Args:
 //
 //	duplicateTopicIds: the number of duplicate topic ids received by the node on the prune messages of the RPC at the end of the async inspection prunes.
-func (c *GossipSubRpcValidationInspectorMetrics) OnPruneMessageInspected(duplicateTopicIds int) {
+//	invalidTopicIds: the number of invalid message ids received by the node on the prune messages at the end of the async inspection of the RPC.
+func (c *GossipSubRpcValidationInspectorMetrics) OnPruneMessageInspected(duplicateTopicIds, invalidTopicIds int) {
 	c.pruneDuplicateTopicIdsHistogram.Observe(float64(duplicateTopicIds))
+	c.pruneInvalidTopicIdsHistogram.Observe(float64(invalidTopicIds))
 }
 
 // OnGraftDuplicateTopicIdsExceedThreshold tracks the number of times that the async inspection of a graft message failed due to the number of duplicate topic ids.
@@ -469,12 +549,20 @@ func (c *GossipSubRpcValidationInspectorMetrics) OnGraftDuplicateTopicIdsExceedT
 	c.graftDuplicateTopicIdsExceedThresholdCount.Inc()
 }
 
+// OnGraftInvalidTopicIdsExceedThreshold tracks the number of times that the async inspection of the graft messages of a single RPC failed due to the number of invalid topic ids
+// received by the node on graft messages of the same RPC excesses threshold, which results in a misbehaviour report.
+func (c *GossipSubRpcValidationInspectorMetrics) OnGraftInvalidTopicIdsExceedThreshold() {
+	c.graftInvalidTopicIdsExceedThresholdCount.Inc()
+}
+
 // OnGraftMessageInspected is called at the end of the async inspection of graft messages of a single RPC, regardless of the result of the inspection.
 // Args:
 //
 //	duplicateTopicIds: the number of duplicate topic ids received by the node on the graft messages at the end of the async inspection of a single RPC.
-func (c *GossipSubRpcValidationInspectorMetrics) OnGraftMessageInspected(duplicateTopicIds int) {
+//	invalidTopicIds: the number of invalid message ids received by the node on the graft messages at the end of the async inspection of the RPC.
+func (c *GossipSubRpcValidationInspectorMetrics) OnGraftMessageInspected(duplicateTopicIds, invalidTopicIds int) {
 	c.graftDuplicateTopicIdsHistogram.Observe(float64(duplicateTopicIds))
+	c.graftInvalidTopicIdsHistogram.Observe(float64(invalidTopicIds))
 }
 
 // OnPublishMessageInspected is called at the end of the async inspection of publish messages of a single RPC, regardless of the result of the inspection.
diff --git a/module/metrics/gossipsub_scoring_registry.go b/module/metrics/gossipsub_scoring_registry.go
new file mode 100644
index 00000000000..111b2279226
--- /dev/null
+++ b/module/metrics/gossipsub_scoring_registry.go
@@ -0,0 +1,53 @@
+package metrics
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+
+	"github.com/onflow/flow-go/module"
+)
+
+// GossipSubScoringRegistryMetrics encapsulates the metrics collectors for collecting metrics related to the Gossipsub scoring registry, offering insights into penalties and
+// other factors used by the scoring registry to compute the application-specific score. It focuses on tracking internal
+// aspects of the application-specific score, distinguishing itself from GossipSubScoringMetrics.
+type GossipSubScoringRegistryMetrics struct {
+	prefix                    string
+	duplicateMessagePenalties prometheus.Histogram
+	duplicateMessageCounts    prometheus.Histogram
+}
+
+var _ module.GossipSubScoringRegistryMetrics = (*GossipSubScoringRegistryMetrics)(nil)
+
+// NewGossipSubScoringRegistryMetrics returns a new *GossipSubScoringRegistryMetrics.
+func NewGossipSubScoringRegistryMetrics(prefix string) *GossipSubScoringRegistryMetrics {
+	gc := &GossipSubScoringRegistryMetrics{prefix: prefix}
+	gc.duplicateMessagePenalties = promauto.NewHistogram(
+		prometheus.HistogramOpts{
+			Namespace: namespaceNetwork,
+			Subsystem: subsystemGossip,
+			Name:      gc.prefix + "gossipsub_scoring_registry_duplicate_message_penalties",
+			Help:      "duplicate message penalty applied to the overall application specific score of a node",
+			Buckets:   []float64{-1, -0.01, -0.001},
+		},
+	)
+	gc.duplicateMessageCounts = promauto.NewHistogram(
+		prometheus.HistogramOpts{
+			Namespace: namespaceNetwork,
+			Subsystem: subsystemGossip,
+			Name:      gc.prefix + "gossipsub_scoring_registry_duplicate_message_counts",
+			Help:      "duplicate message count of a node at the time it is used to compute the duplicate message penalty",
+			Buckets:   []float64{25, 50, 100, 1000},
+		},
+	)
+	return gc
+}
+
+// DuplicateMessagePenalties tracks the duplicate message penalty for a node.
+func (g GossipSubScoringRegistryMetrics) DuplicateMessagePenalties(penalty float64) {
+	g.duplicateMessagePenalties.Observe(penalty)
+}
+
+// DuplicateMessagesCounts tracks the duplicate message count for a node.
+func (g GossipSubScoringRegistryMetrics) DuplicateMessagesCounts(count float64) {
+	g.duplicateMessageCounts.Observe(count)
+}
diff --git a/module/metrics/herocache.go b/module/metrics/herocache.go
index be9dc343488..f6c810deeea 100644
--- a/module/metrics/herocache.go
+++ b/module/metrics/herocache.go
@@ -178,6 +178,14 @@ func GossipSubRPCInspectorQueueMetricFactory(f HeroCacheMetricsFactory, networkT
 	return f(namespaceNetwork, r)
 }
 
+func GossipSubDuplicateMessageTrackerCacheMetricFactory(f HeroCacheMetricsFactory, networkType network.NetworkingType) module.HeroCacheMetrics {
+	r := ResourceNetworkingGossipsubDuplicateMessagesTrackerCache
+	if networkType == network.PublicNetwork {
+		r = PrependPublicPrefix(r)
+	}
+	return f(namespaceNetwork, r)
+}
+
 func GossipSubRPCSentTrackerMetricFactory(f HeroCacheMetricsFactory, networkType network.NetworkingType) module.HeroCacheMetrics {
 	// we don't use the public prefix for the metrics here for sake of backward compatibility of metric name.
 	r := ResourceNetworkingRPCSentTrackerCache
diff --git a/module/metrics/labels.go b/module/metrics/labels.go
index d9c46ff9704..3ca42324a3e 100644
--- a/module/metrics/labels.go
+++ b/module/metrics/labels.go
@@ -60,6 +60,8 @@ const (
 	ResourceQC                                               = "qc"
 	ResourceMyReceipt                                        = "my_receipt"
 	ResourceCollection                                       = "collection"
+	ResourceProtocolState                                    = "protocol_state"
+	ResourceProtocolStateByBlockID                           = "protocol_state_by_block_id"
 	ResourceApproval                                         = "approval"
 	ResourceSeal                                             = "seal"
 	ResourcePendingIncorporatedSeal                          = "pending_incorporated_seal"
@@ -102,6 +104,7 @@ const (
 	ResourceNetworkingRPCSentTrackerCache                    = "gossipsub_rpc_sent_tracker_cache"
 	ResourceNetworkingRPCSentTrackerQueue                    = "gossipsub_rpc_sent_tracker_queue"
 	ResourceNetworkingUnicastDialConfigCache                 = "unicast_dial_config_cache"
+	ResourceNetworkingGossipsubDuplicateMessagesTrackerCache = "gossipsub_duplicate_messages_tracker_cache"
 
 	ResourceFollowerPendingBlocksCache         = "follower_pending_block_cache"           // follower engine
 	ResourceFollowerLoopCertifiedBlocksChannel = "follower_loop_certified_blocks_channel" // follower loop, certified blocks buffered channel
diff --git a/module/metrics/network.go b/module/metrics/network.go
index eae2678a26e..a6eead52e48 100644
--- a/module/metrics/network.go
+++ b/module/metrics/network.go
@@ -27,6 +27,7 @@ type NetworkCollector struct {
 	*GossipSubScoreMetrics
 	*LocalGossipSubRouterMetrics
 	*GossipSubRpcValidationInspectorMetrics
+	*GossipSubScoringRegistryMetrics
 	*AlspMetrics
 	outboundMessageSize          *prometheus.HistogramVec
 	inboundMessageSize           *prometheus.HistogramVec
@@ -77,6 +78,7 @@ func NewNetworkCollector(logger zerolog.Logger, opts ...NetworkCollectorOpt) *Ne
 	nc.LocalGossipSubRouterMetrics = NewGossipSubLocalMeshMetrics(nc.prefix)
 	nc.GossipSubScoreMetrics = NewGossipSubScoreMetrics(nc.prefix)
 	nc.GossipSubRpcValidationInspectorMetrics = NewGossipSubRPCValidationInspectorMetrics(nc.prefix)
+	nc.GossipSubScoringRegistryMetrics = NewGossipSubScoringRegistryMetrics(nc.prefix)
 	nc.AlspMetrics = NewAlspMetrics()
 
 	nc.outboundMessageSize = promauto.NewHistogramVec(
diff --git a/module/metrics/noop.go b/module/metrics/noop.go
index 14ce9bb3994..006bfe4bbe9 100644
--- a/module/metrics/noop.go
+++ b/module/metrics/noop.go
@@ -90,7 +90,6 @@ func (nc *NoopCollector) FinalizedHeight(height uint64)
 func (nc *NoopCollector) SealedHeight(height uint64)                                             {}
 func (nc *NoopCollector) BlockFinalized(*flow.Block)                                             {}
 func (nc *NoopCollector) BlockSealed(*flow.Block)                                                {}
-func (nc *NoopCollector) CommittedEpochFinalView(view uint64)                                    {}
 func (nc *NoopCollector) EpochTransitionHeight(height uint64)                                    {}
 func (nc *NoopCollector) CurrentEpochCounter(counter uint64)                                     {}
 func (nc *NoopCollector) CurrentEpochPhase(phase flow.EpochPhase)                                {}
@@ -162,6 +161,7 @@ func (nc *NoopCollector) StartBlockReceivedToExecuted(blockID flow.Identifier)
 func (nc *NoopCollector) FinishBlockReceivedToExecuted(blockID flow.Identifier)                 {}
 func (nc *NoopCollector) ExecutionComputationUsedPerBlock(computation uint64)                   {}
 func (nc *NoopCollector) ExecutionStorageStateCommitment(bytes int64)                           {}
+func (nc *NoopCollector) ExecutionCheckpointSize(bytes uint64)                                  {}
 func (nc *NoopCollector) ExecutionLastExecutedBlockHeight(height uint64)                        {}
 func (nc *NoopCollector) ExecutionLastFinalizedExecutedBlockHeight(height uint64)               {}
 func (nc *NoopCollector) ExecutionBlockExecuted(_ time.Duration, _ module.ExecutionResultStats) {}
@@ -323,24 +323,29 @@ func (nc *NoopCollector) OnControlMessagesTruncated(messageType p2pmsg.ControlMe
 }
 func (nc *NoopCollector) OnIncomingRpcReceived(iHaveCount, iWantCount, graftCount, pruneCount, msgCount int) {
 }
-func (nc *NoopCollector) AsyncProcessingStarted()                                                 {}
-func (nc *NoopCollector) AsyncProcessingFinished(time.Duration)                                   {}
-func (nc *NoopCollector) OnIWantMessagesInspected(duplicateCount int, cacheMissCount int)         {}
-func (nc *NoopCollector) OnIWantDuplicateMessageIdsExceedThreshold()                              {}
-func (nc *NoopCollector) OnIWantCacheMissMessageIdsExceedThreshold()                              {}
-func (nc *NoopCollector) OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds int) {}
-func (nc *NoopCollector) OnIHaveDuplicateTopicIdsExceedThreshold()                                {}
-func (nc *NoopCollector) OnIHaveDuplicateMessageIdsExceedThreshold()                              {}
+func (nc *NoopCollector) AsyncProcessingStarted()                                         {}
+func (nc *NoopCollector) AsyncProcessingFinished(time.Duration)                           {}
+func (nc *NoopCollector) OnIWantMessagesInspected(duplicateCount int, cacheMissCount int) {}
+func (nc *NoopCollector) OnIWantDuplicateMessageIdsExceedThreshold()                      {}
+func (nc *NoopCollector) OnIWantCacheMissMessageIdsExceedThreshold()                      {}
+func (nc *NoopCollector) OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds, invalidTopicIds int) {
+}
+func (nc *NoopCollector) OnIHaveDuplicateTopicIdsExceedThreshold()   {}
+func (nc *NoopCollector) OnIHaveInvalidTopicIdsExceedThreshold()     {}
+func (nc *NoopCollector) OnIHaveDuplicateMessageIdsExceedThreshold() {}
 func (nc *NoopCollector) OnInvalidTopicIdDetectedForControlMessage(messageType p2pmsg.ControlMessageType) {
 }
-func (nc *NoopCollector) OnActiveClusterIDsNotSetErr()                      {}
-func (nc *NoopCollector) OnUnstakedPeerInspectionFailed()                   {}
-func (nc *NoopCollector) OnInvalidControlMessageNotificationSent()          {}
-func (nc *NoopCollector) OnPublishMessagesInspectionErrorExceedsThreshold() {}
-func (nc *NoopCollector) OnPruneDuplicateTopicIdsExceedThreshold()          {}
-func (nc *NoopCollector) OnPruneMessageInspected(duplicateTopicIds int)     {}
-func (nc *NoopCollector) OnGraftDuplicateTopicIdsExceedThreshold()          {}
-func (nc *NoopCollector) OnGraftMessageInspected(duplicateTopicIds int)     {}
+func (nc *NoopCollector) OnActiveClusterIDsNotSetErr()                                   {}
+func (nc *NoopCollector) OnUnstakedPeerInspectionFailed()                                {}
+func (nc *NoopCollector) OnInvalidControlMessageNotificationSent()                       {}
+func (nc *NoopCollector) OnRpcRejectedFromUnknownSender()                                {}
+func (nc *NoopCollector) OnPublishMessagesInspectionErrorExceedsThreshold()              {}
+func (nc *NoopCollector) OnPruneDuplicateTopicIdsExceedThreshold()                       {}
+func (nc *NoopCollector) OnPruneInvalidTopicIdsExceedThreshold()                         {}
+func (nc *NoopCollector) OnPruneMessageInspected(duplicateTopicIds, invalidTopicIds int) {}
+func (nc *NoopCollector) OnGraftDuplicateTopicIdsExceedThreshold()                       {}
+func (nc *NoopCollector) OnGraftInvalidTopicIdsExceedThreshold()                         {}
+func (nc *NoopCollector) OnGraftMessageInspected(duplicateTopicIds, invalidTopicIds int) {}
 func (nc *NoopCollector) OnPublishMessageInspected(totalErrCount int, invalidTopicIdsCount int, invalidSubscriptionsCount int, invalidSendersCount int) {
 }
 
@@ -356,3 +361,16 @@ var _ module.ExecutionStateIndexerMetrics = (*NoopCollector)(nil)
 func (nc *NoopCollector) BlockIndexed(uint64, time.Duration, int, int, int) {}
 func (nc *NoopCollector) BlockReindexed()                                   {}
 func (nc *NoopCollector) InitializeLatestHeight(height uint64)              {}
+
+var _ module.GossipSubScoringRegistryMetrics = (*NoopCollector)(nil)
+
+func (nc *NoopCollector) DuplicateMessagePenalties(penalty float64) {}
+
+func (nc *NoopCollector) DuplicateMessagesCounts(count float64) {}
+
+var _ module.CollectionExecutedMetric = (*NoopCollector)(nil)
+
+func (nc *NoopCollector) CollectionFinalized(light flow.LightCollection) {}
+func (nc *NoopCollector) CollectionExecuted(light flow.LightCollection)  {}
+func (nc *NoopCollector) ExecutionReceiptReceived(r *flow.ExecutionReceipt) {
+}
diff --git a/module/mock/builder.go b/module/mock/builder.go
index ad65271ddd7..ef109ae5689 100644
--- a/module/mock/builder.go
+++ b/module/mock/builder.go
@@ -12,25 +12,25 @@ type Builder struct {
 	mock.Mock
 }
 
-// BuildOn provides a mock function with given fields: parentID, setter
-func (_m *Builder) BuildOn(parentID flow.Identifier, setter func(*flow.Header) error) (*flow.Header, error) {
-	ret := _m.Called(parentID, setter)
+// BuildOn provides a mock function with given fields: parentID, setter, sign
+func (_m *Builder) BuildOn(parentID flow.Identifier, setter func(*flow.Header) error, sign func(*flow.Header) error) (*flow.Header, error) {
+	ret := _m.Called(parentID, setter, sign)
 
 	var r0 *flow.Header
 	var r1 error
-	if rf, ok := ret.Get(0).(func(flow.Identifier, func(*flow.Header) error) (*flow.Header, error)); ok {
-		return rf(parentID, setter)
+	if rf, ok := ret.Get(0).(func(flow.Identifier, func(*flow.Header) error, func(*flow.Header) error) (*flow.Header, error)); ok {
+		return rf(parentID, setter, sign)
 	}
-	if rf, ok := ret.Get(0).(func(flow.Identifier, func(*flow.Header) error) *flow.Header); ok {
-		r0 = rf(parentID, setter)
+	if rf, ok := ret.Get(0).(func(flow.Identifier, func(*flow.Header) error, func(*flow.Header) error) *flow.Header); ok {
+		r0 = rf(parentID, setter, sign)
 	} else {
 		if ret.Get(0) != nil {
 			r0 = ret.Get(0).(*flow.Header)
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func(flow.Identifier, func(*flow.Header) error) error); ok {
-		r1 = rf(parentID, setter)
+	if rf, ok := ret.Get(1).(func(flow.Identifier, func(*flow.Header) error, func(*flow.Header) error) error); ok {
+		r1 = rf(parentID, setter, sign)
 	} else {
 		r1 = ret.Error(1)
 	}
diff --git a/module/mock/collection_executed_metric.go b/module/mock/collection_executed_metric.go
new file mode 100644
index 00000000000..9cfe11a9767
--- /dev/null
+++ b/module/mock/collection_executed_metric.go
@@ -0,0 +1,53 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mock
+
+import (
+	flow "github.com/onflow/flow-go/model/flow"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// CollectionExecutedMetric is an autogenerated mock type for the CollectionExecutedMetric type
+type CollectionExecutedMetric struct {
+	mock.Mock
+}
+
+// BlockFinalized provides a mock function with given fields: block
+func (_m *CollectionExecutedMetric) BlockFinalized(block *flow.Block) {
+	_m.Called(block)
+}
+
+// CollectionExecuted provides a mock function with given fields: light
+func (_m *CollectionExecutedMetric) CollectionExecuted(light flow.LightCollection) {
+	_m.Called(light)
+}
+
+// CollectionFinalized provides a mock function with given fields: light
+func (_m *CollectionExecutedMetric) CollectionFinalized(light flow.LightCollection) {
+	_m.Called(light)
+}
+
+// ExecutionReceiptReceived provides a mock function with given fields: r
+func (_m *CollectionExecutedMetric) ExecutionReceiptReceived(r *flow.ExecutionReceipt) {
+	_m.Called(r)
+}
+
+// UpdateLastFullBlockHeight provides a mock function with given fields: height
+func (_m *CollectionExecutedMetric) UpdateLastFullBlockHeight(height uint64) {
+	_m.Called(height)
+}
+
+type mockConstructorTestingTNewCollectionExecutedMetric interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewCollectionExecutedMetric creates a new instance of CollectionExecutedMetric. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewCollectionExecutedMetric(t mockConstructorTestingTNewCollectionExecutedMetric) *CollectionExecutedMetric {
+	mock := &CollectionExecutedMetric{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/module/mock/compliance_metrics.go b/module/mock/compliance_metrics.go
index 545394518a3..489d02d8d0d 100644
--- a/module/mock/compliance_metrics.go
+++ b/module/mock/compliance_metrics.go
@@ -22,11 +22,6 @@ func (_m *ComplianceMetrics) BlockSealed(_a0 *flow.Block) {
 	_m.Called(_a0)
 }
 
-// CommittedEpochFinalView provides a mock function with given fields: view
-func (_m *ComplianceMetrics) CommittedEpochFinalView(view uint64) {
-	_m.Called(view)
-}
-
 // CurrentDKGPhase1FinalView provides a mock function with given fields: view
 func (_m *ComplianceMetrics) CurrentDKGPhase1FinalView(view uint64) {
 	_m.Called(view)
diff --git a/module/mock/dkg_controller_factory.go b/module/mock/dkg_controller_factory.go
index df4c29971de..b2253370f52 100644
--- a/module/mock/dkg_controller_factory.go
+++ b/module/mock/dkg_controller_factory.go
@@ -15,15 +15,15 @@ type DKGControllerFactory struct {
 }
 
 // Create provides a mock function with given fields: dkgInstanceID, participants, seed
-func (_m *DKGControllerFactory) Create(dkgInstanceID string, participants flow.IdentityList, seed []byte) (module.DKGController, error) {
+func (_m *DKGControllerFactory) Create(dkgInstanceID string, participants flow.GenericIdentityList[flow.IdentitySkeleton], seed []byte) (module.DKGController, error) {
 	ret := _m.Called(dkgInstanceID, participants, seed)
 
 	var r0 module.DKGController
 	var r1 error
-	if rf, ok := ret.Get(0).(func(string, flow.IdentityList, []byte) (module.DKGController, error)); ok {
+	if rf, ok := ret.Get(0).(func(string, flow.GenericIdentityList[flow.IdentitySkeleton], []byte) (module.DKGController, error)); ok {
 		return rf(dkgInstanceID, participants, seed)
 	}
-	if rf, ok := ret.Get(0).(func(string, flow.IdentityList, []byte) module.DKGController); ok {
+	if rf, ok := ret.Get(0).(func(string, flow.GenericIdentityList[flow.IdentitySkeleton], []byte) module.DKGController); ok {
 		r0 = rf(dkgInstanceID, participants, seed)
 	} else {
 		if ret.Get(0) != nil {
@@ -31,7 +31,7 @@ func (_m *DKGControllerFactory) Create(dkgInstanceID string, participants flow.I
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func(string, flow.IdentityList, []byte) error); ok {
+	if rf, ok := ret.Get(1).(func(string, flow.GenericIdentityList[flow.IdentitySkeleton], []byte) error); ok {
 		r1 = rf(dkgInstanceID, participants, seed)
 	} else {
 		r1 = ret.Error(1)
diff --git a/module/mock/execution_metrics.go b/module/mock/execution_metrics.go
index bca785e7e75..cb9f6b632dc 100644
--- a/module/mock/execution_metrics.go
+++ b/module/mock/execution_metrics.go
@@ -46,6 +46,11 @@ func (_m *ExecutionMetrics) ExecutionBlockExecutionEffortVectorComponent(_a0 str
 	_m.Called(_a0, _a1)
 }
 
+// ExecutionCheckpointSize provides a mock function with given fields: bytes
+func (_m *ExecutionMetrics) ExecutionCheckpointSize(bytes uint64) {
+	_m.Called(bytes)
+}
+
 // ExecutionChunkDataPackGenerated provides a mock function with given fields: proofSize, numberOfTransactions
 func (_m *ExecutionMetrics) ExecutionChunkDataPackGenerated(proofSize int, numberOfTransactions int) {
 	_m.Called(proofSize, numberOfTransactions)
diff --git a/module/mock/gossip_sub_metrics.go b/module/mock/gossip_sub_metrics.go
index f7e057ea5ba..99700b47e92 100644
--- a/module/mock/gossip_sub_metrics.go
+++ b/module/mock/gossip_sub_metrics.go
@@ -56,9 +56,14 @@ func (_m *GossipSubMetrics) OnGraftDuplicateTopicIdsExceedThreshold() {
 	_m.Called()
 }
 
-// OnGraftMessageInspected provides a mock function with given fields: duplicateTopicIds
-func (_m *GossipSubMetrics) OnGraftMessageInspected(duplicateTopicIds int) {
-	_m.Called(duplicateTopicIds)
+// OnGraftInvalidTopicIdsExceedThreshold provides a mock function with given fields:
+func (_m *GossipSubMetrics) OnGraftInvalidTopicIdsExceedThreshold() {
+	_m.Called()
+}
+
+// OnGraftMessageInspected provides a mock function with given fields: duplicateTopicIds, invalidTopicIds
+func (_m *GossipSubMetrics) OnGraftMessageInspected(duplicateTopicIds int, invalidTopicIds int) {
+	_m.Called(duplicateTopicIds, invalidTopicIds)
 }
 
 // OnIHaveControlMessageIdsTruncated provides a mock function with given fields: diff
@@ -76,14 +81,19 @@ func (_m *GossipSubMetrics) OnIHaveDuplicateTopicIdsExceedThreshold() {
 	_m.Called()
 }
 
+// OnIHaveInvalidTopicIdsExceedThreshold provides a mock function with given fields:
+func (_m *GossipSubMetrics) OnIHaveInvalidTopicIdsExceedThreshold() {
+	_m.Called()
+}
+
 // OnIHaveMessageIDsReceived provides a mock function with given fields: channel, msgIdCount
 func (_m *GossipSubMetrics) OnIHaveMessageIDsReceived(channel string, msgIdCount int) {
 	_m.Called(channel, msgIdCount)
 }
 
-// OnIHaveMessagesInspected provides a mock function with given fields: duplicateTopicIds, duplicateMessageIds
-func (_m *GossipSubMetrics) OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds int) {
-	_m.Called(duplicateTopicIds, duplicateMessageIds)
+// OnIHaveMessagesInspected provides a mock function with given fields: duplicateTopicIds, duplicateMessageIds, invalidTopicIds
+func (_m *GossipSubMetrics) OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds int, invalidTopicIds int) {
+	_m.Called(duplicateTopicIds, duplicateMessageIds, invalidTopicIds)
 }
 
 // OnIPColocationFactorUpdated provides a mock function with given fields: _a0
@@ -216,9 +226,14 @@ func (_m *GossipSubMetrics) OnPruneDuplicateTopicIdsExceedThreshold() {
 	_m.Called()
 }
 
-// OnPruneMessageInspected provides a mock function with given fields: duplicateTopicIds
-func (_m *GossipSubMetrics) OnPruneMessageInspected(duplicateTopicIds int) {
-	_m.Called(duplicateTopicIds)
+// OnPruneInvalidTopicIdsExceedThreshold provides a mock function with given fields:
+func (_m *GossipSubMetrics) OnPruneInvalidTopicIdsExceedThreshold() {
+	_m.Called()
+}
+
+// OnPruneMessageInspected provides a mock function with given fields: duplicateTopicIds, invalidTopicIds
+func (_m *GossipSubMetrics) OnPruneMessageInspected(duplicateTopicIds int, invalidTopicIds int) {
+	_m.Called(duplicateTopicIds, invalidTopicIds)
 }
 
 // OnPublishMessageInspected provides a mock function with given fields: totalErrCount, invalidTopicIdsCount, invalidSubscriptionsCount, invalidSendersCount
@@ -236,6 +251,11 @@ func (_m *GossipSubMetrics) OnRpcReceived(msgCount int, iHaveCount int, iWantCou
 	_m.Called(msgCount, iHaveCount, iWantCount, graftCount, pruneCount)
 }
 
+// OnRpcRejectedFromUnknownSender provides a mock function with given fields:
+func (_m *GossipSubMetrics) OnRpcRejectedFromUnknownSender() {
+	_m.Called()
+}
+
 // OnRpcSent provides a mock function with given fields: msgCount, iHaveCount, iWantCount, graftCount, pruneCount
 func (_m *GossipSubMetrics) OnRpcSent(msgCount int, iHaveCount int, iWantCount int, graftCount int, pruneCount int) {
 	_m.Called(msgCount, iHaveCount, iWantCount, graftCount, pruneCount)
diff --git a/module/mock/gossip_sub_rpc_validation_inspector_metrics.go b/module/mock/gossip_sub_rpc_validation_inspector_metrics.go
index 84eef02f7ea..ac15e512fd7 100644
--- a/module/mock/gossip_sub_rpc_validation_inspector_metrics.go
+++ b/module/mock/gossip_sub_rpc_validation_inspector_metrics.go
@@ -40,9 +40,14 @@ func (_m *GossipSubRpcValidationInspectorMetrics) OnGraftDuplicateTopicIdsExceed
 	_m.Called()
 }
 
-// OnGraftMessageInspected provides a mock function with given fields: duplicateTopicIds
-func (_m *GossipSubRpcValidationInspectorMetrics) OnGraftMessageInspected(duplicateTopicIds int) {
-	_m.Called(duplicateTopicIds)
+// OnGraftInvalidTopicIdsExceedThreshold provides a mock function with given fields:
+func (_m *GossipSubRpcValidationInspectorMetrics) OnGraftInvalidTopicIdsExceedThreshold() {
+	_m.Called()
+}
+
+// OnGraftMessageInspected provides a mock function with given fields: duplicateTopicIds, invalidTopicIds
+func (_m *GossipSubRpcValidationInspectorMetrics) OnGraftMessageInspected(duplicateTopicIds int, invalidTopicIds int) {
+	_m.Called(duplicateTopicIds, invalidTopicIds)
 }
 
 // OnIHaveControlMessageIdsTruncated provides a mock function with given fields: diff
@@ -60,14 +65,19 @@ func (_m *GossipSubRpcValidationInspectorMetrics) OnIHaveDuplicateTopicIdsExceed
 	_m.Called()
 }
 
+// OnIHaveInvalidTopicIdsExceedThreshold provides a mock function with given fields:
+func (_m *GossipSubRpcValidationInspectorMetrics) OnIHaveInvalidTopicIdsExceedThreshold() {
+	_m.Called()
+}
+
 // OnIHaveMessageIDsReceived provides a mock function with given fields: channel, msgIdCount
 func (_m *GossipSubRpcValidationInspectorMetrics) OnIHaveMessageIDsReceived(channel string, msgIdCount int) {
 	_m.Called(channel, msgIdCount)
 }
 
-// OnIHaveMessagesInspected provides a mock function with given fields: duplicateTopicIds, duplicateMessageIds
-func (_m *GossipSubRpcValidationInspectorMetrics) OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds int) {
-	_m.Called(duplicateTopicIds, duplicateMessageIds)
+// OnIHaveMessagesInspected provides a mock function with given fields: duplicateTopicIds, duplicateMessageIds, invalidTopicIds
+func (_m *GossipSubRpcValidationInspectorMetrics) OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds int, invalidTopicIds int) {
+	_m.Called(duplicateTopicIds, duplicateMessageIds, invalidTopicIds)
 }
 
 // OnIWantCacheMissMessageIdsExceedThreshold provides a mock function with given fields:
@@ -115,9 +125,14 @@ func (_m *GossipSubRpcValidationInspectorMetrics) OnPruneDuplicateTopicIdsExceed
 	_m.Called()
 }
 
-// OnPruneMessageInspected provides a mock function with given fields: duplicateTopicIds
-func (_m *GossipSubRpcValidationInspectorMetrics) OnPruneMessageInspected(duplicateTopicIds int) {
-	_m.Called(duplicateTopicIds)
+// OnPruneInvalidTopicIdsExceedThreshold provides a mock function with given fields:
+func (_m *GossipSubRpcValidationInspectorMetrics) OnPruneInvalidTopicIdsExceedThreshold() {
+	_m.Called()
+}
+
+// OnPruneMessageInspected provides a mock function with given fields: duplicateTopicIds, invalidTopicIds
+func (_m *GossipSubRpcValidationInspectorMetrics) OnPruneMessageInspected(duplicateTopicIds int, invalidTopicIds int) {
+	_m.Called(duplicateTopicIds, invalidTopicIds)
 }
 
 // OnPublishMessageInspected provides a mock function with given fields: totalErrCount, invalidTopicIdsCount, invalidSubscriptionsCount, invalidSendersCount
@@ -130,6 +145,11 @@ func (_m *GossipSubRpcValidationInspectorMetrics) OnPublishMessagesInspectionErr
 	_m.Called()
 }
 
+// OnRpcRejectedFromUnknownSender provides a mock function with given fields:
+func (_m *GossipSubRpcValidationInspectorMetrics) OnRpcRejectedFromUnknownSender() {
+	_m.Called()
+}
+
 // OnUnstakedPeerInspectionFailed provides a mock function with given fields:
 func (_m *GossipSubRpcValidationInspectorMetrics) OnUnstakedPeerInspectionFailed() {
 	_m.Called()
diff --git a/module/mock/gossip_sub_scoring_registry_metrics.go b/module/mock/gossip_sub_scoring_registry_metrics.go
new file mode 100644
index 00000000000..02aacd79cfe
--- /dev/null
+++ b/module/mock/gossip_sub_scoring_registry_metrics.go
@@ -0,0 +1,35 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mock
+
+import mock "github.com/stretchr/testify/mock"
+
+// GossipSubScoringRegistryMetrics is an autogenerated mock type for the GossipSubScoringRegistryMetrics type
+type GossipSubScoringRegistryMetrics struct {
+	mock.Mock
+}
+
+// DuplicateMessagePenalties provides a mock function with given fields: penalty
+func (_m *GossipSubScoringRegistryMetrics) DuplicateMessagePenalties(penalty float64) {
+	_m.Called(penalty)
+}
+
+// DuplicateMessagesCounts provides a mock function with given fields: count
+func (_m *GossipSubScoringRegistryMetrics) DuplicateMessagesCounts(count float64) {
+	_m.Called(count)
+}
+
+type mockConstructorTestingTNewGossipSubScoringRegistryMetrics interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewGossipSubScoringRegistryMetrics creates a new instance of GossipSubScoringRegistryMetrics. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewGossipSubScoringRegistryMetrics(t mockConstructorTestingTNewGossipSubScoringRegistryMetrics) *GossipSubScoringRegistryMetrics {
+	mock := &GossipSubScoringRegistryMetrics{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/module/mock/identity_provider.go b/module/mock/identity_provider.go
index 925583a40d0..8711a8e8efb 100644
--- a/module/mock/identity_provider.go
+++ b/module/mock/identity_provider.go
@@ -67,15 +67,15 @@ func (_m *IdentityProvider) ByPeerID(_a0 peer.ID) (*flow.Identity, bool) {
 }
 
 // Identities provides a mock function with given fields: _a0
-func (_m *IdentityProvider) Identities(_a0 flow.IdentityFilter) flow.IdentityList {
+func (_m *IdentityProvider) Identities(_a0 flow.IdentityFilter[flow.Identity]) flow.GenericIdentityList[flow.Identity] {
 	ret := _m.Called(_a0)
 
-	var r0 flow.IdentityList
-	if rf, ok := ret.Get(0).(func(flow.IdentityFilter) flow.IdentityList); ok {
+	var r0 flow.GenericIdentityList[flow.Identity]
+	if rf, ok := ret.Get(0).(func(flow.IdentityFilter[flow.Identity]) flow.GenericIdentityList[flow.Identity]); ok {
 		r0 = rf(_a0)
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(flow.IdentityList)
+			r0 = ret.Get(0).(flow.GenericIdentityList[flow.Identity])
 		}
 	}
 
diff --git a/module/mock/lib_p2_p_metrics.go b/module/mock/lib_p2_p_metrics.go
index f91d247d6bf..fb64a2764c2 100644
--- a/module/mock/lib_p2_p_metrics.go
+++ b/module/mock/lib_p2_p_metrics.go
@@ -107,6 +107,16 @@ func (_m *LibP2PMetrics) DNSLookupDuration(duration time.Duration) {
 	_m.Called(duration)
 }
 
+// DuplicateMessagePenalties provides a mock function with given fields: penalty
+func (_m *LibP2PMetrics) DuplicateMessagePenalties(penalty float64) {
+	_m.Called(penalty)
+}
+
+// DuplicateMessagesCounts provides a mock function with given fields: count
+func (_m *LibP2PMetrics) DuplicateMessagesCounts(count float64) {
+	_m.Called(count)
+}
+
 // InboundConnections provides a mock function with given fields: connectionCount
 func (_m *LibP2PMetrics) InboundConnections(connectionCount uint) {
 	_m.Called(connectionCount)
@@ -177,9 +187,14 @@ func (_m *LibP2PMetrics) OnGraftDuplicateTopicIdsExceedThreshold() {
 	_m.Called()
 }
 
-// OnGraftMessageInspected provides a mock function with given fields: duplicateTopicIds
-func (_m *LibP2PMetrics) OnGraftMessageInspected(duplicateTopicIds int) {
-	_m.Called(duplicateTopicIds)
+// OnGraftInvalidTopicIdsExceedThreshold provides a mock function with given fields:
+func (_m *LibP2PMetrics) OnGraftInvalidTopicIdsExceedThreshold() {
+	_m.Called()
+}
+
+// OnGraftMessageInspected provides a mock function with given fields: duplicateTopicIds, invalidTopicIds
+func (_m *LibP2PMetrics) OnGraftMessageInspected(duplicateTopicIds int, invalidTopicIds int) {
+	_m.Called(duplicateTopicIds, invalidTopicIds)
 }
 
 // OnIHaveControlMessageIdsTruncated provides a mock function with given fields: diff
@@ -197,14 +212,19 @@ func (_m *LibP2PMetrics) OnIHaveDuplicateTopicIdsExceedThreshold() {
 	_m.Called()
 }
 
+// OnIHaveInvalidTopicIdsExceedThreshold provides a mock function with given fields:
+func (_m *LibP2PMetrics) OnIHaveInvalidTopicIdsExceedThreshold() {
+	_m.Called()
+}
+
 // OnIHaveMessageIDsReceived provides a mock function with given fields: channel, msgIdCount
 func (_m *LibP2PMetrics) OnIHaveMessageIDsReceived(channel string, msgIdCount int) {
 	_m.Called(channel, msgIdCount)
 }
 
-// OnIHaveMessagesInspected provides a mock function with given fields: duplicateTopicIds, duplicateMessageIds
-func (_m *LibP2PMetrics) OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds int) {
-	_m.Called(duplicateTopicIds, duplicateMessageIds)
+// OnIHaveMessagesInspected provides a mock function with given fields: duplicateTopicIds, duplicateMessageIds, invalidTopicIds
+func (_m *LibP2PMetrics) OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds int, invalidTopicIds int) {
+	_m.Called(duplicateTopicIds, duplicateMessageIds, invalidTopicIds)
 }
 
 // OnIPColocationFactorUpdated provides a mock function with given fields: _a0
@@ -347,9 +367,14 @@ func (_m *LibP2PMetrics) OnPruneDuplicateTopicIdsExceedThreshold() {
 	_m.Called()
 }
 
-// OnPruneMessageInspected provides a mock function with given fields: duplicateTopicIds
-func (_m *LibP2PMetrics) OnPruneMessageInspected(duplicateTopicIds int) {
-	_m.Called(duplicateTopicIds)
+// OnPruneInvalidTopicIdsExceedThreshold provides a mock function with given fields:
+func (_m *LibP2PMetrics) OnPruneInvalidTopicIdsExceedThreshold() {
+	_m.Called()
+}
+
+// OnPruneMessageInspected provides a mock function with given fields: duplicateTopicIds, invalidTopicIds
+func (_m *LibP2PMetrics) OnPruneMessageInspected(duplicateTopicIds int, invalidTopicIds int) {
+	_m.Called(duplicateTopicIds, invalidTopicIds)
 }
 
 // OnPublishMessageInspected provides a mock function with given fields: totalErrCount, invalidTopicIdsCount, invalidSubscriptionsCount, invalidSendersCount
@@ -367,6 +392,11 @@ func (_m *LibP2PMetrics) OnRpcReceived(msgCount int, iHaveCount int, iWantCount
 	_m.Called(msgCount, iHaveCount, iWantCount, graftCount, pruneCount)
 }
 
+// OnRpcRejectedFromUnknownSender provides a mock function with given fields:
+func (_m *LibP2PMetrics) OnRpcRejectedFromUnknownSender() {
+	_m.Called()
+}
+
 // OnRpcSent provides a mock function with given fields: msgCount, iHaveCount, iWantCount, graftCount, pruneCount
 func (_m *LibP2PMetrics) OnRpcSent(msgCount int, iHaveCount int, iWantCount int, graftCount int, pruneCount int) {
 	_m.Called(msgCount, iHaveCount, iWantCount, graftCount, pruneCount)
diff --git a/module/mock/local.go b/module/mock/local.go
index 673dc0b91a3..2bf8212f85b 100644
--- a/module/mock/local.go
+++ b/module/mock/local.go
@@ -47,15 +47,15 @@ func (_m *Local) NodeID() flow.Identifier {
 }
 
 // NotMeFilter provides a mock function with given fields:
-func (_m *Local) NotMeFilter() flow.IdentityFilter {
+func (_m *Local) NotMeFilter() flow.IdentityFilter[flow.Identity] {
 	ret := _m.Called()
 
-	var r0 flow.IdentityFilter
-	if rf, ok := ret.Get(0).(func() flow.IdentityFilter); ok {
+	var r0 flow.IdentityFilter[flow.Identity]
+	if rf, ok := ret.Get(0).(func() flow.IdentityFilter[flow.Identity]); ok {
 		r0 = rf()
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(flow.IdentityFilter)
+			r0 = ret.Get(0).(flow.IdentityFilter[flow.Identity])
 		}
 	}
 
diff --git a/module/mock/network_metrics.go b/module/mock/network_metrics.go
index e86d63fb03a..534150b24d1 100644
--- a/module/mock/network_metrics.go
+++ b/module/mock/network_metrics.go
@@ -112,6 +112,16 @@ func (_m *NetworkMetrics) DuplicateInboundMessagesDropped(topic string, _a1 stri
 	_m.Called(topic, _a1, messageType)
 }
 
+// DuplicateMessagePenalties provides a mock function with given fields: penalty
+func (_m *NetworkMetrics) DuplicateMessagePenalties(penalty float64) {
+	_m.Called(penalty)
+}
+
+// DuplicateMessagesCounts provides a mock function with given fields: count
+func (_m *NetworkMetrics) DuplicateMessagesCounts(count float64) {
+	_m.Called(count)
+}
+
 // InboundConnections provides a mock function with given fields: connectionCount
 func (_m *NetworkMetrics) InboundConnections(connectionCount uint) {
 	_m.Called(connectionCount)
@@ -207,9 +217,14 @@ func (_m *NetworkMetrics) OnGraftDuplicateTopicIdsExceedThreshold() {
 	_m.Called()
 }
 
-// OnGraftMessageInspected provides a mock function with given fields: duplicateTopicIds
-func (_m *NetworkMetrics) OnGraftMessageInspected(duplicateTopicIds int) {
-	_m.Called(duplicateTopicIds)
+// OnGraftInvalidTopicIdsExceedThreshold provides a mock function with given fields:
+func (_m *NetworkMetrics) OnGraftInvalidTopicIdsExceedThreshold() {
+	_m.Called()
+}
+
+// OnGraftMessageInspected provides a mock function with given fields: duplicateTopicIds, invalidTopicIds
+func (_m *NetworkMetrics) OnGraftMessageInspected(duplicateTopicIds int, invalidTopicIds int) {
+	_m.Called(duplicateTopicIds, invalidTopicIds)
 }
 
 // OnIHaveControlMessageIdsTruncated provides a mock function with given fields: diff
@@ -227,14 +242,19 @@ func (_m *NetworkMetrics) OnIHaveDuplicateTopicIdsExceedThreshold() {
 	_m.Called()
 }
 
+// OnIHaveInvalidTopicIdsExceedThreshold provides a mock function with given fields:
+func (_m *NetworkMetrics) OnIHaveInvalidTopicIdsExceedThreshold() {
+	_m.Called()
+}
+
 // OnIHaveMessageIDsReceived provides a mock function with given fields: channel, msgIdCount
 func (_m *NetworkMetrics) OnIHaveMessageIDsReceived(channel string, msgIdCount int) {
 	_m.Called(channel, msgIdCount)
 }
 
-// OnIHaveMessagesInspected provides a mock function with given fields: duplicateTopicIds, duplicateMessageIds
-func (_m *NetworkMetrics) OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds int) {
-	_m.Called(duplicateTopicIds, duplicateMessageIds)
+// OnIHaveMessagesInspected provides a mock function with given fields: duplicateTopicIds, duplicateMessageIds, invalidTopicIds
+func (_m *NetworkMetrics) OnIHaveMessagesInspected(duplicateTopicIds int, duplicateMessageIds int, invalidTopicIds int) {
+	_m.Called(duplicateTopicIds, duplicateMessageIds, invalidTopicIds)
 }
 
 // OnIPColocationFactorUpdated provides a mock function with given fields: _a0
@@ -382,9 +402,14 @@ func (_m *NetworkMetrics) OnPruneDuplicateTopicIdsExceedThreshold() {
 	_m.Called()
 }
 
-// OnPruneMessageInspected provides a mock function with given fields: duplicateTopicIds
-func (_m *NetworkMetrics) OnPruneMessageInspected(duplicateTopicIds int) {
-	_m.Called(duplicateTopicIds)
+// OnPruneInvalidTopicIdsExceedThreshold provides a mock function with given fields:
+func (_m *NetworkMetrics) OnPruneInvalidTopicIdsExceedThreshold() {
+	_m.Called()
+}
+
+// OnPruneMessageInspected provides a mock function with given fields: duplicateTopicIds, invalidTopicIds
+func (_m *NetworkMetrics) OnPruneMessageInspected(duplicateTopicIds int, invalidTopicIds int) {
+	_m.Called(duplicateTopicIds, invalidTopicIds)
 }
 
 // OnPublishMessageInspected provides a mock function with given fields: totalErrCount, invalidTopicIdsCount, invalidSubscriptionsCount, invalidSendersCount
@@ -407,6 +432,11 @@ func (_m *NetworkMetrics) OnRpcReceived(msgCount int, iHaveCount int, iWantCount
 	_m.Called(msgCount, iHaveCount, iWantCount, graftCount, pruneCount)
 }
 
+// OnRpcRejectedFromUnknownSender provides a mock function with given fields:
+func (_m *NetworkMetrics) OnRpcRejectedFromUnknownSender() {
+	_m.Called()
+}
+
 // OnRpcSent provides a mock function with given fields: msgCount, iHaveCount, iWantCount, graftCount, pruneCount
 func (_m *NetworkMetrics) OnRpcSent(msgCount int, iHaveCount int, iWantCount int, graftCount int, pruneCount int) {
 	_m.Called(msgCount, iHaveCount, iWantCount, graftCount, pruneCount)
diff --git a/module/mock/requester.go b/module/mock/requester.go
index d3effd8e215..47256ecf8bf 100644
--- a/module/mock/requester.go
+++ b/module/mock/requester.go
@@ -13,7 +13,7 @@ type Requester struct {
 }
 
 // EntityByID provides a mock function with given fields: entityID, selector
-func (_m *Requester) EntityByID(entityID flow.Identifier, selector flow.IdentityFilter) {
+func (_m *Requester) EntityByID(entityID flow.Identifier, selector flow.IdentityFilter[flow.Identity]) {
 	_m.Called(entityID, selector)
 }
 
@@ -23,7 +23,7 @@ func (_m *Requester) Force() {
 }
 
 // Query provides a mock function with given fields: key, selector
-func (_m *Requester) Query(key flow.Identifier, selector flow.IdentityFilter) {
+func (_m *Requester) Query(key flow.Identifier, selector flow.IdentityFilter[flow.Identity]) {
 	_m.Called(key, selector)
 }
 
diff --git a/module/mock/wal_metrics.go b/module/mock/wal_metrics.go
index bf26cbb86ef..04806761950 100644
--- a/module/mock/wal_metrics.go
+++ b/module/mock/wal_metrics.go
@@ -9,6 +9,11 @@ type WALMetrics struct {
 	mock.Mock
 }
 
+// ExecutionCheckpointSize provides a mock function with given fields: bytes
+func (_m *WALMetrics) ExecutionCheckpointSize(bytes uint64) {
+	_m.Called(bytes)
+}
+
 type mockConstructorTestingTNewWALMetrics interface {
 	mock.TestingT
 	Cleanup(func())
diff --git a/module/mocks/network.go b/module/mocks/network.go
deleted file mode 100644
index 3bab7657423..00000000000
--- a/module/mocks/network.go
+++ /dev/null
@@ -1,168 +0,0 @@
-// Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/onflow/flow-go/module (interfaces: Local,Requester)
-
-// Package mocks is a generated GoMock package.
-package mocks
-
-import (
-	reflect "reflect"
-
-	gomock "github.com/golang/mock/gomock"
-	crypto "github.com/onflow/crypto"
-	hash "github.com/onflow/crypto/hash"
-	flow "github.com/onflow/flow-go/model/flow"
-)
-
-// MockLocal is a mock of Local interface.
-type MockLocal struct {
-	ctrl     *gomock.Controller
-	recorder *MockLocalMockRecorder
-}
-
-// MockLocalMockRecorder is the mock recorder for MockLocal.
-type MockLocalMockRecorder struct {
-	mock *MockLocal
-}
-
-// NewMockLocal creates a new mock instance.
-func NewMockLocal(ctrl *gomock.Controller) *MockLocal {
-	mock := &MockLocal{ctrl: ctrl}
-	mock.recorder = &MockLocalMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use.
-func (m *MockLocal) EXPECT() *MockLocalMockRecorder {
-	return m.recorder
-}
-
-// Address mocks base method.
-func (m *MockLocal) Address() string {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Address")
-	ret0, _ := ret[0].(string)
-	return ret0
-}
-
-// Address indicates an expected call of Address.
-func (mr *MockLocalMockRecorder) Address() *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Address", reflect.TypeOf((*MockLocal)(nil).Address))
-}
-
-// NodeID mocks base method.
-func (m *MockLocal) NodeID() flow.Identifier {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "NodeID")
-	ret0, _ := ret[0].(flow.Identifier)
-	return ret0
-}
-
-// NodeID indicates an expected call of NodeID.
-func (mr *MockLocalMockRecorder) NodeID() *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NodeID", reflect.TypeOf((*MockLocal)(nil).NodeID))
-}
-
-// NotMeFilter mocks base method.
-func (m *MockLocal) NotMeFilter() flow.IdentityFilter {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "NotMeFilter")
-	ret0, _ := ret[0].(flow.IdentityFilter)
-	return ret0
-}
-
-// NotMeFilter indicates an expected call of NotMeFilter.
-func (mr *MockLocalMockRecorder) NotMeFilter() *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "NotMeFilter", reflect.TypeOf((*MockLocal)(nil).NotMeFilter))
-}
-
-// Sign mocks base method.
-func (m *MockLocal) Sign(arg0 []byte, arg1 hash.Hasher) (crypto.Signature, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Sign", arg0, arg1)
-	ret0, _ := ret[0].(crypto.Signature)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// Sign indicates an expected call of Sign.
-func (mr *MockLocalMockRecorder) Sign(arg0, arg1 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Sign", reflect.TypeOf((*MockLocal)(nil).Sign), arg0, arg1)
-}
-
-// SignFunc mocks base method.
-func (m *MockLocal) SignFunc(arg0 []byte, arg1 hash.Hasher, arg2 func(crypto.PrivateKey, []byte, hash.Hasher) (crypto.Signature, error)) (crypto.Signature, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "SignFunc", arg0, arg1, arg2)
-	ret0, _ := ret[0].(crypto.Signature)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// SignFunc indicates an expected call of SignFunc.
-func (mr *MockLocalMockRecorder) SignFunc(arg0, arg1, arg2 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SignFunc", reflect.TypeOf((*MockLocal)(nil).SignFunc), arg0, arg1, arg2)
-}
-
-// MockRequester is a mock of Requester interface.
-type MockRequester struct {
-	ctrl     *gomock.Controller
-	recorder *MockRequesterMockRecorder
-}
-
-// MockRequesterMockRecorder is the mock recorder for MockRequester.
-type MockRequesterMockRecorder struct {
-	mock *MockRequester
-}
-
-// NewMockRequester creates a new mock instance.
-func NewMockRequester(ctrl *gomock.Controller) *MockRequester {
-	mock := &MockRequester{ctrl: ctrl}
-	mock.recorder = &MockRequesterMockRecorder{mock}
-	return mock
-}
-
-// EXPECT returns an object that allows the caller to indicate expected use.
-func (m *MockRequester) EXPECT() *MockRequesterMockRecorder {
-	return m.recorder
-}
-
-// EntityByID mocks base method.
-func (m *MockRequester) EntityByID(arg0 flow.Identifier, arg1 flow.IdentityFilter) {
-	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "EntityByID", arg0, arg1)
-}
-
-// EntityByID indicates an expected call of EntityByID.
-func (mr *MockRequesterMockRecorder) EntityByID(arg0, arg1 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "EntityByID", reflect.TypeOf((*MockRequester)(nil).EntityByID), arg0, arg1)
-}
-
-// Force mocks base method.
-func (m *MockRequester) Force() {
-	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Force")
-}
-
-// Force indicates an expected call of Force.
-func (mr *MockRequesterMockRecorder) Force() *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Force", reflect.TypeOf((*MockRequester)(nil).Force))
-}
-
-// Query mocks base method.
-func (m *MockRequester) Query(arg0 flow.Identifier, arg1 flow.IdentityFilter) {
-	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "Query", arg0, arg1)
-}
-
-// Query indicates an expected call of Query.
-func (mr *MockRequesterMockRecorder) Query(arg0, arg1 interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Query", reflect.TypeOf((*MockRequester)(nil).Query), arg0, arg1)
-}
diff --git a/module/requester.go b/module/requester.go
index dc5e1baa059..93b3f8a66f2 100644
--- a/module/requester.go
+++ b/module/requester.go
@@ -12,17 +12,30 @@ type Requester interface {
 	// if no additional restrictions are required. Data integrity of response
 	// will be checked upon arrival. This function should be used for requesting
 	// entites by their IDs.
-	EntityByID(entityID flow.Identifier, selector flow.IdentityFilter)
+	EntityByID(entityID flow.Identifier, selector flow.IdentityFilter[flow.Identity])
 
 	// Query will request data through the request engine backing the interface.
 	// The additional selector will be applied to the subset
 	// of valid providers for the data and allows finer-grained control
 	// over which providers to request data from. Doesn't perform integrity check
 	// can be used to get entities without knowing their ID.
-	Query(key flow.Identifier, selector flow.IdentityFilter)
+	Query(key flow.Identifier, selector flow.IdentityFilter[flow.Identity])
 
 	// Force will force the dispatcher to send all possible batches immediately.
 	// It can be used in cases where responsiveness is of utmost importance, at
 	// the cost of additional network messages.
 	Force()
 }
+
+type NoopRequester struct{}
+
+func (n NoopRequester) EntityByID(entityID flow.Identifier, selector flow.IdentityFilter[flow.Identity]) {
+}
+
+func (n NoopRequester) Query(key flow.Identifier, selector flow.IdentityFilter[flow.Identity]) {}
+
+func (n NoopRequester) Force() {}
+
+func (n NoopRequester) WithHandle(func(flow.Identifier, flow.Entity)) Requester {
+	return n
+}
diff --git a/module/signature/checksum_test.go b/module/signature/checksum_test.go
index 35a11408bca..9006565aca7 100644
--- a/module/signature/checksum_test.go
+++ b/module/signature/checksum_test.go
@@ -50,11 +50,11 @@ func TestCheckSum(t *testing.T) {
 // is able to extract the same data as the encoder.
 func TestPrefixCheckSum(t *testing.T) {
 	rapid.Check(t, func(t *rapid.T) {
-		committeeSize := rapid.IntRange(0, 300).Draw(t, "committeeSize").(int)
+		committeeSize := rapid.IntRange(0, 300).Draw(t, "committeeSize")
 		committee := unittest.IdentifierListFixture(committeeSize)
-		data := rapid.IntRange(0, 200).Map(func(count int) []byte {
+		data := rapid.Map(rapid.IntRange(0, 200), func(count int) []byte {
 			return unittest.RandomBytes(count)
-		}).Draw(t, "data").([]byte)
+		}).Draw(t, "data")
 		extracted, err := msig.CompareAndExtract(committee, msig.PrefixCheckSum(committee, data))
 		require.NoError(t, err)
 		require.Equal(t, data, extracted)
diff --git a/module/signature/signer_indices.go b/module/signature/signer_indices.go
index 68e3c78f1d5..30bf3faadb8 100644
--- a/module/signature/signer_indices.go
+++ b/module/signature/signer_indices.go
@@ -127,9 +127,9 @@ func EncodeSignerToIndicesAndSigType(
 // Expected Error returns during normal operations:
 //   - signature.IsInvalidSigTypesError if the given `sigType` does not encode a valid sequence of signature types
 func DecodeSigTypeToStakingAndBeaconSigners(
-	signers flow.IdentityList,
+	signers flow.IdentitySkeletonList,
 	sigType []byte,
-) (flow.IdentityList, flow.IdentityList, error) {
+) (flow.IdentitySkeletonList, flow.IdentitySkeletonList, error) {
 	numberSigners := len(signers)
 	if err := validPadding(sigType, numberSigners); err != nil {
 		if errors.Is(err, ErrIncompatibleBitVectorLength) || errors.Is(err, ErrIllegallyPaddedBitVector) {
@@ -138,9 +138,9 @@ func DecodeSigTypeToStakingAndBeaconSigners(
 		return nil, nil, fmt.Errorf("unexpected exception while checking padding of sigTypes: %w", err)
 	}
 
-	// decode bits to Identities
-	stakingSigners := make(flow.IdentityList, 0, numberSigners)
-	beaconSigners := make(flow.IdentityList, 0, numberSigners)
+	// decode bits to IdentitySkeletonList
+	stakingSigners := make(flow.IdentitySkeletonList, 0, numberSigners)
+	beaconSigners := make(flow.IdentitySkeletonList, 0, numberSigners)
 	for i, signer := range signers {
 		if bitutils.ReadBit(sigType, i) == 0 {
 			stakingSigners = append(stakingSigners, signer)
@@ -156,6 +156,7 @@ func DecodeSigTypeToStakingAndBeaconSigners(
 //   - The input `canonicalIdentifiers` must exhaustively list the set of authorized signers in their canonical order.
 //   - The input `signerIDs` represents a set, i.e. it should not contain any duplicates.
 //   - `signerIDs` must be a subset of `canonicalIdentifiers`
+//   - `signerIDs` can be in arbitrary order (canonical order _not required_)
 //
 // RETURN VALUE:
 //   - `signerIndices` is a bit vector. Let signerIndices[i] denote the ith bit of `signerIndices`.
@@ -278,18 +279,20 @@ func decodeSignerIndices(
 // Prerequisite:
 //   - The input `canonicalIdentifiers` must exhaustively list the set of authorized signers in their canonical order.
 //
+// The returned list of decoded identities is in canonical order.
+//
 // Expected Error returns during normal operations:
 // * signature.InvalidSignerIndicesError if the given index vector `prefixed` does not encode a valid set of signers
 func DecodeSignerIndicesToIdentities(
-	canonicalIdentities flow.IdentityList,
+	canonicalIdentities flow.IdentitySkeletonList,
 	prefixed []byte,
-) (flow.IdentityList, error) {
+) (flow.IdentitySkeletonList, error) {
 	indices, err := decodeSignerIndices(canonicalIdentities.NodeIDs(), prefixed)
 	if err != nil {
 		return nil, err
 	}
 
-	signers := make(flow.IdentityList, 0, len(indices))
+	signers := make(flow.IdentitySkeletonList, 0, len(indices))
 	for _, index := range indices {
 		signers = append(signers, canonicalIdentities[index])
 	}
diff --git a/module/signature/signer_indices_test.go b/module/signature/signer_indices_test.go
index 4f1595d06c5..2a10311e2a9 100644
--- a/module/signature/signer_indices_test.go
+++ b/module/signature/signer_indices_test.go
@@ -21,7 +21,7 @@ import (
 //  2. for the decoding step, we offer an optimized convenience function to directly
 //     decode to full identities: Indices --decode--> Identities
 func TestEncodeDecodeIdentities(t *testing.T) {
-	canonicalIdentities := unittest.IdentityListFixture(20)
+	canonicalIdentities := unittest.IdentityListFixture(20).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
 	canonicalIdentifiers := canonicalIdentities.NodeIDs()
 	for s := 0; s < 20; s++ {
 		for e := s; e < 20; e++ {
@@ -104,12 +104,12 @@ func TestEncodeFail(t *testing.T) {
 func Test_EncodeSignerToIndicesAndSigType(t *testing.T) {
 	rapid.Check(t, func(t *rapid.T) {
 		// select total committee size, number of random beacon signers and number of staking signers
-		committeeSize := rapid.IntRange(1, 272).Draw(t, "committeeSize").(int)
-		numStakingSigners := rapid.IntRange(0, committeeSize).Draw(t, "numStakingSigners").(int)
-		numRandomBeaconSigners := rapid.IntRange(0, committeeSize-numStakingSigners).Draw(t, "numRandomBeaconSigners").(int)
+		committeeSize := rapid.IntRange(1, 272).Draw(t, "committeeSize")
+		numStakingSigners := rapid.IntRange(0, committeeSize).Draw(t, "numStakingSigners")
+		numRandomBeaconSigners := rapid.IntRange(0, committeeSize-numStakingSigners).Draw(t, "numRandomBeaconSigners")
 
 		// create committee
-		committeeIdentities := unittest.IdentityListFixture(committeeSize, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical)
+		committeeIdentities := unittest.IdentityListFixture(committeeSize, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical[flow.Identity])
 		committee := committeeIdentities.NodeIDs()
 		stakingSigners, beaconSigners := sampleSigners(t, committee, numStakingSigners, numRandomBeaconSigners)
 
@@ -125,7 +125,7 @@ func Test_EncodeSignerToIndicesAndSigType(t *testing.T) {
 		correctEncoding(t, signerIndices, committee, unorderedSigners)
 
 		// check sigTypes
-		canSigners := committeeIdentities.Filter(filter.HasNodeID(unorderedSigners...)).NodeIDs() // generates list of signer IDs in canonical order
+		canSigners := committeeIdentities.Filter(filter.HasNodeID[flow.Identity](unorderedSigners...)).NodeIDs() // generates list of signer IDs in canonical order
 		correctEncoding(t, sigTypes, canSigners, beaconSigners)
 	})
 }
@@ -142,12 +142,13 @@ func Test_EncodeSignerToIndicesAndSigType(t *testing.T) {
 func Test_DecodeSigTypeToStakingAndBeaconSigners(t *testing.T) {
 	rapid.Check(t, func(t *rapid.T) {
 		// select total committee size, number of random beacon signers and number of staking signers
-		committeeSize := rapid.IntRange(1, 272).Draw(t, "committeeSize").(int)
-		numStakingSigners := rapid.IntRange(0, committeeSize).Draw(t, "numStakingSigners").(int)
-		numRandomBeaconSigners := rapid.IntRange(0, committeeSize-numStakingSigners).Draw(t, "numRandomBeaconSigners").(int)
+		committeeSize := rapid.IntRange(1, 272).Draw(t, "committeeSize")
+		numStakingSigners := rapid.IntRange(0, committeeSize).Draw(t, "numStakingSigners")
+		numRandomBeaconSigners := rapid.IntRange(0, committeeSize-numStakingSigners).Draw(t, "numRandomBeaconSigners")
 
 		// create committee
-		committeeIdentities := unittest.IdentityListFixture(committeeSize, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical)
+		committeeIdentities := unittest.IdentityListFixture(committeeSize, unittest.WithRole(flow.RoleConsensus)).
+			Sort(flow.Canonical[flow.Identity])
 		committee := committeeIdentities.NodeIDs()
 		stakingSigners, beaconSigners := sampleSigners(t, committee, numStakingSigners, numRandomBeaconSigners)
 
@@ -156,35 +157,35 @@ func Test_DecodeSigTypeToStakingAndBeaconSigners(t *testing.T) {
 		require.NoError(t, err)
 
 		// decode
-		decSignerIdentites, err := signature.DecodeSignerIndicesToIdentities(committeeIdentities, signerIndices)
+		decSignerIdentites, err := signature.DecodeSignerIndicesToIdentities(committeeIdentities.ToSkeleton(), signerIndices)
 		require.NoError(t, err)
 		decStakingSigners, decBeaconSigners, err := signature.DecodeSigTypeToStakingAndBeaconSigners(decSignerIdentites, sigTypes)
 		require.NoError(t, err)
 
 		// verify; note that there is a slightly different convention between Filter and the decoding logic:
 		// Filter returns nil for an empty list, while the decoding logic returns an instance of an empty slice
-		sigIdentities := committeeIdentities.Filter(filter.Or(filter.HasNodeID(stakingSigners...), filter.HasNodeID(beaconSigners...))) // signer identities in canonical order
+		sigIdentities := committeeIdentities.Filter(
+			filter.Or(filter.HasNodeID[flow.Identity](stakingSigners...), filter.HasNodeID[flow.Identity](beaconSigners...))).ToSkeleton() // signer identities in canonical order
 		if len(stakingSigners)+len(decBeaconSigners) > 0 {
 			require.Equal(t, sigIdentities, decSignerIdentites)
 		}
 		if len(stakingSigners) == 0 {
 			require.Empty(t, decStakingSigners)
 		} else {
-			require.Equal(t, committeeIdentities.Filter(filter.HasNodeID(stakingSigners...)), decStakingSigners)
+			require.Equal(t, committeeIdentities.Filter(filter.HasNodeID[flow.Identity](stakingSigners...)).ToSkeleton(), decStakingSigners)
 		}
 		if len(decBeaconSigners) == 0 {
 			require.Empty(t, decBeaconSigners)
 		} else {
-			require.Equal(t, committeeIdentities.Filter(filter.HasNodeID(beaconSigners...)), decBeaconSigners)
+			require.Equal(t, committeeIdentities.Filter(filter.HasNodeID[flow.Identity](beaconSigners...)).ToSkeleton(), decBeaconSigners)
 		}
 	})
 }
 
 func Test_ValidPaddingErrIncompatibleBitVectorLength(t *testing.T) {
-	var signers flow.IdentityList
 	var err error
 	// if bits is multiply of 8, then there is no padding needed, any sig type can be decoded.
-	signers = unittest.IdentityListFixture(16)
+	signers := unittest.IdentityListFixture(16).ToSkeleton()
 
 	// 16 bits needs 2 bytes, provided 2 bytes
 	_, _, err = signature.DecodeSigTypeToStakingAndBeaconSigners(signers, unittest.RandomBytes(2))
@@ -201,7 +202,7 @@ func Test_ValidPaddingErrIncompatibleBitVectorLength(t *testing.T) {
 	require.ErrorIs(t, err, signature.ErrIncompatibleBitVectorLength, "low-level error representing the failure should be ErrIncompatibleBitVectorLength")
 
 	// if bits is not multiply of 8, then padding is needed
-	signers = unittest.IdentityListFixture(15)
+	signers = unittest.IdentityListFixture(15).ToSkeleton()
 	_, _, err = signature.DecodeSigTypeToStakingAndBeaconSigners(signers, []byte{byte(255), byte(254)})
 	require.NoError(t, err)
 
@@ -217,30 +218,30 @@ func Test_ValidPaddingErrIncompatibleBitVectorLength(t *testing.T) {
 
 	// if bits is not multiply of 8,
 	// 1 byte more
-	signers = unittest.IdentityListFixture(0)
+	signers = unittest.IdentityListFixture(0).ToSkeleton()
 	_, _, err = signature.DecodeSigTypeToStakingAndBeaconSigners(signers, []byte{byte(255)})
 	require.True(t, signature.IsInvalidSigTypesError(err), "API-level error should be InvalidSigTypesError")
 	require.ErrorIs(t, err, signature.ErrIncompatibleBitVectorLength, "low-level error representing the failure should be ErrIncompatibleBitVectorLength")
 
 	// 1 byte more
-	signers = unittest.IdentityListFixture(1)
+	signers = unittest.IdentityListFixture(1).ToSkeleton()
 	_, _, err = signature.DecodeSigTypeToStakingAndBeaconSigners(signers, []byte{byte(0), byte(0)})
 	require.True(t, signature.IsInvalidSigTypesError(err), "API-level error should be InvalidSigTypesError")
 	require.ErrorIs(t, err, signature.ErrIncompatibleBitVectorLength, "low-level error representing the failure should be ErrIncompatibleBitVectorLength")
 
 	// 1 byte less
-	signers = unittest.IdentityListFixture(7)
+	signers = unittest.IdentityListFixture(7).ToSkeleton()
 	_, _, err = signature.DecodeSigTypeToStakingAndBeaconSigners(signers, []byte{})
 	require.True(t, signature.IsInvalidSigTypesError(err), "API-level error should be InvalidSigTypesError")
 	require.ErrorIs(t, err, signature.ErrIncompatibleBitVectorLength, "low-level error representing the failure should be ErrIncompatibleBitVectorLength")
 }
 
 func TestValidPaddingErrIllegallyPaddedBitVector(t *testing.T) {
-	var signers flow.IdentityList
+	var signers flow.IdentitySkeletonList
 	var err error
 	// if bits is multiply of 8, then there is no padding needed, any sig type can be decoded.
 	for count := 1; count < 8; count++ {
-		signers = unittest.IdentityListFixture(count)
+		signers = unittest.IdentityListFixture(count).ToSkeleton()
 		_, _, err = signature.DecodeSigTypeToStakingAndBeaconSigners(signers, []byte{byte(255)}) // last bit should be 0, but 1
 		require.True(t, signature.IsInvalidSigTypesError(err), "API-level error should be InvalidSigTypesError")
 		require.ErrorIs(t, err, signature.ErrIllegallyPaddedBitVector, "low-level error representing the failure should be ErrIllegallyPaddedBitVector")
@@ -251,7 +252,7 @@ func TestValidPaddingErrIllegallyPaddedBitVector(t *testing.T) {
 	}
 
 	for count := 9; count < 16; count++ {
-		signers = unittest.IdentityListFixture(count)
+		signers = unittest.IdentityListFixture(count).ToSkeleton()
 		_, _, err = signature.DecodeSigTypeToStakingAndBeaconSigners(signers, []byte{byte(255), byte(255)}) // last bit should be 0, but 1
 		require.True(t, signature.IsInvalidSigTypesError(err), "API-level error should be InvalidSigTypesError")
 		require.ErrorIs(t, err, signature.ErrIllegallyPaddedBitVector, "low-level error representing the failure should be ErrIllegallyPaddedBitVector")
@@ -269,11 +270,11 @@ func TestValidPaddingErrIllegallyPaddedBitVector(t *testing.T) {
 func Test_EncodeSignersToIndices(t *testing.T) {
 	rapid.Check(t, func(t *rapid.T) {
 		// select total committee size, number of random beacon signers and number of staking signers
-		committeeSize := rapid.IntRange(1, 272).Draw(t, "committeeSize").(int)
-		numSigners := rapid.IntRange(0, committeeSize).Draw(t, "numSigners").(int)
+		committeeSize := rapid.IntRange(1, 272).Draw(t, "committeeSize")
+		numSigners := rapid.IntRange(0, committeeSize).Draw(t, "numSigners")
 
 		// create committee
-		identities := unittest.IdentityListFixture(committeeSize, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical)
+		identities := unittest.IdentityListFixture(committeeSize, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical[flow.Identity])
 		committee := identities.NodeIDs()
 		signers, err := committee.Sample(uint(numSigners))
 		require.NoError(t, err)
@@ -299,11 +300,11 @@ func Test_EncodeSignersToIndices(t *testing.T) {
 func Test_DecodeSignerIndicesToIdentifiers(t *testing.T) {
 	rapid.Check(t, func(t *rapid.T) {
 		// select total committee size, number of random beacon signers and number of staking signers
-		committeeSize := rapid.IntRange(1, 272).Draw(t, "committeeSize").(int)
-		numSigners := rapid.IntRange(0, committeeSize).Draw(t, "numSigners").(int)
+		committeeSize := rapid.IntRange(1, 272).Draw(t, "committeeSize")
+		numSigners := rapid.IntRange(0, committeeSize).Draw(t, "numSigners")
 
 		// create committee
-		identities := unittest.IdentityListFixture(committeeSize, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical)
+		identities := unittest.IdentityListFixture(committeeSize, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical[flow.Identity])
 		committee := identities.NodeIDs()
 		signers, err := committee.Sample(uint(numSigners))
 		require.NoError(t, err)
@@ -333,25 +334,26 @@ func Test_DecodeSignerIndicesToIdentifiers(t *testing.T) {
 const UpperBoundCommitteeSize = 272
 
 func Test_DecodeSignerIndicesToIdentities(t *testing.T) {
-
 	rapid.Check(t, func(t *rapid.T) {
 		// select total committee size, number of random beacon signers and number of staking signers
-		committeeSize := rapid.IntRange(1, UpperBoundCommitteeSize).Draw(t, "committeeSize").(int)
-		numSigners := rapid.IntRange(0, committeeSize).Draw(t, "numSigners").(int)
+		committeeSize := rapid.IntRange(1, UpperBoundCommitteeSize).Draw(t, "committeeSize")
+		numSigners := rapid.IntRange(0, committeeSize).Draw(t, "numSigners")
 
 		// create committee
-		identities := unittest.IdentityListFixture(committeeSize, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical)
-		signers, err := identities.Sample(uint(numSigners))
+		identities := unittest.IdentityListFixture(committeeSize, unittest.WithRole(flow.RoleConsensus)).Sort(flow.Canonical[flow.Identity])
+		fullSigners, err := identities.Sample(uint(numSigners))
 		require.NoError(t, err)
+		signers := fullSigners.ToSkeleton()
 
 		// encode
 		signerIndices, err := signature.EncodeSignersToIndices(identities.NodeIDs(), signers.NodeIDs())
 		require.NoError(t, err)
 
 		// decode and verify
-		decodedSigners, err := signature.DecodeSignerIndicesToIdentities(identities, signerIndices)
+		decodedSigners, err := signature.DecodeSignerIndicesToIdentities(identities.ToSkeleton(), signerIndices)
 		require.NoError(t, err)
-		require.Equal(t, signers.Sort(flow.Canonical), decodedSigners.Sort(flow.Canonical))
+
+		require.Equal(t, signers.Sort(flow.Canonical[flow.IdentitySkeleton]), decodedSigners.Sort(flow.Canonical[flow.IdentitySkeleton]))
 	})
 }
 
diff --git a/module/state_synchronization/index_reporter.go b/module/state_synchronization/index_reporter.go
index 4863b1e235e..2498cbaa03c 100644
--- a/module/state_synchronization/index_reporter.go
+++ b/module/state_synchronization/index_reporter.go
@@ -3,7 +3,7 @@ package state_synchronization
 // IndexReporter provides information about the current state of the execution state indexer.
 type IndexReporter interface {
 	// LowestIndexedHeight returns the lowest height indexed by the execution state indexer.
-	LowestIndexedHeight() uint64
+	LowestIndexedHeight() (uint64, error)
 	// HighestIndexedHeight returns the highest height indexed by the execution state indexer.
-	HighestIndexedHeight() uint64
+	HighestIndexedHeight() (uint64, error)
 }
diff --git a/module/state_synchronization/indexer/collection_executed_metric.go b/module/state_synchronization/indexer/collection_executed_metric.go
new file mode 100644
index 00000000000..814afbb3325
--- /dev/null
+++ b/module/state_synchronization/indexer/collection_executed_metric.go
@@ -0,0 +1,148 @@
+package indexer
+
+import (
+	"errors"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module"
+	"github.com/onflow/flow-go/module/mempool/stdmap"
+	"github.com/onflow/flow-go/storage"
+)
+
+var _ module.CollectionExecutedMetric = (*CollectionExecutedMetricImpl)(nil)
+
+// CollectionExecutedMetricImpl tracks metrics to measure how long it takes for tx to reach each step in their lifecycle
+type CollectionExecutedMetricImpl struct {
+	log zerolog.Logger // used to log relevant actions with context
+
+	accessMetrics              module.AccessMetrics
+	collectionsToMarkFinalized *stdmap.Times
+	collectionsToMarkExecuted  *stdmap.Times
+	blocksToMarkExecuted       *stdmap.Times
+
+	collections storage.Collections
+	blocks      storage.Blocks
+}
+
+func NewCollectionExecutedMetricImpl(
+	log zerolog.Logger,
+	accessMetrics module.AccessMetrics,
+	collectionsToMarkFinalized *stdmap.Times,
+	collectionsToMarkExecuted *stdmap.Times,
+	blocksToMarkExecuted *stdmap.Times,
+	collections storage.Collections,
+	blocks storage.Blocks,
+) (*CollectionExecutedMetricImpl, error) {
+	return &CollectionExecutedMetricImpl{
+		log:                        log,
+		accessMetrics:              accessMetrics,
+		collectionsToMarkFinalized: collectionsToMarkFinalized,
+		collectionsToMarkExecuted:  collectionsToMarkExecuted,
+		blocksToMarkExecuted:       blocksToMarkExecuted,
+		collections:                collections,
+		blocks:                     blocks,
+	}, nil
+}
+
+// CollectionFinalized tracks collections to mark finalized
+func (c *CollectionExecutedMetricImpl) CollectionFinalized(light flow.LightCollection) {
+	if ti, found := c.collectionsToMarkFinalized.ByID(light.ID()); found {
+		for _, t := range light.Transactions {
+			c.accessMetrics.TransactionFinalized(t, ti)
+		}
+		c.collectionsToMarkFinalized.Remove(light.ID())
+	}
+}
+
+// CollectionExecuted tracks collections to mark executed
+func (c *CollectionExecutedMetricImpl) CollectionExecuted(light flow.LightCollection) {
+	if ti, found := c.collectionsToMarkExecuted.ByID(light.ID()); found {
+		for _, t := range light.Transactions {
+			c.accessMetrics.TransactionExecuted(t, ti)
+		}
+		c.collectionsToMarkExecuted.Remove(light.ID())
+	}
+}
+
+// BlockFinalized tracks finalized metric for block
+func (c *CollectionExecutedMetricImpl) BlockFinalized(block *flow.Block) {
+	// TODO: lookup actual finalization time by looking at the block finalizing `b`
+	now := time.Now().UTC()
+	blockID := block.ID()
+
+	// mark all transactions as finalized
+	// TODO: sample to reduce performance overhead
+	for _, g := range block.Payload.Guarantees {
+		l, err := c.collections.LightByID(g.CollectionID)
+		if errors.Is(err, storage.ErrNotFound) {
+			c.collectionsToMarkFinalized.Add(g.CollectionID, now)
+			continue
+		} else if err != nil {
+			c.log.Warn().Err(err).Str("collection_id", g.CollectionID.String()).
+				Msg("could not track tx finalized metric: finalized collection not found locally")
+			continue
+		}
+
+		for _, t := range l.Transactions {
+			c.accessMetrics.TransactionFinalized(t, now)
+		}
+	}
+
+	if ti, found := c.blocksToMarkExecuted.ByID(blockID); found {
+		c.blockExecuted(block, ti)
+		c.accessMetrics.UpdateExecutionReceiptMaxHeight(block.Header.Height)
+		c.blocksToMarkExecuted.Remove(blockID)
+	}
+}
+
+// ExecutionReceiptReceived tracks execution receipt metrics
+func (c *CollectionExecutedMetricImpl) ExecutionReceiptReceived(r *flow.ExecutionReceipt) {
+	// TODO add actual execution time to execution receipt?
+	now := time.Now().UTC()
+
+	// retrieve the block
+	// TODO: consider using storage.Index.ByBlockID, the index contains collection id and seals ID
+	b, err := c.blocks.ByID(r.ExecutionResult.BlockID)
+
+	if errors.Is(err, storage.ErrNotFound) {
+		c.blocksToMarkExecuted.Add(r.ExecutionResult.BlockID, now)
+		return
+	}
+
+	if err != nil {
+		c.log.Warn().Err(err).Msg("could not track tx executed metric: executed block not found locally")
+		return
+	}
+
+	c.accessMetrics.UpdateExecutionReceiptMaxHeight(b.Header.Height)
+
+	c.blockExecuted(b, now)
+}
+
+func (c *CollectionExecutedMetricImpl) UpdateLastFullBlockHeight(height uint64) {
+	c.accessMetrics.UpdateLastFullBlockHeight(height)
+}
+
+// blockExecuted tracks executed metric for block
+func (c *CollectionExecutedMetricImpl) blockExecuted(block *flow.Block, ti time.Time) {
+	// mark all transactions as executed
+	// TODO: sample to reduce performance overhead
+	for _, g := range block.Payload.Guarantees {
+		l, err := c.collections.LightByID(g.CollectionID)
+		if errors.Is(err, storage.ErrNotFound) {
+			c.collectionsToMarkExecuted.Add(g.CollectionID, ti)
+			continue
+		} else if err != nil {
+			c.log.Warn().Err(err).Str("collection_id", g.CollectionID.String()).
+				Msg("could not track tx executed metric: executed collection not found locally")
+			continue
+		}
+
+		for _, t := range l.Transactions {
+			c.accessMetrics.TransactionExecuted(t, ti)
+		}
+	}
+}
diff --git a/module/state_synchronization/indexer/indexer.go b/module/state_synchronization/indexer/indexer.go
index e3fcaa2551b..3e180b1130e 100644
--- a/module/state_synchronization/indexer/indexer.go
+++ b/module/state_synchronization/indexer/indexer.go
@@ -1,6 +1,7 @@
 package indexer
 
 import (
+	"errors"
 	"fmt"
 	"time"
 
@@ -28,6 +29,12 @@ const (
 	fetchTimeout = 30 * time.Second
 )
 
+// ErrIndexNotInitialized is returned when the indexer is not initialized
+//
+// This generally indicates that the index databases are still being initialized, and trying again
+// later may succeed
+var ErrIndexNotInitialized = errors.New("index not initialized")
+
 var _ state_synchronization.IndexReporter = (*Indexer)(nil)
 
 // Indexer handles ingestion of new execution data available and uses the execution data indexer module
@@ -96,19 +103,26 @@ func (i *Indexer) Start(ctx irrecoverable.SignalerContext) {
 }
 
 // LowestIndexedHeight returns the lowest height indexed by the execution indexer.
-func (i *Indexer) LowestIndexedHeight() uint64 {
+func (i *Indexer) LowestIndexedHeight() (uint64, error) {
 	// TODO: use a separate value to track the lowest indexed height. We're using the registers db's
 	// value here to start because it's convenient. When pruning support is added, this will need to
 	// be updated.
-	return i.registers.FirstHeight()
+	return i.registers.FirstHeight(), nil
 }
 
 // HighestIndexedHeight returns the highest height indexed by the execution indexer.
-func (i *Indexer) HighestIndexedHeight() uint64 {
+func (i *Indexer) HighestIndexedHeight() (uint64, error) {
+	select {
+	case <-i.jobConsumer.Ready():
+	default:
+		// LastProcessedIndex is not meaningful until the component has completed startup
+		return 0, fmt.Errorf("HighestIndexedHeight must not be called before the component is ready")
+	}
+
 	// The jobqueue maintains its own highest indexed height value, separate from the register db.
 	// Since jobs are only marked complete when ALL data is indexed, the lastProcessedIndex must
 	// be strictly less than or equal to the register db's LatestHeight.
-	return i.jobConsumer.LastProcessedIndex()
+	return i.jobConsumer.LastProcessedIndex(), nil
 }
 
 // OnExecutionData is used to notify when new execution data is downloaded by the execution data requester jobqueue.
diff --git a/module/state_synchronization/indexer/indexer_core.go b/module/state_synchronization/indexer/indexer_core.go
index fdeb76b62d7..67cd54e42d1 100644
--- a/module/state_synchronization/indexer/indexer_core.go
+++ b/module/state_synchronization/indexer/indexer_core.go
@@ -8,7 +8,6 @@ import (
 	"github.com/rs/zerolog"
 	"golang.org/x/sync/errgroup"
 
-	"github.com/onflow/flow-go/engine/common/requester"
 	"github.com/onflow/flow-go/ledger"
 	"github.com/onflow/flow-go/ledger/common/convert"
 	"github.com/onflow/flow-go/model/flow"
@@ -24,13 +23,15 @@ type IndexerCore struct {
 	log     zerolog.Logger
 	metrics module.ExecutionStateIndexerMetrics
 
-	registers storage.RegisterIndex
-	headers   storage.Headers
-	events    storage.Events
-	results   storage.LightTransactionResults
-	batcher   bstorage.BatchBuilder
+	registers    storage.RegisterIndex
+	headers      storage.Headers
+	events       storage.Events
+	collections  storage.Collections
+	transactions storage.Transactions
+	results      storage.LightTransactionResults
+	batcher      bstorage.BatchBuilder
 
-	collectionHandler requester.HandleFunc
+	collectionExecutedMetric module.CollectionExecutedMetric
 }
 
 // New execution state indexer used to ingest block execution data and index it by height.
@@ -43,8 +44,10 @@ func New(
 	registers storage.RegisterIndex,
 	headers storage.Headers,
 	events storage.Events,
+	collections storage.Collections,
+	transactions storage.Transactions,
 	results storage.LightTransactionResults,
-	collectionHandler requester.HandleFunc,
+	collectionExecutedMetric module.CollectionExecutedMetric,
 ) (*IndexerCore, error) {
 	log = log.With().Str("component", "execution_indexer").Logger()
 	metrics.InitializeLatestHeight(registers.LatestHeight())
@@ -55,15 +58,16 @@ func New(
 		Msg("indexer initialized")
 
 	return &IndexerCore{
-		log:       log,
-		metrics:   metrics,
-		batcher:   batcher,
-		registers: registers,
-		headers:   headers,
-		events:    events,
-		results:   results,
-
-		collectionHandler: collectionHandler,
+		log:                      log,
+		metrics:                  metrics,
+		batcher:                  batcher,
+		registers:                registers,
+		headers:                  headers,
+		events:                   events,
+		collections:              collections,
+		transactions:             transactions,
+		results:                  results,
+		collectionExecutedMetric: collectionExecutedMetric,
 	}, nil
 }
 
@@ -173,7 +177,10 @@ func (c *IndexerCore) IndexBlockData(data *execution_data.BlockExecutionDataEnti
 		indexedCount := 0
 		if len(data.ChunkExecutionDatas) > 0 {
 			for _, chunk := range data.ChunkExecutionDatas[0 : len(data.ChunkExecutionDatas)-1] {
-				c.collectionHandler(flow.ZeroID, chunk.Collection)
+				err := HandleCollection(chunk.Collection, c.collections, c.transactions, c.log, c.collectionExecutedMetric)
+				if err != nil {
+					return fmt.Errorf("could not handle collection")
+				}
 				indexedCount++
 			}
 		}
@@ -260,3 +267,46 @@ func (c *IndexerCore) indexRegisters(registers map[ledger.Path]*ledger.Payload,
 
 	return c.registers.Store(regEntries, height)
 }
+
+// HandleCollection handles the response of the a collection request made earlier when a block was received.
+// No errors expected during normal operations.
+func HandleCollection(
+	collection *flow.Collection,
+	collections storage.Collections,
+	transactions storage.Transactions,
+	logger zerolog.Logger,
+	collectionExecutedMetric module.CollectionExecutedMetric,
+) error {
+
+	light := collection.Light()
+
+	collectionExecutedMetric.CollectionFinalized(light)
+	collectionExecutedMetric.CollectionExecuted(light)
+
+	// FIX: we can't index guarantees here, as we might have more than one block
+	// with the same collection as long as it is not finalized
+
+	// store the light collection (collection minus the transaction body - those are stored separately)
+	// and add transaction ids as index
+	err := collections.StoreLightAndIndexByTransaction(&light)
+	if err != nil {
+		// ignore collection if already seen
+		if errors.Is(err, storage.ErrAlreadyExists) {
+			logger.Debug().
+				Hex("collection_id", logging.Entity(light)).
+				Msg("collection is already seen")
+			return nil
+		}
+		return err
+	}
+
+	// now store each of the transaction body
+	for _, tx := range collection.Transactions {
+		err := transactions.Store(tx)
+		if err != nil {
+			return fmt.Errorf("could not store transaction (%x): %w", tx.ID(), err)
+		}
+	}
+
+	return nil
+}
diff --git a/module/state_synchronization/indexer/indexer_core_test.go b/module/state_synchronization/indexer/indexer_core_test.go
index 73c0174105f..cf5b907f664 100644
--- a/module/state_synchronization/indexer/indexer_core_test.go
+++ b/module/state_synchronization/indexer/indexer_core_test.go
@@ -14,13 +14,13 @@ import (
 	mocks "github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 
-	"github.com/onflow/flow-go/engine/common/requester"
 	"github.com/onflow/flow-go/ledger"
 	"github.com/onflow/flow-go/ledger/common/convert"
 	"github.com/onflow/flow-go/ledger/common/pathfinder"
 	"github.com/onflow/flow-go/ledger/complete"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/executiondatasync/execution_data"
+	"github.com/onflow/flow-go/module/mempool/stdmap"
 	"github.com/onflow/flow-go/module/metrics"
 	synctest "github.com/onflow/flow-go/module/state_synchronization/requester/unittest"
 	"github.com/onflow/flow-go/storage"
@@ -29,24 +29,24 @@ import (
 	"github.com/onflow/flow-go/utils/unittest"
 )
 
-var noopHandlerFunc requester.HandleFunc = func(originID flow.Identifier, entity flow.Entity) {}
-
 type indexCoreTest struct {
-	t                 *testing.T
-	indexer           *IndexerCore
-	registers         *storagemock.RegisterIndex
-	events            *storagemock.Events
-	results           *storagemock.LightTransactionResults
-	headers           *storagemock.Headers
-	ctx               context.Context
-	blocks            []*flow.Block
-	collectionHandler requester.HandleFunc
-	data              *execution_data.BlockExecutionDataEntity
-	lastHeightStore   func(t *testing.T) uint64
-	firstHeightStore  func(t *testing.T) uint64
-	registersStore    func(t *testing.T, entries flow.RegisterEntries, height uint64) error
-	eventsStore       func(t *testing.T, ID flow.Identifier, events []flow.EventsList) error
-	registersGet      func(t *testing.T, IDs flow.RegisterID, height uint64) (flow.RegisterValue, error)
+	t                *testing.T
+	indexer          *IndexerCore
+	registers        *storagemock.RegisterIndex
+	events           *storagemock.Events
+	collection       *flow.Collection
+	collections      *storagemock.Collections
+	transactions     *storagemock.Transactions
+	results          *storagemock.LightTransactionResults
+	headers          *storagemock.Headers
+	ctx              context.Context
+	blocks           []*flow.Block
+	data             *execution_data.BlockExecutionDataEntity
+	lastHeightStore  func(t *testing.T) uint64
+	firstHeightStore func(t *testing.T) uint64
+	registersStore   func(t *testing.T, entries flow.RegisterEntries, height uint64) error
+	eventsStore      func(t *testing.T, ID flow.Identifier, events []flow.EventsList) error
+	registersGet     func(t *testing.T, IDs flow.RegisterID, height uint64) (flow.RegisterValue, error)
 }
 
 func newIndexCoreTest(
@@ -54,22 +54,21 @@ func newIndexCoreTest(
 	blocks []*flow.Block,
 	exeData *execution_data.BlockExecutionDataEntity,
 ) *indexCoreTest {
+
+	collection := unittest.CollectionFixture(0)
+
 	return &indexCoreTest{
-		t:         t,
-		registers: storagemock.NewRegisterIndex(t),
-		events:    storagemock.NewEvents(t),
-		results:   storagemock.NewLightTransactionResults(t),
-		blocks:    blocks,
-		ctx:       context.Background(),
-		data:      exeData,
-		headers:   newBlockHeadersStorage(blocks).(*storagemock.Headers), // convert it back to mock type for tests
-		collectionHandler: func(originID flow.Identifier, entity flow.Entity) {
-			// collectionHandler is always called. by default, assert the value passed was empty
-			// to enforce the test writer handles the collection when it's tested.
-			// this will never happen in production.
-			assert.Equal(t, flow.ZeroID, originID)
-			assert.Nil(t, entity)
-		},
+		t:            t,
+		registers:    storagemock.NewRegisterIndex(t),
+		events:       storagemock.NewEvents(t),
+		collection:   &collection,
+		results:      storagemock.NewLightTransactionResults(t),
+		collections:  storagemock.NewCollections(t),
+		transactions: storagemock.NewTransactions(t),
+		blocks:       blocks,
+		ctx:          context.Background(),
+		data:         exeData,
+		headers:      newBlockHeadersStorage(blocks).(*storagemock.Headers), // convert it back to mock type for tests,
 	}
 }
 
@@ -149,8 +148,11 @@ func (i *indexCoreTest) setGetRegisters(f func(t *testing.T, ID flow.RegisterID,
 	return i
 }
 
-func (i *indexCoreTest) setOnCollection(fn requester.HandleFunc) *indexCoreTest {
-	i.collectionHandler = fn
+func (i *indexCoreTest) useDefaultStorageMocks() *indexCoreTest {
+
+	i.collections.On("StoreLightAndIndexByTransaction", mock.AnythingOfType("*flow.LightCollection")).Return(nil).Maybe()
+	i.transactions.On("Store", mock.AnythingOfType("*flow.TransactionBody")).Return(nil).Maybe()
+
 	return i
 }
 
@@ -177,11 +179,29 @@ func (i *indexCoreTest) initIndexer() *indexCoreTest {
 
 	i.useDefaultHeights()
 
-	onCollection := func(originID flow.Identifier, entity flow.Entity) {
-		i.collectionHandler(originID, entity)
-	}
+	collectionsToMarkFinalized, err := stdmap.NewTimes(100)
+	require.NoError(i.t, err)
+	collectionsToMarkExecuted, err := stdmap.NewTimes(100)
+	require.NoError(i.t, err)
+	blocksToMarkExecuted, err := stdmap.NewTimes(100)
+	require.NoError(i.t, err)
+
+	log := zerolog.New(os.Stdout)
+	blocks := storagemock.NewBlocks(i.t)
+
+	collectionExecutedMetric, err := NewCollectionExecutedMetricImpl(
+		log,
+		metrics.NewNoopCollector(),
+		collectionsToMarkFinalized,
+		collectionsToMarkExecuted,
+		blocksToMarkExecuted,
+		i.collections,
+		blocks,
+	)
+	require.NoError(i.t, err)
 
-	indexer, err := New(zerolog.New(os.Stdout), metrics.NewNoopCollector(), db, i.registers, i.headers, i.events, i.results, onCollection)
+	indexer, err := New(log, metrics.NewNoopCollector(), db, i.registers, i.headers, i.events,
+		i.collections, i.transactions, i.results, collectionExecutedMetric)
 	require.NoError(i.t, err)
 	i.indexer = indexer
 	return i
@@ -200,6 +220,7 @@ func (i *indexCoreTest) runGetRegister(ID flow.RegisterID, height uint64) (flow.
 func TestExecutionState_IndexBlockData(t *testing.T) {
 	blocks := unittest.BlockchainFixture(5)
 	block := blocks[len(blocks)-1]
+	collection := unittest.CollectionFixture(0)
 
 	// this test makes sure the index block data is correctly calling store register with the
 	// same entries we create as a block execution data test, and correctly converts the registers
@@ -208,7 +229,10 @@ func TestExecutionState_IndexBlockData(t *testing.T) {
 		ed := &execution_data.BlockExecutionData{
 			BlockID: block.ID(),
 			ChunkExecutionDatas: []*execution_data.ChunkExecutionData{
-				{TrieUpdate: trie},
+				{
+					Collection: &collection,
+					TrieUpdate: trie,
+				},
 			},
 		}
 		execData := execution_data.NewBlockExecutionDataEntity(block.ID(), ed)
@@ -249,8 +273,14 @@ func TestExecutionState_IndexBlockData(t *testing.T) {
 		ed := &execution_data.BlockExecutionData{
 			BlockID: block.ID(),
 			ChunkExecutionDatas: []*execution_data.ChunkExecutionData{
-				{TrieUpdate: tries[0]},
-				{TrieUpdate: tries[1]},
+				{
+					Collection: &collection,
+					TrieUpdate: tries[0],
+				},
+				{
+					Collection: &collection,
+					TrieUpdate: tries[1],
+				},
 			},
 		}
 		execData := execution_data.NewBlockExecutionDataEntity(block.ID(), ed)
@@ -259,6 +289,7 @@ func TestExecutionState_IndexBlockData(t *testing.T) {
 		err = newIndexCoreTest(t, blocks, execData).
 			initIndexer().
 			useDefaultEvents().
+			useDefaultStorageMocks().
 			useDefaultTransactionResults().
 			// make sure update registers match in length and are same as block data ledger payloads
 			setStoreRegisters(func(t *testing.T, entries flow.RegisterEntries, height uint64) error {
@@ -285,14 +316,21 @@ func TestExecutionState_IndexBlockData(t *testing.T) {
 			BlockID: block.ID(),
 			ChunkExecutionDatas: []*execution_data.ChunkExecutionData{
 				// split events into 2 chunks
-				{Events: expectedEvents[:10]},
-				{Events: expectedEvents[10:]},
+				{
+					Collection: &collection,
+					Events:     expectedEvents[:10],
+				},
+				{
+					Collection: &collection,
+					Events:     expectedEvents[10:],
+				},
 			},
 		}
 		execData := execution_data.NewBlockExecutionDataEntity(block.ID(), ed)
 
 		err := newIndexCoreTest(t, blocks, execData).
 			initIndexer().
+			useDefaultStorageMocks().
 			// make sure all events are stored at once in order
 			setStoreEvents(func(t *testing.T, actualBlockID flow.Identifier, actualEvents []flow.EventsList) error {
 				assert.Equal(t, block.ID(), actualBlockID)
@@ -326,14 +364,21 @@ func TestExecutionState_IndexBlockData(t *testing.T) {
 			BlockID: block.ID(),
 			ChunkExecutionDatas: []*execution_data.ChunkExecutionData{
 				// split events into 2 chunks
-				{TransactionResults: expectedResults[:10]},
-				{TransactionResults: expectedResults[10:]},
+				{
+					Collection:         &collection,
+					TransactionResults: expectedResults[:10],
+				},
+				{
+					Collection:         &collection,
+					TransactionResults: expectedResults[10:],
+				},
 			},
 		}
 		execData := execution_data.NewBlockExecutionDataEntity(block.ID(), ed)
 
 		err := newIndexCoreTest(t, blocks, execData).
 			initIndexer().
+			useDefaultStorageMocks().
 			// make sure an empty set of events were stored
 			setStoreEvents(func(t *testing.T, actualBlockID flow.Identifier, actualEvents []flow.EventsList) error {
 				assert.Equal(t, block.ID(), actualBlockID)
@@ -371,9 +416,9 @@ func TestExecutionState_IndexBlockData(t *testing.T) {
 			},
 		}
 		execData := execution_data.NewBlockExecutionDataEntity(block.ID(), ed)
-		collectionsHandled := 0
 		err := newIndexCoreTest(t, blocks, execData).
 			initIndexer().
+			useDefaultStorageMocks().
 			// make sure an empty set of events were stored
 			setStoreEvents(func(t *testing.T, actualBlockID flow.Identifier, actualEvents []flow.EventsList) error {
 				assert.Equal(t, block.ID(), actualBlockID)
@@ -387,14 +432,6 @@ func TestExecutionState_IndexBlockData(t *testing.T) {
 				require.Len(t, actualResults, 0)
 				return nil
 			}).
-			setOnCollection(func(_ flow.Identifier, entity flow.Entity) {
-				require.Less(t, collectionsHandled, len(expectedCollections), "more collections handled than expected")
-
-				actual, ok := entity.(*flow.Collection)
-				require.True(t, ok)
-				assert.Equal(t, expectedCollections[collectionsHandled], actual)
-				collectionsHandled++
-			}).
 			// make sure an empty set of register entries was stored
 			setStoreRegisters(func(t *testing.T, entries flow.RegisterEntries, height uint64) error {
 				assert.Equal(t, height, block.Header.Height)
@@ -434,9 +471,9 @@ func TestExecutionState_IndexBlockData(t *testing.T) {
 			},
 		}
 		execData := execution_data.NewBlockExecutionDataEntity(block.ID(), ed)
-		collectionsHandled := 0
 		err := newIndexCoreTest(t, blocks, execData).
 			initIndexer().
+			useDefaultStorageMocks().
 			// make sure all events are stored at once in order
 			setStoreEvents(func(t *testing.T, actualBlockID flow.Identifier, actualEvents []flow.EventsList) error {
 				assert.Equal(t, block.ID(), actualBlockID)
@@ -456,14 +493,6 @@ func TestExecutionState_IndexBlockData(t *testing.T) {
 				}
 				return nil
 			}).
-			setOnCollection(func(_ flow.Identifier, entity flow.Entity) {
-				require.Less(t, collectionsHandled, len(expectedCollections), "more collections handled than expected")
-
-				actual, ok := entity.(*flow.Collection)
-				require.True(t, ok)
-				assert.Equal(t, expectedCollections[collectionsHandled], actual)
-				collectionsHandled++
-			}).
 			// make sure update registers match in length and are same as block data ledger payloads
 			setStoreRegisters(func(t *testing.T, entries flow.RegisterEntries, actualHeight uint64) error {
 				assert.Equal(t, actualHeight, block.Header.Height)
@@ -634,7 +663,8 @@ func TestIndexerIntegration_StoreAndGet(t *testing.T) {
 	// this test makes sure index values for a single register are correctly updated and always last value is returned
 	t.Run("Single Index Value Changes", func(t *testing.T) {
 		pebbleStorage.RunWithRegistersStorageAtInitialHeights(t, 0, 0, func(registers *pebbleStorage.Registers) {
-			index, err := New(logger, metrics, db, registers, nil, nil, nil, noopHandlerFunc)
+			index, err := New(logger, metrics, db, registers,
+				nil, nil, nil, nil, nil, nil)
 			require.NoError(t, err)
 
 			values := [][]byte{[]byte("1"), []byte("1"), []byte("2"), []byte("3"), []byte("4")}
@@ -655,7 +685,8 @@ func TestIndexerIntegration_StoreAndGet(t *testing.T) {
 	// up to the specification script executor requires
 	t.Run("Missing Register", func(t *testing.T) {
 		pebbleStorage.RunWithRegistersStorageAtInitialHeights(t, 0, 0, func(registers *pebbleStorage.Registers) {
-			index, err := New(logger, metrics, db, registers, nil, nil, nil, noopHandlerFunc)
+			index, err := New(logger, metrics, db, registers,
+				nil, nil, nil, nil, nil, nil)
 			require.NoError(t, err)
 
 			value, err := index.RegisterValue(registerID, 0)
@@ -669,7 +700,8 @@ func TestIndexerIntegration_StoreAndGet(t *testing.T) {
 	// e.g. we index A{h(1) -> X}, A{h(2) -> Y}, when we request h(4) we get value Y
 	t.Run("Single Index Value At Later Heights", func(t *testing.T) {
 		pebbleStorage.RunWithRegistersStorageAtInitialHeights(t, 0, 0, func(registers *pebbleStorage.Registers) {
-			index, err := New(logger, metrics, db, registers, nil, nil, nil, noopHandlerFunc)
+			index, err := New(logger, metrics, db, registers,
+				nil, nil, nil, nil, nil, nil)
 			require.NoError(t, err)
 
 			storeValues := [][]byte{[]byte("1"), []byte("2")}
@@ -700,7 +732,8 @@ func TestIndexerIntegration_StoreAndGet(t *testing.T) {
 	// this test makes sure we correctly handle weird payloads
 	t.Run("Empty and Nil Payloads", func(t *testing.T) {
 		pebbleStorage.RunWithRegistersStorageAtInitialHeights(t, 0, 0, func(registers *pebbleStorage.Registers) {
-			index, err := New(logger, metrics, db, registers, nil, nil, nil, noopHandlerFunc)
+			index, err := New(logger, metrics, db, registers,
+				nil, nil, nil, nil, nil, nil)
 			require.NoError(t, err)
 
 			require.NoError(t, index.indexRegisters(map[ledger.Path]*ledger.Payload{}, 1))
diff --git a/module/state_synchronization/mock/index_reporter.go b/module/state_synchronization/mock/index_reporter.go
index 3de0696a8b5..f8fce21feda 100644
--- a/module/state_synchronization/mock/index_reporter.go
+++ b/module/state_synchronization/mock/index_reporter.go
@@ -10,31 +10,51 @@ type IndexReporter struct {
 }
 
 // HighestIndexedHeight provides a mock function with given fields:
-func (_m *IndexReporter) HighestIndexedHeight() uint64 {
+func (_m *IndexReporter) HighestIndexedHeight() (uint64, error) {
 	ret := _m.Called()
 
 	var r0 uint64
+	var r1 error
+	if rf, ok := ret.Get(0).(func() (uint64, error)); ok {
+		return rf()
+	}
 	if rf, ok := ret.Get(0).(func() uint64); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(uint64)
 	}
 
-	return r0
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
 }
 
 // LowestIndexedHeight provides a mock function with given fields:
-func (_m *IndexReporter) LowestIndexedHeight() uint64 {
+func (_m *IndexReporter) LowestIndexedHeight() (uint64, error) {
 	ret := _m.Called()
 
 	var r0 uint64
+	var r1 error
+	if rf, ok := ret.Get(0).(func() (uint64, error)); ok {
+		return rf()
+	}
 	if rf, ok := ret.Get(0).(func() uint64); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(uint64)
 	}
 
-	return r0
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
 }
 
 type mockConstructorTestingTNewIndexReporter interface {
diff --git a/module/state_synchronization/requester/distributer.go b/module/state_synchronization/requester/distributer.go
index ded5ebb95a2..ac97fb07982 100644
--- a/module/state_synchronization/requester/distributer.go
+++ b/module/state_synchronization/requester/distributer.go
@@ -11,7 +11,7 @@ import (
 // distributes them to subscribers
 type ExecutionDataDistributor struct {
 	consumers []state_synchronization.OnExecutionDataReceivedConsumer
-	lock      sync.Mutex
+	lock      sync.RWMutex
 }
 
 func NewExecutionDataDistributor() *ExecutionDataDistributor {
@@ -28,8 +28,8 @@ func (p *ExecutionDataDistributor) AddOnExecutionDataReceivedConsumer(consumer s
 
 // OnExecutionDataReceived is called when new execution data is received
 func (p *ExecutionDataDistributor) OnExecutionDataReceived(executionData *execution_data.BlockExecutionDataEntity) {
-	p.lock.Lock()
-	defer p.lock.Unlock()
+	p.lock.RLock()
+	defer p.lock.RUnlock()
 
 	for _, consumer := range p.consumers {
 		consumer(executionData)
diff --git a/module/state_synchronization/requester/execution_data_requester_test.go b/module/state_synchronization/requester/execution_data_requester_test.go
index b85ce646fa2..e753f8dddad 100644
--- a/module/state_synchronization/requester/execution_data_requester_test.go
+++ b/module/state_synchronization/requester/execution_data_requester_test.go
@@ -18,7 +18,7 @@ import (
 
 	"github.com/onflow/flow-go/consensus/hotstuff/model"
 	"github.com/onflow/flow-go/consensus/hotstuff/notifications/pubsub"
-	"github.com/onflow/flow-go/engine/access/state_stream"
+	"github.com/onflow/flow-go/engine/access/subscription"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module"
 	"github.com/onflow/flow-go/module/blobs"
@@ -408,7 +408,7 @@ func (suite *ExecutionDataRequesterSuite) prepareRequesterTest(cfg *fetchTestRun
 	suite.downloader = mockDownloader(cfg.executionDataEntries)
 	suite.distributor = requester.NewExecutionDataDistributor()
 
-	heroCache := herocache.NewBlockExecutionData(state_stream.DefaultCacheSize, logger, metrics)
+	heroCache := herocache.NewBlockExecutionData(subscription.DefaultCacheSize, logger, metrics)
 	cache := cache.NewExecutionDataCache(suite.downloader, headers, seals, results, heroCache)
 
 	followerDistributor := pubsub.NewFollowerDistributor()
@@ -789,18 +789,19 @@ func (m *mockSnapshot) Head() (*flow.Header, error) {
 
 // none of these are used in this test
 func (m *mockSnapshot) QuorumCertificate() (*flow.QuorumCertificate, error) { return nil, nil }
-func (m *mockSnapshot) Identities(selector flow.IdentityFilter) (flow.IdentityList, error) {
+func (m *mockSnapshot) Identities(selector flow.IdentityFilter[flow.Identity]) (flow.IdentityList, error) {
 	return nil, nil
 }
 func (m *mockSnapshot) Identity(nodeID flow.Identifier) (*flow.Identity, error) { return nil, nil }
 func (m *mockSnapshot) SealedResult() (*flow.ExecutionResult, *flow.Seal, error) {
 	return nil, nil, nil
 }
-func (m *mockSnapshot) Commit() (flow.StateCommitment, error)             { return flow.DummyStateCommitment, nil }
-func (m *mockSnapshot) SealingSegment() (*flow.SealingSegment, error)     { return nil, nil }
-func (m *mockSnapshot) Descendants() ([]flow.Identifier, error)           { return nil, nil }
-func (m *mockSnapshot) RandomSource() ([]byte, error)                     { return nil, nil }
-func (m *mockSnapshot) Phase() (flow.EpochPhase, error)                   { return flow.EpochPhaseUndefined, nil }
-func (m *mockSnapshot) Epochs() protocol.EpochQuery                       { return nil }
-func (m *mockSnapshot) Params() protocol.GlobalParams                     { return nil }
-func (m *mockSnapshot) VersionBeacon() (*flow.SealedVersionBeacon, error) { return nil, nil }
+func (m *mockSnapshot) Commit() (flow.StateCommitment, error)                 { return flow.DummyStateCommitment, nil }
+func (m *mockSnapshot) SealingSegment() (*flow.SealingSegment, error)         { return nil, nil }
+func (m *mockSnapshot) Descendants() ([]flow.Identifier, error)               { return nil, nil }
+func (m *mockSnapshot) RandomSource() ([]byte, error)                         { return nil, nil }
+func (m *mockSnapshot) Phase() (flow.EpochPhase, error)                       { return flow.EpochPhaseUndefined, nil }
+func (m *mockSnapshot) Epochs() protocol.EpochQuery                           { return nil }
+func (m *mockSnapshot) Params() protocol.GlobalParams                         { return nil }
+func (m *mockSnapshot) ProtocolState() (protocol.DynamicProtocolState, error) { return nil, nil }
+func (m *mockSnapshot) VersionBeacon() (*flow.SealedVersionBeacon, error)     { return nil, nil }
diff --git a/module/state_synchronization/requester/jobs/execution_data_reader_test.go b/module/state_synchronization/requester/jobs/execution_data_reader_test.go
index da6b515c72b..e4545aebee3 100644
--- a/module/state_synchronization/requester/jobs/execution_data_reader_test.go
+++ b/module/state_synchronization/requester/jobs/execution_data_reader_test.go
@@ -11,7 +11,6 @@ import (
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
 
-	"github.com/onflow/flow-go/engine/access/state_stream"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/executiondatasync/execution_data"
 	"github.com/onflow/flow-go/module/executiondatasync/execution_data/cache"
@@ -92,8 +91,9 @@ func (suite *ExecutionDataReaderSuite) reset() {
 	)
 
 	suite.downloader = new(exedatamock.Downloader)
+	var executionDataCacheSize uint32 = 100 // Use local value to avoid cycle dependency on subscription package
 
-	heroCache := herocache.NewBlockExecutionData(state_stream.DefaultCacheSize, unittest.Logger(), metrics.NewNoopCollector())
+	heroCache := herocache.NewBlockExecutionData(executionDataCacheSize, unittest.Logger(), metrics.NewNoopCollector())
 	cache := cache.NewExecutionDataCache(suite.downloader, suite.headers, suite.seals, suite.results, heroCache)
 
 	suite.reader = NewExecutionDataReader(
diff --git a/module/synchronization.go b/module/synchronization.go
index eda7145e891..fe78ecb7fc0 100644
--- a/module/synchronization.go
+++ b/module/synchronization.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package module
 
 import (
diff --git a/module/trace/constants.go b/module/trace/constants.go
index 2d333bdb5fc..0b349bc360c 100644
--- a/module/trace/constants.go
+++ b/module/trace/constants.go
@@ -12,6 +12,7 @@ const (
 	ProtoStateMutatorExtendCheckGuarantees SpanName = "proto.state.mutator.extend.checkGuarantees"
 	ProtoStateMutatorExtendCheckSeals      SpanName = "proto.state.mutator.extend.checkSeals"
 	ProtoStateMutatorExtendCheckReceipts   SpanName = "proto.state.mutator.extend.checkReceipts"
+	ProtoStateMutatorEvolveProtocolState   SpanName = "proto.state.mutator.extend.evolveProtocolState"
 	ProtoStateMutatorExtendDBInsert        SpanName = "proto.state.mutator.extend.dbInsert"
 
 	// HeaderExtend
diff --git a/module/upstream/upstream_connector.go b/module/upstream/upstream_connector.go
index d115aedee59..db8843cd619 100644
--- a/module/upstream/upstream_connector.go
+++ b/module/upstream/upstream_connector.go
@@ -20,7 +20,7 @@ import (
 // upstreamConnector tries to connect the unstaked AN with atleast one of the configured bootstrap access nodes
 type upstreamConnector struct {
 	lm                  *lifecycle.LifecycleManager
-	bootstrapIdentities flow.IdentityList
+	bootstrapIdentities flow.IdentitySkeletonList
 	logger              zerolog.Logger
 	unstakedNode        p2p.LibP2PNode
 	cancel              context.CancelFunc
@@ -28,7 +28,7 @@ type upstreamConnector struct {
 	maxRetries          uint64
 }
 
-func NewUpstreamConnector(bootstrapIdentities flow.IdentityList, unstakedNode p2p.LibP2PNode, logger zerolog.Logger) *upstreamConnector {
+func NewUpstreamConnector(bootstrapIdentities flow.IdentitySkeletonList, unstakedNode p2p.LibP2PNode, logger zerolog.Logger) *upstreamConnector {
 	return &upstreamConnector{
 		lm:                  lifecycle.NewLifecycleManager(),
 		bootstrapIdentities: bootstrapIdentities,
@@ -86,7 +86,7 @@ func (connector *upstreamConnector) Ready() <-chan struct{} {
 }
 
 // connect is run to connect to an boostrap peer
-func (connector *upstreamConnector) connect(ctx context.Context, bootstrapPeer flow.Identity) error {
+func (connector *upstreamConnector) connect(ctx context.Context, bootstrapPeer flow.IdentitySkeleton) error {
 
 	select {
 	// check for a cancelled/expired context
diff --git a/module/validation/common.go b/module/validation/common.go
index fda8ea42e9e..01e46e1328e 100644
--- a/module/validation/common.go
+++ b/module/validation/common.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/onflow/flow-go/engine"
 	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/model/flow/filter"
 	"github.com/onflow/flow-go/state/protocol"
 )
 
@@ -30,7 +31,7 @@ func identityForNode(state protocol.State, blockID flow.Identifier, nodeID flow.
 // ensureNodeHasWeightAndRole checks whether, at the given block, `nodeID`
 //   - has _positive_ weight
 //   - and has the expected role
-//   - and is not ejected
+//   - is an active participant of the current epoch and not ejected (i.e. has `EpochParticipationStatusActive`)
 //
 // Returns the following errors:
 //   - sentinel engine.InvalidInputError if any of the above-listed conditions are violated.
@@ -43,15 +44,14 @@ func ensureNodeHasWeightAndRole(identity *flow.Identity, expectedRole flow.Role)
 	if identity.Role != expectedRole {
 		return engine.NewInvalidInputErrorf("expected node %x to have role %s but got %s", identity.NodeID, expectedRole, identity.Role)
 	}
-
 	// check if the identity has non-zero weight
-	if identity.Weight == 0 {
-		return engine.NewInvalidInputErrorf("node has zero weight (%x)", identity.NodeID)
+	if identity.InitialWeight == 0 {
+		return engine.NewInvalidInputErrorf("node %x has zero weight", identity.NodeID)
 	}
-
-	// check that node was not ejected
-	if identity.Ejected {
-		return engine.NewInvalidInputErrorf("node was ejected from network (%x)", identity.NodeID)
+	// check if the identity is a valid epoch participant(is active in the current epoch + not ejected)
+	if !filter.IsValidCurrentEpochParticipant(identity) {
+		return engine.NewInvalidInputErrorf("node (%x) is not an active participant, instead has status: %s", identity.NodeID,
+			identity.EpochParticipationStatus.String())
 	}
 
 	return nil
diff --git a/module/validation/receipt_validator_test.go b/module/validation/receipt_validator_test.go
index 81a4bed321a..a7ca7ddc976 100644
--- a/module/validation/receipt_validator_test.go
+++ b/module/validation/receipt_validator_test.go
@@ -79,8 +79,11 @@ func (s *ReceiptValidationSuite) TestReceiptNoIdentity() {
 	s.Assert().True(engine.IsInvalidInputError(err))
 }
 
-// TestReceiptFromZeroWeightNode tests that we reject receipt from node with zero weight
-func (s *ReceiptValidationSuite) TestReceiptFromZeroWeightNode() {
+// TestReceiptFromNonActiveNode tests that we reject receipt from an execution node which is not authorized to participate:
+// - execution node is joining
+// - execution node is leaving
+// - execution node has zero initial weight.
+func (s *ReceiptValidationSuite) TestReceiptFromNonAuthorizedNode() {
 	valSubgrph := s.ValidSubgraphFixture()
 	receipt := unittest.ExecutionReceiptFixture(unittest.WithExecutorID(s.ExeID),
 		unittest.WithResult(valSubgrph.Result))
@@ -91,12 +94,31 @@ func (s *ReceiptValidationSuite) TestReceiptFromZeroWeightNode() {
 		mock.Anything,
 		mock.Anything).Return(true, nil).Maybe() // call optional, as validator might check weight first
 
-	// replace weight with invalid one
-	s.Identities[s.ExeID].Weight = 0
+	s.Run("execution-node-leaving", func() {
+		// replace EN participation status
+		s.Identities[s.ExeID].EpochParticipationStatus = flow.EpochParticipationStatusLeaving
 
-	err := s.receiptValidator.Validate(receipt)
-	s.Require().Error(err, "should reject invalid weight")
-	s.Assert().True(engine.IsInvalidInputError(err))
+		err := s.receiptValidator.Validate(receipt)
+		s.Require().Error(err, "should reject invalid weight")
+		s.Assert().True(engine.IsInvalidInputError(err))
+	})
+	s.Run("execution-node-joining", func() {
+		// replace EN participation status
+		s.Identities[s.ExeID].EpochParticipationStatus = flow.EpochParticipationStatusJoining
+
+		err := s.receiptValidator.Validate(receipt)
+		s.Require().Error(err, "should reject invalid weight")
+		s.Assert().True(engine.IsInvalidInputError(err))
+	})
+	s.Run("execution-node-zero-weight", func() {
+		// replace EN participation status and initial weight
+		s.Identities[s.ExeID].EpochParticipationStatus = flow.EpochParticipationStatusActive
+		s.Identities[s.ExeID].InitialWeight = 0
+
+		err := s.receiptValidator.Validate(receipt)
+		s.Require().Error(err, "should reject invalid weight")
+		s.Assert().True(engine.IsInvalidInputError(err))
+	})
 }
 
 // TestReceiptInvalidRole tests that we reject receipt with invalid execution node role
diff --git a/network/README.MD b/network/README.MD
new file mode 100644
index 00000000000..706a7655a6b
--- /dev/null
+++ b/network/README.MD
@@ -0,0 +1,13 @@
+
+# Networking Layer
+
+## Configuration
+- [Resource Management](..%2Fconfig%2Fdocs%2FresourceManager.MD)
+
+## Protocols
+- [Unicast (1:1 connections)](p2p%2Funicast%2FREADME.MD)
+
+## Security Protections 
+- [Application Layer Spam Prevention (ALSP)](alsp%2Freadme.md)
+- [GossipSub Peer Scoring](p2p%2Fscoring%2FREADME.md)
+- [GossipSub RPC Inspection](p2p%2Finspector%2FREADME.MD)
\ No newline at end of file
diff --git a/network/channels/channels.go b/network/channels/channels.go
index 817e11c54db..5cd3790a665 100644
--- a/network/channels/channels.go
+++ b/network/channels/channels.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package channels
 
 import (
@@ -102,6 +100,7 @@ func PublicChannels() ChannelList {
 	return ChannelList{
 		PublicSyncCommittee,
 		PublicReceiveBlocks,
+		PublicExecutionDataService,
 	}
 }
 
@@ -154,9 +153,10 @@ const (
 	ProvideApprovalsByChunk  = RequestApprovalsByChunk
 
 	// Public network channels
-	PublicPushBlocks    = Channel("public-push-blocks")
-	PublicReceiveBlocks = PublicPushBlocks
-	PublicSyncCommittee = Channel("public-sync-committee")
+	PublicPushBlocks           = Channel("public-push-blocks")
+	PublicReceiveBlocks        = PublicPushBlocks
+	PublicSyncCommittee        = Channel("public-sync-committee")
+	PublicExecutionDataService = Channel("public-execution-data-service")
 
 	// Execution data service
 	ExecutionDataService = Channel("execution-data-service")
diff --git a/network/codec.go b/network/codec.go
index a0c04b1f3cf..995908e1aff 100644
--- a/network/codec.go
+++ b/network/codec.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package network
 
 import (
diff --git a/network/codec/cbor/codec.go b/network/codec/cbor/codec.go
index fa5a6acb451..3417a443046 100644
--- a/network/codec/cbor/codec.go
+++ b/network/codec/cbor/codec.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package cbor
 
 import (
diff --git a/network/codec/cbor/decoder.go b/network/codec/cbor/decoder.go
index 77dd48bd82c..c0bef5dee17 100644
--- a/network/codec/cbor/decoder.go
+++ b/network/codec/cbor/decoder.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package cbor
 
 import (
diff --git a/network/codec/cbor/encoder.go b/network/codec/cbor/encoder.go
index c154ddebead..e7b14682403 100644
--- a/network/codec/cbor/encoder.go
+++ b/network/codec/cbor/encoder.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package cbor
 
 import (
diff --git a/network/codec/codes.go b/network/codec/codes.go
index 6a91576e17a..8e6eef7b7fa 100644
--- a/network/codec/codes.go
+++ b/network/codec/codes.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package codec
 
 import (
diff --git a/network/conduit.go b/network/conduit.go
index 4eb459c758d..5002eb9a291 100644
--- a/network/conduit.go
+++ b/network/conduit.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package network
 
 import (
diff --git a/network/engine.go b/network/engine.go
index a6c2fd6707a..a9234c6fffd 100644
--- a/network/engine.go
+++ b/network/engine.go
@@ -1,4 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
 package network
 
 import (
diff --git a/network/internal/p2pfixtures/fixtures.go b/network/internal/p2pfixtures/fixtures.go
index 7e8f053676f..fab3fb6228a 100644
--- a/network/internal/p2pfixtures/fixtures.go
+++ b/network/internal/p2pfixtures/fixtures.go
@@ -4,6 +4,7 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"testing"
@@ -135,6 +136,40 @@ func CreateNode(t *testing.T, networkKey crypto.PrivateKey, sporkID flow.Identif
 	return libp2pNode
 }
 
+// SubMustEventuallyStopReceivingAnyMessage checks that the subscription eventually stops receiving any messages within the given timeout by the context.
+// This func uses the publish callback to continually publish messages to the subscription, this ensures that the subscription indeed stops receiving the messages.
+func SubMustEventuallyStopReceivingAnyMessage(t *testing.T, ctx context.Context, sub p2p.Subscription, publish func(t *testing.T)) {
+	done := make(chan struct{})
+	ticker := time.NewTicker(500 * time.Millisecond)
+	defer func() {
+		close(done)
+		ticker.Stop()
+	}()
+
+	go func() {
+		for {
+			select {
+			case <-done:
+				return
+			case <-ticker.C:
+				publish(t)
+			}
+		}
+	}()
+
+	// eventually we should stop receiving messages on the sub
+	require.Eventually(t, func() bool {
+		_, err := sub.Next(ctx)
+		return errors.Is(err, context.DeadlineExceeded)
+	}, 10*time.Second, 100*time.Millisecond)
+
+	// after we stop receiving messages on sub we should continue to not receiving messages
+	// despite messages continuing to be published
+	_, err := sub.Next(ctx)
+	require.Error(t, err)
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+}
+
 // SubMustNeverReceiveAnyMessage checks that the subscription never receives any message within the given timeout by the context.
 func SubMustNeverReceiveAnyMessage(t *testing.T, ctx context.Context, sub p2p.Subscription) {
 	timeouted := make(chan struct{})
@@ -151,6 +186,12 @@ func SubMustNeverReceiveAnyMessage(t *testing.T, ctx context.Context, sub p2p.Su
 	unittest.RequireCloseBefore(t, timeouted, 10*time.Second, "timeout did not happen on receiving expected pubsub message")
 }
 
+func SubsMustEventuallyStopReceivingAnyMessage(t *testing.T, ctx context.Context, subs []p2p.Subscription, send func(t *testing.T)) {
+	for _, sub := range subs {
+		SubMustEventuallyStopReceivingAnyMessage(t, ctx, sub, send)
+	}
+}
+
 // HasSubReceivedMessage checks that the subscription have received the given message within the given timeout by the context.
 // It returns true if the subscription has received the message, false otherwise.
 func HasSubReceivedMessage(t *testing.T, ctx context.Context, expectedMessage []byte, sub p2p.Subscription) bool {
@@ -190,7 +231,7 @@ func AddNodesToEachOthersPeerStore(t *testing.T, nodes []p2p.LibP2PNode, ids flo
 			if node == other {
 				continue
 			}
-			otherPInfo, err := utils.PeerAddressInfo(*ids[i])
+			otherPInfo, err := utils.PeerAddressInfo(ids[i].IdentitySkeleton)
 			require.NoError(t, err)
 			node.Host().Peerstore().AddAddrs(otherPInfo.ID, otherPInfo.Addrs, peerstore.AddressTTL)
 		}
diff --git a/network/internal/p2putils/utils.go b/network/internal/p2putils/utils.go
index 37df9e4794c..4a7d7b58cbe 100644
--- a/network/internal/p2putils/utils.go
+++ b/network/internal/p2putils/utils.go
@@ -167,7 +167,7 @@ func FilterStream(host host.Host, targetID peer.ID, options ...FilterOption) []n
 }
 
 // NetworkingInfo returns ip, port, libp2p public key of the identity.
-func NetworkingInfo(identity flow.Identity) (string, string, crypto.PubKey, error) {
+func NetworkingInfo(identity flow.IdentitySkeleton) (string, string, crypto.PubKey, error) {
 	// split the node address into ip and port
 	ip, port, err := net.SplitHostPort(identity.Address)
 	if err != nil {
diff --git a/network/internal/testutils/testUtil.go b/network/internal/testutils/testUtil.go
index a08af0b218e..be12dc01c96 100644
--- a/network/internal/testutils/testUtil.go
+++ b/network/internal/testutils/testUtil.go
@@ -183,7 +183,7 @@ func NetworkConfigFixture(
 
 	me := mock.NewLocal(t)
 	me.On("NodeID").Return(myId.NodeID).Maybe()
-	me.On("NotMeFilter").Return(filter.Not(filter.HasNodeID(me.NodeID()))).Maybe()
+	me.On("NotMeFilter").Return(filter.Not(filter.HasNodeID[flow.Identity](me.NodeID()))).Maybe()
 	me.On("Address").Return(myId.Address).Maybe()
 
 	defaultFlowConfig, err := config.DefaultConfig()
diff --git a/network/mocknetwork/topology.go b/network/mocknetwork/topology.go
index 04a0dec6f17..d5513bde846 100644
--- a/network/mocknetwork/topology.go
+++ b/network/mocknetwork/topology.go
@@ -13,15 +13,15 @@ type Topology struct {
 }
 
 // Fanout provides a mock function with given fields: ids
-func (_m *Topology) Fanout(ids flow.IdentityList) flow.IdentityList {
+func (_m *Topology) Fanout(ids flow.GenericIdentityList[flow.Identity]) flow.GenericIdentityList[flow.Identity] {
 	ret := _m.Called(ids)
 
-	var r0 flow.IdentityList
-	if rf, ok := ret.Get(0).(func(flow.IdentityList) flow.IdentityList); ok {
+	var r0 flow.GenericIdentityList[flow.Identity]
+	if rf, ok := ret.Get(0).(func(flow.GenericIdentityList[flow.Identity]) flow.GenericIdentityList[flow.Identity]); ok {
 		r0 = rf(ids)
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(flow.IdentityList)
+			r0 = ret.Get(0).(flow.GenericIdentityList[flow.Identity])
 		}
 	}
 
diff --git a/network/netconf/flags.go b/network/netconf/flags.go
index 3d37c078bc1..8b3cb8a5427 100644
--- a/network/netconf/flags.go
+++ b/network/netconf/flags.go
@@ -77,23 +77,63 @@ func AllFlagNames() []string {
 		alspSyncEngineBatchRequestBaseProb,
 		alspSyncEngineRangeRequestBaseProb,
 		alspSyncEngineSyncRequestProb,
+
 		BuildFlagName(gossipsubKey, p2pconfig.PeerScoringEnabledKey),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.LocalMeshLogIntervalKey),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.ScoreTracerIntervalKey),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.RPCSentTrackerCacheSizeKey),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.RPCSentTrackerQueueCacheSizeKey),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.RPCSentTrackerNumOfWorkersKey),
+
+		BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.DuplicateMessageCacheTrackerKey, p2pconfig.DuplicateMessageCacheTrackerSizeKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.DuplicateMessageCacheTrackerKey, p2pconfig.DuplicateMessageCacheTrackerDecayKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.DuplicateMessageCacheTrackerKey, p2pconfig.SkipDecayThresholdKey),
+
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.InspectionQueueConfigKey, p2pconfig.NumberOfWorkersKey),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.InspectionQueueConfigKey, p2pconfig.QueueSizeKey),
+
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ClusterPrefixedMessageConfigKey, p2pconfig.TrackerCacheSizeKey),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ClusterPrefixedMessageConfigKey, p2pconfig.TrackerCacheDecayKey),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ClusterPrefixedMessageConfigKey, p2pconfig.HardThresholdKey),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.NotificationCacheSizeKey),
+
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.DisabledKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.EnableKey, p2pconfig.GraftKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.EnableKey, p2pconfig.PruneKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.EnableKey, p2pconfig.IHaveKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.EnableKey, p2pconfig.IWantKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.EnableKey, p2pconfig.PublishKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.RejectUnstakedPeers),
+
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.TruncationKey, p2pconfig.DisabledKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.TruncationKey, p2pconfig.EnableKey, p2pconfig.GraftKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.TruncationKey, p2pconfig.EnableKey, p2pconfig.PruneKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.TruncationKey, p2pconfig.EnableKey, p2pconfig.IHaveKey),
+		BuildFlagName(gossipsubKey,
+			p2pconfig.RpcInspectorKey,
+			p2pconfig.ValidationConfigKey,
+			p2pconfig.ProcessKey,
+			p2pconfig.TruncationKey,
+			p2pconfig.EnableKey,
+			p2pconfig.IHaveKey,
+			p2pconfig.MessageIDKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.TruncationKey, p2pconfig.EnableKey, p2pconfig.IWantConfigKey),
+		BuildFlagName(gossipsubKey,
+			p2pconfig.RpcInspectorKey,
+			p2pconfig.ValidationConfigKey,
+			p2pconfig.ProcessKey,
+			p2pconfig.TruncationKey,
+			p2pconfig.EnableKey,
+			p2pconfig.IWantKey,
+			p2pconfig.MessageIDKey),
+
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.IHaveConfigKey, p2pconfig.MessageCountThreshold),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.IHaveConfigKey, p2pconfig.MessageIdCountThreshold),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.IHaveConfigKey, p2pconfig.DuplicateTopicIdThresholdKey),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.IHaveConfigKey, p2pconfig.DuplicateMessageIdThresholdKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.IHaveConfigKey, p2pconfig.InvalidTopicIdThresholdKey),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.GraftPruneKey, p2pconfig.DuplicateTopicIdThresholdKey),
+		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.GraftPruneKey, p2pconfig.InvalidTopicIdThresholdKey),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.GraftPruneKey, p2pconfig.MessageCountThreshold),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.IWantConfigKey, p2pconfig.MessageCountThreshold),
 		BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.IWantConfigKey, p2pconfig.MessageIdCountThreshold),
@@ -121,7 +161,7 @@ func AllFlagNames() []string {
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.InternalKey, p2pconfig.TopicKey, p2pconfig.MeshMessageDeliveryActivationKey),
 
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.InternalKey, p2pconfig.ThresholdsKey, p2pconfig.GossipThresholdKey),
-		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.InternalKey, p2pconfig.ThresholdsKey, p2pconfig.PublishThresholdKey),
+		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.InternalKey, p2pconfig.ThresholdsKey, p2pconfig.PublishKey),
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.InternalKey, p2pconfig.ThresholdsKey, p2pconfig.GraylistThresholdKey),
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.InternalKey, p2pconfig.ThresholdsKey, p2pconfig.AcceptPXThresholdKey),
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.InternalKey, p2pconfig.ThresholdsKey, p2pconfig.OpportunisticGraftThresholdKey),
@@ -135,12 +175,15 @@ func AllFlagNames() []string {
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.ProtocolKey, p2pconfig.AppSpecificKey, p2pconfig.MinAppSpecificKey, p2pconfig.PenaltyKey),
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.ProtocolKey, p2pconfig.AppSpecificKey, p2pconfig.UnknownIdentityKey, p2pconfig.PenaltyKey),
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.ProtocolKey, p2pconfig.AppSpecificKey, p2pconfig.InvalidSubscriptionKey, p2pconfig.PenaltyKey),
+		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.ProtocolKey, p2pconfig.AppSpecificKey, p2pconfig.DuplicateMessageKey, p2pconfig.PenaltyKey),
+		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.ProtocolKey, p2pconfig.AppSpecificKey, p2pconfig.DuplicateMessageKey, p2pconfig.ThresholdKey),
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.ProtocolKey, p2pconfig.AppSpecificKey, p2pconfig.MaxAppSpecificKey, p2pconfig.RewardKey),
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.ProtocolKey, p2pconfig.AppSpecificKey, p2pconfig.StakedIdentityKey, p2pconfig.RewardKey),
 
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.StartupSilenceDurationKey),
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.AppSpecificScoreRegistryKey, p2pconfig.ScoreUpdateWorkerNumKey),
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.AppSpecificScoreRegistryKey, p2pconfig.ScoreUpdateRequestQueueSizeKey),
+		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.AppSpecificScoreRegistryKey, p2pconfig.InvalidControlMessageNotificationQueueSizeKey),
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.AppSpecificScoreRegistryKey, p2pconfig.ScoreTTLKey),
 
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.SpamRecordCacheKey, p2pconfig.CacheSizeKey),
@@ -151,11 +194,11 @@ func AllFlagNames() []string {
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.SpamRecordCacheKey, p2pconfig.DecayKey, p2pconfig.MaximumSpamPenaltyDecayFactorKey),
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.SpamRecordCacheKey, p2pconfig.DecayKey, p2pconfig.SkipDecayThresholdKey),
 
-		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.GraftMisbehaviourKey),
-		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.PruneMisbehaviourKey),
-		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.IHaveMisbehaviourKey),
-		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.IWantMisbehaviourKey),
-		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.PublishMisbehaviourKey),
+		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.GraftKey),
+		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.PruneKey),
+		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.IHaveKey),
+		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.IWantKey),
+		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.PublishKey),
 		BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.ClusterPrefixedReductionFactorKey),
 	}
 
@@ -229,6 +272,17 @@ func InitializeNetworkFlags(flags *pflag.FlagSet, config *Config) {
 		"cache size of the rpc sent tracker used by the gossipsub mesh tracer.")
 	flags.Uint32(BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.RPCSentTrackerQueueCacheSizeKey), config.GossipSub.RpcTracer.RPCSentTrackerQueueCacheSize,
 		"cache size of the rpc sent tracker worker queue.")
+
+	flags.Uint32(BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.DuplicateMessageCacheTrackerKey, p2pconfig.DuplicateMessageCacheTrackerSizeKey),
+		config.GossipSub.RpcTracer.DuplicateMessageTrackerConfig.CacheSize,
+		"cache size of the gossipsub duplicate message tracker.")
+	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.DuplicateMessageCacheTrackerKey, p2pconfig.DuplicateMessageCacheTrackerDecayKey),
+		config.GossipSub.RpcTracer.DuplicateMessageTrackerConfig.Decay,
+		"decay rate for the peer duplicate message counters.")
+	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.DuplicateMessageCacheTrackerKey, p2pconfig.SkipDecayThresholdKey),
+		config.GossipSub.RpcTracer.DuplicateMessageTrackerConfig.SkipDecayThreshold,
+		"the duplicate message count threshold below which the penalty will not be decayed")
+
 	flags.Int(BuildFlagName(gossipsubKey, p2pconfig.RpcTracerKey, p2pconfig.RPCSentTrackerNumOfWorkersKey), config.GossipSub.RpcTracer.RpcSentTrackerNumOfWorkers,
 		"number of workers for the rpc sent tracker worker pool.")
 	// gossipsub RPC control message validation limits used for validation configuration and rate limiting
@@ -264,6 +318,64 @@ func InitializeNetworkFlags(flags *pflag.FlagSet, config *Config) {
 		config.AlspConfig.SyncEngine.RangeRequestBaseProb,
 		"base probability of creating a misbehavior report for a range request message")
 	flags.Float32(alspSyncEngineSyncRequestProb, config.AlspConfig.SyncEngine.SyncRequestProb, "probability of creating a misbehavior report for a sync request message")
+
+	flags.Bool(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.DisabledKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Inspect.Disabled,
+		"disable rpc inspection for all control message types")
+	flags.Bool(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.EnableKey, p2pconfig.GraftKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Inspect.EnableGraft,
+		"disable graft control message inspection")
+	flags.Bool(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.EnableKey, p2pconfig.PruneKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Inspect.EnablePrune,
+		"disable prune control message inspection")
+	flags.Bool(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.EnableKey, p2pconfig.IHaveKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Inspect.EnableIHave,
+		"disable ihave control message inspection")
+	flags.Bool(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.EnableKey, p2pconfig.IWantKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Inspect.EnableIWant,
+		"disable iwant control message inspection")
+	flags.Bool(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.EnableKey, p2pconfig.PublishKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Inspect.EnablePublish,
+		"disable rpc publish message inspection")
+	flags.Bool(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.InspectionKey, p2pconfig.RejectUnstakedPeers),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Inspect.RejectUnstakedPeers,
+		"reject rpcs from unstaked peers")
+	flags.Bool(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.TruncationKey, p2pconfig.DisabledKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Truncate.Disabled,
+		"disable rpc truncation for all control message types")
+	flags.Bool(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.TruncationKey, p2pconfig.EnableKey, p2pconfig.GraftKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Truncate.EnableGraft,
+		"disable graft control message truncation")
+	flags.Bool(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.TruncationKey, p2pconfig.EnableKey, p2pconfig.PruneKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Truncate.EnablePrune,
+		"disable prune control message truncation")
+	flags.Bool(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.TruncationKey, p2pconfig.EnableKey, p2pconfig.IHaveKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Truncate.EnableIHave,
+		"disable ihave control message truncation")
+	flags.Bool(BuildFlagName(gossipsubKey,
+		p2pconfig.RpcInspectorKey,
+		p2pconfig.ValidationConfigKey,
+		p2pconfig.ProcessKey,
+		p2pconfig.TruncationKey,
+		p2pconfig.EnableKey,
+		p2pconfig.IHaveKey,
+		p2pconfig.MessageIDKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Truncate.EnableIHaveMessageIds,
+		"disable ihave message id truncation")
+	flags.Bool(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.ProcessKey, p2pconfig.TruncationKey, p2pconfig.EnableKey, p2pconfig.IWantKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Truncate.EnableIWant,
+		"disable iwant control message truncation")
+	flags.Bool(BuildFlagName(gossipsubKey,
+		p2pconfig.RpcInspectorKey,
+		p2pconfig.ValidationConfigKey,
+		p2pconfig.ProcessKey,
+		p2pconfig.TruncationKey,
+		p2pconfig.EnableKey,
+		p2pconfig.IWantKey,
+		p2pconfig.MessageIDKey),
+		config.GossipSub.RpcInspector.Validation.InspectionProcess.Truncate.EnableIWantMessageIds,
+		"disable iwant message id truncation")
+
 	flags.Int(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.IHaveConfigKey, p2pconfig.MessageCountThreshold),
 		config.GossipSub.RpcInspector.Validation.IHave.MessageCountThreshold,
 		"threshold for the number of ihave control messages to accept on a single RPC message, if exceeded the RPC message will be sampled and truncated")
@@ -276,6 +388,11 @@ func InitializeNetworkFlags(flags *pflag.FlagSet, config *Config) {
 	flags.Int(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.IHaveConfigKey, p2pconfig.DuplicateMessageIdThresholdKey),
 		config.GossipSub.RpcInspector.Validation.IHave.DuplicateMessageIdThreshold,
 		"the max allowed duplicate message IDs in a single ihave control message, if exceeded a misbehavior report will be created")
+	flags.Int(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.IHaveConfigKey, p2pconfig.InvalidTopicIdThresholdKey),
+		config.GossipSub.RpcInspector.Validation.IHave.InvalidTopicIdThreshold,
+		"the max allowed invalid topics in a single ihave control message, if exceeded a misbehavior report will be created",
+	)
+
 	flags.Int(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.GraftPruneKey, p2pconfig.MessageCountThreshold),
 		config.GossipSub.RpcInspector.Validation.GraftPrune.MessageCountThreshold,
 		"threshold for the number of graft or prune control messages to accept on a single RPC message, if exceeded the RPC message will be sampled and truncated")
@@ -300,6 +417,10 @@ func InitializeNetworkFlags(flags *pflag.FlagSet, config *Config) {
 	flags.Int(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.GraftPruneKey, p2pconfig.DuplicateTopicIdThresholdKey),
 		config.GossipSub.RpcInspector.Validation.GraftPrune.DuplicateTopicIdThreshold,
 		"the max allowed duplicate topic IDs across all graft or prune control messages in a single RPC message, if exceeded a misbehavior report will be created")
+	flags.Int(BuildFlagName(gossipsubKey, p2pconfig.RpcInspectorKey, p2pconfig.ValidationConfigKey, p2pconfig.GraftPruneKey, p2pconfig.InvalidTopicIdThresholdKey),
+		config.GossipSub.RpcInspector.Validation.GraftPrune.InvalidTopicIdThreshold,
+		"the max allowed invalid topic across all graft or prune control messages in a single RPC message, if exceeded a misbehavior report will be created")
+
 	flags.Duration(BuildFlagName(gossipsubKey, p2pconfig.SubscriptionProviderKey, p2pconfig.UpdateIntervalKey),
 		config.GossipSub.SubscriptionProvider.UpdateInterval,
 		"interval for updating the list of subscribed topics for all peers in the gossipsub, recommended value is a few minutes")
@@ -354,7 +475,7 @@ func InitializeNetworkFlags(flags *pflag.FlagSet, config *Config) {
 	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.InternalKey, p2pconfig.ThresholdsKey, p2pconfig.GossipThresholdKey),
 		config.GossipSub.ScoringParameters.PeerScoring.Internal.Thresholds.Gossip,
 		"the threshold when a peer's penalty drops below this threshold, no gossip is emitted towards that peer and gossip from that peer is ignored")
-	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.InternalKey, p2pconfig.ThresholdsKey, p2pconfig.PublishThresholdKey),
+	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.InternalKey, p2pconfig.ThresholdsKey, p2pconfig.PublishKey),
 		config.GossipSub.ScoringParameters.PeerScoring.Internal.Thresholds.Publish,
 		"the threshold when a peer's penalty drops below this threshold, self-published messages are not propagated towards this peer")
 	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.InternalKey, p2pconfig.ThresholdsKey, p2pconfig.GraylistThresholdKey),
@@ -398,12 +519,24 @@ func InitializeNetworkFlags(flags *pflag.FlagSet, config *Config) {
 		p2pconfig.PenaltyKey),
 		config.GossipSub.ScoringParameters.PeerScoring.Protocol.AppSpecificScore.InvalidSubscriptionPenalty,
 		"the  penalty for invalid subscription. It is applied to the peer's score when the peer subscribes to a topic that it is not authorized to subscribe to")
+	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.ProtocolKey, p2pconfig.AppSpecificKey, p2pconfig.DuplicateMessageKey, p2pconfig.PenaltyKey),
+		config.GossipSub.ScoringParameters.PeerScoring.Protocol.AppSpecificScore.DuplicateMessagePenalty,
+		"the penalty for duplicate messages detected by the gossipsub tracer for a peer")
 	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.ProtocolKey, p2pconfig.AppSpecificKey, p2pconfig.MaxAppSpecificKey, p2pconfig.RewardKey),
 		config.GossipSub.ScoringParameters.PeerScoring.Protocol.AppSpecificScore.MaxAppSpecificReward,
 		"the reward for well-behaving staked peers")
 	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.PeerScoringKey, p2pconfig.ProtocolKey, p2pconfig.AppSpecificKey, p2pconfig.StakedIdentityKey, p2pconfig.RewardKey),
 		config.GossipSub.ScoringParameters.PeerScoring.Protocol.AppSpecificScore.StakedIdentityReward,
 		"the reward for staking peers")
+	flags.Float64(BuildFlagName(gossipsubKey,
+		p2pconfig.ScoreParamsKey,
+		p2pconfig.PeerScoringKey,
+		p2pconfig.ProtocolKey,
+		p2pconfig.AppSpecificKey,
+		p2pconfig.DuplicateMessageKey,
+		p2pconfig.ThresholdKey),
+		config.GossipSub.ScoringParameters.PeerScoring.Protocol.AppSpecificScore.DuplicateMessageThreshold,
+		"the peer's duplicate message count threshold above which the peer will be penalized")
 
 	flags.Duration(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.StartupSilenceDurationKey),
 		config.GossipSub.ScoringParameters.ScoringRegistryParameters.StartupSilenceDuration,
@@ -414,6 +547,9 @@ func InitializeNetworkFlags(flags *pflag.FlagSet, config *Config) {
 	flags.Uint32(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.AppSpecificScoreRegistryKey, p2pconfig.ScoreUpdateRequestQueueSizeKey),
 		config.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreUpdateRequestQueueSize,
 		"size of the app specific score update worker pool queue")
+	flags.Uint32(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.AppSpecificScoreRegistryKey, p2pconfig.InvalidControlMessageNotificationQueueSizeKey),
+		config.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.InvalidControlMessageNotificationQueueSize,
+		"size of the queue for invalid control message notifications processing")
 	flags.Duration(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.AppSpecificScoreRegistryKey, p2pconfig.ScoreTTLKey),
 		config.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL,
 		"time to live for app specific scores; when expired a new request will be sent to the score update worker pool; till then the expired score will be used")
@@ -442,19 +578,19 @@ func InitializeNetworkFlags(flags *pflag.FlagSet, config *Config) {
 		config.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.SkipDecayThreshold,
 		"the threshold for which when the negative penalty is above this value, the decay function will not be called")
 
-	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.GraftMisbehaviourKey),
+	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.GraftKey),
 		config.GossipSub.ScoringParameters.ScoringRegistryParameters.MisbehaviourPenalties.GraftMisbehaviour,
 		"the penalty applied to the application specific penalty when a peer conducts a graft misbehaviour")
-	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.PruneMisbehaviourKey),
+	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.PruneKey),
 		config.GossipSub.ScoringParameters.ScoringRegistryParameters.MisbehaviourPenalties.PruneMisbehaviour,
 		"the penalty applied to the application specific penalty when a peer conducts a prune misbehaviour")
-	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.IHaveMisbehaviourKey),
+	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.IHaveKey),
 		config.GossipSub.ScoringParameters.ScoringRegistryParameters.MisbehaviourPenalties.IHaveMisbehaviour,
 		"the penalty applied to the application specific penalty when a peer conducts a iHave misbehaviour")
-	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.IWantMisbehaviourKey),
+	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.IWantKey),
 		config.GossipSub.ScoringParameters.ScoringRegistryParameters.MisbehaviourPenalties.IWantMisbehaviour,
 		"the penalty applied to the application specific penalty when a peer conducts a iWant misbehaviour")
-	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.PublishMisbehaviourKey),
+	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.PublishKey),
 		config.GossipSub.ScoringParameters.ScoringRegistryParameters.MisbehaviourPenalties.PublishMisbehaviour,
 		"the penalty applied to the application specific penalty when a peer conducts a rpc publish message misbehaviour")
 	flags.Float64(BuildFlagName(gossipsubKey, p2pconfig.ScoreParamsKey, p2pconfig.ScoringRegistryKey, p2pconfig.MisbehaviourPenaltiesKey, p2pconfig.ClusterPrefixedReductionFactorKey),
diff --git a/network/network.go b/network/network.go
index e34160770ee..32b1a172d3c 100644
--- a/network/network.go
+++ b/network/network.go
@@ -48,6 +48,7 @@ type EngineRegistry interface {
 
 	// RegisterBlobService registers a BlobService on the given channel, using the given datastore to retrieve values.
 	// The returned BlobService can be used to request blocks from the network.
+	// RegisterBlobService starts the BlobService component using the network's context.
 	// TODO: We should return a function that can be called to unregister / close the BlobService
 	RegisterBlobService(channel channels.Channel, store datastore.Batching, opts ...BlobServiceOption) (BlobService, error)
 
diff --git a/network/p2p/blob/blob_service.go b/network/p2p/blob/blob_service.go
index 459c26913f2..4a31af4c4af 100644
--- a/network/p2p/blob/blob_service.go
+++ b/network/p2p/blob/blob_service.go
@@ -6,6 +6,9 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-multierror"
+	"github.com/ipfs/boxo/bitswap"
+	bsmsg "github.com/ipfs/boxo/bitswap/message"
+	bsnet "github.com/ipfs/boxo/bitswap/network"
 	blocks "github.com/ipfs/go-block-format"
 	"github.com/ipfs/go-blockservice"
 	"github.com/ipfs/go-cid"
@@ -17,9 +20,6 @@ import (
 	"github.com/libp2p/go-libp2p/core/peer"
 	"github.com/libp2p/go-libp2p/core/protocol"
 	"github.com/libp2p/go-libp2p/core/routing"
-	"github.com/onflow/go-bitswap"
-	bsmsg "github.com/onflow/go-bitswap/message"
-	bsnet "github.com/onflow/go-bitswap/network"
 	"github.com/rs/zerolog"
 	"golang.org/x/time/rate"
 
@@ -281,7 +281,7 @@ func AuthorizedRequester(
 			Logger()
 
 		// TODO: when execution data verification is enabled, add verification nodes here
-		if (id.Role != flow.RoleExecution && id.Role != flow.RoleAccess) || id.Ejected {
+		if (id.Role != flow.RoleExecution && id.Role != flow.RoleAccess) || id.IsEjected() {
 			lg.Warn().
 				Bool(logging.KeySuspicious, true).
 				Msg("rejecting request from peer: unauthorized")
diff --git a/network/p2p/blob/blob_service_test.go b/network/p2p/blob/blob_service_test.go
index 020d8842856..97189fc05ad 100644
--- a/network/p2p/blob/blob_service_test.go
+++ b/network/p2p/blob/blob_service_test.go
@@ -89,8 +89,8 @@ func TestAuthorizedRequester(t *testing.T) {
 		assert.False(t, authorizer(sn1PeerID, cid.Cid{}))
 	})
 
-	an1.Ejected = true
-	en1.Ejected = true
+	an1.EpochParticipationStatus = flow.EpochParticipationStatusEjected
+	en1.EpochParticipationStatus = flow.EpochParticipationStatusEjected
 
 	// AN1 is on allow list (not passed) but is ejected
 	t.Run("always denies ejected AN", func(t *testing.T) {
diff --git a/network/p2p/builder.go b/network/p2p/builder.go
index cbc71475511..207235f7347 100644
--- a/network/p2p/builder.go
+++ b/network/p2p/builder.go
@@ -65,12 +65,12 @@ type GossipSubBuilder interface {
 	// If the routing system has already been set, a fatal error is logged.
 	SetRoutingSystem(routing.Routing)
 
-	// OverrideDefaultRpcInspectorSuiteFactory overrides the default RPC inspector suite factory of the builder.
+	// OverrideDefaultRpcInspectorFactory overrides the default RPC inspector suite factory of the builder.
 	// A default RPC inspector suite factory is provided by the node. This function overrides the default factory.
 	// The purpose of override is to allow the node to provide a custom RPC inspector suite factory for sake of testing
 	// or experimentation.
 	// It is NOT recommended to override the default RPC inspector suite factory in production unless you know what you are doing.
-	OverrideDefaultRpcInspectorSuiteFactory(GossipSubRpcInspectorSuiteFactoryFunc)
+	OverrideDefaultRpcInspectorFactory(GossipSubRpcInspectorFactoryFunc)
 
 	// Build creates a new GossipSub pubsub system.
 	// It returns the newly created GossipSub pubsub system and any errors encountered during its creation.
@@ -85,8 +85,8 @@ type GossipSubBuilder interface {
 	Build(irrecoverable.SignalerContext) (PubSubAdapter, error)
 }
 
-// GossipSubRpcInspectorSuiteFactoryFunc is a function that creates a new RPC inspector suite. It is used to create
-// RPC inspectors for the gossipsub protocol. The RPC inspectors are used to inspect and validate
+// GossipSubRpcInspectorFactoryFunc is a function that creates a new RPC inspector. It is used to create
+// an RPC inspector for the gossipsub protocol. The RPC inspectors are used to inspect and validate
 // incoming RPC messages before they are processed by the gossipsub protocol.
 // Args:
 // - logger: logger to use
@@ -97,10 +97,9 @@ type GossipSubBuilder interface {
 // - networkingType: networking type of the node, i.e., public or private
 // - identityProvider: identity provider of the node
 // Returns:
-// - p2p.GossipSubInspectorSuite: new RPC inspector suite
+// - GossipSubRPCInspector: new RPC inspector suite
 // - error: error if any, any returned error is irrecoverable.
-type GossipSubRpcInspectorSuiteFactoryFunc func(
-	irrecoverable.SignalerContext,
+type GossipSubRpcInspectorFactoryFunc func(
 	zerolog.Logger,
 	flow.Identifier,
 	*p2pconfig.RpcInspectorParameters,
@@ -109,7 +108,8 @@ type GossipSubRpcInspectorSuiteFactoryFunc func(
 	flownet.NetworkingType,
 	module.IdentityProvider,
 	func() TopicProvider,
-) (GossipSubInspectorSuite, error)
+	GossipSubInvCtrlMsgNotifConsumer,
+) (GossipSubRPCInspector, error)
 
 // NodeBuilder is a builder pattern for creating a libp2p Node instance.
 type NodeBuilder interface {
@@ -141,8 +141,31 @@ type NodeBuilder interface {
 	// Returns:
 	// none
 	OverrideNodeConstructor(NodeConstructor) NodeBuilder
-	SetGossipSubFactory(GossipSubFactoryFunc, GossipSubAdapterConfigFunc) NodeBuilder
-	OverrideDefaultRpcInspectorSuiteFactory(GossipSubRpcInspectorSuiteFactoryFunc) NodeBuilder
+
+	// OverrideGossipSubFactory overrides the default gossipsub factory for the GossipSub protocol.
+	// The purpose of override is to allow the node to provide a custom gossipsub factory for sake of testing or experimentation.
+	// Note: it is not recommended to override the default gossipsub factory in production unless you know what you are doing.
+	// Args:
+	// - factory: custom gossipsub factory
+	// Returns:
+	// - NodeBuilder: the node builder
+	OverrideGossipSubFactory(GossipSubFactoryFunc, GossipSubAdapterConfigFunc) NodeBuilder
+
+	// OverrideDefaultRpcInspectorFactory overrides the default rpc inspector factory for the GossipSub protocol.
+	// The purpose of override is to allow the node to provide a custom rpc inspector factory for sake of testing or experimentation.
+	// Note: it is not recommended to override the default rpc inspector factory in production unless you know what you are doing.
+	// Args:
+	// - factory: custom rpc inspector factory
+	// Returns:
+	// - NodeBuilder: the node builder
+	OverrideDefaultRpcInspectorFactory(GossipSubRpcInspectorFactoryFunc) NodeBuilder
+
+	// Build creates a new libp2p node. It returns the newly created libp2p node and any errors encountered during its creation.
+	// Args:
+	// none
+	// Returns:
+	// - LibP2PNode: a new libp2p node
+	// - error: if an error occurs during the creation of the libp2p node, it is returned. Otherwise, nil is returned. Any error returned is unexpected and should be handled as irrecoverable.
 	Build() (LibP2PNode, error)
 }
 
diff --git a/network/p2p/builder/gossipsub/gossipSubBuilder.go b/network/p2p/builder/gossipsub/gossipSubBuilder.go
index 7c0b7508cb4..da3b74943b5 100644
--- a/network/p2p/builder/gossipsub/gossipSubBuilder.go
+++ b/network/p2p/builder/gossipsub/gossipSubBuilder.go
@@ -12,14 +12,11 @@ import (
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module"
 	"github.com/onflow/flow-go/module/irrecoverable"
-	"github.com/onflow/flow-go/module/mempool/queue"
 	"github.com/onflow/flow-go/module/metrics"
 	"github.com/onflow/flow-go/network"
 	"github.com/onflow/flow-go/network/p2p"
 	p2pbuilderconfig "github.com/onflow/flow-go/network/p2p/builder/config"
-	inspectorbuilder "github.com/onflow/flow-go/network/p2p/builder/inspector"
 	p2pconfig "github.com/onflow/flow-go/network/p2p/config"
-	"github.com/onflow/flow-go/network/p2p/distributor"
 	"github.com/onflow/flow-go/network/p2p/inspector/validation"
 	p2pnode "github.com/onflow/flow-go/network/p2p/node"
 	"github.com/onflow/flow-go/network/p2p/scoring"
@@ -38,14 +35,14 @@ type Builder struct {
 	subscriptionFilter  pubsub.SubscriptionFilter
 	gossipSubFactory    p2p.GossipSubFactoryFunc
 	gossipSubConfigFunc p2p.GossipSubAdapterConfigFunc
+	rpcInspectorFactory p2p.GossipSubRpcInspectorFactoryFunc
 	// gossipSubTracer is a callback interface that is called by the gossipsub implementation upon
 	// certain events. Currently, we use it to log and observe the local mesh of the node.
-	gossipSubTracer          p2p.PubSubTracer
-	scoreOptionConfig        *scoring.ScoreOptionConfig
-	idProvider               module.IdentityProvider
-	routingSystem            routing.Routing
-	rpcInspectorSuiteFactory p2p.GossipSubRpcInspectorSuiteFactoryFunc
-	gossipSubCfg             *p2pconfig.GossipSubParameters
+	gossipSubTracer   p2p.PubSubTracer
+	scoreOptionConfig *scoring.ScoreOptionConfig
+	idProvider        module.IdentityProvider
+	routingSystem     routing.Routing
+	gossipSubCfg      *p2pconfig.GossipSubParameters
 }
 
 var _ p2p.GossipSubBuilder = (*Builder)(nil)
@@ -60,6 +57,19 @@ func (g *Builder) SetHost(h host.Host) {
 	g.h = h
 }
 
+// OverrideDefaultRpcInspectorFactory overrides the default rpc inspector factory of the builder.
+// If the rpc inspector factory has already been set, a warning is logged.
+// Note: it is not recommended to override the default rpc inspector factory in production unless you know what you are doing.
+// The purpose of this function is to allow for testing and development.
+// Args:
+// - factoryFunc: the factory function to override the default rpc inspector factory.
+// Returns:
+// none
+func (g *Builder) OverrideDefaultRpcInspectorFactory(factoryFunc p2p.GossipSubRpcInspectorFactoryFunc) {
+	g.logger.Warn().Bool(logging.KeySuspicious, true).Msg("overriding default rpc inspector factory, not recommended for production")
+	g.rpcInspectorFactory = factoryFunc
+}
+
 // SetSubscriptionFilter sets the subscription filter of the builder.
 // If the subscription filter has already been set, a fatal error is logged.
 func (g *Builder) SetSubscriptionFilter(subscriptionFilter pubsub.SubscriptionFilter) {
@@ -128,13 +138,6 @@ func (g *Builder) SetRoutingSystem(routingSystem routing.Routing) {
 	g.routingSystem = routingSystem
 }
 
-// OverrideDefaultRpcInspectorSuiteFactory overrides the default rpc inspector suite factory.
-// Note: this function should only be used for testing purposes. Never override the default rpc inspector suite factory unless you know what you are doing.
-func (g *Builder) OverrideDefaultRpcInspectorSuiteFactory(factory p2p.GossipSubRpcInspectorSuiteFactoryFunc) {
-	g.logger.Warn().Msg("overriding default rpc inspector suite factory")
-	g.rpcInspectorSuiteFactory = factory
-}
-
 // NewGossipSubBuilder returns a new gossipsub builder.
 // Args:
 // - logger: the logger of the node.
@@ -143,6 +146,8 @@ func (g *Builder) OverrideDefaultRpcInspectorSuiteFactory(factory p2p.GossipSubR
 // - sporkId: the spork id of the node.
 // - idProvider: the identity provider of the node.
 // - rpcInspectorConfig: the rpc inspector config of the node.
+// - subscriptionProviderPrams: the subscription provider params of the node.
+// - meshTracer: gossipsub mesh tracer.
 // Returns:
 // - a new gossipsub builder.
 // Note: the builder is not thread-safe. It should only be used in the main thread.
@@ -158,35 +163,76 @@ func NewGossipSubBuilder(logger zerolog.Logger,
 		Logger()
 
 	meshTracerCfg := &tracer.GossipSubMeshTracerConfig{
-		Logger:                             lg,
-		Metrics:                            metricsCfg.Metrics,
-		IDProvider:                         idProvider,
-		LoggerInterval:                     gossipSubCfg.RpcTracer.LocalMeshLogInterval,
-		RpcSentTrackerCacheSize:            gossipSubCfg.RpcTracer.RPCSentTrackerCacheSize,
-		RpcSentTrackerWorkerQueueCacheSize: gossipSubCfg.RpcTracer.RPCSentTrackerQueueCacheSize,
-		RpcSentTrackerNumOfWorkers:         gossipSubCfg.RpcTracer.RpcSentTrackerNumOfWorkers,
+		Logger:         lg,
+		Metrics:        metricsCfg.Metrics,
+		IDProvider:     idProvider,
+		LoggerInterval: gossipSubCfg.RpcTracer.LocalMeshLogInterval,
+		RpcSentTracker: tracer.RpcSentTrackerConfig{
+			CacheSize:            gossipSubCfg.RpcTracer.RPCSentTrackerCacheSize,
+			WorkerQueueCacheSize: gossipSubCfg.RpcTracer.RPCSentTrackerQueueCacheSize,
+			WorkerQueueNumber:    gossipSubCfg.RpcTracer.RpcSentTrackerNumOfWorkers,
+		},
+		DuplicateMessageTrackerCacheConfig: gossipSubCfg.RpcTracer.DuplicateMessageTrackerConfig,
 		HeroCacheMetricsFactory:            metricsCfg.HeroCacheFactory,
 		NetworkingType:                     networkType,
 	}
 	meshTracer := tracer.NewGossipSubMeshTracer(meshTracerCfg)
 
 	b := &Builder{
-		logger:                   lg,
-		metricsCfg:               metricsCfg,
-		sporkId:                  sporkId,
-		networkType:              networkType,
-		idProvider:               idProvider,
-		gossipSubFactory:         defaultGossipSubFactory(),
-		gossipSubConfigFunc:      defaultGossipSubAdapterConfig(),
-		scoreOptionConfig:        scoring.NewScoreOptionConfig(lg, gossipSubCfg.ScoringParameters, metricsCfg.HeroCacheFactory, idProvider, networkType),
-		rpcInspectorSuiteFactory: defaultInspectorSuite(meshTracer),
-		gossipSubTracer:          meshTracer,
-		gossipSubCfg:             gossipSubCfg,
+		logger:              lg,
+		metricsCfg:          metricsCfg,
+		sporkId:             sporkId,
+		networkType:         networkType,
+		idProvider:          idProvider,
+		gossipSubFactory:    defaultGossipSubFactory(),
+		gossipSubConfigFunc: defaultGossipSubAdapterConfig(),
+		scoreOptionConfig: scoring.NewScoreOptionConfig(lg,
+			gossipSubCfg.ScoringParameters,
+			metricsCfg.HeroCacheFactory,
+			metricsCfg.Metrics,
+			idProvider,
+			meshTracer.DuplicateMessageCount,
+			networkType,
+		),
+		gossipSubTracer:     meshTracer,
+		gossipSubCfg:        gossipSubCfg,
+		rpcInspectorFactory: defaultRpcInspectorFactory(meshTracer),
 	}
 
 	return b
 }
 
+// defaultRpcInspectorFactory returns the default rpc inspector factory function. It is used to create the default rpc inspector factory.
+// Note: always use the default rpc inspector factory function to create the rpc inspector factory (unless you know what you are doing).
+// Args:
+// - tracer: the tracer of the node.
+// Returns:
+// - a new rpc inspector factory function.
+func defaultRpcInspectorFactory(tracer p2p.PubSubTracer) p2p.GossipSubRpcInspectorFactoryFunc {
+	return func(logger zerolog.Logger,
+		sporkId flow.Identifier,
+		rpcInspectorConfig *p2pconfig.RpcInspectorParameters,
+		inspectorMetrics module.GossipSubMetrics,
+		heroCacheMetrics metrics.HeroCacheMetricsFactory,
+		networkingType network.NetworkingType,
+		idProvider module.IdentityProvider,
+		topicProvider func() p2p.TopicProvider,
+		notificationConsumer p2p.GossipSubInvCtrlMsgNotifConsumer) (p2p.GossipSubRPCInspector, error) {
+		return validation.NewControlMsgValidationInspector(&validation.InspectorParams{
+			Logger:                  logger.With().Str("component", "rpc-inspector").Logger(),
+			SporkID:                 sporkId,
+			Config:                  &rpcInspectorConfig.Validation,
+			HeroCacheMetricsFactory: heroCacheMetrics,
+			IdProvider:              idProvider,
+			InspectorMetrics:        inspectorMetrics,
+			RpcTracker:              tracer,
+			NetworkingType:          networkingType,
+			InvalidControlMessageNotificationConsumer: notificationConsumer,
+			TopicOracle: topicProvider,
+		})
+	}
+}
+
 // defaultGossipSubFactory returns the default gossipsub factory function. It is used to create the default gossipsub factory.
 // Note: always use the default gossipsub factory function to create the gossipsub factory (unless you know what you are doing).
 func defaultGossipSubFactory() p2p.GossipSubFactoryFunc {
@@ -203,45 +249,6 @@ func defaultGossipSubAdapterConfig() p2p.GossipSubAdapterConfigFunc {
 	}
 }
 
-// defaultInspectorSuite returns the default inspector suite factory function. It is used to create the default inspector suite.
-// Inspector suite is utilized to inspect the incoming gossipsub rpc messages from different perspectives.
-// Note: always use the default inspector suite factory function to create the inspector suite (unless you know what you are doing).
-// todo: this function can be simplified.
-func defaultInspectorSuite(rpcTracker p2p.RpcControlTracking) p2p.GossipSubRpcInspectorSuiteFactoryFunc {
-	return func(ctx irrecoverable.SignalerContext,
-		logger zerolog.Logger,
-		sporkId flow.Identifier,
-		inspectorCfg *p2pconfig.RpcInspectorParameters,
-		gossipSubMetrics module.GossipSubMetrics,
-		heroCacheMetricsFactory metrics.HeroCacheMetricsFactory,
-		networkType network.NetworkingType,
-		idProvider module.IdentityProvider,
-		topicProvider func() p2p.TopicProvider) (p2p.GossipSubInspectorSuite, error) {
-
-		notificationDistributor := distributor.DefaultGossipSubInspectorNotificationDistributor(logger, []queue.HeroStoreConfigOption{
-			queue.WithHeroStoreSizeLimit(inspectorCfg.NotificationCacheSize),
-			queue.WithHeroStoreCollector(metrics.RpcInspectorNotificationQueueMetricFactory(heroCacheMetricsFactory, networkType))}...)
-
-		params := &validation.InspectorParams{
-			Logger:                  logger,
-			SporkID:                 sporkId,
-			Config:                  &inspectorCfg.Validation,
-			Distributor:             notificationDistributor,
-			HeroCacheMetricsFactory: heroCacheMetricsFactory,
-			IdProvider:              idProvider,
-			InspectorMetrics:        gossipSubMetrics,
-			RpcTracker:              rpcTracker,
-			NetworkingType:          networkType,
-			TopicOracle:             topicProvider,
-		}
-		rpcValidationInspector, err := validation.NewControlMsgValidationInspector(params)
-		if err != nil {
-			return nil, fmt.Errorf("failed to create new control message valiadation inspector: %w", err)
-		}
-		return inspectorbuilder.NewGossipSubInspectorSuite(rpcValidationInspector, notificationDistributor), nil
-	}
-}
-
 // Build creates a new GossipSub pubsub system.
 // It returns the newly created GossipSub pubsub system and any errors encountered during its creation.
 // Arguments:
@@ -270,24 +277,17 @@ func (g *Builder) Build(ctx irrecoverable.SignalerContext) (p2p.PubSubAdapter, e
 		gossipSubConfigs.WithSubscriptionFilter(g.subscriptionFilter)
 	}
 
-	inspectorSuite, err := g.rpcInspectorSuiteFactory(ctx,
-		g.logger,
-		g.sporkId,
-		&g.gossipSubCfg.RpcInspector,
-		g.metricsCfg.Metrics,
-		g.metricsCfg.HeroCacheFactory,
-		g.networkType,
-		g.idProvider,
-		func() p2p.TopicProvider {
-			return gossipSub
-		})
-	if err != nil {
-		return nil, fmt.Errorf("could not create gossipsub inspector suite: %w", err)
-	}
-	gossipSubConfigs.WithInspectorSuite(inspectorSuite)
-
+	// scoreOpt is the score option for the GossipSub pubsub system. It is a self-contained component that is used carry over the
+	// peer scoring parameters (including the entire app-specific score function) and inject it into the GossipSub pubsub system at creation time.
 	var scoreOpt *scoring.ScoreOption
+	// scoreTracer is the peer score tracer for the GossipSub pubsub system. It is used to trace the peer scores.
+	// It is only created if peer scoring is enabled. Otherwise, it is nil.
 	var scoreTracer p2p.PeerScoreTracer
+	// consumer is the consumer of the invalid control message notifications; i.e., the component that should be nlotified when
+	// an RPC validation fails. This component is responsible for taking action on the notification. Currently, the score option
+	// is the consumer of the invalid control message notifications.
+	// When the peer scoring is disabled, the consumer is a no-op consumer.
+	var consumer p2p.GossipSubInvCtrlMsgNotifConsumer
 	// currently, peer scoring is not supported for public networks.
 	if g.gossipSubCfg.PeerScoringEnabled && g.networkType != network.PublicNetwork {
 		// wires the gossipsub score option to the subscription provider.
@@ -307,13 +307,12 @@ func (g *Builder) Build(ctx irrecoverable.SignalerContext) (p2p.PubSubAdapter, e
 		if err != nil {
 			return nil, fmt.Errorf("could not create subscription provider: %w", err)
 		}
-
-		g.scoreOptionConfig.SetRegisterNotificationConsumerFunc(inspectorSuite.AddInvalidControlMessageConsumer)
 		scoreOpt, err = scoring.NewScoreOption(g.scoreOptionConfig, subscriptionProvider)
 		if err != nil {
 			return nil, fmt.Errorf("could not create gossipsub score option: %w", err)
 		}
 		gossipSubConfigs.WithScoreOption(scoreOpt)
+		consumer = scoreOpt // the score option is the consumer of the invalid control message notifications.
 
 		if g.gossipSubCfg.RpcTracer.ScoreTracerInterval > 0 {
 			scoreTracer = tracer.NewGossipSubScoreTracer(g.logger, g.idProvider, g.metricsCfg.Metrics, g.gossipSubCfg.RpcTracer.ScoreTracerInterval)
@@ -322,8 +321,26 @@ func (g *Builder) Build(ctx irrecoverable.SignalerContext) (p2p.PubSubAdapter, e
 	} else {
 		g.logger.Warn().
 			Str(logging.KeyNetworkingSecurity, "true").
-			Msg("gossipsub peer scoring is disabled")
+			Msg("gossipsub peer scoring is disabled, no-op consumer will be used for invalid control message notifications.")
+		consumer = scoring.NewNoopInvCtrlMsgNotifConsumer() // no-op consumer as peer scoring is disabled.
+	}
+
+	rpcValidationInspector, err := g.rpcInspectorFactory(
+		g.logger,
+		g.sporkId,
+		&g.gossipSubCfg.RpcInspector,
+		g.metricsCfg.Metrics,
+		g.metricsCfg.HeroCacheFactory,
+		g.networkType,
+		g.idProvider,
+		func() p2p.TopicProvider {
+			return gossipSub
+		},
+		consumer)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create new rpc valiadation inspector: %w", err)
 	}
+	gossipSubConfigs.WithRpcInspector(rpcValidationInspector)
 
 	if g.gossipSubTracer != nil {
 		gossipSubConfigs.WithTracer(g.gossipSubTracer)
@@ -333,7 +350,7 @@ func (g *Builder) Build(ctx irrecoverable.SignalerContext) (p2p.PubSubAdapter, e
 		return nil, fmt.Errorf("could not create gossipsub: host is nil")
 	}
 
-	gossipSub, err = g.gossipSubFactory(ctx, g.logger, g.h, gossipSubConfigs, inspectorSuite)
+	gossipSub, err = g.gossipSubFactory(ctx, g.logger, g.h, gossipSubConfigs, rpcValidationInspector)
 	if err != nil {
 		return nil, fmt.Errorf("could not create gossipsub: %w", err)
 	}
diff --git a/network/p2p/builder/inspector/aggregate.go b/network/p2p/builder/inspector/aggregate.go
deleted file mode 100644
index 604a888fb45..00000000000
--- a/network/p2p/builder/inspector/aggregate.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package inspector
-
-import (
-	"github.com/hashicorp/go-multierror"
-	pubsub "github.com/libp2p/go-libp2p-pubsub"
-	"github.com/libp2p/go-libp2p/core/peer"
-
-	"github.com/onflow/flow-go/network/p2p"
-)
-
-// AggregateRPCInspector gossip sub RPC inspector that combines multiple RPC inspectors into a single inspector. Each
-// individual inspector will be invoked synchronously.
-type AggregateRPCInspector struct {
-	inspectors []p2p.GossipSubRPCInspector
-}
-
-// NewAggregateRPCInspector returns new aggregate RPC inspector.
-func NewAggregateRPCInspector(inspectors ...p2p.GossipSubRPCInspector) *AggregateRPCInspector {
-	return &AggregateRPCInspector{
-		inspectors: inspectors,
-	}
-}
-
-// Inspect func with the p2p.GossipSubAppSpecificRpcInspector func signature that will invoke all the configured inspectors.
-func (a *AggregateRPCInspector) Inspect(peerID peer.ID, rpc *pubsub.RPC) error {
-	var errs *multierror.Error
-	for _, inspector := range a.inspectors {
-		err := inspector.Inspect(peerID, rpc)
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		}
-	}
-	return errs.ErrorOrNil()
-}
-
-func (a *AggregateRPCInspector) Inspectors() []p2p.GossipSubRPCInspector {
-	return a.inspectors
-}
diff --git a/network/p2p/builder/inspector/suite.go b/network/p2p/builder/inspector/suite.go
deleted file mode 100644
index b1b35d8bc2c..00000000000
--- a/network/p2p/builder/inspector/suite.go
+++ /dev/null
@@ -1,93 +0,0 @@
-package inspector
-
-import (
-	pubsub "github.com/libp2p/go-libp2p-pubsub"
-	"github.com/libp2p/go-libp2p/core/peer"
-
-	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/module/component"
-	"github.com/onflow/flow-go/module/irrecoverable"
-	"github.com/onflow/flow-go/network/p2p"
-	"github.com/onflow/flow-go/network/p2p/inspector/validation"
-)
-
-// GossipSubInspectorSuite encapsulates what is exposed to the libp2p node regarding the gossipsub RPC inspectors as
-// well as their notification distributors.
-type GossipSubInspectorSuite struct {
-	component.Component
-	aggregatedInspector       *AggregateRPCInspector
-	validationInspector       *validation.ControlMsgValidationInspector
-	ctrlMsgInspectDistributor p2p.GossipSubInspectorNotifDistributor
-}
-
-// TODO: this can be simplified as there is no more need for the aggregated inspector.
-var _ p2p.GossipSubInspectorSuite = (*GossipSubInspectorSuite)(nil)
-
-// NewGossipSubInspectorSuite creates a new GossipSubInspectorSuite.
-// The suite is composed of the aggregated inspector, which is used to inspect the gossipsub rpc messages, and the
-// control message notification distributor, which is used to notify consumers when a misbehaving peer regarding gossipsub
-// control messages is detected.
-// The suite is also a component, which is used to start and stop the rpc inspectors.
-// Args:
-//   - metricsInspector: the control message metrics inspector.
-//   - validationInspector: the gossipsub validation control message validation inspector.
-//   - ctrlMsgInspectDistributor: the notification distributor that is used to notify consumers when a misbehaving peer
-//
-// regarding gossipsub control messages is detected.
-// Returns:
-//   - the new GossipSubInspectorSuite.
-func NewGossipSubInspectorSuite(
-	validationInspector *validation.ControlMsgValidationInspector,
-	ctrlMsgInspectDistributor p2p.GossipSubInspectorNotifDistributor) *GossipSubInspectorSuite {
-	inspectors := []p2p.GossipSubRPCInspector{validationInspector}
-	s := &GossipSubInspectorSuite{
-		ctrlMsgInspectDistributor: ctrlMsgInspectDistributor,
-		validationInspector:       validationInspector,
-		aggregatedInspector:       NewAggregateRPCInspector(inspectors...),
-	}
-
-	builder := component.NewComponentManagerBuilder()
-	for _, rpcInspector := range inspectors {
-		rpcInspector := rpcInspector // capture loop variable
-		builder.AddWorker(func(ctx irrecoverable.SignalerContext, ready component.ReadyFunc) {
-			rpcInspector.Start(ctx)
-
-			select {
-			case <-ctx.Done():
-			case <-rpcInspector.Ready():
-				ready()
-			}
-
-			<-rpcInspector.Done()
-		})
-	}
-
-	s.Component = builder.Build()
-	return s
-}
-
-// InspectFunc returns the inspect function that is used to inspect the gossipsub rpc messages.
-// This function follows a dependency injection pattern, where the inspect function is injected into the gossipsu, and
-// is called whenever a gossipsub rpc message is received.
-func (s *GossipSubInspectorSuite) InspectFunc() func(peer.ID, *pubsub.RPC) error {
-	return s.aggregatedInspector.Inspect
-}
-
-// AddInvalidControlMessageConsumer adds a consumer to the invalid control message notification distributor.
-// This consumer is notified when a misbehaving peer regarding gossipsub control messages is detected. This follows a pub/sub
-// pattern where the consumer is notified when a new notification is published.
-// A consumer is only notified once for each notification, and only receives notifications that were published after it was added.
-func (s *GossipSubInspectorSuite) AddInvalidControlMessageConsumer(c p2p.GossipSubInvCtrlMsgNotifConsumer) {
-	s.ctrlMsgInspectDistributor.AddConsumer(c)
-}
-
-// ActiveClustersChanged is called when the list of active collection nodes cluster is changed.
-// GossipSubInspectorSuite consumes this event and forwards it to all the respective rpc inspectors, that are
-// concerned with this cluster-based topics (i.e., channels), so that they can update their internal state.
-func (s *GossipSubInspectorSuite) ActiveClustersChanged(list flow.ChainIDList) {
-	for _, rpcInspector := range s.aggregatedInspector.Inspectors() {
-		if r, ok := rpcInspector.(p2p.GossipSubMsgValidationRpcInspector); ok {
-			r.ActiveClustersChanged(list)
-		}
-	}
-}
diff --git a/network/p2p/builder/libp2pNodeBuilder.go b/network/p2p/builder/libp2pNodeBuilder.go
index 7d9709ae457..1b6da66216f 100644
--- a/network/p2p/builder/libp2pNodeBuilder.go
+++ b/network/p2p/builder/libp2pNodeBuilder.go
@@ -146,7 +146,14 @@ func (builder *LibP2PNodeBuilder) SetRoutingSystem(f func(context.Context, host.
 	return builder
 }
 
-func (builder *LibP2PNodeBuilder) SetGossipSubFactory(gf p2p.GossipSubFactoryFunc, cf p2p.GossipSubAdapterConfigFunc) p2p.NodeBuilder {
+// OverrideGossipSubFactory overrides the default gossipsub factory for the GossipSub protocol.
+// The purpose of override is to allow the node to provide a custom gossipsub factory for sake of testing or experimentation.
+// Note: it is not recommended to override the default gossipsub factory in production unless you know what you are doing.
+// Args:
+// - factory: custom gossipsub factory
+// Returns:
+// - NodeBuilder: the node builder
+func (builder *LibP2PNodeBuilder) OverrideGossipSubFactory(gf p2p.GossipSubFactoryFunc, cf p2p.GossipSubAdapterConfigFunc) p2p.NodeBuilder {
 	builder.gossipSubBuilder.SetGossipSubFactory(gf)
 	builder.gossipSubBuilder.SetGossipSubConfigFunc(cf)
 	return builder
@@ -180,8 +187,15 @@ func (builder *LibP2PNodeBuilder) OverrideNodeConstructor(f p2p.NodeConstructor)
 	return builder
 }
 
-func (builder *LibP2PNodeBuilder) OverrideDefaultRpcInspectorSuiteFactory(factory p2p.GossipSubRpcInspectorSuiteFactoryFunc) p2p.NodeBuilder {
-	builder.gossipSubBuilder.OverrideDefaultRpcInspectorSuiteFactory(factory)
+// OverrideDefaultRpcInspectorFactory overrides the default rpc inspector factory for the GossipSub protocol.
+// The purpose of override is to allow the node to provide a custom rpc inspector factory for sake of testing or experimentation.
+// Note: it is not recommended to override the default rpc inspector factory in production unless you know what you are doing.
+// Args:
+// - factory: custom rpc inspector factory
+// Returns:
+// - NodeBuilder: the node builder
+func (builder *LibP2PNodeBuilder) OverrideDefaultRpcInspectorFactory(factory p2p.GossipSubRpcInspectorFactoryFunc) p2p.NodeBuilder {
+	builder.gossipSubBuilder.OverrideDefaultRpcInspectorFactory(factory)
 	return builder
 }
 
@@ -215,7 +229,7 @@ func (builder *LibP2PNodeBuilder) Build() (p2p.LibP2PNode, error) {
 		}
 
 		opts = append(opts, libp2p.ResourceManager(mgr))
-		builder.logger.Info().Msg("default libp2p resource manager is enabled with metrics")
+		builder.logger.Info().Msgf("default libp2p resource manager is enabled with metrics, pubkey: %s", builder.networkKey.PublicKey())
 	}
 
 	if builder.connManager != nil {
diff --git a/network/p2p/builder/utils.go b/network/p2p/builder/utils.go
index b43531e5151..1a4f8a7bd80 100644
--- a/network/p2p/builder/utils.go
+++ b/network/p2p/builder/utils.go
@@ -20,7 +20,7 @@ func notEjectedPeerFilter(idProvider module.IdentityProvider) p2p.PeerFilter {
 	return func(p peer.ID) error {
 		if id, found := idProvider.ByPeerID(p); !found {
 			return fmt.Errorf("failed to get identity of unknown peer with peer id %s", p2plogging.PeerId(p))
-		} else if id.Ejected {
+		} else if id.IsEjected() {
 			return fmt.Errorf("peer %s with node id %s is ejected", p2plogging.PeerId(p), id.NodeID.String())
 		}
 
diff --git a/network/p2p/cache/node_blocklist_wrapper.go b/network/p2p/cache/node_blocklist_wrapper.go
index fab3d27b56c..8bac0b7f55d 100644
--- a/network/p2p/cache/node_blocklist_wrapper.go
+++ b/network/p2p/cache/node_blocklist_wrapper.go
@@ -128,21 +128,21 @@ func (w *NodeDisallowListingWrapper) GetDisallowList() flow.IdentifierList {
 // protocol that pass the provided filter. Caution, this includes ejected nodes.
 // Please check the `Ejected` flag in the returned identities (or provide a
 // filter for removing ejected nodes).
-func (w *NodeDisallowListingWrapper) Identities(filter flow.IdentityFilter) flow.IdentityList {
+func (w *NodeDisallowListingWrapper) Identities(filter flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 	identities := w.identityProvider.Identities(filter)
 	if len(identities) == 0 {
 		return identities
 	}
 
-	// Iterate over all returned identities and set ejected flag to true. We
-	// copy both the return slice and identities of blocked nodes to avoid
+	// Iterate over all returned identities and set the `EpochParticipationStatus` to `flow.EpochParticipationStatusEjected`.
+	// We copy both the return slice and identities of blocked nodes to avoid
 	// any possibility of accidentally modifying the wrapped IdentityProvider
 	idtx := make(flow.IdentityList, 0, len(identities))
 	w.m.RLock()
 	for _, identity := range identities {
 		if w.disallowList.Contains(identity.NodeID) {
-			var i = *identity // shallow copy is sufficient, because `Ejected` flag is in top-level struct
-			i.Ejected = true
+			var i = *identity // shallow copy is sufficient, because `EpochParticipationStatus` is a value type in DynamicIdentity which is also a value type.
+			i.EpochParticipationStatus = flow.EpochParticipationStatusEjected
 			if filter(&i) { // we need to check the filter here again, because the filter might drop ejected nodes and we are modifying the ejected status here
 				idtx = append(idtx, &i)
 			}
@@ -170,7 +170,7 @@ func (w *NodeDisallowListingWrapper) ByNodeID(identifier flow.Identifier) (*flow
 //   - If the node's identity is nil, there is nothing to do because we don't generate identities here.
 //   - If the node is already ejected, we don't have to check the disallowList.
 func (w *NodeDisallowListingWrapper) setEjectedIfBlocked(identity *flow.Identity) *flow.Identity {
-	if identity == nil || identity.Ejected {
+	if identity == nil || identity.IsEjected() {
 		return identity
 	}
 
@@ -181,11 +181,12 @@ func (w *NodeDisallowListingWrapper) setEjectedIfBlocked(identity *flow.Identity
 		return identity
 	}
 
-	// For blocked nodes, we want to return their `Identity` with the `Ejected` flag
-	// set to true. Caution: we need to copy the `Identity` before we override `Ejected`, as we
+	// For blocked nodes, we want to return their `Identity` with the `EpochParticipationStatus`
+	// set to `flow.EpochParticipationStatusEjected`.
+	// Caution: we need to copy the `Identity` before we override `EpochParticipationStatus`, as we
 	// would otherwise potentially change the wrapped IdentityProvider.
-	var i = *identity // shallow copy is sufficient, because `Ejected` flag is in top-level struct
-	i.Ejected = true
+	var i = *identity // shallow copy is sufficient, because `EpochParticipationStatus` is a value type in DynamicIdentity which is also a value type.
+	i.EpochParticipationStatus = flow.EpochParticipationStatusEjected
 	return &i
 }
 
diff --git a/network/p2p/cache/node_blocklist_wrapper_test.go b/network/p2p/cache/node_blocklist_wrapper_test.go
index cf05dd71e73..c3e3d36a37f 100644
--- a/network/p2p/cache/node_blocklist_wrapper_test.go
+++ b/network/p2p/cache/node_blocklist_wrapper_test.go
@@ -17,7 +17,6 @@ import (
 	"github.com/onflow/flow-go/network"
 	"github.com/onflow/flow-go/network/mocknetwork"
 	"github.com/onflow/flow-go/network/p2p/cache"
-	"github.com/onflow/flow-go/network/underlay"
 	"github.com/onflow/flow-go/utils/unittest"
 )
 
@@ -72,7 +71,7 @@ func (s *NodeDisallowListWrapperTestSuite) TestHonestNode() {
 		f := filter.In(identities[3:4])
 		expectedFilteredIdentities := identities.Filter(f)
 		s.provider.On("Identities", mock.Anything).Return(
-			func(filter flow.IdentityFilter) flow.IdentityList {
+			func(filter flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 				return identities.Filter(filter)
 			},
 			nil,
@@ -111,15 +110,15 @@ func (s *NodeDisallowListWrapperTestSuite) TestDisallowListNode() {
 			originalIdentity := blocklist[index.Inc()]
 			s.provider.On("ByNodeID", originalIdentity.NodeID).Return(originalIdentity, expectedfound)
 
-			var expectedIdentity = *originalIdentity // expected Identity is a copy of the original
-			expectedIdentity.Ejected = true          // with the `Ejected` flag set to true
+			var expectedIdentity = *originalIdentity                                         // expected Identity is a copy of the original
+			expectedIdentity.EpochParticipationStatus = flow.EpochParticipationStatusEjected // with the `Ejected` flag set to true
 
 			i, found := s.wrapper.ByNodeID(originalIdentity.NodeID)
 			require.Equal(s.T(), expectedfound, found)
 			require.Equal(s.T(), &expectedIdentity, i)
 
 			// check that originalIdentity returned by wrapped `IdentityProvider` is _not_ modified
-			require.False(s.T(), originalIdentity.Ejected)
+			require.False(s.T(), originalIdentity.IsEjected())
 		})
 
 		s.Run(fmt.Sprintf("IdentityProvider.ByPeerID returning (<non-nil identity>, %v)", expectedfound), func() {
@@ -127,15 +126,15 @@ func (s *NodeDisallowListWrapperTestSuite) TestDisallowListNode() {
 			peerID := (peer.ID)(originalIdentity.NodeID.String())
 			s.provider.On("ByPeerID", peerID).Return(originalIdentity, expectedfound)
 
-			var expectedIdentity = *originalIdentity // expected Identity is a copy of the original
-			expectedIdentity.Ejected = true          // with the `Ejected` flag set to true
+			var expectedIdentity = *originalIdentity                                         // expected Identity is a copy of the original
+			expectedIdentity.EpochParticipationStatus = flow.EpochParticipationStatusEjected // with the `Ejected` flag set to true
 
 			i, found := s.wrapper.ByPeerID(peerID)
 			require.Equal(s.T(), expectedfound, found)
 			require.Equal(s.T(), &expectedIdentity, i)
 
 			// check that originalIdentity returned by `IdentityProvider` is _not_ modified by wrapper
-			require.False(s.T(), originalIdentity.Ejected)
+			require.False(s.T(), originalIdentity.IsEjected())
 		})
 	}
 
@@ -149,19 +148,19 @@ func (s *NodeDisallowListWrapperTestSuite) TestDisallowListNode() {
 
 		s.provider.On("Identities", mock.Anything).Return(combinedIdentities)
 
-		noFilter := filter.Not(filter.In(nil))
+		noFilter := filter.Not(filter.In[flow.Identity](nil))
 		identities := s.wrapper.Identities(noFilter)
 
 		require.Equal(s.T(), numIdentities, len(identities)) // expected number resulting identities have the
 		for _, i := range identities {
 			_, isBlocked := blocklistLookup[i.NodeID]
-			require.Equal(s.T(), isBlocked, i.Ejected)
+			require.Equal(s.T(), isBlocked, i.IsEjected())
 		}
 
 		// check that original `combinedIdentities` returned by `IdentityProvider` are _not_ modified by wrapper
 		require.Equal(s.T(), numIdentities, len(combinedIdentities)) // length of list should not be modified by wrapper
 		for _, i := range combinedIdentities {
-			require.False(s.T(), i.Ejected) // Ejected flag should still have the original value (false here)
+			require.False(s.T(), i.IsEjected()) // Ejected flag should still have the original value (false here)
 		}
 	})
 
@@ -177,19 +176,19 @@ func (s *NodeDisallowListWrapperTestSuite) TestDisallowListNode() {
 
 		s.provider.On("Identities", mock.Anything).Return(combinedIdentities)
 
-		identities := s.wrapper.Identities(underlay.NotEjectedFilter)
+		identities := s.wrapper.Identities(filter.NotEjectedFilter)
 
 		require.Equal(s.T(), len(honestIdentities), len(identities)) // expected only honest nodes to be returned
 		for _, i := range identities {
 			_, isBlocked := blocklistLookup[i.NodeID]
 			require.False(s.T(), isBlocked)
-			require.False(s.T(), i.Ejected)
+			require.False(s.T(), i.IsEjected())
 		}
 
 		// check that original `combinedIdentities` returned by `IdentityProvider` are _not_ modified by wrapper
 		require.Equal(s.T(), numIdentities, len(combinedIdentities)) // length of list should not be modified by wrapper
 		for _, i := range combinedIdentities {
-			require.False(s.T(), i.Ejected) // Ejected flag should still have the original value (false here)
+			require.False(s.T(), i.IsEjected()) // Ejected flag should still have the original value (false here)
 		}
 	})
 }
@@ -222,13 +221,13 @@ func (s *NodeDisallowListWrapperTestSuite) TestUnknownNode() {
 // it in combination a no-op. We test two scenarious
 //   - Node whose original `Identity` has `Ejected = false`:
 //     After adding the node to the disallowList and then removing it again, the `Ejected` should be false.
-//   - Node whose original `Identity` has `Ejected = true`:
+//   - Node whose original `Identity` has `EpochParticipationStatus = flow.EpochParticipationStatusEjected`:
 //     After adding the node to the disallowList and then removing it again, the `Ejected` should be still be true.
 func (s *NodeDisallowListWrapperTestSuite) TestDisallowListAddRemove() {
-	for _, originalEjected := range []bool{true, false} {
-		s.Run(fmt.Sprintf("Add & remove node with Ejected = %v", originalEjected), func() {
+	for _, originalParticipationStatus := range []flow.EpochParticipationStatus{flow.EpochParticipationStatusEjected, flow.EpochParticipationStatusActive} {
+		s.Run(fmt.Sprintf("Add & remove node with EpochParticipationStatus = %v", originalParticipationStatus), func() {
 			originalIdentity := unittest.IdentityFixture()
-			originalIdentity.Ejected = originalEjected
+			originalIdentity.EpochParticipationStatus = originalParticipationStatus
 			peerID := (peer.ID)(originalIdentity.NodeID.String())
 			s.provider.On("ByNodeID", originalIdentity.NodeID).Return(originalIdentity, true)
 			s.provider.On("ByPeerID", peerID).Return(originalIdentity, true)
@@ -237,11 +236,11 @@ func (s *NodeDisallowListWrapperTestSuite) TestDisallowListAddRemove() {
 			// an Identity with `Ejected` equal to the original value should be returned
 			i, found := s.wrapper.ByNodeID(originalIdentity.NodeID)
 			require.True(s.T(), found)
-			require.Equal(s.T(), originalEjected, i.Ejected)
+			require.Equal(s.T(), originalParticipationStatus, i.EpochParticipationStatus)
 
 			i, found = s.wrapper.ByPeerID(peerID)
 			require.True(s.T(), found)
-			require.Equal(s.T(), originalEjected, i.Ejected)
+			require.Equal(s.T(), originalParticipationStatus, i.EpochParticipationStatus)
 
 			// step 2: _after_ putting node on disallowList,
 			// an Identity with `Ejected` equal to `true` should be returned
@@ -254,11 +253,11 @@ func (s *NodeDisallowListWrapperTestSuite) TestDisallowListAddRemove() {
 
 			i, found = s.wrapper.ByNodeID(originalIdentity.NodeID)
 			require.True(s.T(), found)
-			require.True(s.T(), i.Ejected)
+			require.True(s.T(), i.IsEjected())
 
 			i, found = s.wrapper.ByPeerID(peerID)
 			require.True(s.T(), found)
-			require.True(s.T(), i.Ejected)
+			require.True(s.T(), i.IsEjected())
 
 			// step 3: after removing the node from the disallowList,
 			// an Identity with `Ejected` equal to the original value should be returned
@@ -271,11 +270,11 @@ func (s *NodeDisallowListWrapperTestSuite) TestDisallowListAddRemove() {
 
 			i, found = s.wrapper.ByNodeID(originalIdentity.NodeID)
 			require.True(s.T(), found)
-			require.Equal(s.T(), originalEjected, i.Ejected)
+			require.Equal(s.T(), originalParticipationStatus, i.EpochParticipationStatus)
 
 			i, found = s.wrapper.ByPeerID(peerID)
 			require.True(s.T(), found)
-			require.Equal(s.T(), originalEjected, i.Ejected)
+			require.Equal(s.T(), originalParticipationStatus, i.EpochParticipationStatus)
 		})
 	}
 }
diff --git a/network/p2p/cache/protocol_state_provider.go b/network/p2p/cache/protocol_state_provider.go
index cf3bba4e49a..6f7a4462b5b 100644
--- a/network/p2p/cache/protocol_state_provider.go
+++ b/network/p2p/cache/protocol_state_provider.go
@@ -141,7 +141,7 @@ func (p *ProtocolStateIDCache) update(blockID flow.Identifier) {
 // protocol that pass the provided filter. Caution, this includes ejected nodes.
 // Please check the `Ejected` flag in the identities (or provide a filter for
 // removing ejected nodes).
-func (p *ProtocolStateIDCache) Identities(filter flow.IdentityFilter) flow.IdentityList {
+func (p *ProtocolStateIDCache) Identities(filter flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 	p.mu.RLock()
 	defer p.mu.RUnlock()
 	return p.identities.Filter(filter)
diff --git a/network/p2p/cache/protocol_state_provider_test.go b/network/p2p/cache/protocol_state_provider_test.go
index 4aa593ef2a3..eca979de299 100644
--- a/network/p2p/cache/protocol_state_provider_test.go
+++ b/network/p2p/cache/protocol_state_provider_test.go
@@ -73,7 +73,7 @@ func (suite *ProtocolStateProviderTestSuite) triggerUpdate() {
 	// set up protocol snapshot mock
 	snapshot := &mockprotocol.Snapshot{}
 	snapshot.On("Identities", mock.Anything).Return(
-		func(filter flow.IdentityFilter) flow.IdentityList {
+		func(filter flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return suite.participants.Filter(filter)
 		},
 		nil,
diff --git a/network/p2p/config/gossipsub.go b/network/p2p/config/gossipsub.go
index 31b69dd221b..16770b7efd0 100644
--- a/network/p2p/config/gossipsub.go
+++ b/network/p2p/config/gossipsub.go
@@ -109,15 +109,19 @@ type SubscriptionProviderParameters struct {
 
 // GossipSubTracerParameters keys.
 const (
-	LocalMeshLogIntervalKey         = "local-mesh-logging-interval"
-	ScoreTracerIntervalKey          = "score-tracer-interval"
-	RPCSentTrackerCacheSizeKey      = "rpc-sent-tracker-cache-size"
-	RPCSentTrackerQueueCacheSizeKey = "rpc-sent-tracker-queue-cache-size"
-	RPCSentTrackerNumOfWorkersKey   = "rpc-sent-tracker-workers"
+	LocalMeshLogIntervalKey              = "local-mesh-logging-interval"
+	ScoreTracerIntervalKey               = "score-tracer-interval"
+	RPCSentTrackerCacheSizeKey           = "rpc-sent-tracker-cache-size"
+	RPCSentTrackerQueueCacheSizeKey      = "rpc-sent-tracker-queue-cache-size"
+	RPCSentTrackerNumOfWorkersKey        = "rpc-sent-tracker-workers"
+	DuplicateMessageCacheTrackerKey      = "duplicate-message-tracker"
+	DuplicateMessageCacheTrackerSizeKey  = "cache-size"
+	DuplicateMessageCacheTrackerDecayKey = "decay"
 )
 
 // GossipSubTracerParameters is the config for the gossipsub tracer. GossipSub tracer is used to trace the local mesh events and peer scores.
 type GossipSubTracerParameters struct {
+	DuplicateMessageTrackerConfig DuplicateMessageTrackerConfig `validate:"required" mapstructure:"duplicate-message-tracker"`
 	// LocalMeshLogInterval is the interval at which the local mesh is logged.
 	LocalMeshLogInterval time.Duration `validate:"gt=0s" mapstructure:"local-mesh-logging-interval"`
 	// ScoreTracerInterval is the interval at which the score tracer logs the peer scores.
@@ -130,6 +134,16 @@ type GossipSubTracerParameters struct {
 	RpcSentTrackerNumOfWorkers int `validate:"gt=0" mapstructure:"rpc-sent-tracker-workers"`
 }
 
+// DuplicateMessageTrackerConfig duplicate message cache config.
+type DuplicateMessageTrackerConfig struct {
+	// CacheSize cache size of the gossipsub duplicate message tracker.
+	CacheSize uint32 `validate:"gt=0" mapstructure:"cache-size"`
+	// Decay rate of decay for the peer duplicate message counters.
+	Decay float64 `validate:"gt=0,lt=1" mapstructure:"decay"`
+	// SkipDecayThreshold the threshold for which when the counter is below this value, the decay function will not be called
+	SkipDecayThreshold float64 `validate:"gt=0,lt=1" mapstructure:"skip-decay-threshold"`
+}
+
 // ResourceScope is the scope of the resource, e.g., system, transient, protocol, peer, peer-protocol.
 type ResourceScope string
 
diff --git a/network/p2p/config/gossipsub_rpc_inspectors.go b/network/p2p/config/gossipsub_rpc_inspectors.go
index fec58ce5fe1..d18953d3240 100644
--- a/network/p2p/config/gossipsub_rpc_inspectors.go
+++ b/network/p2p/config/gossipsub_rpc_inspectors.go
@@ -17,6 +17,7 @@ type RpcInspectorParameters struct {
 
 // RpcValidationInspectorParameters keys.
 const (
+	ProcessKey                      = "process"
 	ClusterPrefixedMessageConfigKey = "cluster-prefixed-messages"
 	IWantConfigKey                  = "iwant"
 	IHaveConfigKey                  = "ihave"
@@ -25,7 +26,7 @@ const (
 	InspectionQueueConfigKey        = "inspection-queue"
 )
 
-// RpcValidationInspector validation limits used for gossipsub RPC control message inspection.
+// RpcValidationInspector rpc control message validation inspector configuration.
 type RpcValidationInspector struct {
 	ClusterPrefixedMessage ClusterPrefixedMessageInspectionParameters `mapstructure:"cluster-prefixed-messages"`
 	IWant                  IWantRpcInspectionParameters               `mapstructure:"iwant"`
@@ -33,6 +34,67 @@ type RpcValidationInspector struct {
 	GraftPrune             GraftPruneRpcInspectionParameters          `mapstructure:"graft-and-prune"`
 	PublishMessages        PublishMessageInspectionParameters         `mapstructure:"publish-messages"`
 	InspectionQueue        InspectionQueueParameters                  `mapstructure:"inspection-queue"`
+	// InspectionProcess configuration that controls which aspects of rpc inspection are enabled and disabled during inspect message request processing.
+	InspectionProcess InspectionProcess `mapstructure:"process"`
+}
+
+// InspectionProcess configuration that controls which aspects of rpc inspection are enabled and disabled during inspect message request processing.
+type InspectionProcess struct {
+	Inspect  Inspect  `validate:"required" mapstructure:"inspection"`
+	Truncate Truncate `validate:"required" mapstructure:"truncation"`
+}
+
+const (
+	InspectionKey       = "inspection"
+	TruncationKey       = "truncation"
+	EnableKey           = "enable"
+	DisabledKey         = "disabled"
+	MessageIDKey        = "message-id"
+	RejectUnstakedPeers = "reject-unstaked-peers"
+)
+
+// Inspect configuration to enable/disable RPC inspection for a particular control message type.
+type Inspect struct {
+	// Disabled serves as a fail-safe mechanism to globally deactivate inspection logic. When this fail-safe is activated it disables all
+	// aspects of the inspection logic, irrespective of individual configurations like inspection.enable-graft, inspection.enable-prune, etc.
+	// Consequently, all metrics collection and logging related to the rpc and inspection will also be disabled.
+	// It is important to note that activating this fail-safe results in a comprehensive deactivation inspection features.
+	// Please use this setting judiciously, considering its broad impact on the behavior of control message handling.
+	Disabled bool `mapstructure:"disabled"`
+	// EnableGraft enable graft control message inspection.
+	EnableGraft bool `mapstructure:"enable-graft"`
+	// EnablePrune enable prune control message inspection.
+	EnablePrune bool `mapstructure:"enable-prune"`
+	// EnableIHave enable iHave control message inspection.
+	EnableIHave bool `mapstructure:"enable-ihave"`
+	// EnableIWant enable iWant control message inspection.
+	EnableIWant bool `mapstructure:"enable-iwant"`
+	// EnablePublish enable publish message inspection.
+	EnablePublish bool `mapstructure:"enable-publish"`
+	// RejectUnstakedPeers when set to true RPC's will be rejected from unstaked peers.
+	RejectUnstakedPeers bool `mapstructure:"reject-unstaked-peers"`
+}
+
+// Truncate configuration to enable/disable RPC truncation for a particular control message type.
+type Truncate struct {
+	// Disabled serves as a fail-safe mechanism to globally deactivate truncation logic. When this fail-safe is activated it disables all
+	// aspects of the truncation logic, irrespective of individual configurations like truncation.enable-graft, truncation.enable-prune, etc.
+	// Consequently, all metrics collection and logging related to the rpc and inspection will also be disabled.
+	// It is important to note that activating this fail-safe results in a comprehensive deactivation truncation features.
+	// Please use this setting judiciously, considering its broad impact on the behavior of control message handling.
+	Disabled bool `mapstructure:"disabled"`
+	// EnableGraft enable graft control message truncation.
+	EnableGraft bool `mapstructure:"enable-graft"`
+	// EnablePrune enable prune control message truncation.
+	EnablePrune bool `mapstructure:"enable-prune"`
+	// EnableIHave enable iHave control message truncation.
+	EnableIHave bool `mapstructure:"enable-ihave"`
+	// EnableIHaveMessageIds enable iHave message id truncation.
+	EnableIHaveMessageIds bool `mapstructure:"enable-ihave-message-id"`
+	// EnableIWant enable iWant control message truncation.
+	EnableIWant bool `mapstructure:"enable-iwant"`
+	// EnableIWantMessageIds enable iWant message id truncation.
+	EnableIWantMessageIds bool `mapstructure:"enable-iwant-message-id"`
 }
 
 const (
@@ -79,6 +141,10 @@ type GraftPruneRpcInspectionParameters struct {
 	// Ideally, a GRAFT or PRUNE message should not have any duplicate topics, hence a topic ID is counted as a duplicate only if it is repeated more than once.
 	// When the total number of duplicate topic ids in a single GRAFT or PRUNE message exceeds this threshold, the inspection of message will fail.
 	DuplicateTopicIdThreshold int `validate:"gte=0" mapstructure:"duplicate-topic-id-threshold"`
+
+	// InvalidTopicIdThreshold Maximum number of total invalid topic ids in a single GRAFT or PRUNE message, ideally this should be 0 but we allow for some tolerance
+	// to avoid penalizing peers that are not malicious but are misbehaving due to bugs or other issues.
+	InvalidTopicIdThreshold int `validate:"gte=0" mapstructure:"invalid-topic-id-threshold"`
 }
 
 const (
@@ -86,6 +152,7 @@ const (
 	MessageIdCountThreshold    = "message-id-count-threshold"
 	CacheMissThresholdKey      = "cache-miss-threshold"
 	DuplicateMsgIDThresholdKey = "duplicate-message-id-threshold"
+	InvalidTopicIdThresholdKey = "invalid-topic-id-threshold"
 )
 
 // IWantRpcInspectionParameters contains the "numerical values" for iwant rpc control inspection.
@@ -148,6 +215,10 @@ type IHaveRpcInspectionParameters struct {
 	// Ideally, an iHave message should not have any duplicate message IDs, hence a message id is considered duplicate when it is repeated more than once
 	// within the same iHave message. When the total number of duplicate message ids in a single iHave message exceeds this threshold, the inspection of message will fail.
 	DuplicateMessageIdThreshold int `validate:"gte=0" mapstructure:"duplicate-message-id-threshold"`
+
+	// InvalidTopicIdThreshold Maximum number of total invalid topic ids in a single IHAVE message, ideally this should be 0 but we allow for some tolerance
+	// to avoid penalizing peers that are not malicious but are misbehaving due to bugs or other issues.
+	InvalidTopicIdThreshold int `validate:"gte=0" mapstructure:"invalid-topic-id-threshold"`
 }
 
 const (
diff --git a/network/p2p/config/peer_scoring.go b/network/p2p/config/peer_scoring.go
index 25b70e77687..45785b89b0a 100644
--- a/network/p2p/config/peer_scoring.go
+++ b/network/p2p/config/peer_scoring.go
@@ -21,9 +21,10 @@ type PeerScoringParameters struct {
 const (
 	AppSpecificScoreWeightKey = "app-specific-score-weight"
 	DecayToZeroKey            = "decay-to-zero"
-	ThresholdsKey             = "thresholds"
 	BehaviourKey              = "behaviour"
 	TopicKey                  = "topic"
+	ThresholdsKey             = "thresholds"
+	ThresholdKey              = "threshold"
 )
 
 type InternalGossipSubScoreParams struct {
@@ -63,6 +64,7 @@ const (
 	UnknownIdentityKey     = "unknown-identity"
 	InvalidSubscriptionKey = "invalid-subscription"
 	StakedIdentityKey      = "staked-identity"
+	DuplicateMessageKey    = "duplicate-message"
 	RewardKey              = "reward"
 	PenaltyKey             = "penalty"
 )
@@ -82,6 +84,11 @@ type ApplicationSpecificScoreParameters struct {
 	// InvalidSubscriptionPenalty is the  penalty for invalid subscription. It is applied to the peer's score when
 	// the peer subscribes to a topic that it is not authorized to subscribe to.
 	InvalidSubscriptionPenalty float64 `validate:"lt=0" mapstructure:"invalid-subscription-penalty"`
+	// DuplicateMessagePenalty is the penalty for duplicate messages detected by the gossipsub tracer for a peer.
+	// The penalty is multiplied by the current duplicate message count for a peer before it is applied to the application specific score.
+	DuplicateMessagePenalty float64 `validate:"lt=0" mapstructure:"duplicate-message-penalty"`
+	// DuplicateMessageThreshold the threshold at which the duplicate message count for a peer will result in the peer being penalized.
+	DuplicateMessageThreshold float64 `validate:"gt=0" mapstructure:"duplicate-message-threshold"`
 	// MaxAppSpecificReward is the  reward for well-behaving staked peers. If a peer does not have
 	// any misbehavior record, e.g., invalid subscription, invalid message, etc., it will be rewarded with this score.
 	MaxAppSpecificReward float64 `validate:"gt=0" mapstructure:"max-app-specific-reward"`
@@ -93,7 +100,6 @@ type ApplicationSpecificScoreParameters struct {
 
 const (
 	GossipThresholdKey             = "gossip"
-	PublishThresholdKey            = "publish"
 	GraylistThresholdKey           = "graylist"
 	AcceptPXThresholdKey           = "accept-px"
 	OpportunisticGraftThresholdKey = "opportunistic-graft"
diff --git a/network/p2p/config/score_registry.go b/network/p2p/config/score_registry.go
index 3788451325a..ef35dc8bf77 100644
--- a/network/p2p/config/score_registry.go
+++ b/network/p2p/config/score_registry.go
@@ -25,9 +25,10 @@ type ScoringRegistryParameters struct {
 }
 
 const (
-	ScoreUpdateWorkerNumKey        = "score-update-worker-num"
-	ScoreUpdateRequestQueueSizeKey = "score-update-request-queue-size"
-	ScoreTTLKey                    = "score-ttl"
+	ScoreUpdateWorkerNumKey                       = "score-update-worker-num"
+	ScoreUpdateRequestQueueSizeKey                = "score-update-request-queue-size"
+	ScoreTTLKey                                   = "score-ttl"
+	InvalidControlMessageNotificationQueueSizeKey = "invalid-control-message-notification-queue-size"
 )
 
 // AppSpecificScoreParameters is the parameters for the GossipSubAppSpecificScoreRegistry.
@@ -39,6 +40,9 @@ type AppSpecificScoreParameters struct {
 	// ScoreUpdateRequestQueueSize is the size of the worker pool for handling the application specific score update of peers in a non-blocking way.
 	ScoreUpdateRequestQueueSize uint32 `validate:"gt=0" mapstructure:"score-update-request-queue-size"`
 
+	// InvalidControlMessageNotificationQueueSize is the size of the queue for handling invalid control message notifications in a non-blocking way.
+	InvalidControlMessageNotificationQueueSize uint32 `validate:"gt=0" mapstructure:"invalid-control-message-notification-queue-size"`
+
 	// ScoreTTL is the time to live of the application specific score of a peer; the registry keeps a cached copy of the
 	// application specific score of a peer for this duration. When the duration expires, the application specific score
 	// of the peer is updated asynchronously. As long as the update is in progress, the cached copy of the application
@@ -85,11 +89,11 @@ type SpamRecordCacheDecay struct {
 
 const (
 	MisbehaviourPenaltiesKey          = "misbehaviour-penalties"
-	GraftMisbehaviourKey              = "graft"
-	PruneMisbehaviourKey              = "prune"
-	IHaveMisbehaviourKey              = "ihave"
-	IWantMisbehaviourKey              = "iwant"
-	PublishMisbehaviourKey            = "publish"
+	GraftKey                          = "graft"
+	PruneKey                          = "prune"
+	IWantKey                          = "iwant"
+	IHaveKey                          = "ihave"
+	PublishKey                        = "publish"
 	ClusterPrefixedReductionFactorKey = "cluster-prefixed-reduction-factor"
 )
 
diff --git a/network/p2p/connection/connManager.go b/network/p2p/connection/connManager.go
index 38f6773843f..094c5ffa833 100644
--- a/network/p2p/connection/connManager.go
+++ b/network/p2p/connection/connManager.go
@@ -98,3 +98,7 @@ func (cm *ConnManager) TrimOpenConns(ctx context.Context) {
 func (cm *ConnManager) Close() error {
 	return cm.basicConnMgr.Close()
 }
+
+func (cm *ConnManager) CheckLimit(l connmgr.GetConnLimiter) error {
+	return cm.basicConnMgr.CheckLimit(l)
+}
diff --git a/network/p2p/connection/connManager_test.go b/network/p2p/connection/connManager_test.go
index 115192a67f8..6b74e9c097c 100644
--- a/network/p2p/connection/connManager_test.go
+++ b/network/p2p/connection/connManager_test.go
@@ -93,7 +93,7 @@ func testSequence(t *testing.T, sequence []fun, connMgr *connection.ConnManager)
 func generatePeerInfo(t *testing.T) peer.ID {
 	key := p2pfixtures.NetworkingKeyFixtures(t)
 	identity := unittest.IdentityFixture(unittest.WithNetworkingKey(key.PublicKey()), unittest.WithAddress("1.1.1.1:0"))
-	pInfo, err := utils.PeerAddressInfo(*identity)
+	pInfo, err := utils.PeerAddressInfo(identity.IdentitySkeleton)
 	require.NoError(t, err)
 	return pInfo.ID
 }
diff --git a/network/p2p/consumers.go b/network/p2p/consumers.go
index f079a3864af..21e4bd4dfe3 100644
--- a/network/p2p/consumers.go
+++ b/network/p2p/consumers.go
@@ -1,29 +1,11 @@
 package p2p
 
 import (
-	pubsub "github.com/libp2p/go-libp2p-pubsub"
 	"github.com/libp2p/go-libp2p/core/peer"
 
-	"github.com/onflow/flow-go/module/component"
 	p2pmsg "github.com/onflow/flow-go/network/p2p/message"
 )
 
-// GossipSubInspectorNotifDistributor is the interface for the distributor that distributes gossip sub inspector notifications.
-// It is used to distribute notifications to the consumers in an asynchronous manner and non-blocking manner.
-// The implementation should guarantee that all registered consumers are called upon distribution of a new event.
-type GossipSubInspectorNotifDistributor interface {
-	component.Component
-	// Distribute distributes the event to all the consumers.
-	// Any error returned by the distributor is non-recoverable and will cause the node to crash.
-	// Implementation must be concurrency safe, and non-blocking.
-	Distribute(notification *InvCtrlMsgNotif) error
-
-	// AddConsumer adds a consumer to the distributor. The consumer will be called the distributor distributes a new event.
-	// AddConsumer must be concurrency safe. Once a consumer is added, it must be called for all future events.
-	// There is no guarantee that the consumer will be called for events that were already received by the distributor.
-	AddConsumer(GossipSubInvCtrlMsgNotifConsumer)
-}
-
 // CtrlMsgTopicType represents the type of the topic within a control message.
 type CtrlMsgTopicType uint64
 
@@ -90,23 +72,7 @@ func NewInvalidControlMessageNotification(peerID peer.ID, ctlMsgType p2pmsg.Cont
 type GossipSubInvCtrlMsgNotifConsumer interface {
 	// OnInvalidControlMessageNotification is called when a new invalid control message notification is distributed.
 	// Any error on consuming event must handle internally.
-	// The implementation must be concurrency safe, but can be blocking.
+	// The implementation must be concurrency safe and non-blocking.
+	// Note: there is no real-time guarantee on processing the notification.
 	OnInvalidControlMessageNotification(*InvCtrlMsgNotif)
 }
-
-// GossipSubInspectorSuite is the interface for the GossipSub inspector suite.
-// It encapsulates the rpc inspectors and the notification distributors.
-type GossipSubInspectorSuite interface {
-	component.Component
-	CollectionClusterChangesConsumer
-	// InspectFunc returns the inspect function that is used to inspect the gossipsub rpc messages.
-	// This function follows a dependency injection pattern, where the inspect function is injected into the gossipsu, and
-	// is called whenever a gossipsub rpc message is received.
-	InspectFunc() func(peer.ID, *pubsub.RPC) error
-
-	// AddInvalidControlMessageConsumer adds a consumer to the invalid control message notification distributor.
-	// This consumer is notified when a misbehaving peer regarding gossipsub control messages is detected. This follows a pub/sub
-	// pattern where the consumer is notified when a new notification is published.
-	// A consumer is only notified once for each notification, and only receives notifications that were published after it was added.
-	AddInvalidControlMessageConsumer(GossipSubInvCtrlMsgNotifConsumer)
-}
diff --git a/network/p2p/distributor/gossipsub_inspector.go b/network/p2p/distributor/gossipsub_inspector.go
deleted file mode 100644
index d466bf5a134..00000000000
--- a/network/p2p/distributor/gossipsub_inspector.go
+++ /dev/null
@@ -1,117 +0,0 @@
-package distributor
-
-import (
-	"sync"
-
-	"github.com/rs/zerolog"
-
-	"github.com/onflow/flow-go/engine"
-	"github.com/onflow/flow-go/engine/common/worker"
-	"github.com/onflow/flow-go/module/component"
-	"github.com/onflow/flow-go/module/mempool/queue"
-	"github.com/onflow/flow-go/module/metrics"
-	"github.com/onflow/flow-go/network/p2p"
-	p2plogging "github.com/onflow/flow-go/network/p2p/logging"
-)
-
-const (
-	// DefaultGossipSubInspectorNotificationQueueCacheSize is the default cache size for the gossipsub rpc inspector notification queue.
-	DefaultGossipSubInspectorNotificationQueueCacheSize = 10_000
-	// defaultGossipSubInspectorNotificationQueueWorkerCount is the default number of workers that will process the gossipsub rpc inspector notifications.
-	defaultGossipSubInspectorNotificationQueueWorkerCount = 1
-)
-
-var _ p2p.GossipSubInspectorNotifDistributor = (*GossipSubInspectorNotifDistributor)(nil)
-
-// GossipSubInspectorNotifDistributor is a component that distributes gossipsub rpc inspector notifications to
-// registered consumers in a non-blocking manner and asynchronously. It is thread-safe and can be used concurrently from
-// multiple goroutines. The distribution is done by a worker pool. The worker pool is configured with a queue that has a
-// fixed size. If the queue is full, the notification is discarded. The queue size and the number of workers can be
-// configured.
-type GossipSubInspectorNotifDistributor struct {
-	component.Component
-	cm     *component.ComponentManager
-	logger zerolog.Logger
-
-	workerPool   *worker.Pool[*p2p.InvCtrlMsgNotif]
-	consumerLock sync.RWMutex // protects the consumer field from concurrent updates
-	consumers    []p2p.GossipSubInvCtrlMsgNotifConsumer
-}
-
-// DefaultGossipSubInspectorNotificationDistributor returns a new GossipSubInspectorNotifDistributor component with the default configuration.
-func DefaultGossipSubInspectorNotificationDistributor(logger zerolog.Logger, opts ...queue.HeroStoreConfigOption) *GossipSubInspectorNotifDistributor {
-	cfg := &queue.HeroStoreConfig{
-		SizeLimit: DefaultGossipSubInspectorNotificationQueueCacheSize,
-		Collector: metrics.NewNoopCollector(),
-	}
-
-	for _, opt := range opts {
-		opt(cfg)
-	}
-
-	store := queue.NewHeroStore(cfg.SizeLimit, logger, cfg.Collector)
-	return NewGossipSubInspectorNotificationDistributor(logger, store)
-}
-
-// NewGossipSubInspectorNotificationDistributor returns a new GossipSubInspectorNotifDistributor component.
-// It takes a message store to store the notifications in memory and process them asynchronously.
-func NewGossipSubInspectorNotificationDistributor(log zerolog.Logger, store engine.MessageStore) *GossipSubInspectorNotifDistributor {
-	lg := log.With().Str("component", "gossipsub_rpc_inspector_distributor").Logger()
-
-	d := &GossipSubInspectorNotifDistributor{
-		logger: lg,
-	}
-
-	pool := worker.NewWorkerPoolBuilder[*p2p.InvCtrlMsgNotif](lg, store, d.distribute).Build()
-	d.workerPool = pool
-
-	cm := component.NewComponentManagerBuilder()
-
-	for i := 0; i < defaultGossipSubInspectorNotificationQueueWorkerCount; i++ {
-		cm.AddWorker(pool.WorkerLogic())
-	}
-
-	d.cm = cm.Build()
-	d.Component = d.cm
-
-	return d
-}
-
-// Distribute distributes the gossipsub rpc inspector notification to all registered consumers.
-// The distribution is done asynchronously and non-blocking. The notification is added to a queue and processed by a worker pool.
-// DistributeEvent in this implementation does not return an error, but it logs a warning if the queue is full.
-func (g *GossipSubInspectorNotifDistributor) Distribute(notification *p2p.InvCtrlMsgNotif) error {
-	lg := g.logger.With().Str("peer_id", p2plogging.PeerId(notification.PeerID)).Logger()
-	if ok := g.workerPool.Submit(notification); !ok {
-		// we use a queue with a fixed size, so this can happen when queue is full or when the notification is duplicate.
-		lg.Warn().Msg("gossipsub rpc inspector notification queue is full or notification is duplicate, discarding notification")
-	}
-	lg.Trace().Msg("gossipsub rpc inspector notification submitted to the queue")
-	return nil
-}
-
-// AddConsumer adds a consumer to the distributor. The consumer will be called when distributor distributes a new event.
-// AddConsumer must be concurrency safe. Once a consumer is added, it must be called for all future events.
-// There is no guarantee that the consumer will be called for events that were already received by the distributor.
-func (g *GossipSubInspectorNotifDistributor) AddConsumer(consumer p2p.GossipSubInvCtrlMsgNotifConsumer) {
-	g.consumerLock.Lock()
-	defer g.consumerLock.Unlock()
-
-	g.consumers = append(g.consumers, consumer)
-}
-
-// distribute calls the ConsumeEvent method of all registered consumers. It is called by the workers of the worker pool.
-// It is concurrency safe and can be called concurrently by multiple workers. However, the consumers may be blocking
-// on the ConsumeEvent method.
-func (g *GossipSubInspectorNotifDistributor) distribute(notification *p2p.InvCtrlMsgNotif) error {
-	g.consumerLock.RLock()
-	defer g.consumerLock.RUnlock()
-
-	g.logger.Trace().Msg("distributing gossipsub rpc inspector notification")
-	for _, consumer := range g.consumers {
-		consumer.OnInvalidControlMessageNotification(notification)
-	}
-	g.logger.Trace().Msg("gossipsub rpc inspector notification distributed")
-
-	return nil
-}
diff --git a/network/p2p/distributor/gossipsub_inspector_test.go b/network/p2p/distributor/gossipsub_inspector_test.go
deleted file mode 100644
index 43d26d8fc26..00000000000
--- a/network/p2p/distributor/gossipsub_inspector_test.go
+++ /dev/null
@@ -1,101 +0,0 @@
-package distributor_test
-
-import (
-	"context"
-	"fmt"
-	"math/rand"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/libp2p/go-libp2p/core/peer"
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-
-	"github.com/onflow/flow-go/module/irrecoverable"
-	"github.com/onflow/flow-go/network/p2p"
-	"github.com/onflow/flow-go/network/p2p/distributor"
-	p2pmsg "github.com/onflow/flow-go/network/p2p/message"
-	mockp2p "github.com/onflow/flow-go/network/p2p/mock"
-	"github.com/onflow/flow-go/utils/unittest"
-)
-
-// TestGossipSubInspectorNotification tests the GossipSub inspector notification by adding two consumers to the
-// notification distributor component and sending a random set of notifications to the notification component. The test
-// verifies that the consumers receive the notifications.
-func TestGossipSubInspectorNotification(t *testing.T) {
-	g := distributor.DefaultGossipSubInspectorNotificationDistributor(unittest.Logger())
-
-	c1 := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
-	c2 := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
-
-	g.AddConsumer(c1)
-	g.AddConsumer(c2)
-
-	tt := invalidControlMessageNotificationListFixture(t, 100)
-
-	c1Done := sync.WaitGroup{}
-	c1Done.Add(len(tt))
-	c1Seen := unittest.NewProtectedMap[peer.ID, struct{}]()
-	c1.On("OnInvalidControlMessageNotification", mock.Anything).Run(func(args mock.Arguments) {
-		notification, ok := args.Get(0).(*p2p.InvCtrlMsgNotif)
-		require.True(t, ok)
-
-		require.Contains(t, tt, notification)
-
-		// ensure consumer see each peer once
-		require.False(t, c1Seen.Has(notification.PeerID))
-		c1Seen.Add(notification.PeerID, struct{}{})
-
-		c1Done.Done()
-	}).Return()
-
-	c2Done := sync.WaitGroup{}
-	c2Done.Add(len(tt))
-	c2Seen := unittest.NewProtectedMap[peer.ID, struct{}]()
-	c2.On("OnInvalidControlMessageNotification", mock.Anything).Run(func(args mock.Arguments) {
-		notification, ok := args.Get(0).(*p2p.InvCtrlMsgNotif)
-		require.True(t, ok)
-
-		require.Contains(t, tt, notification)
-		// ensure consumer see each peer once
-		require.False(t, c2Seen.Has(notification.PeerID))
-		c2Seen.Add(notification.PeerID, struct{}{})
-
-		c2Done.Done()
-	}).Return()
-
-	cancelCtx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	ctx, _ := irrecoverable.WithSignaler(cancelCtx)
-	g.Start(ctx)
-
-	unittest.RequireCloseBefore(t, g.Ready(), 100*time.Millisecond, "could not start distributor")
-
-	for i := 0; i < len(tt); i++ {
-		go func(i int) {
-			require.NoError(t, g.Distribute(tt[i]))
-		}(i)
-	}
-
-	unittest.RequireReturnsBefore(t, c1Done.Wait, 1*time.Second, "events are not received by consumer 1")
-	unittest.RequireReturnsBefore(t, c2Done.Wait, 1*time.Second, "events are not received by consumer 2")
-	cancel()
-	unittest.RequireCloseBefore(t, g.Done(), 100*time.Millisecond, "could not stop distributor")
-}
-
-func invalidControlMessageNotificationListFixture(t *testing.T, n int) []*p2p.InvCtrlMsgNotif {
-	list := make([]*p2p.InvCtrlMsgNotif, n)
-	for i := 0; i < n; i++ {
-		list[i] = invalidControlMessageNotificationFixture(t)
-	}
-	return list
-}
-
-func invalidControlMessageNotificationFixture(t *testing.T) *p2p.InvCtrlMsgNotif {
-	return &p2p.InvCtrlMsgNotif{
-		PeerID:  unittest.PeerIdFixture(t),
-		MsgType: []p2pmsg.ControlMessageType{p2pmsg.CtrlMsgGraft, p2pmsg.CtrlMsgPrune, p2pmsg.CtrlMsgIHave, p2pmsg.CtrlMsgIWant}[rand.Intn(4)],
-		Error:   fmt.Errorf("this is an error"),
-	}
-}
diff --git a/network/p2p/inspector/README.MD b/network/p2p/inspector/README.MD
new file mode 100644
index 00000000000..df09b36d3e8
--- /dev/null
+++ b/network/p2p/inspector/README.MD
@@ -0,0 +1,208 @@
+# Control Message Validation Inspector Overview
+
+## Component Overview
+The Control Message Validation Inspector (`ControlMsgValidationInspector`) is an injectable component responsible for asynchronous inspection of incoming GossipSub RPC.
+It is entirely developed and maintained at Flow blockchain codebase and is injected into the GossipSub protocol of libp2p at the startup of the node.
+All incoming RPC messages are passed through this inspection to ensure their validity and compliance with the Flow protocol semantics.
+
+The inspector performs two primary functions:
+1. **RPC truncation (blocking)**: It truncates size of incoming RPC messages to prevent excessive resource consumption, if needed. This is done by sampling the messages and reducing their size to a configurable threshold.
+2. **RPC inspection (aka validation) (non-blocking)**: It inspects (aka validates) the truncated or original RPC messages for compliance with the Flow protocol semantics. This includes validation of message structure, topic, sender, and other relevant attributes.
+
+Figure below shows the high-level overview of the Control Message Validation Inspector and its interaction with the GossipSub protocol and the Flow node.
+The blue box represents the GossipSub protocol, which is responsible for handling the pub-sub messaging system and is an external dependency of the Flow node.
+The green boxes represent various components of the Flow node's networking layer that are involved in the inspection and processing of incoming RPC messages.
+The steps that are marked with an asterisk (*) are performed concurrently, while the rest are performed sequentially.
+As shown in this figure, an incoming RPC message is passed by GossipSub to the Control Message Validation Inspector, which then performs the blocking truncation process and queues the RPC for asynchronous non-blocking inspection processes.
+As soon as the RPC is queued for inspection, it is also passed to the GossipSub protocol for further processing. The results of the inspection are used for internal metrics, logging, and feedback to the GossipSub scoring system.
+Once the GossipSub processes the RPC it passes the message to the libp2p node component of the networking layer of the Flow node, which then processes the message and sends it to the rest of the Flow node for further processing.
+Note that the validation process is non-blocking, hence even a malformed RPC is allowed to proceed through the GossipSub protocol to the Flow node. 
+However, based on the result of the asynchronous inspection, the message may be scored negatively, and the sender may be penalized in the peer scoring system.
+The rationale behind this is that post truncation, as far as the RPC size is within the configured limits, a single (or few) non-compliant RPCs do not drastically affect the system's health, hence, the RPCs are allowed to proceed for further processing.
+What matters is the persistent behavior of the sender, and the sender's reputation and future message propagation are _eventually_ affected based on the inspection results.
+![rpc-inspection-process.png](rpc-inspection-process.png)
+## What is an RPC?
+RPC stands for Remote Procedure Call. In the context of GossipSub, it is a message that is sent from one peer to another peer over the GossipSub protocol. 
+The message is sent in the form of a protobuf message and is used to communicate information about the state of the network, such as topic membership, message propagation, and other relevant information.
+It encapsulates various types of messages and commands that peers exchange to implement the GossipSub protocol, a pub-sub (publish-subscribe) messaging system. 
+Remember that the purpose of GossipSub is to efficiently disseminate messages to interested subscribers in the network without requiring a central broker or server.
+Here is what an RPC message looks like in the context of GossipSub:
+```go
+type RPC struct {
+	Subscriptions        []*RPC_SubOpts  `protobuf:"bytes,1,rep,name=subscriptions" json:"subscriptions,omitempty"`
+	Publish              []*Message      `protobuf:"bytes,2,rep,name=publish" json:"publish,omitempty"`
+	Control              *ControlMessage `protobuf:"bytes,3,opt,name=control" json:"control,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}        `json:"-"`
+	XXX_unrecognized     []byte          `json:"-"`
+	XXX_sizecache        int32           `json:"-"`
+}
+``` 
+
+Here's a breakdown of the components within the GossipSub's `RPC` struct:
+1. **Subscriptions (`[]*RPC_SubOpts`)**: This field contains a list of subscription options (`RPC_SubOpts`). 
+    Each `RPC_SubOpts` represents a peer's intent to subscribe or unsubscribe from a topic. 
+    This allows peers to dynamically adjust their interest in various topics and manage their subscription list.
+2. **Publish (`[]*Message`)**: The `Publish` field contains a list of messages that the peer wishes to publish (or gossip) to the network. 
+    Each `Message` is intended for a specific topic, and peers subscribing to that topic should receive the message. 
+    This field is essential for the dissemination of information and data across the network.
+3. **Control (`*ControlMessage`)**
+    The `Control` field holds a control message, which contains various types of control information required for the operation of the GossipSub protocol. 
+    This can include information about grafting (joining a mesh for a topic), pruning (leaving a mesh), 
+    and other control signals related to the maintenance and optimization of the pub-sub network. 
+   The control messages play a crucial role in the mesh overlay maintenance, ensuring efficient and reliable message propagation.
+4. **XXX Fields** These fields (`XXX_NoUnkeyedLiteral`, `XXX_unrecognized`, and `XXX_sizecache`) are generated by the protobuf compiler and are not directly used by the GossipSub protocol. 
+   They are used internally by the protobuf library for various purposes like caching and ensuring correct marshalling and unmarshalling of the protobuf data.
+
+### Closer Look at the Control Message
+In GossipSub, a Control Message is a part of the `RPC` structure and plays a crucial role in maintaining and optimizing the network. 
+It contains several fields, each corresponding to different types of control information.
+The primary purpose of these control messages is to manage the mesh overlay that underpins the GossipSub protocol,
+ensuring efficient and reliable message propagation.
+
+At the core, the control messages are used to maintain the mesh overlay for each topic, allowing peers to join and leave the mesh as their interests and network connectivity change.
+The control messages include the following types:
+
+1. **IHAVE (`[]*ControlIHave`)**: the `IHAVE` messages are used to advertise to peers that the sender has certain messages. 
+   This is part of the message propagation mechanism. 
+   When a peer receives an `IHAVE` message and is interested in the advertised messages (because it doesn't have them yet), 
+   it can request those messages from the sender using an `IWANT` message.
+
+2. **IWANT (`[]*ControlIWant`)**: the `IWANT` messages are requests sent to peers to ask for specific messages previously 
+   advertised in an `IHAVE` message. 
+   This mechanism ensures that messages propagate through the network, 
+   reaching interested subscribers even if they are not directly connected to the message's original publisher.
+
+3. **GRAFT (`[]*ControlGraft`)**: The `GRAFT` messages are used to express the sender's intention to join the mesh for a specific topic. 
+   In GossipSub, each peer maintains a local mesh network for each topic it is interested in. 
+   Each local mesh is a subset of the peers in the network that are interested in the same topic. The complete mesh for a topic is formed by the union of all local meshes, which must be connected to ensure efficient message propagation 
+   (the peer scoring ensures that the mesh is well-connected and that peers are not overloaded with messages)
+   Sending a `GRAFT` message is a way to join the local mesh of a peer, indicating that the sender wants to receive and forward messages for the specific topic.
+
+4. **PRUNE (`[]*ControlPrune`)**: conversely, `PRUNE` messages are sent when a peer wants to leave the local mesh for a specific topic. 
+   This could be because the peer is no longer interested in the topic or is optimizing its network connections. 
+   Upon receiving a `PRUNE` message, peers will remove the sender from their mesh for the specific topic.
+
+```go
+type ControlMessage struct {
+	Ihave                []*ControlIHave `protobuf:"bytes,1,rep,name=ihave" json:"ihave,omitempty"`
+	Iwant                []*ControlIWant `protobuf:"bytes,2,rep,name=iwant" json:"iwant,omitempty"`
+	Graft                []*ControlGraft `protobuf:"bytes,3,rep,name=graft" json:"graft,omitempty"`
+	Prune                []*ControlPrune `protobuf:"bytes,4,rep,name=prune" json:"prune,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}        `json:"-"`
+	XXX_unrecognized     []byte          `json:"-"`
+	XXX_sizecache        int32           `json:"-"`
+}
+```
+
+## Why is RPC Inspection Necessary?
+In the context of the Flow blockchain, RPC inspection is necessary for the following reasons:
+1. **Security**: The inspection process mitigates potential security risks such as spamming, message replay attacks, or malicious content dissemination, and provides complementing feedbacks for the internal GossipSub scoring system.
+
+2. **Resource Management**: By validating and potentially truncating incoming RPC messages, the system manages its computational and memory resources more effectively. 
+   This prevents resource exhaustion attacks where an adversary might attempt to overwhelm the system by sending a large volume of non-compliant or oversized messages.
+
+3. **Metrics and Monitoring**: The inspection process provides valuable insights into the network's health and performance. 
+   By monitoring the incoming RPC messages, the system can collect metrics and statistics about message propagation, topic membership, and other relevant network attributes.
+
+## RPC Truncation (Blocking)
+The Control Message Validation Inspector is responsible for truncating the size of incoming RPC messages to prevent excessive resource consumption. This is done by sampling the messages and reducing their size to a configurable threshold. 
+The truncation process is entirely done in a blocking manner, i.e., it is performed at the entry point of the GossipSub through an injected interceptor, and the incoming RPC messages are modified before they are further processed by the GossipSub protocol.
+The truncation process is applied to different components of the RPC message, specifically the control message types (`GRAFT`, `PRUNE`, `IHAVE`, `IWANT`) and their respective message IDs.
+Truncation is triggered if the count of messages or message IDs exceeds certain configured thresholds, ensuring that the system resources are not overwhelmed.
+When the number of messages or message IDs exceeds the threshold, a random sample of messages or message IDs is selected, and the rest are discarded.
+
+### Message vs Message ID Truncation
+In the context of GossipSub RPC inspection, there is a subtle distinction between the count of messages and the count of message IDs:
+
+1. **Count of Messages:**
+    - This refers to the number of control messages (like `GRAFT`, `PRUNE`, `IHAVE`, `IWANT`) that are part of the `ControlMessage` structure within an RPC message, i.e., size of the `Graft`, `Prune`, `Ihave`, and `Iwant` slice fields.
+    - Each control message type serves a different purpose in the GossipSub protocol (e.g., `GRAFT` for joining a mesh for a topic, `PRUNE` for leaving a mesh).
+    - When we talk about the "count of messages," we're referring to how many individual control messages of each type are included in the RPC.
+    - Truncation based on the count of messages ensures that the number of control messages of each type doesn't exceed a configured threshold, preventing overwhelming the receiving peer with too many control instructions at once.
+
+2. **Count of Message IDs:**
+    - This refers to the number of unique identifiers for actual published messages that are being referenced within control messages like `IHAVE` and `IWANT`.
+    - `IHAVE` messages contain IDs of messages that the sender has and is announcing to peers. `IWANT` messages contain IDs of messages that the sender wants from peers.
+    - Each _individual_ `IHAVE` or `IWANT` control message can reference multiple message IDs. The "count of message IDs" is the total number of such IDs contained within each `IHAVE` or `IWANT` control message.
+    - Truncation based on the count of message IDs ensures that each `IHAVE` or `IWANT` control message doesn't reference an excessively large number of messages. This prevents a scenario where a peer might be asked to process an overwhelming number of message requests at once, which could lead to resource exhaustion.
+
+## RPC Validation (Non-Blocking)
+The Control Message Validation Inspector is also responsible for inspecting the truncated or original RPC messages for compliance with the Flow protocol semantics. 
+The inspection process is done post truncation and is entirely non-blocking, i.e., it does not prevent the further processing of the RPC messages by the GossipSub protocol. 
+In other words, the RPC messages are passed through after truncation for further processing by the GossipSub protocol, regardless of whether they pass the inspection or not.
+At the same time, each incoming RPC message is queued for asynchronous inspection, and the results of the inspection are used for internal metrics, logging, and feedback to the GossipSub scoring system.
+This means that even a non-compliant RPC message is allowed to proceed through the GossipSub protocol to the Flow node. However, based on the result of the asynchronous inspection, 
+the message may be scored negatively, and the sender may be penalized in the peer scoring system. Hence, its future messages may be de-prioritized or ignored by the GossipSub protocol.
+This follows the principle that post truncation, as far as the RPC size is within the configured limits, a single (or few) non-compliant RPCs do not drastically affect the system's health,
+hence, the RPCs are allowed to proceed for further processing. However, the sender's reputation and future message propagation are affected based on the inspection results.
+
+The queued RPCs are picked by a pool of worker threads, and the inspection is performed in parallel to the GossipSub protocol's processing of the RPC messages.
+Each RPC message is inspected for the following attributes sequentially, and once a non-compliance is detected, the inspection process is terminated with a failure result. A failure result
+will cause an _invalid control message notification_ (`p2p.InvCtrlMsgNotif`) to be sent to the `GossipSubAppSpecificScoreRegistry`, which will then be used for penalizing the sender in the peer scoring system.
+The `GossipSubAppSpecificScoreRegistry` is a Flow-level component that decides on part of the individual peer's scoring based on their Flow-specific behavior. 
+It directly provides feedback to the GossipSub protocol for scoring the peers.
+
+The [order of inspections for a single RPC](https://github.com/onflow/flow-go/blob/master/network/p2p/inspector/validation/control_message_validation_inspector.go#L270-L323) is as follows. Note that in the
+descriptions below, when we say an RPC is flagged as invalid or the inspection process is terminated with a failure result, and an _invalid control message notification_ is sent to the `GossipSubAppSpecificScoreRegistry`, which
+will then be used for penalizing the sender in the peer scoring system.
+1. `GRAFT` messages validation: Each RPC contains one or more `GRAFT` messages. Each `GRAFT` message contains a topic ID indicating the mesh the peer wants to join. 
+    The validation process involves iterating through each `GRAFT` message received in the (potentially truncated) RPC.
+    For each `GRAFT` message, the topic ID is validated to ensure it corresponds to a valid and recognized topic within the Flow-network.
+    Topic validation might involve checking if the topic is known, if it's within the scope of the peer's interests or subscriptions, and if it aligns with the network's current configuration (e.g., checking against the active spork ID).
+    If the topic is cluster-prefixed, additional validations ensure that the topic is part of the active cluster IDs. 
+    If (even one) topic ID is invalid or unrecognized, the `GRAFT` message is flagged as invalid, and the inspection process is terminated with a failure result. 
+    In future we may relax this condition to allow for a certain number of invalid topics, but for now, a single invalid topic results in a failure.
+    The inspection process also system keeps track of the topics seen in the `GRAFT` messages of the same RPC. 
+    If a topic is repeated (i.e., if there are duplicate topics in the `GRAFT` messages of the same RPC), this is usually a sign of a protocol violation or misbehavior.
+    The validation process counts these duplicates and, if the number exceeds a certain threshold, it flags RPC message as invalid and terminates the inspection process with a failure result.
+    Note that all `GRAFT` messages on the same (potentially truncated) RPC are validated together, without any sampling, as the number of `GRAFT` messages is usually assumed small, and validating
+    them is not assumed to be resource-intensive.
+2. `PRUNE` messages validation: Similar to `GRAFT`s, each RPC contains one or more `PRUNE` messages. Each `PRUNE` message contains a topic ID indicating the mesh the peer wants to leave. 
+    The validation process involves iterating through each `PRUNE` message received in the (potentially truncated) RPC.
+    For each `PRUNE` message, the topic ID is validated to ensure it corresponds to a valid and recognized topic within the Flow-network.
+    Topic validation might involve checking if the topic is known, if it's within the scope of the peer's interests or subscriptions, and if it aligns with the network's current configuration (e.g., checking against the active spork ID).
+    If the topic is cluster-prefixed, additional validations ensure that the topic is part of the active cluster IDs.
+    If (even one) topic ID is invalid or unrecognized, the `PRUNE` message is flagged as invalid, and the inspection process is terminated with a failure result. 
+    In future we may relax this condition to allow for a certain number of invalid topics, but for now, a single invalid topic results in a failure.
+    The inspection process also system keeps track of the topics seen in the `PRUNE` messages of the same RPC. 
+    If a topic is repeated (i.e., if there are duplicate topics in the `PRUNE` messages of the same RPC), this is usually a sign of a protocol violation or misbehavior.
+    The validation process counts these duplicates and, if the number exceeds a certain threshold, it flags RPC message as invalid and terminates the inspection process with a failure result.
+    Note that all `PRUNE` messages on the same (potentially truncated) RPC are validated together, without any sampling, as the number of `PRUNE` messages is usually assumed small, and validating
+    them is not assumed to be resource-intensive.
+3. `IWANT` messages validation: Each RPC contains one or more `IWANT` messages. Each `IWANT` message contains a list of message IDs that the sender wants from the receiver as the result of an `IHAVE` message.
+    The validation process involves iterating through each `IWANT` message received in the (potentially truncated) RPC.
+    For each `IWANT` message, the message IDs are validated to ensure they correspond to a valid message ID that recently advertised by the sender in an `IHAVE` message.
+    We define an `IWANT` cache miss as the event of an `IWANT` message ID does not correspond to a valid recently advertised `IHAVE` message ID.
+    When number of `IWANT` cache misses exceeds a certain threshold, the `IWANT` message is flagged as invalid, and the inspection process is terminated with a failure result.
+    The inspection process also system keeps track of the message IDs seen in the `IWANT` messages of the same RPC. 
+    If a message ID is repeated (i.e., if there are duplicate message IDs in the `IWANT` messages of the same RPC), this is usually a sign of a protocol violation or misbehavior.
+    The validation process counts these duplicates and, if the number exceeds a certain threshold, it flags RPC message as invalid and terminates the inspection process with a failure result.
+    Note that all `IWANT` messages on the same (potentially truncated) RPC are validated together, without any sampling, as the number of `IWANT` messages is usually assumed small, and validating 
+    them is not assumed to be resource-intensive.
+4. `IHAVE` messages validation: Each RPC contains one or more `IHAVE` messages. Each `IHAVE` message contains a list of message IDs that the sender has and is advertising to the receiver.
+    The validation process involves iterating through each `IHAVE` message received in the (potentially truncated) RPC.
+    Each `IHAVE` message is composed of a topic ID as well as the list of message IDs advertised for that topic.
+    Each topic ID is validated to ensure it corresponds to a valid and recognized topic within the Flow-network.
+    Topic validation might involve checking if the topic is known, if it's within the scope of the peer's interests or subscriptions, and if it aligns with the network's current configuration (e.g., checking against the active spork ID).
+    If the topic is cluster-prefixed, additional validations ensure that the topic is part of the active cluster IDs.
+    If (even one) topic ID is invalid or unrecognized, the `IHAVE` message is flagged as invalid, and the inspection process is terminated with a failure result.
+    The inspection process also system keeps track of the topics seen in the `IHAVE` messages of the same RPC. When a topic is repeated (i.e., if there are duplicate topics in the `IHAVE` messages of the same RPC), this is usually a sign of a protocol violation or misbehavior.
+    The validation process counts these duplicates and, if the number exceeds a certain threshold, it flags RPC message as invalid and terminates the inspection process with a failure result.
+    The message IDs advertised in the `IHAVE` messages are also validated ensure there are no duplicates. When a message ID is repeated (i.e., if there are duplicate message IDs in the `IHAVE` messages of the same RPC), this is usually a sign of a protocol violation or misbehavior.
+    The validation process counts these duplicates and, if the number exceeds a certain threshold, it flags RPC message as invalid and terminates the inspection process with a failure result.
+    Note that all `IHAVE` messages on the same (potentially truncated) RPC are validated together, without any sampling, as the number of `IHAVE` messages is usually assumed small, and validating
+    them is not assumed to be resource-intensive.
+5. `Publish` messages validation: Each RPC contains a list of `Publish` messages that are intended to be gossiped to the network.
+    The validation process involves iterating through each `Publish` message received in the (potentially truncated) RPC.
+    To validate the `Publish` messages of an RPC, the inspector samples a subset of the `Publish` messages and validates them for compliance with the Flow protocol semantics.
+    This is done to avoid adding excessive computational overhead to the inspection process, as the number of `Publish` messages in an RPC can be large, and validating each message can be resource-intensive.
+    The validation of each `Publish` message involves several steps: (1) whether the sender is a valid (staked) Flow node, 
+    (2) whether the topic ID is a valid based on the Flow protocol semantics, and (3) whether the local peer has a valid subscription to the topic.
+    Failure in any of these steps results in a validation error for the `Publish` message. 
+    However, validation error for a single `Publish` message does not cause inspection process to terminate with a failure result for the entire RPC.
+    Rather the inspection process continues to validate the rest of the `Publish` messages in the sampled RPC.
+    Once the entire sampled RPC is validated, the inspection process is terminated with a success if the number of validation errors is within a certain threshold.
+    Otherwise, when the number of validation errors exceeds the threshold, the inspection process is terminated with a failure result, which 
+    will cause an _invalid control message notification_ to be sent to the `GossipSubAppSpecificScoreRegistry`, which will then be used for penalizing the sender in the peer scoring system.
+    As this is the last step in the inspection process, when an RPC reaches this step, it means that the RPC has passed all the previous inspections and is only being validated for the `Publish` messages.
+    Hence, result of this step is used to determine the final result of the inspection process.
\ No newline at end of file
diff --git a/network/p2p/inspector/internal/cache/cache.go b/network/p2p/inspector/internal/cache/cache.go
index d64418d636f..f3295d19f5a 100644
--- a/network/p2p/inspector/internal/cache/cache.go
+++ b/network/p2p/inspector/internal/cache/cache.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/libp2p/go-libp2p/core/peer"
 	"github.com/rs/zerolog"
 
 	"github.com/onflow/flow-go/model/flow"
@@ -65,11 +66,11 @@ func NewRecordCache(config *RecordCacheConfig, recordEntityFactory recordEntityF
 // Returns number of cluster prefix control messages received after the adjustment. The record is initialized before
 // the adjustment func is applied that will increment the Gauge.
 // Args:
-// - nodeID: the node ID of the sender of the control message.
+// - pid: the peer ID of the sender of the control message.
 // Returns:
 //   - The cluster prefix control messages received gauge value after the adjustment.
 //   - exception only in cases of internal data inconsistency or bugs. No errors are expected.
-func (r *RecordCache) ReceivedClusterPrefixedMessage(nodeID flow.Identifier) (float64, error) {
+func (r *RecordCache) ReceivedClusterPrefixedMessage(pid peer.ID) (float64, error) {
 	var err error
 	adjustFunc := func(entity flow.Entity) flow.Entity {
 		entity, err = r.decayAdjustment(entity) // first decay the record
@@ -78,17 +79,17 @@ func (r *RecordCache) ReceivedClusterPrefixedMessage(nodeID flow.Identifier) (fl
 		}
 		return r.incrementAdjustment(entity) // then increment the record
 	}
-
-	adjustedEntity, adjusted := r.c.AdjustWithInit(nodeID, adjustFunc, func() flow.Entity {
-		return r.recordEntityFactory(nodeID)
+	entityID := r.MakeId(pid)
+	adjustedEntity, adjusted := r.c.AdjustWithInit(entityID, adjustFunc, func() flow.Entity {
+		return r.recordEntityFactory(entityID)
 	})
 
 	if err != nil {
-		return 0, fmt.Errorf("unexpected error while applying decay and increment adjustments for node %s: %w", nodeID, err)
+		return 0, fmt.Errorf("unexpected error while applying decay and increment adjustments for peer %s: %w", pid, err)
 	}
 
 	if !adjusted {
-		return 0, fmt.Errorf("adjustment failed for node %s", nodeID)
+		return 0, fmt.Errorf("adjustment failed for peer %s", pid)
 	}
 
 	record := mustBeClusterPrefixedMessageReceivedRecordEntity(adjustedEntity)
@@ -101,25 +102,26 @@ func (r *RecordCache) ReceivedClusterPrefixedMessage(nodeID flow.Identifier) (fl
 // Before the control messages received gauge value is returned it is decayed using the configured decay function.
 // Returns the record and true if the record exists, nil and false otherwise.
 // Args:
-// - nodeID: the node ID of the sender of the control message.
+// - pid: the peer ID of the sender of the control message.
 // Returns:
 // - The cluster prefixed control messages received gauge value after the decay and true if the record exists, 0 and false otherwise.
 // No errors are expected during normal operation.
-func (r *RecordCache) GetWithInit(nodeID flow.Identifier) (float64, bool, error) {
+func (r *RecordCache) GetWithInit(pid peer.ID) (float64, bool, error) {
 	var err error
 	adjustLogic := func(entity flow.Entity) flow.Entity {
 		// perform decay on gauge value
 		entity, err = r.decayAdjustment(entity)
 		return entity
 	}
-	adjustedEntity, adjusted := r.c.AdjustWithInit(nodeID, adjustLogic, func() flow.Entity {
-		return r.recordEntityFactory(nodeID)
+	entityID := r.MakeId(pid)
+	adjustedEntity, adjusted := r.c.AdjustWithInit(entityID, adjustLogic, func() flow.Entity {
+		return r.recordEntityFactory(entityID)
 	})
 	if err != nil {
-		return 0, false, fmt.Errorf("unexpected error while applying decay adjustment for node %s: %w", nodeID, err)
+		return 0, false, fmt.Errorf("unexpected error while applying decay adjustment for peer %s: %w", pid, err)
 	}
 	if !adjusted {
-		return 0, false, fmt.Errorf("decay adjustment failed for node %s", nodeID)
+		return 0, false, fmt.Errorf("decay adjustment failed for peer %s", pid)
 	}
 
 	record := mustBeClusterPrefixedMessageReceivedRecordEntity(adjustedEntity)
@@ -127,19 +129,19 @@ func (r *RecordCache) GetWithInit(nodeID flow.Identifier) (float64, bool, error)
 	return record.Gauge, true, nil
 }
 
-// NodeIDs returns the list of identities of the nodes that have a spam record in the cache.
-func (r *RecordCache) NodeIDs() []flow.Identifier {
-	return flow.GetIDs(r.c.All())
-}
-
 // Remove removes the record of the given peer id from the cache.
 // Returns true if the record is removed, false otherwise (i.e., the record does not exist).
 // Args:
-// - nodeID: the node ID of the sender of the control message.
+// - pid: the peer ID of the sender of the control message.
 // Returns:
 // - true if the record is removed, false otherwise (i.e., the record does not exist).
-func (r *RecordCache) Remove(nodeID flow.Identifier) bool {
-	return r.c.Remove(nodeID)
+func (r *RecordCache) Remove(pid peer.ID) bool {
+	return r.c.Remove(r.MakeId(pid))
+}
+
+// NodeIDs returns the list of identities of the nodes that have a spam record in the cache.
+func (r *RecordCache) NodeIDs() []flow.Identifier {
+	return flow.GetIDs(r.c.All())
 }
 
 // Size returns the number of records in the cache.
@@ -147,6 +149,13 @@ func (r *RecordCache) Size() uint {
 	return r.c.Size()
 }
 
+// MakeId is a helper function for creating the id field of the duplicateMessagesCounterEntity by hashing the peerID.
+// Returns:
+// - the hash of the peerID as a flow.Identifier.
+func (r *RecordCache) MakeId(peerID peer.ID) flow.Identifier {
+	return flow.MakeID([]byte(peerID))
+}
+
 func (r *RecordCache) incrementAdjustment(entity flow.Entity) flow.Entity {
 	record, ok := entity.(ClusterPrefixedMessagesReceivedRecord)
 	if !ok {
diff --git a/network/p2p/inspector/internal/cache/cache_test.go b/network/p2p/inspector/internal/cache/cache_test.go
index d6f5ffad908..3f4c3d629d2 100644
--- a/network/p2p/inspector/internal/cache/cache_test.go
+++ b/network/p2p/inspector/internal/cache/cache_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/libp2p/go-libp2p/core/peer"
 	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/require"
 
@@ -23,18 +24,18 @@ const defaultDecay = 0.99
 func TestRecordCache_Init(t *testing.T) {
 	cache := cacheFixture(t, 100, defaultDecay, zerolog.Nop(), metrics.NewNoopCollector())
 
-	nodeID1 := unittest.IdentifierFixture()
-	nodeID2 := unittest.IdentifierFixture()
+	peerID1 := unittest.PeerIdFixture(t)
+	peerID2 := unittest.PeerIdFixture(t)
 
 	// test initializing a record for an node ID that doesn't exist in the cache
-	gauge, ok, err := cache.GetWithInit(nodeID1)
+	gauge, ok, err := cache.GetWithInit(peerID1)
 	require.NoError(t, err)
 	require.True(t, ok, "expected record to exist")
 	require.Zerof(t, gauge, "expected gauge to be 0")
 	require.Equal(t, uint(1), cache.Size(), "expected cache to have one additional record")
 
 	// test initializing a record for an node ID that already exists in the cache
-	gaugeAgain, ok, err := cache.GetWithInit(nodeID1)
+	gaugeAgain, ok, err := cache.GetWithInit(peerID1)
 	require.NoError(t, err)
 	require.True(t, ok, "expected record to still exist")
 	require.Zerof(t, gaugeAgain, "expected same gauge to be 0")
@@ -42,7 +43,7 @@ func TestRecordCache_Init(t *testing.T) {
 	require.Equal(t, uint(1), cache.Size(), "expected cache to still have one additional record")
 
 	// test initializing a record for another node ID
-	gauge2, ok, err := cache.GetWithInit(nodeID2)
+	gauge2, ok, err := cache.GetWithInit(peerID2)
 	require.NoError(t, err)
 	require.True(t, ok, "expected record to exist")
 	require.Zerof(t, gauge2, "expected second gauge to be 0")
@@ -56,19 +57,19 @@ func TestRecordCache_Init(t *testing.T) {
 func TestRecordCache_ConcurrentInit(t *testing.T) {
 	cache := cacheFixture(t, 100, defaultDecay, zerolog.Nop(), metrics.NewNoopCollector())
 
-	nodeIDs := unittest.IdentifierListFixture(10)
+	pids := unittest.PeerIdFixtures(t, 10)
 
 	var wg sync.WaitGroup
-	wg.Add(len(nodeIDs))
+	wg.Add(len(pids))
 
-	for _, nodeID := range nodeIDs {
-		go func(id flow.Identifier) {
+	for _, pid := range pids {
+		go func(id peer.ID) {
 			defer wg.Done()
 			gauge, found, err := cache.GetWithInit(id)
 			require.NoError(t, err)
 			require.True(t, found)
 			require.Zerof(t, gauge, "expected all gauge values to be initialized to 0")
-		}(nodeID)
+		}(pid)
 	}
 
 	unittest.RequireReturnsBefore(t, wg.Wait, 100*time.Millisecond, "timed out waiting for goroutines to finish")
@@ -82,7 +83,7 @@ func TestRecordCache_ConcurrentInit(t *testing.T) {
 func TestRecordCache_ConcurrentSameRecordInit(t *testing.T) {
 	cache := cacheFixture(t, 100, defaultDecay, zerolog.Nop(), metrics.NewNoopCollector())
 
-	nodeID := unittest.IdentifierFixture()
+	nodeID := unittest.PeerIdFixture(t)
 	const concurrentAttempts = 10
 
 	var wg sync.WaitGroup
@@ -112,34 +113,34 @@ func TestRecordCache_ConcurrentSameRecordInit(t *testing.T) {
 func TestRecordCache_ReceivedClusterPrefixedMessage(t *testing.T) {
 	cache := cacheFixture(t, 100, defaultDecay, zerolog.Nop(), metrics.NewNoopCollector())
 
-	nodeID1 := unittest.IdentifierFixture()
-	nodeID2 := unittest.IdentifierFixture()
+	peerID1 := unittest.PeerIdFixture(t)
+	peerID2 := unittest.PeerIdFixture(t)
 
-	gauge, err := cache.ReceivedClusterPrefixedMessage(nodeID1)
+	gauge, err := cache.ReceivedClusterPrefixedMessage(peerID1)
 	require.NoError(t, err)
 	require.Equal(t, float64(1), gauge)
 
 	// get will apply a slightl decay resulting
 	// in a gauge value less than gauge which is 1 but greater than 0.9
-	currentGauge, ok, err := cache.GetWithInit(nodeID1)
+	currentGauge, ok, err := cache.GetWithInit(peerID1)
 	require.NoError(t, err)
 	require.True(t, ok)
 	require.LessOrEqual(t, currentGauge, gauge)
 	require.Greater(t, currentGauge, 0.9)
 
-	_, ok, err = cache.GetWithInit(nodeID2)
+	_, ok, err = cache.GetWithInit(peerID2)
 	require.NoError(t, err)
 	require.True(t, ok)
 
 	// test adjusting the spam record for a non-existing node ID
-	nodeID3 := unittest.IdentifierFixture()
-	gauge3, err := cache.ReceivedClusterPrefixedMessage(nodeID3)
+	peerID3 := unittest.PeerIdFixture(t)
+	gauge3, err := cache.ReceivedClusterPrefixedMessage(peerID3)
 	require.NoError(t, err)
 	require.Equal(t, float64(1), gauge3)
 
 	// when updated the value should be incremented from 1 -> 2 and slightly decayed resulting
 	// in a gauge value less than 2 but greater than 1.9
-	gauge3, err = cache.ReceivedClusterPrefixedMessage(nodeID3)
+	gauge3, err = cache.ReceivedClusterPrefixedMessage(peerID3)
 	require.NoError(t, err)
 	require.LessOrEqual(t, gauge3, 2.0)
 	require.Greater(t, gauge3, 1.9)
@@ -149,13 +150,13 @@ func TestRecordCache_ReceivedClusterPrefixedMessage(t *testing.T) {
 func TestRecordCache_Decay(t *testing.T) {
 	cache := cacheFixture(t, 100, 0.09, zerolog.Nop(), metrics.NewNoopCollector())
 
-	nodeID1 := unittest.IdentifierFixture()
+	peerID1 := unittest.PeerIdFixture(t)
 
-	// initialize spam records for nodeID1 and nodeID2
-	gauge, err := cache.ReceivedClusterPrefixedMessage(nodeID1)
+	// initialize spam records for peerID1 and peerID2
+	gauge, err := cache.ReceivedClusterPrefixedMessage(peerID1)
 	require.Equal(t, float64(1), gauge)
 	require.NoError(t, err)
-	gauge, ok, err := cache.GetWithInit(nodeID1)
+	gauge, ok, err := cache.GetWithInit(peerID1)
 	require.True(t, ok)
 	require.NoError(t, err)
 	// gauge should have been delayed slightly
@@ -163,7 +164,7 @@ func TestRecordCache_Decay(t *testing.T) {
 
 	time.Sleep(time.Second)
 
-	gauge, ok, err = cache.GetWithInit(nodeID1)
+	gauge, ok, err = cache.GetWithInit(peerID1)
 	require.True(t, ok)
 	require.NoError(t, err)
 	// gauge should have been delayed slightly, but closer to 0
@@ -178,24 +179,24 @@ func TestRecordCache_Identities(t *testing.T) {
 	cache := cacheFixture(t, 100, defaultDecay, zerolog.Nop(), metrics.NewNoopCollector())
 
 	// initialize spam records for a few node IDs
-	nodeID1 := unittest.IdentifierFixture()
-	nodeID2 := unittest.IdentifierFixture()
-	nodeID3 := unittest.IdentifierFixture()
+	peerID1 := unittest.PeerIdFixture(t)
+	peerID2 := unittest.PeerIdFixture(t)
+	peerID3 := unittest.PeerIdFixture(t)
 
-	_, ok, err := cache.GetWithInit(nodeID1)
+	_, ok, err := cache.GetWithInit(peerID1)
 	require.NoError(t, err)
 	require.True(t, ok)
-	_, ok, err = cache.GetWithInit(nodeID2)
+	_, ok, err = cache.GetWithInit(peerID2)
 	require.NoError(t, err)
 	require.True(t, ok)
-	_, ok, err = cache.GetWithInit(nodeID3)
+	_, ok, err = cache.GetWithInit(peerID3)
 	require.NoError(t, err)
 	require.True(t, ok)
 
 	// check if the NodeIDs method returns the correct set of node IDs
 	identities := cache.NodeIDs()
 	require.Equal(t, 3, len(identities))
-	require.ElementsMatch(t, identities, []flow.Identifier{nodeID1, nodeID2, nodeID3})
+	require.ElementsMatch(t, identities, []flow.Identifier{cache.MakeId(peerID1), cache.MakeId(peerID2), cache.MakeId(peerID3)})
 }
 
 // TestRecordCache_Remove tests the Remove method of the RecordCache.
@@ -208,36 +209,36 @@ func TestRecordCache_Remove(t *testing.T) {
 	cache := cacheFixture(t, 100, defaultDecay, zerolog.Nop(), metrics.NewNoopCollector())
 
 	// initialize spam records for a few node IDs
-	nodeID1 := unittest.IdentifierFixture()
-	nodeID2 := unittest.IdentifierFixture()
-	nodeID3 := unittest.IdentifierFixture()
+	peerID1 := unittest.PeerIdFixture(t)
+	peerID2 := unittest.PeerIdFixture(t)
+	peerID3 := unittest.PeerIdFixture(t)
 
-	_, ok, err := cache.GetWithInit(nodeID1)
+	_, ok, err := cache.GetWithInit(peerID1)
 	require.NoError(t, err)
 	require.True(t, ok)
-	_, ok, err = cache.GetWithInit(nodeID2)
+	_, ok, err = cache.GetWithInit(peerID2)
 	require.NoError(t, err)
 	require.True(t, ok)
-	_, ok, err = cache.GetWithInit(nodeID3)
+	_, ok, err = cache.GetWithInit(peerID3)
 	require.NoError(t, err)
 	require.True(t, ok)
 
 	numOfIds := uint(3)
 	require.Equal(t, numOfIds, cache.Size(), fmt.Sprintf("expected size of the cache to be %d", numOfIds))
-	// remove nodeID1 and check if the record is removed
-	require.True(t, cache.Remove(nodeID1))
-	require.NotContains(t, nodeID1, cache.NodeIDs())
+	// remove peerID1 and check if the record is removed
+	require.True(t, cache.Remove(peerID1))
+	require.NotContains(t, peerID1, cache.NodeIDs())
 
 	// check if the other node IDs are still in the cache
-	_, exists, err := cache.GetWithInit(nodeID2)
+	_, exists, err := cache.GetWithInit(peerID2)
 	require.NoError(t, err)
 	require.True(t, exists)
-	_, exists, err = cache.GetWithInit(nodeID3)
+	_, exists, err = cache.GetWithInit(peerID3)
 	require.NoError(t, err)
 	require.True(t, exists)
 
 	// attempt to remove a non-existent node ID
-	nodeID4 := unittest.IdentifierFixture()
+	nodeID4 := unittest.PeerIdFixture(t)
 	require.False(t, cache.Remove(nodeID4))
 }
 
@@ -248,23 +249,23 @@ func TestRecordCache_Remove(t *testing.T) {
 func TestRecordCache_ConcurrentRemove(t *testing.T) {
 	cache := cacheFixture(t, 100, defaultDecay, zerolog.Nop(), metrics.NewNoopCollector())
 
-	nodeIDs := unittest.IdentifierListFixture(10)
-	for _, nodeID := range nodeIDs {
-		_, ok, err := cache.GetWithInit(nodeID)
+	peerIds := unittest.PeerIdFixtures(t, 10)
+	for _, pid := range peerIds {
+		_, ok, err := cache.GetWithInit(pid)
 		require.NoError(t, err)
 		require.True(t, ok)
 	}
 
 	var wg sync.WaitGroup
-	wg.Add(len(nodeIDs))
+	wg.Add(len(peerIds))
 
-	for _, nodeID := range nodeIDs {
-		go func(id flow.Identifier) {
+	for _, pid := range peerIds {
+		go func(id peer.ID) {
 			defer wg.Done()
 			removed := cache.Remove(id)
 			require.True(t, removed)
 			require.NotContains(t, id, cache.NodeIDs())
-		}(nodeID)
+		}(pid)
 	}
 
 	unittest.RequireReturnsBefore(t, wg.Wait, 100*time.Millisecond, "timed out waiting for goroutines to finish")
@@ -280,38 +281,38 @@ func TestRecordCache_ConcurrentRemove(t *testing.T) {
 func TestRecordCache_ConcurrentUpdatesAndReads(t *testing.T) {
 	cache := cacheFixture(t, 100, defaultDecay, zerolog.Nop(), metrics.NewNoopCollector())
 
-	nodeIDs := unittest.IdentifierListFixture(10)
-	for _, nodeID := range nodeIDs {
-		_, ok, err := cache.GetWithInit(nodeID)
+	peerIds := unittest.PeerIdFixtures(t, 10)
+	for _, pid := range peerIds {
+		_, ok, err := cache.GetWithInit(pid)
 		require.NoError(t, err)
 		require.True(t, ok)
 	}
 
 	var wg sync.WaitGroup
-	wg.Add(len(nodeIDs) * 2)
+	wg.Add(len(peerIds) * 2)
 
-	for _, nodeID := range nodeIDs {
+	for _, pid := range peerIds {
 		// adjust spam records concurrently
-		go func(id flow.Identifier) {
+		go func(id peer.ID) {
 			defer wg.Done()
 			_, err := cache.ReceivedClusterPrefixedMessage(id)
 			require.NoError(t, err)
-		}(nodeID)
+		}(pid)
 
 		// get spam records concurrently
-		go func(id flow.Identifier) {
+		go func(id peer.ID) {
 			defer wg.Done()
 			_, found, err := cache.GetWithInit(id)
 			require.NoError(t, err)
 			require.True(t, found)
-		}(nodeID)
+		}(pid)
 	}
 
 	unittest.RequireReturnsBefore(t, wg.Wait, 100*time.Millisecond, "timed out waiting for goroutines to finish")
 
 	// ensure that the records are correctly updated in the cache
-	for _, nodeID := range nodeIDs {
-		gauge, found, err := cache.GetWithInit(nodeID)
+	for _, pid := range peerIds {
+		gauge, found, err := cache.GetWithInit(pid)
 		require.NoError(t, err)
 		require.True(t, found)
 		// slight decay will result in 0.9 < gauge < 1
@@ -329,43 +330,47 @@ func TestRecordCache_ConcurrentUpdatesAndReads(t *testing.T) {
 func TestRecordCache_ConcurrentInitAndRemove(t *testing.T) {
 	cache := cacheFixture(t, 100, defaultDecay, zerolog.Nop(), metrics.NewNoopCollector())
 
-	nodeIDs := unittest.IdentifierListFixture(20)
-	nodeIDsToAdd := nodeIDs[:10]
-	nodeIDsToRemove := nodeIDs[10:]
+	peerIds := unittest.PeerIdFixtures(t, 20)
+	peerIdsToAdd := peerIds[:10]
+	peerIdsToRemove := peerIds[10:]
 
-	for _, nodeID := range nodeIDsToRemove {
-		_, ok, err := cache.GetWithInit(nodeID)
+	for _, pid := range peerIdsToRemove {
+		_, ok, err := cache.GetWithInit(pid)
 		require.NoError(t, err)
 		require.True(t, ok)
 	}
 
 	var wg sync.WaitGroup
-	wg.Add(len(nodeIDs))
+	wg.Add(len(peerIds))
 
 	// initialize spam records concurrently
-	for _, nodeID := range nodeIDsToAdd {
-		go func(id flow.Identifier) {
+	for _, pid := range peerIdsToAdd {
+		go func(id peer.ID) {
 			defer wg.Done()
 			_, ok, err := cache.GetWithInit(id)
 			require.NoError(t, err)
 			require.True(t, ok)
-		}(nodeID)
+		}(pid)
 	}
 
 	// remove spam records concurrently
-	for _, nodeID := range nodeIDsToRemove {
-		go func(id flow.Identifier) {
+	for _, pid := range peerIdsToRemove {
+		go func(id peer.ID) {
 			defer wg.Done()
 			cache.Remove(id)
 			require.NotContains(t, id, cache.NodeIDs())
-		}(nodeID)
+		}(pid)
 	}
 
 	unittest.RequireReturnsBefore(t, wg.Wait, 100*time.Millisecond, "timed out waiting for goroutines to finish")
 
 	// ensure that the initialized records are correctly added to the cache
 	// and removed records are correctly removed from the cache
-	require.ElementsMatch(t, nodeIDsToAdd, cache.NodeIDs())
+	expectedIds := make([]flow.Identifier, len(peerIdsToAdd))
+	for i, pid := range peerIdsToAdd {
+		expectedIds[i] = cache.MakeId(pid)
+	}
+	require.ElementsMatch(t, expectedIds, cache.NodeIDs())
 }
 
 // TestRecordCache_ConcurrentInitRemoveUpdate tests the concurrent initialization, removal, and adjustment of
@@ -376,49 +381,54 @@ func TestRecordCache_ConcurrentInitAndRemove(t *testing.T) {
 func TestRecordCache_ConcurrentInitRemoveUpdate(t *testing.T) {
 	cache := cacheFixture(t, 100, defaultDecay, zerolog.Nop(), metrics.NewNoopCollector())
 
-	nodeIDs := unittest.IdentifierListFixture(30)
-	nodeIDsToAdd := nodeIDs[:10]
-	nodeIDsToRemove := nodeIDs[10:20]
-	nodeIDsToAdjust := nodeIDs[20:]
+	peerIds := unittest.PeerIdFixtures(t, 30)
+	peerIdsToAdd := peerIds[:10]
+	peerIdsToRemove := peerIds[10:20]
+	peerIdsToAdjust := peerIds[20:]
 
-	for _, nodeID := range nodeIDsToRemove {
-		_, ok, err := cache.GetWithInit(nodeID)
+	for _, pid := range peerIdsToRemove {
+		_, ok, err := cache.GetWithInit(pid)
 		require.NoError(t, err)
 		require.True(t, ok)
 	}
 
 	var wg sync.WaitGroup
-	wg.Add(len(nodeIDs))
+	wg.Add(len(peerIds))
 
 	// Initialize spam records concurrently
-	for _, nodeID := range nodeIDsToAdd {
-		go func(id flow.Identifier) {
+	for _, pid := range peerIdsToAdd {
+		go func(id peer.ID) {
 			defer wg.Done()
 			_, ok, err := cache.GetWithInit(id)
 			require.NoError(t, err)
 			require.True(t, ok)
-		}(nodeID)
+		}(pid)
 	}
 
 	// Remove spam records concurrently
-	for _, nodeID := range nodeIDsToRemove {
-		go func(id flow.Identifier) {
+	for _, pid := range peerIdsToRemove {
+		go func(id peer.ID) {
 			defer wg.Done()
 			cache.Remove(id)
 			require.NotContains(t, id, cache.NodeIDs())
-		}(nodeID)
+		}(pid)
 	}
 
 	// Adjust spam records concurrently
-	for _, nodeID := range nodeIDsToAdjust {
-		go func(id flow.Identifier) {
+	for _, pid := range peerIdsToAdjust {
+		go func(id peer.ID) {
 			defer wg.Done()
 			_, _ = cache.ReceivedClusterPrefixedMessage(id)
-		}(nodeID)
+		}(pid)
 	}
 
+	expectedPeerIds := append(peerIdsToAdd, peerIdsToAdjust...)
+	expectedIds := make([]flow.Identifier, len(expectedPeerIds))
+	for i, pid := range expectedPeerIds {
+		expectedIds[i] = cache.MakeId(pid)
+	}
 	unittest.RequireReturnsBefore(t, wg.Wait, 100*time.Millisecond, "timed out waiting for goroutines to finish")
-	require.ElementsMatch(t, append(nodeIDsToAdd, nodeIDsToAdjust...), cache.NodeIDs())
+	require.ElementsMatch(t, expectedIds, cache.NodeIDs())
 }
 
 // TestRecordCache_EdgeCasesAndInvalidInputs tests the edge cases and invalid inputs for RecordCache methods.
@@ -429,49 +439,53 @@ func TestRecordCache_ConcurrentInitRemoveUpdate(t *testing.T) {
 func TestRecordCache_EdgeCasesAndInvalidInputs(t *testing.T) {
 	cache := cacheFixture(t, 100, defaultDecay, zerolog.Nop(), metrics.NewNoopCollector())
 
-	nodeIDs := unittest.IdentifierListFixture(20)
-	nodeIDsToAdd := nodeIDs[:10]
-	nodeIDsToRemove := nodeIDs[10:20]
+	peerIds := unittest.PeerIdFixtures(t, 20)
+	peerIdsToAdd := peerIds[:10]
+	peerIdsToRemove := peerIds[10:20]
 
-	for _, nodeID := range nodeIDsToRemove {
-		_, ok, err := cache.GetWithInit(nodeID)
+	for _, pid := range peerIdsToRemove {
+		_, ok, err := cache.GetWithInit(pid)
 		require.NoError(t, err)
 		require.True(t, ok)
 	}
 
 	var wg sync.WaitGroup
-	wg.Add(len(nodeIDs) + 10)
+	wg.Add(len(peerIds) + 10)
 
 	// initialize spam records concurrently
-	for _, nodeID := range nodeIDsToAdd {
-		go func(id flow.Identifier) {
+	for _, pid := range peerIdsToAdd {
+		go func(id peer.ID) {
 			defer wg.Done()
 			retrieved, ok, err := cache.GetWithInit(id)
 			require.NoError(t, err)
 			require.True(t, ok)
 			require.Zero(t, retrieved)
-		}(nodeID)
+		}(pid)
 	}
 
 	// remove spam records concurrently
-	for _, nodeID := range nodeIDsToRemove {
-		go func(id flow.Identifier) {
+	for _, pid := range peerIdsToRemove {
+		go func(id peer.ID) {
 			defer wg.Done()
 			require.True(t, cache.Remove(id))
-			require.NotContains(t, id, cache.NodeIDs())
-		}(nodeID)
+			require.NotContains(t, cache.MakeId(id), cache.NodeIDs())
+		}(pid)
 	}
 
+	expectedIds := make([]flow.Identifier, len(peerIds))
+	for i, pid := range peerIds {
+		expectedIds[i] = cache.MakeId(pid)
+	}
 	// call NodeIDs method concurrently
 	for i := 0; i < 10; i++ {
 		go func() {
 			defer wg.Done()
 			ids := cache.NodeIDs()
 			// the number of returned IDs should be less than or equal to the number of node IDs
-			require.True(t, len(ids) <= len(nodeIDs))
+			require.True(t, len(ids) <= len(peerIds))
 			// the returned IDs should be a subset of the node IDs
 			for _, id := range ids {
-				require.Contains(t, nodeIDs, id)
+				require.Contains(t, expectedIds, id)
 			}
 		}()
 	}
diff --git a/network/p2p/inspector/internal/cache/cluster_prefixed_received_tracker.go b/network/p2p/inspector/internal/cache/cluster_prefixed_received_tracker.go
index 99e40884e1f..7bf156d0cae 100644
--- a/network/p2p/inspector/internal/cache/cluster_prefixed_received_tracker.go
+++ b/network/p2p/inspector/internal/cache/cluster_prefixed_received_tracker.go
@@ -3,6 +3,7 @@ package cache
 import (
 	"fmt"
 
+	"github.com/libp2p/go-libp2p/core/peer"
 	"github.com/rs/zerolog"
 	"go.uber.org/atomic"
 
@@ -35,20 +36,20 @@ func NewClusterPrefixedMessagesReceivedTracker(logger zerolog.Logger, sizeLimit
 
 // Inc increments the cluster prefixed control messages received Gauge for the peer.
 // All errors returned from this func are unexpected and irrecoverable.
-func (c *ClusterPrefixedMessagesReceivedTracker) Inc(nodeID flow.Identifier) (float64, error) {
-	count, err := c.cache.ReceivedClusterPrefixedMessage(nodeID)
+func (c *ClusterPrefixedMessagesReceivedTracker) Inc(pid peer.ID) (float64, error) {
+	count, err := c.cache.ReceivedClusterPrefixedMessage(pid)
 	if err != nil {
-		return 0, fmt.Errorf("failed to increment cluster prefixed received tracker gauge value for peer %s: %w", nodeID, err)
+		return 0, fmt.Errorf("failed to increment cluster prefixed received tracker gauge value for peer %s: %w", pid, err)
 	}
 	return count, nil
 }
 
 // Load loads the current number of cluster prefixed control messages received by a peer.
 // All errors returned from this func are unexpected and irrecoverable.
-func (c *ClusterPrefixedMessagesReceivedTracker) Load(nodeID flow.Identifier) (float64, error) {
-	count, _, err := c.cache.GetWithInit(nodeID)
+func (c *ClusterPrefixedMessagesReceivedTracker) Load(pid peer.ID) (float64, error) {
+	count, _, err := c.cache.GetWithInit(pid)
 	if err != nil {
-		return 0, fmt.Errorf("failed to get cluster prefixed received tracker gauge value for peer %s: %w", nodeID, err)
+		return 0, fmt.Errorf("failed to get cluster prefixed received tracker gauge value for peer %s: %w", pid, err)
 	}
 	return count, nil
 }
diff --git a/network/p2p/inspector/internal/cache/tracker_test.go b/network/p2p/inspector/internal/cache/tracker_test.go
index 7dac5e6b67a..ce89a2ec631 100644
--- a/network/p2p/inspector/internal/cache/tracker_test.go
+++ b/network/p2p/inspector/internal/cache/tracker_test.go
@@ -16,7 +16,7 @@ import (
 // TestClusterPrefixedMessagesReceivedTracker_Inc ensures cluster prefixed received tracker increments a cluster prefixed control messages received gauge value correctly.
 func TestClusterPrefixedMessagesReceivedTracker_Inc(t *testing.T) {
 	tracker := mockTracker(t)
-	id := unittest.IdentifierFixture()
+	id := unittest.PeerIdFixture(t)
 	n := float64(5)
 	prevGuage := 0.0
 	for i := float64(1); i <= n; i++ {
@@ -34,7 +34,7 @@ func TestClusterPrefixedMessagesReceivedTracker_Inc(t *testing.T) {
 func TestClusterPrefixedMessagesReceivedTracker_IncConcurrent(t *testing.T) {
 	tracker := mockTracker(t)
 	n := float64(5)
-	id := unittest.IdentifierFixture()
+	id := unittest.PeerIdFixture(t)
 	var wg sync.WaitGroup
 	wg.Add(5)
 	for i := float64(0); i < n; i++ {
@@ -55,7 +55,7 @@ func TestClusterPrefixedMessagesReceivedTracker_IncConcurrent(t *testing.T) {
 func TestClusterPrefixedMessagesReceivedTracker_ConcurrentIncAndLoad(t *testing.T) {
 	tracker := mockTracker(t)
 	n := float64(5)
-	id := unittest.IdentifierFixture()
+	id := unittest.PeerIdFixture(t)
 	var wg sync.WaitGroup
 	wg.Add(10)
 
diff --git a/network/p2p/inspector/internal/mockTopicProvider.go b/network/p2p/inspector/internal/mockTopicProvider.go
deleted file mode 100644
index 33599a2fb97..00000000000
--- a/network/p2p/inspector/internal/mockTopicProvider.go
+++ /dev/null
@@ -1,35 +0,0 @@
-package internal
-
-import (
-	"github.com/libp2p/go-libp2p/core/peer"
-)
-
-// MockUpdatableTopicProvider is a mock implementation of the TopicProvider interface.
-// TODO: this should be moved to a common package (e.g. network/p2p/test). Currently, it is not possible to do so because of a circular dependency.
-type MockUpdatableTopicProvider struct {
-	topics        []string
-	subscriptions map[string][]peer.ID
-}
-
-func NewMockUpdatableTopicProvider() *MockUpdatableTopicProvider {
-	return &MockUpdatableTopicProvider{
-		topics:        []string{},
-		subscriptions: map[string][]peer.ID{},
-	}
-}
-
-func (m *MockUpdatableTopicProvider) GetTopics() []string {
-	return m.topics
-}
-
-func (m *MockUpdatableTopicProvider) ListPeers(topic string) []peer.ID {
-	return m.subscriptions[topic]
-}
-
-func (m *MockUpdatableTopicProvider) UpdateTopics(topics []string) {
-	m.topics = topics
-}
-
-func (m *MockUpdatableTopicProvider) UpdateSubscriptions(topic string, peers []peer.ID) {
-	m.subscriptions[topic] = peers
-}
diff --git a/network/p2p/inspector/rpc-inspection-process.png b/network/p2p/inspector/rpc-inspection-process.png
new file mode 100644
index 00000000000..eac93e112c2
Binary files /dev/null and b/network/p2p/inspector/rpc-inspection-process.png differ
diff --git a/network/p2p/inspector/validation/control_message_validation_inspector.go b/network/p2p/inspector/validation/control_message_validation_inspector.go
index fdbaadc5e0d..ffdabe38ce9 100644
--- a/network/p2p/inspector/validation/control_message_validation_inspector.go
+++ b/network/p2p/inspector/validation/control_message_validation_inspector.go
@@ -31,6 +31,26 @@ import (
 	flowrand "github.com/onflow/flow-go/utils/rand"
 )
 
+const (
+	RPCInspectionDisabledWarning     = "rpc inspection disabled for all control message types, skipping inspection"
+	GraftInspectionDisabledWarning   = "rpc graft inspection disabled skipping"
+	PruneInspectionDisabledWarning   = "rpc prune inspection disabled skipping"
+	IWantInspectionDisabledWarning   = "rpc iwant inspection disabled skipping"
+	IHaveInspectionDisabledWarning   = "rpc ihave inspection disabled skipping"
+	PublishInspectionDisabledWarning = "rpc publish message inspection disabled skipping"
+
+	RPCTruncationDisabledWarning            = "rpc truncation disabled for all control message types, skipping truncation"
+	GraftTruncationDisabledWarning          = "rpc graft truncation disabled skipping"
+	PruneTruncationDisabledWarning          = "rpc prune truncation disabled skipping"
+	IHaveTruncationDisabledWarning          = "rpc ihave truncation disabled skipping"
+	IHaveMessageIDTruncationDisabledWarning = "ihave message ids truncation disabled skipping"
+	IWantTruncationDisabledWarning          = "rpc iwant truncation disabled skipping"
+	IWantMessageIDTruncationDisabledWarning = "iwant message ids truncation disabled skipping"
+
+	// rpcInspectorComponentName the rpc inspector component name.
+	rpcInspectorComponentName = "gossipsub_rpc_validation_inspector"
+)
+
 // ControlMsgValidationInspector RPC message inspector that inspects control messages and performs some validation on them,
 // when some validation rule is broken feedback is given via the Peer scoring notifier.
 type ControlMsgValidationInspector struct {
@@ -42,8 +62,6 @@ type ControlMsgValidationInspector struct {
 	metrics module.GossipSubRpcValidationInspectorMetrics
 	// config control message validation configurations.
 	config *p2pconfig.RpcValidationInspector
-	// distributor used to disseminate invalid RPC message notifications.
-	distributor p2p.GossipSubInspectorNotifDistributor
 	// workerPool queue that stores *InspectRPCRequest that will be processed by component workers.
 	workerPool *worker.Pool[*InspectRPCRequest]
 	// tracker is a map that associates the hash of a peer's ID with the
@@ -61,6 +79,10 @@ type ControlMsgValidationInspector struct {
 	networkingType network.NetworkingType
 	// topicOracle callback used to retrieve the current subscribed topics of the libp2p node.
 	topicOracle func() p2p.TopicProvider
+	// notificationConsumer the consumer that will be notified when a misbehavior is detected upon inspection of an RPC.
+	// For each RPC, at most one notification is sent to the consumer.
+	// Each notification acts as a penalty to the peer's score.
+	notificationConsumer p2p.GossipSubInvCtrlMsgNotifConsumer
 }
 
 type InspectorParams struct {
@@ -70,8 +92,6 @@ type InspectorParams struct {
 	SporkID flow.Identifier `validate:"required"`
 	// Config inspector configuration.
 	Config *p2pconfig.RpcValidationInspector `validate:"required"`
-	// Distributor gossipsub inspector notification distributor.
-	Distributor p2p.GossipSubInspectorNotifDistributor `validate:"required"`
 	// HeroCacheMetricsFactory the metrics factory.
 	HeroCacheMetricsFactory metrics.HeroCacheMetricsFactory `validate:"required"`
 	// IdProvider identity provider is used to get the flow identifier for a peer.
@@ -85,10 +105,15 @@ type InspectorParams struct {
 	// TopicOracle callback used to retrieve the current subscribed topics of the libp2p node.
 	// It is set as a callback to avoid circular dependencies between the topic oracle and the inspector.
 	TopicOracle func() p2p.TopicProvider `validate:"required"`
+
+	// InvalidControlMessageNotificationConsumer the consumer that will be notified when a misbehavior is detected upon inspection of an RPC.
+	// For each RPC, at most one notification is sent to the consumer.
+	// Each notification acts as a penalty to the peer's score.
+	InvalidControlMessageNotificationConsumer p2p.GossipSubInvCtrlMsgNotifConsumer `validate:"required"`
 }
 
 var _ component.Component = (*ControlMsgValidationInspector)(nil)
-var _ p2p.GossipSubMsgValidationRpcInspector = (*ControlMsgValidationInspector)(nil)
+var _ p2p.GossipSubRPCInspector = (*ControlMsgValidationInspector)(nil)
 var _ protocol.Consumer = (*ControlMsgValidationInspector)(nil)
 
 // NewControlMsgValidationInspector returns new ControlMsgValidationInspector
@@ -123,16 +148,16 @@ func NewControlMsgValidationInspector(params *InspectorParams) (*ControlMsgValid
 	}
 
 	c := &ControlMsgValidationInspector{
-		logger:         lg,
-		sporkID:        params.SporkID,
-		config:         params.Config,
-		distributor:    params.Distributor,
-		tracker:        clusterPrefixedTracker,
-		rpcTracker:     params.RpcTracker,
-		idProvider:     params.IdProvider,
-		metrics:        params.InspectorMetrics,
-		networkingType: params.NetworkingType,
-		topicOracle:    params.TopicOracle,
+		logger:               lg,
+		sporkID:              params.SporkID,
+		config:               params.Config,
+		tracker:              clusterPrefixedTracker,
+		rpcTracker:           params.RpcTracker,
+		idProvider:           params.IdProvider,
+		metrics:              params.InspectorMetrics,
+		networkingType:       params.NetworkingType,
+		topicOracle:          params.TopicOracle,
+		notificationConsumer: params.InvalidControlMessageNotificationConsumer,
 	}
 
 	store := queue.NewHeroStore(params.Config.InspectionQueue.Size, params.Logger, inspectMsgQueueCacheCollector)
@@ -142,22 +167,6 @@ func NewControlMsgValidationInspector(params *InspectorParams) (*ControlMsgValid
 	c.workerPool = pool
 
 	builder := component.NewComponentManagerBuilder()
-	builder.AddWorker(func(ctx irrecoverable.SignalerContext, ready component.ReadyFunc) {
-		c.logger.Debug().Msg("starting rpc inspector distributor")
-		c.ctx = ctx
-		c.distributor.Start(ctx)
-		select {
-		case <-ctx.Done():
-			c.logger.Debug().Msg("rpc inspector distributor startup aborted; context cancelled")
-		case <-c.distributor.Ready():
-			c.logger.Debug().Msg("rpc inspector distributor started")
-			ready()
-		}
-		<-ctx.Done()
-		c.logger.Debug().Msg("rpc inspector distributor stopped")
-		<-c.distributor.Done()
-		c.logger.Debug().Msg("rpc inspector distributor shutdown complete")
-	})
 	for i := 0; i < c.config.InspectionQueue.NumberOfWorkers; i++ {
 		builder.AddWorker(pool.WorkerLogic())
 	}
@@ -191,6 +200,33 @@ func (c *ControlMsgValidationInspector) ActiveClustersChanged(clusterIDList flow
 // Returns:
 //   - error: if a new inspect rpc request cannot be created, all errors returned are considered irrecoverable.
 func (c *ControlMsgValidationInspector) Inspect(from peer.ID, rpc *pubsub.RPC) error {
+	if c.config.InspectionProcess.Inspect.Disabled {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(RPCInspectionDisabledWarning)
+		return nil
+	}
+
+	// check peer identity when running private network
+	// sanity check: rpc inspection should be disabled on public networks
+	if c.networkingType == network.PrivateNetwork && c.config.InspectionProcess.Inspect.RejectUnstakedPeers {
+		_, err := c.checkSenderIdentity(from)
+		if err != nil {
+			c.notificationConsumer.OnInvalidControlMessageNotification(p2p.NewInvalidControlMessageNotification(from, p2pmsg.CtrlMsgRPC, err, 1, p2p.CtrlMsgNonClusterTopicType))
+			c.logger.
+				Error().
+				Err(err).
+				Str("peer_id", p2plogging.PeerId(from)).
+				Bool(logging.KeyNetworkingSecurity, true).
+				Msg("rpc received from unstaked peer")
+			c.metrics.OnInvalidControlMessageNotificationSent()
+			c.metrics.OnRpcRejectedFromUnknownSender()
+			return err
+		}
+	}
+
 	// first truncate the rpc to the configured max sample size; if needed
 	c.truncateRPC(from, rpc)
 
@@ -205,7 +241,6 @@ func (c *ControlMsgValidationInspector) Inspect(from peer.ID, rpc *pubsub.RPC) e
 		return fmt.Errorf("failed to get inspect RPC request: %w", err)
 	}
 	c.workerPool.Submit(req)
-
 	return nil
 }
 
@@ -293,27 +328,26 @@ func (c *ControlMsgValidationInspector) processInspectRPCReq(req *InspectRPCRequ
 	return nil
 }
 
-// checkPubsubMessageSender checks the sender of the sender of pubsub message to ensure they are not unstaked, or ejected.
+// checkSenderIdentity checks the identity of the peer with pid and ensures they are not unstaked, or ejected.
 // This check is only required on private networks.
 // Args:
-//   - message: the pubsub message.
+//   - pid : the peer ID.
 //
 // Returns:
-//   - error: if the peer ID cannot be created from bytes, sender is unknown or the identity is ejected.
+//   - error: sender is unknown or the identity is ejected.
 //
 // All errors returned from this function can be considered benign.
-func (c *ControlMsgValidationInspector) checkPubsubMessageSender(message *pubsub_pb.Message) error {
-	pid, err := peer.IDFromBytes(message.GetFrom())
-	if err != nil {
-		return fmt.Errorf("failed to get peer ID from bytes: %w", err)
+func (c *ControlMsgValidationInspector) checkSenderIdentity(pid peer.ID) (*flow.Identity, error) {
+	id, ok := c.idProvider.ByPeerID(pid)
+	if !ok {
+		return nil, NewUnstakedPeerErr(pid)
 	}
-	if id, ok := c.idProvider.ByPeerID(pid); !ok {
-		return fmt.Errorf("received rpc publish message from unstaked peer: %s", pid)
-	} else if id.Ejected {
-		return fmt.Errorf("received rpc publish message from ejected peer: %s", pid)
+
+	if id.IsEjected() {
+		return nil, NewEjectedPeerErr(pid)
 	}
 
-	return nil
+	return id, nil
 }
 
 // inspectGraftMessages performs topic validation on all grafts in the control message using the provided validateTopic func while tracking duplicates.
@@ -326,12 +360,23 @@ func (c *ControlMsgValidationInspector) checkPubsubMessageSender(message *pubsub
 // - error: if any error occurs while sampling or validating topics, all returned errors are benign and should not cause the node to crash.
 // - bool: true if an error is returned and the topic that failed validation was a cluster prefixed topic, false otherwise.
 func (c *ControlMsgValidationInspector) inspectGraftMessages(from peer.ID, grafts []*pubsub_pb.ControlGraft, activeClusterIDS flow.ChainIDList) (error, p2p.CtrlMsgTopicType) {
+	if !c.config.InspectionProcess.Inspect.EnableGraft {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(GraftInspectionDisabledWarning)
+		return nil, p2p.CtrlMsgNonClusterTopicType
+	}
+
 	duplicateTopicTracker := make(duplicateStrTracker)
 	totalDuplicateTopicIds := 0
+	totalInvalidTopicIdErrs := 0
 	defer func() {
 		// regardless of inspection result, update metrics
-		c.metrics.OnGraftMessageInspected(totalDuplicateTopicIds)
+		c.metrics.OnGraftMessageInspected(totalDuplicateTopicIds, totalInvalidTopicIdErrs)
 	}()
+
 	for _, graft := range grafts {
 		topic := channels.Topic(graft.GetTopicID())
 		if duplicateTopicTracker.track(topic.String()) > 1 {
@@ -340,14 +385,16 @@ func (c *ControlMsgValidationInspector) inspectGraftMessages(from peer.ID, graft
 			// check if the total number of duplicates exceeds the configured threshold.
 			if totalDuplicateTopicIds > c.config.GraftPrune.DuplicateTopicIdThreshold {
 				c.metrics.OnGraftDuplicateTopicIdsExceedThreshold()
-				return NewDuplicateTopicErr(topic.String(), totalDuplicateTopicIds, p2pmsg.CtrlMsgGraft), p2p.CtrlMsgNonClusterTopicType
+				return NewDuplicateTopicIDThresholdExceeded(totalDuplicateTopicIds, len(grafts), c.config.GraftPrune.DuplicateTopicIdThreshold), p2p.CtrlMsgNonClusterTopicType
 			}
 		}
 		err, ctrlMsgType := c.validateTopic(from, topic, activeClusterIDS)
 		if err != nil {
-			// TODO: consider adding a threshold for this error similar to the duplicate topic id threshold.
+			totalInvalidTopicIdErrs++
 			c.metrics.OnInvalidTopicIdDetectedForControlMessage(p2pmsg.CtrlMsgGraft)
-			return err, ctrlMsgType
+			if totalInvalidTopicIdErrs > c.config.GraftPrune.InvalidTopicIdThreshold {
+				return NewInvalidTopicIDThresholdExceeded(totalInvalidTopicIdErrs, c.config.GraftPrune.InvalidTopicIdThreshold), ctrlMsgType
+			}
 		}
 	}
 	return nil, p2p.CtrlMsgNonClusterTopicType
@@ -364,11 +411,20 @@ func (c *ControlMsgValidationInspector) inspectGraftMessages(from peer.ID, graft
 //   - error: if any error occurs while sampling or validating topics, all returned errors are benign and should not cause the node to crash.
 //   - bool: true if an error is returned and the topic that failed validation was a cluster prefixed topic, false otherwise.
 func (c *ControlMsgValidationInspector) inspectPruneMessages(from peer.ID, prunes []*pubsub_pb.ControlPrune, activeClusterIDS flow.ChainIDList) (error, p2p.CtrlMsgTopicType) {
+	if !c.config.InspectionProcess.Inspect.EnablePrune {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(PruneInspectionDisabledWarning)
+		return nil, p2p.CtrlMsgNonClusterTopicType
+	}
 	tracker := make(duplicateStrTracker)
 	totalDuplicateTopicIds := 0
+	totalInvalidTopicIdErrs := 0
 	defer func() {
 		// regardless of inspection result, update metrics
-		c.metrics.OnPruneMessageInspected(totalDuplicateTopicIds)
+		c.metrics.OnPruneMessageInspected(totalDuplicateTopicIds, totalInvalidTopicIdErrs)
 	}()
 	for _, prune := range prunes {
 		topic := channels.Topic(prune.GetTopicID())
@@ -378,14 +434,16 @@ func (c *ControlMsgValidationInspector) inspectPruneMessages(from peer.ID, prune
 			// check if the total number of duplicates exceeds the configured threshold.
 			if totalDuplicateTopicIds > c.config.GraftPrune.DuplicateTopicIdThreshold {
 				c.metrics.OnPruneDuplicateTopicIdsExceedThreshold()
-				return NewDuplicateTopicErr(topic.String(), totalDuplicateTopicIds, p2pmsg.CtrlMsgPrune), p2p.CtrlMsgNonClusterTopicType
+				return NewDuplicateTopicIDThresholdExceeded(totalDuplicateTopicIds, len(prunes), c.config.GraftPrune.DuplicateTopicIdThreshold), p2p.CtrlMsgNonClusterTopicType
 			}
 		}
 		err, ctrlMsgType := c.validateTopic(from, topic, activeClusterIDS)
 		if err != nil {
-			// TODO: consider adding a threshold for this error similar to the duplicate topic id threshold.
+			totalInvalidTopicIdErrs++
 			c.metrics.OnInvalidTopicIdDetectedForControlMessage(p2pmsg.CtrlMsgPrune)
-			return err, ctrlMsgType
+			if totalInvalidTopicIdErrs > c.config.GraftPrune.InvalidTopicIdThreshold {
+				return NewInvalidTopicIDThresholdExceeded(totalInvalidTopicIdErrs, c.config.GraftPrune.InvalidTopicIdThreshold), ctrlMsgType
+			}
 		}
 	}
 	return nil, p2p.CtrlMsgNonClusterTopicType
@@ -402,6 +460,15 @@ func (c *ControlMsgValidationInspector) inspectPruneMessages(from peer.ID, prune
 //   - error: if any error occurs while sampling or validating topics, all returned errors are benign and should not cause the node to crash.
 //   - bool: true if an error is returned and the topic that failed validation was a cluster prefixed topic, false otherwise.
 func (c *ControlMsgValidationInspector) inspectIHaveMessages(from peer.ID, ihaves []*pubsub_pb.ControlIHave, activeClusterIDS flow.ChainIDList) (error, p2p.CtrlMsgTopicType) {
+	if !c.config.InspectionProcess.Inspect.EnableIHave {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(IHaveInspectionDisabledWarning)
+		return nil, p2p.CtrlMsgNonClusterTopicType
+	}
+
 	if len(ihaves) == 0 {
 		return nil, p2p.CtrlMsgNonClusterTopicType
 	}
@@ -415,9 +482,10 @@ func (c *ControlMsgValidationInspector) inspectIHaveMessages(from peer.ID, ihave
 	totalMessageIds := 0
 	totalDuplicateTopicIds := 0
 	totalDuplicateMessageIds := 0
+	totalInvalidTopicIdErrs := 0
 	defer func() {
 		// regardless of inspection result, update metrics
-		c.metrics.OnIHaveMessagesInspected(totalDuplicateTopicIds, totalDuplicateMessageIds)
+		c.metrics.OnIHaveMessagesInspected(totalDuplicateTopicIds, totalDuplicateMessageIds, totalInvalidTopicIdErrs)
 	}()
 	for _, ihave := range ihaves {
 		messageIds := ihave.GetMessageIDs()
@@ -427,9 +495,11 @@ func (c *ControlMsgValidationInspector) inspectIHaveMessages(from peer.ID, ihave
 		// first check if the topic is valid, fail fast if it is not
 		err, ctrlMsgType := c.validateTopic(from, channels.Topic(topic), activeClusterIDS)
 		if err != nil {
-			// TODO: consider adding a threshold for this error similar to the duplicate topic id threshold.
+			totalInvalidTopicIdErrs++
 			c.metrics.OnInvalidTopicIdDetectedForControlMessage(p2pmsg.CtrlMsgIHave)
-			return err, ctrlMsgType
+			if totalInvalidTopicIdErrs > c.config.IHave.InvalidTopicIdThreshold {
+				return NewInvalidTopicIDThresholdExceeded(totalInvalidTopicIdErrs, c.config.IHave.InvalidTopicIdThreshold), ctrlMsgType
+			}
 		}
 
 		// then track the topic ensuring it is not beyond a duplicate threshold.
@@ -438,7 +508,7 @@ func (c *ControlMsgValidationInspector) inspectIHaveMessages(from peer.ID, ihave
 			// the topic is duplicated, check if the total number of duplicates exceeds the configured threshold
 			if totalDuplicateTopicIds > c.config.IHave.DuplicateTopicIdThreshold {
 				c.metrics.OnIHaveDuplicateTopicIdsExceedThreshold()
-				return NewDuplicateTopicErr(topic, totalDuplicateTopicIds, p2pmsg.CtrlMsgIHave), p2p.CtrlMsgNonClusterTopicType
+				return NewDuplicateTopicIDThresholdExceeded(totalDuplicateTopicIds, len(ihaves), c.config.IHave.DuplicateTopicIdThreshold), p2p.CtrlMsgNonClusterTopicType
 			}
 		}
 
@@ -473,6 +543,15 @@ func (c *ControlMsgValidationInspector) inspectIHaveMessages(from peer.ID, ihave
 // - DuplicateTopicErr: if there are any duplicate message ids found in any of the iWants.
 // - IWantCacheMissThresholdErr: if the rate of cache misses exceeds the configured allowed threshold.
 func (c *ControlMsgValidationInspector) inspectIWantMessages(from peer.ID, iWants []*pubsub_pb.ControlIWant) error {
+	if !c.config.InspectionProcess.Inspect.EnableIWant {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(IWantInspectionDisabledWarning)
+		return nil
+	}
+
 	if len(iWants) == 0 {
 		return nil
 	}
@@ -546,10 +625,19 @@ func (c *ControlMsgValidationInspector) inspectIWantMessages(from peer.ID, iWant
 // - InvalidRpcPublishMessagesErr: if the amount of invalid messages exceeds the configured RPCMessageErrorThreshold.
 // - int: the number of invalid pubsub messages
 func (c *ControlMsgValidationInspector) inspectRpcPublishMessages(from peer.ID, messages []*pubsub_pb.Message, activeClusterIDS flow.ChainIDList) (error, uint64) {
+	if !c.config.InspectionProcess.Inspect.EnablePublish {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(PublishInspectionDisabledWarning)
+		return nil, 0
+	}
 	totalMessages := len(messages)
 	if totalMessages == 0 {
 		return nil, 0
 	}
+
 	sampleSize := c.config.PublishMessages.MaxSampleSize
 	if sampleSize > totalMessages {
 		sampleSize = totalMessages
@@ -579,15 +667,9 @@ func (c *ControlMsgValidationInspector) inspectRpcPublishMessages(from peer.ID,
 		}
 		c.metrics.OnPublishMessageInspected(errCnt, invalidTopicIdsCount, invalidSubscriptionsCount, invalidSendersCount)
 	}()
+
+	idCheckCache := make(map[peer.ID]error)
 	for _, message := range messages[:sampleSize] {
-		if c.networkingType == network.PrivateNetwork {
-			err := c.checkPubsubMessageSender(message)
-			if err != nil {
-				invalidSendersCount++
-				errs = multierror.Append(errs, err)
-				continue
-			}
-		}
 		topic := channels.Topic(message.GetTopic())
 		// The boolean value returned when validating a topic, indicating whether the topic is cluster-prefixed or not, is intentionally ignored.
 		// This is because we have already set a threshold for errors allowed on publish messages. Reducing the penalty further based on
@@ -603,9 +685,35 @@ func (c *ControlMsgValidationInspector) inspectRpcPublishMessages(from peer.ID,
 		if !hasSubscription(topic.String()) {
 			invalidSubscriptionsCount++
 			errs = multierror.Append(errs, fmt.Errorf("subscription for topic %s not found", topic))
+			continue
 		}
-	}
 
+		if c.networkingType == network.PrivateNetwork {
+			pid, err := peer.IDFromBytes(message.GetFrom())
+			if err != nil {
+				invalidSendersCount++
+				errs = multierror.Append(errs, fmt.Errorf("failed to get peer ID from bytes: %w", err))
+				continue
+			}
+
+			if idCheckErr, ok := idCheckCache[pid]; ok {
+				if idCheckErr != nil {
+					errs = multierror.Append(errs, idCheckErr)
+					continue
+				}
+			}
+
+			_, idErr := c.checkSenderIdentity(pid)
+			if idErr != nil {
+				invalidSendersCount++
+				errs = multierror.Append(errs, idErr)
+				idCheckCache[pid] = idErr
+				continue
+			}
+
+			idCheckCache[pid] = nil
+		}
+	}
 	// return an error when we exceed the error threshold
 	if errs != nil && errs.Len() > c.config.PublishMessages.ErrorThreshold {
 		c.metrics.OnPublishMessagesInspectionErrorExceedsThreshold()
@@ -620,16 +728,27 @@ func (c *ControlMsgValidationInspector) inspectRpcPublishMessages(from peer.ID,
 // - from: peer ID of the sender.
 // - rpc: the pubsub RPC.
 func (c *ControlMsgValidationInspector) truncateRPC(from peer.ID, rpc *pubsub.RPC) {
+	if c.config.InspectionProcess.Truncate.Disabled {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(RPCTruncationDisabledWarning)
+		return
+	}
+
 	for _, ctlMsgType := range p2pmsg.ControlMessageTypes() {
 		switch ctlMsgType {
 		case p2pmsg.CtrlMsgGraft:
-			c.truncateGraftMessages(rpc)
+			c.truncateGraftMessages(from, rpc)
 		case p2pmsg.CtrlMsgPrune:
-			c.truncatePruneMessages(rpc)
+			c.truncatePruneMessages(from, rpc)
 		case p2pmsg.CtrlMsgIHave:
-			c.truncateIHaveMessages(rpc)
+			c.truncateIHaveMessages(from, rpc)
+			c.truncateIHaveMessageIds(from, rpc)
 		case p2pmsg.CtrlMsgIWant:
 			c.truncateIWantMessages(from, rpc)
+			c.truncateIWantMessageIds(from, rpc)
 		default:
 			// sanity check this should never happen
 			c.logAndThrowError(fmt.Errorf("unknown control message type encountered during RPC truncation"))
@@ -641,7 +760,16 @@ func (c *ControlMsgValidationInspector) truncateRPC(from peer.ID, rpc *pubsub.RP
 // GraftPruneMessageMaxSampleSize the list of Grafts will be truncated.
 // Args:
 //   - rpc: the rpc message to truncate.
-func (c *ControlMsgValidationInspector) truncateGraftMessages(rpc *pubsub.RPC) {
+func (c *ControlMsgValidationInspector) truncateGraftMessages(from peer.ID, rpc *pubsub.RPC) {
+	if !c.config.InspectionProcess.Truncate.EnableGraft {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(GraftTruncationDisabledWarning)
+		return
+	}
+
 	grafts := rpc.GetControl().GetGraft()
 	originalGraftSize := len(grafts)
 	if originalGraftSize <= c.config.GraftPrune.MessageCountThreshold {
@@ -661,7 +789,16 @@ func (c *ControlMsgValidationInspector) truncateGraftMessages(rpc *pubsub.RPC) {
 // GraftPruneMessageMaxSampleSize the list of Prunes will be truncated.
 // Args:
 //   - rpc: the rpc message to truncate.
-func (c *ControlMsgValidationInspector) truncatePruneMessages(rpc *pubsub.RPC) {
+func (c *ControlMsgValidationInspector) truncatePruneMessages(from peer.ID, rpc *pubsub.RPC) {
+	if !c.config.InspectionProcess.Truncate.EnablePrune {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(PruneTruncationDisabledWarning)
+		return
+	}
+
 	prunes := rpc.GetControl().GetPrune()
 	originalPruneSize := len(prunes)
 	if originalPruneSize <= c.config.GraftPrune.MessageCountThreshold {
@@ -680,7 +817,16 @@ func (c *ControlMsgValidationInspector) truncatePruneMessages(rpc *pubsub.RPC) {
 // MessageCountThreshold the list of iHaves will be truncated.
 // Args:
 //   - rpc: the rpc message to truncate.
-func (c *ControlMsgValidationInspector) truncateIHaveMessages(rpc *pubsub.RPC) {
+func (c *ControlMsgValidationInspector) truncateIHaveMessages(from peer.ID, rpc *pubsub.RPC) {
+	if !c.config.InspectionProcess.Truncate.EnableIHave {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(IHaveTruncationDisabledWarning)
+		return
+	}
+
 	ihaves := rpc.GetControl().GetIhave()
 	originalIHaveCount := len(ihaves)
 	if originalIHaveCount == 0 {
@@ -699,14 +845,22 @@ func (c *ControlMsgValidationInspector) truncateIHaveMessages(rpc *pubsub.RPC) {
 		rpc.Control.Ihave = ihaves[:sampleSize]
 		c.metrics.OnControlMessagesTruncated(p2pmsg.CtrlMsgIHave, originalIHaveCount-len(rpc.Control.Ihave))
 	}
-	c.truncateIHaveMessageIds(rpc)
 }
 
 // truncateIHaveMessageIds truncates the message ids for each iHave control message in the RPC. If the total number of message ids in a single iHave exceeds the configured
 // MessageIdCountThreshold the list of message ids will be truncated. Before message ids are truncated the iHave control messages should have been truncated themselves.
 // Args:
 //   - rpc: the rpc message to truncate.
-func (c *ControlMsgValidationInspector) truncateIHaveMessageIds(rpc *pubsub.RPC) {
+func (c *ControlMsgValidationInspector) truncateIHaveMessageIds(from peer.ID, rpc *pubsub.RPC) {
+	if !c.config.InspectionProcess.Truncate.EnableIHaveMessageIds {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(IHaveMessageIDTruncationDisabledWarning)
+		return
+	}
+
 	for _, ihave := range rpc.GetControl().GetIhave() {
 		messageIDs := ihave.GetMessageIDs()
 		originalMessageIdCount := len(messageIDs)
@@ -734,6 +888,15 @@ func (c *ControlMsgValidationInspector) truncateIHaveMessageIds(rpc *pubsub.RPC)
 // Args:
 //   - rpc: the rpc message to truncate.
 func (c *ControlMsgValidationInspector) truncateIWantMessages(from peer.ID, rpc *pubsub.RPC) {
+	if !c.config.InspectionProcess.Truncate.EnableIWant {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(IWantTruncationDisabledWarning)
+		return
+	}
+
 	iWants := rpc.GetControl().GetIwant()
 	originalIWantCount := uint(len(iWants))
 	if originalIWantCount == 0 {
@@ -752,7 +915,6 @@ func (c *ControlMsgValidationInspector) truncateIWantMessages(from peer.ID, rpc
 		rpc.Control.Iwant = iWants[:sampleSize]
 		c.metrics.OnControlMessagesTruncated(p2pmsg.CtrlMsgIWant, int(originalIWantCount)-len(rpc.Control.Iwant))
 	}
-	c.truncateIWantMessageIds(from, rpc)
 }
 
 // truncateIWantMessageIds truncates the message ids for each iWant control message in the RPC. If the total number of message ids in a single iWant exceeds the configured
@@ -760,6 +922,15 @@ func (c *ControlMsgValidationInspector) truncateIWantMessages(from peer.ID, rpc
 // Args:
 //   - rpc: the rpc message to truncate.
 func (c *ControlMsgValidationInspector) truncateIWantMessageIds(from peer.ID, rpc *pubsub.RPC) {
+	if !c.config.InspectionProcess.Truncate.EnableIWantMessageIds {
+		c.logger.
+			Trace().
+			Str("peer_id", p2plogging.PeerId(from)).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg(IWantMessageIDTruncationDisabledWarning)
+		return
+	}
+
 	lastHighest := c.rpcTracker.LastHighestIHaveRPCSize()
 	lg := c.logger.With().
 		Str("peer_id", p2plogging.PeerId(from)).
@@ -843,23 +1014,17 @@ func (c *ControlMsgValidationInspector) validateClusterPrefixedTopic(from peer.I
 		Str("from", p2plogging.PeerId(from)).
 		Logger()
 
-	// only staked nodes are expected to participate on cluster prefixed topics
-	nodeID, err := c.getFlowIdentifier(from)
-	if err != nil {
-		return err
-	}
 	if len(activeClusterIds) == 0 {
 		// cluster IDs have not been updated yet
-		_, incErr := c.tracker.Inc(nodeID)
+		_, incErr := c.tracker.Inc(from)
 		if incErr != nil {
 			// irrecoverable error encountered
-			c.logAndThrowError(fmt.Errorf("error encountered while incrementing the cluster prefixed control message gauge %s: %w", nodeID, err))
+			c.logAndThrowError(fmt.Errorf("error encountered while incrementing the cluster prefixed control message gauge %s: %w", from, incErr))
 		}
 
 		// if the amount of messages received is below our hard threshold log the error and return nil.
-		if ok := c.checkClusterPrefixHardThreshold(nodeID); ok {
+		if ok := c.checkClusterPrefixHardThreshold(from); ok {
 			lg.Warn().
-				Err(err).
 				Str("topic", topic.String()).
 				Msg("failed to validate cluster prefixed control message with cluster pre-fixed topic active cluster ids not set")
 			return nil
@@ -868,17 +1033,17 @@ func (c *ControlMsgValidationInspector) validateClusterPrefixedTopic(from peer.I
 		return NewActiveClusterIdsNotSetErr(topic)
 	}
 
-	err = channels.IsValidFlowClusterTopic(topic, activeClusterIds)
+	err := channels.IsValidFlowClusterTopic(topic, activeClusterIds)
 	if err != nil {
 		if channels.IsUnknownClusterIDErr(err) {
 			// unknown cluster ID error could indicate that a node has fallen
 			// behind and needs to catchup increment to topics received cache.
-			_, incErr := c.tracker.Inc(nodeID)
+			_, incErr := c.tracker.Inc(from)
 			if incErr != nil {
-				c.logAndThrowError(fmt.Errorf("error encountered while incrementing the cluster prefixed control message gauge %s: %w", nodeID, err))
+				c.logAndThrowError(fmt.Errorf("error encountered while incrementing the cluster prefixed control message gauge %s: %w", from, err))
 			}
 			// if the amount of messages received is below our hard threshold log the error and return nil.
-			if c.checkClusterPrefixHardThreshold(nodeID) {
+			if c.checkClusterPrefixHardThreshold(from) {
 				lg.Warn().
 					Err(err).
 					Str("topic", topic.String()).
@@ -892,28 +1057,15 @@ func (c *ControlMsgValidationInspector) validateClusterPrefixedTopic(from peer.I
 	return nil
 }
 
-// getFlowIdentifier returns the flow identity identifier for a peer.
-// Args:
-//   - peerID: the peer id of the sender.
-//
-// The returned error indicates that the peer is un-staked.
-func (c *ControlMsgValidationInspector) getFlowIdentifier(peerID peer.ID) (flow.Identifier, error) {
-	id, ok := c.idProvider.ByPeerID(peerID)
-	if !ok {
-		return flow.ZeroID, NewUnstakedPeerErr(fmt.Errorf("failed to get flow identity for peer: %s", peerID))
-	}
-	return id.ID(), nil
-}
-
 // checkClusterPrefixHardThreshold returns true if the cluster prefix received tracker count is less than
 // the configured HardThreshold, false otherwise.
 // If any error is encountered while loading from the tracker this func will throw an error on the signaler context, these errors
 // are unexpected and irrecoverable indicating a bug.
-func (c *ControlMsgValidationInspector) checkClusterPrefixHardThreshold(nodeID flow.Identifier) bool {
-	gauge, err := c.tracker.Load(nodeID)
+func (c *ControlMsgValidationInspector) checkClusterPrefixHardThreshold(pid peer.ID) bool {
+	gauge, err := c.tracker.Load(pid)
 	if err != nil {
 		// irrecoverable error encountered
-		c.logAndThrowError(fmt.Errorf("cluster prefixed control message gauge during hard threshold check failed for node %s: %w", nodeID, err))
+		c.logAndThrowError(fmt.Errorf("cluster prefixed control message gauge during hard threshold check failed for peer %s: %w", pid, err))
 	}
 	return gauge <= c.config.ClusterPrefixedMessage.HardThreshold
 }
@@ -944,14 +1096,8 @@ func (c *ControlMsgValidationInspector) logAndDistributeAsyncInspectErrs(req *In
 		c.metrics.OnUnstakedPeerInspectionFailed()
 		lg.Warn().Msg("control message received from unstaked peer")
 	default:
-		distErr := c.distributor.Distribute(p2p.NewInvalidControlMessageNotification(req.Peer, ctlMsgType, err, count, topicType))
-		if distErr != nil {
-			lg.Error().
-				Err(distErr).
-				Msg("failed to distribute invalid control message notification")
-			return
-		}
-		lg.Error().Msg("rpc control message async inspection failed")
+		c.notificationConsumer.OnInvalidControlMessageNotification(p2p.NewInvalidControlMessageNotification(req.Peer, ctlMsgType, err, count, topicType))
+		lg.Error().Msg("rpc control message async inspection failed, notification sent")
 		c.metrics.OnInvalidControlMessageNotificationSent()
 	}
 }
diff --git a/network/p2p/inspector/validation/control_message_validation_inspector_test.go b/network/p2p/inspector/validation/control_message_validation_inspector_test.go
index 672f89c057e..e56161dca64 100644
--- a/network/p2p/inspector/validation/control_message_validation_inspector_test.go
+++ b/network/p2p/inspector/validation/control_message_validation_inspector_test.go
@@ -4,16 +4,21 @@ import (
 	"context"
 	"fmt"
 	"math/rand"
+	"os"
 	"sync"
 	"testing"
 	"time"
 
+	pubsub "github.com/libp2p/go-libp2p-pubsub"
 	pubsub_pb "github.com/libp2p/go-libp2p-pubsub/pb"
 	"github.com/libp2p/go-libp2p/core/peer"
+	"github.com/rs/zerolog"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
+	"go.uber.org/atomic"
 
 	"github.com/onflow/flow-go/config"
+	"github.com/onflow/flow-go/engine/common/worker"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/irrecoverable"
 	"github.com/onflow/flow-go/module/metrics"
@@ -21,7 +26,6 @@ import (
 	"github.com/onflow/flow-go/network"
 	"github.com/onflow/flow-go/network/channels"
 	"github.com/onflow/flow-go/network/p2p"
-	"github.com/onflow/flow-go/network/p2p/inspector/internal"
 	"github.com/onflow/flow-go/network/p2p/inspector/validation"
 	p2pmsg "github.com/onflow/flow-go/network/p2p/message"
 	mockp2p "github.com/onflow/flow-go/network/p2p/mock"
@@ -30,24 +34,23 @@ import (
 )
 
 func TestNewControlMsgValidationInspector(t *testing.T) {
-
 	t.Run("should create validation inspector without error", func(t *testing.T) {
 		sporkID := unittest.IdentifierFixture()
 		flowConfig, err := config.DefaultConfig()
 		require.NoError(t, err, "failed to get default flow config")
-		distributor := mockp2p.NewGossipSubInspectorNotifDistributor(t)
+		consumer := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
 		idProvider := mockmodule.NewIdentityProvider(t)
-		topicProvider := internal.NewMockUpdatableTopicProvider()
+		topicProvider := p2ptest.NewUpdatableTopicProviderFixture()
 		inspector, err := validation.NewControlMsgValidationInspector(&validation.InspectorParams{
 			Logger:                  unittest.Logger(),
 			SporkID:                 sporkID,
 			Config:                  &flowConfig.NetworkConfig.GossipSub.RpcInspector.Validation,
-			Distributor:             distributor,
 			IdProvider:              idProvider,
 			HeroCacheMetricsFactory: metrics.NewNoopHeroCacheMetricsFactory(),
 			InspectorMetrics:        metrics.NewNoopCollector(),
 			RpcTracker:              mockp2p.NewRpcControlTracking(t),
 			NetworkingType:          network.PublicNetwork,
+			InvalidControlMessageNotificationConsumer: consumer,
 			TopicOracle: func() p2p.TopicProvider {
 				return topicProvider
 			},
@@ -60,18 +63,18 @@ func TestNewControlMsgValidationInspector(t *testing.T) {
 			Logger:                  unittest.Logger(),
 			SporkID:                 unittest.IdentifierFixture(),
 			Config:                  nil,
-			Distributor:             nil,
 			IdProvider:              nil,
 			HeroCacheMetricsFactory: nil,
 			InspectorMetrics:        nil,
 			RpcTracker:              nil,
 			TopicOracle:             nil,
+			InvalidControlMessageNotificationConsumer: nil,
 		})
 		require.Nil(t, inspector)
 		require.Error(t, err)
 		s := err.Error()
 		require.Contains(t, s, "validation for 'Config' failed on the 'required'")
-		require.Contains(t, s, "validation for 'Distributor' failed on the 'required'")
+		require.Contains(t, s, "validation for 'InvalidControlMessageNotificationConsumer' failed on the 'required'")
 		require.Contains(t, s, "validation for 'IdProvider' failed on the 'required'")
 		require.Contains(t, s, "validation for 'HeroCacheMetricsFactory' failed on the 'required'")
 		require.Contains(t, s, "validation for 'InspectorMetrics' failed on the 'required'")
@@ -87,11 +90,11 @@ func TestNewControlMsgValidationInspector(t *testing.T) {
 func TestControlMessageValidationInspector_truncateRPC(t *testing.T) {
 	t.Run("graft truncation", func(t *testing.T) {
 		graftPruneMessageMaxSampleSize := 1000
-		inspector, signalerCtx, cancel, distributor, rpcTracker, _, _, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+		inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
 			params.Config.GraftPrune.MessageCountThreshold = graftPruneMessageMaxSampleSize
 		})
 		// topic validation is ignored set any topic oracle
-		distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Maybe()
+		consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Maybe()
 		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 		rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Maybe()
 		inspector.Start(signalerCtx)
@@ -104,6 +107,7 @@ func TestControlMessageValidationInspector_truncateRPC(t *testing.T) {
 		require.Less(t, len(graftsLessThanMaxSampleSize.GetControl().GetGraft()), graftPruneMessageMaxSampleSize)
 
 		from := unittest.PeerIdFixture(t)
+		idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Twice()
 		require.NoError(t, inspector.Inspect(from, graftsGreaterThanMaxSampleSize))
 		require.NoError(t, inspector.Inspect(from, graftsLessThanMaxSampleSize))
 		require.Eventually(t, func() bool {
@@ -119,24 +123,24 @@ func TestControlMessageValidationInspector_truncateRPC(t *testing.T) {
 
 	t.Run("prune truncation", func(t *testing.T) {
 		graftPruneMessageMaxSampleSize := 1000
-		inspector, signalerCtx, cancel, distributor, rpcTracker, _, _, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+		inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
 			params.Config.GraftPrune.MessageCountThreshold = graftPruneMessageMaxSampleSize
 		})
 		// topic validation is ignored set any topic oracle
 		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 		rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Maybe()
-		distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Twice()
+		consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Maybe()
 
 		inspector.Start(signalerCtx)
 		unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
-		// unittest.RequireCloseBefore(t, inspector.Ready(), 100*time.Millisecond, "inspector did not start")
 		// topic validation not performed, so we can use random strings
 		prunesGreaterThanMaxSampleSize := unittest.P2PRPCFixture(unittest.WithPrunes(unittest.P2PRPCPruneFixtures(unittest.IdentifierListFixture(2000).Strings()...)...))
 		require.Greater(t, len(prunesGreaterThanMaxSampleSize.GetControl().GetPrune()), graftPruneMessageMaxSampleSize)
 		prunesLessThanMaxSampleSize := unittest.P2PRPCFixture(unittest.WithPrunes(unittest.P2PRPCPruneFixtures(unittest.IdentifierListFixture(50).Strings()...)...))
 		require.Less(t, len(prunesLessThanMaxSampleSize.GetControl().GetPrune()), graftPruneMessageMaxSampleSize)
 		from := unittest.PeerIdFixture(t)
+		idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Twice()
 		require.NoError(t, inspector.Inspect(from, prunesGreaterThanMaxSampleSize))
 		require.NoError(t, inspector.Inspect(from, prunesLessThanMaxSampleSize))
 		require.Eventually(t, func() bool {
@@ -152,13 +156,14 @@ func TestControlMessageValidationInspector_truncateRPC(t *testing.T) {
 
 	t.Run("ihave message id truncation", func(t *testing.T) {
 		maxSampleSize := 1000
-		inspector, signalerCtx, cancel, distributor, rpcTracker, _, _, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+		inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
 			params.Config.IHave.MessageCountThreshold = maxSampleSize
 		})
 		// topic validation is ignored set any topic oracle
 		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 		rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Maybe()
-		distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Twice()
+		consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Maybe()
+
 		inspector.Start(signalerCtx)
 		unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
@@ -169,6 +174,7 @@ func TestControlMessageValidationInspector_truncateRPC(t *testing.T) {
 		require.Less(t, len(iHavesLessThanMaxSampleSize.GetControl().GetIhave()), maxSampleSize)
 
 		from := unittest.PeerIdFixture(t)
+		idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Twice()
 		require.NoError(t, inspector.Inspect(from, iHavesGreaterThanMaxSampleSize))
 		require.NoError(t, inspector.Inspect(from, iHavesLessThanMaxSampleSize))
 		require.Eventually(t, func() bool {
@@ -184,13 +190,13 @@ func TestControlMessageValidationInspector_truncateRPC(t *testing.T) {
 
 	t.Run("ihave message ids truncation", func(t *testing.T) {
 		maxMessageIDSampleSize := 1000
-		inspector, signalerCtx, cancel, distributor, rpcTracker, _, _, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+		inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
 			params.Config.IHave.MessageIdCountThreshold = maxMessageIDSampleSize
 		})
 		// topic validation is ignored set any topic oracle
 		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 		rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Maybe()
-		distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Twice()
+		consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Maybe()
 		inspector.Start(signalerCtx)
 		unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
@@ -199,6 +205,7 @@ func TestControlMessageValidationInspector_truncateRPC(t *testing.T) {
 		iHavesLessThanMaxSampleSize := unittest.P2PRPCFixture(unittest.WithIHaves(unittest.P2PRPCIHaveFixtures(50, unittest.IdentifierListFixture(10).Strings()...)...))
 
 		from := unittest.PeerIdFixture(t)
+		idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Twice()
 		require.NoError(t, inspector.Inspect(from, iHavesGreaterThanMaxSampleSize))
 		require.NoError(t, inspector.Inspect(from, iHavesLessThanMaxSampleSize))
 		require.Eventually(t, func() bool {
@@ -222,13 +229,13 @@ func TestControlMessageValidationInspector_truncateRPC(t *testing.T) {
 
 	t.Run("iwant message truncation", func(t *testing.T) {
 		maxSampleSize := uint(100)
-		inspector, signalerCtx, cancel, distributor, rpcTracker, _, _, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+		inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
 			params.Config.IWant.MessageCountThreshold = maxSampleSize
 		})
 		// topic validation is ignored set any topic oracle
 		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 		rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Maybe()
-		distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Maybe()
+		consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Maybe()
 		inspector.Start(signalerCtx)
 		unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
@@ -238,6 +245,7 @@ func TestControlMessageValidationInspector_truncateRPC(t *testing.T) {
 		require.Less(t, uint(len(iWantsLessThanMaxSampleSize.GetControl().GetIwant())), maxSampleSize)
 
 		from := unittest.PeerIdFixture(t)
+		idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Twice()
 		require.NoError(t, inspector.Inspect(from, iWantsGreaterThanMaxSampleSize))
 		require.NoError(t, inspector.Inspect(from, iWantsLessThanMaxSampleSize))
 		require.Eventually(t, func() bool {
@@ -253,13 +261,13 @@ func TestControlMessageValidationInspector_truncateRPC(t *testing.T) {
 
 	t.Run("iwant message id truncation", func(t *testing.T) {
 		maxMessageIDSampleSize := 1000
-		inspector, signalerCtx, cancel, distributor, rpcTracker, _, _, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+		inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
 			params.Config.IWant.MessageIdCountThreshold = maxMessageIDSampleSize
 		})
 		// topic validation is ignored set any topic oracle
 		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 		rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Maybe()
-		distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Maybe()
+		consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Maybe()
 		inspector.Start(signalerCtx)
 		unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
@@ -267,6 +275,7 @@ func TestControlMessageValidationInspector_truncateRPC(t *testing.T) {
 		iWantsLessThanMaxSampleSize := unittest.P2PRPCFixture(unittest.WithIWants(unittest.P2PRPCIWantFixtures(10, 50)...))
 
 		from := unittest.PeerIdFixture(t)
+		idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Twice()
 		require.NoError(t, inspector.Inspect(from, iWantsGreaterThanMaxSampleSize))
 		require.NoError(t, inspector.Inspect(from, iWantsLessThanMaxSampleSize))
 		require.Eventually(t, func() bool {
@@ -291,8 +300,12 @@ func TestControlMessageValidationInspector_truncateRPC(t *testing.T) {
 
 // TestControlMessageInspection_ValidRpc ensures inspector does not disseminate invalid control message notifications for a valid RPC.
 func TestControlMessageInspection_ValidRpc(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, rpcTracker, sporkID, _, topicProviderOracle := inspectorFixture(t)
-	defer distributor.AssertNotCalled(t, "Distribute")
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
+	defer consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification")
 
 	topics := []string{
 		fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID),
@@ -332,32 +345,99 @@ func TestControlMessageInspection_ValidRpc(t *testing.T) {
 	})
 
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
 	require.NoError(t, inspector.Inspect(from, rpc))
-	// sleep for 1 second to ensure rpc is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
-// TestGraftInspection_InvalidTopic ensures inspector disseminates an invalid control message notification for
-// graft messages when the topic is invalid.
-func TestGraftInspection_InvalidTopic(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, topicProviderOracle := inspectorFixture(t)
-	// create unknown topic
-	unknownTopic, malformedTopic, invalidSporkIDTopic := invalidTopics(t, sporkID)
+// TestGraftInspection_InvalidTopic_BelowThreshold ensures inspector does not disseminate an invalid control message notification for
+// graft messages when the invalid topic id count does not exceed the configured threshold.
+func TestGraftInspection_InvalidTopic_BelowThreshold(t *testing.T) {
+	c, err := config.DefaultConfig()
+	require.NoError(t, err)
+	cfg := &c.NetworkConfig.GossipSub.RpcInspector.Validation
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
+
+	var unknownTopicGrafts []*pubsub_pb.ControlGraft
+	var malformedTopicGrafts []*pubsub_pb.ControlGraft
+	var invalidSporkIDTopicGrafts []*pubsub_pb.ControlGraft
+	var allTopics []string
+	for i := 0; i < cfg.GraftPrune.InvalidTopicIdThreshold; i++ {
+		// create unknown topic
+		unknownTopic, malformedTopic, invalidSporkIDTopic := invalidTopics(t, sporkID)
+		allTopics = append(allTopics, unknownTopic, malformedTopic, invalidSporkIDTopic)
+		unknownTopicGrafts = append(unknownTopicGrafts, unittest.P2PRPCGraftFixture(&unknownTopic))
+		malformedTopicGrafts = append(malformedTopicGrafts, unittest.P2PRPCGraftFixture(&malformedTopic))
+		invalidSporkIDTopicGrafts = append(invalidSporkIDTopicGrafts, unittest.P2PRPCGraftFixture(&invalidSporkIDTopic))
+	}
 	// avoid unknown topics errors
-	topicProviderOracle.UpdateTopics([]string{unknownTopic, malformedTopic, invalidSporkIDTopic})
-	unknownTopicGraft := unittest.P2PRPCGraftFixture(&unknownTopic)
-	malformedTopicGraft := unittest.P2PRPCGraftFixture(&malformedTopic)
-	invalidSporkIDTopicGraft := unittest.P2PRPCGraftFixture(&invalidSporkIDTopic)
+	topicProviderOracle.UpdateTopics(allTopics)
+	unknownTopicReq := unittest.P2PRPCFixture(unittest.WithGrafts(unknownTopicGrafts...))
+	malformedTopicReq := unittest.P2PRPCFixture(unittest.WithGrafts(malformedTopicGrafts...))
+	invalidSporkIDTopicReq := unittest.P2PRPCFixture(unittest.WithGrafts(invalidSporkIDTopicGrafts...))
+
+	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Times(3)
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+	consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
+	inspector.Start(signalerCtx)
+	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
+
+	require.NoError(t, inspector.Inspect(from, unknownTopicReq))
+	require.NoError(t, inspector.Inspect(from, malformedTopicReq))
+	require.NoError(t, inspector.Inspect(from, invalidSporkIDTopicReq))
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 3
+	}, time.Second, 500*time.Millisecond)
+	cancel()
+	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
+}
 
-	unknownTopicReq := unittest.P2PRPCFixture(unittest.WithGrafts(unknownTopicGraft))
-	malformedTopicReq := unittest.P2PRPCFixture(unittest.WithGrafts(malformedTopicGraft))
-	invalidSporkIDTopicReq := unittest.P2PRPCFixture(unittest.WithGrafts(invalidSporkIDTopicGraft))
+// TestGraftInspection_InvalidTopic_AboveThreshold ensures inspector disseminates an invalid control message notification for
+// graft messages when the invalid topic id count exceeds the configured threshold.
+func TestGraftInspection_InvalidTopic_AboveThreshold(t *testing.T) {
+	c, err := config.DefaultConfig()
+	require.NoError(t, err)
+	cfg := &c.NetworkConfig.GossipSub.RpcInspector.Validation
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Config = cfg
+		params.Logger = logger
+	})
+
+	var unknownTopicGrafts []*pubsub_pb.ControlGraft
+	var malformedTopicGrafts []*pubsub_pb.ControlGraft
+	var invalidSporkIDTopicGrafts []*pubsub_pb.ControlGraft
+	var allTopics []string
+	for i := 0; i < cfg.GraftPrune.InvalidTopicIdThreshold+1; i++ {
+		// create unknown topic
+		unknownTopic, malformedTopic, invalidSporkIDTopic := invalidTopics(t, sporkID)
+		allTopics = append(allTopics, unknownTopic, malformedTopic, invalidSporkIDTopic)
+		unknownTopicGrafts = append(unknownTopicGrafts, unittest.P2PRPCGraftFixture(&unknownTopic))
+		malformedTopicGrafts = append(malformedTopicGrafts, unittest.P2PRPCGraftFixture(&malformedTopic))
+		invalidSporkIDTopicGrafts = append(invalidSporkIDTopicGrafts, unittest.P2PRPCGraftFixture(&invalidSporkIDTopic))
+	}
+
+	// avoid unknown topics errors
+	topicProviderOracle.UpdateTopics(allTopics)
+	unknownTopicReq := unittest.P2PRPCFixture(unittest.WithGrafts(unknownTopicGrafts...))
+	malformedTopicReq := unittest.P2PRPCFixture(unittest.WithGrafts(malformedTopicGrafts...))
+	invalidSporkIDTopicReq := unittest.P2PRPCFixture(unittest.WithGrafts(invalidSporkIDTopicGrafts...))
 
 	from := unittest.PeerIdFixture(t)
-	checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgGraft, channels.IsInvalidTopicErr, p2p.CtrlMsgNonClusterTopicType)
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Times(3).Run(checkNotification)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Times(3)
+	checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgGraft, validation.IsInvalidTopicIDThresholdExceeded, p2p.CtrlMsgNonClusterTopicType)
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Times(3).Run(checkNotification)
 
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
@@ -365,8 +445,9 @@ func TestGraftInspection_InvalidTopic(t *testing.T) {
 	require.NoError(t, inspector.Inspect(from, unknownTopicReq))
 	require.NoError(t, inspector.Inspect(from, malformedTopicReq))
 	require.NoError(t, inspector.Inspect(from, invalidSporkIDTopicReq))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 3
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
@@ -374,7 +455,11 @@ func TestGraftInspection_InvalidTopic(t *testing.T) {
 // TestGraftInspection_DuplicateTopicIds_BelowThreshold ensures inspector does not disseminate invalid control message notifications
 // for a valid RPC with duplicate graft topic ids below the threshold.
 func TestGraftInspection_DuplicateTopicIds_BelowThreshold(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, topicProviderOracle := inspectorFixture(t)
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
 	duplicateTopic := fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID)
 	// avoid unknown topics errors
 	topicProviderOracle.UpdateTopics([]string{duplicateTopic})
@@ -385,22 +470,29 @@ func TestGraftInspection_DuplicateTopicIds_BelowThreshold(t *testing.T) {
 		grafts = append(grafts, unittest.P2PRPCGraftFixture(&duplicateTopic))
 	}
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
 	rpc := unittest.P2PRPCFixture(unittest.WithGrafts(grafts...))
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 	// no notification should be disseminated for valid messages as long as the number of duplicates is below the threshold
-	distributor.AssertNotCalled(t, "Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
+	consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
 
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 100*time.Millisecond, inspector)
 
 	require.NoError(t, inspector.Inspect(from, rpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
 func TestGraftInspection_DuplicateTopicIds_AboveThreshold(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, topicProviderOracle := inspectorFixture(t)
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
 	duplicateTopic := fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID)
 	// avoid unknown topics errors
 	topicProviderOracle.UpdateTopics([]string{duplicateTopic})
@@ -411,20 +503,119 @@ func TestGraftInspection_DuplicateTopicIds_AboveThreshold(t *testing.T) {
 		grafts = append(grafts, unittest.P2PRPCGraftFixture(&duplicateTopic))
 	}
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
 	rpc := unittest.P2PRPCFixture(unittest.WithGrafts(grafts...))
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(func(args mock.Arguments) {
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(func(args mock.Arguments) {
 		notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
 		require.True(t, ok)
 		require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType, "expected p2p.CtrlMsgNonClusterTopicType notification type, no RPC with cluster prefixed topic sent in this test")
 		require.Equal(t, from, notification.PeerID)
 		require.Equal(t, p2pmsg.CtrlMsgGraft, notification.MsgType)
-		require.True(t, validation.IsDuplicateTopicErr(notification.Error))
+		require.True(t, validation.IsDuplicateTopicIDThresholdExceeded(notification.Error))
 	})
 
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 100*time.Millisecond, inspector)
 
 	require.NoError(t, inspector.Inspect(from, rpc))
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
+	cancel()
+	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
+}
+
+// TestPruneInspection_InvalidTopic_BelowThreshold ensures inspector does not disseminate an invalid control message notification for
+// prune messages when the invalid topic id count does not exceed the configured threshold.
+func TestPruneInspection_InvalidTopic_BelowThreshold(t *testing.T) {
+	c, err := config.DefaultConfig()
+	require.NoError(t, err)
+	cfg := &c.NetworkConfig.GossipSub.RpcInspector.Validation
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Config = cfg
+	})
+
+	var unknownTopicPrunes []*pubsub_pb.ControlPrune
+	var malformedTopicPrunes []*pubsub_pb.ControlPrune
+	var invalidSporkIDTopicPrunes []*pubsub_pb.ControlPrune
+	var allTopics []string
+	for i := 0; i < cfg.GraftPrune.InvalidTopicIdThreshold; i++ {
+		// create unknown topic
+		unknownTopic, malformedTopic, invalidSporkIDTopic := invalidTopics(t, sporkID)
+		allTopics = append(allTopics, unknownTopic, malformedTopic, invalidSporkIDTopic)
+		unknownTopicPrunes = append(unknownTopicPrunes, unittest.P2PRPCPruneFixture(&unknownTopic))
+		malformedTopicPrunes = append(malformedTopicPrunes, unittest.P2PRPCPruneFixture(&malformedTopic))
+		invalidSporkIDTopicPrunes = append(invalidSporkIDTopicPrunes, unittest.P2PRPCPruneFixture(&invalidSporkIDTopic))
+	}
+
+	// avoid unknown topics errors
+	topicProviderOracle.UpdateTopics(allTopics)
+	unknownTopicReq := unittest.P2PRPCFixture(unittest.WithPrunes(unknownTopicPrunes...))
+	malformedTopicReq := unittest.P2PRPCFixture(unittest.WithPrunes(malformedTopicPrunes...))
+	invalidSporkIDTopicReq := unittest.P2PRPCFixture(unittest.WithPrunes(invalidSporkIDTopicPrunes...))
+
+	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Times(3)
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+	// no notification should be disseminated for valid messages as long as the number of invalid topic ids is below the threshold
+	consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
+	inspector.Start(signalerCtx)
+	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
+
+	require.NoError(t, inspector.Inspect(from, unknownTopicReq))
+	require.NoError(t, inspector.Inspect(from, malformedTopicReq))
+	require.NoError(t, inspector.Inspect(from, invalidSporkIDTopicReq))
+
+	// sleep for 1 second to ensure rpc's is processed
+	time.Sleep(2 * time.Second)
+	cancel()
+	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
+}
+
+// TestPruneInspection_InvalidTopic_AboveThreshold ensures inspector disseminates an invalid control message notification for
+// prune messages when the invalid topic id count exceeds the configured threshold.
+func TestPruneInspection_InvalidTopic_AboveThreshold(t *testing.T) {
+	c, err := config.DefaultConfig()
+	require.NoError(t, err)
+	cfg := &c.NetworkConfig.GossipSub.RpcInspector.Validation
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Config = cfg
+	})
+
+	var unknownTopicPrunes []*pubsub_pb.ControlPrune
+	var malformedTopicPrunes []*pubsub_pb.ControlPrune
+	var invalidSporkIDTopicPrunes []*pubsub_pb.ControlPrune
+	var allTopics []string
+	for i := 0; i < cfg.GraftPrune.InvalidTopicIdThreshold+1; i++ {
+		// create unknown topic
+		unknownTopic, malformedTopic, invalidSporkIDTopic := invalidTopics(t, sporkID)
+		allTopics = append(allTopics, unknownTopic, malformedTopic, invalidSporkIDTopic)
+		unknownTopicPrunes = append(unknownTopicPrunes, unittest.P2PRPCPruneFixture(&unknownTopic))
+		malformedTopicPrunes = append(malformedTopicPrunes, unittest.P2PRPCPruneFixture(&malformedTopic))
+		invalidSporkIDTopicPrunes = append(invalidSporkIDTopicPrunes, unittest.P2PRPCPruneFixture(&invalidSporkIDTopic))
+	}
+
+	// avoid unknown topics errors
+	topicProviderOracle.UpdateTopics(allTopics)
+	unknownTopicReq := unittest.P2PRPCFixture(unittest.WithPrunes(unknownTopicPrunes...))
+	malformedTopicReq := unittest.P2PRPCFixture(unittest.WithPrunes(malformedTopicPrunes...))
+	invalidSporkIDTopicReq := unittest.P2PRPCFixture(unittest.WithPrunes(invalidSporkIDTopicPrunes...))
+
+	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Times(3)
+	checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgPrune, validation.IsInvalidTopicIDThresholdExceeded, p2p.CtrlMsgNonClusterTopicType)
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Times(3).Run(checkNotification)
+
+	inspector.Start(signalerCtx)
+	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
+
+	require.NoError(t, inspector.Inspect(from, unknownTopicReq))
+	require.NoError(t, inspector.Inspect(from, malformedTopicReq))
+	require.NoError(t, inspector.Inspect(from, invalidSporkIDTopicReq))
+
 	// sleep for 1 second to ensure rpc's is processed
 	time.Sleep(time.Second)
 	cancel()
@@ -434,7 +625,11 @@ func TestGraftInspection_DuplicateTopicIds_AboveThreshold(t *testing.T) {
 // TestPruneInspection_DuplicateTopicIds_AboveThreshold ensures inspector disseminates an invalid control message notification for
 // prune messages when the number of duplicate topic ids is above the threshold.
 func TestPruneInspection_DuplicateTopicIds_AboveThreshold(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, topicProviderOracle := inspectorFixture(t)
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
 	duplicateTopic := fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID)
 	// avoid unknown topics errors
 	topicProviderOracle.UpdateTopics([]string{duplicateTopic})
@@ -446,22 +641,26 @@ func TestPruneInspection_DuplicateTopicIds_AboveThreshold(t *testing.T) {
 		prunes = append(prunes, unittest.P2PRPCPruneFixture(&duplicateTopic))
 	}
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
 	rpc := unittest.P2PRPCFixture(unittest.WithPrunes(prunes...))
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(func(args mock.Arguments) {
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(func(args mock.Arguments) {
 		notification, ok := args[0].(*p2p.InvCtrlMsgNotif)
 		require.True(t, ok)
 		require.Equal(t, notification.TopicType, p2p.CtrlMsgNonClusterTopicType, "expected p2p.CtrlMsgNonClusterTopicType notification type, no RPC with cluster prefixed topic sent in this test")
 		require.Equal(t, from, notification.PeerID)
 		require.Equal(t, p2pmsg.CtrlMsgPrune, notification.MsgType)
-		require.True(t, validation.IsDuplicateTopicErr(notification.Error))
+		require.True(t, validation.IsDuplicateTopicIDThresholdExceeded(notification.Error))
 	})
 
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 100*time.Millisecond, inspector)
 
 	require.NoError(t, inspector.Inspect(from, rpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
@@ -469,7 +668,11 @@ func TestPruneInspection_DuplicateTopicIds_AboveThreshold(t *testing.T) {
 // TestPruneInspection_DuplicateTopicIds_BelowThreshold ensures inspector does not disseminate invalid control message notifications
 // for a valid RPC with duplicate prune topic ids below the threshold.
 func TestPrueInspection_DuplicateTopicIds_BelowThreshold(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, topicProviderOracle := inspectorFixture(t)
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
 	duplicateTopic := fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID)
 	// avoid unknown topics errors
 	topicProviderOracle.UpdateTopics([]string{duplicateTopic})
@@ -480,78 +683,121 @@ func TestPrueInspection_DuplicateTopicIds_BelowThreshold(t *testing.T) {
 		prunes = append(prunes, unittest.P2PRPCPruneFixture(&duplicateTopic))
 	}
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
 	rpc := unittest.P2PRPCFixture(unittest.WithPrunes(prunes...))
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+
 	// no notification should be disseminated for valid messages as long as the number of duplicates is below the threshold
-	distributor.AssertNotCalled(t, "Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
+	consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
 
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 100*time.Millisecond, inspector)
 
 	require.NoError(t, inspector.Inspect(from, rpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
-// TestPruneInspection_InvalidTopic ensures inspector disseminates an invalid control message notification for
-// prune messages when the topic is invalid.
-func TestPruneInspection_InvalidTopic(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, topicProviderOracle := inspectorFixture(t)
-	// create unknown topic
-	unknownTopic, malformedTopic, invalidSporkIDTopic := invalidTopics(t, sporkID)
-	unknownTopicPrune := unittest.P2PRPCPruneFixture(&unknownTopic)
-	malformedTopicPrune := unittest.P2PRPCPruneFixture(&malformedTopic)
-	invalidSporkIDTopicPrune := unittest.P2PRPCPruneFixture(&invalidSporkIDTopic)
+// TestIHaveInspection_InvalidTopic_AboveThreshold ensures inspector disseminates an invalid control message notification for
+// ihave messages when the invalid topic id count exceeds the configured threshold.
+func TestIHaveInspection_InvalidTopic_AboveThreshold(t *testing.T) {
+	c, err := config.DefaultConfig()
+	require.NoError(t, err)
+	cfg := &c.NetworkConfig.GossipSub.RpcInspector.Validation
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Config = cfg
+		params.Logger = logger
+	})
+
+	var unknownTopicIHaves []*pubsub_pb.ControlIHave
+	var malformedTopicIHaves []*pubsub_pb.ControlIHave
+	var invalidSporkIDTopicIHaves []*pubsub_pb.ControlIHave
+	var allTopics []string
+	for i := 0; i < cfg.GraftPrune.InvalidTopicIdThreshold+1; i++ {
+		// create unknown topic
+		unknownTopic, malformedTopic, invalidSporkIDTopic := invalidTopics(t, sporkID)
+		allTopics = append(allTopics, unknownTopic, malformedTopic, invalidSporkIDTopic)
+		unknownTopicIHaves = append(unknownTopicIHaves, unittest.P2PRPCIHaveFixture(&unknownTopic, unittest.IdentifierListFixture(5).Strings()...))
+		malformedTopicIHaves = append(malformedTopicIHaves, unittest.P2PRPCIHaveFixture(&malformedTopic, unittest.IdentifierListFixture(5).Strings()...))
+		invalidSporkIDTopicIHaves = append(invalidSporkIDTopicIHaves, unittest.P2PRPCIHaveFixture(&invalidSporkIDTopic, unittest.IdentifierListFixture(5).Strings()...))
+	}
+
 	// avoid unknown topics errors
-	topicProviderOracle.UpdateTopics([]string{unknownTopic, malformedTopic, invalidSporkIDTopic})
-	unknownTopicRpc := unittest.P2PRPCFixture(unittest.WithPrunes(unknownTopicPrune))
-	malformedTopicRpc := unittest.P2PRPCFixture(unittest.WithPrunes(malformedTopicPrune))
-	invalidSporkIDTopicRpc := unittest.P2PRPCFixture(unittest.WithPrunes(invalidSporkIDTopicPrune))
+	topicProviderOracle.UpdateTopics(allTopics)
+	unknownTopicReq := unittest.P2PRPCFixture(unittest.WithIHaves(unknownTopicIHaves...))
+	malformedTopicReq := unittest.P2PRPCFixture(unittest.WithIHaves(malformedTopicIHaves...))
+	invalidSporkIDTopicReq := unittest.P2PRPCFixture(unittest.WithIHaves(invalidSporkIDTopicIHaves...))
 
 	from := unittest.PeerIdFixture(t)
-	checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgPrune, channels.IsInvalidTopicErr, p2p.CtrlMsgNonClusterTopicType)
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Times(3).Run(checkNotification)
-
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Times(3)
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+	checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgIHave, validation.IsInvalidTopicIDThresholdExceeded, p2p.CtrlMsgNonClusterTopicType)
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Times(3).Run(checkNotification)
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
-	require.NoError(t, inspector.Inspect(from, unknownTopicRpc))
-	require.NoError(t, inspector.Inspect(from, malformedTopicRpc))
-	require.NoError(t, inspector.Inspect(from, invalidSporkIDTopicRpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.NoError(t, inspector.Inspect(from, unknownTopicReq))
+	require.NoError(t, inspector.Inspect(from, malformedTopicReq))
+	require.NoError(t, inspector.Inspect(from, invalidSporkIDTopicReq))
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 3
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
-// TestIHaveInspection_InvalidTopic ensures inspector disseminates an invalid control message notification for
-// iHave messages when the topic is invalid.
-func TestIHaveInspection_InvalidTopic(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, topicProviderOracle := inspectorFixture(t)
-	// create unknown topic
-	unknownTopic, malformedTopic, invalidSporkIDTopic := invalidTopics(t, sporkID)
-	// avoid unknown topics errors
-	topicProviderOracle.UpdateTopics([]string{unknownTopic, malformedTopic, invalidSporkIDTopic})
-	unknownTopicIhave := unittest.P2PRPCIHaveFixture(&unknownTopic, unittest.IdentifierListFixture(5).Strings()...)
-	malformedTopicIhave := unittest.P2PRPCIHaveFixture(&malformedTopic, unittest.IdentifierListFixture(5).Strings()...)
-	invalidSporkIDTopicIhave := unittest.P2PRPCIHaveFixture(&invalidSporkIDTopic, unittest.IdentifierListFixture(5).Strings()...)
+// TestIHaveInspection_InvalidTopic_BelowThreshold ensures inspector does not disseminate an invalid control message notification for
+// ihave messages when the invalid topic id count does not exceed the configured threshold.
+func TestIHaveInspection_InvalidTopic_BelowThreshold(t *testing.T) {
+	c, err := config.DefaultConfig()
+	require.NoError(t, err)
+	cfg := &c.NetworkConfig.GossipSub.RpcInspector.Validation
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Config = cfg
+		params.Logger = logger
+	})
+
+	var unknownTopicIHaves []*pubsub_pb.ControlIHave
+	var malformedTopicIHaves []*pubsub_pb.ControlIHave
+	var invalidSporkIDTopicIHaves []*pubsub_pb.ControlIHave
+	var allTopics []string
+	for i := 0; i < cfg.GraftPrune.InvalidTopicIdThreshold; i++ {
+		// create unknown topic
+		unknownTopic, malformedTopic, invalidSporkIDTopic := invalidTopics(t, sporkID)
+		allTopics = append(allTopics, unknownTopic, malformedTopic, invalidSporkIDTopic)
+		unknownTopicIHaves = append(unknownTopicIHaves, unittest.P2PRPCIHaveFixture(&unknownTopic, unittest.IdentifierListFixture(5).Strings()...))
+		malformedTopicIHaves = append(malformedTopicIHaves, unittest.P2PRPCIHaveFixture(&malformedTopic, unittest.IdentifierListFixture(5).Strings()...))
+		invalidSporkIDTopicIHaves = append(invalidSporkIDTopicIHaves, unittest.P2PRPCIHaveFixture(&invalidSporkIDTopic, unittest.IdentifierListFixture(5).Strings()...))
+	}
 
-	unknownTopicRpc := unittest.P2PRPCFixture(unittest.WithIHaves(unknownTopicIhave))
-	malformedTopicRpc := unittest.P2PRPCFixture(unittest.WithIHaves(malformedTopicIhave))
-	invalidSporkIDTopicRpc := unittest.P2PRPCFixture(unittest.WithIHaves(invalidSporkIDTopicIhave))
+	// avoid unknown topics errors
+	topicProviderOracle.UpdateTopics(allTopics)
+	unknownTopicReq := unittest.P2PRPCFixture(unittest.WithIHaves(unknownTopicIHaves...))
+	malformedTopicReq := unittest.P2PRPCFixture(unittest.WithIHaves(malformedTopicIHaves...))
+	invalidSporkIDTopicReq := unittest.P2PRPCFixture(unittest.WithIHaves(invalidSporkIDTopicIHaves...))
 
 	from := unittest.PeerIdFixture(t)
-	checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgIHave, channels.IsInvalidTopicErr, p2p.CtrlMsgNonClusterTopicType)
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Times(3).Run(checkNotification)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Times(3)
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+	// no notification should be disseminated for valid messages as long as the number of invalid topic ids is below the threshold
+	consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
-	require.NoError(t, inspector.Inspect(from, unknownTopicRpc))
-	require.NoError(t, inspector.Inspect(from, malformedTopicRpc))
-	require.NoError(t, inspector.Inspect(from, invalidSporkIDTopicRpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.NoError(t, inspector.Inspect(from, unknownTopicReq))
+	require.NoError(t, inspector.Inspect(from, malformedTopicReq))
+	require.NoError(t, inspector.Inspect(from, invalidSporkIDTopicReq))
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 3
+	}, time.Second, 500*time.Millisecond)
+
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
@@ -559,7 +805,11 @@ func TestIHaveInspection_InvalidTopic(t *testing.T) {
 // TestIHaveInspection_DuplicateTopicIds_BelowThreshold ensures inspector does not disseminate an invalid control message notification for
 // iHave messages when duplicate topic ids are below allowed threshold.
 func TestIHaveInspection_DuplicateTopicIds_BelowThreshold(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, topicProviderOracle := inspectorFixture(t)
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
 	validTopic := fmt.Sprintf("%s/%s", channels.PushBlocks.String(), sporkID)
 	// avoid unknown topics errors
 	topicProviderOracle.UpdateTopics([]string{validTopic})
@@ -575,15 +825,18 @@ func TestIHaveInspection_DuplicateTopicIds_BelowThreshold(t *testing.T) {
 	// creates an RPC with duplicate topic ids but different message ids
 	duplicateMsgIDRpc := unittest.P2PRPCFixture(unittest.WithIHaves(ihaves...))
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 
 	// no notification should be disseminated for valid messages as long as the number of duplicates is below the threshold
-	distributor.AssertNotCalled(t, "Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
+	consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 	require.NoError(t, inspector.Inspect(from, duplicateMsgIDRpc))
-	// TODO: this sleeps should be replaced with a queue size checker.
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
@@ -591,7 +844,11 @@ func TestIHaveInspection_DuplicateTopicIds_BelowThreshold(t *testing.T) {
 // TestIHaveInspection_DuplicateTopicIds_AboveThreshold ensures inspector disseminate an invalid control message notification for
 // iHave messages when duplicate topic ids are above allowed threshold.
 func TestIHaveInspection_DuplicateTopicIds_AboveThreshold(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, topicProviderOracle := inspectorFixture(t)
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
 	validTopic := fmt.Sprintf("%s/%s", channels.PushBlocks.String(), sporkID)
 	// avoid unknown topics errors
 	topicProviderOracle.UpdateTopics([]string{validTopic})
@@ -607,16 +864,20 @@ func TestIHaveInspection_DuplicateTopicIds_AboveThreshold(t *testing.T) {
 	// creates an RPC with duplicate topic ids but different message ids
 	duplicateMsgIDRpc := unittest.P2PRPCFixture(unittest.WithIHaves(ihaves...))
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 
 	// one notification should be disseminated for invalid messages when the number of duplicates exceeds the threshold
-	checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgIHave, validation.IsDuplicateTopicErr, p2p.CtrlMsgNonClusterTopicType)
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
+	checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgIHave, validation.IsDuplicateTopicIDThresholdExceeded, p2p.CtrlMsgNonClusterTopicType)
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
+
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 	require.NoError(t, inspector.Inspect(from, duplicateMsgIDRpc))
-	// TODO: this sleeps should be replaced with a queue size checker.
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
@@ -624,7 +885,11 @@ func TestIHaveInspection_DuplicateTopicIds_AboveThreshold(t *testing.T) {
 // TestIHaveInspection_DuplicateMessageIds_BelowThreshold ensures inspector does not disseminate an invalid control message notification for
 // iHave messages when duplicate message ids are below allowed threshold.
 func TestIHaveInspection_DuplicateMessageIds_BelowThreshold(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, topicProviderOracle := inspectorFixture(t)
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
 	validTopic := fmt.Sprintf("%s/%s", channels.PushBlocks.String(), sporkID)
 	// avoid unknown topics errors
 	topicProviderOracle.UpdateTopics([]string{validTopic})
@@ -640,15 +905,18 @@ func TestIHaveInspection_DuplicateMessageIds_BelowThreshold(t *testing.T) {
 	duplicateMsgIDIHave := unittest.P2PRPCIHaveFixture(&validTopic, append(msgIds, unittest.IdentifierListFixture(5)...).Strings()...)
 	duplicateMsgIDRpc := unittest.P2PRPCFixture(unittest.WithIHaves(duplicateMsgIDIHave))
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 
 	// no notification should be disseminated for valid messages as long as the number of duplicates is below the threshold
-	distributor.AssertNotCalled(t, "Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
+	consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 	require.NoError(t, inspector.Inspect(from, duplicateMsgIDRpc))
-	// TODO: this sleeps should be replaced with a queue size checker.
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
@@ -656,7 +924,11 @@ func TestIHaveInspection_DuplicateMessageIds_BelowThreshold(t *testing.T) {
 // TestIHaveInspection_DuplicateMessageIds_AboveThreshold ensures inspector disseminates an invalid control message notification for
 // iHave messages when duplicate message ids are above allowed threshold.
 func TestIHaveInspection_DuplicateMessageIds_AboveThreshold(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, topicProviderOracle := inspectorFixture(t)
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
 	validTopic := fmt.Sprintf("%s/%s", channels.PushBlocks.String(), sporkID)
 	// avoid unknown topics errors
 	topicProviderOracle.UpdateTopics([]string{validTopic})
@@ -672,16 +944,19 @@ func TestIHaveInspection_DuplicateMessageIds_AboveThreshold(t *testing.T) {
 	duplicateMsgIDIHave := unittest.P2PRPCIHaveFixture(&validTopic, append(msgIds, unittest.IdentifierListFixture(5)...).Strings()...)
 	duplicateMsgIDRpc := unittest.P2PRPCFixture(unittest.WithIHaves(duplicateMsgIDIHave))
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 
 	// one notification should be disseminated for invalid messages when the number of duplicates exceeds the threshold
 	checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgIHave, validation.IsDuplicateMessageIDErr, p2p.CtrlMsgNonClusterTopicType)
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 	require.NoError(t, inspector.Inspect(from, duplicateMsgIDRpc))
-	// TODO: this sleeps should be replaced with a queue size checker.
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
@@ -689,7 +964,11 @@ func TestIHaveInspection_DuplicateMessageIds_AboveThreshold(t *testing.T) {
 // TestIWantInspection_DuplicateMessageIds_BelowThreshold ensures inspector does not disseminate an invalid control message notification for
 // iWant messages when duplicate message ids are below allowed threshold.
 func TestIWantInspection_DuplicateMessageIds_BelowThreshold(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, rpcTracker, _, _, _ := inspectorFixture(t)
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
 	// oracle must be set even though iWant messages do not have topic IDs
 	duplicateMsgID := unittest.IdentifierFixture()
 	duplicates := flow.IdentifierList{}
@@ -705,7 +984,9 @@ func TestIWantInspection_DuplicateMessageIds_BelowThreshold(t *testing.T) {
 	duplicateMsgIDRpc := unittest.P2PRPCFixture(unittest.WithIWants(duplicateMsgIDIWant))
 
 	from := unittest.PeerIdFixture(t)
-	distributor.AssertNotCalled(t, "Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
+	// no notification should be disseminated for valid messages as long as the number of duplicates is below the threshold
+	consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif"))
 	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 	rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Run(func(args mock.Arguments) {
 		id, ok := args[0].(string)
@@ -717,15 +998,20 @@ func TestIWantInspection_DuplicateMessageIds_BelowThreshold(t *testing.T) {
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 	require.NoError(t, inspector.Inspect(from, duplicateMsgIDRpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
 // TestIWantInspection_DuplicateMessageIds_AboveThreshold ensures inspector disseminates invalid control message notifications for iWant messages when duplicate message ids exceeds allowed threshold.
 func TestIWantInspection_DuplicateMessageIds_AboveThreshold(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, rpcTracker, _, _, _ := inspectorFixture(t)
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
 	// oracle must be set even though iWant messages do not have topic IDs
 	duplicateMsgID := unittest.IdentifierFixture()
 	duplicates := flow.IdentifierList{}
@@ -741,8 +1027,9 @@ func TestIWantInspection_DuplicateMessageIds_AboveThreshold(t *testing.T) {
 	duplicateMsgIDRpc := unittest.P2PRPCFixture(unittest.WithIWants(duplicateMsgIDIWant))
 
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
 	checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgIWant, validation.IsIWantDuplicateMsgIDThresholdErr, p2p.CtrlMsgNonClusterTopicType)
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
 	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 	rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Run(func(args mock.Arguments) {
 		id, ok := args[0].(string)
@@ -754,24 +1041,29 @@ func TestIWantInspection_DuplicateMessageIds_AboveThreshold(t *testing.T) {
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 	require.NoError(t, inspector.Inspect(from, duplicateMsgIDRpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
 // TestIWantInspection_CacheMiss_AboveThreshold ensures inspector disseminates invalid control message notifications for iWant messages when cache misses exceeds allowed threshold.
 func TestIWantInspection_CacheMiss_AboveThreshold(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, rpcTracker, _, _, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
 		// set high cache miss threshold to ensure we only disseminate notification when it is exceeded
 		params.Config.IWant.CacheMissThreshold = 900
+		params.Logger = logger
 	})
 	// 10 iwant messages, each with 100 message ids; total of 1000 message ids, which when imitated as cache misses should trigger notification dissemination.
 	inspectMsgRpc := unittest.P2PRPCFixture(unittest.WithIWants(unittest.P2PRPCIWantFixtures(10, 100)...))
 
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
 	checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgIWant, validation.IsIWantCacheMissThresholdErr, p2p.CtrlMsgNonClusterTopicType)
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
 	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 	// return false each time to eventually force a notification to be disseminated when the cache miss count finally exceeds the 90% threshold
 	allIwantsChecked := sync.WaitGroup{}
@@ -798,19 +1090,23 @@ func TestIWantInspection_CacheMiss_AboveThreshold(t *testing.T) {
 	require.NoError(t, inspector.Inspect(from, inspectMsgRpc))
 	unittest.RequireReturnsBefore(t, allIwantsChecked.Wait, 1*time.Second, "all iwant messages should be checked for cache misses")
 
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
 func TestIWantInspection_CacheMiss_BelowThreshold(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, rpcTracker, _, _, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
 		// set high cache miss threshold to ensure that we do not disseminate notification in this test
 		params.Config.IWant.CacheMissThreshold = 99
+		params.Logger = logger
 	})
 	// oracle must be set even though iWant messages do not have topic IDs
-	defer distributor.AssertNotCalled(t, "Distribute")
+	defer consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification")
 
 	msgIds := unittest.IdentifierListFixture(98).Strings() // one less than cache miss threshold
 	inspectMsgRpc := unittest.P2PRPCFixture(unittest.WithIWants(unittest.P2PRPCIWantFixture(msgIds...)))
@@ -827,23 +1123,28 @@ func TestIWantInspection_CacheMiss_BelowThreshold(t *testing.T) {
 	})
 
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 	require.NoError(t, inspector.Inspect(from, inspectMsgRpc))
 	unittest.RequireReturnsBefore(t, allIwantsChecked.Wait, 1*time.Second, "all iwant messages should be checked for cache misses")
 
-	// waits one more second to ensure no notification is disseminated
-	time.Sleep(1 * time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
 // TestControlMessageInspection_ExceedingErrThreshold ensures inspector disseminates invalid control message notifications for RPCs that exceed the configured error threshold.
 func TestPublishMessageInspection_ExceedingErrThreshold(t *testing.T) {
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
 	errThreshold := 500
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
 		params.Config.PublishMessages.ErrorThreshold = errThreshold
+		params.Logger = logger
 	})
 	// create unknown topic
 	unknownTopic := channels.Topic(fmt.Sprintf("%s/%s", unittest.IdentifierFixture(), sporkID)).String()
@@ -851,13 +1152,14 @@ func TestPublishMessageInspection_ExceedingErrThreshold(t *testing.T) {
 	malformedTopic := channels.Topic("!@#$%^&**((").String()
 	// a topics spork ID is considered invalid if it does not match the current spork ID
 	invalidSporkIDTopic := channels.Topic(fmt.Sprintf("%s/%s", channels.PushBlocks, unittest.IdentifierFixture())).String()
+	publisher := unittest.PeerIdFixture(t)
 	// create 10 normal messages
-	pubsubMsgs := unittest.GossipSubMessageFixtures(50, fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID))
+	pubsubMsgs := unittest.GossipSubMessageFixtures(50, fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID), p2ptest.WithFrom(publisher))
 	// add 550 invalid messages to force notification dissemination
 	invalidMessageFixtures := []*pubsub_pb.Message{
-		{Topic: &unknownTopic},
-		{Topic: &malformedTopic},
-		{Topic: &invalidSporkIDTopic},
+		{Topic: &unknownTopic, From: []byte(publisher)},
+		{Topic: &malformedTopic, From: []byte(publisher)},
+		{Topic: &invalidSporkIDTopic, From: []byte(publisher)},
 	}
 	for i := 0; i < errThreshold+1; i++ {
 		pubsubMsgs = append(pubsubMsgs, invalidMessageFixtures[rand.Intn(len(invalidMessageFixtures))])
@@ -867,71 +1169,96 @@ func TestPublishMessageInspection_ExceedingErrThreshold(t *testing.T) {
 	for i, msg := range pubsubMsgs {
 		topics[i] = *msg.Topic
 	}
+
 	// set topic oracle to return list of topics to avoid hasSubscription errors and force topic validation
 	topicProviderOracle.UpdateTopics(topics)
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true)
+	idProvider.On("ByPeerID", publisher).Return(nil, false)
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+
 	checkNotification := checkNotificationFunc(t, from, p2pmsg.RpcPublishMessage, validation.IsInvalidRpcPublishMessagesErr, p2p.CtrlMsgNonClusterTopicType)
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
 
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 	require.NoError(t, inspector.Inspect(from, rpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
 // TestControlMessageInspection_MissingSubscription ensures inspector disseminates invalid control message notifications for RPCs that the peer is not subscribed to.
 func TestPublishMessageInspection_MissingSubscription(t *testing.T) {
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
 	errThreshold := 500
-	inspector, signalerCtx, cancel, distributor, _, sporkID, _, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
 		params.Config.PublishMessages.ErrorThreshold = errThreshold
+		params.Logger = logger
 	})
-	pubsubMsgs := unittest.GossipSubMessageFixtures(errThreshold+1, fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID))
+	publisher := unittest.PeerIdFixture(t)
+	pubsubMsgs := unittest.GossipSubMessageFixtures(errThreshold+1, fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID), p2ptest.WithFrom(publisher))
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true)
 	rpc := unittest.P2PRPCFixture(unittest.WithPubsubMessages(pubsubMsgs...))
 	checkNotification := checkNotificationFunc(t, from, p2pmsg.RpcPublishMessage, validation.IsInvalidRpcPublishMessagesErr, p2p.CtrlMsgNonClusterTopicType)
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 	require.NoError(t, inspector.Inspect(from, rpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
 // TestPublishMessageInspection_MissingTopic ensures inspector disseminates invalid control message notifications for published messages with missing topics.
 func TestPublishMessageInspection_MissingTopic(t *testing.T) {
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
 	errThreshold := 500
-	inspector, signalerCtx, cancel, distributor, _, _, _, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+	inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
 		// 5 invalid pubsub messages will force notification dissemination
 		params.Config.PublishMessages.ErrorThreshold = errThreshold
+		params.Logger = logger
 	})
-	pubsubMsgs := unittest.GossipSubMessageFixtures(errThreshold+1, "")
+	publisher := unittest.PeerIdFixture(t)
+	pubsubMsgs := unittest.GossipSubMessageFixtures(errThreshold+1, "", p2ptest.WithFrom(publisher))
 	rpc := unittest.P2PRPCFixture(unittest.WithPubsubMessages(pubsubMsgs...))
 	for _, msg := range pubsubMsgs {
 		msg.Topic = nil
 	}
 	from := unittest.PeerIdFixture(t)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true)
 	checkNotification := checkNotificationFunc(t, from, p2pmsg.RpcPublishMessage, validation.IsInvalidRpcPublishMessagesErr, p2p.CtrlMsgNonClusterTopicType)
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 	require.NoError(t, inspector.Inspect(from, rpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
 // TestRpcInspectionDeactivatedOnPublicNetwork ensures inspector does not inspect RPCs on public networks.
 func TestRpcInspectionDeactivatedOnPublicNetwork(t *testing.T) {
-	inspector, signalerCtx, cancel, _, _, sporkID, idProvider, topicProviderOracle := inspectorFixture(t)
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, _, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+		params.NetworkingType = network.PublicNetwork
+	})
 	from := unittest.PeerIdFixture(t)
 	defer idProvider.AssertNotCalled(t, "ByPeerID", from)
 	topic := fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID)
@@ -940,61 +1267,102 @@ func TestRpcInspectionDeactivatedOnPublicNetwork(t *testing.T) {
 	rpc := unittest.P2PRPCFixture(unittest.WithPubsubMessages(pubsubMsgs...))
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
-
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 	require.NoError(t, inspector.Inspect(from, rpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
+	cancel()
+	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
+}
+
+// TestInspection_Unstaked_Peer ensures inspector disseminates invalid control message notifications for rpc's from unstaked peers when running private network.
+func TestInspection_Unstaked_Peer(t *testing.T) {
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		// override the inspector and params, run the inspector in private mode
+		params.NetworkingType = network.PrivateNetwork
+	})
+	unstakedPeer := unittest.PeerIdFixture(t)
+	topic := fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID)
+	topicProviderOracle.UpdateTopics([]string{topic})
+	idProvider.On("ByPeerID", unstakedPeer).Return(nil, false).Once()
+	checkNotification := checkNotificationFunc(t, unstakedPeer, p2pmsg.CtrlMsgRPC, validation.IsErrUnstakedPeer, p2p.CtrlMsgNonClusterTopicType)
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
+	inspector.Start(signalerCtx)
+	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
+
+	require.Error(t, inspector.Inspect(unstakedPeer, unittest.P2PRPCFixture()))
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
 // TestControlMessageInspection_Unstaked_From ensures inspector disseminates invalid control message notifications for published messages from unstaked peers.
 func TestPublishMessageInspection_Unstaked_From(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
 		// override the inspector and params, run the inspector in private mode
 		params.NetworkingType = network.PrivateNetwork
+		params.Logger = logger
 	})
 	from := unittest.PeerIdFixture(t)
+	unstakedPeer := unittest.PeerIdFixture(t)
 	topic := fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID)
 	topicProviderOracle.UpdateTopics([]string{topic})
 	// default RpcMessageErrorThreshold is 500, 501 messages should trigger a notification
-	pubsubMsgs := unittest.GossipSubMessageFixtures(501, topic, unittest.WithFrom(from))
-	idProvider.On("ByPeerID", from).Return(nil, false).Times(501)
+	pubsubMsgs := unittest.GossipSubMessageFixtures(501, topic, unittest.WithFrom(unstakedPeer))
+	idProvider.On("ByPeerID", unstakedPeer).Return(nil, false)
+	idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true)
 	rpc := unittest.P2PRPCFixture(unittest.WithPubsubMessages(pubsubMsgs...))
 	checkNotification := checkNotificationFunc(t, from, p2pmsg.RpcPublishMessage, validation.IsInvalidRpcPublishMessagesErr, p2p.CtrlMsgNonClusterTopicType)
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 	require.NoError(t, inspector.Inspect(from, rpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
 // TestControlMessageInspection_Ejected_From ensures inspector disseminates invalid control message notifications for published messages from ejected peers.
 func TestPublishMessageInspection_Ejected_From(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
 		// override the inspector and params, run the inspector in private mode
 		params.NetworkingType = network.PrivateNetwork
+		params.Logger = logger
 	})
+
 	from := unittest.PeerIdFixture(t)
 	id := unittest.IdentityFixture()
-	id.Ejected = true
+
+	ejectedNode := unittest.PeerIdFixture(t)
+	ejectedId := unittest.IdentityFixture()
+	ejectedId.EpochParticipationStatus = flow.EpochParticipationStatusEjected
+
 	topic := fmt.Sprintf("%s/%s", channels.TestNetworkChannel, sporkID)
 	topicProviderOracle.UpdateTopics([]string{topic})
-	pubsubMsgs := unittest.GossipSubMessageFixtures(501, topic, unittest.WithFrom(from))
-	idProvider.On("ByPeerID", from).Return(id, true).Times(501)
+	pubsubMsgs := unittest.GossipSubMessageFixtures(501, topic, unittest.WithFrom(ejectedNode))
+	idProvider.On("ByPeerID", ejectedNode).Return(ejectedId, true)
+	idProvider.On("ByPeerID", from).Return(id, true)
+
 	rpc := unittest.P2PRPCFixture(unittest.WithPubsubMessages(pubsubMsgs...))
 	checkNotification := checkNotificationFunc(t, from, p2pmsg.RpcPublishMessage, validation.IsInvalidRpcPublishMessagesErr, p2p.CtrlMsgNonClusterTopicType)
-	distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+	consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 	require.NoError(t, inspector.Inspect(from, rpc))
-	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == 1
+	}, time.Second, 500*time.Millisecond)
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
@@ -1002,71 +1370,67 @@ func TestPublishMessageInspection_Ejected_From(t *testing.T) {
 // TestNewControlMsgValidationInspector_validateClusterPrefixedTopic ensures cluster prefixed topics are validated as expected.
 func TestNewControlMsgValidationInspector_validateClusterPrefixedTopic(t *testing.T) {
 	t.Run("validateClusterPrefixedTopic should not return an error for valid cluster prefixed topics", func(t *testing.T) {
-		inspector, signalerCtx, cancel, distributor, _, sporkID, idProvider, topicProviderOracle := inspectorFixture(t)
-		defer distributor.AssertNotCalled(t, "Distribute")
+		logCounter := atomic.NewInt64(0)
+		logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+
+		inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+			params.Logger = logger
+		})
+		defer consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification")
 		clusterID := flow.ChainID(unittest.IdentifierFixture().String())
 		clusterPrefixedTopic := channels.Topic(fmt.Sprintf("%s/%s", channels.SyncCluster(clusterID), sporkID)).String()
 		topicProviderOracle.UpdateTopics([]string{clusterPrefixedTopic})
 		from := unittest.PeerIdFixture(t)
 		idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
 		inspectMsgRpc := unittest.P2PRPCFixture(unittest.WithGrafts(unittest.P2PRPCGraftFixture(&clusterPrefixedTopic)))
+		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 		inspector.ActiveClustersChanged(flow.ChainIDList{clusterID, flow.ChainID(unittest.IdentifierFixture().String()), flow.ChainID(unittest.IdentifierFixture().String())})
 		inspector.Start(signalerCtx)
 		unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 		require.NoError(t, inspector.Inspect(from, inspectMsgRpc))
-		// sleep for 1 second to ensure rpc's is processed
-		time.Sleep(time.Second)
+		require.Eventually(t, func() bool {
+			return logCounter.Load() == 1
+		}, time.Second, 500*time.Millisecond)
 		cancel()
 		unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 	})
 
 	t.Run("validateClusterPrefixedTopic should not return error if cluster prefixed hard threshold not exceeded for unknown cluster ids", func(t *testing.T) {
-		inspector, signalerCtx, cancel, distributor, _, sporkID, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+		logCounter := atomic.NewInt64(0)
+		logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+		inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
 			// set hard threshold to small number , ensure that a single unknown cluster prefix id does not cause a notification to be disseminated
 			params.Config.ClusterPrefixedMessage.HardThreshold = 2
+			params.Logger = logger
 		})
-		defer distributor.AssertNotCalled(t, "Distribute")
+		defer consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification")
 		clusterID := flow.ChainID(unittest.IdentifierFixture().String())
 		clusterPrefixedTopic := channels.Topic(fmt.Sprintf("%s/%s", channels.SyncCluster(clusterID), sporkID)).String()
 		from := unittest.PeerIdFixture(t)
 		inspectMsgRpc := unittest.P2PRPCFixture(unittest.WithGrafts(unittest.P2PRPCGraftFixture(&clusterPrefixedTopic)))
 		id := unittest.IdentityFixture()
 		idProvider.On("ByPeerID", from).Return(id, true).Once()
+		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 		inspector.Start(signalerCtx)
 		unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 		require.NoError(t, inspector.Inspect(from, inspectMsgRpc))
-		// sleep for 1 second to ensure rpc's is processed
-		time.Sleep(time.Second)
-		cancel()
-		unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
-	})
-
-	t.Run("validateClusterPrefixedTopic should return an error when sender is unstaked", func(t *testing.T) {
-		inspector, signalerCtx, cancel, distributor, _, sporkID, idProvider, topicProviderOracle := inspectorFixture(t)
-		defer distributor.AssertNotCalled(t, "Distribute")
-		clusterID := flow.ChainID(unittest.IdentifierFixture().String())
-		clusterPrefixedTopic := channels.Topic(fmt.Sprintf("%s/%s", channels.SyncCluster(clusterID), sporkID)).String()
-		topicProviderOracle.UpdateTopics([]string{clusterPrefixedTopic})
-		from := unittest.PeerIdFixture(t)
-		idProvider.On("ByPeerID", from).Return(nil, false).Once()
-		inspectMsgRpc := unittest.P2PRPCFixture(unittest.WithGrafts(unittest.P2PRPCGraftFixture(&clusterPrefixedTopic)))
-		inspector.ActiveClustersChanged(flow.ChainIDList{flow.ChainID(unittest.IdentifierFixture().String())})
-		inspector.Start(signalerCtx)
-		unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
-
-		require.NoError(t, inspector.Inspect(from, inspectMsgRpc))
-		// sleep for 1 second to ensure rpc's is processed
-		time.Sleep(time.Second)
+		require.Eventually(t, func() bool {
+			return logCounter.Load() == 1
+		}, time.Second, 500*time.Millisecond)
 		cancel()
 		unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 	})
 
 	t.Run("validateClusterPrefixedTopic should return error if cluster prefixed hard threshold exceeded for unknown cluster ids", func(t *testing.T) {
-		inspector, signalerCtx, cancel, distributor, _, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
+		logCounter := atomic.NewInt64(0)
+		logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+		inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle := inspectorFixture(t, func(params *validation.InspectorParams) {
 			// the 11th unknown cluster ID error should cause an error
 			params.Config.ClusterPrefixedMessage.HardThreshold = 10
+			params.Config.GraftPrune.InvalidTopicIdThreshold = 0
+			params.Logger = logger
 		})
 		clusterID := flow.ChainID(unittest.IdentifierFixture().String())
 		clusterPrefixedTopic := channels.Topic(fmt.Sprintf("%s/%s", channels.SyncCluster(clusterID), sporkID)).String()
@@ -1074,18 +1438,20 @@ func TestNewControlMsgValidationInspector_validateClusterPrefixedTopic(t *testin
 		from := unittest.PeerIdFixture(t)
 		identity := unittest.IdentityFixture()
 		idProvider.On("ByPeerID", from).Return(identity, true).Times(11)
-		checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgGraft, channels.IsUnknownClusterIDErr, p2p.CtrlMsgTopicTypeClusterPrefixed)
+		checkNotification := checkNotificationFunc(t, from, p2pmsg.CtrlMsgGraft, validation.IsInvalidTopicIDThresholdExceeded, p2p.CtrlMsgTopicTypeClusterPrefixed)
 		inspectMsgRpc := unittest.P2PRPCFixture(unittest.WithGrafts(unittest.P2PRPCGraftFixture(&clusterPrefixedTopic)))
 		inspector.ActiveClustersChanged(flow.ChainIDList{flow.ChainID(unittest.IdentifierFixture().String())})
-		distributor.On("Distribute", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
+		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+		consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(checkNotification)
 		inspector.Start(signalerCtx)
 		unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
 
 		for i := 0; i < 11; i++ {
 			require.NoError(t, inspector.Inspect(from, inspectMsgRpc))
 		}
-		// sleep for 1 second to ensure rpc's is processed
-		time.Sleep(time.Second)
+		require.Eventually(t, func() bool {
+			return logCounter.Load() == 11
+		}, time.Second, 100*time.Millisecond)
 		cancel()
 		unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 	})
@@ -1093,8 +1459,13 @@ func TestNewControlMsgValidationInspector_validateClusterPrefixedTopic(t *testin
 
 // TestControlMessageValidationInspector_ActiveClustersChanged validates the expected update of the active cluster IDs list.
 func TestControlMessageValidationInspector_ActiveClustersChanged(t *testing.T) {
-	inspector, signalerCtx, cancel, distributor, _, sporkID, idProvider, _ := inspectorFixture(t)
-	defer distributor.AssertNotCalled(t, "Distribute")
+	logCounter := atomic.NewInt64(0)
+	logger := hookedLogger(logCounter, zerolog.TraceLevel, worker.QueuedItemProcessedLog)
+
+	inspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+		params.Logger = logger
+	})
+	defer consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification")
 	identity := unittest.IdentityFixture()
 	idProvider.On("ByPeerID", mock.AnythingOfType("peer.ID")).Return(identity, true).Times(5)
 	activeClusterIds := make(flow.ChainIDList, 0)
@@ -1104,7 +1475,7 @@ func TestControlMessageValidationInspector_ActiveClustersChanged(t *testing.T) {
 	inspector.ActiveClustersChanged(activeClusterIds)
 	inspector.Start(signalerCtx)
 	unittest.RequireComponentsReadyBefore(t, 1*time.Second, inspector)
-
+	rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
 	from := unittest.PeerIdFixture(t)
 	for _, id := range activeClusterIds {
 		topic := channels.Topic(fmt.Sprintf("%s/%s", channels.SyncCluster(id), sporkID)).String()
@@ -1112,11 +1483,255 @@ func TestControlMessageValidationInspector_ActiveClustersChanged(t *testing.T) {
 		require.NoError(t, inspector.Inspect(from, rpc))
 	}
 	// sleep for 1 second to ensure rpc's is processed
-	time.Sleep(time.Second)
+	require.Eventually(t, func() bool {
+		return logCounter.Load() == int64(len(activeClusterIds))
+	}, time.Second, 500*time.Millisecond)
+
 	cancel()
 	unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
 }
 
+// TestControlMessageValidationInspector_TruncationConfigToggle ensures that rpc's are not truncated when truncation is disabled through configs.
+func TestControlMessageValidationInspector_TruncationConfigToggle(t *testing.T) {
+	t.Run("should not perform truncation when disabled is set to true", func(t *testing.T) {
+		numOfMsgs := 5000
+		logCounter := atomic.NewInt64(0)
+		logger := hookedLogger(logCounter, zerolog.TraceLevel, validation.RPCTruncationDisabledWarning, worker.QueuedItemProcessedLog)
+		inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+			params.Config.GraftPrune.MessageCountThreshold = numOfMsgs
+			params.Logger = logger
+			// disable truncation for all control message types
+			params.Config.InspectionProcess.Truncate.Disabled = true
+		})
+
+		// topic validation is ignored set any topic oracle
+		consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Maybe()
+		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+		rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Maybe()
+		inspector.Start(signalerCtx)
+
+		rpc := unittest.P2PRPCFixture(
+			unittest.WithGrafts(unittest.P2PRPCGraftFixtures(unittest.IdentifierListFixture(numOfMsgs).Strings()...)...),
+			unittest.WithPrunes(unittest.P2PRPCPruneFixtures(unittest.IdentifierListFixture(numOfMsgs).Strings()...)...),
+			unittest.WithIHaves(unittest.P2PRPCIHaveFixtures(numOfMsgs, unittest.IdentifierListFixture(numOfMsgs).Strings()...)...),
+			unittest.WithIWants(unittest.P2PRPCIWantFixtures(numOfMsgs, numOfMsgs)...),
+		)
+
+		from := unittest.PeerIdFixture(t)
+		idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
+		require.NoError(t, inspector.Inspect(from, rpc))
+
+		require.Eventually(t, func() bool {
+			return logCounter.Load() == 2
+		}, time.Second, 500*time.Millisecond)
+
+		// ensure truncation not performed
+		require.Len(t, rpc.GetControl().GetGraft(), numOfMsgs)
+		require.Len(t, rpc.GetControl().GetPrune(), numOfMsgs)
+		require.Len(t, rpc.GetControl().GetIhave(), numOfMsgs)
+		ensureMessageIdsLen(t, p2pmsg.CtrlMsgIHave, rpc, numOfMsgs)
+		require.Len(t, rpc.GetControl().GetIwant(), numOfMsgs)
+		ensureMessageIdsLen(t, p2pmsg.CtrlMsgIWant, rpc, numOfMsgs)
+
+		cancel()
+		unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
+	})
+
+	t.Run("should not perform truncation when disabled for each individual control message type directly", func(t *testing.T) {
+		numOfMsgs := 5000
+		expectedLogStrs := []string{
+			validation.GraftTruncationDisabledWarning,
+			validation.PruneTruncationDisabledWarning,
+			validation.IHaveTruncationDisabledWarning,
+			validation.IHaveMessageIDTruncationDisabledWarning,
+			validation.IWantTruncationDisabledWarning,
+			validation.IWantMessageIDTruncationDisabledWarning,
+			worker.QueuedItemProcessedLog,
+		}
+		logCounter := atomic.NewInt64(0)
+		logger := hookedLogger(logCounter, zerolog.TraceLevel, expectedLogStrs...)
+		inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+			params.Config.GraftPrune.MessageCountThreshold = numOfMsgs
+			params.Logger = logger
+			// disable truncation for all control message types individually
+			params.Config.InspectionProcess.Truncate.EnableGraft = false
+			params.Config.InspectionProcess.Truncate.EnablePrune = false
+			params.Config.InspectionProcess.Truncate.EnableIHave = false
+			params.Config.InspectionProcess.Truncate.EnableIHaveMessageIds = false
+			params.Config.InspectionProcess.Truncate.EnableIWant = false
+			params.Config.InspectionProcess.Truncate.EnableIWantMessageIds = false
+		})
+
+		// topic validation is ignored set any topic oracle
+		consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Maybe()
+		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+		rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Maybe()
+		inspector.Start(signalerCtx)
+
+		rpc := unittest.P2PRPCFixture(
+			unittest.WithGrafts(unittest.P2PRPCGraftFixtures(unittest.IdentifierListFixture(numOfMsgs).Strings()...)...),
+			unittest.WithPrunes(unittest.P2PRPCPruneFixtures(unittest.IdentifierListFixture(numOfMsgs).Strings()...)...),
+			unittest.WithIHaves(unittest.P2PRPCIHaveFixtures(numOfMsgs, unittest.IdentifierListFixture(numOfMsgs).Strings()...)...),
+			unittest.WithIWants(unittest.P2PRPCIWantFixtures(numOfMsgs, numOfMsgs)...),
+		)
+
+		from := unittest.PeerIdFixture(t)
+		idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
+		require.NoError(t, inspector.Inspect(from, rpc))
+
+		require.Eventually(t, func() bool {
+			return logCounter.Load() == int64(len(expectedLogStrs))
+		}, time.Second, 500*time.Millisecond)
+
+		// ensure truncation not performed
+		require.Len(t, rpc.GetControl().GetGraft(), numOfMsgs)
+		require.Len(t, rpc.GetControl().GetPrune(), numOfMsgs)
+		require.Len(t, rpc.GetControl().GetIhave(), numOfMsgs)
+		ensureMessageIdsLen(t, p2pmsg.CtrlMsgIHave, rpc, numOfMsgs)
+		require.Len(t, rpc.GetControl().GetIwant(), numOfMsgs)
+		ensureMessageIdsLen(t, p2pmsg.CtrlMsgIWant, rpc, numOfMsgs)
+
+		cancel()
+		unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
+	})
+}
+
+// TestControlMessageValidationInspector_InspectionConfigToggle ensures that rpc's are not inspected when inspection is disabled through configs.
+func TestControlMessageValidationInspector_InspectionConfigToggle(t *testing.T) {
+	t.Run("should not perform inspection when disabled is set to true", func(t *testing.T) {
+		numOfMsgs := 5000
+		logCounter := atomic.NewInt64(0)
+		logger := hookedLogger(logCounter, zerolog.TraceLevel, validation.RPCInspectionDisabledWarning)
+		inspector, signalerCtx, cancel, consumer, rpcTracker, _, _, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+			params.Logger = logger
+			// disable inspector for all control message types
+			params.Config.InspectionProcess.Inspect.Disabled = true
+		})
+
+		// notification consumer should never be called when inspection is disabled
+		defer consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification")
+		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+		rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Maybe()
+		inspector.Start(signalerCtx)
+
+		rpc := unittest.P2PRPCFixture(
+			unittest.WithGrafts(unittest.P2PRPCGraftFixtures(unittest.IdentifierListFixture(numOfMsgs).Strings()...)...),
+			unittest.WithPrunes(unittest.P2PRPCPruneFixtures(unittest.IdentifierListFixture(numOfMsgs).Strings()...)...),
+			unittest.WithIHaves(unittest.P2PRPCIHaveFixtures(numOfMsgs, unittest.IdentifierListFixture(numOfMsgs).Strings()...)...),
+			unittest.WithIWants(unittest.P2PRPCIWantFixtures(numOfMsgs, numOfMsgs)...),
+		)
+
+		from := unittest.PeerIdFixture(t)
+		require.NoError(t, inspector.Inspect(from, rpc))
+
+		require.Eventually(t, func() bool {
+			return logCounter.Load() == 1
+		}, time.Second, 500*time.Millisecond)
+
+		cancel()
+		unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
+	})
+
+	t.Run("should not check identity when reject-unstaked-peers is false", func(t *testing.T) {
+		inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+			// disable inspector for all control message types
+			params.Config.InspectionProcess.Inspect.RejectUnstakedPeers = false
+		})
+
+		// notification consumer should never be called when inspection is disabled
+		defer consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification")
+		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+		rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Maybe()
+
+		from := unittest.PeerIdFixture(t)
+
+		defer idProvider.AssertNotCalled(t, "ByPeerID", from)
+		inspector.Start(signalerCtx)
+
+		require.NoError(t, inspector.Inspect(from, unittest.P2PRPCFixture()))
+
+		time.Sleep(time.Second)
+		cancel()
+		unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
+	})
+
+	t.Run("should check identity when reject-unstaked-peers is true", func(t *testing.T) {
+		inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+			// disable inspector for all control message types
+			params.Config.InspectionProcess.Inspect.RejectUnstakedPeers = true
+		})
+
+		// notification consumer should never be called when inspection is disabled
+		consumer.On("OnInvalidControlMessageNotification", mock.AnythingOfType("*p2p.InvCtrlMsgNotif")).Return(nil).Once().Run(func(args mock.Arguments) {
+			notification, ok := args.Get(0).(*p2p.InvCtrlMsgNotif)
+			require.True(t, ok)
+			require.True(t, validation.IsErrUnstakedPeer(notification.Error))
+		})
+		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+		rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Maybe()
+
+		from := unittest.PeerIdFixture(t)
+
+		idProvider.On("ByPeerID", from).Return(nil, false).Once()
+		inspector.Start(signalerCtx)
+
+		require.Error(t, inspector.Inspect(from, unittest.P2PRPCFixture()))
+
+		time.Sleep(time.Second)
+		cancel()
+		unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
+	})
+
+	t.Run("should not perform inspection when disabled for each individual control message type directly", func(t *testing.T) {
+		numOfMsgs := 5000
+		expectedLogStrs := []string{
+			validation.GraftInspectionDisabledWarning,
+			validation.PruneInspectionDisabledWarning,
+			validation.IHaveInspectionDisabledWarning,
+			validation.IWantInspectionDisabledWarning,
+			validation.PublishInspectionDisabledWarning,
+			worker.QueuedItemProcessedLog,
+		}
+		logCounter := atomic.NewInt64(0)
+		logger := hookedLogger(logCounter, zerolog.TraceLevel, expectedLogStrs...)
+		inspector, signalerCtx, cancel, consumer, rpcTracker, _, idProvider, _ := inspectorFixture(t, func(params *validation.InspectorParams) {
+			params.Config.GraftPrune.MessageCountThreshold = numOfMsgs
+			params.Logger = logger
+			// disable inspection for all control message types individually
+			params.Config.InspectionProcess.Inspect.EnableGraft = false
+			params.Config.InspectionProcess.Inspect.EnablePrune = false
+			params.Config.InspectionProcess.Inspect.EnableIHave = false
+			params.Config.InspectionProcess.Inspect.EnableIWant = false
+			params.Config.InspectionProcess.Inspect.EnablePublish = false
+		})
+
+		// notification consumer should never be called when inspection is disabled
+		defer consumer.AssertNotCalled(t, "OnInvalidControlMessageNotification")
+		rpcTracker.On("LastHighestIHaveRPCSize").Return(int64(100)).Maybe()
+		rpcTracker.On("WasIHaveRPCSent", mock.AnythingOfType("string")).Return(true).Maybe()
+		inspector.Start(signalerCtx)
+
+		rpc := unittest.P2PRPCFixture(
+			unittest.WithGrafts(unittest.P2PRPCGraftFixtures(unittest.IdentifierListFixture(numOfMsgs).Strings()...)...),
+			unittest.WithPrunes(unittest.P2PRPCPruneFixtures(unittest.IdentifierListFixture(numOfMsgs).Strings()...)...),
+			unittest.WithIHaves(unittest.P2PRPCIHaveFixtures(numOfMsgs, unittest.IdentifierListFixture(numOfMsgs).Strings()...)...),
+			unittest.WithIWants(unittest.P2PRPCIWantFixtures(numOfMsgs, numOfMsgs)...),
+			unittest.WithPubsubMessages(unittest.GossipSubMessageFixtures(numOfMsgs, unittest.RandomStringFixture(t, 100), unittest.WithFrom(unittest.PeerIdFixture(t)))...),
+		)
+
+		from := unittest.PeerIdFixture(t)
+		idProvider.On("ByPeerID", from).Return(unittest.IdentityFixture(), true).Once()
+		require.NoError(t, inspector.Inspect(from, rpc))
+
+		require.Eventually(t, func() bool {
+			return logCounter.Load() == int64(len(expectedLogStrs))
+		}, time.Second, 500*time.Millisecond)
+
+		cancel()
+		unittest.RequireCloseBefore(t, inspector.Done(), 5*time.Second, "inspector did not stop")
+	})
+}
+
 // invalidTopics returns 3 invalid topics.
 // - unknown topic
 // - malformed topic
@@ -1149,30 +1764,30 @@ func checkNotificationFunc(t *testing.T,
 
 func inspectorFixture(t *testing.T, opts ...func(params *validation.InspectorParams)) (*validation.ControlMsgValidationInspector,
 	*irrecoverable.MockSignalerContext,
-	context.CancelFunc,
-	*mockp2p.GossipSubInspectorNotificationDistributor,
+	context.CancelFunc, *mockp2p.GossipSubInvalidControlMessageNotificationConsumer,
 	*mockp2p.RpcControlTracking,
 	flow.Identifier,
 	*mockmodule.IdentityProvider,
-	*internal.MockUpdatableTopicProvider) {
+	*p2ptest.UpdatableTopicProviderFixture) {
+
 	sporkID := unittest.IdentifierFixture()
 	flowConfig, err := config.DefaultConfig()
 	require.NoError(t, err)
-	distributor := mockp2p.NewGossipSubInspectorNotificationDistributor(t)
-	p2ptest.MockInspectorNotificationDistributorReadyDoneAware(distributor)
+
+	consumer := mockp2p.NewGossipSubInvalidControlMessageNotificationConsumer(t)
 	idProvider := mockmodule.NewIdentityProvider(t)
 	rpcTracker := mockp2p.NewRpcControlTracking(t)
-	topicProviderOracle := internal.NewMockUpdatableTopicProvider()
+	topicProviderOracle := p2ptest.NewUpdatableTopicProviderFixture()
 	params := &validation.InspectorParams{
 		Logger:                  unittest.Logger(),
 		SporkID:                 sporkID,
 		Config:                  &flowConfig.NetworkConfig.GossipSub.RpcInspector.Validation,
-		Distributor:             distributor,
 		IdProvider:              idProvider,
 		HeroCacheMetricsFactory: metrics.NewNoopHeroCacheMetricsFactory(),
 		InspectorMetrics:        metrics.NewNoopCollector(),
 		RpcTracker:              rpcTracker,
-		NetworkingType:          network.PublicNetwork,
+		InvalidControlMessageNotificationConsumer: consumer,
+		NetworkingType: network.PrivateNetwork,
 		TopicOracle: func() p2p.TopicProvider {
 			return topicProviderOracle
 		},
@@ -1184,5 +1799,35 @@ func inspectorFixture(t *testing.T, opts ...func(params *validation.InspectorPar
 	require.NoError(t, err, "failed to create control message validation inspector fixture")
 	ctx, cancel := context.WithCancel(context.Background())
 	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
-	return validationInspector, signalerCtx, cancel, distributor, rpcTracker, sporkID, idProvider, topicProviderOracle
+	return validationInspector, signalerCtx, cancel, consumer, rpcTracker, sporkID, idProvider, topicProviderOracle
+}
+
+// utility function to track the number of expected logs for the expected log level.
+func hookedLogger(counter *atomic.Int64, expectedLogLevel zerolog.Level, expectedLogs ...string) zerolog.Logger {
+	hook := zerolog.HookFunc(func(e *zerolog.Event, level zerolog.Level, message string) {
+		if level == expectedLogLevel {
+			for _, s := range expectedLogs {
+				if message == s {
+					counter.Inc()
+				}
+			}
+		}
+	})
+	return zerolog.New(os.Stdout).Level(expectedLogLevel).Hook(hook)
+}
+
+// ensureMessageIdsLen ensures RPC IHave and IWant message ids are the expected len.
+func ensureMessageIdsLen(t *testing.T, msgType p2pmsg.ControlMessageType, rpc *pubsub.RPC, expectedLen int) {
+	switch msgType {
+	case p2pmsg.CtrlMsgIHave:
+		for _, ihave := range rpc.GetControl().GetIhave() {
+			require.Len(t, ihave.GetMessageIDs(), expectedLen)
+		}
+	case p2pmsg.CtrlMsgIWant:
+		for _, iwant := range rpc.GetControl().GetIwant() {
+			require.Len(t, iwant.GetMessageIDs(), expectedLen)
+		}
+	default:
+		require.Fail(t, "control message type provided does not contain message ids expected ihave or iwant")
+	}
 }
diff --git a/network/p2p/inspector/validation/errors.go b/network/p2p/inspector/validation/errors.go
index bb73f9cba9b..b343e556b23 100644
--- a/network/p2p/inspector/validation/errors.go
+++ b/network/p2p/inspector/validation/errors.go
@@ -4,6 +4,8 @@ import (
 	"errors"
 	"fmt"
 
+	"github.com/libp2p/go-libp2p/core/peer"
+
 	"github.com/onflow/flow-go/network/channels"
 	p2pmsg "github.com/onflow/flow-go/network/p2p/message"
 )
@@ -133,16 +135,16 @@ func IsErrActiveClusterIDsNotSet(err error) bool {
 
 // ErrUnstakedPeer error that indicates a cluster prefixed control message has been from an unstaked peer.
 type ErrUnstakedPeer struct {
-	err error
+	pid peer.ID
 }
 
 func (e ErrUnstakedPeer) Error() string {
-	return e.err.Error()
+	return fmt.Sprintf("unstaked peer: %s", e.pid)
 }
 
 // NewUnstakedPeerErr returns a new ErrUnstakedPeer.
-func NewUnstakedPeerErr(err error) ErrUnstakedPeer {
-	return ErrUnstakedPeer{err: err}
+func NewUnstakedPeerErr(pid peer.ID) ErrUnstakedPeer {
+	return ErrUnstakedPeer{pid: pid}
 }
 
 // IsErrUnstakedPeer returns true if an error is ErrUnstakedPeer.
@@ -151,6 +153,26 @@ func IsErrUnstakedPeer(err error) bool {
 	return errors.As(err, &e)
 }
 
+// ErrEjectedPeer error that indicates a cluster prefixed control message has been received from an ejected peer.
+type ErrEjectedPeer struct {
+	pid peer.ID
+}
+
+func (e ErrEjectedPeer) Error() string {
+	return fmt.Sprintf("ejected peer: %s", e.pid)
+}
+
+// NewEjectedPeerErr returns a new ErrEjectedPeer.
+func NewEjectedPeerErr(pid peer.ID) ErrEjectedPeer {
+	return ErrEjectedPeer{pid: pid}
+}
+
+// IsErrEjectedPeer returns true if an error is ErrEjectedPeer.
+func IsErrEjectedPeer(err error) bool {
+	var e ErrEjectedPeer
+	return errors.As(err, &e)
+}
+
 // InvalidRpcPublishMessagesErr error indicates that rpc publish message validation failed.
 type InvalidRpcPublishMessagesErr struct {
 	// err the original error returned by the calling func.
@@ -173,3 +195,46 @@ func IsInvalidRpcPublishMessagesErr(err error) bool {
 	var e InvalidRpcPublishMessagesErr
 	return errors.As(err, &e)
 }
+
+// DuplicateTopicIDThresholdExceeded indicates that the number of duplicate topic IDs exceeds the allowed threshold.
+type DuplicateTopicIDThresholdExceeded struct {
+	duplicates int
+	sampleSize int
+	threshold  int
+}
+
+func (e DuplicateTopicIDThresholdExceeded) Error() string {
+	return fmt.Sprintf("%d/%d duplicate topic IDs exceed the allowed threshold: %d", e.duplicates, e.sampleSize, e.threshold)
+}
+
+// NewDuplicateTopicIDThresholdExceeded returns a new DuplicateTopicIDThresholdExceeded error.
+func NewDuplicateTopicIDThresholdExceeded(duplicates int, sampleSize int, threshold int) DuplicateTopicIDThresholdExceeded {
+	return DuplicateTopicIDThresholdExceeded{duplicates, sampleSize, threshold}
+}
+
+// IsDuplicateTopicIDThresholdExceeded returns true if an error is DuplicateTopicIDThresholdExceeded
+func IsDuplicateTopicIDThresholdExceeded(err error) bool {
+	var e DuplicateTopicIDThresholdExceeded
+	return errors.As(err, &e)
+}
+
+// InvalidTopicIDThresholdExceeded indicates that the number of invalid topic IDs exceeds the allowed threshold.
+type InvalidTopicIDThresholdExceeded struct {
+	invalidCount int
+	threshold    int
+}
+
+func (e InvalidTopicIDThresholdExceeded) Error() string {
+	return fmt.Sprintf("%d invalid topic IDs exceed the allowed threshold: %d", e.invalidCount, e.threshold)
+}
+
+// NewInvalidTopicIDThresholdExceeded returns a new InvalidTopicIDThresholdExceeded error.
+func NewInvalidTopicIDThresholdExceeded(invalidCount, threshold int) InvalidTopicIDThresholdExceeded {
+	return InvalidTopicIDThresholdExceeded{invalidCount, threshold}
+}
+
+// IsInvalidTopicIDThresholdExceeded returns true if an error is InvalidTopicIDThresholdExceeded.
+func IsInvalidTopicIDThresholdExceeded(err error) bool {
+	var e InvalidTopicIDThresholdExceeded
+	return errors.As(err, &e)
+}
diff --git a/network/p2p/inspector/validation/errors_test.go b/network/p2p/inspector/validation/errors_test.go
index 29072fbd5f7..cc56ca52fde 100644
--- a/network/p2p/inspector/validation/errors_test.go
+++ b/network/p2p/inspector/validation/errors_test.go
@@ -105,3 +105,27 @@ func TestInvalidRpcPublishMessagesErrRoundTrip(t *testing.T) {
 	dummyErr := fmt.Errorf("dummy error")
 	assert.False(t, IsInvalidRpcPublishMessagesErr(dummyErr), "IsInvalidRpcPublishMessagesErr should return false for non-InvalidRpcPublishMessagesErr error")
 }
+
+// TestErrDuplicateTopicIDThresholdExceededRoundTrip ensures correct error formatting for DuplicateTopicIDThresholdExceeded.
+func TestDuplicateTopicIDThresholdExceededRoundTrip(t *testing.T) {
+	expectedErrorMsg := "3/5 duplicate topic IDs exceed the allowed threshold: 2"
+	err := NewDuplicateTopicIDThresholdExceeded(3, 5, 2)
+	assert.Equal(t, expectedErrorMsg, err.Error(), "the error message should be correctly formatted")
+	// tests the IsDuplicateTopicIDThresholdExceeded function.
+	assert.True(t, IsDuplicateTopicIDThresholdExceeded(err), "IsDuplicateTopicIDThresholdExceeded should return true for DuplicateTopicIDThresholdExceeded error")
+	// test IsDuplicateTopicIDThresholdExceeded with a different error type.
+	dummyErr := fmt.Errorf("dummy error")
+	assert.False(t, IsDuplicateTopicIDThresholdExceeded(dummyErr), "IsDuplicateTopicIDThresholdExceeded should return false for non-DuplicateTopicIDThresholdExceeded error")
+}
+
+// TestErrInvalidTopicIDThresholdExceededRoundTrip ensures correct error formatting for InvalidTopicIDThresholdExceeded.
+func TestInvalidTopicIDThresholdExceededRoundTrip(t *testing.T) {
+	expectedErrorMsg := "8 invalid topic IDs exceed the allowed threshold: 5"
+	err := NewInvalidTopicIDThresholdExceeded(8, 5)
+	assert.Equal(t, expectedErrorMsg, err.Error(), "the error message should be correctly formatted")
+	// tests the IsInvalidTopicIDThresholdExceeded function.
+	assert.True(t, IsInvalidTopicIDThresholdExceeded(err), "IsInvalidTopicIDThresholdExceeded should return true for InvalidTopicIDThresholdExceeded error")
+	// test IsInvalidTopicIDThresholdExceeded with a different error type.
+	dummyErr := fmt.Errorf("dummy error")
+	assert.False(t, IsInvalidTopicIDThresholdExceeded(dummyErr), "IsInvalidTopicIDThresholdExceeded should return false for non-InvalidTopicIDThresholdExceeded error")
+}
diff --git a/network/p2p/inspector/validation/validation_inspector_config.go b/network/p2p/inspector/validation/validation_inspector_config.go
deleted file mode 100644
index ccad4018c04..00000000000
--- a/network/p2p/inspector/validation/validation_inspector_config.go
+++ /dev/null
@@ -1,14 +0,0 @@
-package validation
-
-const (
-	// DefaultNumberOfWorkers default number of workers for the inspector component.
-	DefaultNumberOfWorkers = 5
-	// DefaultControlMsgValidationInspectorQueueCacheSize is the default size of the inspect message queue.
-	DefaultControlMsgValidationInspectorQueueCacheSize = 100
-	// DefaultClusterPrefixedControlMsgsReceivedCacheSize is the default size of the cluster prefixed topics received record cache.
-	DefaultClusterPrefixedControlMsgsReceivedCacheSize = 150
-	// DefaultClusterPrefixedControlMsgsReceivedCacheDecay the default cache decay value for cluster prefixed topics received cached counters.
-	DefaultClusterPrefixedControlMsgsReceivedCacheDecay = 0.99
-	// rpcInspectorComponentName the rpc inspector component name.
-	rpcInspectorComponentName = "gossipsub_rpc_validation_inspector"
-)
diff --git a/network/p2p/libp2pNode.go b/network/p2p/libp2pNode.go
index aa4b1a3a408..e38342aacb7 100644
--- a/network/p2p/libp2pNode.go
+++ b/network/p2p/libp2pNode.go
@@ -87,7 +87,7 @@ type Routable interface {
 
 // UnicastManagement abstracts the unicast management capabilities of the node.
 type UnicastManagement interface {
-	// OpenProtectedStream opens a new stream to a peer with a protection tag. The protection tag can be used to ensure
+	// OpenAndWriteOnStream opens a new stream to a peer with a protection tag. The protection tag can be used to ensure
 	// that the connection to the peer is maintained for a particular purpose. The stream is opened to the given peerID
 	// and writingLogic is executed on the stream. The created stream does not need to be reused and can be inexpensively
 	// created for each send. Moreover, the stream creation does not incur a round-trip time as the stream negotiation happens
diff --git a/network/p2p/message/types.go b/network/p2p/message/types.go
index 19dcc9e78d2..baab4384253 100644
--- a/network/p2p/message/types.go
+++ b/network/p2p/message/types.go
@@ -8,6 +8,7 @@ func (c ControlMessageType) String() string {
 }
 
 const (
+	CtrlMsgRPC        ControlMessageType = "RPC"
 	CtrlMsgIHave      ControlMessageType = "IHAVE"
 	CtrlMsgIWant      ControlMessageType = "IWANT"
 	CtrlMsgGraft      ControlMessageType = "GRAFT"
diff --git a/network/p2p/mock/gossip_sub_builder.go b/network/p2p/mock/gossip_sub_builder.go
index 13342243e3b..a5d4a846c56 100644
--- a/network/p2p/mock/gossip_sub_builder.go
+++ b/network/p2p/mock/gossip_sub_builder.go
@@ -51,8 +51,8 @@ func (_m *GossipSubBuilder) EnableGossipSubScoringWithOverride(_a0 *p2p.PeerScor
 	_m.Called(_a0)
 }
 
-// OverrideDefaultRpcInspectorSuiteFactory provides a mock function with given fields: _a0
-func (_m *GossipSubBuilder) OverrideDefaultRpcInspectorSuiteFactory(_a0 p2p.GossipSubRpcInspectorSuiteFactoryFunc) {
+// OverrideDefaultRpcInspectorFactory provides a mock function with given fields: _a0
+func (_m *GossipSubBuilder) OverrideDefaultRpcInspectorFactory(_a0 p2p.GossipSubRpcInspectorFactoryFunc) {
 	_m.Called(_a0)
 }
 
diff --git a/network/p2p/mock/gossip_sub_duplicate_message_tracker_cache.go b/network/p2p/mock/gossip_sub_duplicate_message_tracker_cache.go
new file mode 100644
index 00000000000..1fdf8247aa4
--- /dev/null
+++ b/network/p2p/mock/gossip_sub_duplicate_message_tracker_cache.go
@@ -0,0 +1,84 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mockp2p
+
+import (
+	mock "github.com/stretchr/testify/mock"
+
+	peer "github.com/libp2p/go-libp2p/core/peer"
+)
+
+// GossipSubDuplicateMessageTrackerCache is an autogenerated mock type for the GossipSubDuplicateMessageTrackerCache type
+type GossipSubDuplicateMessageTrackerCache struct {
+	mock.Mock
+}
+
+// Get provides a mock function with given fields: peerId
+func (_m *GossipSubDuplicateMessageTrackerCache) Get(peerId peer.ID) (float64, bool, error) {
+	ret := _m.Called(peerId)
+
+	var r0 float64
+	var r1 bool
+	var r2 error
+	if rf, ok := ret.Get(0).(func(peer.ID) (float64, bool, error)); ok {
+		return rf(peerId)
+	}
+	if rf, ok := ret.Get(0).(func(peer.ID) float64); ok {
+		r0 = rf(peerId)
+	} else {
+		r0 = ret.Get(0).(float64)
+	}
+
+	if rf, ok := ret.Get(1).(func(peer.ID) bool); ok {
+		r1 = rf(peerId)
+	} else {
+		r1 = ret.Get(1).(bool)
+	}
+
+	if rf, ok := ret.Get(2).(func(peer.ID) error); ok {
+		r2 = rf(peerId)
+	} else {
+		r2 = ret.Error(2)
+	}
+
+	return r0, r1, r2
+}
+
+// Inc provides a mock function with given fields: peerId
+func (_m *GossipSubDuplicateMessageTrackerCache) Inc(peerId peer.ID) (float64, error) {
+	ret := _m.Called(peerId)
+
+	var r0 float64
+	var r1 error
+	if rf, ok := ret.Get(0).(func(peer.ID) (float64, error)); ok {
+		return rf(peerId)
+	}
+	if rf, ok := ret.Get(0).(func(peer.ID) float64); ok {
+		r0 = rf(peerId)
+	} else {
+		r0 = ret.Get(0).(float64)
+	}
+
+	if rf, ok := ret.Get(1).(func(peer.ID) error); ok {
+		r1 = rf(peerId)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+type mockConstructorTestingTNewGossipSubDuplicateMessageTrackerCache interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewGossipSubDuplicateMessageTrackerCache creates a new instance of GossipSubDuplicateMessageTrackerCache. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewGossipSubDuplicateMessageTrackerCache(t mockConstructorTestingTNewGossipSubDuplicateMessageTrackerCache) *GossipSubDuplicateMessageTrackerCache {
+	mock := &GossipSubDuplicateMessageTrackerCache{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/network/p2p/mock/gossip_sub_inspector_notif_distributor.go b/network/p2p/mock/gossip_sub_inspector_notif_distributor.go
deleted file mode 100644
index b378c9fac2b..00000000000
--- a/network/p2p/mock/gossip_sub_inspector_notif_distributor.go
+++ /dev/null
@@ -1,86 +0,0 @@
-// Code generated by mockery v2.21.4. DO NOT EDIT.
-
-package mockp2p
-
-import (
-	irrecoverable "github.com/onflow/flow-go/module/irrecoverable"
-	mock "github.com/stretchr/testify/mock"
-
-	p2p "github.com/onflow/flow-go/network/p2p"
-)
-
-// GossipSubInspectorNotifDistributor is an autogenerated mock type for the GossipSubInspectorNotifDistributor type
-type GossipSubInspectorNotifDistributor struct {
-	mock.Mock
-}
-
-// AddConsumer provides a mock function with given fields: _a0
-func (_m *GossipSubInspectorNotifDistributor) AddConsumer(_a0 p2p.GossipSubInvCtrlMsgNotifConsumer) {
-	_m.Called(_a0)
-}
-
-// Distribute provides a mock function with given fields: notification
-func (_m *GossipSubInspectorNotifDistributor) Distribute(notification *p2p.InvCtrlMsgNotif) error {
-	ret := _m.Called(notification)
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(*p2p.InvCtrlMsgNotif) error); ok {
-		r0 = rf(notification)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// Done provides a mock function with given fields:
-func (_m *GossipSubInspectorNotifDistributor) Done() <-chan struct{} {
-	ret := _m.Called()
-
-	var r0 <-chan struct{}
-	if rf, ok := ret.Get(0).(func() <-chan struct{}); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(<-chan struct{})
-		}
-	}
-
-	return r0
-}
-
-// Ready provides a mock function with given fields:
-func (_m *GossipSubInspectorNotifDistributor) Ready() <-chan struct{} {
-	ret := _m.Called()
-
-	var r0 <-chan struct{}
-	if rf, ok := ret.Get(0).(func() <-chan struct{}); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(<-chan struct{})
-		}
-	}
-
-	return r0
-}
-
-// Start provides a mock function with given fields: _a0
-func (_m *GossipSubInspectorNotifDistributor) Start(_a0 irrecoverable.SignalerContext) {
-	_m.Called(_a0)
-}
-
-type mockConstructorTestingTNewGossipSubInspectorNotifDistributor interface {
-	mock.TestingT
-	Cleanup(func())
-}
-
-// NewGossipSubInspectorNotifDistributor creates a new instance of GossipSubInspectorNotifDistributor. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-func NewGossipSubInspectorNotifDistributor(t mockConstructorTestingTNewGossipSubInspectorNotifDistributor) *GossipSubInspectorNotifDistributor {
-	mock := &GossipSubInspectorNotifDistributor{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
diff --git a/network/p2p/mock/gossip_sub_inspector_notification_distributor.go b/network/p2p/mock/gossip_sub_inspector_notification_distributor.go
deleted file mode 100644
index f44f7a2c480..00000000000
--- a/network/p2p/mock/gossip_sub_inspector_notification_distributor.go
+++ /dev/null
@@ -1,87 +0,0 @@
-// Code generated by mockery v2.21.4. DO NOT EDIT.
-
-package mockp2p
-
-import (
-	mock "github.com/stretchr/testify/mock"
-
-	irrecoverable "github.com/onflow/flow-go/module/irrecoverable"
-
-	p2p "github.com/onflow/flow-go/network/p2p"
-)
-
-// GossipSubInspectorNotificationDistributor is an autogenerated mock type for the GossipSubInspectorNotificationDistributor type
-type GossipSubInspectorNotificationDistributor struct {
-	mock.Mock
-}
-
-// AddConsumer provides a mock function with given fields: _a0
-func (_m *GossipSubInspectorNotificationDistributor) AddConsumer(_a0 p2p.GossipSubInvCtrlMsgNotifConsumer) {
-	_m.Called(_a0)
-}
-
-// DistributeInvalidControlMessageNotification provides a mock function with given fields: notification
-func (_m *GossipSubInspectorNotificationDistributor) Distribute(notification *p2p.InvCtrlMsgNotif) error {
-	ret := _m.Called(notification)
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(*p2p.InvCtrlMsgNotif) error); ok {
-		r0 = rf(notification)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// Done provides a mock function with given fields:
-func (_m *GossipSubInspectorNotificationDistributor) Done() <-chan struct{} {
-	ret := _m.Called()
-
-	var r0 <-chan struct{}
-	if rf, ok := ret.Get(0).(func() <-chan struct{}); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(<-chan struct{})
-		}
-	}
-
-	return r0
-}
-
-// Ready provides a mock function with given fields:
-func (_m *GossipSubInspectorNotificationDistributor) Ready() <-chan struct{} {
-	ret := _m.Called()
-
-	var r0 <-chan struct{}
-	if rf, ok := ret.Get(0).(func() <-chan struct{}); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(<-chan struct{})
-		}
-	}
-
-	return r0
-}
-
-// Start provides a mock function with given fields: _a0
-func (_m *GossipSubInspectorNotificationDistributor) Start(_a0 irrecoverable.SignalerContext) {
-	_m.Called(_a0)
-}
-
-type mockConstructorTestingTNewGossipSubInspectorNotificationDistributor interface {
-	mock.TestingT
-	Cleanup(func())
-}
-
-// NewGossipSubInspectorNotificationDistributor creates a new instance of GossipSubInspectorNotificationDistributor. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-func NewGossipSubInspectorNotificationDistributor(t mockConstructorTestingTNewGossipSubInspectorNotificationDistributor) *GossipSubInspectorNotificationDistributor {
-	mock := &GossipSubInspectorNotificationDistributor{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
diff --git a/network/p2p/mock/gossip_sub_inspector_suite.go b/network/p2p/mock/gossip_sub_inspector_suite.go
deleted file mode 100644
index 90c7e5b15d7..00000000000
--- a/network/p2p/mock/gossip_sub_inspector_suite.go
+++ /dev/null
@@ -1,99 +0,0 @@
-// Code generated by mockery v2.21.4. DO NOT EDIT.
-
-package mockp2p
-
-import (
-	flow "github.com/onflow/flow-go/model/flow"
-	irrecoverable "github.com/onflow/flow-go/module/irrecoverable"
-
-	mock "github.com/stretchr/testify/mock"
-
-	p2p "github.com/onflow/flow-go/network/p2p"
-
-	peer "github.com/libp2p/go-libp2p/core/peer"
-
-	pubsub "github.com/libp2p/go-libp2p-pubsub"
-)
-
-// GossipSubInspectorSuite is an autogenerated mock type for the GossipSubInspectorSuite type
-type GossipSubInspectorSuite struct {
-	mock.Mock
-}
-
-// ActiveClustersChanged provides a mock function with given fields: _a0
-func (_m *GossipSubInspectorSuite) ActiveClustersChanged(_a0 flow.ChainIDList) {
-	_m.Called(_a0)
-}
-
-// AddInvalidControlMessageConsumer provides a mock function with given fields: _a0
-func (_m *GossipSubInspectorSuite) AddInvalidControlMessageConsumer(_a0 p2p.GossipSubInvCtrlMsgNotifConsumer) {
-	_m.Called(_a0)
-}
-
-// Done provides a mock function with given fields:
-func (_m *GossipSubInspectorSuite) Done() <-chan struct{} {
-	ret := _m.Called()
-
-	var r0 <-chan struct{}
-	if rf, ok := ret.Get(0).(func() <-chan struct{}); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(<-chan struct{})
-		}
-	}
-
-	return r0
-}
-
-// InspectFunc provides a mock function with given fields:
-func (_m *GossipSubInspectorSuite) InspectFunc() func(peer.ID, *pubsub.RPC) error {
-	ret := _m.Called()
-
-	var r0 func(peer.ID, *pubsub.RPC) error
-	if rf, ok := ret.Get(0).(func() func(peer.ID, *pubsub.RPC) error); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(func(peer.ID, *pubsub.RPC) error)
-		}
-	}
-
-	return r0
-}
-
-// Ready provides a mock function with given fields:
-func (_m *GossipSubInspectorSuite) Ready() <-chan struct{} {
-	ret := _m.Called()
-
-	var r0 <-chan struct{}
-	if rf, ok := ret.Get(0).(func() <-chan struct{}); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(<-chan struct{})
-		}
-	}
-
-	return r0
-}
-
-// Start provides a mock function with given fields: _a0
-func (_m *GossipSubInspectorSuite) Start(_a0 irrecoverable.SignalerContext) {
-	_m.Called(_a0)
-}
-
-type mockConstructorTestingTNewGossipSubInspectorSuite interface {
-	mock.TestingT
-	Cleanup(func())
-}
-
-// NewGossipSubInspectorSuite creates a new instance of GossipSubInspectorSuite. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-func NewGossipSubInspectorSuite(t mockConstructorTestingTNewGossipSubInspectorSuite) *GossipSubInspectorSuite {
-	mock := &GossipSubInspectorSuite{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
diff --git a/network/p2p/mock/gossip_sub_msg_validation_rpc_inspector.go b/network/p2p/mock/gossip_sub_msg_validation_rpc_inspector.go
deleted file mode 100644
index 41d3a409533..00000000000
--- a/network/p2p/mock/gossip_sub_msg_validation_rpc_inspector.go
+++ /dev/null
@@ -1,104 +0,0 @@
-// Code generated by mockery v2.21.4. DO NOT EDIT.
-
-package mockp2p
-
-import (
-	flow "github.com/onflow/flow-go/model/flow"
-	irrecoverable "github.com/onflow/flow-go/module/irrecoverable"
-
-	mock "github.com/stretchr/testify/mock"
-
-	peer "github.com/libp2p/go-libp2p/core/peer"
-
-	pubsub "github.com/libp2p/go-libp2p-pubsub"
-)
-
-// GossipSubMsgValidationRpcInspector is an autogenerated mock type for the GossipSubMsgValidationRpcInspector type
-type GossipSubMsgValidationRpcInspector struct {
-	mock.Mock
-}
-
-// ActiveClustersChanged provides a mock function with given fields: _a0
-func (_m *GossipSubMsgValidationRpcInspector) ActiveClustersChanged(_a0 flow.ChainIDList) {
-	_m.Called(_a0)
-}
-
-// Done provides a mock function with given fields:
-func (_m *GossipSubMsgValidationRpcInspector) Done() <-chan struct{} {
-	ret := _m.Called()
-
-	var r0 <-chan struct{}
-	if rf, ok := ret.Get(0).(func() <-chan struct{}); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(<-chan struct{})
-		}
-	}
-
-	return r0
-}
-
-// Inspect provides a mock function with given fields: _a0, _a1
-func (_m *GossipSubMsgValidationRpcInspector) Inspect(_a0 peer.ID, _a1 *pubsub.RPC) error {
-	ret := _m.Called(_a0, _a1)
-
-	var r0 error
-	if rf, ok := ret.Get(0).(func(peer.ID, *pubsub.RPC) error); ok {
-		r0 = rf(_a0, _a1)
-	} else {
-		r0 = ret.Error(0)
-	}
-
-	return r0
-}
-
-// Name provides a mock function with given fields:
-func (_m *GossipSubMsgValidationRpcInspector) Name() string {
-	ret := _m.Called()
-
-	var r0 string
-	if rf, ok := ret.Get(0).(func() string); ok {
-		r0 = rf()
-	} else {
-		r0 = ret.Get(0).(string)
-	}
-
-	return r0
-}
-
-// Ready provides a mock function with given fields:
-func (_m *GossipSubMsgValidationRpcInspector) Ready() <-chan struct{} {
-	ret := _m.Called()
-
-	var r0 <-chan struct{}
-	if rf, ok := ret.Get(0).(func() <-chan struct{}); ok {
-		r0 = rf()
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(<-chan struct{})
-		}
-	}
-
-	return r0
-}
-
-// Start provides a mock function with given fields: _a0
-func (_m *GossipSubMsgValidationRpcInspector) Start(_a0 irrecoverable.SignalerContext) {
-	_m.Called(_a0)
-}
-
-type mockConstructorTestingTNewGossipSubMsgValidationRpcInspector interface {
-	mock.TestingT
-	Cleanup(func())
-}
-
-// NewGossipSubMsgValidationRpcInspector creates a new instance of GossipSubMsgValidationRpcInspector. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-func NewGossipSubMsgValidationRpcInspector(t mockConstructorTestingTNewGossipSubMsgValidationRpcInspector) *GossipSubMsgValidationRpcInspector {
-	mock := &GossipSubMsgValidationRpcInspector{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
diff --git a/network/p2p/mock/gossip_sub_rpc_inspector.go b/network/p2p/mock/gossip_sub_rpc_inspector.go
index fa7453b5bc2..24123537b23 100644
--- a/network/p2p/mock/gossip_sub_rpc_inspector.go
+++ b/network/p2p/mock/gossip_sub_rpc_inspector.go
@@ -3,7 +3,9 @@
 package mockp2p
 
 import (
+	flow "github.com/onflow/flow-go/model/flow"
 	irrecoverable "github.com/onflow/flow-go/module/irrecoverable"
+
 	mock "github.com/stretchr/testify/mock"
 
 	peer "github.com/libp2p/go-libp2p/core/peer"
@@ -16,6 +18,11 @@ type GossipSubRPCInspector struct {
 	mock.Mock
 }
 
+// ActiveClustersChanged provides a mock function with given fields: _a0
+func (_m *GossipSubRPCInspector) ActiveClustersChanged(_a0 flow.ChainIDList) {
+	_m.Called(_a0)
+}
+
 // Done provides a mock function with given fields:
 func (_m *GossipSubRPCInspector) Done() <-chan struct{} {
 	ret := _m.Called()
diff --git a/network/p2p/mock/gossip_sub_rpc_inspector_factory_func.go b/network/p2p/mock/gossip_sub_rpc_inspector_factory_func.go
new file mode 100644
index 00000000000..141da62f9e5
--- /dev/null
+++ b/network/p2p/mock/gossip_sub_rpc_inspector_factory_func.go
@@ -0,0 +1,66 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mockp2p
+
+import (
+	flow "github.com/onflow/flow-go/model/flow"
+	metrics "github.com/onflow/flow-go/module/metrics"
+
+	mock "github.com/stretchr/testify/mock"
+
+	module "github.com/onflow/flow-go/module"
+
+	network "github.com/onflow/flow-go/network"
+
+	p2p "github.com/onflow/flow-go/network/p2p"
+
+	p2pconfig "github.com/onflow/flow-go/network/p2p/config"
+
+	zerolog "github.com/rs/zerolog"
+)
+
+// GossipSubRpcInspectorFactoryFunc is an autogenerated mock type for the GossipSubRpcInspectorFactoryFunc type
+type GossipSubRpcInspectorFactoryFunc struct {
+	mock.Mock
+}
+
+// Execute provides a mock function with given fields: _a0, _a1, _a2, _a3, _a4, _a5, _a6, _a7, _a8
+func (_m *GossipSubRpcInspectorFactoryFunc) Execute(_a0 zerolog.Logger, _a1 flow.Identifier, _a2 *p2pconfig.RpcInspectorParameters, _a3 module.GossipSubMetrics, _a4 metrics.HeroCacheMetricsFactory, _a5 network.NetworkingType, _a6 module.IdentityProvider, _a7 func() p2p.TopicProvider, _a8 p2p.GossipSubInvCtrlMsgNotifConsumer) (p2p.GossipSubRPCInspector, error) {
+	ret := _m.Called(_a0, _a1, _a2, _a3, _a4, _a5, _a6, _a7, _a8)
+
+	var r0 p2p.GossipSubRPCInspector
+	var r1 error
+	if rf, ok := ret.Get(0).(func(zerolog.Logger, flow.Identifier, *p2pconfig.RpcInspectorParameters, module.GossipSubMetrics, metrics.HeroCacheMetricsFactory, network.NetworkingType, module.IdentityProvider, func() p2p.TopicProvider, p2p.GossipSubInvCtrlMsgNotifConsumer) (p2p.GossipSubRPCInspector, error)); ok {
+		return rf(_a0, _a1, _a2, _a3, _a4, _a5, _a6, _a7, _a8)
+	}
+	if rf, ok := ret.Get(0).(func(zerolog.Logger, flow.Identifier, *p2pconfig.RpcInspectorParameters, module.GossipSubMetrics, metrics.HeroCacheMetricsFactory, network.NetworkingType, module.IdentityProvider, func() p2p.TopicProvider, p2p.GossipSubInvCtrlMsgNotifConsumer) p2p.GossipSubRPCInspector); ok {
+		r0 = rf(_a0, _a1, _a2, _a3, _a4, _a5, _a6, _a7, _a8)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(p2p.GossipSubRPCInspector)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(zerolog.Logger, flow.Identifier, *p2pconfig.RpcInspectorParameters, module.GossipSubMetrics, metrics.HeroCacheMetricsFactory, network.NetworkingType, module.IdentityProvider, func() p2p.TopicProvider, p2p.GossipSubInvCtrlMsgNotifConsumer) error); ok {
+		r1 = rf(_a0, _a1, _a2, _a3, _a4, _a5, _a6, _a7, _a8)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+type mockConstructorTestingTNewGossipSubRpcInspectorFactoryFunc interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewGossipSubRpcInspectorFactoryFunc creates a new instance of GossipSubRpcInspectorFactoryFunc. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewGossipSubRpcInspectorFactoryFunc(t mockConstructorTestingTNewGossipSubRpcInspectorFactoryFunc) *GossipSubRpcInspectorFactoryFunc {
+	mock := &GossipSubRpcInspectorFactoryFunc{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/network/p2p/mock/gossip_sub_rpc_inspector_suite_factory_func.go b/network/p2p/mock/gossip_sub_rpc_inspector_suite_factory_func.go
deleted file mode 100644
index 7b419f29c48..00000000000
--- a/network/p2p/mock/gossip_sub_rpc_inspector_suite_factory_func.go
+++ /dev/null
@@ -1,68 +0,0 @@
-// Code generated by mockery v2.21.4. DO NOT EDIT.
-
-package mockp2p
-
-import (
-	flow "github.com/onflow/flow-go/model/flow"
-	irrecoverable "github.com/onflow/flow-go/module/irrecoverable"
-
-	metrics "github.com/onflow/flow-go/module/metrics"
-
-	mock "github.com/stretchr/testify/mock"
-
-	module "github.com/onflow/flow-go/module"
-
-	network "github.com/onflow/flow-go/network"
-
-	p2p "github.com/onflow/flow-go/network/p2p"
-
-	p2pconfig "github.com/onflow/flow-go/network/p2p/config"
-
-	zerolog "github.com/rs/zerolog"
-)
-
-// GossipSubRpcInspectorSuiteFactoryFunc is an autogenerated mock type for the GossipSubRpcInspectorSuiteFactoryFunc type
-type GossipSubRpcInspectorSuiteFactoryFunc struct {
-	mock.Mock
-}
-
-// Execute provides a mock function with given fields: _a0, _a1, _a2, _a3, _a4, _a5, _a6, _a7, _a8
-func (_m *GossipSubRpcInspectorSuiteFactoryFunc) Execute(_a0 irrecoverable.SignalerContext, _a1 zerolog.Logger, _a2 flow.Identifier, _a3 *p2pconfig.RpcInspectorParameters, _a4 module.GossipSubMetrics, _a5 metrics.HeroCacheMetricsFactory, _a6 network.NetworkingType, _a7 module.IdentityProvider, _a8 func() p2p.TopicProvider) (p2p.GossipSubInspectorSuite, error) {
-	ret := _m.Called(_a0, _a1, _a2, _a3, _a4, _a5, _a6, _a7, _a8)
-
-	var r0 p2p.GossipSubInspectorSuite
-	var r1 error
-	if rf, ok := ret.Get(0).(func(irrecoverable.SignalerContext, zerolog.Logger, flow.Identifier, *p2pconfig.RpcInspectorParameters, module.GossipSubMetrics, metrics.HeroCacheMetricsFactory, network.NetworkingType, module.IdentityProvider, func() p2p.TopicProvider) (p2p.GossipSubInspectorSuite, error)); ok {
-		return rf(_a0, _a1, _a2, _a3, _a4, _a5, _a6, _a7, _a8)
-	}
-	if rf, ok := ret.Get(0).(func(irrecoverable.SignalerContext, zerolog.Logger, flow.Identifier, *p2pconfig.RpcInspectorParameters, module.GossipSubMetrics, metrics.HeroCacheMetricsFactory, network.NetworkingType, module.IdentityProvider, func() p2p.TopicProvider) p2p.GossipSubInspectorSuite); ok {
-		r0 = rf(_a0, _a1, _a2, _a3, _a4, _a5, _a6, _a7, _a8)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(p2p.GossipSubInspectorSuite)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(irrecoverable.SignalerContext, zerolog.Logger, flow.Identifier, *p2pconfig.RpcInspectorParameters, module.GossipSubMetrics, metrics.HeroCacheMetricsFactory, network.NetworkingType, module.IdentityProvider, func() p2p.TopicProvider) error); ok {
-		r1 = rf(_a0, _a1, _a2, _a3, _a4, _a5, _a6, _a7, _a8)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-type mockConstructorTestingTNewGossipSubRpcInspectorSuiteFactoryFunc interface {
-	mock.TestingT
-	Cleanup(func())
-}
-
-// NewGossipSubRpcInspectorSuiteFactoryFunc creates a new instance of GossipSubRpcInspectorSuiteFactoryFunc. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-func NewGossipSubRpcInspectorSuiteFactoryFunc(t mockConstructorTestingTNewGossipSubRpcInspectorSuiteFactoryFunc) *GossipSubRpcInspectorSuiteFactoryFunc {
-	mock := &GossipSubRpcInspectorSuiteFactoryFunc{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
diff --git a/network/p2p/mock/node_builder.go b/network/p2p/mock/node_builder.go
index 3b10dcfb0c8..5229be19fbc 100644
--- a/network/p2p/mock/node_builder.go
+++ b/network/p2p/mock/node_builder.go
@@ -53,12 +53,12 @@ func (_m *NodeBuilder) Build() (p2p.LibP2PNode, error) {
 	return r0, r1
 }
 
-// OverrideDefaultRpcInspectorSuiteFactory provides a mock function with given fields: _a0
-func (_m *NodeBuilder) OverrideDefaultRpcInspectorSuiteFactory(_a0 p2p.GossipSubRpcInspectorSuiteFactoryFunc) p2p.NodeBuilder {
+// OverrideDefaultRpcInspectorFactory provides a mock function with given fields: _a0
+func (_m *NodeBuilder) OverrideDefaultRpcInspectorFactory(_a0 p2p.GossipSubRpcInspectorFactoryFunc) p2p.NodeBuilder {
 	ret := _m.Called(_a0)
 
 	var r0 p2p.NodeBuilder
-	if rf, ok := ret.Get(0).(func(p2p.GossipSubRpcInspectorSuiteFactoryFunc) p2p.NodeBuilder); ok {
+	if rf, ok := ret.Get(0).(func(p2p.GossipSubRpcInspectorFactoryFunc) p2p.NodeBuilder); ok {
 		r0 = rf(_a0)
 	} else {
 		if ret.Get(0) != nil {
@@ -69,6 +69,22 @@ func (_m *NodeBuilder) OverrideDefaultRpcInspectorSuiteFactory(_a0 p2p.GossipSub
 	return r0
 }
 
+// OverrideGossipSubFactory provides a mock function with given fields: _a0, _a1
+func (_m *NodeBuilder) OverrideGossipSubFactory(_a0 p2p.GossipSubFactoryFunc, _a1 p2p.GossipSubAdapterConfigFunc) p2p.NodeBuilder {
+	ret := _m.Called(_a0, _a1)
+
+	var r0 p2p.NodeBuilder
+	if rf, ok := ret.Get(0).(func(p2p.GossipSubFactoryFunc, p2p.GossipSubAdapterConfigFunc) p2p.NodeBuilder); ok {
+		r0 = rf(_a0, _a1)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(p2p.NodeBuilder)
+		}
+	}
+
+	return r0
+}
+
 // OverrideGossipSubScoringConfig provides a mock function with given fields: _a0
 func (_m *NodeBuilder) OverrideGossipSubScoringConfig(_a0 *p2p.PeerScoringConfigOverride) p2p.NodeBuilder {
 	ret := _m.Called(_a0)
@@ -149,22 +165,6 @@ func (_m *NodeBuilder) SetConnectionManager(_a0 connmgr.ConnManager) p2p.NodeBui
 	return r0
 }
 
-// SetGossipSubFactory provides a mock function with given fields: _a0, _a1
-func (_m *NodeBuilder) SetGossipSubFactory(_a0 p2p.GossipSubFactoryFunc, _a1 p2p.GossipSubAdapterConfigFunc) p2p.NodeBuilder {
-	ret := _m.Called(_a0, _a1)
-
-	var r0 p2p.NodeBuilder
-	if rf, ok := ret.Get(0).(func(p2p.GossipSubFactoryFunc, p2p.GossipSubAdapterConfigFunc) p2p.NodeBuilder); ok {
-		r0 = rf(_a0, _a1)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(p2p.NodeBuilder)
-		}
-	}
-
-	return r0
-}
-
 // SetResourceManager provides a mock function with given fields: _a0
 func (_m *NodeBuilder) SetResourceManager(_a0 network.ResourceManager) p2p.NodeBuilder {
 	ret := _m.Called(_a0)
diff --git a/network/p2p/mock/pub_sub_adapter_config.go b/network/p2p/mock/pub_sub_adapter_config.go
index 113ef45a163..980d6cb71f3 100644
--- a/network/p2p/mock/pub_sub_adapter_config.go
+++ b/network/p2p/mock/pub_sub_adapter_config.go
@@ -14,11 +14,6 @@ type PubSubAdapterConfig struct {
 	mock.Mock
 }
 
-// WithInspectorSuite provides a mock function with given fields: _a0
-func (_m *PubSubAdapterConfig) WithInspectorSuite(_a0 p2p.GossipSubInspectorSuite) {
-	_m.Called(_a0)
-}
-
 // WithMessageIdFunction provides a mock function with given fields: f
 func (_m *PubSubAdapterConfig) WithMessageIdFunction(f func([]byte) string) {
 	_m.Called(f)
@@ -29,6 +24,11 @@ func (_m *PubSubAdapterConfig) WithRoutingDiscovery(_a0 routing.ContentRouting)
 	_m.Called(_a0)
 }
 
+// WithRpcInspector provides a mock function with given fields: _a0
+func (_m *PubSubAdapterConfig) WithRpcInspector(_a0 p2p.GossipSubRPCInspector) {
+	_m.Called(_a0)
+}
+
 // WithScoreOption provides a mock function with given fields: _a0
 func (_m *PubSubAdapterConfig) WithScoreOption(_a0 p2p.ScoreOptionBuilder) {
 	_m.Called(_a0)
diff --git a/network/p2p/mock/pub_sub_tracer.go b/network/p2p/mock/pub_sub_tracer.go
index 9dc380aed65..0b82964ad6b 100644
--- a/network/p2p/mock/pub_sub_tracer.go
+++ b/network/p2p/mock/pub_sub_tracer.go
@@ -56,6 +56,20 @@ func (_m *PubSubTracer) DuplicateMessage(msg *pubsub.Message) {
 	_m.Called(msg)
 }
 
+// DuplicateMessageCount provides a mock function with given fields: _a0
+func (_m *PubSubTracer) DuplicateMessageCount(_a0 peer.ID) float64 {
+	ret := _m.Called(_a0)
+
+	var r0 float64
+	if rf, ok := ret.Get(0).(func(peer.ID) float64); ok {
+		r0 = rf(_a0)
+	} else {
+		r0 = ret.Get(0).(float64)
+	}
+
+	return r0
+}
+
 // GetLocalMeshPeers provides a mock function with given fields: topic
 func (_m *PubSubTracer) GetLocalMeshPeers(topic channels.Topic) []peer.ID {
 	ret := _m.Called(topic)
diff --git a/network/p2p/node/gossipSubAdapter.go b/network/p2p/node/gossipSubAdapter.go
index d1acf5af376..3ada14efd5c 100644
--- a/network/p2p/node/gossipSubAdapter.go
+++ b/network/p2p/node/gossipSubAdapter.go
@@ -112,7 +112,7 @@ func NewGossipSubAdapter(ctx context.Context,
 		a.localMeshTracer = tracer
 	}
 
-	if inspectorSuite := gossipSubConfig.InspectorSuiteComponent(); inspectorSuite != nil {
+	if inspectorSuite := gossipSubConfig.RpcInspectorComponent(); inspectorSuite != nil {
 		builder.AddWorker(func(ctx irrecoverable.SignalerContext, ready component.ReadyFunc) {
 			a.logger.Info().Msg("starting inspector suite")
 			inspectorSuite.Start(ctx)
diff --git a/network/p2p/node/gossipSubAdapterConfig.go b/network/p2p/node/gossipSubAdapterConfig.go
index f4069930612..e9b102a6e81 100644
--- a/network/p2p/node/gossipSubAdapterConfig.go
+++ b/network/p2p/node/gossipSubAdapterConfig.go
@@ -14,11 +14,11 @@ import (
 // GossipSubAdapterConfig is a wrapper around libp2p pubsub options that
 // implements the PubSubAdapterConfig interface for the Flow network.
 type GossipSubAdapterConfig struct {
-	options        []pubsub.Option
-	scoreTracer    p2p.PeerScoreTracer
-	scoreOption    p2p.ScoreOptionBuilder
-	pubsubTracer   p2p.PubSubTracer
-	inspectorSuite p2p.GossipSubInspectorSuite // currently only used to manage the lifecycle.
+	options      []pubsub.Option
+	scoreTracer  p2p.PeerScoreTracer
+	scoreOption  p2p.ScoreOptionBuilder
+	pubsubTracer p2p.PubSubTracer
+	inspector    p2p.GossipSubRPCInspector // currently only used to manage the lifecycle.
 }
 
 var _ p2p.PubSubAdapterConfig = (*GossipSubAdapterConfig)(nil)
@@ -82,9 +82,9 @@ func (g *GossipSubAdapterConfig) WithMessageIdFunction(f func([]byte) string) {
 // - suite: the inspector suite to use
 // Returns:
 // -None
-func (g *GossipSubAdapterConfig) WithInspectorSuite(suite p2p.GossipSubInspectorSuite) {
-	g.options = append(g.options, pubsub.WithAppSpecificRpcInspector(suite.InspectFunc()))
-	g.inspectorSuite = suite
+func (g *GossipSubAdapterConfig) WithRpcInspector(inspector p2p.GossipSubRPCInspector) {
+	g.options = append(g.options, pubsub.WithAppSpecificRpcInspector(inspector.Inspect))
+	g.inspector = inspector
 }
 
 // WithTracer adds a tracer option to the config.
@@ -120,15 +120,15 @@ func (g *GossipSubAdapterConfig) ScoringComponent() component.Component {
 	return g.scoreOption
 }
 
-// InspectorSuiteComponent returns the component that manages the lifecycle of the inspector suite.
+// RpcInspectorComponent returns the component that manages the lifecycle of the inspector suite.
 // This is used to start and stop the inspector suite by the PubSubAdapter.
 // Args:
 //   - None
 //
 // Returns:
 //   - component.Component: the component that manages the lifecycle of the inspector suite.
-func (g *GossipSubAdapterConfig) InspectorSuiteComponent() component.Component {
-	return g.inspectorSuite
+func (g *GossipSubAdapterConfig) RpcInspectorComponent() component.Component {
+	return g.inspector
 }
 
 // WithScoreTracer sets the tracer for the peer score.
diff --git a/network/p2p/node/libp2pNode_test.go b/network/p2p/node/libp2pNode_test.go
index d301cf48733..9a538bd269b 100644
--- a/network/p2p/node/libp2pNode_test.go
+++ b/network/p2p/node/libp2pNode_test.go
@@ -54,7 +54,7 @@ func TestMultiAddress(t *testing.T) {
 	}
 
 	for _, tc := range tt {
-		ip, port, _, err := p2putils.NetworkingInfo(*tc.identity)
+		ip, port, _, err := p2putils.NetworkingInfo(tc.identity.IdentitySkeleton)
 		require.NoError(t, err)
 
 		actualAddress := utils.MultiAddressStr(ip, port)
@@ -88,12 +88,12 @@ func TestGetPeerInfo(t *testing.T) {
 		identity := unittest.IdentityFixture(unittest.WithNetworkingKey(key.PublicKey()), unittest.WithAddress("1.1.1.1:0"))
 
 		// translates node-i address into info
-		info, err := utils.PeerAddressInfo(*identity)
+		info, err := utils.PeerAddressInfo(identity.IdentitySkeleton)
 		require.NoError(t, err)
 
 		// repeats the translation for node-i
 		for j := 0; j < 10; j++ {
-			rinfo, err := utils.PeerAddressInfo(*identity)
+			rinfo, err := utils.PeerAddressInfo(identity.IdentitySkeleton)
 			require.NoError(t, err)
 			assert.Equal(t, rinfo.String(), info.String(), "inconsistent id generated")
 		}
@@ -113,7 +113,7 @@ func TestAddPeers(t *testing.T) {
 
 	// add the remaining nodes to the first node as its set of peers
 	for _, identity := range identities[1:] {
-		peerInfo, err := utils.PeerAddressInfo(*identity)
+		peerInfo, err := utils.PeerAddressInfo(identity.IdentitySkeleton)
 		require.NoError(t, err)
 		require.NoError(t, nodes[0].ConnectToPeer(ctx, peerInfo))
 	}
@@ -170,7 +170,7 @@ func TestConnGater(t *testing.T) {
 	p2ptest.StartNode(t, signalerCtx, node1)
 	defer p2ptest.StopNode(t, node1, cancel)
 
-	node1Info, err := utils.PeerAddressInfo(identity1)
+	node1Info, err := utils.PeerAddressInfo(identity1.IdentitySkeleton)
 	assert.NoError(t, err)
 
 	node2Peers := unittest.NewProtectedMap[peer.ID, struct{}]()
@@ -187,7 +187,7 @@ func TestConnGater(t *testing.T) {
 	p2ptest.StartNode(t, signalerCtx, node2)
 	defer p2ptest.StopNode(t, node2, cancel)
 
-	node2Info, err := utils.PeerAddressInfo(identity2)
+	node2Info, err := utils.PeerAddressInfo(identity2.IdentitySkeleton)
 	assert.NoError(t, err)
 
 	node1.Host().Peerstore().AddAddrs(node2Info.ID, node2Info.Addrs, peerstore.PermanentAddrTTL)
@@ -295,7 +295,7 @@ func createConcurrentStreams(t *testing.T, ctx context.Context, nodes []p2p.LibP
 				continue
 			}
 
-			pInfo, err := utils.PeerAddressInfo(*ids[i])
+			pInfo, err := utils.PeerAddressInfo(ids[i].IdentitySkeleton)
 			require.NoError(t, err)
 			this.Host().Peerstore().AddAddrs(pInfo.ID, pInfo.Addrs, peerstore.AddressTTL)
 
diff --git a/network/p2p/node/libp2pStream_test.go b/network/p2p/node/libp2pStream_test.go
index 46d291f3af5..9b8e8453014 100644
--- a/network/p2p/node/libp2pStream_test.go
+++ b/network/p2p/node/libp2pStream_test.go
@@ -49,7 +49,7 @@ func TestStreamClosing(t *testing.T) {
 	p2ptest.StartNodes(t, signalerCtx, nodes)
 	defer p2ptest.StopNodes(t, nodes, cancel)
 
-	nodeInfo1, err := utils.PeerAddressInfo(*identities[1])
+	nodeInfo1, err := utils.PeerAddressInfo(identities[1].IdentitySkeleton)
 	require.NoError(t, err)
 
 	senderWG := sync.WaitGroup{}
@@ -161,7 +161,7 @@ func testCreateStream(t *testing.T, sporkId flow.Identifier, unicasts []protocol
 	allStreamsClosedWg := sync.WaitGroup{}
 	for i := 0; i < streamCount; i++ {
 		allStreamsClosedWg.Add(1)
-		pInfo, err := utils.PeerAddressInfo(*id2)
+		pInfo, err := utils.PeerAddressInfo(id2.IdentitySkeleton)
 		require.NoError(t, err)
 		nodes[0].Host().Peerstore().AddAddrs(pInfo.ID, pInfo.Addrs, peerstore.AddressTTL)
 		go func() {
@@ -236,7 +236,7 @@ func TestCreateStream_FallBack(t *testing.T) {
 	allStreamsClosedWg := sync.WaitGroup{}
 	for i := 0; i < streamCount; i++ {
 		allStreamsClosedWg.Add(1)
-		pInfo, err := utils.PeerAddressInfo(otherId)
+		pInfo, err := utils.PeerAddressInfo(otherId.IdentitySkeleton)
 		require.NoError(t, err)
 		thisNode.Host().Peerstore().AddAddrs(pInfo.ID, pInfo.Addrs, peerstore.AddressTTL)
 
@@ -289,7 +289,7 @@ func TestCreateStreamIsConcurrencySafe(t *testing.T) {
 	p2ptest.StartNodes(t, signalerCtx, nodes)
 	defer p2ptest.StopNodes(t, nodes, cancel)
 
-	nodeInfo1, err := utils.PeerAddressInfo(*identities[1])
+	nodeInfo1, err := utils.PeerAddressInfo(identities[1].IdentitySkeleton)
 	require.NoError(t, err)
 
 	wg := sync.WaitGroup{}
@@ -351,7 +351,7 @@ func TestNoBackoffWhenCreatingStream(t *testing.T) {
 	defer p2ptest.StopNode(t, node1, cancel1)
 
 	id2 := identities[1]
-	pInfo, err := utils.PeerAddressInfo(*id2)
+	pInfo, err := utils.PeerAddressInfo(id2.IdentitySkeleton)
 	require.NoError(t, err)
 	nodes[0].Host().Peerstore().AddAddrs(pInfo.ID, pInfo.Addrs, peerstore.AddressTTL)
 
@@ -511,7 +511,7 @@ func TestCreateStreamTimeoutWithUnresponsiveNode(t *testing.T) {
 		require.NoError(t, listener.Close())
 	}()
 
-	silentNodeInfo, err := utils.PeerAddressInfo(silentNodeId)
+	silentNodeInfo, err := utils.PeerAddressInfo(silentNodeId.IdentitySkeleton)
 	require.NoError(t, err)
 
 	timeout := 1 * time.Second
@@ -548,7 +548,7 @@ func TestCreateStreamIsConcurrent(t *testing.T) {
 	p2ptest.StartNodes(t, signalerCtx, goodNodes)
 	defer p2ptest.StopNodes(t, goodNodes, cancel)
 
-	goodNodeInfo1, err := utils.PeerAddressInfo(*goodNodeIds[1])
+	goodNodeInfo1, err := utils.PeerAddressInfo(goodNodeIds[1].IdentitySkeleton)
 	require.NoError(t, err)
 
 	// create a silent node which never replies
@@ -556,7 +556,7 @@ func TestCreateStreamIsConcurrent(t *testing.T) {
 	defer func() {
 		require.NoError(t, listener.Close())
 	}()
-	silentNodeInfo, err := utils.PeerAddressInfo(silentNodeId)
+	silentNodeInfo, err := utils.PeerAddressInfo(silentNodeId.IdentitySkeleton)
 	require.NoError(t, err)
 
 	// creates a stream to unresponsive node and makes sure that the stream creation is blocked
diff --git a/network/p2p/node/libp2pUtils_test.go b/network/p2p/node/libp2pUtils_test.go
index e06a46f61e6..c7d0d52274b 100644
--- a/network/p2p/node/libp2pUtils_test.go
+++ b/network/p2p/node/libp2pUtils_test.go
@@ -29,7 +29,7 @@ func TestLibP2PUtilsTestSuite(t *testing.T) {
 func (ts *LibP2PUtilsTestSuite) TestPeerInfoFromID() {
 	ids, exceptedPeerInfos := idsAndPeerInfos(ts.T())
 	for i, id := range ids {
-		actualAddrInfo, err := utils.PeerAddressInfo(*id)
+		actualAddrInfo, err := utils.PeerAddressInfo(id.IdentitySkeleton)
 		assert.NoError(ts.T(), err)
 		assert.Equal(ts.T(), exceptedPeerInfos[i].String(), actualAddrInfo.String())
 	}
@@ -83,6 +83,6 @@ func BenchmarkPeerInfoFromID(b *testing.B) {
 	id.Address = "1.1.1.1:3569"
 	b.StartTimer()
 	for n := 0; n < b.N; n++ {
-		_, _ = utils.PeerAddressInfo(*id)
+		_, _ = utils.PeerAddressInfo(id.IdentitySkeleton)
 	}
 }
diff --git a/network/p2p/node/resourceManager_test.go b/network/p2p/node/resourceManager_test.go
index 42a53c3b5b4..b68624fd604 100644
--- a/network/p2p/node/resourceManager_test.go
+++ b/network/p2p/node/resourceManager_test.go
@@ -260,6 +260,12 @@ func TestCreateStream_ProtocolLimitLessThanPeerProtocolLimit(t *testing.T) {
 }
 
 func TestCreateStream_ProtocolLimitGreaterThanPeerProtocolLimit(t *testing.T) {
+	// TODO: with libp2p upgrade to v0.32.2; this test is failing as the peer protocol limit is not being enforced, and
+	// rather the protocol limit is being enforced, this test expects each peer not to be allowed more than 5 streams on a specific protocol.
+	// However, the maximum number of streams on a specific protocol (and specific peer) are being enforced instead.
+	// A quick investigation shows that it may be due to the way libp2p treats our unicast protocol (it is not a limit-enforcing protocol).
+	// But further investigation is required to confirm this.
+	unittest.SkipUnless(t, unittest.TEST_TODO, "broken test")
 	// the case where protocol-level limit is higher than the peer-protocol-level limit.
 	base := baseCreateStreamInboundStreamResourceLimitConfig()
 	base.maxInboundStreamProtocol = 10    // overall limit is 10 streams on a specific protocol (across all peers).
diff --git a/network/p2p/pubsub.go b/network/p2p/pubsub.go
index 7b4833736bb..97741d0820e 100644
--- a/network/p2p/pubsub.go
+++ b/network/p2p/pubsub.go
@@ -83,14 +83,18 @@ type PubSubAdapterConfig interface {
 	// WithScoreTracer sets the tracer for the underlying pubsub score implementation.
 	// This is used to expose the local scoring table of the GossipSub node to its higher level components.
 	WithScoreTracer(tracer PeerScoreTracer)
-	WithInspectorSuite(GossipSubInspectorSuite)
+	WithRpcInspector(GossipSubRPCInspector)
 }
 
-// GossipSubRPCInspector app specific RPC inspector used to inspect and validate incoming RPC messages before they are processed by libp2p.
+// GossipSubRPCInspector abstracts the general behavior of an app specific RPC inspector specifically
+// used to inspect and validate incoming. It is used to implement custom message validation logic. It is injected into
+// the GossipSubRouter and run on every incoming RPC message before the message is processed by libp2p. If the message
+// is invalid the RPC message will be dropped.
 // Implementations must:
 //   - be concurrency safe
 //   - be non-blocking
 type GossipSubRPCInspector interface {
+	collection.ClusterEvents
 	component.Component
 
 	// Name returns the name of the rpc inspector.
@@ -102,18 +106,6 @@ type GossipSubRPCInspector interface {
 	Inspect(peer.ID, *pubsub.RPC) error
 }
 
-// GossipSubMsgValidationRpcInspector abstracts the general behavior of an app specific RPC inspector specifically
-// used to inspect and validate incoming. It is used to implement custom message validation logic. It is injected into
-// the GossipSubRouter and run on every incoming RPC message before the message is processed by libp2p. If the message
-// is invalid the RPC message will be dropped.
-// Implementations must:
-//   - be concurrency safe
-//   - be non-blocking
-type GossipSubMsgValidationRpcInspector interface {
-	collection.ClusterEvents
-	GossipSubRPCInspector
-}
-
 // Topic is the abstraction of the underlying pubsub topic that is used by the Flow network.
 type Topic interface {
 	// String returns the topic name as a string.
@@ -175,6 +167,12 @@ type PubSubTracer interface {
 	component.Component
 	pubsub.RawTracer
 	RpcControlTracking
+	// DuplicateMessageCount returns the current duplicate message count for the peer.
+	// Args:
+	// - peer.ID: the peer ID.
+	// Returns:
+	// - float64: duplicate message count.
+	DuplicateMessageCount(peer.ID) float64
 	// GetLocalMeshPeers returns the list of peers in the mesh for the given topic.
 	// Args:
 	// - topic: the topic.
diff --git a/network/p2p/scoring/app_score_test.go b/network/p2p/scoring/app_score_test.go
index e373cd6ac0e..819e1f4ed2d 100644
--- a/network/p2p/scoring/app_score_test.go
+++ b/network/p2p/scoring/app_score_test.go
@@ -128,6 +128,7 @@ func TestFullGossipSubConnectivityAmongHonestNodesWithMaliciousMajority(t *testi
 	idProvider := mock.NewIdentityProvider(t)
 	defaultConfig, err := config.DefaultConfig()
 	require.NoError(t, err)
+
 	// override the default config to make the mesh tracer log more frequently
 	defaultConfig.NetworkConfig.GossipSub.RpcTracer.LocalMeshLogInterval = time.Second
 
diff --git a/network/p2p/scoring/noopConsumer.go b/network/p2p/scoring/noopConsumer.go
new file mode 100644
index 00000000000..b3eaa95ee8e
--- /dev/null
+++ b/network/p2p/scoring/noopConsumer.go
@@ -0,0 +1,19 @@
+package scoring
+
+import "github.com/onflow/flow-go/network/p2p"
+
+// NoopInvCtrlMsgNotifConsumer is a no-op implementation of the p2p.GossipSubInvCtrlMsgNotifConsumer interface.
+// It is used to consume invalid control message notifications from the GossipSub pubsub system and take no action.
+// It is mainly used for cases when the peer scoring system is disabled.
+type NoopInvCtrlMsgNotifConsumer struct {
+}
+
+func NewNoopInvCtrlMsgNotifConsumer() *NoopInvCtrlMsgNotifConsumer {
+	return &NoopInvCtrlMsgNotifConsumer{}
+}
+
+var _ p2p.GossipSubInvCtrlMsgNotifConsumer = (*NoopInvCtrlMsgNotifConsumer)(nil)
+
+func (n NoopInvCtrlMsgNotifConsumer) OnInvalidControlMessageNotification(_ *p2p.InvCtrlMsgNotif) {
+	// no-op
+}
diff --git a/network/p2p/scoring/registry.go b/network/p2p/scoring/registry.go
index 4b56de3754e..6fcaeb8e49a 100644
--- a/network/p2p/scoring/registry.go
+++ b/network/p2p/scoring/registry.go
@@ -50,6 +50,9 @@ type GossipSubAppSpecificScoreRegistry struct {
 
 	penalty p2pconfig.MisbehaviourPenalties
 
+	// getDuplicateMessageCount callback used to get a gauge of the number of duplicate messages detected for each peer.
+	getDuplicateMessageCount func(id peer.ID) float64
+
 	validator p2p.SubscriptionValidator
 
 	// scoreTTL is the time to live of the application specific score of a peer; the registry keeps a cached copy of the
@@ -62,7 +65,12 @@ type GossipSubAppSpecificScoreRegistry struct {
 	appScoreCache p2p.GossipSubApplicationSpecificScoreCache
 
 	// appScoreUpdateWorkerPool is the worker pool for handling the application specific score update of peers in a non-blocking way.
-	appScoreUpdateWorkerPool *worker.Pool[peer.ID]
+	appScoreUpdateWorkerPool  *worker.Pool[peer.ID]
+	invCtrlMsgNotifWorkerPool *worker.Pool[*p2p.InvCtrlMsgNotif]
+
+	appSpecificScoreParams    p2pconfig.ApplicationSpecificScoreParameters
+	duplicateMessageThreshold float64
+	collector                 module.GossipSubScoringRegistryMetrics
 
 	// silencePeriodDuration duration that the startup silence period will last, during which nodes will not be penalized
 	silencePeriodDuration time.Duration
@@ -70,11 +78,6 @@ type GossipSubAppSpecificScoreRegistry struct {
 	silencePeriodStartTime time.Time
 	// silencePeriodElapsed atomic bool that stores a bool flag which indicates if the silence period is over or not.
 	silencePeriodElapsed *atomic.Bool
-
-	unknownIdentityPenalty     float64
-	minAppSpecificPenalty      float64
-	stakedIdentityReward       float64
-	invalidSubscriptionPenalty float64
 }
 
 // GossipSubAppSpecificScoreRegistryConfig is the configuration for the GossipSubAppSpecificScoreRegistry.
@@ -95,6 +98,9 @@ type GossipSubAppSpecificScoreRegistryConfig struct {
 	// an authorized peer is found).
 	IdProvider module.IdentityProvider `validate:"required"`
 
+	// GetDuplicateMessageCount callback used to get a gauge of the number of duplicate messages detected for each peer.
+	GetDuplicateMessageCount func(id peer.ID) float64
+
 	// SpamRecordCacheFactory is a factory function that returns a new GossipSubSpamRecordCache. It is used to initialize the spamScoreCache.
 	// The cache is used to store the application specific penalty of peers.
 	SpamRecordCacheFactory func() p2p.GossipSubSpamRecordCache `validate:"required"`
@@ -112,6 +118,10 @@ type GossipSubAppSpecificScoreRegistryConfig struct {
 	ScoringRegistryStartupSilenceDuration time.Duration
 
 	AppSpecificScoreParams p2pconfig.ApplicationSpecificScoreParameters `validate:"required"`
+
+	DuplicateMessageThreshold float64 `validate:"gt=0"`
+
+	Collector module.GossipSubScoringRegistryMetrics `validate:"required"`
 }
 
 // NewGossipSubAppSpecificScoreRegistry returns a new GossipSubAppSpecificScoreRegistry.
@@ -130,30 +140,35 @@ func NewGossipSubAppSpecificScoreRegistry(config *GossipSubAppSpecificScoreRegis
 	}
 
 	lg := config.Logger.With().Str("module", "app_score_registry").Logger()
-	store := queue.NewHeroStore(config.Parameters.ScoreUpdateRequestQueueSize,
-		lg.With().Str("component", "app_specific_score_update").Logger(),
-		metrics.GossipSubAppSpecificScoreUpdateQueueMetricFactory(config.HeroCacheMetricsFactory, config.NetworkingType))
 
 	reg := &GossipSubAppSpecificScoreRegistry{
-		logger:                     config.Logger.With().Str("module", "app_score_registry").Logger(),
-		spamScoreCache:             config.SpamRecordCacheFactory(),
-		appScoreCache:              config.AppScoreCacheFactory(),
-		penalty:                    config.Penalty,
-		validator:                  config.Validator,
-		idProvider:                 config.IdProvider,
-		scoreTTL:                   config.Parameters.ScoreTTL,
-		silencePeriodDuration:      config.ScoringRegistryStartupSilenceDuration,
-		silencePeriodElapsed:       atomic.NewBool(false),
-		unknownIdentityPenalty:     config.AppSpecificScoreParams.UnknownIdentityPenalty,
-		minAppSpecificPenalty:      config.AppSpecificScoreParams.MinAppSpecificPenalty,
-		stakedIdentityReward:       config.AppSpecificScoreParams.StakedIdentityReward,
-		invalidSubscriptionPenalty: config.AppSpecificScoreParams.InvalidSubscriptionPenalty,
+		logger:                    config.Logger.With().Str("module", "app_score_registry").Logger(),
+		getDuplicateMessageCount:  config.GetDuplicateMessageCount,
+		spamScoreCache:            config.SpamRecordCacheFactory(),
+		appScoreCache:             config.AppScoreCacheFactory(),
+		penalty:                   config.Penalty,
+		validator:                 config.Validator,
+		idProvider:                config.IdProvider,
+		scoreTTL:                  config.Parameters.ScoreTTL,
+		silencePeriodDuration:     config.ScoringRegistryStartupSilenceDuration,
+		silencePeriodElapsed:      atomic.NewBool(false),
+		appSpecificScoreParams:    config.AppSpecificScoreParams,
+		duplicateMessageThreshold: config.DuplicateMessageThreshold,
+		collector:                 config.Collector,
 	}
 
-	reg.appScoreUpdateWorkerPool = worker.NewWorkerPoolBuilder[peer.ID](lg.With().Str("component", "app_specific_score_update_worker_pool").Logger(),
-		store,
+	appSpecificScore := queue.NewHeroStore(config.Parameters.ScoreUpdateRequestQueueSize,
+		lg.With().Str("component", "app_specific_score_update").Logger(),
+		metrics.GossipSubAppSpecificScoreUpdateQueueMetricFactory(config.HeroCacheMetricsFactory, config.NetworkingType))
+	reg.appScoreUpdateWorkerPool = worker.NewWorkerPoolBuilder[peer.ID](lg.With().Str("component", "app_specific_score_update_worker_pool").Logger(), appSpecificScore,
 		reg.processAppSpecificScoreUpdateWork).Build()
 
+	invalidCtrlMsgNotificationStore := queue.NewHeroStore(config.Parameters.InvalidControlMessageNotificationQueueSize,
+		lg.With().Str("component", "invalid_control_message_notification_queue").Logger(),
+		metrics.RpcInspectorNotificationQueueMetricFactory(config.HeroCacheMetricsFactory, config.NetworkingType),
+		queue.WithMessageEntityFactory(queue.NewMessageEntityWithNonce))
+	reg.invCtrlMsgNotifWorkerPool = worker.NewWorkerPoolBuilder[*p2p.InvCtrlMsgNotif](lg, invalidCtrlMsgNotificationStore, reg.handleMisbehaviourReport).Build()
+
 	builder := component.NewComponentManagerBuilder()
 	builder.AddWorker(func(ctx irrecoverable.SignalerContext, ready component.ReadyFunc) {
 		reg.logger.Info().Msg("starting subscription validator")
@@ -176,7 +191,7 @@ func NewGossipSubAppSpecificScoreRegistry(config *GossipSubAppSpecificScoreRegis
 		}
 		reg.silencePeriodStartTime = time.Now()
 		ready()
-	})
+	}).AddWorker(reg.invCtrlMsgNotifWorkerPool.WorkerLogic()) // we must NOT have more than one worker for processing notifications; handling notifications are NOT idempotent.
 
 	for i := 0; i < config.Parameters.ScoreUpdateWorkerNum; i++ {
 		builder.AddWorker(reg.appScoreUpdateWorkerPool.WorkerLogic())
@@ -283,7 +298,16 @@ func (r *GossipSubAppSpecificScoreRegistry) computeAppSpecificScore(pid peer.ID)
 		}
 	}
 
-	// (4) staking reward: for staked peers, a default positive reward is applied only if the peer has no penalty on spamming and subscription.
+	// (4) duplicate messages penalty: the duplicate messages penalty is applied to the application specific penalty as long
+	// as the number of duplicate messages detected for a peer is greater than 0. This counter is decayed overtime, thus sustained
+	// good behavior should eventually lead to the duplicate messages penalty applied being 0.
+	duplicateMessagesPenalty := r.duplicateMessagesPenalty(pid)
+	if duplicateMessagesPenalty < 0 {
+		lg = lg.With().Float64("duplicate_messages_penalty", duplicateMessagesPenalty).Logger()
+		appSpecificScore += duplicateMessagesPenalty
+	}
+
+	// (5) staking reward: for staked peers, a default positive reward is applied only if the peer has no penalty on spamming and subscription.
 	if stakingScore > 0 && appSpecificScore == float64(0) {
 		lg = lg.With().Float64("staking_reward", stakingScore).Logger()
 		appSpecificScore += stakingScore
@@ -292,7 +316,6 @@ func (r *GossipSubAppSpecificScoreRegistry) computeAppSpecificScore(pid peer.ID)
 	lg.Trace().
 		Float64("total_app_specific_score", appSpecificScore).
 		Msg("application specific score computed")
-
 	return appSpecificScore
 }
 
@@ -326,7 +349,7 @@ func (r *GossipSubAppSpecificScoreRegistry) stakingScore(pid peer.ID) (float64,
 			Err(err).
 			Bool(logging.KeySuspicious, true).
 			Msg("invalid peer identity, penalizing peer")
-		return r.unknownIdentityPenalty, flow.Identifier{}, 0
+		return r.appSpecificScoreParams.UnknownIdentityPenalty, flow.Identifier{}, 0
 	}
 
 	lg = lg.With().
@@ -339,13 +362,13 @@ func (r *GossipSubAppSpecificScoreRegistry) stakingScore(pid peer.ID) (float64,
 	if flowId.Role == flow.RoleAccess {
 		lg.Trace().
 			Msg("pushing access node to edge by penalizing with minimum penalty value")
-		return r.minAppSpecificPenalty, flowId.NodeID, flowId.Role
+		return r.appSpecificScoreParams.MinAppSpecificPenalty, flowId.NodeID, flowId.Role
 	}
 
 	lg.Trace().
 		Msg("rewarding well-behaved non-access node peer with maximum reward value")
 
-	return r.stakedIdentityReward, flowId.NodeID, flowId.Role
+	return r.appSpecificScoreParams.StakedIdentityReward, flowId.NodeID, flowId.Role
 }
 
 func (r *GossipSubAppSpecificScoreRegistry) subscriptionPenalty(pid peer.ID, flowId flow.Identifier, role flow.Role) float64 {
@@ -357,27 +380,63 @@ func (r *GossipSubAppSpecificScoreRegistry) subscriptionPenalty(pid peer.ID, flo
 			Hex("flow_id", logging.ID(flowId)).
 			Bool(logging.KeySuspicious, true).
 			Msg("invalid subscription detected, penalizing peer")
-		return r.invalidSubscriptionPenalty
+		return r.appSpecificScoreParams.InvalidSubscriptionPenalty
 	}
 
 	return 0
 }
 
+// duplicateMessagesPenalty returns the duplicate message penalty for a peer. A penalty is only returned if the duplicate
+// message count for a peer exceeds the DefaultDuplicateMessageThreshold. A penalty is applied for the amount of duplicate
+// messages above the DefaultDuplicateMessageThreshold.
+func (r *GossipSubAppSpecificScoreRegistry) duplicateMessagesPenalty(pid peer.ID) float64 {
+	duplicateMessageCount, duplicateMessagePenalty := 0.0, 0.0
+	defer func() {
+		r.collector.DuplicateMessagesCounts(duplicateMessageCount)
+		r.collector.DuplicateMessagePenalties(duplicateMessagePenalty)
+	}()
+
+	duplicateMessageCount = r.getDuplicateMessageCount(pid)
+	if duplicateMessageCount > r.duplicateMessageThreshold {
+		duplicateMessagePenalty = (duplicateMessageCount - r.duplicateMessageThreshold) * r.appSpecificScoreParams.DuplicateMessagePenalty
+		if duplicateMessagePenalty < r.appSpecificScoreParams.MaxAppSpecificPenalty {
+			return r.appSpecificScoreParams.MaxAppSpecificPenalty
+		}
+	}
+	return duplicateMessagePenalty
+}
+
 // OnInvalidControlMessageNotification is called when a new invalid control message notification is distributed.
 // Any error on consuming event must handle internally.
 // The implementation must be concurrency safe, but can be blocking.
+// Note: there is no real-time guarantee on processing the notification.
 func (r *GossipSubAppSpecificScoreRegistry) OnInvalidControlMessageNotification(notification *p2p.InvCtrlMsgNotif) {
-	// we use mutex to ensure the method is concurrency safe.
+	lg := r.logger.With().Str("peer_id", p2plogging.PeerId(notification.PeerID)).Logger()
+	if ok := r.invCtrlMsgNotifWorkerPool.Submit(notification); !ok {
+		// we use a queue with a fixed size, so this can happen when queue is full or when the notification is duplicate.
+		// TODO: we have to add a metric for this case.
+		// TODO: we should not have deduplication for this case, as we need to penalize the peer for each misbehaviour, we need to add a nonce to the notification.
+		lg.Warn().Msg("gossipsub rpc inspector notification queue is full or notification is duplicate, discarding notification")
+	}
+	lg.Trace().Msg("gossipsub rpc inspector notification submitted to the queue")
+}
 
+// handleMisbehaviourReport is the worker function that is called by the worker pool to handle the misbehaviour report of a peer.
+// The function is called in a non-blocking way, and the worker pool is used to limit the number of concurrent executions of the function.
+// Args:
+// - notification: the notification of the misbehaviour report of a peer.
+// Returns:
+// - error: an error if the update failed; any returned error is an irrecoverable error and indicates a bug or misconfiguration.
+func (r *GossipSubAppSpecificScoreRegistry) handleMisbehaviourReport(notification *p2p.InvCtrlMsgNotif) error {
+	// we use mutex to ensure the method is concurrency safe.
 	lg := r.logger.With().
 		Err(notification.Error).
-		Str("peer_id", p2plogging.PeerId(notification.PeerID)).
 		Str("misbehavior_type", notification.MsgType.String()).Logger()
 
 	// during startup silence period avoid penalizing nodes, ignore all notifications
 	if !r.afterSilencePeriod() {
 		lg.Trace().Msg("ignoring invalid control message notification for peer during silence period")
-		return
+		return nil
 	}
 
 	record, err := r.spamScoreCache.Adjust(notification.PeerID, func(record p2p.GossipSubSpamRecord) p2p.GossipSubSpamRecord {
@@ -393,6 +452,8 @@ func (r *GossipSubAppSpecificScoreRegistry) OnInvalidControlMessageNotification(
 			penalty += r.penalty.IWantMisbehaviour
 		case p2pmsg.RpcPublishMessage:
 			penalty += r.penalty.PublishMisbehaviour
+		case p2pmsg.CtrlMsgRPC:
+			penalty += r.penalty.PublishMisbehaviour
 		default:
 			// the error is considered fatal as it means that we have an unsupported misbehaviour type, we should crash the node to prevent routing attack vulnerability.
 			lg.Fatal().Str("misbehavior_type", notification.MsgType.String()).Msg("unknown misbehaviour type")
@@ -415,6 +476,8 @@ func (r *GossipSubAppSpecificScoreRegistry) OnInvalidControlMessageNotification(
 	lg.Debug().
 		Float64("spam_record_penalty", record.Penalty).
 		Msg("applied misbehaviour penalty and updated application specific penalty")
+
+	return nil
 }
 
 // afterSilencePeriod returns true if registry silence period is over, false otherwise.
diff --git a/network/p2p/scoring/registry_test.go b/network/p2p/scoring/registry_test.go
index ce5a522c17c..b4687335485 100644
--- a/network/p2p/scoring/registry_test.go
+++ b/network/p2p/scoring/registry_test.go
@@ -44,9 +44,10 @@ func TestScoreRegistry_FreshStart(t *testing.T) {
 	// refresh cached app-specific score every 100 milliseconds to speed up the test.
 	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 100 * time.Millisecond
 
+	maximumSpamPenaltyDecayFactor := cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor
 	reg, spamRecords, appScoreCache := newGossipSubAppSpecificScoreRegistry(t,
 		cfg.NetworkConfig.GossipSub.ScoringParameters,
-		scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor),
+		scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor),
 		withStakedIdentities(peerID),
 		withValidSubscriptions(peerID))
 	ctx, cancel := context.WithCancel(context.Background())
@@ -131,9 +132,10 @@ func testScoreRegistryPeerWithSpamRecord(t *testing.T, messageType p2pmsg.Contro
 	// refresh cached app-specific score every 100 milliseconds to speed up the test.
 	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 10 * time.Millisecond
 
+	maximumSpamPenaltyDecayFactor := cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor
 	reg, spamRecords, appScoreCache := newGossipSubAppSpecificScoreRegistry(t,
 		cfg.NetworkConfig.GossipSub.ScoringParameters,
-		scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor),
+		scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor),
 		withStakedIdentities(peerID),
 		withValidSubscriptions(peerID))
 	ctx, cancel := context.WithCancel(context.Background())
@@ -167,29 +169,31 @@ func testScoreRegistryPeerWithSpamRecord(t *testing.T, messageType p2pmsg.Contro
 		MsgType: messageType,
 	})
 
-	// the penalty should now be updated in the spamRecords
-	record, err, ok := spamRecords.Get(peerID) // get the record from the spamRecords.
-	assert.True(t, ok)
-	assert.NoError(t, err)
-	assert.Less(t, math.Abs(expectedPenalty-record.Penalty), 10e-3)                                                                                                                                         // penalty should be updated to -10.
-	assert.Equal(t, scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor)().Decay, record.Decay) // decay should be initialized to the initial state.
-
 	queryTime := time.Now()
-	// eventually, the app specific score should be updated in the cache.
 	require.Eventually(t, func() bool {
-		// calling the app specific score function when there is no app specific score in the cache should eventually update the cache.
-		score := reg.AppSpecificScoreFunc()(peerID)
+		// the notification is processed asynchronously, and the penalty should eventually be updated in the spamRecords
+		record, err, ok := spamRecords.Get(peerID) // get the record from the spamRecords.
+		if !ok {
+			return false
+		}
+		require.NoError(t, err)
+		if !unittest.AreNumericallyClose(expectedPenalty, record.Penalty, 10e-2) {
+			return false
+		}
+		require.Equal(t, scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor)().Decay, record.Decay) // decay should be initialized to the initial state.
+
+		// eventually, the app specific score should be updated in the cache.
 		// this peer has a spam record, with no subscription penalty. Hence, the app specific score should only be the spam penalty,
 		// and the peer should be deprived of the default reward for its valid staked role.
-		// As the app specific score in the cache and spam penalty in the spamRecords are updated at different times, we account for 0.1% error.
-		return math.Abs(expectedPenalty-score)/math.Max(expectedPenalty, score) < 0.001
-	}, 5*time.Second, 100*time.Millisecond)
+		// As the app specific score in the cache and spam penalty in the spamRecords are updated at different times, we account for 5% error.
+		return unittest.AreNumericallyClose(expectedPenalty, reg.AppSpecificScoreFunc()(peerID), 0.05)
+	}, 5*time.Second, 10*time.Millisecond)
 
 	// the app specific score should now be updated in the cache.
 	score, updated, exists = appScoreCache.Get(peerID) // get the score from the cache.
 	require.True(t, exists)
 	require.True(t, updated.After(queryTime))
-	require.True(t, math.Abs(expectedPenalty-score)/math.Max(expectedPenalty, score) < 0.001)
+	require.True(t, unittest.AreNumericallyClose(expectedPenalty, score, 0.1)) // account for maximum 10% error due to decays and asynchrony.
 
 	// stop the registry.
 	cancel()
@@ -234,10 +238,10 @@ func testScoreRegistrySpamRecordWithUnknownIdentity(t *testing.T, messageType p2
 	require.NoError(t, err)
 	// refresh cached app-specific score every 100 milliseconds to speed up the test.
 	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 100 * time.Millisecond
-
+	maximumSpamPenaltyDecayFactor := cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor
 	reg, spamRecords, appScoreCache := newGossipSubAppSpecificScoreRegistry(t,
 		cfg.NetworkConfig.GossipSub.ScoringParameters,
-		scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor),
+		scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor),
 		withUnknownIdentity(peerID),
 		withValidSubscriptions(peerID))
 	ctx, cancel := context.WithCancel(context.Background())
@@ -271,31 +275,33 @@ func testScoreRegistrySpamRecordWithUnknownIdentity(t *testing.T, messageType p2
 		MsgType: messageType,
 	})
 
-	// the penalty should now be updated.
-	record, err, ok := spamRecords.Get(peerID) // get the record from the spamRecords.
-	require.True(t, ok)
-	require.NoError(t, err)
-	require.Less(t, math.Abs(expectedPenalty-record.Penalty), 10e-3)                                                                                                                                         // penalty should be updated to -10, we account for decay.
-	require.Equal(t, scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor)().Decay, record.Decay) // decay should be initialized to the initial state.
-
 	queryTime := time.Now()
-	// eventually, the app specific score should be updated in the cache.
 	require.Eventually(t, func() bool {
-		// calling the app specific score function when there is no app specific score in the cache should eventually update the cache.
-		score := reg.AppSpecificScoreFunc()(peerID)
+		// the notification is processed asynchronously, and the penalty should eventually be updated in the spamRecords
+		record, err, ok := spamRecords.Get(peerID) // get the record from the spamRecords.
+		if !ok {
+			return false
+		}
+		require.NoError(t, err)
+		if !unittest.AreNumericallyClose(expectedPenalty, record.Penalty, 10e-2) {
+			return false
+		}
+		require.Equal(t, scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor)().Decay, record.Decay) // decay should be initialized to the initial state.
+
+		// eventually, the app specific score should be updated in the cache.
 		// the peer has spam record as well as an unknown identity. Hence, the app specific score should be the spam penalty
 		// and the staking penalty.
-		// As the app specific score in the cache and spam penalty in the spamRecords are updated at different times, we account for 0.1% error.
-		return unittest.AreNumericallyClose(expectedPenalty+scoreOptParameters.UnknownIdentityPenalty, score, 0.01)
-	}, 5*time.Second, 10*time.Millisecond)
+		// As the app specific score in the cache and spam penalty in the spamRecords are updated at different times, we account for 5% error.
+		return unittest.AreNumericallyClose(expectedPenalty+scoreOptParameters.UnknownIdentityPenalty, reg.AppSpecificScoreFunc()(peerID), 0.05)
+	}, 5*time.Second, 100*time.Millisecond)
 
 	// the app specific score should now be updated in the cache.
 	score, updated, exists = appScoreCache.Get(peerID) // get the score from the cache.
 	require.True(t, exists)
+	fmt.Println("updated", updated, "queryTime", queryTime)
 	require.True(t, updated.After(queryTime))
-
-	unittest.RequireNumericallyClose(t, expectedPenalty+scoreOptParameters.UnknownIdentityPenalty, score, 0.01)
-	assert.Equal(t, scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor)().Decay, record.Decay) // decay should be initialized to the initial state.
+	fmt.Println("score", score, "expected", expectedPenalty+scoreOptParameters.UnknownIdentityPenalty)
+	unittest.RequireNumericallyClose(t, expectedPenalty+scoreOptParameters.UnknownIdentityPenalty, score, 0.1) // account for maximum 10% error due to decays and asynchrony.
 
 	// stop the registry.
 	cancel()
@@ -341,10 +347,10 @@ func testScoreRegistrySpamRecordWithSubscriptionPenalty(t *testing.T, messageTyp
 	require.NoError(t, err)
 	// refresh cached app-specific score every 100 milliseconds to speed up the test.
 	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 100 * time.Millisecond
-
+	maximumSpamPenaltyDecayFactor := cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor
 	reg, spamRecords, appScoreCache := newGossipSubAppSpecificScoreRegistry(t,
 		cfg.NetworkConfig.GossipSub.ScoringParameters,
-		scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor),
+		scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor),
 		withStakedIdentities(peerID),
 		withInvalidSubscriptions(peerID))
 	ctx, cancel := context.WithCancel(context.Background())
@@ -378,29 +384,256 @@ func testScoreRegistrySpamRecordWithSubscriptionPenalty(t *testing.T, messageTyp
 		MsgType: messageType,
 	})
 
-	// the penalty should now be updated.
-	record, err, ok := spamRecords.Get(peerID) // get the record from the spamRecords.
-	assert.True(t, ok)
-	assert.NoError(t, err)
-	assert.Less(t, math.Abs(expectedPenalty-record.Penalty), 10e-3)
-	assert.Equal(t, scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor)().Decay, record.Decay) // decay should be initialized to the initial state.
-
 	queryTime := time.Now()
+	require.Eventually(t, func() bool {
+		// the notification is processed asynchronously, and the penalty should eventually be updated in the spamRecords
+		record, err, ok := spamRecords.Get(peerID) // get the record from the spamRecords.
+		if !ok {
+			return false
+		}
+		require.NoError(t, err)
+		if !unittest.AreNumericallyClose(expectedPenalty, record.Penalty, 10e-2) {
+			return false
+		}
+		require.Equal(t, scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor)().Decay, record.Decay) // decay should be initialized to the initial state.
+
+		// eventually, the app specific score should be updated in the cache.
+		// the peer has spam record as well as an unknown identity. Hence, the app specific score should be the spam penalty
+		// and the staking penalty.
+		// As the app specific score in the cache and spam penalty in the spamRecords are updated at different times, we account for 5% error.
+		return unittest.AreNumericallyClose(expectedPenalty+scoreOptParameters.InvalidSubscriptionPenalty, reg.AppSpecificScoreFunc()(peerID), 0.05)
+	}, 5*time.Second, 100*time.Millisecond)
+
+	// the app specific score should now be updated in the cache.
+	score, updated, exists = appScoreCache.Get(peerID) // get the score from the cache.
+	require.True(t, exists)
+	require.True(t, updated.After(queryTime))
+	unittest.RequireNumericallyClose(t, expectedPenalty+scoreOptParameters.InvalidSubscriptionPenalty, score, 0.1) // account for maximum 10% error due to decays and asynchrony.
+
+	// stop the registry.
+	cancel()
+	unittest.RequireCloseBefore(t, reg.Done(), 1*time.Second, "failed to stop GossipSubAppSpecificScoreRegistry")
+}
+
+// TestScoreRegistry_SpamRecordWithDuplicateMessagesPenalty is a test suite for verifying the behavior of the ScoreRegistry
+// in handling spam records when duplicate messages penalty is applied. It encompasses a series of sub-tests, each focusing on
+// a different control message type: graft, prune, ihave, iwant, and RpcPublishMessage. These sub-tests are designed to
+// validate the appropriate application of penalties in the ScoreRegistry when a peer has sent duplicate messages.
+func TestScoreRegistry_SpamRecordWithDuplicateMessagesPenalty(t *testing.T) {
+	t.Run("graft", func(t *testing.T) {
+		testScoreRegistrySpamRecordWithDuplicateMessagesPenalty(t, p2pmsg.CtrlMsgGraft, penaltyValueFixtures().GraftMisbehaviour)
+	})
+	t.Run("prune", func(t *testing.T) {
+		testScoreRegistrySpamRecordWithDuplicateMessagesPenalty(t, p2pmsg.CtrlMsgPrune, penaltyValueFixtures().PruneMisbehaviour)
+	})
+	t.Run("ihave", func(t *testing.T) {
+		testScoreRegistrySpamRecordWithDuplicateMessagesPenalty(t, p2pmsg.CtrlMsgIHave, penaltyValueFixtures().IHaveMisbehaviour)
+	})
+	t.Run("iwant", func(t *testing.T) {
+		testScoreRegistrySpamRecordWithDuplicateMessagesPenalty(t, p2pmsg.CtrlMsgIWant, penaltyValueFixtures().IWantMisbehaviour)
+	})
+	t.Run("RpcPublishMessage", func(t *testing.T) {
+		testScoreRegistrySpamRecordWithDuplicateMessagesPenalty(t, p2pmsg.RpcPublishMessage, penaltyValueFixtures().PublishMisbehaviour)
+	})
+}
+
+// testScoreRegistryPeerDuplicateMessagesPenalty conducts an individual test within the TestScoreRegistry_SpamRecordWithDuplicateMessagesPenalty suite.
+// It evaluates the ScoreRegistry's handling of a staked peer with valid subscriptions and when a  record is present for
+// the peer ID, and the peer has sent some duplicate messages. The function simulates the process of starting the registry, recording a misbehavior, receiving duplicate messages tracked via
+// the mesh tracer duplicate messages tracker, and then verifying the expected app specific score.
+// Parameters:
+// - t *testing.T: The test context.
+// - messageType p2pmsg.ControlMessageType: The type of control message being tested.
+// - expectedPenalty float64: The expected penalty value for the given control message type.
+// The function focuses on evaluating the registry's response to spam activities (as represented by control messages) from a
+// peer that has sent duplicate messages. It verifies that penalties are accurately computed and applied, taking into account both
+// the spam record and the duplicate message's penalty.
+func testScoreRegistrySpamRecordWithDuplicateMessagesPenalty(t *testing.T, messageType p2pmsg.ControlMessageType, expectedPenalty float64) {
+	peerID := unittest.PeerIdFixture(t)
+	cfg, err := config.DefaultConfig()
+	require.NoError(t, err)
+	// refresh cached app-specific score every 100 milliseconds to speed up the test.
+	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 10 * time.Millisecond
+	duplicateMessageThreshold := cfg.NetworkConfig.GossipSub.ScoringParameters.PeerScoring.Protocol.AppSpecificScore.DuplicateMessageThreshold
+	duplicateMessagePenalty := cfg.NetworkConfig.GossipSub.ScoringParameters.PeerScoring.Protocol.AppSpecificScore.DuplicateMessagePenalty
+	maximumSpamPenaltyDecayFactor := cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor
+	duplicateMessagesCount := 10000.0
+	reg, spamRecords, appScoreCache := newGossipSubAppSpecificScoreRegistry(t, cfg.NetworkConfig.GossipSub.ScoringParameters,
+		scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor),
+		withStakedIdentities(peerID),
+		withValidSubscriptions(peerID),
+		func(registryConfig *scoring.GossipSubAppSpecificScoreRegistryConfig) {
+			registryConfig.GetDuplicateMessageCount = func(_ peer.ID) float64 {
+				// we add the duplicate message threshold so that penalization is triggered
+				return duplicateMessagesCount + duplicateMessageThreshold
+			}
+		})
+
+	// starts the registry.
+	ctx, cancel := context.WithCancel(context.Background())
+	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
+	reg.Start(signalerCtx)
+	unittest.RequireCloseBefore(t, reg.Ready(), 1*time.Second, "failed to start GossipSubAppSpecificScoreRegistry")
+
+	// initially, the spamRecords should not have the peer id; also the app specific score record should not be in the cache.
+	require.False(t, spamRecords.Has(peerID))
+	score, updated, exists := appScoreCache.Get(peerID) // get the score from the cache.
+	require.False(t, exists)
+	require.Equal(t, time.Time{}, updated)
+	require.Equal(t, float64(0), score)
+
+	expectedDuplicateMessagesPenalty := duplicateMessagesCount * duplicateMessagePenalty
 	// eventually, the app specific score should be updated in the cache.
 	require.Eventually(t, func() bool {
 		// calling the app specific score function when there is no app specific score in the cache should eventually update the cache.
 		score := reg.AppSpecificScoreFunc()(peerID)
-		// the peer has spam record as well as an unknown identity. Hence, the app specific score should be the spam penalty
-		// and the staking penalty.
-		// As the app specific score in the cache and spam penalty in the spamRecords are updated at different times, we account for 0.1% error.
-		return unittest.AreNumericallyClose(expectedPenalty+scoreOptParameters.InvalidSubscriptionPenalty, score, 0.01)
+		// since the peer id does no other penalties the score is eventually expected to be the expected penalty for 10000 duplicate messages
+		return score == expectedDuplicateMessagesPenalty
+	}, 5*time.Second, 100*time.Millisecond)
+
+	// report a misbehavior for the peer id.
+	reg.OnInvalidControlMessageNotification(&p2p.InvCtrlMsgNotif{
+		PeerID:  peerID,
+		MsgType: messageType,
+	})
+
+	queryTime := time.Now()
+	require.Eventually(t, func() bool {
+		// the notification is processed asynchronously, and the penalty should eventually be updated in the spamRecords
+		record, err, ok := spamRecords.Get(peerID) // get the record from the spamRecords.
+		if !ok {
+			return false
+		}
+		require.NoError(t, err)
+		if !unittest.AreNumericallyClose(expectedPenalty, record.Penalty, 10e-2) {
+			return false
+		}
+		require.Equal(t, scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor)().Decay, record.Decay) // decay should be initialized to the initial state.
+
+		// eventually, the app specific score should be updated in the cache.
+		// As the app specific score in the cache and spam penalty in the spamRecords are updated at different times, we account for 5% error.
+		return unittest.AreNumericallyClose(expectedPenalty+expectedDuplicateMessagesPenalty, reg.AppSpecificScoreFunc()(peerID), 0.05)
+	}, 5*time.Second, 100*time.Millisecond)
+
+	// the app specific score should now be updated in the cache.
+	score, updated, exists = appScoreCache.Get(peerID) // get the score from the cache.
+	require.True(t, exists)
+	require.True(t, updated.After(queryTime))
+	unittest.RequireNumericallyClose(t, expectedPenalty+expectedDuplicateMessagesPenalty, score, 0.1) // account for maximum 10% error due to decays and asynchrony.
+
+	// stop the registry.
+	cancel()
+	unittest.RequireCloseBefore(t, reg.Done(), 1*time.Second, "failed to stop GossipSubAppSpecificScoreRegistry")
+}
+
+// TestScoreRegistry_SpamRecordWithoutDuplicateMessagesPenalty is a test suite for verifying the behavior of the ScoreRegistry
+// in handling spam records when duplicate messages exist but do not exceed the scoring.DefaultDuplicateMessageThreshold no penalty is applied.
+// It encompasses a series of sub-tests, each focusing on a different control message type: graft, prune, ihave, iwant, and RpcPublishMessage. These sub-tests are designed to
+// validate the appropriate application of penalties in the ScoreRegistry when a peer has sent duplicate messages.
+func TestScoreRegistry_SpamRecordWithoutDuplicateMessagesPenalty(t *testing.T) {
+	t.Run("graft", func(t *testing.T) {
+		testScoreRegistrySpamRecordWithoutDuplicateMessagesPenalty(t, p2pmsg.CtrlMsgGraft, penaltyValueFixtures().GraftMisbehaviour)
+	})
+	t.Run("prune", func(t *testing.T) {
+		testScoreRegistrySpamRecordWithoutDuplicateMessagesPenalty(t, p2pmsg.CtrlMsgPrune, penaltyValueFixtures().PruneMisbehaviour)
+	})
+	t.Run("ihave", func(t *testing.T) {
+		testScoreRegistrySpamRecordWithoutDuplicateMessagesPenalty(t, p2pmsg.CtrlMsgIHave, penaltyValueFixtures().IHaveMisbehaviour)
+	})
+	t.Run("iwant", func(t *testing.T) {
+		testScoreRegistrySpamRecordWithoutDuplicateMessagesPenalty(t, p2pmsg.CtrlMsgIWant, penaltyValueFixtures().IWantMisbehaviour)
+	})
+	t.Run("RpcPublishMessage", func(t *testing.T) {
+		testScoreRegistrySpamRecordWithoutDuplicateMessagesPenalty(t, p2pmsg.RpcPublishMessage, penaltyValueFixtures().PublishMisbehaviour)
+	})
+}
+
+// testScoreRegistrySpamRecordWithoutDuplicateMessagesPenalty conducts an individual test within the TestScoreRegistry_SpamRecordWithoutDuplicateMessagesPenalty suite.
+// It evaluates the ScoreRegistry's handling of a staked peer with valid subscriptions and when a  record is present for
+// the peer ID, and the peer has sent some duplicate messages. The function simulates the process of starting the registry, recording a misbehavior, receiving duplicate messages tracked via
+// the mesh tracer duplicate messages tracker, and then verifying the expected app specific score.
+// Parameters:
+// - t *testing.T: The test context.
+// - messageType p2pmsg.ControlMessageType: The type of control message being tested.
+// The function focuses on evaluating the registry's response to spam activities (as represented by control messages) from a
+// peer that has sent duplicate messages. It verifies that duplicate message penalty is not applied if the duplicate message count for a peer
+// does not exceed scoring.DefaultDuplicateMessageThreshold.
+func testScoreRegistrySpamRecordWithoutDuplicateMessagesPenalty(t *testing.T, messageType p2pmsg.ControlMessageType, expectedPenalty float64) {
+	peerID := unittest.PeerIdFixture(t)
+	cfg, err := config.DefaultConfig()
+	require.NoError(t, err)
+	// refresh cached app-specific score every 100 milliseconds to speed up the test.
+	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 10 * time.Millisecond
+	duplicateMessageThreshold := cfg.NetworkConfig.GossipSub.ScoringParameters.PeerScoring.Protocol.AppSpecificScore.DuplicateMessagePenalty
+	maximumSpamPenaltyDecayFactor := cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor
+	reg, spamRecords, appScoreCache := newGossipSubAppSpecificScoreRegistry(t, cfg.NetworkConfig.GossipSub.ScoringParameters,
+		scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor),
+		withStakedIdentities(peerID),
+		withValidSubscriptions(peerID),
+		func(registryConfig *scoring.GossipSubAppSpecificScoreRegistryConfig) {
+			registryConfig.GetDuplicateMessageCount = func(_ peer.ID) float64 {
+				// duplicate message count never exceeds scoring.DefaultDuplicateMessageThreshold so a penalty should never be applied
+				return duplicateMessageThreshold - 1
+			}
+		})
+
+	// starts the registry.
+	ctx, cancel := context.WithCancel(context.Background())
+	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
+	reg.Start(signalerCtx)
+	unittest.RequireCloseBefore(t, reg.Ready(), 1*time.Second, "failed to start GossipSubAppSpecificScoreRegistry")
+
+	// initially, the spamRecords should not have the peer id; also the app specific score record should not be in the cache.
+	require.False(t, spamRecords.Has(peerID))
+	score, updated, exists := appScoreCache.Get(peerID) // get the score from the cache.
+	require.False(t, exists)
+	require.Equal(t, time.Time{}, updated)
+	require.Equal(t, float64(0), score)
+
+	// initial score will be 0 subsequent calls to get app specific score
+	// should reward the peer with the scoring.MaxAppSpecificPenalty for not having any spam record, staking, or subscription penalties
+	score = reg.AppSpecificScoreFunc()(peerID)
+	require.Equal(t, 0.0, score)
+
+	// app specific score should not be effected by duplicate messages count
+	require.Never(t, func() bool {
+		score := reg.AppSpecificScoreFunc()(peerID)
+		return score != cfg.NetworkConfig.GossipSub.ScoringParameters.PeerScoring.Protocol.AppSpecificScore.MaxAppSpecificReward
+	}, 5*time.Second, 10*time.Millisecond)
+
+	// report a misbehavior for the peer id.
+	reg.OnInvalidControlMessageNotification(&p2p.InvCtrlMsgNotif{
+		PeerID:  peerID,
+		MsgType: messageType,
+	})
+
+	require.Eventually(t, func() bool {
+		// the notification is processed asynchronously, and the penalty should eventually be updated in the spamRecords
+		record, err, ok := spamRecords.Get(peerID) // get the record from the spamRecords.
+		if !ok {
+			return false
+		}
+		require.NoError(t, err)
+		if !unittest.AreNumericallyClose(expectedPenalty, record.Penalty, 10e-2) {
+			return false
+		}
+		require.Equal(t, scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor)().Decay, record.Decay) // decay should be initialized to the initial state.
+
+		return true
+	}, 5*time.Second, 10*time.Millisecond)
+
+	queryTime := time.Now()
+	// eventually, the app specific score should be updated in the cache.
+	require.Eventually(t, func() bool {
+		score := reg.AppSpecificScoreFunc()(peerID)
+		return unittest.AreNumericallyClose(expectedPenalty, score, 0.2)
 	}, 5*time.Second, 10*time.Millisecond)
 
 	// the app specific score should now be updated in the cache.
 	score, updated, exists = appScoreCache.Get(peerID) // get the score from the cache.
 	require.True(t, exists)
 	require.True(t, updated.After(queryTime))
-	unittest.RequireNumericallyClose(t, expectedPenalty+scoreOptParameters.InvalidSubscriptionPenalty, score, 0.01)
+	unittest.RequireNumericallyClose(t, expectedPenalty, score, 0.01)
 
 	// stop the registry.
 	cancel()
@@ -414,10 +647,10 @@ func TestScoreRegistry_SpamPenaltyDecaysInCache(t *testing.T) {
 	require.NoError(t, err)
 	// refresh cached app-specific score every 100 milliseconds to speed up the test.
 	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 100 * time.Millisecond
-
+	maximumSpamPenaltyDecayFactor := cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor
 	reg, _, _ := newGossipSubAppSpecificScoreRegistry(t,
 		cfg.NetworkConfig.GossipSub.ScoringParameters,
-		scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor),
+		scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor),
 		withStakedIdentities(peerID),
 		withValidSubscriptions(peerID))
 	ctx, cancel := context.WithCancel(context.Background())
@@ -471,7 +704,7 @@ func TestScoreRegistry_SpamPenaltyDecaysInCache(t *testing.T) {
 		penaltyValueFixtures().PublishMisbehaviour
 	// the lower bound is the sum of the penalties with decay assuming the decay is applied 4 times to the sum of the penalties.
 	// in reality, the decay is applied 4 times to the first penalty, then 3 times to the second penalty, and so on.
-	r := scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor)()
+	r := scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor)()
 	scoreLowerBound := scoreUpperBound * math.Pow(r.Decay, 4)
 
 	// eventually, the app specific score should be updated in the cache.
@@ -715,12 +948,12 @@ func TestScoreRegistry_TestSpamRecordDecayAdjustment(t *testing.T) {
 	// increase configured DecayRateReductionFactor so that the decay time is increased faster
 	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.DecayRateReductionFactor = .1
 	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.PenaltyDecayEvaluationPeriod = time.Second
-
+	maximumSpamPenaltyDecayFactor := cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor
 	peer1 := unittest.PeerIdFixture(t)
 	peer2 := unittest.PeerIdFixture(t)
 	reg, spamRecords, _ := newGossipSubAppSpecificScoreRegistry(t,
 		cfg.NetworkConfig.GossipSub.ScoringParameters,
-		scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor),
+		scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor),
 		withStakedIdentities(peer1, peer2),
 		withValidSubscriptions(peer1, peer2))
 
@@ -746,15 +979,22 @@ func TestScoreRegistry_TestSpamRecordDecayAdjustment(t *testing.T) {
 	// for a spam record should be reduced to the MinimumSpamPenaltyDecayFactor
 	prevDecay := scoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor
 	tolerance := 0.1
+
 	require.Eventually(t, func() bool {
 		reg.OnInvalidControlMessageNotification(&p2p.InvCtrlMsgNotif{
 			PeerID:  peer1,
 			MsgType: p2pmsg.CtrlMsgPrune,
 		})
+
+		// the spam penalty should eventually updated in the spamRecords
 		record, err, ok := spamRecords.Get(peer1)
 		require.NoError(t, err)
-		require.True(t, ok)
-		assert.Less(t, math.Abs(prevDecay-record.Decay), tolerance)
+		if !ok {
+			return false
+		}
+		if math.Abs(prevDecay-record.Decay) > tolerance {
+			return false
+		}
 		prevDecay = record.Decay
 		return record.Decay == scoringRegistryParameters.SpamRecordCache.Decay.MinimumSpamPenaltyDecayFactor
 	}, 5*time.Second, 500*time.Millisecond)
@@ -764,6 +1004,14 @@ func TestScoreRegistry_TestSpamRecordDecayAdjustment(t *testing.T) {
 		PeerID:  peer2,
 		MsgType: p2pmsg.CtrlMsgPrune,
 	})
+
+	// eventually the spam record should appear in the cache
+	require.Eventually(t, func() bool {
+		_, err, ok := spamRecords.Get(peer2)
+		require.NoError(t, err)
+		return ok
+	}, 5*time.Second, 10*time.Millisecond)
+
 	// reduce penalty and increase Decay to scoring.MinimumSpamPenaltyDecayFactor
 	record, err := spamRecords.Adjust(peer2, func(record p2p.GossipSubSpamRecord) p2p.GossipSubSpamRecord {
 		record.Penalty = -.1
@@ -792,9 +1040,12 @@ func TestScoreRegistry_TestSpamRecordDecayAdjustment(t *testing.T) {
 			PeerID:  peer2,
 			MsgType: p2pmsg.CtrlMsgPrune,
 		})
+		// the spam penalty should eventually updated in the spamRecords
 		record, err, ok := spamRecords.Get(peer1)
 		require.NoError(t, err)
-		require.True(t, ok)
+		if !ok {
+			return false
+		}
 		return record.Decay == scoringRegistryParameters.SpamRecordCache.Decay.MinimumSpamPenaltyDecayFactor
 	}, 5*time.Second, 500*time.Millisecond)
 
@@ -815,10 +1066,10 @@ func TestPeerSpamPenaltyClusterPrefixed(t *testing.T) {
 	require.NoError(t, err)
 	// refresh cached app-specific score every 100 milliseconds to speed up the test.
 	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 100 * time.Millisecond
-
+	maximumSpamPenaltyDecayFactor := cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor
 	reg, spamRecords, _ := newGossipSubAppSpecificScoreRegistry(t,
 		cfg.NetworkConfig.GossipSub.ScoringParameters,
-		scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor),
+		scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor),
 		withStakedIdentities(peerIds...),
 		withValidSubscriptions(peerIds...))
 
@@ -873,16 +1124,24 @@ func TestPeerSpamPenaltyClusterPrefixed(t *testing.T) {
 		// expected penalty should be penaltyValueFixtures().GraftMisbehaviour * (1  + clusterReductionFactor)
 		expectedPenalty := penaltyValueFixture(ctlMsgType) * (1 + penaltyValueFixtures().ClusterPrefixedReductionFactor)
 
-		// the penalty should now be updated in the spamRecords
-		record, err, ok := spamRecords.Get(peerID) // get the record from the spamRecords.
-		assert.True(t, ok)
-		assert.NoError(t, err)
-		assert.Less(t, math.Abs(expectedPenalty-record.Penalty), 10e-3)
-		assert.Equal(t, scoring.InitAppScoreRecordStateFunc(cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor)().Decay, record.Decay)
+		require.Eventually(t, func() bool {
+			// the notification is processed asynchronously, and the penalty should eventually be updated in the spamRecords
+			record, err, ok := spamRecords.Get(peerID) // get the record from the spamRecords.
+			if !ok {
+				return false
+			}
+			require.NoError(t, err)
+			if !unittest.AreNumericallyClose(expectedPenalty, record.Penalty, 10e-2) {
+				return false
+			}
+			require.Equal(t, scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor)().Decay, record.Decay) // decay should be initialized to the initial state.
+			return true
+		}, 5*time.Second, 100*time.Millisecond)
+
 		// this peer has a spam record, with no subscription penalty. Hence, the app specific score should only be the spam penalty,
 		// and the peer should be deprived of the default reward for its valid staked role.
 		score := reg.AppSpecificScoreFunc()(peerID)
-		tolerance := 10e-3 // 0.1%
+		tolerance := 0.02 // 0.1%
 		if expectedPenalty == 0 {
 			assert.Less(t, math.Abs(expectedPenalty), tolerance)
 		} else {
@@ -912,8 +1171,9 @@ func TestScoringRegistrySilencePeriod(t *testing.T) {
 
 	cfg, err := config.DefaultConfig()
 	require.NoError(t, err)
-	// refresh cached app-specific score every 100 milliseconds to speed up the test.
-	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 100 * time.Millisecond
+	// refresh cached app-specific score every 10 milliseconds to speed up the test.
+	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 10 * time.Millisecond
+	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor = .99
 	maximumSpamPenaltyDecayFactor := cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor
 	reg, spamRecords, _ := newGossipSubAppSpecificScoreRegistry(t,
 		cfg.NetworkConfig.GossipSub.ScoringParameters,
@@ -967,26 +1227,24 @@ func TestScoringRegistrySilencePeriod(t *testing.T) {
 		return invalidSubscriptionPenalty == reg.AppSpecificScoreFunc()(peerID)
 	}, 2*time.Second, 200*time.Millisecond)
 
-	// after silence period the peer has spam record as well as an unknown identity. Hence, the app specific score should be the spam penalty
+	// after silence period the peer has spam record as well as an unknown identity. Hence, the app specific score should be the spam penalty—
 	// and the staking penalty.
 	reg.OnInvalidControlMessageNotification(&p2p.InvCtrlMsgNotif{
 		PeerID:  peerID,
 		MsgType: p2pmsg.CtrlMsgGraft,
 	})
+
+	require.Eventually(t, func() bool {
+		return spamRecords.Has(peerID)
+	}, time.Second, 100*time.Millisecond)
+
 	// the penalty should now be applied and spam records created.
 	record, err, ok := spamRecords.Get(peerID)
 	assert.True(t, ok)
 	assert.NoError(t, err)
 	expectedPenalty := penaltyValueFixtures().GraftMisbehaviour
-	assert.Less(t, math.Abs(expectedPenalty-record.Penalty), 10e-3)
+	unittest.RequireNumericallyClose(t, expectedPenalty, record.Penalty, 10e-3)
 	assert.Equal(t, scoring.InitAppScoreRecordStateFunc(maximumSpamPenaltyDecayFactor)().Decay, record.Decay) // decay should be initialized to the initial state.
-
-	require.Eventually(t, func() bool {
-		// we expect to have logged a debug message for all notifications ignored.
-		require.Equal(t, int32(expectedNumOfSilencedNotif), silencedNotificationLogs.Load())
-		// after silence period the invalid subscription penalty should be applied to the app specific score
-		return invalidSubscriptionPenalty+expectedPenalty-reg.AppSpecificScoreFunc()(peerID) < 0.1
-	}, 2*time.Second, 200*time.Millisecond)
 }
 
 // withStakedIdentities returns a function that sets the identity provider to return staked identities for the given peer ids.
@@ -1103,10 +1361,15 @@ func newGossipSubAppSpecificScoreRegistry(t *testing.T,
 		SpamRecordCacheFactory: func() p2p.GossipSubSpamRecordCache {
 			return cache
 		},
+		GetDuplicateMessageCount: func(id peer.ID) float64 {
+			return 0
+		},
 		Parameters:                            params.ScoringRegistryParameters.AppSpecificScore,
 		HeroCacheMetricsFactory:               metrics.NewNoopHeroCacheMetricsFactory(),
 		NetworkingType:                        network.PrivateNetwork,
 		AppSpecificScoreParams:                params.PeerScoring.Protocol.AppSpecificScore,
+		DuplicateMessageThreshold:             params.PeerScoring.Protocol.AppSpecificScore.DuplicateMessageThreshold,
+		Collector:                             metrics.NewNoopCollector(),
 		ScoringRegistryStartupSilenceDuration: 0, // turn off silence period by default
 	}
 	for _, opt := range opts {
diff --git a/network/p2p/scoring/score_option.go b/network/p2p/scoring/score_option.go
index 07b948d975e..3136478176b 100644
--- a/network/p2p/scoring/score_option.go
+++ b/network/p2p/scoring/score_option.go
@@ -33,17 +33,19 @@ type ScoreOption struct {
 	defaultTopicScoreParams *pubsub.TopicScoreParams
 	validator               p2p.SubscriptionValidator
 	appScoreFunc            func(peer.ID) float64
+	appScoreRegistry        *GossipSubAppSpecificScoreRegistry
 }
 
 type ScoreOptionConfig struct {
-	logger                           zerolog.Logger
-	params                           p2pconfig.ScoringParameters
-	provider                         module.IdentityProvider
-	heroCacheMetricsFactory          metrics.HeroCacheMetricsFactory
-	appScoreFunc                     func(peer.ID) float64
-	topicParams                      []func(map[string]*pubsub.TopicScoreParams)
-	registerNotificationConsumerFunc func(p2p.GossipSubInvCtrlMsgNotifConsumer)
-	networkingType                   network.NetworkingType
+	logger                          zerolog.Logger
+	params                          p2pconfig.ScoringParameters
+	provider                        module.IdentityProvider
+	heroCacheMetricsFactory         metrics.HeroCacheMetricsFactory
+	appScoreFunc                    func(peer.ID) float64
+	topicParams                     []func(map[string]*pubsub.TopicScoreParams)
+	getDuplicateMessageCount        func(id peer.ID) float64
+	scoringRegistryMetricsCollector module.GossipSubScoringRegistryMetrics
+	networkingType                  network.NetworkingType
 }
 
 // NewScoreOptionConfig creates a new configuration for the GossipSub peer scoring option.
@@ -57,15 +59,19 @@ type ScoreOptionConfig struct {
 func NewScoreOptionConfig(logger zerolog.Logger,
 	params p2pconfig.ScoringParameters,
 	hcMetricsFactory metrics.HeroCacheMetricsFactory,
+	scoringRegistryMetricsCollector module.GossipSubScoringRegistryMetrics,
 	idProvider module.IdentityProvider,
+	getDuplicateMessageCount func(id peer.ID) float64,
 	networkingType network.NetworkingType) *ScoreOptionConfig {
 	return &ScoreOptionConfig{
-		logger:                  logger.With().Str("module", "pubsub_score_option").Logger(),
-		provider:                idProvider,
-		params:                  params,
-		heroCacheMetricsFactory: hcMetricsFactory,
-		topicParams:             make([]func(map[string]*pubsub.TopicScoreParams), 0),
-		networkingType:          networkingType,
+		logger:                          logger.With().Str("module", "pubsub_score_option").Logger(),
+		provider:                        idProvider,
+		params:                          params,
+		heroCacheMetricsFactory:         hcMetricsFactory,
+		topicParams:                     make([]func(map[string]*pubsub.TopicScoreParams), 0),
+		networkingType:                  networkingType,
+		getDuplicateMessageCount:        getDuplicateMessageCount,
+		scoringRegistryMetricsCollector: scoringRegistryMetricsCollector,
 	}
 }
 
@@ -87,13 +93,6 @@ func (c *ScoreOptionConfig) OverrideTopicScoreParams(topic channels.Topic, topic
 	})
 }
 
-// SetRegisterNotificationConsumerFunc sets the function to register the notification consumer for the penalty option.
-// ScoreOption uses this function to register the notification consumer for the pubsub system so that it can receive
-// notifications of invalid control messages.
-func (c *ScoreOptionConfig) SetRegisterNotificationConsumerFunc(f func(p2p.GossipSubInvCtrlMsgNotifConsumer)) {
-	c.registerNotificationConsumerFunc = f
-}
-
 // NewScoreOption creates a new penalty option with the given configuration.
 func NewScoreOption(cfg *ScoreOptionConfig, provider p2p.SubscriptionProvider) (*ScoreOption, error) {
 	throttledSampler := logging.BurstSampler(cfg.params.PeerScoring.Protocol.MaxDebugLogs, time.Second)
@@ -122,9 +121,14 @@ func NewScoreOption(cfg *ScoreOptionConfig, provider p2p.SubscriptionProvider) (
 				InitAppScoreRecordStateFunc(cfg.params.ScoringRegistryParameters.SpamRecordCache.Decay.MaximumSpamPenaltyDecayFactor),
 				DefaultDecayFunction(cfg.params.ScoringRegistryParameters.SpamRecordCache.Decay))
 		},
-		Parameters:             cfg.params.ScoringRegistryParameters.AppSpecificScore,
-		NetworkingType:         cfg.networkingType,
-		AppSpecificScoreParams: cfg.params.PeerScoring.Protocol.AppSpecificScore,
+		GetDuplicateMessageCount: func(id peer.ID) float64 {
+			return cfg.getDuplicateMessageCount(id)
+		},
+		Parameters:                cfg.params.ScoringRegistryParameters.AppSpecificScore,
+		NetworkingType:            cfg.networkingType,
+		AppSpecificScoreParams:    cfg.params.PeerScoring.Protocol.AppSpecificScore,
+		DuplicateMessageThreshold: cfg.params.PeerScoring.Protocol.AppSpecificScore.DuplicateMessageThreshold,
+		Collector:                 cfg.scoringRegistryMetricsCollector,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to create gossipsub app specific score registry: %w", err)
@@ -176,7 +180,8 @@ func NewScoreOption(cfg *ScoreOptionConfig, provider p2p.SubscriptionProvider) (
 			MeshMessageDeliveriesWindow:     cfg.params.PeerScoring.Internal.TopicParameters.MeshMessageDeliveriesWindow,
 			MeshMessageDeliveriesActivation: cfg.params.PeerScoring.Internal.TopicParameters.MeshMessageDeliveryActivation,
 		},
-		appScoreFunc: scoreRegistry.AppSpecificScoreFunc(),
+		appScoreFunc:     scoreRegistry.AppSpecificScoreFunc(),
+		appScoreRegistry: scoreRegistry,
 	}
 
 	// set the app specific penalty function for the penalty option
@@ -199,11 +204,6 @@ func NewScoreOption(cfg *ScoreOptionConfig, provider p2p.SubscriptionProvider) (
 			Msg("decay interval is overridden, should never happen in production")
 	}
 
-	// registers the score registry as the consumer of the invalid control message notifications
-	if cfg.registerNotificationConsumerFunc != nil {
-		cfg.registerNotificationConsumerFunc(scoreRegistry)
-	}
-
 	s.peerScoreParams.AppSpecificScore = s.appScoreFunc
 
 	// apply the topic penalty parameters if any.
@@ -265,3 +265,11 @@ func (s *ScoreOption) TopicScoreParams(topic *pubsub.Topic) *pubsub.TopicScorePa
 	}
 	return params
 }
+
+// OnInvalidControlMessageNotification is called when a new invalid control message notification is distributed.
+// Any error on consuming event must handle internally.
+// The implementation must be concurrency safe and non-blocking.
+// Note: there is no real-time guarantee on processing the notification.
+func (s *ScoreOption) OnInvalidControlMessageNotification(notif *p2p.InvCtrlMsgNotif) {
+	s.appScoreRegistry.OnInvalidControlMessageNotification(notif)
+}
diff --git a/network/p2p/scoring/scoring_test.go b/network/p2p/scoring/scoring_test.go
index cee819d3c85..f448cd271bd 100644
--- a/network/p2p/scoring/scoring_test.go
+++ b/network/p2p/scoring/scoring_test.go
@@ -7,7 +7,6 @@ import (
 	"testing"
 	"time"
 
-	pubsub "github.com/libp2p/go-libp2p-pubsub"
 	"github.com/libp2p/go-libp2p/core/peer"
 	"github.com/rs/zerolog"
 	mocktestify "github.com/stretchr/testify/mock"
@@ -16,7 +15,6 @@ import (
 	"github.com/onflow/flow-go/config"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module"
-	"github.com/onflow/flow-go/module/component"
 	"github.com/onflow/flow-go/module/id"
 	"github.com/onflow/flow-go/module/irrecoverable"
 	"github.com/onflow/flow-go/module/metrics"
@@ -26,55 +24,11 @@ import (
 	"github.com/onflow/flow-go/network/p2p"
 	p2pconfig "github.com/onflow/flow-go/network/p2p/config"
 	p2pmsg "github.com/onflow/flow-go/network/p2p/message"
+	mockp2p "github.com/onflow/flow-go/network/p2p/mock"
 	p2ptest "github.com/onflow/flow-go/network/p2p/test"
 	"github.com/onflow/flow-go/utils/unittest"
 )
 
-// mockInspectorSuite is a mock implementation of the GossipSubInspectorSuite interface.
-// It is used to test the impact of invalid control messages on the scoring and connectivity of nodes in a network.
-type mockInspectorSuite struct {
-	component.Component
-	t        *testing.T
-	consumer p2p.GossipSubInvCtrlMsgNotifConsumer
-}
-
-// ensures that mockInspectorSuite implements the GossipSubInspectorSuite interface.
-var _ p2p.GossipSubInspectorSuite = (*mockInspectorSuite)(nil)
-
-func (m *mockInspectorSuite) AddInvalidControlMessageConsumer(consumer p2p.GossipSubInvCtrlMsgNotifConsumer) {
-	require.Nil(m.t, m.consumer)
-	m.consumer = consumer
-}
-func (m *mockInspectorSuite) ActiveClustersChanged(_ flow.ChainIDList) {
-	// no-op
-}
-
-// newMockInspectorSuite creates a new mockInspectorSuite.
-// Args:
-// - t: the test object used for assertions.
-// Returns:
-// - a new mockInspectorSuite.
-func newMockInspectorSuite(t *testing.T) *mockInspectorSuite {
-	i := &mockInspectorSuite{
-		t: t,
-	}
-
-	builder := component.NewComponentManagerBuilder()
-	builder.AddWorker(func(ctx irrecoverable.SignalerContext, ready component.ReadyFunc) {
-		ready()
-		<-ctx.Done()
-	})
-
-	i.Component = builder.Build()
-	return i
-}
-
-// InspectFunc returns a function that is called when a node receives a control message.
-// In this mock implementation, the function does nothing.
-func (m *mockInspectorSuite) InspectFunc() func(peer.ID, *pubsub.RPC) error {
-	return nil
-}
-
 // TestInvalidCtrlMsgScoringIntegration tests the impact of invalid control messages on the scoring and connectivity of nodes in a network.
 // It creates a network of 2 nodes, and sends a set of control messages with invalid topic IDs to one of the nodes.
 // It then checks that the node receiving the invalid control messages decreases its score for the peer spamming the invalid messages, and
@@ -86,26 +40,25 @@ func TestInvalidCtrlMsgScoringIntegration(t *testing.T) {
 	sporkId := unittest.IdentifierFixture()
 	idProvider := mock.NewIdentityProvider(t)
 
-	inspectorSuite1 := newMockInspectorSuite(t)
-	factory := func(
-		irrecoverable.SignalerContext,
-		zerolog.Logger,
-		flow.Identifier,
-		*p2pconfig.RpcInspectorParameters,
-		module.GossipSubMetrics,
-		metrics.HeroCacheMetricsFactory,
-		flownet.NetworkingType,
-		module.IdentityProvider,
-		func() p2p.TopicProvider) (p2p.GossipSubInspectorSuite, error) {
-		// override the gossipsub rpc inspector suite factory to return the mock inspector suite
-		return inspectorSuite1, nil
-	}
-
 	cfg, err := config.DefaultConfig()
 	require.NoError(t, err)
 
 	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 10 * time.Millisecond // speed up the test
 
+	var notificationConsumer p2p.GossipSubInvCtrlMsgNotifConsumer
+	inspector := mockp2p.NewGossipSubRPCInspector(t)
+	inspector.On("Inspect", mocktestify.Anything, mocktestify.Anything).Return(nil) // no-op for the inspector
+	inspector.On("ActiveClustersChanged", mocktestify.Anything).Return().Maybe()    // no-op for the inspector
+	inspector.On("Start", mocktestify.Anything).Return(nil)                         // no-op for the inspector
+
+	// mocking the Ready and Done channels to be closed
+	done := make(chan struct{})
+	close(done)
+	f := func() <-chan struct{} {
+		return done
+	}
+	inspector.On("Ready").Return(f()) // no-op for the inspector
+	inspector.On("Done").Return(f())  // no-op for the inspector
 	node1, id1 := p2ptest.NodeFixture(
 		t,
 		sporkId,
@@ -113,7 +66,19 @@ func TestInvalidCtrlMsgScoringIntegration(t *testing.T) {
 		idProvider,
 		p2ptest.WithRole(flow.RoleConsensus),
 		p2ptest.OverrideFlowConfig(cfg),
-		p2ptest.OverrideGossipSubRpcInspectorSuiteFactory(factory))
+		p2ptest.OverrideGossipSubRpcInspectorFactory(func(logger zerolog.Logger,
+			_ flow.Identifier,
+			_ *p2pconfig.RpcInspectorParameters,
+			_ module.GossipSubMetrics,
+			_ metrics.HeroCacheMetricsFactory,
+			_ flownet.NetworkingType,
+			_ module.IdentityProvider,
+			_ func() p2p.TopicProvider,
+			consumer p2p.GossipSubInvCtrlMsgNotifConsumer) (p2p.GossipSubRPCInspector, error) {
+			// short-wire the consumer
+			notificationConsumer = consumer
+			return inspector, nil
+		}))
 
 	node2, id2 := p2ptest.NodeFixture(
 		t,
@@ -125,6 +90,8 @@ func TestInvalidCtrlMsgScoringIntegration(t *testing.T) {
 
 	ids := flow.IdentityList{&id1, &id2}
 	nodes := []p2p.LibP2PNode{node1, node2}
+	// suppressing "peers provider not set error"
+	p2ptest.RegisterPeerProviders(t, nodes)
 
 	provider := id.NewFixedIdentityProvider(ids)
 	idProvider.On("ByPeerID", mocktestify.Anything).Return(
@@ -148,7 +115,7 @@ func TestInvalidCtrlMsgScoringIntegration(t *testing.T) {
 	// simulates node2 spamming node1 with invalid gossipsub control messages until node2 gets dissallow listed.
 	// since the decay will start lower than .99 and will only be incremented by default .01, we need to spam a lot of messages so that the node gets disallow listed
 	for i := 0; i < 750; i++ {
-		inspectorSuite1.consumer.OnInvalidControlMessageNotification(&p2p.InvCtrlMsgNotif{
+		notificationConsumer.OnInvalidControlMessageNotification(&p2p.InvCtrlMsgNotif{
 			PeerID:  node2.ID(),
 			MsgType: p2pmsg.ControlMessageTypes()[rand.Intn(len(p2pmsg.ControlMessageTypes()))],
 			Error:   fmt.Errorf("invalid control message"),
diff --git a/network/p2p/scoring/subscription_validator_test.go b/network/p2p/scoring/subscription_validator_test.go
index 1a6a4b6bfcb..3a1668316f1 100644
--- a/network/p2p/scoring/subscription_validator_test.go
+++ b/network/p2p/scoring/subscription_validator_test.go
@@ -164,7 +164,6 @@ func TestSubscriptionValidator_InvalidSubscriptions(t *testing.T) {
 // 4. Verification node also publishes a chunk request on the RequestChunks channel.
 // 5. Test checks that consensus node does not receive the chunk request while the other verification node does.
 func TestSubscriptionValidator_Integration(t *testing.T) {
-	unittest.SkipUnless(t, unittest.TEST_FLAKY, "flaky test")
 	ctx, cancel := context.WithCancel(context.Background())
 	signalerCtx := irrecoverable.NewMockSignalerContext(t, ctx)
 
@@ -173,6 +172,8 @@ func TestSubscriptionValidator_Integration(t *testing.T) {
 	// set a low update interval to speed up the test
 	cfg.NetworkConfig.GossipSub.SubscriptionProvider.UpdateInterval = 10 * time.Millisecond
 	cfg.NetworkConfig.GossipSub.ScoringParameters.ScoringRegistryParameters.AppSpecificScore.ScoreTTL = 10 * time.Millisecond
+	// score tracer interval is set to 500 milliseconds to speed up the test, it should be shorter than the heartbeat interval (1 second) of gossipsub to catch the score updates in time.
+	cfg.NetworkConfig.GossipSub.RpcTracer.ScoreTracerInterval = 500 * time.Millisecond
 
 	sporkId := unittest.IdentifierFixture()
 
@@ -271,8 +272,15 @@ func TestSubscriptionValidator_Integration(t *testing.T) {
 	conSubChunks, err := conNode.Subscribe(channels.TopicFromChannel(channels.RequestChunks, sporkId), topicValidator)
 	require.NoError(t, err)
 
-	// let's wait for a bit to subscription propagate.
-	time.Sleep(5 * time.Second)
+	invalidSubscriptionPenalty := cfg.NetworkConfig.GossipSub.ScoringParameters.PeerScoring.Protocol.AppSpecificScore.InvalidSubscriptionPenalty
+	require.Eventually(t, func() bool {
+		score, ok := verNode1.PeerScoreExposer().GetScore(conNode.ID())
+		return score == invalidSubscriptionPenalty && ok
+	}, 5*time.Second, 200*time.Millisecond)
+	require.Eventually(t, func() bool {
+		score, ok := verNode2.PeerScoreExposer().GetScore(conNode.ID())
+		return score == invalidSubscriptionPenalty && ok
+	}, 5*time.Second, 200*time.Millisecond)
 
 	// consensus node publishes another proposal, but this time, it should not reach verification node.
 	// since upon an unauthorized subscription, verification node should have slashed consensus node on
@@ -284,11 +292,12 @@ func TestSubscriptionValidator_Integration(t *testing.T) {
 		unittest.NetworkCodec().Encode,
 		message.ProtocolTypePubSub)
 	require.NoError(t, err)
-	require.NoError(t, conNode.Publish(ctx, outgoingMessageScope))
 
 	ctx5s, cancel5s := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel5s()
-	p2pfixtures.SubsMustNeverReceiveAnyMessage(t, ctx5s, []p2p.Subscription{ver1SubBlocks, ver2SubBlocks})
+	p2pfixtures.SubsMustEventuallyStopReceivingAnyMessage(t, ctx5s, []p2p.Subscription{ver1SubBlocks, ver2SubBlocks}, func(t *testing.T) {
+		require.NoError(t, conNode.Publish(ctx, outgoingMessageScope))
+	})
 
 	// moreover, a verification node publishing a message to the request chunk topic should not reach consensus node.
 	// however, both verification nodes should receive the message.
@@ -302,6 +311,7 @@ func TestSubscriptionValidator_Integration(t *testing.T) {
 		unittest.NetworkCodec().Encode,
 		message.ProtocolTypePubSub)
 	require.NoError(t, err)
+
 	require.NoError(t, verNode1.Publish(ctx, outgoingMessageScope))
 
 	ctx1s, cancel1s = context.WithTimeout(ctx, 1*time.Second)
@@ -311,8 +321,9 @@ func TestSubscriptionValidator_Integration(t *testing.T) {
 	require.NoError(t, err)
 
 	p2pfixtures.SubsMustReceiveMessage(t, ctx1s, expectedReceivedData, []p2p.Subscription{ver1SubChunks, ver2SubChunks})
-
 	ctx5s, cancel5s = context.WithTimeout(ctx, 5*time.Second)
 	defer cancel5s()
-	p2pfixtures.SubsMustNeverReceiveAnyMessage(t, ctx5s, []p2p.Subscription{conSubChunks})
+	p2pfixtures.SubsMustEventuallyStopReceivingAnyMessage(t, ctx5s, []p2p.Subscription{conSubChunks}, func(t *testing.T) {
+		require.NoError(t, verNode1.Publish(ctx, outgoingMessageScope))
+	})
 }
diff --git a/network/p2p/scoring/utils.go b/network/p2p/scoring/utils.go
index a1358f72f56..53d0ff0e620 100644
--- a/network/p2p/scoring/utils.go
+++ b/network/p2p/scoring/utils.go
@@ -14,7 +14,7 @@ func HasValidFlowIdentity(idProvider module.IdentityProvider, pid peer.ID) (*flo
 		return nil, NewInvalidPeerIDError(pid, PeerIdStatusUnknown)
 	}
 
-	if flowId.Ejected {
+	if flowId.IsEjected() {
 		return nil, NewInvalidPeerIDError(pid, PeerIdStatusEjected)
 	}
 
diff --git a/network/p2p/scoring/utils_test.go b/network/p2p/scoring/utils_test.go
index 1da111bf748..3ddfdb09e97 100644
--- a/network/p2p/scoring/utils_test.go
+++ b/network/p2p/scoring/utils_test.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/module/mock"
 	"github.com/onflow/flow-go/network/p2p/scoring"
 	"github.com/onflow/flow-go/utils/unittest"
@@ -28,7 +29,7 @@ func TestHasValidIdentity_Ejected(t *testing.T) {
 	idProvider := mock.NewIdentityProvider(t)
 
 	ejectedIdentity := unittest.IdentityFixture()
-	ejectedIdentity.Ejected = true
+	ejectedIdentity.EpochParticipationStatus = flow.EpochParticipationStatusEjected
 	peerId := unittest.PeerIdFixture(t)
 	idProvider.On("ByPeerID", peerId).Return(ejectedIdentity, true)
 
diff --git a/network/p2p/test/fixtures.go b/network/p2p/test/fixtures.go
index 037bf5d4d14..b765f6a823b 100644
--- a/network/p2p/test/fixtures.go
+++ b/network/p2p/test/fixtures.go
@@ -19,7 +19,6 @@ import (
 	discoveryBackoff "github.com/libp2p/go-libp2p/p2p/discovery/backoff"
 	"github.com/onflow/crypto"
 	"github.com/rs/zerolog"
-	mockery "github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/exp/rand"
 
@@ -37,7 +36,6 @@ import (
 	p2pbuilderconfig "github.com/onflow/flow-go/network/p2p/builder/config"
 	"github.com/onflow/flow-go/network/p2p/connection"
 	p2pdht "github.com/onflow/flow-go/network/p2p/dht"
-	mockp2p "github.com/onflow/flow-go/network/p2p/mock"
 	"github.com/onflow/flow-go/network/p2p/unicast/protocols"
 	"github.com/onflow/flow-go/network/p2p/utils"
 	validator "github.com/onflow/flow-go/network/validator/pubsub"
@@ -161,8 +159,8 @@ func NodeFixture(t *testing.T,
 		})
 	}
 
-	if parameters.GossipSubRpcInspectorSuiteFactory != nil {
-		builder.OverrideDefaultRpcInspectorSuiteFactory(parameters.GossipSubRpcInspectorSuiteFactory)
+	if parameters.GossipSubRpcInspectorFactory != nil {
+		builder.OverrideDefaultRpcInspectorFactory(parameters.GossipSubRpcInspectorFactory)
 	}
 
 	if parameters.ResourceManager != nil {
@@ -178,7 +176,7 @@ func NodeFixture(t *testing.T,
 	}
 
 	if parameters.GossipSubFactory != nil && parameters.GossipSubConfig != nil {
-		builder.SetGossipSubFactory(parameters.GossipSubFactory, parameters.GossipSubConfig)
+		builder.OverrideGossipSubFactory(parameters.GossipSubFactory, parameters.GossipSubConfig)
 	}
 
 	if parameters.ConnManager != nil {
@@ -228,28 +226,28 @@ func RegisterPeerProviders(_ *testing.T, nodes []p2p.LibP2PNode) {
 type NodeFixtureParameterOption func(*NodeFixtureParameters)
 
 type NodeFixtureParameters struct {
-	HandlerFunc                       network.StreamHandler
-	NetworkingType                    flownet.NetworkingType
-	Unicasts                          []protocols.ProtocolName
-	Key                               crypto.PrivateKey
-	Address                           string
-	DhtOptions                        []dht.Option
-	Role                              flow.Role
-	Logger                            zerolog.Logger
-	PeerScoringEnabled                bool
-	IdProvider                        module.IdentityProvider
-	PeerScoringConfigOverride         *p2p.PeerScoringConfigOverride
-	PeerManagerConfig                 *p2pbuilderconfig.PeerManagerConfig
-	PeerProvider                      p2p.PeersProvider // peer manager parameter
-	ConnGater                         p2p.ConnectionGater
-	ConnManager                       connmgr.ConnManager
-	GossipSubFactory                  p2p.GossipSubFactoryFunc
-	GossipSubConfig                   p2p.GossipSubAdapterConfigFunc
-	MetricsCfg                        *p2pbuilderconfig.MetricsConfig
-	ResourceManager                   network.ResourceManager
-	GossipSubRpcInspectorSuiteFactory p2p.GossipSubRpcInspectorSuiteFactoryFunc
-	FlowConfig                        *config.FlowConfig
-	UnicastRateLimiterDistributor     p2p.UnicastRateLimiterDistributor
+	HandlerFunc                   network.StreamHandler
+	NetworkingType                flownet.NetworkingType
+	Unicasts                      []protocols.ProtocolName
+	Key                           crypto.PrivateKey
+	Address                       string
+	DhtOptions                    []dht.Option
+	Role                          flow.Role
+	Logger                        zerolog.Logger
+	PeerScoringEnabled            bool
+	IdProvider                    module.IdentityProvider
+	PeerScoringConfigOverride     *p2p.PeerScoringConfigOverride
+	PeerManagerConfig             *p2pbuilderconfig.PeerManagerConfig
+	PeerProvider                  p2p.PeersProvider // peer manager parameter
+	ConnGater                     p2p.ConnectionGater
+	ConnManager                   connmgr.ConnManager
+	GossipSubFactory              p2p.GossipSubFactoryFunc
+	GossipSubConfig               p2p.GossipSubAdapterConfigFunc
+	MetricsCfg                    *p2pbuilderconfig.MetricsConfig
+	ResourceManager               network.ResourceManager
+	GossipSubRpcInspectorFactory  p2p.GossipSubRpcInspectorFactoryFunc
+	FlowConfig                    *config.FlowConfig
+	UnicastRateLimiterDistributor p2p.UnicastRateLimiterDistributor
 }
 
 func WithUnicastRateLimitDistributor(distributor p2p.UnicastRateLimiterDistributor) NodeFixtureParameterOption {
@@ -258,9 +256,9 @@ func WithUnicastRateLimitDistributor(distributor p2p.UnicastRateLimiterDistribut
 	}
 }
 
-func OverrideGossipSubRpcInspectorSuiteFactory(factory p2p.GossipSubRpcInspectorSuiteFactoryFunc) NodeFixtureParameterOption {
+func OverrideGossipSubRpcInspectorFactory(factory p2p.GossipSubRpcInspectorFactoryFunc) NodeFixtureParameterOption {
 	return func(p *NodeFixtureParameters) {
-		p.GossipSubRpcInspectorSuiteFactory = factory
+		p.GossipSubRpcInspectorFactory = factory
 	}
 }
 
@@ -512,7 +510,7 @@ func LetNodesDiscoverEachOther(t *testing.T, ctx context.Context, nodes []p2p.Li
 			if node == other {
 				continue
 			}
-			otherPInfo, err := utils.PeerAddressInfo(*ids[i])
+			otherPInfo, err := utils.PeerAddressInfo(ids[i].IdentitySkeleton)
 			require.NoError(t, err)
 			require.NoError(t, node.ConnectToPeer(ctx, otherPInfo))
 		}
@@ -809,38 +807,6 @@ func NewConnectionGater(idProvider module.IdentityProvider, allowListFilter p2p.
 	return connection.NewConnGater(unittest.Logger(), idProvider, connection.WithOnInterceptPeerDialFilters(filters), connection.WithOnInterceptSecuredFilters(filters))
 }
 
-// MockInspectorNotificationDistributorReadyDoneAware mocks the Ready and Done methods of the distributor to return a channel that is already closed,
-// so that the distributor is considered ready and done when the test needs.
-func MockInspectorNotificationDistributorReadyDoneAware(d *mockp2p.GossipSubInspectorNotificationDistributor) {
-	d.On("Start", mockery.Anything).Return().Maybe()
-	d.On("Ready").Return(func() <-chan struct{} {
-		ch := make(chan struct{})
-		close(ch)
-		return ch
-	}()).Maybe()
-	d.On("Done").Return(func() <-chan struct{} {
-		ch := make(chan struct{})
-		close(ch)
-		return ch
-	}()).Maybe()
-}
-
-// MockScoringRegistrySubscriptionValidatorReadyDoneAware mocks the Ready and Done methods of the subscription validator to return a channel that is already closed,
-// so that the distributor is considered ready and done when the test needs.
-func MockScoringRegistrySubscriptionValidatorReadyDoneAware(s *mockp2p.SubscriptionValidator) {
-	s.On("Start", mockery.Anything).Return().Maybe()
-	s.On("Ready").Return(func() <-chan struct{} {
-		ch := make(chan struct{})
-		close(ch)
-		return ch
-	}()).Maybe()
-	s.On("Done").Return(func() <-chan struct{} {
-		ch := make(chan struct{})
-		close(ch)
-		return ch
-	}()).Maybe()
-}
-
 // GossipSubRpcFixtures returns a slice of random message IDs for testing.
 // Args:
 // - t: *testing.T instance
@@ -980,6 +946,19 @@ func WithGraft(msgCount int, topicId string) GossipSubCtrlOption {
 	}
 }
 
+// WithGrafts adds a GRAFT control message with each given topicID to the control message.
+func WithGrafts(topicIds ...string) GossipSubCtrlOption {
+	return func(msg *pb.ControlMessage) {
+		grafts := make([]*pb.ControlGraft, len(topicIds))
+		for i, topic := range topicIds {
+			grafts[i] = &pb.ControlGraft{
+				TopicID: &topic,
+			}
+		}
+		msg.Graft = grafts
+	}
+}
+
 // WithPrune adds PRUNE control messages with given topicID to the control message.
 func WithPrune(msgCount int, topicId string) GossipSubCtrlOption {
 	return func(msg *pb.ControlMessage) {
@@ -993,6 +972,19 @@ func WithPrune(msgCount int, topicId string) GossipSubCtrlOption {
 	}
 }
 
+// WithPrunes adds a PRUNE control message with each given topicID to the control message.
+func WithPrunes(topicIds ...string) GossipSubCtrlOption {
+	return func(msg *pb.ControlMessage) {
+		prunes := make([]*pb.ControlPrune, len(topicIds))
+		for i, topic := range topicIds {
+			prunes[i] = &pb.ControlPrune{
+				TopicID: &topic,
+			}
+		}
+		msg.Prune = prunes
+	}
+}
+
 // gossipSubMessageIdFixture returns a random gossipSub message ID.
 func gossipSubMessageIdFixture() string {
 	// TODO: messageID length should be a parameter.
@@ -1033,3 +1025,32 @@ func GossipSubMessageFixture(t *testing.T) *pb.Message {
 		Key:       unittest.RandomBytes(byteSize),
 	}
 }
+
+// UpdatableTopicProviderFixture is a mock implementation of the TopicProvider interface.
+type UpdatableTopicProviderFixture struct {
+	topics        []string
+	subscriptions map[string][]peer.ID
+}
+
+func NewUpdatableTopicProviderFixture() *UpdatableTopicProviderFixture {
+	return &UpdatableTopicProviderFixture{
+		topics:        []string{},
+		subscriptions: map[string][]peer.ID{},
+	}
+}
+
+func (m *UpdatableTopicProviderFixture) GetTopics() []string {
+	return m.topics
+}
+
+func (m *UpdatableTopicProviderFixture) ListPeers(topic string) []peer.ID {
+	return m.subscriptions[topic]
+}
+
+func (m *UpdatableTopicProviderFixture) UpdateTopics(topics []string) {
+	m.topics = topics
+}
+
+func (m *UpdatableTopicProviderFixture) UpdateSubscriptions(topic string, peers []peer.ID) {
+	m.subscriptions[topic] = peers
+}
diff --git a/network/p2p/test/sporking_test.go b/network/p2p/test/sporking_test.go
index e1e8d8cb7b6..2d0d8e9586e 100644
--- a/network/p2p/test/sporking_test.go
+++ b/network/p2p/test/sporking_test.go
@@ -84,7 +84,7 @@ func TestCrosstalkPreventionOnNetworkKeyChange(t *testing.T) {
 
 	p2ptest.StartNode(t, signalerCtx2, node2)
 
-	peerInfo2, err := utils.PeerAddressInfo(id2)
+	peerInfo2, err := utils.PeerAddressInfo(id2.IdentitySkeleton)
 	require.NoError(t, err)
 
 	// create stream from node 1 to node 2
@@ -147,7 +147,7 @@ func TestOneToOneCrosstalkPrevention(t *testing.T) {
 	p2ptest.StartNode(t, signalerCtx1, node1)
 	defer p2ptest.StopNode(t, node1, cancel1)
 
-	peerInfo1, err := utils.PeerAddressInfo(id1)
+	peerInfo1, err := utils.PeerAddressInfo(id1.IdentitySkeleton)
 	require.NoError(t, err)
 
 	// create and start node 2 on localhost and random port
@@ -211,6 +211,7 @@ func TestOneToKCrosstalkPrevention(t *testing.T) {
 	// from joining the mesh. As this test simulates the scenario where a node is moved from the old chain to the new chain, we disable peer scoring
 	// to allow the node to join the mesh on the new chain, otherwise the node will be disconnected from the mesh due to peer scoring penalty for unknown identifiers.
 	cfg.NetworkConfig.GossipSub.PeerScoringEnabled = false
+	cfg.NetworkConfig.GossipSub.RpcInspector.Validation.InspectionProcess.Inspect.RejectUnstakedPeers = false
 	node1, id1 := p2ptest.NodeFixture(t,
 		previousSporkId,
 		"test_one_to_k_crosstalk_prevention",
@@ -232,7 +233,7 @@ func TestOneToKCrosstalkPrevention(t *testing.T) {
 	p2ptest.StartNode(t, signalerCtx2, node2)
 	defer p2ptest.StopNode(t, node2, cancel2)
 
-	pInfo2, err := utils.PeerAddressInfo(id2)
+	pInfo2, err := utils.PeerAddressInfo(id2.IdentitySkeleton)
 	require.NoError(t, err)
 
 	// spork topic is derived by suffixing the channel with the root block ID
diff --git a/network/p2p/test/topic_validator_test.go b/network/p2p/test/topic_validator_test.go
index 45c4bc296d8..ac62e5ae5f0 100644
--- a/network/p2p/test/topic_validator_test.go
+++ b/network/p2p/test/topic_validator_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/stretchr/testify/mock"
 
+	"github.com/onflow/flow-go/config"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/messages"
 	"github.com/onflow/flow-go/module/irrecoverable"
@@ -74,7 +75,7 @@ func TestTopicValidator_Unstaked(t *testing.T) {
 		return nil
 	}
 
-	pInfo2, err := utils.PeerAddressInfo(identity2)
+	pInfo2, err := utils.PeerAddressInfo(identity2.IdentitySkeleton)
 	require.NoError(t, err)
 
 	// node1 is connected to node2
@@ -135,7 +136,7 @@ func TestTopicValidator_PublicChannel(t *testing.T) {
 	channel := channels.PublicSyncCommittee
 	topic := channels.TopicFromChannel(channel, sporkId)
 
-	pInfo2, err := utils.PeerAddressInfo(identity2)
+	pInfo2, err := utils.PeerAddressInfo(identity2.IdentitySkeleton)
 	require.NoError(t, err)
 
 	// node1 is connected to node2
@@ -204,7 +205,7 @@ func TestTopicValidator_TopicMismatch(t *testing.T) {
 	channel := channels.ConsensusCommittee
 	topic := channels.TopicFromChannel(channel, sporkId)
 
-	pInfo2, err := utils.PeerAddressInfo(identity2)
+	pInfo2, err := utils.PeerAddressInfo(identity2.IdentitySkeleton)
 	require.NoError(t, err)
 
 	// node1 is connected to node2
@@ -265,7 +266,7 @@ func TestTopicValidator_InvalidTopic(t *testing.T) {
 
 	topic := channels.Topic("invalid-topic")
 
-	pInfo2, err := utils.PeerAddressInfo(identity2)
+	pInfo2, err := utils.PeerAddressInfo(identity2.IdentitySkeleton)
 	require.NoError(t, err)
 
 	// node1 is connected to node2
@@ -362,10 +363,10 @@ func TestAuthorizedSenderValidator_Unauthorized(t *testing.T) {
 	authorizedSenderValidator := validator.NewAuthorizedSenderValidator(logger, violationsConsumer, getIdentity)
 	pubsubMessageValidator := authorizedSenderValidator.PubSubMessageValidator(channel)
 
-	pInfo1, err := utils.PeerAddressInfo(identity1)
+	pInfo1, err := utils.PeerAddressInfo(identity1.IdentitySkeleton)
 	require.NoError(t, err)
 
-	pInfo2, err := utils.PeerAddressInfo(identity2)
+	pInfo2, err := utils.PeerAddressInfo(identity2.IdentitySkeleton)
 	require.NoError(t, err)
 
 	// node1 is connected to node2, and the an1 is connected to node1
@@ -490,7 +491,7 @@ func TestAuthorizedSenderValidator_InvalidMsg(t *testing.T) {
 	authorizedSenderValidator := validator.NewAuthorizedSenderValidator(logger, violationsConsumer, getIdentity)
 	pubsubMessageValidator := authorizedSenderValidator.PubSubMessageValidator(channel)
 
-	pInfo2, err := utils.PeerAddressInfo(identity2)
+	pInfo2, err := utils.PeerAddressInfo(identity2.IdentitySkeleton)
 	require.NoError(t, err)
 
 	// node1 is connected to node2
@@ -540,9 +541,13 @@ func TestAuthorizedSenderValidator_Ejected(t *testing.T) {
 
 	sporkId := unittest.IdentifierFixture()
 
-	sn1, identity1 := p2ptest.NodeFixture(t, sporkId, "consensus_1", idProvider, p2ptest.WithRole(flow.RoleConsensus))
-	sn2, identity2 := p2ptest.NodeFixture(t, sporkId, "consensus_2", idProvider, p2ptest.WithRole(flow.RoleConsensus))
-	an1, identity3 := p2ptest.NodeFixture(t, sporkId, "access_1", idProvider, p2ptest.WithRole(flow.RoleAccess))
+	cfg, err := config.DefaultConfig()
+	require.NoError(t, err)
+	// turn off unstaked peer rejection so that nodes can connect
+	cfg.NetworkConfig.GossipSub.RpcInspector.Validation.InspectionProcess.Inspect.RejectUnstakedPeers = false
+	sn1, identity1 := p2ptest.NodeFixture(t, sporkId, "consensus_1", idProvider, p2ptest.WithRole(flow.RoleConsensus), p2ptest.OverrideFlowConfig(cfg))
+	sn2, identity2 := p2ptest.NodeFixture(t, sporkId, "consensus_2", idProvider, p2ptest.WithRole(flow.RoleConsensus), p2ptest.OverrideFlowConfig(cfg))
+	an1, identity3 := p2ptest.NodeFixture(t, sporkId, "access_1", idProvider, p2ptest.WithRole(flow.RoleAccess), p2ptest.OverrideFlowConfig(cfg))
 	idProvider.On("ByPeerID", sn1.ID()).Return(&identity1, true).Maybe()
 	idProvider.On("ByPeerID", sn2.ID()).Return(&identity2, true).Maybe()
 	idProvider.On("ByPeerID", an1.ID()).Return(&identity3, true).Maybe()
@@ -573,10 +578,10 @@ func TestAuthorizedSenderValidator_Ejected(t *testing.T) {
 	authorizedSenderValidator := validator.NewAuthorizedSenderValidator(logger, violationsConsumer, getIdentity)
 	pubsubMessageValidator := authorizedSenderValidator.PubSubMessageValidator(channel)
 
-	pInfo1, err := utils.PeerAddressInfo(identity1)
+	pInfo1, err := utils.PeerAddressInfo(identity1.IdentitySkeleton)
 	require.NoError(t, err)
 
-	pInfo2, err := utils.PeerAddressInfo(identity2)
+	pInfo2, err := utils.PeerAddressInfo(identity2.IdentitySkeleton)
 	require.NoError(t, err)
 
 	// node1 is connected to node2, and the an1 is connected to node1
@@ -624,7 +629,7 @@ func TestAuthorizedSenderValidator_Ejected(t *testing.T) {
 	p2pfixtures.SubMustReceiveMessage(t, timedCtx, expectedReceivedData1, sub3)
 
 	// "eject" sn2 to ensure messages published by ejected nodes get rejected
-	identity2.Ejected = true
+	identity2.EpochParticipationStatus = flow.EpochParticipationStatusEjected
 
 	outgoingMessageScope3, err := message.NewOutgoingScope(
 		flow.IdentifierList{identity1.NodeID, identity2.NodeID},
@@ -687,10 +692,10 @@ func TestAuthorizedSenderValidator_ClusterChannel(t *testing.T) {
 	authorizedSenderValidator := validator.NewAuthorizedSenderValidator(logger, violationsConsumer, getIdentity)
 	pubsubMessageValidator := authorizedSenderValidator.PubSubMessageValidator(channel)
 
-	pInfo1, err := utils.PeerAddressInfo(identity1)
+	pInfo1, err := utils.PeerAddressInfo(identity1.IdentitySkeleton)
 	require.NoError(t, err)
 
-	pInfo2, err := utils.PeerAddressInfo(identity2)
+	pInfo2, err := utils.PeerAddressInfo(identity2.IdentitySkeleton)
 	require.NoError(t, err)
 
 	// ln3 <-> sn1 <-> sn2
diff --git a/network/p2p/tracer/gossipSubMeshTracer.go b/network/p2p/tracer/gossipSubMeshTracer.go
index 7e5324b01dd..a25f4e717d6 100644
--- a/network/p2p/tracer/gossipSubMeshTracer.go
+++ b/network/p2p/tracer/gossipSubMeshTracer.go
@@ -18,6 +18,7 @@ import (
 	"github.com/onflow/flow-go/network"
 	"github.com/onflow/flow-go/network/channels"
 	"github.com/onflow/flow-go/network/p2p"
+	p2pconfig "github.com/onflow/flow-go/network/p2p/config"
 	p2plogging "github.com/onflow/flow-go/network/p2p/logging"
 	"github.com/onflow/flow-go/network/p2p/tracer/internal"
 	"github.com/onflow/flow-go/utils/logging"
@@ -47,28 +48,38 @@ const (
 // Additionally, it allows users to configure the logging interval.
 type GossipSubMeshTracer struct {
 	component.Component
-
-	topicMeshMu    sync.RWMutex                    // to protect topicMeshMap
-	topicMeshMap   map[string]map[peer.ID]struct{} // map of local mesh peers by topic.
-	logger         zerolog.Logger
-	idProvider     module.IdentityProvider
-	loggerInterval time.Duration
-	metrics        module.LocalGossipSubRouterMetrics
-	rpcSentTracker *internal.RPCSentTracker
+	topicMeshMu                  sync.RWMutex                    // to protect topicMeshMap
+	topicMeshMap                 map[string]map[peer.ID]struct{} // map of local mesh peers by topic.
+	logger                       zerolog.Logger
+	idProvider                   module.IdentityProvider
+	loggerInterval               time.Duration
+	metrics                      module.LocalGossipSubRouterMetrics
+	rpcSentTracker               *internal.RPCSentTracker
+	duplicateMessageTrackerCache *internal.DuplicateMessageTrackerCache
 }
 
 var _ p2p.PubSubTracer = (*GossipSubMeshTracer)(nil)
 
+type RpcSentTrackerConfig struct {
+	CacheSize            uint32 `validate:"gt=0"`
+	WorkerQueueCacheSize uint32 `validate:"gt=0"`
+	WorkerQueueNumber    int    `validate:"gt=0"`
+}
+
+type DuplicateMessageTrackerCacheConfig struct {
+	CacheSize uint32  `validate:"gt=0"`
+	Decay     float64 `validate:"gt=0"`
+}
+
 type GossipSubMeshTracerConfig struct {
-	network.NetworkingType
-	metrics.HeroCacheMetricsFactory
-	Logger                             zerolog.Logger
-	Metrics                            module.LocalGossipSubRouterMetrics
-	IDProvider                         module.IdentityProvider
-	LoggerInterval                     time.Duration
-	RpcSentTrackerCacheSize            uint32
-	RpcSentTrackerWorkerQueueCacheSize uint32
-	RpcSentTrackerNumOfWorkers         int
+	network.NetworkingType             `validate:"required"`
+	metrics.HeroCacheMetricsFactory    `validate:"required"`
+	Logger                             zerolog.Logger                          `validate:"required"`
+	Metrics                            module.LocalGossipSubRouterMetrics      `validate:"required"`
+	IDProvider                         module.IdentityProvider                 `validate:"required"`
+	LoggerInterval                     time.Duration                           `validate:"required"`
+	DuplicateMessageTrackerCacheConfig p2pconfig.DuplicateMessageTrackerConfig `validate:"required"`
+	RpcSentTracker                     RpcSentTrackerConfig                    `validate:"required"`
 }
 
 // NewGossipSubMeshTracer creates a new *GossipSubMeshTracer.
@@ -80,11 +91,11 @@ func NewGossipSubMeshTracer(config *GossipSubMeshTracerConfig) *GossipSubMeshTra
 	lg := config.Logger.With().Str("component", "gossipsub_topology_tracer").Logger()
 	rpcSentTracker := internal.NewRPCSentTracker(&internal.RPCSentTrackerConfig{
 		Logger:                             lg,
-		RPCSentCacheSize:                   config.RpcSentTrackerCacheSize,
+		RPCSentCacheSize:                   config.RpcSentTracker.CacheSize,
 		RPCSentCacheCollector:              metrics.GossipSubRPCSentTrackerMetricFactory(config.HeroCacheMetricsFactory, config.NetworkingType),
 		WorkerQueueCacheCollector:          metrics.GossipSubRPCSentTrackerQueueMetricFactory(config.HeroCacheMetricsFactory, config.NetworkingType),
-		WorkerQueueCacheSize:               config.RpcSentTrackerWorkerQueueCacheSize,
-		NumOfWorkers:                       config.RpcSentTrackerNumOfWorkers,
+		WorkerQueueCacheSize:               config.RpcSentTracker.WorkerQueueCacheSize,
+		NumOfWorkers:                       config.RpcSentTracker.WorkerQueueNumber,
 		LastHighestIhavesSentResetInterval: defaultLastHighestIHaveRPCSizeResetInterval,
 	})
 	g := &GossipSubMeshTracer{
@@ -94,6 +105,13 @@ func NewGossipSubMeshTracer(config *GossipSubMeshTracerConfig) *GossipSubMeshTra
 		logger:         lg,
 		loggerInterval: config.LoggerInterval,
 		rpcSentTracker: rpcSentTracker,
+		duplicateMessageTrackerCache: internal.NewDuplicateMessageTrackerCache(
+			config.DuplicateMessageTrackerCacheConfig.CacheSize,
+			config.DuplicateMessageTrackerCacheConfig.Decay,
+			config.DuplicateMessageTrackerCacheConfig.SkipDecayThreshold,
+			config.Logger,
+			metrics.GossipSubDuplicateMessageTrackerCacheMetricFactory(config.HeroCacheMetricsFactory, config.NetworkingType),
+		),
 	}
 
 	g.Component = component.NewComponentManagerBuilder().
@@ -359,10 +377,21 @@ func (t *GossipSubMeshTracer) DuplicateMessage(msg *pubsub.Message) {
 		lg = lg.With().Str("remote_peer_id", p2plogging.PeerId(from)).Logger()
 	}
 
+	count, err := t.duplicateMessageTrackerCache.DuplicateMessageReceived(msg.ReceivedFrom)
+	if err != nil {
+		t.logger.Fatal().
+			Err(err).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Msg("failed to increment gossipsub duplicate message tracker count for peer")
+		return
+	}
+
 	lg.Trace().
 		Str("received_from", p2plogging.PeerId(msg.ReceivedFrom)).
 		Int("message_size", size).
+		Float64("duplicate_message_count", count).
 		Msg("received duplicate pubsub message")
+
 }
 
 // ThrottlePeer is called by GossipSub when a peer is throttled by the local node, i.e., the local node is not accepting any
@@ -450,6 +479,28 @@ func (t *GossipSubMeshTracer) LastHighestIHaveRPCSize() int64 {
 	return t.rpcSentTracker.LastHighestIHaveRPCSize()
 }
 
+// DuplicateMessageCount returns the current duplicate message count for the peer.
+func (t *GossipSubMeshTracer) DuplicateMessageCount(peerID peer.ID) float64 {
+	count, found, err := t.duplicateMessageTrackerCache.GetWithInit(peerID)
+	if err != nil {
+		t.logger.Fatal().
+			Err(err).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Str("peer_id", p2plogging.PeerId(peerID)).
+			Msg("failed to get duplicate message count for peer")
+		return 0
+	}
+	if !found {
+		t.logger.Fatal().
+			Err(err).
+			Bool(logging.KeyNetworkingSecurity, true).
+			Str("peer_id", peerID.String()).
+			Msg("failed to initialize duplicate message count for peer during get with init")
+		return 0
+	}
+	return count
+}
+
 // logLoop logs the mesh peers of the local node for each topic at a regular interval.
 func (t *GossipSubMeshTracer) logLoop(ctx irrecoverable.SignalerContext) {
 	ticker := time.NewTicker(t.loggerInterval)
diff --git a/network/p2p/tracer/gossipSubMeshTracer_test.go b/network/p2p/tracer/gossipSubMeshTracer_test.go
index aaf6419cec7..75163922d60 100644
--- a/network/p2p/tracer/gossipSubMeshTracer_test.go
+++ b/network/p2p/tracer/gossipSubMeshTracer_test.go
@@ -74,6 +74,8 @@ func TestGossipSubMeshTracer(t *testing.T) {
 	defaultConfig.NetworkConfig.GossipSub.RpcTracer.LocalMeshLogInterval = 1 * time.Second
 	// disables peer scoring for sake of testing; so that unknown peers are not penalized and could be detected by the meshTracer.
 	defaultConfig.NetworkConfig.GossipSub.PeerScoringEnabled = false
+	// disables rejection of RPC's from unstaked peer so that unknown peers could be detected bu the meshTracer
+	defaultConfig.NetworkConfig.GossipSub.RpcInspector.Validation.InspectionProcess.Inspect.RejectUnstakedPeers = false
 	tracerNode, tracerId := p2ptest.NodeFixture(
 		t,
 		sporkId,
diff --git a/network/p2p/tracer/internal/duplicate_msgs_counter_cache.go b/network/p2p/tracer/internal/duplicate_msgs_counter_cache.go
new file mode 100644
index 00000000000..e2deb3189fb
--- /dev/null
+++ b/network/p2p/tracer/internal/duplicate_msgs_counter_cache.go
@@ -0,0 +1,154 @@
+package internal
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/libp2p/go-libp2p/core/peer"
+	"github.com/rs/zerolog"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module"
+	herocache "github.com/onflow/flow-go/module/mempool/herocache/backdata"
+	"github.com/onflow/flow-go/module/mempool/herocache/backdata/heropool"
+	"github.com/onflow/flow-go/module/mempool/stdmap"
+	"github.com/onflow/flow-go/network/p2p/scoring"
+)
+
+// DuplicateMessageTrackerCache is a cache used to store the current count of duplicate messages detected
+// from a peer. This count is utilized to calculate a penalty for duplicate messages, which is then applied
+// to the peer's application-specific score. The duplicate message tracker decays over time to prevent perpetual
+// penalization of a peer.
+type DuplicateMessageTrackerCache struct {
+	// the in-memory and thread-safe cache for storing the spam records of peers.
+	c     *stdmap.Backend
+	decay float64
+	// skipDecayThreshold The threshold for which when the counter is below this value, the decay function will not be called
+	skipDecayThreshold float64
+}
+
+// NewDuplicateMessageTrackerCache returns a new HeroCache-based duplicate message counter cache.
+// Args:
+//
+//	sizeLimit: the maximum number of entries that can be stored in the cache.
+//	decay: the record decay.
+//	logger: the logger to be used by the cache.
+//	collector: the metrics collector to be used by the cache.
+//
+// Returns:
+//   - *DuplicateMessageTrackerCache: the newly created cache with a HeroCache-based backend.
+func NewDuplicateMessageTrackerCache(sizeLimit uint32, decay, skipDecayThreshold float64, logger zerolog.Logger, collector module.HeroCacheMetrics) *DuplicateMessageTrackerCache {
+	backData := herocache.NewCache(sizeLimit,
+		herocache.DefaultOversizeFactor,
+		heropool.LRUEjection,
+		logger.With().Str("mempool", "gossipsub=duplicate-message-counter-cache").Logger(),
+		collector)
+	return &DuplicateMessageTrackerCache{
+		decay:              decay,
+		skipDecayThreshold: skipDecayThreshold,
+		c:                  stdmap.NewBackend(stdmap.WithBackData(backData)),
+	}
+}
+
+// DuplicateMessageReceived applies an adjustment that increments the number of duplicate messages received by a peer.
+// Returns number of duplicate messages received after the adjustment. The record is initialized before
+// the adjustment func is applied that will increment the counter value.
+//   - exception only in cases of internal data inconsistency or bugs. No errors are expected.
+func (d *DuplicateMessageTrackerCache) DuplicateMessageReceived(peerID peer.ID) (float64, error) {
+	var err error
+	adjustFunc := func(entity flow.Entity) flow.Entity {
+		entity, err = d.decayAdjustment(entity) // first decay the record
+		if err != nil {
+			return entity
+		}
+		return d.incrementAdjustment(entity) // then increment the record
+	}
+
+	entityId := makeId(peerID)
+	adjustedEntity, adjusted := d.c.AdjustWithInit(entityId, adjustFunc, func() flow.Entity {
+		return newDuplicateMessagesCounter(entityId)
+	})
+
+	if err != nil {
+		return 0, fmt.Errorf("unexpected error while applying decay and increment adjustments for peer %s: %w", peerID, err)
+	}
+
+	if !adjusted {
+		return 0, fmt.Errorf("adjustment failed for peer %s", peerID)
+	}
+
+	record := mustBeDuplicateMessagesCounterEntity(adjustedEntity)
+
+	return record.Value, nil
+}
+
+// GetWithInit returns the current number of duplicate messages received from a peer.
+// The record is initialized before the count is returned.
+// Before the counter value is returned it is decayed using the configured decay function.
+// Returns the record and true if the record exists, nil and false otherwise.
+// Args:
+// - peerID: peerID of the remote peer.
+// Returns:
+// - The duplicate messages counter value after the decay and true if the record exists, 0 and false otherwise.
+// No errors are expected during normal operation, all errors returned are considered irrecoverable.
+func (d *DuplicateMessageTrackerCache) GetWithInit(peerID peer.ID) (float64, bool, error) {
+	var err error
+	adjustLogic := func(entity flow.Entity) flow.Entity {
+		// perform decay on gauge value
+		entity, err = d.decayAdjustment(entity)
+		return entity
+	}
+
+	entityId := makeId(peerID)
+	adjustedEntity, adjusted := d.c.AdjustWithInit(entityId, adjustLogic, func() flow.Entity {
+		return newDuplicateMessagesCounter(entityId)
+	})
+	if err != nil {
+		return 0, false, fmt.Errorf("unexpected error while applying decay adjustment for peer %s: %w", peerID, err)
+	}
+	if !adjusted {
+		return 0, false, fmt.Errorf("decay adjustment failed for peer %s", peerID)
+	}
+
+	counter := mustBeDuplicateMessagesCounterEntity(adjustedEntity)
+
+	return counter.Value, true, nil
+}
+
+// incrementAdjustment performs a cache adjustment that increments the guage for the duplicateMessagesCounterEntity
+func (d *DuplicateMessageTrackerCache) incrementAdjustment(entity flow.Entity) flow.Entity {
+	counter := mustBeDuplicateMessagesCounterEntity(entity)
+	counter.Value++
+	counter.lastUpdated = time.Now()
+	// Return the adjusted counter.
+	return counter
+}
+
+// decayAdjustment performs geometric recordDecay on the duplicate message counter gauge of a peer. This ensures a peer is not penalized forever.
+// All errors returned from this function are unexpected and irrecoverable.
+func (d *DuplicateMessageTrackerCache) decayAdjustment(entity flow.Entity) (flow.Entity, error) {
+	counter := mustBeDuplicateMessagesCounterEntity(entity)
+	duplicateMessages := counter.Value
+	if duplicateMessages == 0 {
+		return counter, nil
+	}
+
+	if duplicateMessages < d.skipDecayThreshold {
+		counter.Value = 0
+		return counter, nil
+	}
+
+	decayedVal, err := scoring.GeometricDecay(duplicateMessages, d.decay, counter.lastUpdated)
+	if err != nil {
+		return counter, fmt.Errorf("could not decay duplicate message counter: %w", err)
+	}
+
+	if decayedVal > duplicateMessages {
+		return counter, fmt.Errorf("unexpected recordDecay value %f for duplicate message counter gauge %f", decayedVal, duplicateMessages)
+	}
+
+	counter.Value = decayedVal
+	counter.lastUpdated = time.Now()
+	// Return the adjusted counter.
+	return counter, nil
+}
diff --git a/network/p2p/tracer/internal/duplicate_msgs_counter_cache_test.go b/network/p2p/tracer/internal/duplicate_msgs_counter_cache_test.go
new file mode 100644
index 00000000000..6e53d89ec1f
--- /dev/null
+++ b/network/p2p/tracer/internal/duplicate_msgs_counter_cache_test.go
@@ -0,0 +1,229 @@
+package internal
+
+import (
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/libp2p/go-libp2p/core/peer"
+	"github.com/rs/zerolog"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/module"
+	"github.com/onflow/flow-go/module/metrics"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+const defaultDecay = .99
+const defaultSkipDecayThreshold = 0.1
+
+// TestDuplicateMessageTrackerCache_Init tests the Init method of the RecordCache.
+// It ensures that the method returns true when a new record is initialized
+// and false when an existing record is initialized.
+func TestDuplicateMessageTrackerCache_Init(t *testing.T) {
+	cache := duplicateMessageTrackerCacheFixture(t, 100, defaultDecay, defaultSkipDecayThreshold, zerolog.Nop(), metrics.NewNoopCollector())
+
+	peerID1 := unittest.PeerIdFixture(t)
+	peerID2 := unittest.PeerIdFixture(t)
+
+	// test initializing a record for an node ID that doesn't exist in the cache
+	gauge, ok, err := cache.GetWithInit(peerID1)
+	require.NoError(t, err)
+	require.True(t, ok, "expected record to exist")
+	require.Zerof(t, gauge, "expected gauge to be 0")
+	require.Equal(t, uint(1), cache.c.Size(), "expected cache to have one additional record")
+
+	// test initializing a record for an node ID that already exists in the cache
+	gaugeAgain, ok, err := cache.GetWithInit(peerID1)
+	require.NoError(t, err)
+	require.True(t, ok, "expected record to still exist")
+	require.Zerof(t, gaugeAgain, "expected same gauge to be 0")
+	require.Equal(t, gauge, gaugeAgain, "expected records to be the same")
+	require.Equal(t, uint(1), cache.c.Size(), "expected cache to still have one additional record")
+
+	// test initializing a record for another node ID
+	gauge2, ok, err := cache.GetWithInit(peerID2)
+	require.NoError(t, err)
+	require.True(t, ok, "expected record to exist")
+	require.Zerof(t, gauge2, "expected second gauge to be 0")
+	require.Equal(t, uint(2), cache.c.Size(), "expected cache to have two additional records")
+}
+
+// TestDuplicateMessageTrackerCache_ConcurrentInit tests the concurrent initialization of records.
+// The test covers the following scenarios:
+// 1. Multiple goroutines initializing records for different node IDs.
+// 2. Ensuring that all records are correctly initialized.
+func TestDuplicateMessageTrackerCache_ConcurrentInit(t *testing.T) {
+	cache := duplicateMessageTrackerCacheFixture(t, 100, defaultDecay, defaultSkipDecayThreshold, zerolog.Nop(), metrics.NewNoopCollector())
+
+	peerIDs := unittest.PeerIdFixtures(t, 10)
+
+	var wg sync.WaitGroup
+	wg.Add(len(peerIDs))
+
+	for _, peerID := range peerIDs {
+		go func(id peer.ID) {
+			defer wg.Done()
+			gauge, found, err := cache.GetWithInit(id)
+			require.NoError(t, err)
+			require.True(t, found)
+			require.Zerof(t, gauge, "expected all gauge values to be initialized to 0")
+		}(peerID)
+	}
+
+	unittest.RequireReturnsBefore(t, wg.Wait, 100*time.Millisecond, "timed out waiting for goroutines to finish")
+}
+
+// TestDuplicateMessageTrackerCache_ConcurrentSameRecordInit tests the concurrent initialization of the same record.
+// The test covers the following scenarios:
+// 1. Multiple goroutines attempting to initialize the same record concurrently.
+// 2. Only one goroutine successfully initializes the record, and others receive false on initialization.
+// 3. The record is correctly initialized in the cache and can be retrieved using the GetWithInit method.
+func TestDuplicateMessageTrackerCache_ConcurrentSameRecordInit(t *testing.T) {
+	cache := duplicateMessageTrackerCacheFixture(t, 100, defaultDecay, defaultSkipDecayThreshold, zerolog.Nop(), metrics.NewNoopCollector())
+
+	peerID := unittest.PeerIdFixture(t)
+	const concurrentAttempts = 10
+
+	var wg sync.WaitGroup
+	wg.Add(concurrentAttempts)
+
+	for i := 0; i < concurrentAttempts; i++ {
+		go func() {
+			defer wg.Done()
+			gauge, found, err := cache.GetWithInit(peerID)
+			require.NoError(t, err)
+			require.True(t, found)
+			require.Zero(t, gauge)
+		}()
+	}
+
+	unittest.RequireReturnsBefore(t, wg.Wait, 100*time.Millisecond, "timed out waiting for goroutines to finish")
+
+	// ensure that only one goroutine successfully initialized the record
+	require.Equal(t, uint(1), cache.c.Size())
+}
+
+// TestDuplicateMessageTrackerCache_DuplicateMessageReceived tests the DuplicateMessageReceived method of the RecordCache.
+// The test covers the following scenarios:
+// 1. Updating a record gauge for an existing peer ID.
+// 2. Attempting to update a record gauge  for a non-existing peer ID should not result in error. DuplicateMessageReceived should always attempt to initialize the gauge.
+// 3. Multiple updates on the same record only initialize the record once.
+func TestDuplicateMessageTrackerCache_DuplicateMessageReceived(t *testing.T) {
+	cache := duplicateMessageTrackerCacheFixture(t, 100, defaultDecay, defaultSkipDecayThreshold, zerolog.Nop(), metrics.NewNoopCollector())
+
+	peerID1 := unittest.PeerIdFixture(t)
+	peerID2 := unittest.PeerIdFixture(t)
+
+	gauge, err := cache.DuplicateMessageReceived(peerID1)
+	require.NoError(t, err)
+	require.Equal(t, float64(1), gauge)
+
+	// get will apply a slightl decay resulting
+	// in a gauge value less than gauge which is 1 but greater than 0.9
+	currentGauge, ok, err := cache.GetWithInit(peerID1)
+	require.NoError(t, err)
+	require.True(t, ok)
+	require.LessOrEqual(t, currentGauge, gauge)
+	require.Greater(t, currentGauge, 0.9)
+
+	_, ok, err = cache.GetWithInit(peerID2)
+	require.NoError(t, err)
+	require.True(t, ok)
+
+	// test adjusting the spam record for a non-existing node ID
+	peerID3 := unittest.PeerIdFixture(t)
+	gauge3, err := cache.DuplicateMessageReceived(peerID3)
+	require.NoError(t, err)
+	require.Equal(t, float64(1), gauge3)
+
+	// when updated the value should be incremented from 1 -> 2 and slightly decayed resulting
+	// in a gauge value less than 2 but greater than 1.9
+	gauge3, err = cache.DuplicateMessageReceived(peerID3)
+	require.NoError(t, err)
+	require.LessOrEqual(t, gauge3, 2.0)
+	require.Greater(t, gauge3, 1.9)
+}
+
+// TestDuplicateMessageTrackerCache_ConcurrentDuplicateMessageReceived tests the concurrent adjustments and reads of records for different
+// node IDs. The test covers the following scenarios:
+// 1. Multiple goroutines adjusting records for different peer IDs concurrently.
+// 2. Multiple goroutines getting records for different peer IDs concurrently.
+// 3. The adjusted records are correctly updated in the cache.
+// 4. Ensure records are decayed as expected.
+func TestDuplicateMessageTrackerCache_ConcurrentDuplicateMessageReceived(t *testing.T) {
+	cache := duplicateMessageTrackerCacheFixture(t, 100, defaultDecay, defaultSkipDecayThreshold, zerolog.Nop(), metrics.NewNoopCollector())
+
+	peerIDs := unittest.PeerIdFixtures(t, 10)
+	for _, peerID := range peerIDs {
+		_, ok, err := cache.GetWithInit(peerID)
+		require.NoError(t, err)
+		require.True(t, ok)
+	}
+
+	var wg sync.WaitGroup
+	wg.Add(len(peerIDs) * 2)
+
+	for _, peerID := range peerIDs {
+		// adjust spam records concurrently
+		go func(id peer.ID) {
+			defer wg.Done()
+			_, err := cache.DuplicateMessageReceived(id)
+			require.NoError(t, err)
+		}(peerID)
+
+		// get spam records concurrently
+		go func(id peer.ID) {
+			defer wg.Done()
+			_, found, err := cache.GetWithInit(id)
+			require.NoError(t, err)
+			require.True(t, found)
+		}(peerID)
+	}
+
+	unittest.RequireReturnsBefore(t, wg.Wait, 100*time.Millisecond, "timed out waiting for goroutines to finish")
+
+	// ensure that the records are correctly updated in the cache
+	for _, nodeID := range peerIDs {
+		gauge, found, err := cache.GetWithInit(nodeID)
+		require.NoError(t, err)
+		require.True(t, found)
+		// slight decay will result in 0.9 < gauge < 1
+		require.LessOrEqual(t, gauge, 1.0)
+		require.Greater(t, gauge, 0.9)
+	}
+}
+
+// TestDuplicateMessageTrackerCache_UpdateDecay ensures that a counter value in the record cache is eventually decayed back to 0 after some time.
+func TestDuplicateMessageTrackerCache_Decay(t *testing.T) {
+	cache := duplicateMessageTrackerCacheFixture(t, 100, 0.09, defaultSkipDecayThreshold, zerolog.Nop(), metrics.NewNoopCollector())
+
+	peerID := unittest.PeerIdFixture(t)
+
+	// initialize spam records for peerID and nodeID2
+	gauge, err := cache.DuplicateMessageReceived(peerID)
+	require.Equal(t, float64(1), gauge)
+	require.NoError(t, err)
+	gauge, ok, err := cache.GetWithInit(peerID)
+	require.True(t, ok)
+	require.NoError(t, err)
+	// gauge should have been delayed slightly
+	require.True(t, gauge < float64(1))
+
+	time.Sleep(time.Second)
+
+	gauge, ok, err = cache.GetWithInit(peerID)
+	require.True(t, ok)
+	require.NoError(t, err)
+	// gauge should have been delayed slightly, but closer to 0
+	require.Less(t, gauge, 0.1)
+}
+
+// rpcSentCacheFixture returns a new *DuplicateMessageTrackerCache.
+func duplicateMessageTrackerCacheFixture(t *testing.T, sizeLimit uint32, decay, skipDecayThreshold float64, logger zerolog.Logger, collector module.HeroCacheMetrics) *DuplicateMessageTrackerCache {
+	r := NewDuplicateMessageTrackerCache(sizeLimit, decay, skipDecayThreshold, logger, collector)
+	// expect cache to be empty
+	require.Equalf(t, uint(0), r.c.Size(), "cache size must be 0")
+	require.NotNil(t, r)
+	return r
+}
diff --git a/network/p2p/tracer/internal/duplicate_msgs_counter_entity.go b/network/p2p/tracer/internal/duplicate_msgs_counter_entity.go
new file mode 100644
index 00000000000..4f7c5364806
--- /dev/null
+++ b/network/p2p/tracer/internal/duplicate_msgs_counter_entity.go
@@ -0,0 +1,60 @@
+package internal
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/libp2p/go-libp2p/core/peer"
+
+	"github.com/onflow/flow-go/model/flow"
+)
+
+// duplicateMessagesCounterEntity cache record that keeps track of the amount of duplicate messages received from a peer.
+type duplicateMessagesCounterEntity struct {
+	// ID the entity ID.
+	Id flow.Identifier
+	// Value the number of duplicate messages.
+	Value       float64
+	lastUpdated time.Time
+}
+
+func newDuplicateMessagesCounter(id flow.Identifier) duplicateMessagesCounterEntity {
+	return duplicateMessagesCounterEntity{
+		Id:          id,
+		Value:       0.0,
+		lastUpdated: time.Now(),
+	}
+}
+
+var _ flow.Entity = (*duplicateMessagesCounterEntity)(nil)
+
+func (d duplicateMessagesCounterEntity) ID() flow.Identifier {
+	return d.Id
+}
+
+func (d duplicateMessagesCounterEntity) Checksum() flow.Identifier {
+	return d.Id
+}
+
+// mustBeDuplicateMessagesCounterEntity is a helper function for type assertion of the flow.Entity to duplicateMessagesCounterEntity.
+// It panics if the type assertion fails.
+// Args:
+// - entity: the flow.Entity to be type asserted.
+// Returns:
+// - the duplicateMessagesCounterEntity entity.
+func mustBeDuplicateMessagesCounterEntity(entity flow.Entity) duplicateMessagesCounterEntity {
+	c, ok := entity.(duplicateMessagesCounterEntity)
+	if !ok {
+		// sanity check
+		// This should never happen, because the cache only contains duplicateMessagesCounterEntity entities.
+		panic(fmt.Sprintf("invalid entity type, expected duplicateMessagesCounterEntity type, got: %T", entity))
+	}
+	return c
+}
+
+// makeId is a helper function for creating the id field of the duplicateMessagesCounterEntity by hashing the peerID.
+// Returns:
+// - the hash of the peerID as a flow.Identifier.
+func makeId(peerID peer.ID) flow.Identifier {
+	return flow.MakeID([]byte(peerID))
+}
diff --git a/network/p2p/tracer/internal/cache.go b/network/p2p/tracer/internal/rpc_sent_cache.go
similarity index 96%
rename from network/p2p/tracer/internal/cache.go
rename to network/p2p/tracer/internal/rpc_sent_cache.go
index 655ddf2179f..d1f5de9c294 100644
--- a/network/p2p/tracer/internal/cache.go
+++ b/network/p2p/tracer/internal/rpc_sent_cache.go
@@ -1,8 +1,6 @@
 package internal
 
 import (
-	"fmt"
-
 	"github.com/rs/zerolog"
 
 	"github.com/onflow/flow-go/model/flow"
@@ -79,5 +77,5 @@ func (r *rpcSentCache) size() uint {
 // Returns:
 // - flow.Identifier: the entity ID.
 func (r *rpcSentCache) rpcSentEntityID(messageId string, controlMsgType p2pmsg.ControlMessageType) flow.Identifier {
-	return flow.MakeIDFromFingerPrint([]byte(fmt.Sprintf("%s%s", messageId, controlMsgType)))
+	return flow.MakeIDFromFingerPrint([]byte(messageId + string(controlMsgType)))
 }
diff --git a/network/p2p/tracer/internal/cache_test.go b/network/p2p/tracer/internal/rpc_sent_cache_test.go
similarity index 90%
rename from network/p2p/tracer/internal/cache_test.go
rename to network/p2p/tracer/internal/rpc_sent_cache_test.go
index 10872b7b7ef..91cdeda6df3 100644
--- a/network/p2p/tracer/internal/cache_test.go
+++ b/network/p2p/tracer/internal/rpc_sent_cache_test.go
@@ -20,7 +20,7 @@ import (
 // It ensures that the method returns true when a new record is initialized
 // and false when an existing record is initialized.
 func TestCache_Add(t *testing.T) {
-	cache := cacheFixture(t, 100, zerolog.Nop(), metrics.NewNoopCollector())
+	cache := rpcSentCacheFixture(t, 100, zerolog.Nop(), metrics.NewNoopCollector())
 	controlMsgType := p2pmsg.CtrlMsgIHave
 	messageID1 := unittest.IdentifierFixture().String()
 	messageID2 := unittest.IdentifierFixture().String()
@@ -46,7 +46,7 @@ func TestCache_Add(t *testing.T) {
 // 1. Multiple goroutines initializing records for different ids.
 // 2. Ensuring that all records are correctly initialized.
 func TestCache_ConcurrentAdd(t *testing.T) {
-	cache := cacheFixture(t, 100, zerolog.Nop(), metrics.NewNoopCollector())
+	cache := rpcSentCacheFixture(t, 100, zerolog.Nop(), metrics.NewNoopCollector())
 	controlMsgType := p2pmsg.CtrlMsgIHave
 	messageIds := unittest.IdentifierListFixture(10)
 
@@ -74,7 +74,7 @@ func TestCache_ConcurrentAdd(t *testing.T) {
 // 2. Only one goroutine successfully initializes the record, and others receive false on initialization.
 // 3. The record is correctly initialized in the cache and can be retrieved using the Get method.
 func TestCache_ConcurrentSameRecordAdd(t *testing.T) {
-	cache := cacheFixture(t, 100, zerolog.Nop(), metrics.NewNoopCollector())
+	cache := rpcSentCacheFixture(t, 100, zerolog.Nop(), metrics.NewNoopCollector())
 	controlMsgType := p2pmsg.CtrlMsgIHave
 	messageID := unittest.IdentifierFixture().String()
 	const concurrentAttempts = 10
@@ -103,8 +103,8 @@ func TestCache_ConcurrentSameRecordAdd(t *testing.T) {
 	require.True(t, cache.has(messageID, controlMsgType))
 }
 
-// cacheFixture returns a new *RecordCache.
-func cacheFixture(t *testing.T, sizeLimit uint32, logger zerolog.Logger, collector module.HeroCacheMetrics) *rpcSentCache {
+// rpcSentCacheFixture returns a new *RecordCache.
+func rpcSentCacheFixture(t *testing.T, sizeLimit uint32, logger zerolog.Logger, collector module.HeroCacheMetrics) *rpcSentCache {
 	config := &rpcCtrlMsgSentCacheConfig{
 		sizeLimit: sizeLimit,
 		logger:    logger,
diff --git a/network/p2p/tracer/internal/rpc_send_entity.go b/network/p2p/tracer/internal/rpc_sent_entity.go
similarity index 100%
rename from network/p2p/tracer/internal/rpc_send_entity.go
rename to network/p2p/tracer/internal/rpc_sent_entity.go
diff --git a/network/p2p/translator/identity_provider_translator.go b/network/p2p/translator/identity_provider_translator.go
index d1dd643415a..ddd1f41c004 100644
--- a/network/p2p/translator/identity_provider_translator.go
+++ b/network/p2p/translator/identity_provider_translator.go
@@ -38,7 +38,7 @@ func (t *IdentityProviderIDTranslator) GetFlowID(p peer.ID) (flow.Identifier, er
 }
 
 func (t *IdentityProviderIDTranslator) GetPeerID(n flow.Identifier) (peer.ID, error) {
-	ids := t.idProvider.Identities(filter.HasNodeID(n))
+	ids := t.idProvider.Identities(filter.HasNodeID[flow.Identity](n))
 	if len(ids) == 0 {
 		return "", fmt.Errorf("could not find identity with id %v", n.String())
 	}
diff --git a/network/p2p/translator/unstaked_translator.go b/network/p2p/translator/unstaked_translator.go
index a1386ba6119..5948e17e52b 100644
--- a/network/p2p/translator/unstaked_translator.go
+++ b/network/p2p/translator/unstaked_translator.go
@@ -52,7 +52,7 @@ func (t *PublicNetworkIDTranslator) GetPeerID(flowID flow.Identifier) (peer.ID,
 func (t *PublicNetworkIDTranslator) GetFlowID(peerID peer.ID) (flow.Identifier, error) {
 	pk, err := peerID.ExtractPublicKey()
 	if err != nil {
-		return flow.ZeroID, fmt.Errorf("cannot generate an unstaked FlowID for peerID %v: corresponding libp2p key is not extractible from PeerID", peerID)
+		return flow.ZeroID, fmt.Errorf("cannot generate an unstaked FlowID for peerID %v: corresponding libp2p key is not extractible from PeerID: %w", peerID, err)
 	}
 
 	if pk.Type() != crypto_pb.KeyType_Secp256k1 {
diff --git a/network/p2p/utils/p2putils.go b/network/p2p/utils/p2putils.go
index 1779cdc34f9..524eb8aae1e 100644
--- a/network/p2p/utils/p2putils.go
+++ b/network/p2p/utils/p2putils.go
@@ -19,7 +19,7 @@ import (
 //	flow.Identity        ---> peer.AddrInfo
 //	|-- Address          --->   |-- []multiaddr.Multiaddr
 //	|-- NetworkPublicKey --->   |-- ID
-func PeerAddressInfo(identity flow.Identity) (peer.AddrInfo, error) {
+func PeerAddressInfo(identity flow.IdentitySkeleton) (peer.AddrInfo, error) {
 	ip, port, key, err := p2putils.NetworkingInfo(identity)
 	if err != nil {
 		return peer.AddrInfo{}, fmt.Errorf("could not translate identity to networking info %s: %w", identity.NodeID.String(), err)
@@ -39,14 +39,14 @@ func PeerAddressInfo(identity flow.Identity) (peer.AddrInfo, error) {
 	return pInfo, err
 }
 
-// PeerInfosFromIDs converts the given flow.Identities to peer.AddrInfo.
+// PeerInfosFromIDs converts the given flow.Identity to peer.AddrInfo.
 // For each identity, if the conversion succeeds, the peer.AddrInfo is included in the result else it is
 // included in the error map with the corresponding error
 func PeerInfosFromIDs(ids flow.IdentityList) ([]peer.AddrInfo, map[flow.Identifier]error) {
 	validIDs := make([]peer.AddrInfo, 0, len(ids))
 	invalidIDs := make(map[flow.Identifier]error)
 	for _, id := range ids {
-		peerInfo, err := PeerAddressInfo(*id)
+		peerInfo, err := PeerAddressInfo(id.IdentitySkeleton)
 		if err != nil {
 			invalidIDs[id.NodeID] = err
 			continue
diff --git a/network/test/cohort1/meshengine_test.go b/network/test/cohort1/meshengine_test.go
index 9e25cd84eae..081e00d94eb 100644
--- a/network/test/cohort1/meshengine_test.go
+++ b/network/test/cohort1/meshengine_test.go
@@ -247,7 +247,7 @@ func (suite *MeshEngineTestSuite) allToAllScenario(send testutils.ConduitSendWra
 		}
 
 		// others keeps the identifier of all nodes except ith node
-		others := suite.ids.Filter(filter.Not(filter.HasNodeID(suite.ids[i].NodeID))).NodeIDs()
+		others := suite.ids.Filter(filter.Not(filter.HasNodeID[flow.Identity](suite.ids[i].NodeID))).NodeIDs()
 		require.NoError(suite.Suite.T(), send(event, engs[i].Con, others...))
 		wg.Add(count - 1)
 	}
@@ -379,7 +379,7 @@ func (suite *MeshEngineTestSuite) messageSizeScenario(send testutils.ConduitSend
 		}
 	}
 	// others keeps the identifier of all nodes except node that is sender.
-	others := suite.ids.Filter(filter.Not(filter.HasNodeID(suite.ids[0].NodeID))).NodeIDs()
+	others := suite.ids.Filter(filter.Not(filter.HasNodeID[flow.Identity](suite.ids[0].NodeID))).NodeIDs()
 
 	// generates and sends an event of custom size to the network
 	payload := testutils.NetworkPayloadFixture(suite.T(), size)
@@ -450,7 +450,7 @@ func (suite *MeshEngineTestSuite) conduitCloseScenario(send testutils.ConduitSen
 
 		// others keeps the identifier of all nodes except ith node and the node that unregistered from the topic.
 		// nodes without valid topic registration for a channel will reject messages on that channel via unicast.
-		others := suite.ids.Filter(filter.Not(filter.HasNodeID(suite.ids[i].NodeID, suite.ids[unregisterIndex].NodeID))).NodeIDs()
+		others := suite.ids.Filter(filter.Not(filter.HasNodeID[flow.Identity](suite.ids[i].NodeID, suite.ids[unregisterIndex].NodeID))).NodeIDs()
 
 		if i == unregisterIndex {
 			// assert that unsubscribed engine cannot publish on that topic
diff --git a/network/test/cohort2/epochtransition_test.go b/network/test/cohort2/epochtransition_test.go
index 6b33664cf65..71aca42e5e6 100644
--- a/network/test/cohort2/epochtransition_test.go
+++ b/network/test/cohort2/epochtransition_test.go
@@ -180,10 +180,10 @@ func (suite *MutableIdentityTableSuite) setupStateMock() {
 	suite.snapshot.On("Phase").Return(flow.EpochPhaseCommitted, nil)
 	// return all the current list of ids for the state.Final.Identities call made by the network
 	suite.snapshot.On("Identities", mock.Anything).Return(
-		func(flow.IdentityFilter) flow.IdentityList {
+		func(flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return suite.testNodes.ids()
 		},
-		func(flow.IdentityFilter) error { return nil })
+		func(flow.IdentityFilter[flow.Identity]) error { return nil })
 	suite.state.On("Final").Return(suite.snapshot, nil)
 }
 
@@ -397,7 +397,7 @@ func (suite *MutableIdentityTableSuite) exchangeMessages(
 	for i, allowedEng := range allowedEngs {
 
 		fromID := allowedIDs[i].NodeID
-		targetIDs := allowedIDs.Filter(filter.Not(filter.HasNodeID(allowedIDs[i].NodeID)))
+		targetIDs := allowedIDs.Filter(filter.Not(filter.HasNodeID[flow.Identity](allowedIDs[i].NodeID)))
 
 		err := suite.sendMessage(fromID, allowedEng, targetIDs, send)
 		require.NoError(suite.T(), err)
diff --git a/network/test/cohort2/unicast_authorization_test.go b/network/test/cohort2/unicast_authorization_test.go
index 26d5da48849..1391b95dcad 100644
--- a/network/test/cohort2/unicast_authorization_test.go
+++ b/network/test/cohort2/unicast_authorization_test.go
@@ -168,8 +168,8 @@ func (u *UnicastAuthorizationTestSuite) TestUnicastAuthorization_UnstakedPeer()
 func (u *UnicastAuthorizationTestSuite) TestUnicastAuthorization_EjectedPeer() {
 	slashingViolationsConsumer := mocknetwork.NewViolationsConsumer(u.T())
 	u.setupNetworks(slashingViolationsConsumer)
-	// NOTE: setup ejected identity
-	u.senderID.Ejected = true
+	//NOTE: setup ejected identity
+	u.senderID.EpochParticipationStatus = flow.EpochParticipationStatusEjected
 
 	// overriding the identity provide of the receiver node to return the ejected identity so that the
 	// sender node looks ejected to its networking layer and hence it sends a SenderEjectedError upon receiving a message
diff --git a/network/underlay/network.go b/network/underlay/network.go
index d7a1b3f277b..9217aa099f4 100644
--- a/network/underlay/network.go
+++ b/network/underlay/network.go
@@ -74,14 +74,6 @@ var (
 	ErrUnicastMsgWithoutSub = errors.New("networking layer does not have subscription for the channel ID indicated in the unicast message received")
 )
 
-// NotEjectedFilter is an identity filter that, when applied to the identity
-// table at a given snapshot, returns all nodes that we should communicate with
-// over the networking layer.
-//
-// NOTE: The protocol state includes nodes from the previous/next epoch that should
-// be included in network communication. We omit any nodes that have been ejected.
-var NotEjectedFilter = filter.Not(filter.Ejected)
-
 // Network serves as the comprehensive networking layer that integrates three interfaces within Flow; Underlay, EngineRegistry, and ConduitAdapter.
 // It is responsible for creating conduits through which engines can send and receive messages to and from other engines on the network, as well as registering other services
 // such as BlobService and PingService. It also provides a set of APIs that can be used to send messages to other nodes on the network.
@@ -545,7 +537,7 @@ func (n *Network) UnRegisterChannel(channel channels.Channel) error {
 }
 
 func (n *Network) Identities() flow.IdentityList {
-	return n.identityProvider.Identities(NotEjectedFilter)
+	return n.identityProvider.Identities(filter.NotEjectedFilter)
 }
 
 func (n *Network) Identity(pid peer.ID) (*flow.Identity, bool) {
diff --git a/network/underlay/noop.go b/network/underlay/noop.go
new file mode 100644
index 00000000000..8273ded7026
--- /dev/null
+++ b/network/underlay/noop.go
@@ -0,0 +1,51 @@
+package underlay
+
+import (
+	"github.com/ipfs/go-datastore"
+	"github.com/libp2p/go-libp2p/core/protocol"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module"
+	"github.com/onflow/flow-go/network"
+	"github.com/onflow/flow-go/network/channels"
+)
+
+type NoopConduit struct{}
+
+var _ network.Conduit = (*NoopConduit)(nil)
+
+func (n *NoopConduit) ReportMisbehavior(network.MisbehaviorReport) {}
+
+func (n *NoopConduit) Publish(event interface{}, targetIDs ...flow.Identifier) error {
+	return nil
+}
+
+func (n *NoopConduit) Unicast(event interface{}, targetID flow.Identifier) error {
+	return nil
+}
+
+func (n *NoopConduit) Multicast(event interface{}, num uint, targetIDs ...flow.Identifier) error {
+	return nil
+}
+
+func (n *NoopConduit) Close() error {
+	return nil
+}
+
+type NoopEngineRegister struct {
+	module.NoopComponent
+}
+
+func (n NoopEngineRegister) Register(channel channels.Channel, messageProcessor network.MessageProcessor) (network.Conduit, error) {
+	return &NoopConduit{}, nil
+}
+
+func (n NoopEngineRegister) RegisterBlobService(channel channels.Channel, store datastore.Batching, opts ...network.BlobServiceOption) (network.BlobService, error) {
+	return nil, nil
+}
+
+func (n NoopEngineRegister) RegisterPingService(pingProtocolID protocol.ID, pingInfoProvider network.PingInfoProvider) (network.PingService, error) {
+	return nil, nil
+}
+
+var _ network.EngineRegistry = (*NoopEngineRegister)(nil)
diff --git a/network/validator/authorized_sender_validator.go b/network/validator/authorized_sender_validator.go
index 1a9a9d9a44f..d4300e06e03 100644
--- a/network/validator/authorized_sender_validator.go
+++ b/network/validator/authorized_sender_validator.go
@@ -122,7 +122,7 @@ func (av *AuthorizedSenderValidator) Validate(from peer.ID, payload []byte, chan
 //   - message.ErrUnauthorizedMessageOnChannel if msg is not authorized to be sent on channel
 //   - message.ErrUnauthorizedRole if sender role is not authorized to send msg
 func (av *AuthorizedSenderValidator) isAuthorizedSender(identity *flow.Identity, channel channels.Channel, msgCode codec.MessageCode, protocol message.ProtocolType) (string, error) {
-	if identity.Ejected {
+	if identity.IsEjected() {
 		return "", ErrSenderEjected
 	}
 
diff --git a/network/validator/authorized_sender_validator_test.go b/network/validator/authorized_sender_validator_test.go
index 8a9cd138cbb..597ba700671 100644
--- a/network/validator/authorized_sender_validator_test.go
+++ b/network/validator/authorized_sender_validator_test.go
@@ -285,7 +285,7 @@ func (s *TestAuthorizedSenderValidatorSuite) TestValidatorCallback_ClusterPrefix
 func (s *TestAuthorizedSenderValidatorSuite) TestValidatorCallback_ValidationFailure() {
 	s.Run("sender is ejected", func() {
 		identity, _ := unittest.IdentityWithNetworkingKeyFixture()
-		identity.Ejected = true
+		identity.EpochParticipationStatus = flow.EpochParticipationStatusEjected
 		getIdentityFunc := s.getIdentity(identity)
 		pid, err := unittest.PeerIDFromFlowID(identity)
 		require.NoError(s.T(), err)
diff --git a/state/cluster/badger/mutator_test.go b/state/cluster/badger/mutator_test.go
index 1897cf6a39a..f6650d09791 100644
--- a/state/cluster/badger/mutator_test.go
+++ b/state/cluster/badger/mutator_test.go
@@ -24,6 +24,7 @@ import (
 	pbadger "github.com/onflow/flow-go/state/protocol/badger"
 	"github.com/onflow/flow-go/state/protocol/events"
 	"github.com/onflow/flow-go/state/protocol/inmem"
+	"github.com/onflow/flow-go/state/protocol/protocol_state"
 	protocolutil "github.com/onflow/flow-go/state/protocol/util"
 	storage "github.com/onflow/flow-go/storage/badger"
 	"github.com/onflow/flow-go/storage/badger/operation"
@@ -42,8 +43,9 @@ type MutatorSuite struct {
 	epochCounter uint64
 
 	// protocol state for reference blocks for transactions
-	protoState   protocol.FollowerState
-	protoGenesis *flow.Header
+	protoState           protocol.FollowerState
+	mutableProtocolState protocol.MutableProtocolState
+	protoGenesis         *flow.Block
 
 	state cluster.MutableState
 }
@@ -66,15 +68,21 @@ func (suite *MutatorSuite) SetupTest() {
 
 	// just bootstrap with a genesis block, we'll use this as reference
 	genesis, result, seal := unittest.BootstrapFixture(unittest.IdentityListFixture(5, unittest.WithAllRoles()))
+
 	// ensure we don't enter a new epoch for tests that build many blocks
 	result.ServiceEvents[0].Event.(*flow.EpochSetup).FinalView = genesis.Header.View + 100_000
+
 	seal.ResultID = result.ID()
 	qc := unittest.QuorumCertificateFixture(unittest.QCWithRootBlockID(genesis.ID()))
+	genesis.Payload.ProtocolStateID = inmem.ProtocolStateFromEpochServiceEvents(
+		result.ServiceEvents[0].Event.(*flow.EpochSetup),
+		result.ServiceEvents[1].Event.(*flow.EpochCommit),
+	).ID()
 	rootSnapshot, err := inmem.SnapshotFromBootstrapState(genesis, result, seal, qc)
 	require.NoError(suite.T(), err)
 	suite.epochCounter = rootSnapshot.Encodable().Epochs.Current.Counter
 
-	suite.protoGenesis = genesis.Header
+	suite.protoGenesis = genesis
 	state, err := pbadger.Bootstrap(
 		metrics,
 		suite.db,
@@ -85,7 +93,7 @@ func (suite *MutatorSuite) SetupTest() {
 		all.QuorumCertificates,
 		all.Setups,
 		all.EpochCommits,
-		all.Statuses,
+		all.ProtocolState,
 		all.VersionBeacons,
 		rootSnapshot,
 	)
@@ -93,6 +101,15 @@ func (suite *MutatorSuite) SetupTest() {
 	suite.protoState, err = pbadger.NewFollowerState(log, tracer, events.NewNoop(), state, all.Index, all.Payloads, protocolutil.MockBlockTimer())
 	require.NoError(suite.T(), err)
 
+	suite.mutableProtocolState = protocol_state.NewMutableProtocolState(
+		all.ProtocolState,
+		state.Params(),
+		all.Headers,
+		all.Results,
+		all.Setups,
+		all.EpochCommits,
+	)
+
 	clusterStateRoot, err := NewStateRoot(suite.genesis, unittest.QuorumCertificateFixture(), suite.epochCounter)
 	suite.NoError(err)
 	clusterState, err := Bootstrap(suite.db, clusterStateRoot)
@@ -366,14 +383,12 @@ func (suite *MutatorSuite) TestExtend_WithExpiredReferenceBlock() {
 	// the collection to be expired
 	parent := suite.protoGenesis
 	for i := 0; i < flow.DefaultTransactionExpiry+1; i++ {
-		next := unittest.BlockWithParentFixture(parent)
-		next.Payload.Guarantees = nil
-		next.SetPayload(*next.Payload)
+		next := unittest.BlockWithParentProtocolState(parent)
 		err := suite.protoState.ExtendCertified(context.Background(), next, unittest.CertifyBlock(next.Header))
 		suite.Require().Nil(err)
 		err = suite.protoState.Finalize(context.Background(), next.ID())
 		suite.Require().Nil(err)
-		parent = next.Header
+		parent = next
 	}
 
 	block := suite.Block()
@@ -398,7 +413,7 @@ func (suite *MutatorSuite) TestExtend_WithReferenceBlockFromClusterChain() {
 // using a reference block in a different epoch than the cluster's epoch.
 func (suite *MutatorSuite) TestExtend_WithReferenceBlockFromDifferentEpoch() {
 	// build and complete the current epoch, then use a reference block from next epoch
-	eb := unittest.NewEpochBuilder(suite.T(), suite.protoState)
+	eb := unittest.NewEpochBuilder(suite.T(), suite.mutableProtocolState, suite.protoState)
 	eb.BuildEpoch().CompleteEpoch()
 	heights, ok := eb.EpochHeights(1)
 	require.True(suite.T(), ok)
@@ -417,9 +432,7 @@ func (suite *MutatorSuite) TestExtend_WithReferenceBlockFromDifferentEpoch() {
 // should be considered an unverifiable extension. It's possible that this reference
 // block has been finalized, we just haven't processed it yet.
 func (suite *MutatorSuite) TestExtend_WithUnfinalizedReferenceBlock() {
-	unfinalized := unittest.BlockWithParentFixture(suite.protoGenesis)
-	unfinalized.Payload.Guarantees = nil
-	unfinalized.SetPayload(*unfinalized.Payload)
+	unfinalized := unittest.BlockWithParentProtocolState(suite.protoGenesis)
 	err := suite.protoState.ExtendCertified(context.Background(), unfinalized, unittest.CertifyBlock(unfinalized.Header))
 	suite.Require().NoError(err)
 
@@ -436,12 +449,12 @@ func (suite *MutatorSuite) TestExtend_WithUnfinalizedReferenceBlock() {
 // to only use finalized blocks as reference, the proposer knowingly generated an invalid
 func (suite *MutatorSuite) TestExtend_WithOrphanedReferenceBlock() {
 	// create a block extending genesis which is not finalized
-	orphaned := unittest.BlockWithParentFixture(suite.protoGenesis)
+	orphaned := unittest.BlockWithParentProtocolState(suite.protoGenesis)
 	err := suite.protoState.ExtendCertified(context.Background(), orphaned, unittest.CertifyBlock(orphaned.Header))
 	suite.Require().NoError(err)
 
 	// create a block extending genesis (conflicting with previous) which is finalized
-	finalized := unittest.BlockWithParentFixture(suite.protoGenesis)
+	finalized := unittest.BlockWithParentProtocolState(suite.protoGenesis)
 	finalized.Payload.Guarantees = nil
 	finalized.SetPayload(*finalized.Payload)
 	err = suite.protoState.ExtendCertified(context.Background(), finalized, unittest.CertifyBlock(finalized.Header))
diff --git a/state/cluster/badger/params.go b/state/cluster/badger/params.go
index ab557f2a7f2..afdbb7ff129 100644
--- a/state/cluster/badger/params.go
+++ b/state/cluster/badger/params.go
@@ -8,6 +8,6 @@ type Params struct {
 	state *State
 }
 
-func (p *Params) ChainID() (flow.ChainID, error) {
-	return p.state.clusterID, nil
+func (p *Params) ChainID() flow.ChainID {
+	return p.state.clusterID
 }
diff --git a/state/cluster/badger/snapshot_test.go b/state/cluster/badger/snapshot_test.go
index 7dd81c0ed4d..c3a90cc5125 100644
--- a/state/cluster/badger/snapshot_test.go
+++ b/state/cluster/badger/snapshot_test.go
@@ -66,7 +66,7 @@ func (suite *SnapshotSuite) SetupTest() {
 		all.QuorumCertificates,
 		all.Setups,
 		all.EpochCommits,
-		all.Statuses,
+		all.ProtocolState,
 		all.VersionBeacons,
 		root,
 	)
@@ -290,8 +290,6 @@ func (suite *SnapshotSuite) TestPending_Grandchildren() {
 }
 
 func (suite *SnapshotSuite) TestParams_ChainID() {
-
-	chainID, err := suite.state.Params().ChainID()
-	suite.Require().Nil(err)
+	chainID := suite.state.Params().ChainID()
 	suite.Assert().Equal(suite.genesis.Header.ChainID, chainID)
 }
diff --git a/state/cluster/mock/params.go b/state/cluster/mock/params.go
index 7d499e305e0..0c7bd9a7833 100644
--- a/state/cluster/mock/params.go
+++ b/state/cluster/mock/params.go
@@ -13,27 +13,17 @@ type Params struct {
 }
 
 // ChainID provides a mock function with given fields:
-func (_m *Params) ChainID() (flow.ChainID, error) {
+func (_m *Params) ChainID() flow.ChainID {
 	ret := _m.Called()
 
 	var r0 flow.ChainID
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (flow.ChainID, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() flow.ChainID); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(flow.ChainID)
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 type mockConstructorTestingTNewParams interface {
diff --git a/state/cluster/params.go b/state/cluster/params.go
index 8bfc2be46bd..9df9c44840b 100644
--- a/state/cluster/params.go
+++ b/state/cluster/params.go
@@ -6,8 +6,6 @@ import (
 
 // Params contains constant information about this cluster state.
 type Params interface {
-
 	// ChainID returns the chain ID for this cluster.
-	// No errors are expected during normal operation.
-	ChainID() (flow.ChainID, error)
+	ChainID() flow.ChainID
 }
diff --git a/state/cluster/root_block.go b/state/cluster/root_block.go
index 073c8e84322..3391ee31e85 100644
--- a/state/cluster/root_block.go
+++ b/state/cluster/root_block.go
@@ -19,7 +19,7 @@ var rootBlockPayloadHash = rootBlockPayload.Hash()
 
 // CanonicalRootBlock returns the canonical root block for the given
 // cluster in the given epoch. It contains an empty collection referencing
-func CanonicalRootBlock(epoch uint64, participants flow.IdentityList) *cluster.Block {
+func CanonicalRootBlock(epoch uint64, participants flow.IdentitySkeletonList) *cluster.Block {
 	chainID := CanonicalClusterID(epoch, participants.NodeIDs())
 
 	header := &flow.Header{
diff --git a/state/protocol/badger/mutator.go b/state/protocol/badger/mutator.go
index dd2f2035656..d0575a068b3 100644
--- a/state/protocol/badger/mutator.go
+++ b/state/protocol/badger/mutator.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package badger
 
 import (
@@ -137,6 +135,7 @@ func (m *FollowerState) ExtendCertified(ctx context.Context, candidate *flow.Blo
 	if err != nil || isDuplicate {
 		return err
 	}
+	deferredDbOps := transaction.NewDeferredDbOps()
 
 	// sanity check if certifyingQC actually certifies candidate block
 	if certifyingQC.View != candidate.Header.View {
@@ -147,7 +146,7 @@ func (m *FollowerState) ExtendCertified(ctx context.Context, candidate *flow.Blo
 	}
 
 	// check if the block header is a valid extension of parent block
-	err = m.headerExtend(candidate)
+	err = m.headerExtend(ctx, candidate, certifyingQC, deferredDbOps)
 	if err != nil {
 		// since we have a QC for this block, it cannot be an invalid extension
 		return fmt.Errorf("unexpected invalid block (id=%x) with certifying qc (id=%x): %s",
@@ -155,15 +154,22 @@ func (m *FollowerState) ExtendCertified(ctx context.Context, candidate *flow.Blo
 	}
 
 	// find the last seal at the parent block
-	last, err := m.lastSealed(candidate)
+	_, err = m.lastSealed(candidate, deferredDbOps)
 	if err != nil {
-		return fmt.Errorf("payload seal(s) not compliant with chain state: %w", err)
+		return fmt.Errorf("failed to determine the lastest sealed block in fork: %w", err)
 	}
 
-	// insert the block, certifying QC and index the last seal for the block
-	err = m.insert(ctx, candidate, certifyingQC, last)
+	// evolve protocol state and verify consistency with commitment included in
+	err = m.evolveProtocolState(ctx, candidate, deferredDbOps)
 	if err != nil {
-		return fmt.Errorf("failed to insert the block: %w", err)
+		return fmt.Errorf("evolving protocol state failed: %w", err)
+	}
+
+	// Execute the deferred database operations as one atomic transaction and emit scheduled notifications on success.
+	// The `candidate` block _must be valid_ (otherwise, the state will be corrupted)!
+	err = operation.RetryOnConflictTx(m.db, transaction.Update, deferredDbOps.Pending()) // No errors are expected during normal operations
+	if err != nil {
+		return fmt.Errorf("failed to persist candidate block %v and its dependencies: %w", blockID, err)
 	}
 
 	return nil
@@ -183,9 +189,10 @@ func (m *ParticipantState) Extend(ctx context.Context, candidate *flow.Block) er
 	if err != nil || isDuplicate {
 		return err
 	}
+	deferredDbOps := transaction.NewDeferredDbOps()
 
 	// check if the block header is a valid extension of parent block
-	err = m.headerExtend(candidate)
+	err = m.headerExtend(ctx, candidate, nil, deferredDbOps)
 	if err != nil {
 		return fmt.Errorf("header not compliant with chain state: %w", err)
 	}
@@ -212,37 +219,62 @@ func (m *ParticipantState) Extend(ctx context.Context, candidate *flow.Block) er
 	}
 
 	// check if the seals in the payload is a valid extension of the finalized state
-	lastSeal, err := m.sealExtend(ctx, candidate)
+	_, err = m.sealExtend(ctx, candidate, deferredDbOps)
 	if err != nil {
 		return fmt.Errorf("payload seal(s) not compliant with chain state: %w", err)
 	}
 
-	// insert the block and index the last seal for the block
-	err = m.insert(ctx, candidate, nil, lastSeal)
+	// evolve protocol state and verify consistency with commitment included in payload
+	err = m.evolveProtocolState(ctx, candidate, deferredDbOps)
 	if err != nil {
-		return fmt.Errorf("failed to insert the block: %w", err)
+		return fmt.Errorf("evolving protocol state failed: %w", err)
 	}
 
+	// Execute the deferred database operations and emit scheduled notifications on success.
+	// The `candidate` block _must be valid_ (otherwise, the state will be corrupted)!
+	err = operation.RetryOnConflictTx(m.db, transaction.Update, deferredDbOps.Pending()) // No errors are expected during normal operations
+	if err != nil {
+		return fmt.Errorf("failed to persist candiate block %v and its dependencies: %w", candidate.ID(), err)
+	}
 	return nil
 }
 
 // headerExtend verifies the validity of the block header (excluding verification of the
-// consensus rules). Specifically, we check that the block connects to the last finalized block.
+// consensus rules). Specifically, we check that
+//  1. the payload is consistent with the payload hash stated in the header
+//  2. candidate header is consistent with its parent:
+//     - ChainID is identical
+//     - height increases by 1
+//     - ParentView stated by the candidate block equals the parent's actual view
+//  3. candidate's block time conforms to protocol rules
+//  4. If a `certifyingQC` is given (can be nil), we sanity-check that it certifies the candidate block
+//
+// If all checks pass, this method queues the following operations to persist the candidate block and
+// schedules `BlockProcessable` notification to be emitted in order of increasing height:
+//
+//	5a. store QC embedded into the candidate block and emit `BlockProcessable` notification for the parent
+//	5b. store candidate block and index it as a child of its parent (needed for recovery to traverse unfinalized blocks)
+//	5c. if we are given a certifyingQC, store it and queue a `BlockProcessable` notification for the candidate block
+//
+// If `headerExtend` is called by `ParticipantState.Extend` (full consensus participant) then `certifyingQC` will be nil,
+// but the block payload will be validated. If `headerExtend` is called by `FollowerState.Extend` (consensus follower),
+// then `certifyingQC` must be not nil which proves payload validity.
+//
 // Expected errors during normal operations:
 //   - state.InvalidExtensionError if the candidate block is invalid
-func (m *FollowerState) headerExtend(candidate *flow.Block) error {
-	// FIRST: We do some initial cheap sanity checks, like checking the payload
-	// hash is consistent
-
+func (m *FollowerState) headerExtend(ctx context.Context, candidate *flow.Block, certifyingQC *flow.QuorumCertificate, deferredDbOps *transaction.DeferredDbOps) error {
+	span, _ := m.tracer.StartSpanFromContext(ctx, trace.ProtoStateMutatorExtendCheckHeader)
+	defer span.End()
+	blockID := candidate.ID()
 	header := candidate.Header
-	payload := candidate.Payload
-	if payload.Hash() != header.PayloadHash {
+
+	// STEP 1: Check that the payload is consistent with the payload hash in the header
+	if candidate.Payload.Hash() != header.PayloadHash {
 		return state.NewInvalidExtensionError("payload integrity check failed")
 	}
 
-	// SECOND: Next, we can check whether the block is a valid descendant of the
+	// STEP 2: Next, we can check whether the block is a valid descendant of the
 	// parent. It should have the same chain ID and a height that is one bigger.
-
 	parent, err := m.headers.ByBlockID(header.ParentID)
 	if err != nil {
 		return state.NewInvalidExtensionErrorf("could not retrieve parent: %s", err)
@@ -260,8 +292,8 @@ func (m *FollowerState) headerExtend(candidate *flow.Block) error {
 			header.Height, parent.Height)
 	}
 
-	// check validity of block timestamp using parent's timestamp
-	err = m.blockTimer.Validate(parent.Timestamp, candidate.Header.Timestamp)
+	// STEP 3: check validity of block timestamp using parent's timestamp
+	err = m.blockTimer.Validate(parent.Timestamp, header.Timestamp)
 	if err != nil {
 		if protocol.IsInvalidBlockTimestampError(err) {
 			return state.NewInvalidExtensionErrorf("candidate contains invalid timestamp: %w", err)
@@ -269,6 +301,60 @@ func (m *FollowerState) headerExtend(candidate *flow.Block) error {
 		return fmt.Errorf("validating block's time stamp failed with unexpected error: %w", err)
 	}
 
+	// STEP 4: if a certifying QC is given (can be nil), sanity-check that it actually certifies the candidate block
+	if certifyingQC != nil {
+		if certifyingQC.View != header.View {
+			return fmt.Errorf("qc doesn't certify candidate block, expect %d view, got %d", header.View, certifyingQC.View)
+		}
+		if certifyingQC.BlockID != blockID {
+			return fmt.Errorf("qc doesn't certify candidate block, expect %x blockID, got %x", blockID, certifyingQC.BlockID)
+		}
+	}
+
+	// STEP 5:
+	qc := candidate.Header.QuorumCertificate()
+	deferredDbOps.AddDbOp(func(tx *transaction.Tx) error {
+		// STEP 5a: Store QC for parent block and emit `BlockProcessable` notification if and only if
+		//  - the QC for the parent has not been stored before (otherwise, we already emitted the notification) and
+		//  - the parent block's height is larger than the finalized root height (the root block is already considered processed)
+		// Thereby, we reduce duplicated `BlockProcessable` notifications.
+		err := m.qcs.StoreTx(qc)(tx)
+		if err != nil {
+			if !errors.Is(err, storage.ErrAlreadyExists) {
+				return fmt.Errorf("could not store incorporated qc: %w", err)
+			}
+		} else {
+			// trigger BlockProcessable for parent block above root height
+			if parent.Height > m.finalizedRootHeight {
+				tx.OnSucceed(func() {
+					m.consumer.BlockProcessable(parent, qc)
+				})
+			}
+		}
+
+		// STEP 5b: Store candidate block and index it as a child of its parent (needed for recovery to traverse unfinalized blocks)
+		err = m.blocks.StoreTx(candidate)(tx) // insert the block into the database AND cache
+		if err != nil {
+			return fmt.Errorf("could not store candidate block: %w", err)
+		}
+		err = transaction.WithTx(procedure.IndexNewBlock(blockID, candidate.Header.ParentID))(tx)
+		if err != nil {
+			return fmt.Errorf("could not index new block: %w", err)
+		}
+
+		// STEP 5c: if we are given a certifyingQC, store it and queue a `BlockProcessable` notification for the candidate block
+		if certifyingQC != nil {
+			err = m.qcs.StoreTx(certifyingQC)(tx)
+			if err != nil {
+				return fmt.Errorf("could not store certifying qc: %w", err)
+			}
+			tx.OnSucceed(func() { // queue a BlockProcessable event for candidate block, since it is certified
+				m.consumer.BlockProcessable(candidate.Header, certifyingQC)
+			})
+		}
+		return nil
+	})
+
 	return nil
 }
 
@@ -332,8 +418,9 @@ func (m *ParticipantState) checkOutdatedExtension(header *flow.Header) error {
 // guaranteeExtend verifies the validity of the collection guarantees that are
 // included in the block. Specifically, we check for expired collections and
 // duplicated collections (also including ancestor blocks).
+// Expected errors during normal operations:
+//   - state.InvalidExtensionError if the candidate block contains invalid collection guarantees
 func (m *ParticipantState) guaranteeExtend(ctx context.Context, candidate *flow.Block) error {
-
 	span, _ := m.tracer.StartSpanFromContext(ctx, trace.ProtoStateMutatorExtendCheckGuarantees)
 	defer span.End()
 
@@ -411,10 +498,11 @@ func (m *ParticipantState) guaranteeExtend(ctx context.Context, candidate *flow.
 	return nil
 }
 
-// sealExtend checks the compliance of the payload seals. Returns last seal that form a chain for
-// candidate block.
-func (m *ParticipantState) sealExtend(ctx context.Context, candidate *flow.Block) (*flow.Seal, error) {
-
+// sealExtend checks the compliance of the payload seals. It queues a deferred database
+// operation for indexing the latest seal as of the candidate block and returns the latest seal.
+// Expected errors during normal operations:
+//   - state.InvalidExtensionError if the candidate block has invalid seals
+func (m *ParticipantState) sealExtend(ctx context.Context, candidate *flow.Block, deferredDbOps *transaction.DeferredDbOps) (*flow.Seal, error) {
 	span, _ := m.tracer.StartSpanFromContext(ctx, trace.ProtoStateMutatorExtendCheckSeals)
 	defer span.End()
 
@@ -423,6 +511,7 @@ func (m *ParticipantState) sealExtend(ctx context.Context, candidate *flow.Block
 		return nil, state.NewInvalidExtensionErrorf("seal validation error: %w", err)
 	}
 
+	deferredDbOps.AddBadgerOp(operation.IndexLatestSealAtBlock(candidate.ID(), lastSeal.ID()))
 	return lastSeal, nil
 }
 
@@ -433,8 +522,10 @@ func (m *ParticipantState) sealExtend(ctx context.Context, candidate *flow.Block
 //   - No seal has been included for the respective block in this particular fork
 //
 // We require the receipts to be sorted by block height (within a payload).
+//
+// Expected errors during normal operations:
+//   - state.InvalidExtensionError if the candidate block contains invalid receipts
 func (m *ParticipantState) receiptExtend(ctx context.Context, candidate *flow.Block) error {
-
 	span, _ := m.tracer.StartSpanFromContext(ctx, trace.ProtoStateMutatorExtendCheckReceipts)
 	defer span.End()
 
@@ -453,140 +544,82 @@ func (m *ParticipantState) receiptExtend(ctx context.Context, candidate *flow.Bl
 	return nil
 }
 
-// lastSealed returns the highest sealed block from the fork with head `candidate`.
+// lastSealed determines the highest sealed block from the fork with head `candidate`.
+// It queues a deferred database operation for indexing the latest seal as of the candidate block.
+// and returns the latest seal.
+//
 // For instance, here is the chain state: block 100 is the head, block 97 is finalized,
 // and 95 is the last sealed block at the state of block 100.
 // 95 (sealed) <- 96 <- 97 (finalized) <- 98 <- 99 <- 100
 // Now, if block 101 is extending block 100, and its payload has a seal for 96, then it will
 // be the last sealed for block 101.
 // No errors are expected during normal operation.
-func (m *FollowerState) lastSealed(candidate *flow.Block) (*flow.Seal, error) {
-	header := candidate.Header
+func (m *FollowerState) lastSealed(candidate *flow.Block, deferredDbOps *transaction.DeferredDbOps) (latestSeal *flow.Seal, err error) {
 	payload := candidate.Payload
+	blockID := candidate.ID()
 
-	// getting the last sealed block
-	last, err := m.seals.HighestInFork(header.ParentID)
-	if err != nil {
-		return nil, fmt.Errorf("could not retrieve parent seal (%x): %w", header.ParentID, err)
-	}
-
-	// if the payload of the block has no seals, then the last seal is the seal for the highest block
+	// If the candidate blocks' payload has no seals, the latest seal in this fork remains unchanged, i.e. latest seal as of the
+	// parent is also the latest seal as of the candidate block. Otherwise, we take the latest seal included in the candidate block.
+	// Note that seals might not be ordered in the block.
 	if len(payload.Seals) == 0 {
-		return last, nil
-	}
-
-	ordered, err := protocol.OrderedSeals(payload, m.headers)
-	if err != nil {
-		// all errors are unexpected - differentiation is for clearer error messages
-		if errors.Is(err, storage.ErrNotFound) {
-			return nil, fmt.Errorf("ordering seals: candidate payload contains seals for unknown block: %s", err.Error())
+		latestSeal, err = m.seals.HighestInFork(candidate.Header.ParentID)
+		if err != nil {
+			return nil, fmt.Errorf("could not retrieve parent seal (%x): %w", candidate.Header.ParentID, err)
 		}
-		if errors.Is(err, protocol.ErrDiscontinuousSeals) || errors.Is(err, protocol.ErrMultipleSealsForSameHeight) {
-			return nil, fmt.Errorf("ordering seals: candidate payload contains invalid seal set: %s", err.Error())
+	} else {
+		ordered, err := protocol.OrderedSeals(payload.Seals, m.headers)
+		if err != nil {
+			// all errors are unexpected - differentiation is for clearer error messages
+			if errors.Is(err, storage.ErrNotFound) {
+				return nil, irrecoverable.NewExceptionf("ordering seals: candidate payload contains seals for unknown block: %w", err)
+			}
+			if errors.Is(err, protocol.ErrDiscontinuousSeals) || errors.Is(err, protocol.ErrMultipleSealsForSameHeight) {
+				return nil, irrecoverable.NewExceptionf("ordering seals: candidate payload contains invalid seal set: %w", err)
+			}
+			return nil, fmt.Errorf("unexpected error ordering seals: %w", err)
 		}
-		return nil, fmt.Errorf("unexpected error ordering seals: %w", err)
+		latestSeal = ordered[len(ordered)-1]
 	}
-	return ordered[len(ordered)-1], nil
+
+	deferredDbOps.AddBadgerOp(operation.IndexLatestSealAtBlock(blockID, latestSeal.ID()))
+	return latestSeal, nil
 }
 
-// insert stores the candidate block in the database.
-// The `candidate` block _must be valid_ (otherwise, the state will be corrupted).
-// dbUpdates contains other database operations which must be applied atomically
-// with inserting the block.
-// Caller is responsible for ensuring block validity.
-// If insert is called from Extend(by consensus participant) then certifyingQC will be nil but the block payload will be validated.
-// If insert is called from ExtendCertified(by consensus follower) then certifyingQC must be not nil which proves payload validity.
-// No errors are expected during normal operations.
-func (m *FollowerState) insert(ctx context.Context, candidate *flow.Block, certifyingQC *flow.QuorumCertificate, last *flow.Seal) error {
-	span, _ := m.tracer.StartSpanFromContext(ctx, trace.ProtoStateMutatorExtendDBInsert)
+// evolveProtocolState
+//   - instantiates a Protocol State Mutator from the parent block's state
+//   - applies any state-changing service events sealed by this block
+//   - verifies that the resulting protocol state is consistent with the commitment in the block
+//
+// Expected errors during normal operations:
+//   - state.InvalidExtensionError if the Protocol State commitment in the candidate block does
+//     not match the Protocol State we constructed locally
+func (m *FollowerState) evolveProtocolState(ctx context.Context, candidate *flow.Block, deferredDbOps *transaction.DeferredDbOps) error {
+	span, _ := m.tracer.StartSpanFromContext(ctx, trace.ProtoStateMutatorEvolveProtocolState)
 	defer span.End()
 
-	blockID := candidate.ID()
-	parentID := candidate.Header.ParentID
-	latestSealID := last.ID()
-
-	parent, err := m.headers.ByBlockID(parentID)
+	// instantiate Protocol State Mutator from the parent block's state and apply any state-changing service events sealed by this block
+	stateMutator, err := m.protocolState.Mutator(candidate.Header.View, candidate.Header.ParentID)
 	if err != nil {
-		return fmt.Errorf("could not retrieve block header for %x: %w", parentID, err)
+		return fmt.Errorf("could not create protocol state mutator for view %d: %w", candidate.Header.View, err)
 	}
-
-	// apply any state changes from service events sealed by this block's parent
-	dbUpdates, err := m.handleEpochServiceEvents(candidate)
+	err = stateMutator.ApplyServiceEventsFromValidatedSeals(candidate.Payload.Seals)
 	if err != nil {
 		return fmt.Errorf("could not process service events: %w", err)
 	}
 
-	qc := candidate.Header.QuorumCertificate()
-
-	var events []func()
-
-	// Both the header itself and its payload are in compliance with the protocol state.
-	// We can now store the candidate block, as well as adding its final seal
-	// to the seal index and initializing its children index.
-	err = operation.RetryOnConflictTx(m.db, transaction.Update, func(tx *transaction.Tx) error {
-		// insert the block into the database AND cache
-		err := m.blocks.StoreTx(candidate)(tx)
-		if err != nil {
-			return fmt.Errorf("could not store candidate block: %w", err)
-		}
-
-		err = m.qcs.StoreTx(qc)(tx)
-		if err != nil {
-			if !errors.Is(err, storage.ErrAlreadyExists) {
-				return fmt.Errorf("could not store incorporated qc: %w", err)
-			}
-		} else {
-			// trigger BlockProcessable for parent blocks above root height
-			if parent.Height > m.finalizedRootHeight {
-				events = append(events, func() {
-					m.consumer.BlockProcessable(parent, qc)
-				})
-			}
-		}
-
-		if certifyingQC != nil {
-			err = m.qcs.StoreTx(certifyingQC)(tx)
-			if err != nil {
-				return fmt.Errorf("could not store certifying qc: %w", err)
-			}
-
-			// trigger BlockProcessable for candidate block if it's certified
-			events = append(events, func() {
-				m.consumer.BlockProcessable(candidate.Header, certifyingQC)
-			})
-		}
-
-		// index the latest sealed block in this fork
-		err = transaction.WithTx(operation.IndexLatestSealAtBlock(blockID, latestSealID))(tx)
-		if err != nil {
-			return fmt.Errorf("could not index candidate seal: %w", err)
-		}
-
-		// index the child block for recovery
-		err = transaction.WithTx(procedure.IndexNewBlock(blockID, candidate.Header.ParentID))(tx)
-		if err != nil {
-			return fmt.Errorf("could not index new block: %w", err)
-		}
-
-		// apply any optional DB operations from service events
-		for _, apply := range dbUpdates {
-			err := apply(tx)
-			if err != nil {
-				return fmt.Errorf("could not apply operation: %w", err)
-			}
-		}
-
-		return nil
-	})
-	if err != nil {
-		return fmt.Errorf("could not execute state extension: %w", err)
+	// verify Protocol State commitment in the candidate block matches the locally-constructed value
+	hasChanges, updatedState, updatedStateID, dbUpdates := stateMutator.Build()
+	if updatedStateID != candidate.Payload.ProtocolStateID {
+		return state.NewInvalidExtensionErrorf("invalid protocol state commitment %x in block, which should be %x", candidate.Payload.ProtocolStateID, updatedStateID)
 	}
 
-	// execute scheduled events
-	for _, event := range events {
-		event()
+	// Schedule deferred database operations to index the protocol state by the candidate block's ID
+	// and persist the new protocol state (if there are any changes)
+	deferredDbOps.AddDbOp(m.protocolStateSnapshotsDB.Index(candidate.ID(), updatedStateID))
+	if hasChanges {
+		deferredDbOps.AddDbOp(operation.SkipDuplicatesTx(m.protocolStateSnapshotsDB.StoreTx(updatedStateID, updatedState)))
+		deferredDbOps.AddDbOps(dbUpdates...)
 	}
-
 	return nil
 }
 
@@ -595,7 +628,6 @@ func (m *FollowerState) insert(ctx context.Context, candidate *flow.Block, certi
 // Hence, the parent of `blockID` has to be the last finalized block.
 // No errors are expected during normal operations.
 func (m *FollowerState) Finalize(ctx context.Context, blockID flow.Identifier) error {
-
 	// preliminaries: start tracer and retrieve full block
 	span, _ := m.tracer.StartSpanFromContext(ctx, trace.ProtoStateMutatorFinalize)
 	defer span.End()
@@ -641,30 +673,22 @@ func (m *FollowerState) Finalize(ctx context.Context, blockID flow.Identifier) e
 
 	// We update metrics and emit protocol events for epoch state changes when
 	// the block corresponding to the state change is finalized
-	epochStatus, err := m.epoch.statuses.ByBlockID(blockID)
-	if err != nil {
-		return fmt.Errorf("could not retrieve epoch state: %w", err)
-	}
-	currentEpochSetup, err := m.epoch.setups.ByID(epochStatus.CurrentEpoch.SetupID)
+	psSnapshot, err := m.protocolState.AtBlockID(blockID)
 	if err != nil {
-		return fmt.Errorf("could not retrieve setup event for current epoch: %w", err)
+		return fmt.Errorf("could not retrieve protocol state snapshot: %w", err)
 	}
+	currentEpochSetup := psSnapshot.EpochSetup()
 	epochFallbackTriggered, err := m.isEpochEmergencyFallbackTriggered()
 	if err != nil {
 		return fmt.Errorf("could not check persisted epoch emergency fallback flag: %w", err)
 	}
 
 	// if epoch fallback was not previously triggered, check whether this block triggers it
-	if !epochFallbackTriggered {
-		epochFallbackTriggered, err = m.epochFallbackTriggeredByFinalizedBlock(header, epochStatus, currentEpochSetup)
-		if err != nil {
-			return fmt.Errorf("could not check whether finalized block triggers epoch fallback: %w", err)
-		}
-		if epochFallbackTriggered {
-			// emit the protocol event only the first time epoch fallback is triggered
-			events = append(events, m.consumer.EpochEmergencyFallbackTriggered)
-			metrics = append(metrics, m.metrics.EpochEmergencyFallbackTriggered)
-		}
+	if !epochFallbackTriggered && psSnapshot.InvalidEpochTransitionAttempted() {
+		epochFallbackTriggered = true
+		// emit the protocol event only the first time epoch fallback is triggered
+		events = append(events, m.consumer.EpochEmergencyFallbackTriggered)
+		metrics = append(metrics, m.metrics.EpochEmergencyFallbackTriggered)
 	}
 
 	isFirstBlockOfEpoch, err := m.isFirstBlockOfEpoch(header, currentEpochSetup)
@@ -677,7 +701,7 @@ func (m *FollowerState) Finalize(ctx context.Context, blockID flow.Identifier) e
 	// If epoch emergency fallback is triggered, the current epoch continues until
 	// the next spork - so skip these updates.
 	if !epochFallbackTriggered {
-		epochPhaseMetrics, epochPhaseEvents, err := m.epochPhaseMetricsAndEventsOnBlockFinalized(block, epochStatus)
+		epochPhaseMetrics, epochPhaseEvents, err := m.epochPhaseMetricsAndEventsOnBlockFinalized(block)
 		if err != nil {
 			return fmt.Errorf("could not determine epoch phase metrics/events for finalized block: %w", err)
 		}
@@ -685,7 +709,7 @@ func (m *FollowerState) Finalize(ctx context.Context, blockID flow.Identifier) e
 		events = append(events, epochPhaseEvents...)
 
 		if isFirstBlockOfEpoch {
-			epochTransitionMetrics, epochTransitionEvents := m.epochTransitionMetricsAndEventsOnBlockFinalized(header, currentEpochSetup)
+			epochTransitionMetrics, epochTransitionEvents := m.epochTransitionMetricsAndEventsOnBlockFinalized(header, psSnapshot.EpochSetup())
 			if err != nil {
 				return fmt.Errorf("could not determine epoch transition metrics/events for finalized block: %w", err)
 			}
@@ -759,9 +783,9 @@ func (m *FollowerState) Finalize(ctx context.Context, blockID flow.Identifier) e
 	}
 
 	// update the cache
-	m.State.cachedFinal.Store(&cachedHeader{blockID, header})
+	m.State.cachedLatestFinal.Store(&cachedHeader{blockID, header})
 	if len(block.Payload.Seals) > 0 {
-		m.State.cachedSealed.Store(&cachedHeader{lastSeal.BlockID, sealed})
+		m.State.cachedLatestSealed.Store(&cachedHeader{lastSeal.BlockID, sealed})
 	}
 
 	// Emit protocol events after database transaction succeeds. Event delivery is guaranteed,
@@ -792,43 +816,6 @@ func (m *FollowerState) Finalize(ctx context.Context, blockID flow.Identifier) e
 	return nil
 }
 
-// epochFallbackTriggeredByFinalizedBlock checks whether finalizing the input block
-// would trigger epoch emergency fallback mode. In particular, we trigger epoch
-// fallback mode while finalizing block B in either of the following cases:
-//  1. B is the head of a fork in which epoch fallback was tentatively triggered,
-//     due to incorporating an invalid service event.
-//  2. (a) B is the first finalized block with view greater than or equal to the epoch
-//     commitment deadline for the current epoch AND
-//     (b) the next epoch has not been committed as of B.
-//
-// This function should only be called when epoch fallback *has not already been triggered*.
-// See protocol.Params for more details on the epoch commitment deadline.
-//
-// No errors are expected during normal operation.
-func (m *FollowerState) epochFallbackTriggeredByFinalizedBlock(block *flow.Header, epochStatus *flow.EpochStatus, currentEpochSetup *flow.EpochSetup) (bool, error) {
-	// 1. Epoch fallback is tentatively triggered on this fork
-	if epochStatus.InvalidServiceEventIncorporated {
-		return true, nil
-	}
-
-	// 2.(a) determine whether block B is past the epoch commitment deadline
-	safetyThreshold, err := m.Params().EpochCommitSafetyThreshold()
-	if err != nil {
-		return false, fmt.Errorf("could not get epoch commit safety threshold: %w", err)
-	}
-	blockExceedsDeadline := block.View+safetyThreshold >= currentEpochSetup.FinalView
-
-	// 2.(b) determine whether the next epoch is committed w.r.t. block B
-	currentEpochPhase, err := epochStatus.Phase()
-	if err != nil {
-		return false, fmt.Errorf("could not get current epoch phase: %w", err)
-	}
-	isNextEpochCommitted := currentEpochPhase == flow.EpochPhaseCommitted
-
-	blockTriggersEpochFallback := blockExceedsDeadline && !isNextEpochCommitted
-	return blockTriggersEpochFallback, nil
-}
-
 // isFirstBlockOfEpoch returns true if the given block is the first block of a new epoch.
 // We accept the EpochSetup event for the current epoch (w.r.t. input block B) which contains
 // the FirstView for the epoch (denoted W). By construction, B.View >= W.
@@ -897,14 +884,14 @@ func (m *FollowerState) epochTransitionMetricsAndEventsOnBlockFinalized(block *f
 //
 // This function should only be called when epoch fallback *has not already been triggered*.
 // No errors are expected during normal operation.
-func (m *FollowerState) epochPhaseMetricsAndEventsOnBlockFinalized(block *flow.Block, epochStatus *flow.EpochStatus) (
+func (m *FollowerState) epochPhaseMetricsAndEventsOnBlockFinalized(block *flow.Block) (
 	metrics []func(),
 	events []func(),
 	err error,
 ) {
 
 	// block payload may not specify seals in order, so order them by block height before processing
-	orderedSeals, err := protocol.OrderedSeals(block.Payload, m.headers)
+	orderedSeals, err := protocol.OrderedSeals(block.Payload.Seals, m.headers)
 	if err != nil {
 		if errors.Is(err, storage.ErrNotFound) {
 			return nil, nil, fmt.Errorf("ordering seals: parent payload contains seals for unknown block: %s", err.Error())
@@ -930,12 +917,6 @@ func (m *FollowerState) epochPhaseMetricsAndEventsOnBlockFinalized(block *flow.B
 				events = append(events, func() { m.metrics.CurrentEpochPhase(flow.EpochPhaseCommitted) })
 				// track epoch phase transition (setup->committed)
 				events = append(events, func() { m.consumer.EpochCommittedPhaseStarted(ev.Counter-1, block.Header) })
-				// track final view of committed epoch
-				nextEpochSetup, err := m.epoch.setups.ByID(epochStatus.NextEpoch.SetupID)
-				if err != nil {
-					return nil, nil, fmt.Errorf("could not retrieve setup event for next epoch: %w", err)
-				}
-				events = append(events, func() { m.metrics.CommittedEpochFinalView(nextEpochSetup.FinalView) })
 			case *flow.VersionBeacon:
 				// do nothing for now
 			default:
@@ -947,61 +928,6 @@ func (m *FollowerState) epochPhaseMetricsAndEventsOnBlockFinalized(block *flow.B
 	return
 }
 
-// epochStatus computes the EpochStatus for the given block *before* applying
-// any service event state changes which come into effect with this block.
-//
-// Specifically, we must determine whether block is the first block of a new
-// epoch in its respective fork. We do this by comparing the block's view to
-// the Epoch data from its parent. If the block's view is _larger_ than the
-// final View of the parent's epoch, the block starts a new Epoch.
-//
-// Possible outcomes:
-//  1. Block is in same Epoch as parent (block.View < epoch.FinalView)
-//     -> the parent's EpochStatus.CurrentEpoch also applies for the current block
-//  2. Block enters the next Epoch (block.View ≥ epoch.FinalView)
-//     a) HAPPY PATH: Epoch fallback is not triggered, we enter the next epoch:
-//     -> the parent's EpochStatus.NextEpoch is the current block's EpochStatus.CurrentEpoch
-//     b) FALLBACK PATH: Epoch fallback is triggered, we continue the current epoch:
-//     -> the parent's EpochStatus.CurrentEpoch also applies for the current block
-//
-// As the parent was a valid extension of the chain, by induction, the parent
-// satisfies all consistency requirements of the protocol.
-//
-// Returns the EpochStatus for the input block.
-// No error returns are expected under normal operations
-func (m *FollowerState) epochStatus(block *flow.Header, epochFallbackTriggered bool) (*flow.EpochStatus, error) {
-	parentStatus, err := m.epoch.statuses.ByBlockID(block.ParentID)
-	if err != nil {
-		return nil, fmt.Errorf("could not retrieve epoch state for parent: %w", err)
-	}
-	parentSetup, err := m.epoch.setups.ByID(parentStatus.CurrentEpoch.SetupID)
-	if err != nil {
-		return nil, fmt.Errorf("could not retrieve EpochSetup event for parent: %w", err)
-	}
-
-	// Case 1 or 2b (still in parent block's epoch or epoch fallback triggered):
-	if block.View <= parentSetup.FinalView || epochFallbackTriggered {
-		// IMPORTANT: copy the status to avoid modifying the parent status in the cache
-		return parentStatus.Copy(), nil
-	}
-
-	// Case 2a (first block of new epoch):
-	// sanity check: parent's epoch Preparation should be completed and have EpochSetup and EpochCommit events
-	if parentStatus.NextEpoch.SetupID == flow.ZeroID {
-		return nil, fmt.Errorf("missing setup event for starting next epoch")
-	}
-	if parentStatus.NextEpoch.CommitID == flow.ZeroID {
-		return nil, fmt.Errorf("missing commit event for starting next epoch")
-	}
-	epochStatus, err := flow.NewEpochStatus(
-		parentStatus.CurrentEpoch.SetupID, parentStatus.CurrentEpoch.CommitID,
-		parentStatus.NextEpoch.SetupID, parentStatus.NextEpoch.CommitID,
-		flow.ZeroID, flow.ZeroID,
-	)
-	return epochStatus, err
-
-}
-
 // versionBeaconOnBlockFinalized extracts and returns the VersionBeacons from the
 // finalized block's seals.
 // This could return multiple VersionBeacons if the parent block contains multiple Seals.
@@ -1012,7 +938,7 @@ func (m *FollowerState) versionBeaconOnBlockFinalized(
 ) ([]*flow.SealedVersionBeacon, error) {
 	var versionBeacons []*flow.SealedVersionBeacon
 
-	seals, err := protocol.OrderedSeals(finalized.Payload, m.headers)
+	seals, err := protocol.OrderedSeals(finalized.Payload.Seals, m.headers)
 	if err != nil {
 		if errors.Is(err, storage.ErrNotFound) {
 			return nil, fmt.Errorf(
@@ -1063,146 +989,3 @@ func (m *FollowerState) versionBeaconOnBlockFinalized(
 
 	return versionBeacons, nil
 }
-
-// handleEpochServiceEvents handles applying state changes which occur as a result
-// of service events being included in a block payload:
-//   - inserting incorporated service events
-//   - updating EpochStatus for the candidate block
-//
-// Consider a chain where a service event is emitted during execution of block A.
-// Block B contains a receipt for A. Block C contains a seal for block A.
-//
-// A <- .. <- B(RA) <- .. <- C(SA)
-//
-// Service events are included within execution results, which are stored
-// opaquely as part of the block payload in block B. We only validate and insert
-// the typed service event to storage once we process C, the block containing the
-// seal for block A. This is because we rely on the sealing subsystem to validate
-// correctness of the service event before processing it.
-// Consequently, any change to the protocol state introduced by a service event
-// emitted during execution of block A would only become visible when querying
-// C or its descendants.
-//
-// This method will only apply service-event-induced state changes when the
-// input block has the form of block C (ie. contains a seal for a block in
-// which a service event was emitted).
-//
-// Return values:
-//   - dbUpdates - If the service events are valid, or there are no service events,
-//     this method returns a slice of Badger operations to apply while storing the block.
-//     This includes an operation to index the epoch status for every block, and
-//     operations to insert service events for blocks that include them.
-//
-// No errors are expected during normal operation.
-func (m *FollowerState) handleEpochServiceEvents(candidate *flow.Block) (dbUpdates []func(*transaction.Tx) error, err error) {
-	epochFallbackTriggered, err := m.isEpochEmergencyFallbackTriggered()
-	if err != nil {
-		return nil, fmt.Errorf("could not retrieve epoch fallback status: %w", err)
-	}
-	epochStatus, err := m.epochStatus(candidate.Header, epochFallbackTriggered)
-	if err != nil {
-		return nil, fmt.Errorf("could not determine epoch status for candidate block: %w", err)
-	}
-	activeSetup, err := m.epoch.setups.ByID(epochStatus.CurrentEpoch.SetupID)
-	if err != nil {
-		return nil, fmt.Errorf("could not retrieve current epoch setup event: %w", err)
-	}
-
-	// always persist the candidate's epoch status
-	// note: We are scheduling the operation to store the Epoch status using the _pointer_ variable `epochStatus`.
-	// The struct `epochStatus` points to will still be modified below.
-	blockID := candidate.ID()
-	dbUpdates = append(dbUpdates, m.epoch.statuses.StoreTx(blockID, epochStatus))
-
-	// never process service events after epoch fallback is triggered
-	if epochStatus.InvalidServiceEventIncorporated || epochFallbackTriggered {
-		return dbUpdates, nil
-	}
-
-	// We apply service events from blocks which are sealed by this candidate block.
-	// The block's payload might contain epoch preparation service events for the next
-	// epoch. In this case, we need to update the tentative protocol state.
-	// We need to validate whether all information is available in the protocol
-	// state to go to the next epoch when needed. In cases where there is a bug
-	// in the smart contract, it could be that this happens too late and the
-	// chain finalization should halt.
-
-	// block payload may not specify seals in order, so order them by block height before processing
-	orderedSeals, err := protocol.OrderedSeals(candidate.Payload, m.headers)
-	if err != nil {
-		if errors.Is(err, storage.ErrNotFound) {
-			return nil, fmt.Errorf("ordering seals: parent payload contains seals for unknown block: %s", err.Error())
-		}
-		return nil, fmt.Errorf("unexpected error ordering seals: %w", err)
-	}
-	for _, seal := range orderedSeals {
-		result, err := m.results.ByID(seal.ResultID)
-		if err != nil {
-			return nil, fmt.Errorf("could not get result (id=%x) for seal (id=%x): %w", seal.ResultID, seal.ID(), err)
-		}
-
-		for _, event := range result.ServiceEvents {
-
-			switch ev := event.Event.(type) {
-			case *flow.EpochSetup:
-				// validate the service event
-				err := isValidExtendingEpochSetup(ev, activeSetup, epochStatus)
-				if err != nil {
-					if protocol.IsInvalidServiceEventError(err) {
-						// we have observed an invalid service event, which triggers epoch fallback mode
-						epochStatus.InvalidServiceEventIncorporated = true
-						return dbUpdates, nil
-					}
-					return nil, fmt.Errorf("unexpected error validating EpochSetup service event: %w", err)
-				}
-
-				// prevents multiple setup events for same Epoch (including multiple setup events in payload of same block)
-				epochStatus.NextEpoch.SetupID = ev.ID()
-
-				// we'll insert the setup event when we insert the block
-				dbUpdates = append(dbUpdates, m.epoch.setups.StoreTx(ev))
-
-			case *flow.EpochCommit:
-				// if we receive an EpochCommit event, we must have already observed an EpochSetup event
-				// => otherwise, we have observed an EpochCommit without corresponding EpochSetup, which triggers epoch fallback mode
-				if epochStatus.NextEpoch.SetupID == flow.ZeroID {
-					epochStatus.InvalidServiceEventIncorporated = true
-					return dbUpdates, nil
-				}
-
-				// if we have observed an EpochSetup event, we must be able to retrieve it from the database
-				// => otherwise, this is a symptom of bug or data corruption since this component sets the SetupID field
-				extendingSetup, err := m.epoch.setups.ByID(epochStatus.NextEpoch.SetupID)
-				if err != nil {
-					if errors.Is(err, storage.ErrNotFound) {
-						return nil, irrecoverable.NewExceptionf("could not retrieve EpochSetup (id=%x) stored in EpochStatus for block %x: %w",
-							epochStatus.NextEpoch.SetupID, blockID, err)
-					}
-					return nil, fmt.Errorf("unexpected error retrieving next epoch setup: %w", err)
-				}
-
-				// validate the service event
-				err = isValidExtendingEpochCommit(ev, extendingSetup, activeSetup, epochStatus)
-				if err != nil {
-					if protocol.IsInvalidServiceEventError(err) {
-						// we have observed an invalid service event, which triggers epoch fallback mode
-						epochStatus.InvalidServiceEventIncorporated = true
-						return dbUpdates, nil
-					}
-					return nil, fmt.Errorf("unexpected error validating EpochCommit service event: %w", err)
-				}
-
-				// prevents multiple setup events for same Epoch (including multiple setup events in payload of same block)
-				epochStatus.NextEpoch.CommitID = ev.ID()
-
-				// we'll insert the commit event when we insert the block
-				dbUpdates = append(dbUpdates, m.epoch.commits.StoreTx(ev))
-			case *flow.VersionBeacon:
-				// do nothing for now
-			default:
-				return nil, fmt.Errorf("invalid service event type (type_name=%s, go_type=%T)", event.Type, ev)
-			}
-		}
-	}
-	return
-}
diff --git a/state/protocol/badger/mutator_test.go b/state/protocol/badger/mutator_test.go
index 788408b881e..4db288ce1fd 100644
--- a/state/protocol/badger/mutator_test.go
+++ b/state/protocol/badger/mutator_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package badger_test
 
 import (
@@ -30,6 +28,7 @@ import (
 	"github.com/onflow/flow-go/state/protocol/events"
 	"github.com/onflow/flow-go/state/protocol/inmem"
 	mockprotocol "github.com/onflow/flow-go/state/protocol/mock"
+	"github.com/onflow/flow-go/state/protocol/protocol_state"
 	"github.com/onflow/flow-go/state/protocol/util"
 	"github.com/onflow/flow-go/storage"
 	stoerr "github.com/onflow/flow-go/storage"
@@ -108,7 +107,7 @@ func TestExtendValid(t *testing.T) {
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
@@ -128,7 +127,7 @@ func TestExtendValid(t *testing.T) {
 		require.NoError(t, err)
 
 		// insert block1 on top of the root block
-		block1 := unittest.BlockWithParentFixture(block.Header)
+		block1 := unittest.BlockWithParentProtocolState(block)
 		err = fullState.Extend(context.Background(), block1)
 		require.NoError(t, err)
 
@@ -142,7 +141,7 @@ func TestExtendValid(t *testing.T) {
 		})
 
 		t.Run("BlockProcessable event should be emitted when any child of block1 is inserted", func(t *testing.T) {
-			block2 := unittest.BlockWithParentFixture(block1.Header)
+			block2 := unittest.BlockWithParentProtocolState(block1)
 			consumer.On("BlockProcessable", block1.Header, mock.Anything).Once()
 			err := fullState.Extend(context.Background(), block2)
 			require.NoError(t, err)
@@ -152,6 +151,7 @@ func TestExtendValid(t *testing.T) {
 
 func TestSealedIndex(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
 		rootHeader, err := rootSnapshot.Head()
 		require.NoError(t, err)
@@ -164,20 +164,22 @@ func TestSealedIndex(t *testing.T) {
 
 		// block 1
 		b1 := unittest.BlockWithParentFixture(rootHeader)
-		b1.SetPayload(flow.EmptyPayload())
+		b1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), b1)
 		require.NoError(t, err)
 
 		// block 2(result B1)
 		b1Receipt := unittest.ReceiptForBlockFixture(b1)
 		b2 := unittest.BlockWithParentFixture(b1.Header)
-		b2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(b1Receipt)))
+		b2.SetPayload(unittest.PayloadFixture(
+			unittest.WithReceipts(b1Receipt),
+			unittest.WithProtocolStateID(rootProtocolStateID),
+		))
 		err = state.Extend(context.Background(), b2)
 		require.NoError(t, err)
 
 		// block 3
-		b3 := unittest.BlockWithParentFixture(b2.Header)
-		b3.SetPayload(flow.EmptyPayload())
+		b3 := unittest.BlockWithParentProtocolState(b2)
 		err = state.Extend(context.Background(), b3)
 		require.NoError(t, err)
 
@@ -186,8 +188,9 @@ func TestSealedIndex(t *testing.T) {
 		b3Receipt := unittest.ReceiptForBlockFixture(b3)
 		b4 := unittest.BlockWithParentFixture(b3.Header)
 		b4.SetPayload(flow.Payload{
-			Receipts: []*flow.ExecutionReceiptMeta{b2Receipt.Meta(), b3Receipt.Meta()},
-			Results:  []*flow.ExecutionResult{&b2Receipt.ExecutionResult, &b3Receipt.ExecutionResult},
+			Receipts:        []*flow.ExecutionReceiptMeta{b2Receipt.Meta(), b3Receipt.Meta()},
+			Results:         []*flow.ExecutionResult{&b2Receipt.ExecutionResult, &b3Receipt.ExecutionResult},
+			ProtocolStateID: rootProtocolStateID,
 		})
 		err = state.Extend(context.Background(), b4)
 		require.NoError(t, err)
@@ -196,7 +199,8 @@ func TestSealedIndex(t *testing.T) {
 		b1Seal := unittest.Seal.Fixture(unittest.Seal.WithResult(&b1Receipt.ExecutionResult))
 		b5 := unittest.BlockWithParentFixture(b4.Header)
 		b5.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{b1Seal},
+			Seals:           []*flow.Seal{b1Seal},
+			ProtocolStateID: rootProtocolStateID,
 		})
 		err = state.Extend(context.Background(), b5)
 		require.NoError(t, err)
@@ -206,14 +210,14 @@ func TestSealedIndex(t *testing.T) {
 		b3Seal := unittest.Seal.Fixture(unittest.Seal.WithResult(&b3Receipt.ExecutionResult))
 		b6 := unittest.BlockWithParentFixture(b5.Header)
 		b6.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{b2Seal, b3Seal},
+			Seals:           []*flow.Seal{b2Seal, b3Seal},
+			ProtocolStateID: rootProtocolStateID,
 		})
 		err = state.Extend(context.Background(), b6)
 		require.NoError(t, err)
 
 		// block 7
-		b7 := unittest.BlockWithParentFixture(b6.Header)
-		b7.SetPayload(flow.EmptyPayload())
+		b7 := unittest.BlockWithParentProtocolState(b6)
 		err = state.Extend(context.Background(), b7)
 		require.NoError(t, err)
 
@@ -271,6 +275,7 @@ func TestSealedIndex(t *testing.T) {
 
 func TestVersionBeaconIndex(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
 		rootHeader, err := rootSnapshot.Head()
 		require.NoError(t, err)
@@ -283,7 +288,7 @@ func TestVersionBeaconIndex(t *testing.T) {
 
 		// block 1
 		b1 := unittest.BlockWithParentFixture(rootHeader)
-		b1.SetPayload(flow.EmptyPayload())
+		b1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), b1)
 		require.NoError(t, err)
 
@@ -339,13 +344,13 @@ func TestVersionBeaconIndex(t *testing.T) {
 		b1Receipt := unittest.ReceiptForBlockFixture(b1)
 		b1Receipt.ExecutionResult.ServiceEvents = []flow.ServiceEvent{vb1.ServiceEvent()}
 		b2 := unittest.BlockWithParentFixture(b1.Header)
-		b2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(b1Receipt)))
+		b2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(b1Receipt),
+			unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), b2)
 		require.NoError(t, err)
 
 		// block 3
-		b3 := unittest.BlockWithParentFixture(b2.Header)
-		b3.SetPayload(flow.EmptyPayload())
+		b3 := unittest.BlockWithParentProtocolState(b2)
 		err = state.Extend(context.Background(), b3)
 		require.NoError(t, err)
 
@@ -358,8 +363,9 @@ func TestVersionBeaconIndex(t *testing.T) {
 
 		b4 := unittest.BlockWithParentFixture(b3.Header)
 		b4.SetPayload(flow.Payload{
-			Receipts: []*flow.ExecutionReceiptMeta{b2Receipt.Meta(), b3Receipt.Meta()},
-			Results:  []*flow.ExecutionResult{&b2Receipt.ExecutionResult, &b3Receipt.ExecutionResult},
+			Receipts:        []*flow.ExecutionReceiptMeta{b2Receipt.Meta(), b3Receipt.Meta()},
+			Results:         []*flow.ExecutionResult{&b2Receipt.ExecutionResult, &b3Receipt.ExecutionResult},
+			ProtocolStateID: rootProtocolStateID,
 		})
 		err = state.Extend(context.Background(), b4)
 		require.NoError(t, err)
@@ -368,7 +374,8 @@ func TestVersionBeaconIndex(t *testing.T) {
 		b1Seal := unittest.Seal.Fixture(unittest.Seal.WithResult(&b1Receipt.ExecutionResult))
 		b5 := unittest.BlockWithParentFixture(b4.Header)
 		b5.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{b1Seal},
+			Seals:           []*flow.Seal{b1Seal},
+			ProtocolStateID: rootProtocolStateID,
 		})
 		err = state.Extend(context.Background(), b5)
 		require.NoError(t, err)
@@ -378,7 +385,8 @@ func TestVersionBeaconIndex(t *testing.T) {
 		b3Seal := unittest.Seal.Fixture(unittest.Seal.WithResult(&b3Receipt.ExecutionResult))
 		b6 := unittest.BlockWithParentFixture(b5.Header)
 		b6.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{b2Seal, b3Seal},
+			Seals:           []*flow.Seal{b2Seal, b3Seal},
+			ProtocolStateID: rootProtocolStateID,
 		})
 		err = state.Extend(context.Background(), b6)
 		require.NoError(t, err)
@@ -438,6 +446,7 @@ func TestVersionBeaconIndex(t *testing.T) {
 
 func TestExtendSealedBoundary(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
 		head, err := rootSnapshot.Head()
 		require.NoError(t, err)
@@ -449,7 +458,7 @@ func TestExtendSealedBoundary(t *testing.T) {
 
 		// Create a first block on top of the snapshot
 		block1 := unittest.BlockWithParentFixture(head)
-		block1.SetPayload(flow.EmptyPayload())
+		block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), block1)
 		require.NoError(t, err)
 
@@ -457,8 +466,9 @@ func TestExtendSealedBoundary(t *testing.T) {
 		block1Receipt := unittest.ReceiptForBlockFixture(block1)
 		block2 := unittest.BlockWithParentFixture(block1.Header)
 		block2.SetPayload(flow.Payload{
-			Receipts: []*flow.ExecutionReceiptMeta{block1Receipt.Meta()},
-			Results:  []*flow.ExecutionResult{&block1Receipt.ExecutionResult},
+			Receipts:        []*flow.ExecutionReceiptMeta{block1Receipt.Meta()},
+			Results:         []*flow.ExecutionResult{&block1Receipt.ExecutionResult},
+			ProtocolStateID: rootProtocolStateID,
 		})
 		err = state.Extend(context.Background(), block2)
 		require.NoError(t, err)
@@ -467,7 +477,8 @@ func TestExtendSealedBoundary(t *testing.T) {
 		block1Seal := unittest.Seal.Fixture(unittest.Seal.WithResult(&block1Receipt.ExecutionResult))
 		block3 := unittest.BlockWithParentFixture(block2.Header)
 		block3.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{block1Seal},
+			Seals:           []*flow.Seal{block1Seal},
+			ProtocolStateID: rootProtocolStateID,
 		})
 		err = state.Extend(context.Background(), block3)
 		require.NoError(t, err)
@@ -524,12 +535,13 @@ func TestExtendMissingParent(t *testing.T) {
 
 func TestExtendHeightTooSmall(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
 		head, err := rootSnapshot.Head()
 		require.NoError(t, err)
 
 		extend := unittest.BlockFixture()
-		extend.SetPayload(flow.EmptyPayload())
+		extend.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		extend.Header.Height = 1
 		extend.Header.View = 1
 		extend.Header.ParentID = head.ID()
@@ -571,7 +583,7 @@ func TestExtendHeightTooLarge(t *testing.T) {
 	})
 }
 
-// TestExtendInconsistentParentView tests if mutator rejects block with invalid ParentView. ParentView must be consistent
+// TestExtendInconsistentParentView tests if mutableState rejects block with invalid ParentView. ParentView must be consistent
 // with view of block referred by ParentID.
 func TestExtendInconsistentParentView(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
@@ -593,6 +605,7 @@ func TestExtendInconsistentParentView(t *testing.T) {
 
 func TestExtendBlockNotConnected(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
 
 		head, err := rootSnapshot.Head()
@@ -600,7 +613,7 @@ func TestExtendBlockNotConnected(t *testing.T) {
 
 		// add 2 blocks, the second finalizing/sealing the state of the first
 		extend := unittest.BlockWithParentFixture(head)
-		extend.SetPayload(flow.EmptyPayload())
+		extend.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 
 		err = state.Extend(context.Background(), extend)
 		require.NoError(t, err)
@@ -682,8 +695,8 @@ func TestExtendReceiptsNotSorted(t *testing.T) {
 
 func TestExtendReceiptsInvalid(t *testing.T) {
 	validator := mockmodule.NewReceiptValidator(t)
-
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFullProtocolStateAndValidator(t, rootSnapshot, validator, func(db *badger.DB, state *protocol.ParticipantState) {
 		head, err := rootSnapshot.Head()
 		require.NoError(t, err)
@@ -692,7 +705,7 @@ func TestExtendReceiptsInvalid(t *testing.T) {
 
 		// create block2 and block3
 		block2 := unittest.BlockWithParentFixture(head)
-		block2.SetPayload(flow.EmptyPayload())
+		block2.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), block2)
 		require.NoError(t, err)
 
@@ -701,8 +714,9 @@ func TestExtendReceiptsInvalid(t *testing.T) {
 
 		block3 := unittest.BlockWithParentFixture(block2.Header)
 		block3.SetPayload(flow.Payload{
-			Receipts: []*flow.ExecutionReceiptMeta{receipt.Meta()},
-			Results:  []*flow.ExecutionResult{&receipt.ExecutionResult},
+			Receipts:        []*flow.ExecutionReceiptMeta{receipt.Meta()},
+			Results:         []*flow.ExecutionResult{&receipt.ExecutionResult},
+			ProtocolStateID: rootProtocolStateID,
 		})
 
 		// force the receipt validator to refuse this payload
@@ -716,21 +730,20 @@ func TestExtendReceiptsInvalid(t *testing.T) {
 
 func TestExtendReceiptsValid(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
 		head, err := rootSnapshot.Head()
 		require.NoError(t, err)
 		block2 := unittest.BlockWithParentFixture(head)
-		block2.SetPayload(flow.EmptyPayload())
+		block2.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), block2)
 		require.NoError(t, err)
 
-		block3 := unittest.BlockWithParentFixture(block2.Header)
-		block3.SetPayload(flow.EmptyPayload())
+		block3 := unittest.BlockWithParentProtocolState(block2)
 		err = state.Extend(context.Background(), block3)
 		require.NoError(t, err)
 
-		block4 := unittest.BlockWithParentFixture(block3.Header)
-		block4.SetPayload(flow.EmptyPayload())
+		block4 := unittest.BlockWithParentProtocolState(block3)
 		err = state.Extend(context.Background(), block4)
 		require.NoError(t, err)
 
@@ -750,6 +763,7 @@ func TestExtendReceiptsValid(t *testing.T) {
 				&receipt3b.ExecutionResult,
 				&receipt3c.ExecutionResult,
 			},
+			ProtocolStateID: rootProtocolStateID,
 		})
 		err = state.Extend(context.Background(), block5)
 		require.NoError(t, err)
@@ -781,7 +795,7 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 	consumer.On("BlockFinalized", mock.Anything)
 	consumer.On("BlockProcessable", mock.Anything, mock.Anything)
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
-
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
 
 		// set up state and mock ComplianceMetrics object
@@ -801,7 +815,6 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 		require.NoError(t, err)
 		metrics.On("CurrentEpochCounter", counter).Once()
 		metrics.On("CurrentEpochPhase", initialPhase).Once()
-		metrics.On("CommittedEpochFinalView", finalView).Once()
 
 		metrics.On("CurrentEpochFinalView", finalView).Once()
 
@@ -824,7 +837,7 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
@@ -844,6 +857,16 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 		)
 		require.NoError(t, err)
 
+		mutableProtocolState := protocol_state.NewMutableProtocolState(
+			all.ProtocolState,
+			state.Params(),
+			all.Headers,
+			all.Results,
+			all.Setups,
+			all.EpochCommits,
+		)
+		calculateExpectedStateId := calculateExpectedStateId(t, mutableProtocolState)
+
 		head, err := rootSnapshot.Head()
 		require.NoError(t, err)
 		result, _, err := rootSnapshot.SealedResult()
@@ -856,7 +879,7 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 
 		// add a block for the first seal to reference
 		block1 := unittest.BlockWithParentFixture(head)
-		block1.SetPayload(flow.EmptyPayload())
+		block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), block1)
 		require.NoError(t, err)
 		err = state.Finalize(context.Background(), block1.ID())
@@ -867,7 +890,7 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 
 		// add a participant for the next epoch
 		epoch2NewParticipant := unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification))
-		epoch2Participants := append(participants, epoch2NewParticipant).Sort(flow.Canonical)
+		epoch2Participants := append(participants, epoch2NewParticipant).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
 
 		// create the epoch setup event for the second epoch
 		epoch2Setup := unittest.EpochSetupFixture(
@@ -884,7 +907,7 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 
 		// add a second block with the receipt for block 1
 		block2 := unittest.BlockWithParentFixture(block1.Header)
-		block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1)))
+		block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1), unittest.WithProtocolStateID(block1.Payload.ProtocolStateID)))
 
 		err = state.Extend(context.Background(), block2)
 		require.NoError(t, err)
@@ -892,9 +915,11 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 		require.NoError(t, err)
 
 		// block 3 contains the seal for block 1
+		seals := []*flow.Seal{seal1}
 		block3 := unittest.BlockWithParentFixture(block2.Header)
 		block3.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{seal1},
+			Seals:           seals,
+			ProtocolStateID: calculateExpectedStateId(block3.Header, seals),
 		})
 
 		// insert the block sealing the EpochSetup event
@@ -925,7 +950,7 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 		require.Error(t, err)
 
 		// insert B4
-		block4 := unittest.BlockWithParentFixture(block3.Header)
+		block4 := unittest.BlockWithParentProtocolState(block3)
 		err = state.Extend(context.Background(), block4)
 		require.NoError(t, err)
 
@@ -950,7 +975,7 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 		epoch2Commit := unittest.EpochCommitFixture(
 			unittest.CommitWithCounter(epoch2Setup.Counter),
 			unittest.WithClusterQCsFromAssignments(epoch2Setup.Assignments),
-			unittest.WithDKGFromParticipants(epoch2Participants),
+			unittest.WithDKGFromParticipants(epoch2Participants.ToSkeleton()),
 		)
 
 		// create receipt and seal for block 2
@@ -961,7 +986,8 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 
 		// block 5 contains the receipt for block 2
 		block5 := unittest.BlockWithParentFixture(block4.Header)
-		block5.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt2)))
+		block5.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt2),
+			unittest.WithProtocolStateID(block4.Payload.ProtocolStateID)))
 
 		err = state.Extend(context.Background(), block5)
 		require.NoError(t, err)
@@ -969,9 +995,11 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 		require.NoError(t, err)
 
 		// block 6 contains the seal for block 2
+		seals = []*flow.Seal{seal2}
 		block6 := unittest.BlockWithParentFixture(block5.Header)
 		block6.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{seal2},
+			Seals:           seals,
+			ProtocolStateID: calculateExpectedStateId(block6.Header, seals),
 		})
 
 		err = state.Extend(context.Background(), block6)
@@ -997,23 +1025,19 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 		require.Equal(t, flow.EpochPhaseCommitted, phase)
 
 		// block 7 has the final view of the epoch, insert it, finalized after finalizing block 6
-		block7 := unittest.BlockWithParentFixture(block6.Header)
-		block7.SetPayload(flow.EmptyPayload())
+		block7 := unittest.BlockWithParentProtocolState(block6)
 		block7.Header.View = epoch1FinalView
 		err = state.Extend(context.Background(), block7)
 		require.NoError(t, err)
 
 		// expect epoch phase transition once we finalize block 6
 		consumer.On("EpochCommittedPhaseStarted", epoch2Setup.Counter-1, block6.Header).Once()
-		// expect committed final view to be updated, since we are committing epoch 2
-		metrics.On("CommittedEpochFinalView", epoch2Setup.FinalView).Once()
 		metrics.On("CurrentEpochPhase", flow.EpochPhaseCommitted).Once()
 
 		err = state.Finalize(context.Background(), block6.ID())
 		require.NoError(t, err)
 
 		consumer.AssertCalled(t, "EpochCommittedPhaseStarted", epoch2Setup.Counter-1, block6.Header)
-		metrics.AssertCalled(t, "CommittedEpochFinalView", epoch2Setup.FinalView)
 		metrics.AssertCalled(t, "CurrentEpochPhase", flow.EpochPhaseCommitted)
 
 		// we should still be in epoch 1
@@ -1031,9 +1055,12 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 
 		// block 8 has a view > final view of epoch 1, it will be considered the first block of epoch 2
 		block8 := unittest.BlockWithParentFixture(block7.Header)
-		block8.SetPayload(flow.EmptyPayload())
 		// we should handle views that aren't exactly the first valid view of the epoch
 		block8.Header.View = epoch1FinalView + uint64(1+rand.Intn(10))
+		// need to update root protocol state since we enter new epoch
+		block8.SetPayload(
+			unittest.PayloadFixture(
+				unittest.WithProtocolStateID(calculateExpectedStateId(block8.Header, nil))))
 
 		err = state.Extend(context.Background(), block8)
 		require.NoError(t, err)
@@ -1086,7 +1113,9 @@ func TestExtendEpochTransitionValid(t *testing.T) {
 //	         \--B2<--B4(R2)<--B6(S2)<--B8
 func TestExtendConflictingEpochEvents(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
-	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
+	util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
+		calculateExpectedStateId := calculateExpectedStateId(t, mutableState)
 
 		head, err := rootSnapshot.Head()
 		require.NoError(t, err)
@@ -1095,12 +1124,12 @@ func TestExtendConflictingEpochEvents(t *testing.T) {
 
 		// add two conflicting blocks for each service event to reference
 		block1 := unittest.BlockWithParentFixture(head)
-		block1.SetPayload(flow.EmptyPayload())
+		block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), block1)
 		require.NoError(t, err)
 
 		block2 := unittest.BlockWithParentFixture(head)
-		block2.SetPayload(flow.EmptyPayload())
+		block2.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), block2)
 		require.NoError(t, err)
 
@@ -1128,8 +1157,9 @@ func TestExtendConflictingEpochEvents(t *testing.T) {
 		// add block 1 receipt to block 3 payload
 		block3 := unittest.BlockWithParentFixture(block1.Header)
 		block3.SetPayload(flow.Payload{
-			Receipts: []*flow.ExecutionReceiptMeta{block1Receipt.Meta()},
-			Results:  []*flow.ExecutionResult{&block1Receipt.ExecutionResult},
+			Receipts:        []*flow.ExecutionReceiptMeta{block1Receipt.Meta()},
+			Results:         []*flow.ExecutionResult{&block1Receipt.ExecutionResult},
+			ProtocolStateID: block1.Payload.ProtocolStateID,
 		})
 		err = state.Extend(context.Background(), block3)
 		require.NoError(t, err)
@@ -1141,22 +1171,24 @@ func TestExtendConflictingEpochEvents(t *testing.T) {
 		// add block 2 receipt to block 4 payload
 		block4 := unittest.BlockWithParentFixture(block2.Header)
 		block4.SetPayload(flow.Payload{
-			Receipts: []*flow.ExecutionReceiptMeta{block2Receipt.Meta()},
-			Results:  []*flow.ExecutionResult{&block2Receipt.ExecutionResult},
+			Receipts:        []*flow.ExecutionReceiptMeta{block2Receipt.Meta()},
+			Results:         []*flow.ExecutionResult{&block2Receipt.ExecutionResult},
+			ProtocolStateID: block1.Payload.ProtocolStateID,
 		})
 		err = state.Extend(context.Background(), block4)
 		require.NoError(t, err)
 
 		// seal for block 1
-		seal1 := unittest.Seal.Fixture(unittest.Seal.WithResult(&block1Receipt.ExecutionResult))
+		seals1 := []*flow.Seal{unittest.Seal.Fixture(unittest.Seal.WithResult(&block1Receipt.ExecutionResult))}
 
 		// seal for block 2
-		seal2 := unittest.Seal.Fixture(unittest.Seal.WithResult(&block2Receipt.ExecutionResult))
+		seals2 := []*flow.Seal{unittest.Seal.Fixture(unittest.Seal.WithResult(&block2Receipt.ExecutionResult))}
 
 		// block 5 builds on block 3, contains seal for block 1
 		block5 := unittest.BlockWithParentFixture(block3.Header)
 		block5.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{seal1},
+			Seals:           seals1,
+			ProtocolStateID: calculateExpectedStateId(block5.Header, seals1),
 		})
 		err = state.Extend(context.Background(), block5)
 		require.NoError(t, err)
@@ -1164,18 +1196,19 @@ func TestExtendConflictingEpochEvents(t *testing.T) {
 		// block 6 builds on block 4, contains seal for block 2
 		block6 := unittest.BlockWithParentFixture(block4.Header)
 		block6.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{seal2},
+			Seals:           seals2,
+			ProtocolStateID: calculateExpectedStateId(block6.Header, seals2),
 		})
 		err = state.Extend(context.Background(), block6)
 		require.NoError(t, err)
 
 		// block 7 builds on block 5, contains QC for block 7
-		block7 := unittest.BlockWithParentFixture(block5.Header)
+		block7 := unittest.BlockWithParentProtocolState(block5)
 		err = state.Extend(context.Background(), block7)
 		require.NoError(t, err)
 
 		// block 8 builds on block 6, contains QC for block 6
-		block8 := unittest.BlockWithParentFixture(block6.Header)
+		block8 := unittest.BlockWithParentProtocolState(block6)
 		err = state.Extend(context.Background(), block8)
 		require.NoError(t, err)
 
@@ -1198,7 +1231,9 @@ func TestExtendConflictingEpochEvents(t *testing.T) {
 //	        \--B2<--B4(R2)<--B6(S2)<--B8
 func TestExtendDuplicateEpochEvents(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
-	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
+	util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
+		calculateExpectedStateId := calculateExpectedStateId(t, mutableState)
 
 		head, err := rootSnapshot.Head()
 		require.NoError(t, err)
@@ -1207,12 +1242,12 @@ func TestExtendDuplicateEpochEvents(t *testing.T) {
 
 		// add two conflicting blocks for each service event to reference
 		block1 := unittest.BlockWithParentFixture(head)
-		block1.SetPayload(flow.EmptyPayload())
+		block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), block1)
 		require.NoError(t, err)
 
 		block2 := unittest.BlockWithParentFixture(head)
-		block2.SetPayload(flow.EmptyPayload())
+		block2.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), block2)
 		require.NoError(t, err)
 
@@ -1233,7 +1268,10 @@ func TestExtendDuplicateEpochEvents(t *testing.T) {
 
 		// add block 1 receipt to block 3 payload
 		block3 := unittest.BlockWithParentFixture(block1.Header)
-		block3.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(block1Receipt)))
+		block3.SetPayload(unittest.PayloadFixture(
+			unittest.WithReceipts(block1Receipt),
+			unittest.WithProtocolStateID(rootProtocolStateID),
+		))
 		err = state.Extend(context.Background(), block3)
 		require.NoError(t, err)
 
@@ -1243,20 +1281,24 @@ func TestExtendDuplicateEpochEvents(t *testing.T) {
 
 		// add block 2 receipt to block 4 payload
 		block4 := unittest.BlockWithParentFixture(block2.Header)
-		block4.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(block2Receipt)))
+		block4.SetPayload(unittest.PayloadFixture(
+			unittest.WithReceipts(block2Receipt),
+			unittest.WithProtocolStateID(rootProtocolStateID),
+		))
 		err = state.Extend(context.Background(), block4)
 		require.NoError(t, err)
 
 		// seal for block 1
-		seal1 := unittest.Seal.Fixture(unittest.Seal.WithResult(&block1Receipt.ExecutionResult))
+		seals1 := []*flow.Seal{unittest.Seal.Fixture(unittest.Seal.WithResult(&block1Receipt.ExecutionResult))}
 
 		// seal for block 2
-		seal2 := unittest.Seal.Fixture(unittest.Seal.WithResult(&block2Receipt.ExecutionResult))
+		seals2 := []*flow.Seal{unittest.Seal.Fixture(unittest.Seal.WithResult(&block2Receipt.ExecutionResult))}
 
 		// block 5 builds on block 3, contains seal for block 1
 		block5 := unittest.BlockWithParentFixture(block3.Header)
 		block5.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{seal1},
+			Seals:           seals1,
+			ProtocolStateID: calculateExpectedStateId(block5.Header, seals1),
 		})
 		err = state.Extend(context.Background(), block5)
 		require.NoError(t, err)
@@ -1264,19 +1306,20 @@ func TestExtendDuplicateEpochEvents(t *testing.T) {
 		// block 6 builds on block 4, contains seal for block 2
 		block6 := unittest.BlockWithParentFixture(block4.Header)
 		block6.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{seal2},
+			Seals:           seals2,
+			ProtocolStateID: calculateExpectedStateId(block6.Header, seals2),
 		})
 		err = state.Extend(context.Background(), block6)
 		require.NoError(t, err)
 
 		// block 7 builds on block 5, contains QC for block 7
-		block7 := unittest.BlockWithParentFixture(block5.Header)
+		block7 := unittest.BlockWithParentProtocolState(block5)
 		err = state.Extend(context.Background(), block7)
 		require.NoError(t, err)
 
 		// block 8 builds on block 6, contains QC for block 6
 		// at this point we are inserting the duplicate EpochSetup, should not error
-		block8 := unittest.BlockWithParentFixture(block6.Header)
+		block8 := unittest.BlockWithParentProtocolState(block6)
 		err = state.Extend(context.Background(), block8)
 		require.NoError(t, err)
 
@@ -1295,6 +1338,7 @@ func TestExtendDuplicateEpochEvents(t *testing.T) {
 // service event should trigger epoch fallback when the fork is finalized.
 func TestExtendEpochSetupInvalid(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 
 	// setupState initializes the protocol state for a test case
 	// * creates and finalizes a new block for the first seal to reference
@@ -1311,14 +1355,14 @@ func TestExtendEpochSetupInvalid(t *testing.T) {
 
 		// add a block for the first seal to reference
 		block1 := unittest.BlockWithParentFixture(head)
-		block1.SetPayload(flow.EmptyPayload())
+		block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		unittest.InsertAndFinalize(t, state, block1)
 
 		epoch1Setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
 
 		// add a participant for the next epoch
 		epoch2NewParticipant := unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification))
-		epoch2Participants := append(participants, epoch2NewParticipant).Sort(flow.Canonical)
+		epoch2Participants := append(participants, epoch2NewParticipant).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
 
 		// this function will return a VALID setup event and seal, we will modify
 		// in different ways in each test case
@@ -1341,16 +1385,16 @@ func TestExtendEpochSetupInvalid(t *testing.T) {
 		return block1, createSetupEvent
 	}
 
-	// expect a setup event with wrong counter to trigger EECC without error
-	t.Run("wrong counter (EECC)", func(t *testing.T) {
-		util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
+	// expect a setup event with wrong counter to trigger EFM without error
+	t.Run("wrong counter [EFM]", func(t *testing.T) {
+		util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
 			block1, createSetup := setupState(t, db, state)
 
 			_, receipt, seal := createSetup(func(setup *flow.EpochSetup) {
 				setup.Counter = rand.Uint64()
 			})
 
-			receiptBlock, sealingBlock := unittest.SealBlock(t, state, block1, receipt, seal)
+			receiptBlock, sealingBlock := unittest.SealBlock(t, state, mutableState, block1, receipt, seal)
 			err := state.Finalize(context.Background(), receiptBlock.ID())
 			require.NoError(t, err)
 			// epoch fallback not triggered before finalization
@@ -1362,16 +1406,16 @@ func TestExtendEpochSetupInvalid(t *testing.T) {
 		})
 	})
 
-	// expect a setup event with wrong final view to trigger EECC without error
-	t.Run("invalid final view (EECC)", func(t *testing.T) {
-		util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
+	// expect a setup event with wrong final view to trigger EFM without error
+	t.Run("invalid final view [EFM]", func(t *testing.T) {
+		util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
 			block1, createSetup := setupState(t, db, state)
 
 			_, receipt, seal := createSetup(func(setup *flow.EpochSetup) {
 				setup.FinalView = block1.Header.View
 			})
 
-			receiptBlock, sealingBlock := unittest.SealBlock(t, state, block1, receipt, seal)
+			receiptBlock, sealingBlock := unittest.SealBlock(t, state, mutableState, block1, receipt, seal)
 			err := state.Finalize(context.Background(), receiptBlock.ID())
 			require.NoError(t, err)
 			// epoch fallback not triggered before finalization
@@ -1383,16 +1427,38 @@ func TestExtendEpochSetupInvalid(t *testing.T) {
 		})
 	})
 
-	// expect a setup event with empty seed to trigger EECC without error
-	t.Run("empty seed (EECC)", func(t *testing.T) {
-		util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
+	// expect a setup event with empty seed to trigger EFM without error
+	t.Run("empty seed [EFM]", func(t *testing.T) {
+		util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
 			block1, createSetup := setupState(t, db, state)
 
 			_, receipt, seal := createSetup(func(setup *flow.EpochSetup) {
 				setup.RandomSource = nil
 			})
 
-			receiptBlock, sealingBlock := unittest.SealBlock(t, state, block1, receipt, seal)
+			receiptBlock, sealingBlock := unittest.SealBlock(t, state, mutableState, block1, receipt, seal)
+			err := state.Finalize(context.Background(), receiptBlock.ID())
+			require.NoError(t, err)
+			// epoch fallback not triggered before finalization
+			assertEpochEmergencyFallbackTriggered(t, state, false)
+			err = state.Finalize(context.Background(), sealingBlock.ID())
+			require.NoError(t, err)
+			// epoch fallback triggered after finalization
+			assertEpochEmergencyFallbackTriggered(t, state, true)
+		})
+	})
+
+	t.Run("participants not ordered [EFM]", func(t *testing.T) {
+		util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
+			block1, createSetup := setupState(t, db, state)
+
+			_, receipt, seal := createSetup(func(setup *flow.EpochSetup) {
+				var err error
+				setup.Participants, err = setup.Participants.Shuffle()
+				require.NoError(t, err)
+			})
+
+			receiptBlock, sealingBlock := unittest.SealBlock(t, state, mutableState, block1, receipt, seal)
 			err := state.Finalize(context.Background(), receiptBlock.ID())
 			require.NoError(t, err)
 			// epoch fallback not triggered before finalization
@@ -1409,6 +1475,7 @@ func TestExtendEpochSetupInvalid(t *testing.T) {
 // service event should trigger epoch fallback when the fork is finalized.
 func TestExtendEpochCommitInvalid(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 
 	// setupState initializes the protocol state for a test case
 	// * creates and finalizes a new block for the first seal to reference
@@ -1426,7 +1493,7 @@ func TestExtendEpochCommitInvalid(t *testing.T) {
 
 		// add a block for the first seal to reference
 		block1 := unittest.BlockWithParentFixture(head)
-		block1.SetPayload(flow.EmptyPayload())
+		block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		unittest.InsertAndFinalize(t, state, block1)
 
 		epoch1Setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
@@ -1434,9 +1501,9 @@ func TestExtendEpochCommitInvalid(t *testing.T) {
 		// swap consensus node for a new one for epoch 2
 		epoch2NewParticipant := unittest.IdentityFixture(unittest.WithRole(flow.RoleConsensus))
 		epoch2Participants := append(
-			participants.Filter(filter.Not(filter.HasRole(flow.RoleConsensus))),
+			participants.Filter(filter.Not[flow.Identity](filter.HasRole[flow.Identity](flow.RoleConsensus))),
 			epoch2NewParticipant,
-		).Sort(flow.Canonical)
+		).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
 
 		// factory method to create a valid EpochSetup method w.r.t. the generated state
 		createSetup := func(block *flow.Block) (*flow.EpochSetup, *flow.ExecutionReceipt, *flow.Seal) {
@@ -1471,13 +1538,13 @@ func TestExtendEpochCommitInvalid(t *testing.T) {
 		return block1, createSetup, createCommit
 	}
 
-	t.Run("without setup (EECC)", func(t *testing.T) {
-		util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
+	t.Run("without setup [EFM]", func(t *testing.T) {
+		util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
 			block1, _, createCommit := setupState(t, state)
 
 			_, receipt, seal := createCommit(block1)
 
-			receiptBlock, sealingBlock := unittest.SealBlock(t, state, block1, receipt, seal)
+			receiptBlock, sealingBlock := unittest.SealBlock(t, state, mutableState, block1, receipt, seal)
 			err := state.Finalize(context.Background(), receiptBlock.ID())
 			require.NoError(t, err)
 			// epoch fallback not triggered before finalization
@@ -1489,28 +1556,28 @@ func TestExtendEpochCommitInvalid(t *testing.T) {
 		})
 	})
 
-	// expect a commit event with wrong counter to trigger EECC without error
-	t.Run("inconsistent counter (EECC)", func(t *testing.T) {
-		util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
+	// expect a commit event with wrong counter to trigger EFM without error
+	t.Run("inconsistent counter [EFM]", func(t *testing.T) {
+		util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
 			block1, createSetup, createCommit := setupState(t, state)
 
 			// seal block 1, in which EpochSetup was emitted
 			epoch2Setup, setupReceipt, setupSeal := createSetup(block1)
-			epochSetupReceiptBlock, epochSetupSealingBlock := unittest.SealBlock(t, state, block1, setupReceipt, setupSeal)
+			epochSetupReceiptBlock, epochSetupSealingBlock := unittest.SealBlock(t, state, mutableState, block1, setupReceipt, setupSeal)
 			err := state.Finalize(context.Background(), epochSetupReceiptBlock.ID())
 			require.NoError(t, err)
 			err = state.Finalize(context.Background(), epochSetupSealingBlock.ID())
 			require.NoError(t, err)
 
 			// insert a block with a QC for block 2
-			block3 := unittest.BlockWithParentFixture(epochSetupSealingBlock)
+			block3 := unittest.BlockWithParentProtocolState(epochSetupSealingBlock)
 			unittest.InsertAndFinalize(t, state, block3)
 
 			_, receipt, seal := createCommit(block3, func(commit *flow.EpochCommit) {
 				commit.Counter = epoch2Setup.Counter + 1
 			})
 
-			receiptBlock, sealingBlock := unittest.SealBlock(t, state, block3, receipt, seal)
+			receiptBlock, sealingBlock := unittest.SealBlock(t, state, mutableState, block3, receipt, seal)
 			err = state.Finalize(context.Background(), receiptBlock.ID())
 			require.NoError(t, err)
 			// epoch fallback not triggered before finalization
@@ -1522,28 +1589,28 @@ func TestExtendEpochCommitInvalid(t *testing.T) {
 		})
 	})
 
-	// expect a commit event with wrong cluster QCs to trigger EECC without error
-	t.Run("inconsistent cluster QCs (EECC)", func(t *testing.T) {
-		util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
+	// expect a commit event with wrong cluster QCs to trigger EFM without error
+	t.Run("inconsistent cluster QCs [EFM]", func(t *testing.T) {
+		util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
 			block1, createSetup, createCommit := setupState(t, state)
 
 			// seal block 1, in which EpochSetup was emitted
 			_, setupReceipt, setupSeal := createSetup(block1)
-			epochSetupReceiptBlock, epochSetupSealingBlock := unittest.SealBlock(t, state, block1, setupReceipt, setupSeal)
+			epochSetupReceiptBlock, epochSetupSealingBlock := unittest.SealBlock(t, state, mutableState, block1, setupReceipt, setupSeal)
 			err := state.Finalize(context.Background(), epochSetupReceiptBlock.ID())
 			require.NoError(t, err)
 			err = state.Finalize(context.Background(), epochSetupSealingBlock.ID())
 			require.NoError(t, err)
 
 			// insert a block with a QC for block 2
-			block3 := unittest.BlockWithParentFixture(epochSetupSealingBlock)
+			block3 := unittest.BlockWithParentProtocolState(epochSetupSealingBlock)
 			unittest.InsertAndFinalize(t, state, block3)
 
 			_, receipt, seal := createCommit(block3, func(commit *flow.EpochCommit) {
 				commit.ClusterQCs = append(commit.ClusterQCs, flow.ClusterQCVoteDataFromQC(unittest.QuorumCertificateWithSignerIDsFixture()))
 			})
 
-			receiptBlock, sealingBlock := unittest.SealBlock(t, state, block3, receipt, seal)
+			receiptBlock, sealingBlock := unittest.SealBlock(t, state, mutableState, block3, receipt, seal)
 			err = state.Finalize(context.Background(), receiptBlock.ID())
 			require.NoError(t, err)
 			// epoch fallback not triggered before finalization
@@ -1555,21 +1622,21 @@ func TestExtendEpochCommitInvalid(t *testing.T) {
 		})
 	})
 
-	// expect a commit event with wrong dkg participants to trigger EECC without error
-	t.Run("inconsistent DKG participants (EECC)", func(t *testing.T) {
-		util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
+	// expect a commit event with wrong dkg participants to trigger EFM without error
+	t.Run("inconsistent DKG participants [EFM]", func(t *testing.T) {
+		util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
 			block1, createSetup, createCommit := setupState(t, state)
 
 			// seal block 1, in which EpochSetup was emitted
 			_, setupReceipt, setupSeal := createSetup(block1)
-			epochSetupReceiptBlock, epochSetupSealingBlock := unittest.SealBlock(t, state, block1, setupReceipt, setupSeal)
+			epochSetupReceiptBlock, epochSetupSealingBlock := unittest.SealBlock(t, state, mutableState, block1, setupReceipt, setupSeal)
 			err := state.Finalize(context.Background(), epochSetupReceiptBlock.ID())
 			require.NoError(t, err)
 			err = state.Finalize(context.Background(), epochSetupSealingBlock.ID())
 			require.NoError(t, err)
 
 			// insert a block with a QC for block 2
-			block3 := unittest.BlockWithParentFixture(epochSetupSealingBlock)
+			block3 := unittest.BlockWithParentProtocolState(epochSetupSealingBlock)
 			unittest.InsertAndFinalize(t, state, block3)
 
 			_, receipt, seal := createCommit(block3, func(commit *flow.EpochCommit) {
@@ -1577,7 +1644,7 @@ func TestExtendEpochCommitInvalid(t *testing.T) {
 				commit.DKGParticipantKeys = append(commit.DKGParticipantKeys, unittest.KeyFixture(crypto.BLSBLS12381).PublicKey())
 			})
 
-			receiptBlock, sealingBlock := unittest.SealBlock(t, state, block3, receipt, seal)
+			receiptBlock, sealingBlock := unittest.SealBlock(t, state, mutableState, block3, receipt, seal)
 			err = state.Finalize(context.Background(), receiptBlock.ID())
 			require.NoError(t, err)
 			// epoch fallback not triggered before finalization
@@ -1597,7 +1664,7 @@ func TestExtendEpochCommitInvalid(t *testing.T) {
 func TestExtendEpochTransitionWithoutCommit(t *testing.T) {
 
 	// skipping because this case will now result in emergency epoch continuation kicking in
-	unittest.SkipUnless(t, unittest.TEST_TODO, "disabled as the current implementation uses a temporary fallback measure in this case (triggers EECC), rather than returning an error")
+	unittest.SkipUnless(t, unittest.TEST_TODO, "disabled as the current implementation uses a temporary fallback measure in this case (triggers EFM), rather than returning an error")
 
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
@@ -1619,7 +1686,7 @@ func TestExtendEpochTransitionWithoutCommit(t *testing.T) {
 
 		// add a participant for the next epoch
 		epoch2NewParticipant := unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification))
-		epoch2Participants := append(participants, epoch2NewParticipant).Sort(flow.Canonical)
+		epoch2Participants := append(participants, epoch2NewParticipant).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
 
 		// create the epoch setup event for the second epoch
 		epoch2Setup := unittest.EpochSetupFixture(
@@ -1664,14 +1731,14 @@ func TestExtendEpochTransitionWithoutCommit(t *testing.T) {
 func TestEmergencyEpochFallback(t *testing.T) {
 
 	// if we finalize the first block past the epoch commitment deadline while
-	// in the EpochStaking phase, EECC should be triggered
+	// in the EpochStaking phase, EFM should be triggered
 	//
 	//       Epoch Commitment Deadline
 	//       |     Epoch Boundary
 	//       |     |
 	//       v     v
 	// ROOT <- B1 <- B2
-	t.Run("passed epoch commitment deadline in EpochStaking phase - should trigger EECC", func(t *testing.T) {
+	t.Run("passed epoch commitment deadline in EpochStaking phase - should trigger EFM", func(t *testing.T) {
 
 		rootSnapshot := unittest.RootSnapshotFixture(participants)
 		metricsMock := mockmodule.NewComplianceMetrics(t)
@@ -1680,19 +1747,21 @@ func TestEmergencyEpochFallback(t *testing.T) {
 		protoEventsMock.On("BlockFinalized", mock.Anything)
 		protoEventsMock.On("BlockProcessable", mock.Anything, mock.Anything)
 
-		util.RunWithFullProtocolStateAndMetricsAndConsumer(t, rootSnapshot, metricsMock, protoEventsMock, func(db *badger.DB, state *protocol.ParticipantState) {
+		util.RunWithFullProtocolStateAndMetricsAndConsumer(t, rootSnapshot, metricsMock, protoEventsMock, func(db *badger.DB, state *protocol.ParticipantState, mutableProtocolState realprotocol.MutableProtocolState) {
 			head, err := rootSnapshot.Head()
 			require.NoError(t, err)
 			result, _, err := rootSnapshot.SealedResult()
 			require.NoError(t, err)
-			safetyThreshold, err := rootSnapshot.Params().EpochCommitSafetyThreshold()
+			safetyThreshold := rootSnapshot.Params().EpochCommitSafetyThreshold()
 			require.NoError(t, err)
 
+			calculateExpectedStateId := calculateExpectedStateId(t, mutableProtocolState)
+
 			epoch1Setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
 			epoch1FinalView := epoch1Setup.FinalView
 			epoch1CommitmentDeadline := epoch1FinalView - safetyThreshold
 
-			// finalizing block 1 should trigger EECC
+			// finalizing block 1 should trigger EFM
 			metricsMock.On("EpochEmergencyFallbackTriggered").Once()
 			protoEventsMock.On("EpochEmergencyFallbackTriggered").Once()
 
@@ -1700,6 +1769,7 @@ func TestEmergencyEpochFallback(t *testing.T) {
 			// block 1 will be the first block on or past the epoch commitment deadline
 			block1 := unittest.BlockWithParentFixture(head)
 			block1.Header.View = epoch1CommitmentDeadline + rand.Uint64()%2
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(calculateExpectedStateId(block1.Header, nil))))
 			err = state.Extend(context.Background(), block1)
 			require.NoError(t, err)
 			assertEpochEmergencyFallbackTriggered(t, state, false) // not triggered before finalization
@@ -1708,47 +1778,48 @@ func TestEmergencyEpochFallback(t *testing.T) {
 			assertEpochEmergencyFallbackTriggered(t, state, true) // triggered after finalization
 
 			// block 2 will be the first block past the first epoch boundary
-			block2 := unittest.BlockWithParentFixture(block1.Header)
+			block2 := unittest.BlockWithParentProtocolState(block1)
 			block2.Header.View = epoch1FinalView + 1
 			err = state.Extend(context.Background(), block2)
 			require.NoError(t, err)
 			err = state.Finalize(context.Background(), block2.ID())
 			require.NoError(t, err)
 
-			// since EECC has been triggered, epoch transition metrics should not be updated
+			// since EFM has been triggered, epoch transition metrics should not be updated
 			metricsMock.AssertNotCalled(t, "EpochTransition", mock.Anything, mock.Anything)
 			metricsMock.AssertNotCalled(t, "CurrentEpochCounter", epoch1Setup.Counter+1)
 		})
 	})
 
 	// if we finalize the first block past the epoch commitment deadline while
-	// in the EpochSetup phase, EECC should be triggered
+	// in the EpochSetup phase, EFM should be triggered
 	//
 	//                       Epoch Commitment Deadline
 	//                       |         Epoch Boundary
 	//                       |         |
 	//                       v         v
 	// ROOT <- B1 <- B2(R1) <- B3(S1) <- B4
-	t.Run("passed epoch commitment deadline in EpochSetup phase - should trigger EECC", func(t *testing.T) {
+	t.Run("passed epoch commitment deadline in EpochSetup phase - should trigger EFM", func(t *testing.T) {
 
 		rootSnapshot := unittest.RootSnapshotFixture(participants)
+		rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 		metricsMock := mockmodule.NewComplianceMetrics(t)
 		mockMetricsForRootSnapshot(metricsMock, rootSnapshot)
 		protoEventsMock := mockprotocol.NewConsumer(t)
 		protoEventsMock.On("BlockFinalized", mock.Anything)
 		protoEventsMock.On("BlockProcessable", mock.Anything, mock.Anything)
 
-		util.RunWithFullProtocolStateAndMetricsAndConsumer(t, rootSnapshot, metricsMock, protoEventsMock, func(db *badger.DB, state *protocol.ParticipantState) {
+		util.RunWithFullProtocolStateAndMetricsAndConsumer(t, rootSnapshot, metricsMock, protoEventsMock, func(db *badger.DB, state *protocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
 			head, err := rootSnapshot.Head()
 			require.NoError(t, err)
 			result, _, err := rootSnapshot.SealedResult()
 			require.NoError(t, err)
-			safetyThreshold, err := rootSnapshot.Params().EpochCommitSafetyThreshold()
+			safetyThreshold := rootSnapshot.Params().EpochCommitSafetyThreshold()
 			require.NoError(t, err)
 
 			// add a block for the first seal to reference
 			block1 := unittest.BlockWithParentFixture(head)
-			block1.SetPayload(flow.EmptyPayload())
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			err = state.Extend(context.Background(), block1)
 			require.NoError(t, err)
 			err = state.Finalize(context.Background(), block1.ID())
@@ -1760,7 +1831,7 @@ func TestEmergencyEpochFallback(t *testing.T) {
 
 			// add a participant for the next epoch
 			epoch2NewParticipant := unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification))
-			epoch2Participants := append(participants, epoch2NewParticipant).Sort(flow.Canonical)
+			epoch2Participants := append(participants, epoch2NewParticipant).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
 
 			// create the epoch setup event for the second epoch
 			epoch2Setup := unittest.EpochSetupFixture(
@@ -1776,7 +1847,10 @@ func TestEmergencyEpochFallback(t *testing.T) {
 
 			// add a block containing a receipt for block 1
 			block2 := unittest.BlockWithParentFixture(block1.Header)
-			block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1)))
+			block2.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receipt1),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			err = state.Extend(context.Background(), block2)
 			require.NoError(t, err)
 			err = state.Finalize(context.Background(), block2.ID())
@@ -1785,13 +1859,15 @@ func TestEmergencyEpochFallback(t *testing.T) {
 			// block 3 seals block 1 and will be the first block on or past the epoch commitment deadline
 			block3 := unittest.BlockWithParentFixture(block2.Header)
 			block3.Header.View = epoch1CommitmentDeadline + rand.Uint64()%2
+			seals := []*flow.Seal{seal1}
 			block3.SetPayload(flow.Payload{
-				Seals: []*flow.Seal{seal1},
+				Seals:           seals,
+				ProtocolStateID: calculateExpectedStateId(t, mutableState)(block3.Header, seals),
 			})
 			err = state.Extend(context.Background(), block3)
 			require.NoError(t, err)
 
-			// finalizing block 3 should trigger EECC
+			// finalizing block 3 should trigger EFM
 			metricsMock.On("EpochEmergencyFallbackTriggered").Once()
 			protoEventsMock.On("EpochEmergencyFallbackTriggered").Once()
 
@@ -1801,14 +1877,14 @@ func TestEmergencyEpochFallback(t *testing.T) {
 			assertEpochEmergencyFallbackTriggered(t, state, true) // triggered after finalization
 
 			// block 4 will be the first block past the first epoch boundary
-			block4 := unittest.BlockWithParentFixture(block3.Header)
+			block4 := unittest.BlockWithParentProtocolState(block3)
 			block4.Header.View = epoch1FinalView + 1
 			err = state.Extend(context.Background(), block4)
 			require.NoError(t, err)
 			err = state.Finalize(context.Background(), block4.ID())
 			require.NoError(t, err)
 
-			// since EECC has been triggered, epoch transition metrics should not be updated
+			// since EFM has been triggered, epoch transition metrics should not be updated
 			metricsMock.AssertNotCalled(t, "EpochTransition", epoch2Setup.Counter, mock.Anything)
 			metricsMock.AssertNotCalled(t, "CurrentEpochCounter", epoch2Setup.Counter)
 		})
@@ -1816,22 +1892,23 @@ func TestEmergencyEpochFallback(t *testing.T) {
 
 	// if an invalid epoch service event is incorporated, we should:
 	//   - not apply the phase transition corresponding to the invalid service event
-	//   - immediately trigger EECC
+	//   - immediately trigger EFM
 	//
 	//                            Epoch Boundary
 	//                                 |
 	//                                 v
 	// ROOT <- B1 <- B2(R1) <- B3(S1) <- B4
-	t.Run("epoch transition with invalid service event - should trigger EECC", func(t *testing.T) {
+	t.Run("epoch transition with invalid service event - should trigger EFM", func(t *testing.T) {
 
 		rootSnapshot := unittest.RootSnapshotFixture(participants)
+		rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 		metricsMock := mockmodule.NewComplianceMetrics(t)
 		mockMetricsForRootSnapshot(metricsMock, rootSnapshot)
 		protoEventsMock := mockprotocol.NewConsumer(t)
 		protoEventsMock.On("BlockFinalized", mock.Anything)
 		protoEventsMock.On("BlockProcessable", mock.Anything, mock.Anything)
 
-		util.RunWithFullProtocolStateAndMetricsAndConsumer(t, rootSnapshot, metricsMock, protoEventsMock, func(db *badger.DB, state *protocol.ParticipantState) {
+		util.RunWithFullProtocolStateAndMetricsAndConsumer(t, rootSnapshot, metricsMock, protoEventsMock, func(db *badger.DB, state *protocol.ParticipantState, mutableState realprotocol.MutableProtocolState) {
 			head, err := rootSnapshot.Head()
 			require.NoError(t, err)
 			result, _, err := rootSnapshot.SealedResult()
@@ -1839,7 +1916,7 @@ func TestEmergencyEpochFallback(t *testing.T) {
 
 			// add a block for the first seal to reference
 			block1 := unittest.BlockWithParentFixture(head)
-			block1.SetPayload(flow.EmptyPayload())
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			err = state.Extend(context.Background(), block1)
 			require.NoError(t, err)
 			err = state.Finalize(context.Background(), block1.ID())
@@ -1850,7 +1927,7 @@ func TestEmergencyEpochFallback(t *testing.T) {
 
 			// add a participant for the next epoch
 			epoch2NewParticipant := unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification))
-			epoch2Participants := append(participants, epoch2NewParticipant).Sort(flow.Canonical)
+			epoch2Participants := append(participants, epoch2NewParticipant).Sort(flow.Canonical[flow.Identity]).ToSkeleton()
 
 			// create the epoch setup event for the second epoch
 			// this event is invalid because it used a non-contiguous first view
@@ -1867,7 +1944,10 @@ func TestEmergencyEpochFallback(t *testing.T) {
 
 			// add a block containing a receipt for block 1
 			block2 := unittest.BlockWithParentFixture(block1.Header)
-			block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1)))
+			block2.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receipt1),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			err = state.Extend(context.Background(), block2)
 			require.NoError(t, err)
 			err = state.Finalize(context.Background(), block2.ID())
@@ -1875,13 +1955,15 @@ func TestEmergencyEpochFallback(t *testing.T) {
 
 			// block 3 is where the service event state change comes into effect
 			block3 := unittest.BlockWithParentFixture(block2.Header)
+			seals := []*flow.Seal{seal1}
 			block3.SetPayload(flow.Payload{
-				Seals: []*flow.Seal{seal1},
+				Seals:           seals,
+				ProtocolStateID: calculateExpectedStateId(t, mutableState)(block3.Header, seals),
 			})
 			err = state.Extend(context.Background(), block3)
 			require.NoError(t, err)
 
-			// incorporating the service event should trigger EECC
+			// incorporating the service event should trigger EFM
 			metricsMock.On("EpochEmergencyFallbackTriggered").Once()
 			protoEventsMock.On("EpochEmergencyFallbackTriggered").Once()
 
@@ -1891,14 +1973,14 @@ func TestEmergencyEpochFallback(t *testing.T) {
 			assertEpochEmergencyFallbackTriggered(t, state, true) // triggered after finalization
 
 			// block 5 is the first block past the current epoch boundary
-			block4 := unittest.BlockWithParentFixture(block3.Header)
+			block4 := unittest.BlockWithParentProtocolState(block3)
 			block4.Header.View = epoch1Setup.FinalView + 1
 			err = state.Extend(context.Background(), block4)
 			require.NoError(t, err)
 			err = state.Finalize(context.Background(), block4.ID())
 			require.NoError(t, err)
 
-			// since EECC has been triggered, epoch transition metrics should not be updated
+			// since EFM has been triggered, epoch transition metrics should not be updated
 			metricsMock.AssertNotCalled(t, "EpochTransition", epoch2Setup.Counter, mock.Anything)
 			metricsMock.AssertNotCalled(t, "CurrentEpochCounter", epoch2Setup.Counter)
 		})
@@ -1919,6 +2001,7 @@ func TestExtendInvalidSealsInBlock(t *testing.T) {
 		consumer.On("BlockProcessable", mock.Anything, mock.Anything)
 
 		rootSnapshot := unittest.RootSnapshotFixture(participants)
+		rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 
 		state, err := protocol.Bootstrap(
 			metrics,
@@ -1930,7 +2013,7 @@ func TestExtendInvalidSealsInBlock(t *testing.T) {
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
@@ -1940,17 +2023,20 @@ func TestExtendInvalidSealsInBlock(t *testing.T) {
 		require.NoError(t, err)
 
 		block1 := unittest.BlockWithParentFixture(head)
-		block1.Payload.Guarantees = nil
-		block1.Header.PayloadHash = block1.Payload.Hash()
+		block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 
 		block1Receipt := unittest.ReceiptForBlockFixture(block1)
 		block2 := unittest.BlockWithParentFixture(block1.Header)
-		block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(block1Receipt)))
+		block2.SetPayload(unittest.PayloadFixture(
+			unittest.WithReceipts(block1Receipt),
+			unittest.WithProtocolStateID(rootProtocolStateID),
+		))
 
 		block1Seal := unittest.Seal.Fixture(unittest.Seal.WithResult(&block1Receipt.ExecutionResult))
 		block3 := unittest.BlockWithParentFixture(block2.Header)
 		block3.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{block1Seal},
+			Seals:           []*flow.Seal{block1Seal},
+			ProtocolStateID: rootProtocolStateID,
 		})
 
 		sealValidator := mockmodule.NewSealValidator(t)
@@ -1995,6 +2081,7 @@ func TestExtendInvalidSealsInBlock(t *testing.T) {
 
 func TestHeaderExtendValid(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.FollowerState) {
 		head, err := rootSnapshot.Head()
 		require.NoError(t, err)
@@ -2002,7 +2089,7 @@ func TestHeaderExtendValid(t *testing.T) {
 		require.NoError(t, err)
 
 		extend := unittest.BlockWithParentFixture(head)
-		extend.SetPayload(flow.EmptyPayload())
+		extend.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 
 		err = state.ExtendCertified(context.Background(), extend, unittest.CertifyBlock(extend.Header))
 		require.NoError(t, err)
@@ -2038,11 +2125,13 @@ func TestHeaderExtendMissingParent(t *testing.T) {
 
 func TestHeaderExtendHeightTooSmall(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.FollowerState) {
 		head, err := rootSnapshot.Head()
 		require.NoError(t, err)
 
 		block1 := unittest.BlockWithParentFixture(head)
+		block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 
 		// create another block that points to the previous block `extend` as parent
 		// but has _same_ height as parent. This violates the condition that a child's
@@ -2086,11 +2175,13 @@ func TestExtendBlockProcessable(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
 	head, err := rootSnapshot.Head()
 	require.NoError(t, err)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	consumer := mockprotocol.NewConsumer(t)
 	util.RunWithFullProtocolStateAndConsumer(t, rootSnapshot, consumer, func(db *badger.DB, state *protocol.ParticipantState) {
 		block := unittest.BlockWithParentFixture(head)
-		child := unittest.BlockWithParentFixture(block.Header)
-		grandChild := unittest.BlockWithParentFixture(child.Header)
+		block.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
+		child := unittest.BlockWithParentProtocolState(block)
+		grandChild := unittest.BlockWithParentProtocolState(child)
 
 		// extend block using certifying QC, expect that BlockProcessable will be emitted once
 		consumer.On("BlockProcessable", block.Header, child.Header.QuorumCertificate()).Once()
@@ -2119,11 +2210,13 @@ func TestExtendBlockProcessable(t *testing.T) {
 // The Follower should accept this block since tracking of orphan blocks is implemented by another component.
 func TestFollowerHeaderExtendBlockNotConnected(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.FollowerState) {
 		head, err := rootSnapshot.Head()
 		require.NoError(t, err)
 
 		block1 := unittest.BlockWithParentFixture(head)
+		block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.ExtendCertified(context.Background(), block1, unittest.CertifyBlock(block1.Header))
 		require.NoError(t, err)
 
@@ -2132,6 +2225,7 @@ func TestFollowerHeaderExtendBlockNotConnected(t *testing.T) {
 
 		// create a fork at view/height 1 and try to connect it to root
 		block2 := unittest.BlockWithParentFixture(head)
+		block2.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.ExtendCertified(context.Background(), block2, unittest.CertifyBlock(block2.Header))
 		require.NoError(t, err)
 
@@ -2149,11 +2243,13 @@ func TestFollowerHeaderExtendBlockNotConnected(t *testing.T) {
 // The Participant should reject this block as an outdated chain extension
 func TestParticipantHeaderExtendBlockNotConnected(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
 		head, err := rootSnapshot.Head()
 		require.NoError(t, err)
 
 		block1 := unittest.BlockWithParentFixture(head)
+		block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), block1)
 		require.NoError(t, err)
 
@@ -2162,6 +2258,7 @@ func TestParticipantHeaderExtendBlockNotConnected(t *testing.T) {
 
 		// create a fork at view/height 1 and try to connect it to root
 		block2 := unittest.BlockWithParentFixture(head)
+		block2.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		err = state.Extend(context.Background(), block2)
 		require.True(t, st.IsOutdatedExtensionError(err), err)
 
@@ -2176,13 +2273,13 @@ func TestHeaderExtendHighestSeal(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
 	head, err := rootSnapshot.Head()
 	require.NoError(t, err)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.FollowerState) {
 		// create block2 and block3
 		block2 := unittest.BlockWithParentFixture(head)
-		block2.SetPayload(flow.EmptyPayload())
+		block2.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 
-		block3 := unittest.BlockWithParentFixture(block2.Header)
-		block3.SetPayload(flow.EmptyPayload())
+		block3 := unittest.BlockWithParentProtocolState(block2)
 
 		err := state.ExtendCertified(context.Background(), block2, block3.Header.QuorumCertificate())
 		require.NoError(t, err)
@@ -2194,13 +2291,19 @@ func TestHeaderExtendHighestSeal(t *testing.T) {
 		// include the seals in block4
 		block4 := unittest.BlockWithParentFixture(block3.Header)
 		// include receipts and results
-		block4.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt3, receipt2)))
+		block4.SetPayload(unittest.PayloadFixture(
+			unittest.WithReceipts(receipt3, receipt2),
+			unittest.WithProtocolStateID(rootProtocolStateID),
+		))
 
 		// include the seals in block4
 		block5 := unittest.BlockWithParentFixture(block4.Header)
 		// placing seals in the reversed order to test
 		// Extend will pick the highest sealed block
-		block5.SetPayload(unittest.PayloadFixture(unittest.WithSeals(seal3, seal2)))
+		block5.SetPayload(unittest.PayloadFixture(
+			unittest.WithSeals(seal3, seal2),
+			unittest.WithProtocolStateID(rootProtocolStateID),
+		))
 
 		err = state.ExtendCertified(context.Background(), block3, block4.Header.QuorumCertificate())
 		require.NoError(t, err)
@@ -2248,6 +2351,7 @@ func TestExtendCertifiedInvalidQC(t *testing.T) {
 // guarantees with invalid guarantors
 func TestExtendInvalidGuarantee(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
 		// create a valid block
 		head, err := rootSnapshot.Head()
@@ -2262,13 +2366,15 @@ func TestExtendInvalidGuarantee(t *testing.T) {
 		require.NoError(t, err)
 
 		block := unittest.BlockWithParentFixture(head)
-		payload := flow.EmptyPayload()
-		payload.Guarantees = []*flow.CollectionGuarantee{
-			{
-				ChainID:          cluster.ChainID(),
-				ReferenceBlockID: head.ID(),
-				SignerIndices:    validSignerIndices,
+		payload := flow.Payload{
+			Guarantees: []*flow.CollectionGuarantee{
+				{
+					ChainID:          cluster.ChainID(),
+					ReferenceBlockID: head.ID(),
+					SignerIndices:    validSignerIndices,
+				},
 			},
+			ProtocolStateID: rootProtocolStateID,
 		}
 
 		// now the valid block has a guarantee in the payload with valid signer indices.
@@ -2353,18 +2459,22 @@ func TestExtendInvalidGuarantee(t *testing.T) {
 // If block B is finalized and contains a seal for block A, then A is the last sealed block
 func TestSealed(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.FollowerState) {
 		head, err := rootSnapshot.Head()
 		require.NoError(t, err)
 
 		// block 1 will be sealed
 		block1 := unittest.BlockWithParentFixture(head)
-
+		block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		receipt1, seal1 := unittest.ReceiptAndSealForBlock(block1)
 
 		// block 2 contains receipt for block 1
 		block2 := unittest.BlockWithParentFixture(block1.Header)
-		block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1)))
+		block2.SetPayload(unittest.PayloadFixture(
+			unittest.WithReceipts(receipt1),
+			unittest.WithProtocolStateID(rootProtocolStateID),
+		))
 
 		err = state.ExtendCertified(context.Background(), block1, block2.Header.QuorumCertificate())
 		require.NoError(t, err)
@@ -2374,7 +2484,8 @@ func TestSealed(t *testing.T) {
 		// block 3 contains seal for block 1
 		block3 := unittest.BlockWithParentFixture(block2.Header)
 		block3.SetPayload(flow.Payload{
-			Seals: []*flow.Seal{seal1},
+			Seals:           []*flow.Seal{seal1},
+			ProtocolStateID: rootProtocolStateID,
 		})
 
 		err = state.ExtendCertified(context.Background(), block2, block3.Header.QuorumCertificate())
@@ -2399,12 +2510,14 @@ func TestSealed(t *testing.T) {
 // A non atomic bug would be: header is found in DB, but payload index is not found
 func TestCacheAtomicity(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	util.RunWithFollowerProtocolStateAndHeaders(t, rootSnapshot,
 		func(db *badger.DB, state *protocol.FollowerState, headers storage.Headers, index storage.Index) {
 			head, err := rootSnapshot.Head()
 			require.NoError(t, err)
 
 			block := unittest.BlockWithParentFixture(head)
+			block.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			blockID := block.ID()
 
 			// check 100 times to see if either 1) or 2) satisfies
@@ -2460,7 +2573,7 @@ func TestHeaderInvalidTimestamp(t *testing.T) {
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
@@ -2496,11 +2609,13 @@ func TestHeaderInvalidTimestamp(t *testing.T) {
 // where second extend doesn't result in an error and effectively is no-op.
 func TestProtocolStateIdempotent(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	head, err := rootSnapshot.Head()
 	require.NoError(t, err)
 	t.Run("follower", func(t *testing.T) {
 		util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.FollowerState) {
 			block := unittest.BlockWithParentFixture(head)
+			block.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			err := state.ExtendCertified(context.Background(), block, unittest.CertifyBlock(block.Header))
 			require.NoError(t, err)
 
@@ -2512,6 +2627,7 @@ func TestProtocolStateIdempotent(t *testing.T) {
 	t.Run("participant", func(t *testing.T) {
 		util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *protocol.ParticipantState) {
 			block := unittest.BlockWithParentFixture(head)
+			block.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			err := state.Extend(context.Background(), block)
 			require.NoError(t, err)
 
@@ -2535,9 +2651,9 @@ func assertEpochEmergencyFallbackTriggered(t *testing.T, state realprotocol.Stat
 // metrics which are set during bootstrapping and building blocks.
 func mockMetricsForRootSnapshot(metricsMock *mockmodule.ComplianceMetrics, rootSnapshot *inmem.Snapshot) {
 	metricsMock.On("CurrentEpochCounter", rootSnapshot.Encodable().Epochs.Current.Counter)
-	metricsMock.On("CurrentEpochPhase", rootSnapshot.Encodable().Phase)
+	phase, _ := rootSnapshot.Phase()
+	metricsMock.On("CurrentEpochPhase", phase)
 	metricsMock.On("CurrentEpochFinalView", rootSnapshot.Encodable().Epochs.Current.FinalView)
-	metricsMock.On("CommittedEpochFinalView", rootSnapshot.Encodable().Epochs.Current.FinalView)
 	metricsMock.On("CurrentDKGPhase1FinalView", rootSnapshot.Encodable().Epochs.Current.DKGPhase1FinalView)
 	metricsMock.On("CurrentDKGPhase2FinalView", rootSnapshot.Encodable().Epochs.Current.DKGPhase2FinalView)
 	metricsMock.On("CurrentDKGPhase3FinalView", rootSnapshot.Encodable().Epochs.Current.DKGPhase3FinalView)
@@ -2546,3 +2662,24 @@ func mockMetricsForRootSnapshot(metricsMock *mockmodule.ComplianceMetrics, rootS
 	metricsMock.On("FinalizedHeight", mock.Anything)
 	metricsMock.On("SealedHeight", mock.Anything)
 }
+
+func getRootProtocolStateID(t *testing.T, rootSnapshot *inmem.Snapshot) flow.Identifier {
+	rootProtocolState, err := rootSnapshot.ProtocolState()
+	require.NoError(t, err)
+	return rootProtocolState.Entry().ID()
+}
+
+// calculateExpectedStateId is a utility function which makes easier to get expected protocol state ID after applying service events contained in seals.
+func calculateExpectedStateId(t *testing.T, mutableProtocolState realprotocol.MutableProtocolState) func(header *flow.Header, seals []*flow.Seal) flow.Identifier {
+	return func(header *flow.Header, seals []*flow.Seal) flow.Identifier {
+		stateMutator, err := mutableProtocolState.Mutator(header.View, header.ParentID)
+		require.NoError(t, err)
+
+		err = stateMutator.ApplyServiceEventsFromValidatedSeals(seals)
+		require.NoError(t, err)
+
+		_, _, expectedStateID, _ := stateMutator.Build()
+		require.NoError(t, err)
+		return expectedStateID
+	}
+}
diff --git a/state/protocol/badger/params.go b/state/protocol/badger/params.go
index 52a447f7351..888aa538b16 100644
--- a/state/protocol/badger/params.go
+++ b/state/protocol/badger/params.go
@@ -3,129 +3,200 @@ package badger
 import (
 	"fmt"
 
+	"github.com/dgraph-io/badger/v2"
+
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/state/protocol/inmem"
+	"github.com/onflow/flow-go/storage"
 	"github.com/onflow/flow-go/storage/badger/operation"
 )
 
 type Params struct {
-	state *State
+	protocol.GlobalParams
+	protocol.InstanceParams
 }
 
 var _ protocol.Params = (*Params)(nil)
 
-func (p Params) ChainID() (flow.ChainID, error) {
-
-	// retrieve root header
-	root, err := p.FinalizedRoot()
-	if err != nil {
-		return "", fmt.Errorf("could not get root: %w", err)
-	}
-
-	return root.ChainID, nil
+// InstanceParams implements the interface protocol.InstanceParams. All functions
+// are served on demand directly from the database, _without_ any caching.
+type InstanceParams struct {
+	db *badger.DB
+	// finalizedRoot marks the cutoff of the history this node knows about. It is the block at the tip
+	// of the root snapshot used to bootstrap this node - all newer blocks are synced from the network.
+	finalizedRoot *flow.Header
+	// sealedRoot is the latest sealed block with respect to `finalizedRoot`.
+	sealedRoot *flow.Header
+	// rootSeal is the seal for block `sealedRoot` - the newest incorporated seal with respect to `finalizedRoot`.
+	rootSeal *flow.Seal
 }
 
-func (p Params) SporkID() (flow.Identifier, error) {
+var _ protocol.InstanceParams = (*InstanceParams)(nil)
 
-	var sporkID flow.Identifier
-	err := p.state.db.View(operation.RetrieveSporkID(&sporkID))
-	if err != nil {
-		return flow.ZeroID, fmt.Errorf("could not get spork id: %w", err)
+// ReadInstanceParams reads the instance parameters from the database and returns them as in-memory representation.
+// No errors are expected during normal operation.
+func ReadInstanceParams(db *badger.DB, headers storage.Headers, seals storage.Seals) (*InstanceParams, error) {
+	params := &InstanceParams{
+		db: db,
 	}
 
-	return sporkID, nil
-}
-
-func (p Params) SporkRootBlockHeight() (uint64, error) {
-	var sporkRootBlockHeight uint64
-	err := p.state.db.View(operation.RetrieveSporkRootBlockHeight(&sporkRootBlockHeight))
+	// in next section we will read data from the database and cache them,
+	// as they are immutable for the runtime of the node.
+	err := db.View(func(txn *badger.Txn) error {
+		var (
+			finalizedRootHeight uint64
+			sealedRootHeight    uint64
+		)
+
+		// root height
+		err := db.View(operation.RetrieveRootHeight(&finalizedRootHeight))
+		if err != nil {
+			return fmt.Errorf("could not read root block to populate cache: %w", err)
+		}
+		// sealed root height
+		err = db.View(operation.RetrieveSealedRootHeight(&sealedRootHeight))
+		if err != nil {
+			return fmt.Errorf("could not read sealed root block to populate cache: %w", err)
+		}
+
+		// look up 'finalized root block'
+		var finalizedRootID flow.Identifier
+		err = db.View(operation.LookupBlockHeight(finalizedRootHeight, &finalizedRootID))
+		if err != nil {
+			return fmt.Errorf("could not look up finalized root height: %w", err)
+		}
+		params.finalizedRoot, err = headers.ByBlockID(finalizedRootID)
+		if err != nil {
+			return fmt.Errorf("could not retrieve finalized root header: %w", err)
+		}
+
+		// look up the sealed block as of the 'finalized root block'
+		var sealedRootID flow.Identifier
+		err = db.View(operation.LookupBlockHeight(sealedRootHeight, &sealedRootID))
+		if err != nil {
+			return fmt.Errorf("could not look up sealed root height: %w", err)
+		}
+		params.sealedRoot, err = headers.ByBlockID(sealedRootID)
+		if err != nil {
+			return fmt.Errorf("could not retrieve sealed root header: %w", err)
+		}
+
+		// retrieve the root seal
+		params.rootSeal, err = seals.HighestInFork(finalizedRootID)
+		if err != nil {
+			return fmt.Errorf("could not retrieve root seal: %w", err)
+		}
+
+		return nil
+	})
 	if err != nil {
-		return 0, fmt.Errorf("could not get spork root block height: %w", err)
+		return nil, fmt.Errorf("could not read InstanceParams data to populate cache: %w", err)
 	}
 
-	return sporkRootBlockHeight, nil
+	return params, nil
 }
 
-func (p Params) ProtocolVersion() (uint, error) {
-
-	var version uint
-	err := p.state.db.View(operation.RetrieveProtocolVersion(&version))
+// EpochFallbackTriggered returns whether epoch fallback mode [EFM] has been triggered.
+// EFM is a permanent, spork-scoped state which is triggered when the next
+// epoch fails to be committed in the allocated time. Once EFM is triggered,
+// it will remain in effect until the next spork.
+// TODO for 'leaving Epoch Fallback via special service event'
+// No errors are expected during normal operation.
+func (p *InstanceParams) EpochFallbackTriggered() (bool, error) {
+	var triggered bool
+	err := p.db.View(operation.CheckEpochEmergencyFallbackTriggered(&triggered))
 	if err != nil {
-		return 0, fmt.Errorf("could not get protocol version: %w", err)
+		return false, fmt.Errorf("could not check epoch fallback triggered: %w", err)
 	}
+	return triggered, nil
+}
 
-	return version, nil
+// FinalizedRoot returns the finalized root header of the current protocol state. This will be
+// the head of the protocol state snapshot used to bootstrap this state and
+// may differ from node to node for the same protocol state.
+func (p *InstanceParams) FinalizedRoot() *flow.Header {
+	return p.finalizedRoot
 }
 
-func (p Params) EpochCommitSafetyThreshold() (uint64, error) {
+// SealedRoot returns the sealed root block. If it's different from FinalizedRoot() block,
+// it means the node is bootstrapped from mid-spork.
+func (p *InstanceParams) SealedRoot() *flow.Header {
+	return p.sealedRoot
+}
 
-	var threshold uint64
-	err := p.state.db.View(operation.RetrieveEpochCommitSafetyThreshold(&threshold))
-	if err != nil {
-		return 0, fmt.Errorf("could not get epoch commit safety threshold")
-	}
-	return threshold, nil
+// Seal returns the root block seal of the current protocol state. This is the seal for the
+// `SealedRoot` block that was used to bootstrap this state. It may differ from node to node.
+func (p *InstanceParams) Seal() *flow.Seal {
+	return p.rootSeal
 }
 
-func (p Params) EpochFallbackTriggered() (bool, error) {
-	var triggered bool
-	err := p.state.db.View(operation.CheckEpochEmergencyFallbackTriggered(&triggered))
+// ReadGlobalParams reads the global parameters from the database and returns them as in-memory representation.
+// No errors are expected during normal operation.
+func ReadGlobalParams(db *badger.DB) (*inmem.Params, error) {
+	var sporkID flow.Identifier
+	err := db.View(operation.RetrieveSporkID(&sporkID))
 	if err != nil {
-		return false, fmt.Errorf("could not check epoch fallback triggered: %w", err)
+		return nil, fmt.Errorf("could not get spork id: %w", err)
 	}
-	return triggered, nil
-}
 
-func (p Params) FinalizedRoot() (*flow.Header, error) {
-
-	// look up root block ID
-	var rootID flow.Identifier
-	err := p.state.db.View(operation.LookupBlockHeight(p.state.finalizedRootHeight, &rootID))
+	var sporkRootBlockHeight uint64
+	err = db.View(operation.RetrieveSporkRootBlockHeight(&sporkRootBlockHeight))
 	if err != nil {
-		return nil, fmt.Errorf("could not look up root header: %w", err)
+		return nil, fmt.Errorf("could not get spork root block height: %w", err)
 	}
 
-	// retrieve root header
-	header, err := p.state.headers.ByBlockID(rootID)
+	var threshold uint64
+	err = db.View(operation.RetrieveEpochCommitSafetyThreshold(&threshold))
 	if err != nil {
-		return nil, fmt.Errorf("could not retrieve root header: %w", err)
+		return nil, fmt.Errorf("could not get epoch commit safety threshold")
 	}
 
-	return header, nil
-}
-
-func (p Params) SealedRoot() (*flow.Header, error) {
-	// look up root block ID
-	var rootID flow.Identifier
-	err := p.state.db.View(operation.LookupBlockHeight(p.state.sealedRootHeight, &rootID))
-
+	var version uint
+	err = db.View(operation.RetrieveProtocolVersion(&version))
 	if err != nil {
-		return nil, fmt.Errorf("could not look up root header: %w", err)
+		return nil, fmt.Errorf("could not get protocol version: %w", err)
 	}
 
-	// retrieve root header
-	header, err := p.state.headers.ByBlockID(rootID)
+	root, err := ReadFinalizedRoot(db) // retrieve root header
 	if err != nil {
-		return nil, fmt.Errorf("could not retrieve root header: %w", err)
+		return nil, fmt.Errorf("could not get root: %w", err)
 	}
 
-	return header, nil
+	return inmem.NewParams(
+		inmem.EncodableParams{
+			ChainID:                    root.ChainID,
+			SporkID:                    sporkID,
+			SporkRootBlockHeight:       sporkRootBlockHeight,
+			ProtocolVersion:            version,
+			EpochCommitSafetyThreshold: threshold,
+		},
+	), nil
 }
 
-func (p Params) Seal() (*flow.Seal, error) {
-
-	// look up root header
+// ReadFinalizedRoot retrieves the root block's header from the database.
+// This information is immutable for the runtime of the software and may be cached.
+func ReadFinalizedRoot(db *badger.DB) (*flow.Header, error) {
+	var finalizedRootHeight uint64
 	var rootID flow.Identifier
-	err := p.state.db.View(operation.LookupBlockHeight(p.state.finalizedRootHeight, &rootID))
+	var rootHeader flow.Header
+	err := db.View(func(tx *badger.Txn) error {
+		err := operation.RetrieveRootHeight(&finalizedRootHeight)(tx)
+		if err != nil {
+			return fmt.Errorf("could not retrieve finalized root height: %w", err)
+		}
+		err = operation.LookupBlockHeight(finalizedRootHeight, &rootID)(tx) // look up root block ID
+		if err != nil {
+			return fmt.Errorf("could not retrieve root header's ID by height: %w", err)
+		}
+		err = operation.RetrieveHeader(rootID, &rootHeader)(tx) // retrieve root header
+		if err != nil {
+			return fmt.Errorf("could not retrieve root header: %w", err)
+		}
+		return nil
+	})
 	if err != nil {
-		return nil, fmt.Errorf("could not look up root header: %w", err)
+		return nil, fmt.Errorf("failed to read root information from database: %w", err)
 	}
-
-	// retrieve the root seal
-	seal, err := p.state.seals.HighestInFork(rootID)
-	if err != nil {
-		return nil, fmt.Errorf("could not retrieve root seal: %w", err)
-	}
-
-	return seal, nil
+	return &rootHeader, nil
 }
diff --git a/state/protocol/badger/snapshot.go b/state/protocol/badger/snapshot.go
index 90cdebc6db9..9d62a7474a9 100644
--- a/state/protocol/badger/snapshot.go
+++ b/state/protocol/badger/snapshot.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package badger
 
 import (
@@ -11,7 +9,6 @@ import (
 	"github.com/onflow/flow-go/consensus/hotstuff/model"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/flow/filter"
-	"github.com/onflow/flow-go/model/flow/mapfunc"
 	"github.com/onflow/flow-go/state/fork"
 	"github.com/onflow/flow-go/state/protocol"
 	"github.com/onflow/flow-go/state/protocol/inmem"
@@ -84,102 +81,27 @@ func (s *Snapshot) QuorumCertificate() (*flow.QuorumCertificate, error) {
 }
 
 func (s *Snapshot) Phase() (flow.EpochPhase, error) {
-	status, err := s.state.epoch.statuses.ByBlockID(s.blockID)
+	psSnapshot, err := s.state.protocolState.AtBlockID(s.blockID)
 	if err != nil {
-		return flow.EpochPhaseUndefined, fmt.Errorf("could not retrieve epoch status: %w", err)
+		return flow.EpochPhaseUndefined, fmt.Errorf("could not retrieve protocol state snapshot: %w", err)
 	}
-	phase, err := status.Phase()
-	return phase, err
+	return psSnapshot.EpochPhase(), nil
 }
 
-func (s *Snapshot) Identities(selector flow.IdentityFilter) (flow.IdentityList, error) {
-
-	// TODO: CAUTION SHORTCUT
-	// we retrieve identities based on the initial identity table from the EpochSetup
-	// event here -- this will need revision to support mid-epoch identity changes
-	// once slashing is implemented
-
-	status, err := s.state.epoch.statuses.ByBlockID(s.blockID)
-	if err != nil {
-		return nil, err
-	}
-
-	setup, err := s.state.epoch.setups.ByID(status.CurrentEpoch.SetupID)
+func (s *Snapshot) Identities(selector flow.IdentityFilter[flow.Identity]) (flow.IdentityList, error) {
+	psSnapshot, err := s.state.protocolState.AtBlockID(s.blockID)
 	if err != nil {
 		return nil, err
 	}
 
-	// sort the identities so the 'IsCached' binary search works
-	identities := setup.Participants.Sort(flow.Canonical)
-
-	// get identities that are in either last/next epoch but NOT in the current epoch
-	var otherEpochIdentities flow.IdentityList
-	phase, err := status.Phase()
-	if err != nil {
-		return nil, fmt.Errorf("could not get phase: %w", err)
-	}
-	switch phase {
-	// during staking phase (the beginning of the epoch) we include identities
-	// from the previous epoch that are now un-staking
-	case flow.EpochPhaseStaking:
-
-		if !status.HasPrevious() {
-			break
-		}
-
-		previousSetup, err := s.state.epoch.setups.ByID(status.PreviousEpoch.SetupID)
-		if err != nil {
-			return nil, fmt.Errorf("could not get previous epoch setup event: %w", err)
-		}
-
-		for _, identity := range previousSetup.Participants {
-			exists := identities.Exists(identity)
-			// add identity from previous epoch that is not in current epoch
-			if !exists {
-				otherEpochIdentities = append(otherEpochIdentities, identity)
-			}
-		}
-
-	// during setup and committed phases (the end of the epoch) we include
-	// identities that will join in the next epoch
-	case flow.EpochPhaseSetup, flow.EpochPhaseCommitted:
-
-		nextSetup, err := s.state.epoch.setups.ByID(status.NextEpoch.SetupID)
-		if err != nil {
-			return nil, fmt.Errorf("could not get next epoch setup: %w", err)
-		}
-
-		for _, identity := range nextSetup.Participants {
-			exists := identities.Exists(identity)
-
-			// add identity from next epoch that is not in current epoch
-			if !exists {
-				otherEpochIdentities = append(otherEpochIdentities, identity)
-			}
-		}
-
-	default:
-		return nil, fmt.Errorf("invalid epoch phase: %s", phase)
-	}
-
-	// add the identities from next/last epoch, with weight set to 0
-	identities = append(
-		identities,
-		otherEpochIdentities.Map(mapfunc.WithWeight(0))...,
-	)
-
 	// apply the filter to the participants
-	identities = identities.Filter(selector)
-
-	// apply a deterministic sort to the participants
-	identities = identities.Sort(flow.Canonical)
-
+	identities := psSnapshot.Identities().Filter(selector)
 	return identities, nil
 }
 
 func (s *Snapshot) Identity(nodeID flow.Identifier) (*flow.Identity, error) {
 	// filter identities at snapshot for node ID
-	identities, err := s.Identities(filter.HasNodeID(nodeID))
+	identities, err := s.Identities(filter.HasNodeID[flow.Identity](nodeID))
 	if err != nil {
 		return nil, fmt.Errorf("could not get identities: %w", err)
 	}
@@ -231,7 +153,7 @@ func (s *Snapshot) SealingSegment() (*flow.SealingSegment, error) {
 	//       This is relevant if `head` does not contain any seals.
 	//  (ii) All blocks that are sealed by `head`. This is relevant if head` contains _multiple_ seals.
 	// (iii) The sealing segment should contain the history back to (including):
-	//       limitHeight := max(head.Height - flow.DefaultTransactionExpiry, SporkRootBlockHeight)
+	//       limitHeight := max(blockSealedAtHead.Height - flow.DefaultTransactionExpiry, SporkRootBlockHeight)
 	// Per convention, we include the blocks for (i) in the `SealingSegment.Blocks`, while the
 	// additional blocks for (ii) and optionally (iii) are contained in as `SealingSegment.ExtraBlocks`.
 	head, err := s.state.blocks.ByID(s.blockID)
@@ -299,10 +221,10 @@ func (s *Snapshot) SealingSegment() (*flow.SealingSegment, error) {
 	}
 
 	// STEP (iii): extended history to allow checking for duplicated collections, i.e.
-	// limitHeight = max(head.Height - flow.DefaultTransactionExpiry, SporkRootBlockHeight)
+	// limitHeight = max(blockSealedAtHead.Height - flow.DefaultTransactionExpiry, SporkRootBlockHeight)
 	limitHeight := s.state.sporkRootBlockHeight
-	if head.Header.Height > s.state.sporkRootBlockHeight+flow.DefaultTransactionExpiry {
-		limitHeight = head.Header.Height - flow.DefaultTransactionExpiry
+	if blockSealedAtHead.Height > s.state.sporkRootBlockHeight+flow.DefaultTransactionExpiry {
+		limitHeight = blockSealedAtHead.Height - flow.DefaultTransactionExpiry
 	}
 
 	// As we have to satisfy (ii) _and_ (iii), we have to take the longest history, i.e. the lowest height.
@@ -401,6 +323,13 @@ func (s *Snapshot) Params() protocol.GlobalParams {
 	return s.state.Params()
 }
 
+// ProtocolState returns the dynamic protocol state that the Head block commits to. The
+// compliance layer guarantees that only valid blocks are appended to the protocol state.
+// For each block stored there should be a protocol state stored.
+func (s *Snapshot) ProtocolState() (protocol.DynamicProtocolState, error) {
+	return s.state.protocolState.AtBlockID(s.blockID)
+}
+
 func (s *Snapshot) VersionBeacon() (*flow.SealedVersionBeacon, error) {
 	head, err := s.state.headers.ByBlockID(s.blockID)
 	if err != nil {
@@ -419,19 +348,13 @@ type EpochQuery struct {
 func (q *EpochQuery) Current() protocol.Epoch {
 	// all errors returned from storage reads here are unexpected, because all
 	// snapshots reside within a current epoch, which must be queryable
-	status, err := q.snap.state.epoch.statuses.ByBlockID(q.snap.blockID)
-	if err != nil {
-		return invalid.NewEpochf("could not get epoch status for block %x: %w", q.snap.blockID, err)
-	}
-	setup, err := q.snap.state.epoch.setups.ByID(status.CurrentEpoch.SetupID)
-	if err != nil {
-		return invalid.NewEpochf("could not get current EpochSetup (id=%x) for block %x: %w", status.CurrentEpoch.SetupID, q.snap.blockID, err)
-	}
-	commit, err := q.snap.state.epoch.commits.ByID(status.CurrentEpoch.CommitID)
+	psSnapshot, err := q.snap.state.protocolState.AtBlockID(q.snap.blockID)
 	if err != nil {
-		return invalid.NewEpochf("could not get current EpochCommit (id=%x) for block %x: %w", status.CurrentEpoch.CommitID, q.snap.blockID, err)
+		return invalid.NewEpochf("could not get protocol state snapshot at block %x: %w", q.snap.blockID, err)
 	}
 
+	setup := psSnapshot.EpochSetup()
+	commit := psSnapshot.EpochCommit()
 	firstHeight, _, epochStarted, _, err := q.retrieveEpochHeightBounds(setup.Counter)
 	if err != nil {
 		return invalid.NewEpochf("could not get current epoch height bounds: %s", err.Error())
@@ -445,37 +368,28 @@ func (q *EpochQuery) Current() protocol.Epoch {
 // Next returns the next epoch, if it is available.
 func (q *EpochQuery) Next() protocol.Epoch {
 
-	status, err := q.snap.state.epoch.statuses.ByBlockID(q.snap.blockID)
+	psSnapshot, err := q.snap.state.protocolState.AtBlockID(q.snap.blockID)
 	if err != nil {
-		return invalid.NewEpochf("could not get epoch status for block %x: %w", q.snap.blockID, err)
-	}
-	phase, err := status.Phase()
-	if err != nil {
-		// critical error: malformed EpochStatus in storage
-		return invalid.NewEpochf("read malformed EpochStatus from storage: %w", err)
+		return invalid.NewEpochf("could not get protocol state snapshot at block %x: %w", q.snap.blockID, err)
 	}
+	phase := psSnapshot.EpochPhase()
+	entry := psSnapshot.Entry()
+
 	// if we are in the staking phase, the next epoch is not setup yet
 	if phase == flow.EpochPhaseStaking {
 		return invalid.NewEpoch(protocol.ErrNextEpochNotSetup)
 	}
-
 	// if we are in setup phase, return a SetupEpoch
-	nextSetup, err := q.snap.state.epoch.setups.ByID(status.NextEpoch.SetupID)
-	if err != nil {
-		// all errors are critical, because we must be able to retrieve EpochSetup when in setup phase
-		return invalid.NewEpochf("could not get next EpochSetup (id=%x) for block %x: %w", status.NextEpoch.SetupID, q.snap.blockID, err)
-	}
+	nextSetup := entry.NextEpochSetup
 	if phase == flow.EpochPhaseSetup {
 		return inmem.NewSetupEpoch(nextSetup)
 	}
-
 	// if we are in committed phase, return a CommittedEpoch
-	nextCommit, err := q.snap.state.epoch.commits.ByID(status.NextEpoch.CommitID)
-	if err != nil {
-		// all errors are critical, because we must be able to retrieve EpochCommit when in committed phase
-		return invalid.NewEpochf("could not get next EpochCommit (id=%x) for block %x: %w", status.NextEpoch.CommitID, q.snap.blockID, err)
+	nextCommit := entry.NextEpochCommit
+	if phase == flow.EpochPhaseCommitted {
+		return inmem.NewCommittedEpoch(nextSetup, nextCommit)
 	}
-	return inmem.NewCommittedEpoch(nextSetup, nextCommit)
+	return invalid.NewEpochf("data corruption: unknown epoch phase implies malformed protocol state epoch data")
 }
 
 // Previous returns the previous epoch. During the first epoch after the root
@@ -483,29 +397,22 @@ func (q *EpochQuery) Next() protocol.Epoch {
 // For all other epochs, returns the previous epoch.
 func (q *EpochQuery) Previous() protocol.Epoch {
 
-	status, err := q.snap.state.epoch.statuses.ByBlockID(q.snap.blockID)
+	psSnapshot, err := q.snap.state.protocolState.AtBlockID(q.snap.blockID)
 	if err != nil {
-		return invalid.NewEpochf("could not get epoch status for block %x: %w", q.snap.blockID, err)
+		return invalid.NewEpochf("could not get protocol state snapshot at block %x: %w", q.snap.blockID, err)
 	}
+	entry := psSnapshot.Entry()
 
 	// CASE 1: there is no previous epoch - this indicates we are in the first
 	// epoch after a spork root or genesis block
-	if !status.HasPrevious() {
+	if !psSnapshot.PreviousEpochExists() {
 		return invalid.NewEpoch(protocol.ErrNoPreviousEpoch)
 	}
 
 	// CASE 2: we are in any other epoch - retrieve the setup and commit events
 	// for the previous epoch
-	setup, err := q.snap.state.epoch.setups.ByID(status.PreviousEpoch.SetupID)
-	if err != nil {
-		// all errors are critical, because we must be able to retrieve EpochSetup for previous epoch
-		return invalid.NewEpochf("could not get previous EpochSetup (id=%x) for block %x: %w", status.PreviousEpoch.SetupID, q.snap.blockID, err)
-	}
-	commit, err := q.snap.state.epoch.commits.ByID(status.PreviousEpoch.CommitID)
-	if err != nil {
-		// all errors are critical, because we must be able to retrieve EpochCommit for previous epoch
-		return invalid.NewEpochf("could not get current EpochCommit (id=%x) for block %x: %w", status.PreviousEpoch.CommitID, q.snap.blockID, err)
-	}
+	setup := entry.PreviousEpochSetup
+	commit := entry.PreviousEpochCommit
 
 	firstHeight, finalHeight, _, epochEnded, err := q.retrieveEpochHeightBounds(setup.Counter)
 	if err != nil {
diff --git a/state/protocol/badger/snapshot_test.go b/state/protocol/badger/snapshot_test.go
index 54f1522b2b8..ab70a4efa00 100644
--- a/state/protocol/badger/snapshot_test.go
+++ b/state/protocol/badger/snapshot_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package badger_test
 
 import (
@@ -37,18 +35,22 @@ func TestUnknownReferenceBlock(t *testing.T) {
 	rootSnapshot := unittest.RootSnapshotFixture(participants, func(block *flow.Block) {
 		block.Header.Height = rootHeight
 	})
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
 		// build some finalized non-root blocks (heights 101-110)
-		head := rootSnapshot.Encodable().Head
+		head := unittest.BlockWithParentFixture(rootSnapshot.Encodable().Head)
+		head.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
+		buildFinalizedBlock(t, state, head)
+
 		const nBlocks = 10
-		for i := 0; i < nBlocks; i++ {
-			next := unittest.BlockWithParentFixture(head)
+		for i := 1; i < nBlocks; i++ {
+			next := unittest.BlockWithParentProtocolState(head)
 			buildFinalizedBlock(t, state, next)
-			head = next.Header
+			head = next
 		}
 		// build an unfinalized block (height 111)
-		buildBlock(t, state, unittest.BlockWithParentFixture(head))
+		buildBlock(t, state, unittest.BlockWithParentProtocolState(head))
 
 		finalizedHeader, err := state.Final().Head()
 		require.NoError(t, err)
@@ -104,13 +106,11 @@ func TestHead(t *testing.T) {
 func TestSnapshot_Params(t *testing.T) {
 	participants := unittest.IdentityListFixture(5, unittest.WithAllRoles())
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 
-	expectedChainID, err := rootSnapshot.Params().ChainID()
-	require.NoError(t, err)
-	expectedSporkID, err := rootSnapshot.Params().SporkID()
-	require.NoError(t, err)
-	expectedProtocolVersion, err := rootSnapshot.Params().ProtocolVersion()
-	require.NoError(t, err)
+	expectedChainID := rootSnapshot.Params().ChainID()
+	expectedSporkID := rootSnapshot.Params().SporkID()
+	expectedProtocolVersion := rootSnapshot.Params().ProtocolVersion()
 
 	rootHeader, err := rootSnapshot.Head()
 	require.NoError(t, err)
@@ -121,6 +121,7 @@ func TestSnapshot_Params(t *testing.T) {
 		const nBlocks = 10
 		for i := 0; i < nBlocks; i++ {
 			next := unittest.BlockWithParentFixture(head)
+			next.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			buildFinalizedBlock(t, state, next)
 			head = next.Header
 		}
@@ -133,18 +134,15 @@ func TestSnapshot_Params(t *testing.T) {
 		}
 		for _, snapshot := range snapshots {
 			t.Run("should be able to get chain ID from snapshot", func(t *testing.T) {
-				chainID, err := snapshot.Params().ChainID()
-				require.NoError(t, err)
+				chainID := snapshot.Params().ChainID()
 				assert.Equal(t, expectedChainID, chainID)
 			})
 			t.Run("should be able to get spork ID from snapshot", func(t *testing.T) {
-				sporkID, err := snapshot.Params().SporkID()
-				require.NoError(t, err)
+				sporkID := snapshot.Params().SporkID()
 				assert.Equal(t, expectedSporkID, sporkID)
 			})
 			t.Run("should be able to get protocol version from snapshot", func(t *testing.T) {
-				protocolVersion, err := snapshot.Params().ProtocolVersion()
-				require.NoError(t, err)
+				protocolVersion := snapshot.Params().ProtocolVersion()
 				assert.Equal(t, expectedProtocolVersion, protocolVersion)
 			})
 		}
@@ -160,15 +158,20 @@ func TestSnapshot_Params(t *testing.T) {
 func TestSnapshot_Descendants(t *testing.T) {
 	participants := unittest.IdentityListFixture(5, unittest.WithAllRoles())
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	head, err := rootSnapshot.Head()
 	require.NoError(t, err)
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
 		var expectedBlocks []flow.Identifier
 		for i := 5; i > 3; i-- {
-			for _, block := range unittest.ChainFixtureFrom(i, head) {
+			parent := head
+			for n := 0; n < i; n++ {
+				block := unittest.BlockWithParentFixture(parent)
+				block.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 				err := state.Extend(context.Background(), block)
 				require.NoError(t, err)
 				expectedBlocks = append(expectedBlocks, block.ID())
+				parent = block.Header
 			}
 		}
 
@@ -199,10 +202,11 @@ func TestIdentities(t *testing.T) {
 		t.Run("filtered", func(t *testing.T) {
 			sample, err := identities.SamplePct(0.1)
 			require.NoError(t, err)
-			filters := []flow.IdentityFilter{
-				filter.HasRole(flow.RoleCollection),
-				filter.HasNodeID(sample.NodeIDs()...),
-				filter.HasWeight(true),
+			filters := []flow.IdentityFilter[flow.Identity]{
+				filter.HasRole[flow.Identity](flow.RoleCollection),
+				filter.HasNodeID[flow.Identity](sample.NodeIDs()...),
+				filter.HasInitialWeight[flow.Identity](true),
+				filter.IsValidCurrentEpochParticipant,
 			}
 
 			for _, filterfunc := range filters {
@@ -226,16 +230,17 @@ func TestClusters(t *testing.T) {
 	qc := unittest.QuorumCertificateFixture(unittest.QCWithRootBlockID(root.ID()))
 	setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
 	commit := result.ServiceEvents[1].Event.(*flow.EpochCommit)
-	setup.Assignments = unittest.ClusterAssignment(uint(nClusters), collectors)
+	setup.Assignments = unittest.ClusterAssignment(uint(nClusters), collectors.ToSkeleton())
 	clusterQCs := unittest.QuorumCertificatesFromAssignments(setup.Assignments)
 	commit.ClusterQCs = flow.ClusterQCVoteDatasFromQCs(clusterQCs)
 	seal.ResultID = result.ID()
+	root.Payload.ProtocolStateID = inmem.ProtocolStateFromEpochServiceEvents(setup, commit).ID()
 
 	rootSnapshot, err := inmem.SnapshotFromBootstrapState(root, result, seal, qc)
 	require.NoError(t, err)
 
 	util.RunWithBootstrapState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.State) {
-		expectedClusters, err := factory.NewClusterList(setup.Assignments, collectors)
+		expectedClusters, err := factory.NewClusterList(setup.Assignments, collectors.ToSkeleton())
 		require.NoError(t, err)
 		actualClusters, err := state.Final().Epochs().Current().Clustering()
 		require.NoError(t, err)
@@ -259,6 +264,7 @@ func TestClusters(t *testing.T) {
 func TestSealingSegment(t *testing.T) {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	head, err := rootSnapshot.Head()
 	require.NoError(t, err)
 
@@ -286,13 +292,14 @@ func TestSealingSegment(t *testing.T) {
 		util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.FollowerState) {
 			// build an extra block on top of root
 			block1 := unittest.BlockWithParentFixture(head)
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			buildFinalizedBlock(t, state, block1)
 
 			segment, err := state.AtBlockID(block1.ID()).SealingSegment()
 			require.NoError(t, err)
 
 			// build a valid child B2 to ensure we have a QC
-			buildBlock(t, state, unittest.BlockWithParentFixture(block1.Header))
+			buildBlock(t, state, unittest.BlockWithParentProtocolState(block1))
 
 			// sealing segment should contain B1 and B2
 			// B2 is reference of snapshot, B1 is latest sealed
@@ -308,21 +315,29 @@ func TestSealingSegment(t *testing.T) {
 	// ROOT <- B1 <- B2(R1) <- B3(S1)
 	// Expected sealing segment: [B1, B2, B3], extra blocks: [ROOT]
 	t.Run("non-root", func(t *testing.T) {
-		util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.FollowerState) {
+		util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState protocol.MutableProtocolState) {
 			// build a block to seal
 			block1 := unittest.BlockWithParentFixture(head)
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			buildFinalizedBlock(t, state, block1)
 
 			receipt1, seal1 := unittest.ReceiptAndSealForBlock(block1)
 
 			block2 := unittest.BlockWithParentFixture(block1.Header)
-			block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1)))
+			block2.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receipt1),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			buildFinalizedBlock(t, state, block2)
 
 			// build a block sealing block1
-			block3 := unittest.BlockWithParentFixture(block2.Header)
+			block3 := unittest.BlockWithParentProtocolState(block2)
 
-			block3.SetPayload(unittest.PayloadFixture(unittest.WithSeals(seal1)))
+			seals := []*flow.Seal{seal1}
+			block3.SetPayload(flow.Payload{
+				Seals:           seals,
+				ProtocolStateID: calculateExpectedStateId(t, mutableState)(block3.Header, seals),
+			})
 			buildFinalizedBlock(t, state, block3)
 
 			segment, err := state.AtBlockID(block3.ID()).SealingSegment()
@@ -332,7 +347,7 @@ func TestSealingSegment(t *testing.T) {
 			assert.Equal(t, segment.ExtraBlocks[0].Header.Height, head.Height)
 
 			// build a valid child B3 to ensure we have a QC
-			buildBlock(t, state, unittest.BlockWithParentFixture(block3.Header))
+			buildBlock(t, state, unittest.BlockWithParentProtocolState(block3))
 
 			// sealing segment should contain B1, B2, B3
 			// B3 is reference of snapshot, B1 is latest sealed
@@ -351,6 +366,7 @@ func TestSealingSegment(t *testing.T) {
 
 			// build a block to seal
 			block1 := unittest.BlockWithParentFixture(head)
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			buildFinalizedBlock(t, state, block1)
 
 			receipt1, seal1 := unittest.ReceiptAndSealForBlock(block1)
@@ -358,11 +374,14 @@ func TestSealingSegment(t *testing.T) {
 			parent := block1
 			// build a large chain of intermediary blocks
 			for i := 0; i < 100; i++ {
-				next := unittest.BlockWithParentFixture(parent.Header)
+				next := unittest.BlockWithParentProtocolState(parent)
 				if i == 0 {
 					// Repetitions of the same receipt in one fork would be a protocol violation.
 					// Hence, we include the result only once in the direct child of B1.
-					next.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1)))
+					next.SetPayload(unittest.PayloadFixture(
+						unittest.WithReceipts(receipt1),
+						unittest.WithProtocolStateID(parent.Payload.ProtocolStateID),
+					))
 				}
 				buildFinalizedBlock(t, state, next)
 				parent = next
@@ -370,8 +389,10 @@ func TestSealingSegment(t *testing.T) {
 
 			// build the block sealing block 1
 			blockN := unittest.BlockWithParentFixture(parent.Header)
-
-			blockN.SetPayload(unittest.PayloadFixture(unittest.WithSeals(seal1)))
+			blockN.SetPayload(unittest.PayloadFixture(
+				unittest.WithSeals(seal1),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			buildFinalizedBlock(t, state, blockN)
 
 			segment, err := state.AtBlockID(blockN.ID()).SealingSegment()
@@ -397,34 +418,45 @@ func TestSealingSegment(t *testing.T) {
 		util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.FollowerState) {
 
 			block1 := unittest.BlockWithParentFixture(head)
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			buildFinalizedBlock(t, state, block1)
 			receipt1, seal1 := unittest.ReceiptAndSealForBlock(block1)
 
 			block2 := unittest.BlockWithParentFixture(block1.Header)
-			block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1)))
+			block2.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receipt1),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			buildFinalizedBlock(t, state, block2)
 
 			receipt2, seal2 := unittest.ReceiptAndSealForBlock(block2)
 
-			block3 := unittest.BlockWithParentFixture(block2.Header)
+			block3 := unittest.BlockWithParentProtocolState(block2)
 			buildFinalizedBlock(t, state, block3)
 
 			block4 := unittest.BlockWithParentFixture(block3.Header)
-			block4.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt2), unittest.WithSeals(seal1)))
+			block4.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receipt2),
+				unittest.WithSeals(seal1),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			buildFinalizedBlock(t, state, block4)
 
-			block5 := unittest.BlockWithParentFixture(block4.Header)
+			block5 := unittest.BlockWithParentProtocolState(block4)
 			buildFinalizedBlock(t, state, block5)
 
 			block6 := unittest.BlockWithParentFixture(block5.Header)
-			block6.SetPayload(unittest.PayloadFixture(unittest.WithSeals(seal2)))
+			block6.SetPayload(unittest.PayloadFixture(
+				unittest.WithSeals(seal2),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			buildFinalizedBlock(t, state, block6)
 
 			segment, err := state.AtBlockID(block6.ID()).SealingSegment()
 			require.NoError(t, err)
 
 			// build a valid child to ensure we have a QC
-			buildBlock(t, state, unittest.BlockWithParentFixture(block6.Header))
+			buildBlock(t, state, unittest.BlockWithParentProtocolState(block6))
 
 			// sealing segment should be [B2, B3, B4, B5, B6]
 			require.Len(t, segment.Blocks, 5)
@@ -453,19 +485,32 @@ func TestSealingSegment(t *testing.T) {
 			receiptB := unittest.ExecutionReceiptFixture()
 
 			block1 := unittest.BlockWithParentFixture(head)
-			block1.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receiptA1)))
+			block1.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receiptA1),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 
 			block2 := unittest.BlockWithParentFixture(block1.Header)
-			block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receiptB), unittest.WithReceiptsAndNoResults(receiptA2)))
+			block2.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receiptB),
+				unittest.WithReceiptsAndNoResults(receiptA2),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			receiptC, sealC := unittest.ReceiptAndSealForBlock(block2)
 
 			block3 := unittest.BlockWithParentFixture(block2.Header)
-			block3.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receiptC)))
+			block3.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receiptC),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 
-			block4 := unittest.BlockWithParentFixture(block3.Header)
+			block4 := unittest.BlockWithParentProtocolState(block3)
 
 			block5 := unittest.BlockWithParentFixture(block4.Header)
-			block5.SetPayload(unittest.PayloadFixture(unittest.WithSeals(sealC)))
+			block5.SetPayload(unittest.PayloadFixture(
+				unittest.WithSeals(sealC),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 
 			buildFinalizedBlock(t, state, block1)
 			buildFinalizedBlock(t, state, block2)
@@ -477,7 +522,7 @@ func TestSealingSegment(t *testing.T) {
 			require.NoError(t, err)
 
 			// build a valid child to ensure we have a QC
-			buildBlock(t, state, unittest.BlockWithParentFixture(block5.Header))
+			buildBlock(t, state, unittest.BlockWithParentProtocolState(block5))
 
 			require.Len(t, segment.Blocks, 4)
 			unittest.AssertEqualBlocksLenAndOrder(t, []*flow.Block{block2, block3, block4, block5}, segment.Blocks)
@@ -510,20 +555,34 @@ func TestSealingSegment(t *testing.T) {
 			receiptB2 := unittest.ExecutionReceiptFixture(unittest.WithResult(&receiptB.ExecutionResult))
 
 			block1 := unittest.BlockWithParentFixture(head)
-			block1.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receiptA1)))
+			block1.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receiptA1),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 
 			block2 := unittest.BlockWithParentFixture(block1.Header)
-			block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receiptB), unittest.WithReceiptsAndNoResults(receiptA2)))
+			block2.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receiptB),
+				unittest.WithReceiptsAndNoResults(receiptA2),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 
 			receiptForSeal, seal := unittest.ReceiptAndSealForBlock(block2)
 
 			block3 := unittest.BlockWithParentFixture(block2.Header)
-			block3.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receiptForSeal), unittest.WithReceiptsAndNoResults(receiptB2, receiptA3)))
+			block3.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receiptForSeal),
+				unittest.WithReceiptsAndNoResults(receiptB2, receiptA3),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 
-			block4 := unittest.BlockWithParentFixture(block3.Header)
+			block4 := unittest.BlockWithParentProtocolState(block3)
 
 			block5 := unittest.BlockWithParentFixture(block4.Header)
-			block5.SetPayload(unittest.PayloadFixture(unittest.WithSeals(seal)))
+			block5.SetPayload(unittest.PayloadFixture(
+				unittest.WithSeals(seal),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 
 			buildFinalizedBlock(t, state, block1)
 			buildFinalizedBlock(t, state, block2)
@@ -535,7 +594,7 @@ func TestSealingSegment(t *testing.T) {
 			require.NoError(t, err)
 
 			// build a valid child to ensure we have a QC
-			buildBlock(t, state, unittest.BlockWithParentFixture(block5.Header))
+			buildBlock(t, state, unittest.BlockWithParentProtocolState(block5))
 
 			require.Len(t, segment.Blocks, 4)
 			unittest.AssertEqualBlocksLenAndOrder(t, []*flow.Block{block2, block3, block4, block5}, segment.Blocks)
@@ -555,28 +614,35 @@ func TestSealingSegment(t *testing.T) {
 		util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.FollowerState) {
 			// build a block to seal
 			block1 := unittest.BlockWithParentFixture(head)
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			buildFinalizedBlock(t, state, block1)
 
 			// build a block sealing block1
 			block2 := unittest.BlockWithParentFixture(block1.Header)
 			receipt1, seal1 := unittest.ReceiptAndSealForBlock(block1)
-			block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1)))
+			block2.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receipt1),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			buildFinalizedBlock(t, state, block2)
 
-			block3 := unittest.BlockWithParentFixture(block2.Header)
+			block3 := unittest.BlockWithParentProtocolState(block2)
 			buildFinalizedBlock(t, state, block3)
 
 			block4 := unittest.BlockWithParentFixture(block3.Header)
-			block4.SetPayload(unittest.PayloadFixture(unittest.WithSeals(seal1)))
+			block4.SetPayload(unittest.PayloadFixture(
+				unittest.WithSeals(seal1),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			buildFinalizedBlock(t, state, block4)
 
-			block5 := unittest.BlockWithParentFixture(block4.Header)
+			block5 := unittest.BlockWithParentProtocolState(block4)
 			buildFinalizedBlock(t, state, block5)
 
 			snapshot := state.AtBlockID(block5.ID())
 
 			// build a valid child to ensure we have a QC
-			buildFinalizedBlock(t, state, unittest.BlockWithParentFixture(block5.Header))
+			buildFinalizedBlock(t, state, unittest.BlockWithParentProtocolState(block5))
 
 			segment, err := snapshot.SealingSegment()
 			require.NoError(t, err)
@@ -588,56 +654,135 @@ func TestSealingSegment(t *testing.T) {
 			assertSealingSegmentBlocksQueryableAfterBootstrap(t, snapshot)
 		})
 	})
+
+	// Root <- B1 <- B2 <- ... <- B700(Seal_B699)
+	// Expected sealing segment: [B699, B700], Extra blocks: [B98, B99, ..., B698]
+	// where DefaultTransactionExpiry = 600
+	t.Run("test extra blocks contain exactly DefaultTransactionExpiry number of blocks below the sealed block", func(t *testing.T) {
+		util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.FollowerState) {
+			root := unittest.BlockWithParentFixture(head)
+			root.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
+			buildFinalizedBlock(t, state, root)
+
+			blocks := make([]*flow.Block, 0, flow.DefaultTransactionExpiry+3)
+			parent := root
+			for i := 0; i < flow.DefaultTransactionExpiry+1; i++ {
+				next := unittest.BlockWithParentProtocolState(parent)
+				next.Header.View = next.Header.Height + 1 // set view so we are still in the same epoch
+				buildFinalizedBlock(t, state, next)
+				blocks = append(blocks, next)
+				parent = next
+			}
+
+			// last sealed block
+			lastSealedBlock := parent
+			lastReceipt, lastSeal := unittest.ReceiptAndSealForBlock(lastSealedBlock)
+			prevLastBlock := unittest.BlockWithParentFixture(lastSealedBlock.Header)
+			prevLastBlock.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(lastReceipt),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
+			buildFinalizedBlock(t, state, prevLastBlock)
+
+			// last finalized block
+			lastBlock := unittest.BlockWithParentFixture(prevLastBlock.Header)
+			lastBlock.SetPayload(unittest.PayloadFixture(
+				unittest.WithSeals(lastSeal),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
+			buildFinalizedBlock(t, state, lastBlock)
+
+			// build a valid child to ensure we have a QC
+			buildFinalizedBlock(t, state, unittest.BlockWithParentProtocolState(lastBlock))
+
+			snapshot := state.AtBlockID(lastBlock.ID())
+			segment, err := snapshot.SealingSegment()
+			require.NoError(t, err)
+
+			assert.Equal(t, lastBlock.Header, segment.Highest().Header)
+			assert.Equal(t, lastBlock.Header, segment.Finalized().Header)
+			assert.Equal(t, lastSealedBlock.Header, segment.Sealed().Header)
+
+			// there are DefaultTransactionExpiry number of blocks in total
+			unittest.AssertEqualBlocksLenAndOrder(t, blocks[:flow.DefaultTransactionExpiry], segment.ExtraBlocks)
+			assert.Len(t, segment.ExtraBlocks, flow.DefaultTransactionExpiry)
+			assertSealingSegmentBlocksQueryableAfterBootstrap(t, snapshot)
+
+		})
+	})
 	// Test the case where the reference block of the snapshot contains seals for blocks that are lower than the lowest sealing segment's block.
 	// This test case specifically checks if sealing segment includes both highest and lowest block sealed by head.
 	// ROOT <- B1 <- B2 <- B3(Seal_B1) <- B4 <- ... <- LastBlock(Seal_B2, Seal_B3, Seal_B4)
-	// Expected sealing segment: [B4, ..., B5], Extra blocks: [B2, B3]
+	// Expected sealing segment: [B4, ..., B5], Extra blocks: [Root, B1, B2, B3]
 	t.Run("highest block seals outside segment", func(t *testing.T) {
 		util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.FollowerState) {
 			// build a block to seal
 			block1 := unittest.BlockWithParentFixture(head)
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			buildFinalizedBlock(t, state, block1)
 
 			// build a block sealing block1
 			block2 := unittest.BlockWithParentFixture(block1.Header)
 			receipt1, seal1 := unittest.ReceiptAndSealForBlock(block1)
-			block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1)))
+			block2.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receipt1),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			buildFinalizedBlock(t, state, block2)
 
 			receipt2, seal2 := unittest.ReceiptAndSealForBlock(block2)
 			block3 := unittest.BlockWithParentFixture(block2.Header)
-			block3.SetPayload(unittest.PayloadFixture(unittest.WithSeals(seal1), unittest.WithReceipts(receipt2)))
+			block3.SetPayload(unittest.PayloadFixture(
+				unittest.WithSeals(seal1),
+				unittest.WithReceipts(receipt2),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			buildFinalizedBlock(t, state, block3)
 
 			receipt3, seal3 := unittest.ReceiptAndSealForBlock(block3)
 			block4 := unittest.BlockWithParentFixture(block3.Header)
-			block4.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt3)))
+			block4.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receipt3),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			buildFinalizedBlock(t, state, block4)
 
 			// build chain, so it's long enough to not target blocks as inside of flow.DefaultTransactionExpiry window.
 			parent := block4
 			for i := 0; i < 1.5*flow.DefaultTransactionExpiry; i++ {
-				next := unittest.BlockWithParentFixture(parent.Header)
+				next := unittest.BlockWithParentProtocolState(parent)
 				next.Header.View = next.Header.Height + 1 // set view so we are still in the same epoch
 				buildFinalizedBlock(t, state, next)
 				parent = next
 			}
 
 			receipt4, seal4 := unittest.ReceiptAndSealForBlock(block4)
-			lastBlock := unittest.BlockWithParentFixture(parent.Header)
-			lastBlock.SetPayload(unittest.PayloadFixture(unittest.WithSeals(seal2, seal3, seal4), unittest.WithReceipts(receipt4)))
+			prevLastBlock := unittest.BlockWithParentFixture(parent.Header)
+			prevLastBlock.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receipt4),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
+			buildFinalizedBlock(t, state, prevLastBlock)
+
+			// since result and seal cannot be part of the same block, we need to build another block
+			lastBlock := unittest.BlockWithParentFixture(prevLastBlock.Header)
+			lastBlock.SetPayload(unittest.PayloadFixture(
+				unittest.WithSeals(seal2, seal3, seal4),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			buildFinalizedBlock(t, state, lastBlock)
 
 			snapshot := state.AtBlockID(lastBlock.ID())
 
 			// build a valid child to ensure we have a QC
-			buildFinalizedBlock(t, state, unittest.BlockWithParentFixture(lastBlock.Header))
+			buildFinalizedBlock(t, state, unittest.BlockWithParentProtocolState(lastBlock))
 
 			segment, err := snapshot.SealingSegment()
 			require.NoError(t, err)
 			assert.Equal(t, lastBlock.Header, segment.Highest().Header)
 			assert.Equal(t, block4.Header, segment.Sealed().Header)
-			unittest.AssertEqualBlocksLenAndOrder(t, []*flow.Block{block2, block3}, segment.ExtraBlocks)
+			root := rootSnapshot.Encodable().SealingSegment.Sealed()
+			unittest.AssertEqualBlocksLenAndOrder(t, []*flow.Block{root, block1, block2, block3}, segment.ExtraBlocks)
 			assert.Len(t, segment.ExecutionResults, 2)
 
 			assertSealingSegmentBlocksQueryableAfterBootstrap(t, snapshot)
@@ -653,6 +798,7 @@ func TestSealingSegment(t *testing.T) {
 //     (2b) An orphaned block is chosen as head; at this height a block other than the orphaned has been finalized.
 func TestSealingSegment_FailureCases(t *testing.T) {
 	sporkRootSnapshot := unittest.RootSnapshotFixture(unittest.CompleteIdentitySet())
+	rootProtocolStateID := getRootProtocolStateID(t, sporkRootSnapshot)
 	sporkRoot, err := sporkRootSnapshot.Head()
 	require.NoError(t, err)
 
@@ -671,17 +817,24 @@ func TestSealingSegment_FailureCases(t *testing.T) {
 		//                                    └── head ──┘
 		//
 		b1 := unittest.BlockWithParentFixture(sporkRoot) // construct block b1, append to state and finalize
+		b1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		receipt, seal := unittest.ReceiptAndSealForBlock(b1)
 		b2 := unittest.BlockWithParentFixture(b1.Header) // construct block b2, append to state and finalize
-		b2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt)))
+		b2.SetPayload(unittest.PayloadFixture(
+			unittest.WithReceipts(receipt),
+			unittest.WithProtocolStateID(rootProtocolStateID),
+		))
 		b3 := unittest.BlockWithParentFixture(b2.Header) // construct block b3 with seal for b1, append it to state and finalize
-		b3.SetPayload(unittest.PayloadFixture(unittest.WithSeals(seal)))
+		b3.SetPayload(unittest.PayloadFixture(
+			unittest.WithSeals(seal),
+			unittest.WithProtocolStateID(rootProtocolStateID),
+		))
 
-		multipleBlockSnapshot := snapshotAfter(t, sporkRootSnapshot, func(state *bprotocol.FollowerState) protocol.Snapshot {
+		multipleBlockSnapshot := snapshotAfter(t, sporkRootSnapshot, func(state *bprotocol.FollowerState, mutableState protocol.MutableProtocolState) protocol.Snapshot {
 			for _, b := range []*flow.Block{b1, b2, b3} {
 				buildFinalizedBlock(t, state, b)
 			}
-			b4 := unittest.BlockWithParentFixture(b3.Header)
+			b4 := unittest.BlockWithParentProtocolState(b3)
 			require.NoError(t, state.ExtendCertified(context.Background(), b4, unittest.CertifyBlock(b4.Header))) // add child of b3 to ensure we have a QC for b3
 			return state.AtBlockID(b3.ID())
 		})
@@ -690,8 +843,7 @@ func TestSealingSegment_FailureCases(t *testing.T) {
 		// Thereby, the state should have b3 as its local root block. In addition, the blocks contained in the sealing
 		// segment, such as b2 should be stored in the state.
 		util.RunWithFollowerProtocolState(t, multipleBlockSnapshot, func(db *badger.DB, state *bprotocol.FollowerState) {
-			localStateRootBlock, err := state.Params().FinalizedRoot()
-			require.NoError(t, err)
+			localStateRootBlock := state.Params().FinalizedRoot()
 			assert.Equal(t, b3.ID(), localStateRootBlock.ID())
 
 			// verify that b2 is known to the protocol state, but constructing a sealing segment fails
@@ -711,7 +863,9 @@ func TestSealingSegment_FailureCases(t *testing.T) {
 		util.RunWithFollowerProtocolState(t, sporkRootSnapshot, func(db *badger.DB, state *bprotocol.FollowerState) {
 			// add _unfinalized_ blocks b1 and b2 to state (block b5 is necessary, so b1 has a QC, which is a consistency requirement for subsequent finality)
 			b1 := unittest.BlockWithParentFixture(sporkRoot)
+			b1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			b2 := unittest.BlockWithParentFixture(b1.Header)
+			b2.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			require.NoError(t, state.ExtendCertified(context.Background(), b1, b2.Header.QuorumCertificate()))
 			require.NoError(t, state.ExtendCertified(context.Background(), b2, unittest.CertifyBlock(b2.Header))) // adding block b5 (providing required QC for b1)
 
@@ -729,10 +883,13 @@ func TestSealingSegment_FailureCases(t *testing.T) {
 	t.Run("sealing segment from orphaned block", func(t *testing.T) {
 		util.RunWithFollowerProtocolState(t, sporkRootSnapshot, func(db *badger.DB, state *bprotocol.FollowerState) {
 			orphaned := unittest.BlockWithParentFixture(sporkRoot)
-			orphanedChild := unittest.BlockWithParentFixture(orphaned.Header)
+			orphaned.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
+			orphanedChild := unittest.BlockWithParentProtocolState(orphaned)
 			require.NoError(t, state.ExtendCertified(context.Background(), orphaned, orphanedChild.Header.QuorumCertificate()))
 			require.NoError(t, state.ExtendCertified(context.Background(), orphanedChild, unittest.CertifyBlock(orphanedChild.Header)))
-			buildFinalizedBlock(t, state, unittest.BlockWithParentFixture(sporkRoot))
+			block := unittest.BlockWithParentFixture(sporkRoot)
+			block.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
+			buildFinalizedBlock(t, state, block)
 
 			// consistency check: the finalized block at height `orphaned.Height` should be different than `orphaned`
 			h, err := state.AtHeight(orphaned.Header.Height).Head()
@@ -755,6 +912,7 @@ func TestSealingSegment_FailureCases(t *testing.T) {
 func TestBootstrapSealingSegmentWithExtraBlocks(t *testing.T) {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	rootEpoch := rootSnapshot.Epochs().Current()
 	cluster, err := rootEpoch.Cluster(0)
 	require.NoError(t, err)
@@ -763,27 +921,38 @@ func TestBootstrapSealingSegmentWithExtraBlocks(t *testing.T) {
 	require.NoError(t, err)
 	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
 		block1 := unittest.BlockWithParentFixture(head)
+		block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 		buildFinalizedBlock(t, state, block1)
 		receipt1, seal1 := unittest.ReceiptAndSealForBlock(block1)
 
 		block2 := unittest.BlockWithParentFixture(block1.Header)
-		block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1)))
+		block2.SetPayload(unittest.PayloadFixture(
+			unittest.WithReceipts(receipt1),
+			unittest.WithProtocolStateID(rootProtocolStateID),
+		))
 		buildFinalizedBlock(t, state, block2)
 
 		receipt2, seal2 := unittest.ReceiptAndSealForBlock(block2)
 
-		block3 := unittest.BlockWithParentFixture(block2.Header)
+		block3 := unittest.BlockWithParentProtocolState(block2)
 		buildFinalizedBlock(t, state, block3)
 
 		block4 := unittest.BlockWithParentFixture(block3.Header)
-		block4.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt2), unittest.WithSeals(seal1)))
+		block4.SetPayload(unittest.PayloadFixture(
+			unittest.WithReceipts(receipt2),
+			unittest.WithSeals(seal1),
+			unittest.WithProtocolStateID(rootProtocolStateID),
+		))
 		buildFinalizedBlock(t, state, block4)
 
-		block5 := unittest.BlockWithParentFixture(block4.Header)
+		block5 := unittest.BlockWithParentProtocolState(block4)
 		buildFinalizedBlock(t, state, block5)
 
 		block6 := unittest.BlockWithParentFixture(block5.Header)
-		block6.SetPayload(unittest.PayloadFixture(unittest.WithSeals(seal2)))
+		block6.SetPayload(unittest.PayloadFixture(
+			unittest.WithSeals(seal2),
+			unittest.WithProtocolStateID(rootProtocolStateID),
+		))
 		buildFinalizedBlock(t, state, block6)
 
 		snapshot := state.AtBlockID(block6.ID())
@@ -791,7 +960,7 @@ func TestBootstrapSealingSegmentWithExtraBlocks(t *testing.T) {
 		require.NoError(t, err)
 
 		// build a valid child to ensure we have a QC
-		buildBlock(t, state, unittest.BlockWithParentFixture(block6.Header))
+		buildBlock(t, state, unittest.BlockWithParentProtocolState(block6))
 
 		// sealing segment should be [B2, B3, B4, B5, B6]
 		require.Len(t, segment.Blocks, 5)
@@ -812,7 +981,10 @@ func TestBootstrapSealingSegmentWithExtraBlocks(t *testing.T) {
 			require.NoError(t, err)
 			guarantee.SignerIndices = signerIndices
 
-			block7.SetPayload(unittest.PayloadFixture(unittest.WithGuarantees(guarantee)))
+			block7.SetPayload(unittest.PayloadFixture(
+				unittest.WithGuarantees(guarantee),
+				unittest.WithProtocolStateID(block6.Payload.ProtocolStateID),
+			))
 			buildBlock(t, state, block7)
 		})
 	})
@@ -821,6 +993,7 @@ func TestBootstrapSealingSegmentWithExtraBlocks(t *testing.T) {
 func TestLatestSealedResult(t *testing.T) {
 	identities := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 
 	t.Run("root snapshot", func(t *testing.T) {
 		util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.FollowerState) {
@@ -840,23 +1013,31 @@ func TestLatestSealedResult(t *testing.T) {
 
 		util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.FollowerState) {
 			block1 := unittest.BlockWithParentFixture(head)
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 
-			block2 := unittest.BlockWithParentFixture(block1.Header)
+			block2 := unittest.BlockWithParentProtocolState(block1)
 
 			receipt1, seal1 := unittest.ReceiptAndSealForBlock(block1)
-			block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1)))
+			block2.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receipt1),
+				unittest.WithProtocolStateID(rootProtocolStateID),
+			))
 			block3 := unittest.BlockWithParentFixture(block2.Header)
-			block3.SetPayload(unittest.PayloadFixture(unittest.WithSeals(seal1)))
+			block3.SetPayload(unittest.PayloadFixture(
+				unittest.WithSeals(seal1),
+				unittest.WithProtocolStateID(rootProtocolStateID)))
 
 			receipt2, seal2 := unittest.ReceiptAndSealForBlock(block2)
 			receipt3, seal3 := unittest.ReceiptAndSealForBlock(block3)
 			block4 := unittest.BlockWithParentFixture(block3.Header)
 			block4.SetPayload(unittest.PayloadFixture(
 				unittest.WithReceipts(receipt2, receipt3),
+				unittest.WithProtocolStateID(rootProtocolStateID),
 			))
 			block5 := unittest.BlockWithParentFixture(block4.Header)
 			block5.SetPayload(unittest.PayloadFixture(
 				unittest.WithSeals(seal2, seal3),
+				unittest.WithProtocolStateID(rootProtocolStateID),
 			))
 
 			err = state.ExtendCertified(context.Background(), block1, block2.Header.QuorumCertificate())
@@ -908,6 +1089,7 @@ func TestLatestSealedResult(t *testing.T) {
 func TestQuorumCertificate(t *testing.T) {
 	identities := unittest.IdentityListFixture(5, unittest.WithAllRoles())
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	head, err := rootSnapshot.Head()
 	require.NoError(t, err)
 
@@ -917,7 +1099,7 @@ func TestQuorumCertificate(t *testing.T) {
 
 			// create a block to query
 			block1 := unittest.BlockWithParentFixture(head)
-			block1.SetPayload(flow.EmptyPayload())
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			err := state.Extend(context.Background(), block1)
 			require.NoError(t, err)
 
@@ -947,7 +1129,7 @@ func TestQuorumCertificate(t *testing.T) {
 
 			// add a block so we aren't testing against root
 			block1 := unittest.BlockWithParentFixture(head)
-			block1.SetPayload(flow.EmptyPayload())
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			certifyingQC := unittest.CertifyBlock(block1.Header)
 			err := state.ExtendCertified(context.Background(), block1, certifyingQC)
 			require.NoError(t, err)
@@ -970,15 +1152,14 @@ func TestQuorumCertificate(t *testing.T) {
 		util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
 			// create a block to query
 			block1 := unittest.BlockWithParentFixture(head)
-			block1.SetPayload(flow.EmptyPayload())
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			err := state.Extend(context.Background(), block1)
 			require.NoError(t, err)
 
 			_, err = state.AtBlockID(block1.ID()).QuorumCertificate()
 			assert.ErrorIs(t, err, storage.ErrNotFound)
 
-			block2 := unittest.BlockWithParentFixture(block1.Header)
-			block2.SetPayload(flow.EmptyPayload())
+			block2 := unittest.BlockWithParentProtocolState(block1)
 			err = state.Extend(context.Background(), block2)
 			require.NoError(t, err)
 
@@ -999,11 +1180,11 @@ func TestSnapshot_EpochQuery(t *testing.T) {
 	result, _, err := rootSnapshot.SealedResult()
 	require.NoError(t, err)
 
-	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
+	util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState protocol.MutableProtocolState) {
 		epoch1Counter := result.ServiceEvents[0].Event.(*flow.EpochSetup).Counter
 		epoch2Counter := epoch1Counter + 1
 
-		epochBuilder := unittest.NewEpochBuilder(t, state)
+		epochBuilder := unittest.NewEpochBuilder(t, mutableState, state)
 		// build epoch 1 (prepare epoch 2)
 		epochBuilder.
 			BuildEpoch().
@@ -1090,9 +1271,9 @@ func TestSnapshot_EpochFirstView(t *testing.T) {
 	result, _, err := rootSnapshot.SealedResult()
 	require.NoError(t, err)
 
-	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
+	util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState protocol.MutableProtocolState) {
 
-		epochBuilder := unittest.NewEpochBuilder(t, state)
+		epochBuilder := unittest.NewEpochBuilder(t, mutableState, state)
 		// build epoch 1 (prepare epoch 2)
 		epochBuilder.
 			BuildEpoch().
@@ -1171,9 +1352,9 @@ func TestSnapshot_EpochHeightBoundaries(t *testing.T) {
 	head, err := rootSnapshot.Head()
 	require.NoError(t, err)
 
-	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
+	util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState protocol.MutableProtocolState) {
 
-		epochBuilder := unittest.NewEpochBuilder(t, state)
+		epochBuilder := unittest.NewEpochBuilder(t, mutableState, state)
 
 		epoch1FirstHeight := head.Height
 		t.Run("first epoch - EpochStaking phase", func(t *testing.T) {
@@ -1246,23 +1427,23 @@ func TestSnapshot_CrossEpochIdentities(t *testing.T) {
 	removedAtEpoch2 := epoch1Identities[rand.Intn(len(epoch1Identities))]
 	// epoch 2 has partial overlap with epoch 1
 	epoch2Identities := append(
-		epoch1Identities.Filter(filter.Not(filter.HasNodeID(removedAtEpoch2.NodeID))),
+		epoch1Identities.Filter(filter.Not(filter.HasNodeID[flow.Identity](removedAtEpoch2.NodeID))),
 		addedAtEpoch2)
 	// epoch 3 has no overlap with epoch 2
 	epoch3Identities := unittest.IdentityListFixture(10, unittest.WithAllRoles())
 
 	rootSnapshot := unittest.RootSnapshotFixture(epoch1Identities)
-	util.RunWithFullProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState) {
+	util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, state *bprotocol.ParticipantState, mutableState protocol.MutableProtocolState) {
 
-		epochBuilder := unittest.NewEpochBuilder(t, state)
+		epochBuilder := unittest.NewEpochBuilder(t, mutableState, state)
 		// build epoch 1 (prepare epoch 2)
 		epochBuilder.
-			UsingSetupOpts(unittest.WithParticipants(epoch2Identities)).
+			UsingSetupOpts(unittest.WithParticipants(epoch2Identities.ToSkeleton())).
 			BuildEpoch().
 			CompleteEpoch()
 		// build epoch 2 (prepare epoch 3)
 		epochBuilder.
-			UsingSetupOpts(unittest.WithParticipants(epoch3Identities)).
+			UsingSetupOpts(unittest.WithParticipants(epoch3Identities.ToSkeleton())).
 			BuildEpoch().
 			CompleteEpoch()
 
@@ -1273,8 +1454,7 @@ func TestSnapshot_CrossEpochIdentities(t *testing.T) {
 		require.True(t, ok)
 
 		t.Run("should be able to query at root block", func(t *testing.T) {
-			root, err := state.Params().FinalizedRoot()
-			require.NoError(t, err)
+			root := state.Params().FinalizedRoot()
 			snapshot := state.AtHeight(root.Height)
 			identities, err := snapshot.Identities(filter.Any)
 			require.NoError(t, err)
@@ -1303,11 +1483,12 @@ func TestSnapshot_CrossEpochIdentities(t *testing.T) {
 					// all current epoch identities should match configuration from EpochSetup event
 					assert.ElementsMatch(t, epoch1Identities, identities.Filter(epoch1Identities.Selector()))
 
-					// should contain single next epoch identity with 0 weight
-					nextEpochIdentity := identities.Filter(filter.HasNodeID(addedAtEpoch2.NodeID))[0]
-					assert.Equal(t, uint64(0), nextEpochIdentity.Weight) // should have 0 weight
-					nextEpochIdentity.Weight = addedAtEpoch2.Weight
-					assert.Equal(t, addedAtEpoch2, nextEpochIdentity) // should be equal besides weight
+					// should contain single identity for next epoch with status `flow.EpochParticipationStatusJoining`
+					nextEpochIdentity := identities.Filter(filter.HasNodeID[flow.Identity](addedAtEpoch2.NodeID))[0]
+					assert.Equal(t, flow.EpochParticipationStatusJoining, nextEpochIdentity.EpochParticipationStatus,
+						"expect joining status since we are in setup & commit phase")
+					assert.Equal(t, addedAtEpoch2.IdentitySkeleton, nextEpochIdentity.IdentitySkeleton,
+						"expect skeleton to be identical")
 				})
 			}
 		})
@@ -1324,11 +1505,12 @@ func TestSnapshot_CrossEpochIdentities(t *testing.T) {
 			// all current epoch identities should match configuration from EpochSetup event
 			assert.ElementsMatch(t, epoch2Identities, identities.Filter(epoch2Identities.Selector()))
 
-			// should contain single previous epoch identity with 0 weight
-			lastEpochIdentity := identities.Filter(filter.HasNodeID(removedAtEpoch2.NodeID))[0]
-			assert.Equal(t, uint64(0), lastEpochIdentity.Weight) // should have 0 weight
-			lastEpochIdentity.Weight = removedAtEpoch2.Weight    // overwrite weight
-			assert.Equal(t, removedAtEpoch2, lastEpochIdentity)  // should be equal besides weight
+			// should contain single identity from previous epoch with status `flow.EpochParticipationStatusLeaving`
+			lastEpochIdentity := identities.Filter(filter.HasNodeID[flow.Identity](removedAtEpoch2.NodeID))[0]
+			assert.Equal(t, flow.EpochParticipationStatusLeaving, lastEpochIdentity.EpochParticipationStatus,
+				"expect leaving status since we are in staking phase")
+			assert.Equal(t, removedAtEpoch2.IdentitySkeleton, lastEpochIdentity.IdentitySkeleton,
+				"expect skeleton to be identical")
 		})
 
 		t.Run("should not include previous epoch after staking phase", func(t *testing.T) {
@@ -1349,13 +1531,14 @@ func TestSnapshot_CrossEpochIdentities(t *testing.T) {
 					// all current epoch identities should match configuration from EpochSetup event
 					assert.ElementsMatch(t, epoch2Identities, identities.Filter(epoch2Identities.Selector()))
 
-					// should contain next epoch identities with 0 weight
+					// should contain next epoch's identities with status `flow.EpochParticipationStatusJoining`
 					for _, expected := range epoch3Identities {
 						actual, exists := identities.ByNodeID(expected.NodeID)
 						require.True(t, exists)
-						assert.Equal(t, uint64(0), actual.Weight) // should have 0 weight
-						actual.Weight = expected.Weight           // overwrite weight
-						assert.Equal(t, expected, actual)         // should be equal besides weight
+						assert.Equal(t, flow.EpochParticipationStatusJoining, actual.EpochParticipationStatus,
+							"expect joining status since we are in setup & commit phase")
+						assert.Equal(t, expected.IdentitySkeleton, actual.IdentitySkeleton,
+							"expect skeleton to be identical")
 					}
 				})
 			}
diff --git a/state/protocol/badger/state.go b/state/protocol/badger/state.go
index 40973dc05f2..9681cb33c8f 100644
--- a/state/protocol/badger/state.go
+++ b/state/protocol/badger/state.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package badger
 
 import (
@@ -15,6 +13,7 @@ import (
 	statepkg "github.com/onflow/flow-go/state"
 	"github.com/onflow/flow-go/state/protocol"
 	"github.com/onflow/flow-go/state/protocol/invalid"
+	"github.com/onflow/flow-go/state/protocol/protocol_state"
 	"github.com/onflow/flow-go/storage"
 	"github.com/onflow/flow-go/storage/badger/operation"
 	"github.com/onflow/flow-go/storage/badger/transaction"
@@ -35,28 +34,33 @@ type State struct {
 	results storage.ExecutionResults
 	seals   storage.Seals
 	epoch   struct {
-		setups   storage.EpochSetups
-		commits  storage.EpochCommits
-		statuses storage.EpochStatuses
+		setups  storage.EpochSetups
+		commits storage.EpochCommits
 	}
-	versionBeacons storage.VersionBeacons
+	params                   protocol.Params
+	protocolStateSnapshotsDB storage.ProtocolState
+	protocolState            protocol.MutableProtocolState
+	versionBeacons           storage.VersionBeacons
 
-	// rootHeight marks the cutoff of the history this node knows about. We cache it in the state
+	// finalizedRootHeight marks the cutoff of the history this node knows about. We cache it in the state
 	// because it cannot change over the lifecycle of a protocol state instance. It is frequently
 	// larger than the height of the root block of the spork, (also cached below as
-	// `sporkRootBlockHeight`), for instance if the node joined in an epoch after the last spork.
+	// `sporkRootBlockHeight`), for instance, if the node joined in an epoch after the last spork.
 	finalizedRootHeight uint64
-	// sealedRootHeight returns the root block that is sealed.
+	// sealedRootHeight returns the root block that is sealed. We cache it in
+	// the state, because it cannot change over the lifecycle of a protocol state instance.
 	sealedRootHeight uint64
 	// sporkRootBlockHeight is the height of the root block in the current spork. We cache it in
 	// the state, because it cannot change over the lifecycle of a protocol state instance.
 	// Caution: A node that joined in a later epoch past the spork, the node will likely _not_
 	// know the spork's root block in full (though it will always know the height).
 	sporkRootBlockHeight uint64
-	// cache the latest finalized and sealed block headers as these are common queries.
-	// It can be cached because the protocol state is solely responsible for updating these values.
-	cachedFinal  *atomic.Pointer[cachedHeader]
-	cachedSealed *atomic.Pointer[cachedHeader]
+	// cachedLatestFinal is the *latest* finalized block header, which we can cache here,
+	// because the protocol state is solely responsible for updating it.
+	cachedLatestFinal *atomic.Pointer[cachedHeader]
+	// cachedLatestSealed is the *latest* sealed block headers, which we can cache here,
+	// because the protocol state is solely responsible for updating it.
+	cachedLatestSealed *atomic.Pointer[cachedHeader]
 }
 
 var _ protocol.State = (*State)(nil)
@@ -89,7 +93,7 @@ func Bootstrap(
 	qcs storage.QuorumCertificates,
 	setups storage.EpochSetups,
 	commits storage.EpochCommits,
-	statuses storage.EpochStatuses,
+	protocolStateSnapshotsDB storage.ProtocolState,
 	versionBeacons storage.VersionBeacons,
 	root protocol.Snapshot,
 	options ...BootstrapConfigOptions,
@@ -108,20 +112,6 @@ func Bootstrap(
 		return nil, fmt.Errorf("expected empty database")
 	}
 
-	state := newState(
-		metrics,
-		db,
-		headers,
-		seals,
-		results,
-		blocks,
-		qcs,
-		setups,
-		commits,
-		statuses,
-		versionBeacons,
-	)
-
 	if err := IsValidRootSnapshot(root, !config.SkipNetworkAddressValidation); err != nil {
 		return nil, fmt.Errorf("cannot bootstrap invalid root snapshot: %w", err)
 	}
@@ -146,7 +136,7 @@ func Bootstrap(
 		// 1) bootstrap the sealing segment
 		// creating sealed root block with the rootResult
 		// creating finalized root block with lastFinalized
-		err = state.bootstrapSealingSegment(segment, lastFinalized, rootSeal)(tx)
+		err = bootstrapSealingSegment(blocks, qcs, segment, lastFinalized, rootSeal)(tx)
 		if err != nil {
 			return fmt.Errorf("could not bootstrap sealing chain segment blocks: %w", err)
 		}
@@ -162,67 +152,129 @@ func Bootstrap(
 		}
 
 		// 3) initialize the current protocol state height/view pointers
-		err = transaction.WithTx(state.bootstrapStatePointers(root))(tx)
+		err = bootstrapStatePointers(root)(tx)
 		if err != nil {
 			return fmt.Errorf("could not bootstrap height/view pointers: %w", err)
 		}
 
 		// 4) initialize values related to the epoch logic
-		err = state.bootstrapEpoch(root.Epochs(), segment, !config.SkipNetworkAddressValidation)(tx)
+		rootProtocolState, err := root.ProtocolState()
+		if err != nil {
+			return fmt.Errorf("could not retrieve protocol state for root snapshot: %w", err)
+		}
+		err = bootstrapEpoch(setups, commits, rootProtocolState, !config.SkipNetworkAddressValidation)(tx)
 		if err != nil {
 			return fmt.Errorf("could not bootstrap epoch values: %w", err)
 		}
 
 		// 5) initialize spork params
-		err = transaction.WithTx(state.bootstrapSporkInfo(root))(tx)
+		err = bootstrapSporkInfo(root)(tx)
 		if err != nil {
 			return fmt.Errorf("could not bootstrap spork info: %w", err)
 		}
 
-		// 6) set metric values
-		err = state.updateEpochMetrics(root)
+		// 6) bootstrap dynamic protocol state
+		err = bootstrapProtocolState(segment, rootProtocolState, protocolStateSnapshotsDB)(tx)
 		if err != nil {
-			return fmt.Errorf("could not update epoch metrics: %w", err)
-		}
-		state.metrics.BlockSealed(lastSealed)
-		state.metrics.SealedHeight(lastSealed.Header.Height)
-		state.metrics.FinalizedHeight(lastFinalized.Header.Height)
-		for _, block := range segment.Blocks {
-			state.metrics.BlockFinalized(block)
+			return fmt.Errorf("could not bootstrap protocol state: %w", err)
 		}
 
 		// 7) initialize version beacon
-		err = transaction.WithTx(state.boostrapVersionBeacon(root))(tx)
+		err = boostrapVersionBeacon(root)(tx)
 		if err != nil {
 			return fmt.Errorf("could not bootstrap version beacon: %w", err)
 		}
 
+		// 8) set metric values, we pass `false` here since this node has empty storage and doesn't know anything about EFM.
+		// TODO for 'leaving Epoch Fallback via special service event', this needs to be updated to support bootstrapping
+		// while in EFM, currently initial state doesn't know how to bootstrap node when we have entered EFM.
+		err = updateEpochMetrics(metrics, root, false)
+		if err != nil {
+			return fmt.Errorf("could not update epoch metrics: %w", err)
+		}
+		metrics.BlockSealed(lastSealed)
+		metrics.SealedHeight(lastSealed.Header.Height)
+		metrics.FinalizedHeight(lastFinalized.Header.Height)
+		for _, block := range segment.Blocks {
+			metrics.BlockFinalized(block)
+		}
+
 		return nil
 	})
 	if err != nil {
 		return nil, fmt.Errorf("bootstrapping failed: %w", err)
 	}
 
-	// populate the protocol state cache
-	err = state.populateCache()
+	instanceParams, err := ReadInstanceParams(db, headers, seals)
 	if err != nil {
-		return nil, fmt.Errorf("failed to populate cache: %w", err)
+		return nil, fmt.Errorf("could not read instance params: %w", err)
 	}
 
-	return state, nil
+	params := &Params{
+		GlobalParams:   root.Params(),
+		InstanceParams: instanceParams,
+	}
+
+	return newState(
+		metrics,
+		db,
+		headers,
+		seals,
+		results,
+		blocks,
+		qcs,
+		setups,
+		commits,
+		protocolStateSnapshotsDB,
+		versionBeacons,
+		params,
+	)
+}
+
+// bootstrapProtocolState bootstraps data structures needed for Dynamic Protocol State.
+// It inserts the root protocol state and indexes all blocks in the sealing segment assuming that
+// dynamic protocol state didn't change in the sealing segment.
+// The root snapshot's sealing segment must not straddle any epoch transitions
+// or epoch phase transitions.
+func bootstrapProtocolState(segment *flow.SealingSegment, rootProtocolState protocol.DynamicProtocolState, protocolState storage.ProtocolState) func(*transaction.Tx) error {
+	return func(tx *transaction.Tx) error {
+		rootProtocolStateEntry := rootProtocolState.Entry().ProtocolStateEntry
+		protocolStateID := rootProtocolStateEntry.ID()
+		err := protocolState.StoreTx(protocolStateID, rootProtocolStateEntry)(tx)
+		if err != nil {
+			return fmt.Errorf("could not insert root protocol state: %w", err)
+		}
+
+		// NOTE: as specified in the godoc, this code assumes that each block
+		// in the sealing segment in within the same phase within the same epoch.
+		// the sealing segment.
+		for _, block := range segment.AllBlocks() {
+			err = protocolState.Index(block.ID(), protocolStateID)(tx)
+			if err != nil {
+				return fmt.Errorf("could not index root protocol state: %w", err)
+			}
+		}
+		return nil
+	}
 }
 
 // bootstrapSealingSegment inserts all blocks and associated metadata for the
 // protocol state root snapshot to disk.
-func (state *State) bootstrapSealingSegment(segment *flow.SealingSegment, head *flow.Block, rootSeal *flow.Seal) func(tx *transaction.Tx) error {
+func bootstrapSealingSegment(
+	blocks storage.Blocks,
+	qcs storage.QuorumCertificates,
+	segment *flow.SealingSegment,
+	head *flow.Block,
+	rootSeal *flow.Seal,
+) func(*transaction.Tx) error {
 	return func(tx *transaction.Tx) error {
-
+		txn := tx.DBTxn // tx is just a wrapper around a badger transaction with the additional ability to register callbacks that are executed after the badger transaction completed _successfully_
 		for _, result := range segment.ExecutionResults {
-			err := transaction.WithTx(operation.SkipDuplicates(operation.InsertExecutionResult(result)))(tx)
+			err := operation.SkipDuplicates(operation.InsertExecutionResult(result))(txn)
 			if err != nil {
 				return fmt.Errorf("could not insert execution result: %w", err)
 			}
-			err = transaction.WithTx(operation.IndexExecutionResult(result.BlockID, result.ID()))(tx)
+			err = operation.IndexExecutionResult(result.BlockID, result.ID())(txn)
 			if err != nil {
 				return fmt.Errorf("could not index execution result: %w", err)
 			}
@@ -230,7 +282,7 @@ func (state *State) bootstrapSealingSegment(segment *flow.SealingSegment, head *
 
 		// insert the first seal (in case the segment's first block contains no seal)
 		if segment.FirstSeal != nil {
-			err := transaction.WithTx(operation.InsertSeal(segment.FirstSeal.ID(), segment.FirstSeal))(tx)
+			err := operation.InsertSeal(segment.FirstSeal.ID(), segment.FirstSeal)(txn)
 			if err != nil {
 				return fmt.Errorf("could not insert first seal: %w", err)
 			}
@@ -240,7 +292,7 @@ func (state *State) bootstrapSealingSegment(segment *flow.SealingSegment, head *
 		// different from the finalized root block, then it means the node dynamically bootstrapped.
 		// In that case, we should index the result of the sealed root block so that the EN is able
 		// to execute the next block.
-		err := transaction.WithTx(operation.SkipDuplicates(operation.IndexExecutionResult(rootSeal.BlockID, rootSeal.ResultID)))(tx)
+		err := operation.SkipDuplicates(operation.IndexExecutionResult(rootSeal.BlockID, rootSeal.ResultID))(txn)
 		if err != nil {
 			return fmt.Errorf("could not index root result: %w", err)
 		}
@@ -248,15 +300,15 @@ func (state *State) bootstrapSealingSegment(segment *flow.SealingSegment, head *
 		for _, block := range segment.ExtraBlocks {
 			blockID := block.ID()
 			height := block.Header.Height
-			err := state.blocks.StoreTx(block)(tx)
+			err := blocks.StoreTx(block)(tx)
 			if err != nil {
 				return fmt.Errorf("could not insert SealingSegment extra block: %w", err)
 			}
-			err = transaction.WithTx(operation.IndexBlockHeight(height, blockID))(tx)
+			err = operation.IndexBlockHeight(height, blockID)(txn)
 			if err != nil {
 				return fmt.Errorf("could not index SealingSegment extra block (id=%x): %w", blockID, err)
 			}
-			err = state.qcs.StoreTx(block.Header.QuorumCertificate())(tx)
+			err = qcs.StoreTx(block.Header.QuorumCertificate())(tx)
 			if err != nil {
 				return fmt.Errorf("could not store qc for SealingSegment extra block (id=%x): %w", blockID, err)
 			}
@@ -266,15 +318,15 @@ func (state *State) bootstrapSealingSegment(segment *flow.SealingSegment, head *
 			blockID := block.ID()
 			height := block.Header.Height
 
-			err := state.blocks.StoreTx(block)(tx)
+			err := blocks.StoreTx(block)(tx)
 			if err != nil {
 				return fmt.Errorf("could not insert SealingSegment block: %w", err)
 			}
-			err = transaction.WithTx(operation.IndexBlockHeight(height, blockID))(tx)
+			err = operation.IndexBlockHeight(height, blockID)(txn)
 			if err != nil {
 				return fmt.Errorf("could not index SealingSegment block (id=%x): %w", blockID, err)
 			}
-			err = state.qcs.StoreTx(block.Header.QuorumCertificate())(tx)
+			err = qcs.StoreTx(block.Header.QuorumCertificate())(tx)
 			if err != nil {
 				return fmt.Errorf("could not store qc for SealingSegment block (id=%x): %w", blockID, err)
 			}
@@ -286,18 +338,18 @@ func (state *State) bootstrapSealingSegment(segment *flow.SealingSegment, head *
 			}
 			// sanity check: make sure the seal exists
 			var latestSeal flow.Seal
-			err = transaction.WithTx(operation.RetrieveSeal(latestSealID, &latestSeal))(tx)
+			err = operation.RetrieveSeal(latestSealID, &latestSeal)(txn)
 			if err != nil {
 				return fmt.Errorf("could not verify latest seal for block (id=%x) exists: %w", blockID, err)
 			}
-			err = transaction.WithTx(operation.IndexLatestSealAtBlock(blockID, latestSealID))(tx)
+			err = operation.IndexLatestSealAtBlock(blockID, latestSealID)(txn)
 			if err != nil {
 				return fmt.Errorf("could not index block seal: %w", err)
 			}
 
 			// for all but the first block in the segment, index the parent->child relationship
 			if i > 0 {
-				err = transaction.WithTx(operation.InsertBlockChildren(block.Header.ParentID, []flow.Identifier{blockID}))(tx)
+				err = operation.InsertBlockChildren(block.Header.ParentID, []flow.Identifier{blockID})(txn)
 				if err != nil {
 					return fmt.Errorf("could not insert child index for block (id=%x): %w", blockID, err)
 				}
@@ -305,7 +357,7 @@ func (state *State) bootstrapSealingSegment(segment *flow.SealingSegment, head *
 		}
 
 		// insert an empty child index for the final block in the segment
-		err = transaction.WithTx(operation.InsertBlockChildren(head.ID(), nil))(tx)
+		err = operation.InsertBlockChildren(head.ID(), nil)(txn)
 		if err != nil {
 			return fmt.Errorf("could not insert child index for head block (id=%x): %w", head.ID(), err)
 		}
@@ -316,8 +368,8 @@ func (state *State) bootstrapSealingSegment(segment *flow.SealingSegment, head *
 
 // bootstrapStatePointers instantiates special pointers used to by the protocol
 // state to keep track of special block heights and views.
-func (state *State) bootstrapStatePointers(root protocol.Snapshot) func(*badger.Txn) error {
-	return func(tx *badger.Txn) error {
+func bootstrapStatePointers(root protocol.Snapshot) func(*transaction.Tx) error {
+	return func(tx *transaction.Tx) error {
 		segment, err := root.SealingSegment()
 		if err != nil {
 			return fmt.Errorf("could not get sealing segment: %w", err)
@@ -361,221 +413,170 @@ func (state *State) bootstrapStatePointers(root protocol.Snapshot) func(*badger.
 			NewestQC:    rootQC,
 		}
 
+		bdtx := tx.DBTxn // tx is just a wrapper around a badger transaction with the additional ability to register callbacks that are executed after the badger transaction completed _successfully_
 		// insert initial views for HotStuff
-		err = operation.InsertSafetyData(highest.Header.ChainID, safetyData)(tx)
+		err = operation.InsertSafetyData(highest.Header.ChainID, safetyData)(bdtx)
 		if err != nil {
 			return fmt.Errorf("could not insert safety data: %w", err)
 		}
-		err = operation.InsertLivenessData(highest.Header.ChainID, livenessData)(tx)
+		err = operation.InsertLivenessData(highest.Header.ChainID, livenessData)(bdtx)
 		if err != nil {
 			return fmt.Errorf("could not insert liveness data: %w", err)
 		}
 
 		// insert height pointers
-		err = operation.InsertRootHeight(highest.Header.Height)(tx)
+		err = operation.InsertRootHeight(highest.Header.Height)(bdtx)
 		if err != nil {
 			return fmt.Errorf("could not insert finalized root height: %w", err)
 		}
 		// the sealed root height is the lowest block in sealing segment
-		err = operation.InsertSealedRootHeight(lowest.Header.Height)(tx)
+		err = operation.InsertSealedRootHeight(lowest.Header.Height)(bdtx)
 		if err != nil {
 			return fmt.Errorf("could not insert sealed root height: %w", err)
 		}
-		err = operation.InsertFinalizedHeight(highest.Header.Height)(tx)
+		err = operation.InsertFinalizedHeight(highest.Header.Height)(bdtx)
 		if err != nil {
 			return fmt.Errorf("could not insert finalized height: %w", err)
 		}
-		err = operation.InsertSealedHeight(lowest.Header.Height)(tx)
+		err = operation.InsertSealedHeight(lowest.Header.Height)(bdtx)
 		if err != nil {
 			return fmt.Errorf("could not insert sealed height: %w", err)
 		}
-		err = operation.IndexFinalizedSealByBlockID(seal.BlockID, seal.ID())(tx)
+		err = operation.IndexFinalizedSealByBlockID(seal.BlockID, seal.ID())(bdtx)
 		if err != nil {
 			return fmt.Errorf("could not index sealed block: %w", err)
 		}
 
+		// insert first-height indices for epochs which have started
+		hasPrevious, err := protocol.PreviousEpochExists(root)
+		if err != nil {
+			return fmt.Errorf("could not check existence of previous epoch: %w", err)
+		}
+		if hasPrevious {
+			err = indexFirstHeight(root.Epochs().Previous())(bdtx)
+			if err != nil {
+				return fmt.Errorf("could not index previous epoch first height: %w", err)
+			}
+		}
+		err = indexFirstHeight(root.Epochs().Current())(bdtx)
+		if err != nil {
+			return fmt.Errorf("could not index current epoch first height: %w", err)
+		}
+
 		return nil
 	}
 }
 
 // bootstrapEpoch bootstraps the protocol state database with information about
 // the previous, current, and next epochs as of the root snapshot.
-//
-// The root snapshot's sealing segment must not straddle any epoch transitions
-// or epoch phase transitions.
-func (state *State) bootstrapEpoch(epochs protocol.EpochQuery, segment *flow.SealingSegment, verifyNetworkAddress bool) func(*transaction.Tx) error {
+func bootstrapEpoch(
+	epochSetups storage.EpochSetups,
+	epochCommits storage.EpochCommits,
+	rootProtocolState protocol.DynamicProtocolState,
+	verifyNetworkAddress bool,
+) func(*transaction.Tx) error {
 	return func(tx *transaction.Tx) error {
-		previous := epochs.Previous()
-		current := epochs.Current()
-		next := epochs.Next()
+		richEntry := rootProtocolState.Entry()
 
-		// build the status as we go
-		status := new(flow.EpochStatus)
+		// keep track of EpochSetup/EpochCommit service events, then store them after this step is complete
 		var setups []*flow.EpochSetup
 		var commits []*flow.EpochCommit
 
-		// insert previous epoch if it exists
-		_, err := previous.Counter()
-		if err == nil {
+		// validate and insert previous epoch if it exists
+		if rootProtocolState.PreviousEpochExists() {
 			// if there is a previous epoch, both setup and commit events must exist
-			setup, err := protocol.ToEpochSetup(previous)
-			if err != nil {
-				return fmt.Errorf("could not get previous epoch setup event: %w", err)
-			}
-			commit, err := protocol.ToEpochCommit(previous)
-			if err != nil {
-				return fmt.Errorf("could not get previous epoch commit event: %w", err)
-			}
+			setup := richEntry.PreviousEpochSetup
+			commit := richEntry.PreviousEpochCommit
 
-			if err := verifyEpochSetup(setup, verifyNetworkAddress); err != nil {
-				return fmt.Errorf("invalid setup: %w", err)
+			if err := protocol.IsValidEpochSetup(setup, verifyNetworkAddress); err != nil {
+				return fmt.Errorf("invalid EpochSetup for previous epoch: %w", err)
 			}
-			if err := isValidEpochCommit(commit, setup); err != nil {
-				return fmt.Errorf("invalid commit: %w", err)
-			}
-
-			err = indexFirstHeight(previous)(tx.DBTxn)
-			if err != nil {
-				return fmt.Errorf("could not index epoch first height: %w", err)
+			if err := protocol.IsValidEpochCommit(commit, setup); err != nil {
+				return fmt.Errorf("invalid EpochCommit for previous epoch: %w", err)
 			}
 
 			setups = append(setups, setup)
 			commits = append(commits, commit)
-			status.PreviousEpoch.SetupID = setup.ID()
-			status.PreviousEpoch.CommitID = commit.ID()
-		} else if !errors.Is(err, protocol.ErrNoPreviousEpoch) {
-			return fmt.Errorf("could not retrieve previous epoch: %w", err)
 		}
 
-		// insert current epoch - both setup and commit events must exist
-		setup, err := protocol.ToEpochSetup(current)
-		if err != nil {
-			return fmt.Errorf("could not get current epoch setup event: %w", err)
-		}
-		commit, err := protocol.ToEpochCommit(current)
-		if err != nil {
-			return fmt.Errorf("could not get current epoch commit event: %w", err)
-		}
+		// validate and insert current epoch
+		setup := richEntry.CurrentEpochSetup
+		commit := richEntry.CurrentEpochCommit
 
-		if err := verifyEpochSetup(setup, verifyNetworkAddress); err != nil {
-			return fmt.Errorf("invalid setup: %w", err)
+		if err := protocol.IsValidEpochSetup(setup, verifyNetworkAddress); err != nil {
+			return fmt.Errorf("invalid EpochSetup for current epoch: %w", err)
 		}
-		if err := isValidEpochCommit(commit, setup); err != nil {
-			return fmt.Errorf("invalid commit: %w", err)
-		}
-
-		err = indexFirstHeight(current)(tx.DBTxn)
-		if err != nil {
-			return fmt.Errorf("could not index epoch first height: %w", err)
+		if err := protocol.IsValidEpochCommit(commit, setup); err != nil {
+			return fmt.Errorf("invalid EpochCommit for current epoch: %w", err)
 		}
 
 		setups = append(setups, setup)
 		commits = append(commits, commit)
-		status.CurrentEpoch.SetupID = setup.ID()
-		status.CurrentEpoch.CommitID = commit.ID()
-
-		// insert next epoch, if it exists
-		_, err = next.Counter()
-		if err == nil {
-			// either only the setup event, or both the setup and commit events must exist
-			setup, err := protocol.ToEpochSetup(next)
-			if err != nil {
-				return fmt.Errorf("could not get next epoch setup event: %w", err)
-			}
 
-			if err := verifyEpochSetup(setup, verifyNetworkAddress); err != nil {
-				return fmt.Errorf("invalid setup: %w", err)
-			}
+		// validate and insert next epoch, if it exists
+		if richEntry.NextEpoch != nil {
+			setup := richEntry.NextEpochSetup   // must not be nil
+			commit := richEntry.NextEpochCommit // may be nil
 
-			setups = append(setups, setup)
-			status.NextEpoch.SetupID = setup.ID()
-			commit, err := protocol.ToEpochCommit(next)
-			if err != nil && !errors.Is(err, protocol.ErrNextEpochNotCommitted) {
-				return fmt.Errorf("could not get next epoch commit event: %w", err)
+			if err := protocol.IsValidEpochSetup(setup, verifyNetworkAddress); err != nil {
+				return fmt.Errorf("invalid EpochSetup for next epoch: %w", err)
 			}
-			if err == nil {
-				if err := isValidEpochCommit(commit, setup); err != nil {
-					return fmt.Errorf("invalid commit")
+			setups = append(setups, setup)
+
+			if commit != nil {
+				if err := protocol.IsValidEpochCommit(commit, setup); err != nil {
+					return fmt.Errorf("invalid EpochCommit for next epoch")
 				}
 				commits = append(commits, commit)
-				status.NextEpoch.CommitID = commit.ID()
 			}
-		} else if !errors.Is(err, protocol.ErrNextEpochNotSetup) {
-			return fmt.Errorf("could not get next epoch: %w", err)
-		}
-
-		// sanity check: ensure epoch status is valid
-		err = status.Check()
-		if err != nil {
-			return fmt.Errorf("bootstrapping resulting in invalid epoch status: %w", err)
 		}
 
 		// insert all epoch setup/commit service events
+		// dynamic protocol state relies on these events being stored
 		for _, setup := range setups {
-			err = state.epoch.setups.StoreTx(setup)(tx)
+			err := epochSetups.StoreTx(setup)(tx)
 			if err != nil {
 				return fmt.Errorf("could not store epoch setup event: %w", err)
 			}
 		}
 		for _, commit := range commits {
-			err = state.epoch.commits.StoreTx(commit)(tx)
+			err := epochCommits.StoreTx(commit)(tx)
 			if err != nil {
 				return fmt.Errorf("could not store epoch commit event: %w", err)
 			}
 		}
 
-		// NOTE: as specified in the godoc, this code assumes that each block
-		// in the sealing segment in within the same phase within the same epoch.
-		for _, block := range segment.AllBlocks() {
-			blockID := block.ID()
-			err = state.epoch.statuses.StoreTx(blockID, status)(tx)
-			if err != nil {
-				return fmt.Errorf("could not store epoch status for block (id=%x): %w", blockID, err)
-			}
-		}
-
 		return nil
 	}
 }
 
 // bootstrapSporkInfo bootstraps the protocol state with information about the
 // spork which is used to disambiguate Flow networks.
-func (state *State) bootstrapSporkInfo(root protocol.Snapshot) func(*badger.Txn) error {
-	return func(tx *badger.Txn) error {
-		params := root.Params()
+func bootstrapSporkInfo(root protocol.Snapshot) func(*transaction.Tx) error {
+	return func(tx *transaction.Tx) error {
+		bdtx := tx.DBTxn // tx is just a wrapper around a badger transaction with the additional ability to register callbacks that are executed after the badger transaction completed _successfully_
 
-		sporkID, err := params.SporkID()
-		if err != nil {
-			return fmt.Errorf("could not get spork ID: %w", err)
-		}
-		err = operation.InsertSporkID(sporkID)(tx)
+		params := root.Params()
+		sporkID := params.SporkID()
+		err := operation.InsertSporkID(sporkID)(bdtx)
 		if err != nil {
 			return fmt.Errorf("could not insert spork ID: %w", err)
 		}
 
-		sporkRootBlockHeight, err := params.SporkRootBlockHeight()
-		if err != nil {
-			return fmt.Errorf("could not get spork root block height: %w", err)
-		}
-		err = operation.InsertSporkRootBlockHeight(sporkRootBlockHeight)(tx)
+		sporkRootBlockHeight := params.SporkRootBlockHeight()
+		err = operation.InsertSporkRootBlockHeight(sporkRootBlockHeight)(bdtx)
 		if err != nil {
 			return fmt.Errorf("could not insert spork root block height: %w", err)
 		}
 
-		version, err := params.ProtocolVersion()
-		if err != nil {
-			return fmt.Errorf("could not get protocol version: %w", err)
-		}
-		err = operation.InsertProtocolVersion(version)(tx)
+		version := params.ProtocolVersion()
+		err = operation.InsertProtocolVersion(version)(bdtx)
 		if err != nil {
 			return fmt.Errorf("could not insert protocol version: %w", err)
 		}
 
-		threshold, err := params.EpochCommitSafetyThreshold()
-		if err != nil {
-			return fmt.Errorf("could not get epoch commit safety threshold: %w", err)
-		}
-		err = operation.InsertEpochCommitSafetyThreshold(threshold)(tx)
+		threshold := params.EpochCommitSafetyThreshold()
+		err = operation.InsertEpochCommitSafetyThreshold(threshold)(bdtx)
 		if err != nil {
 			return fmt.Errorf("could not insert epoch commit safety threshold: %w", err)
 		}
@@ -615,7 +616,7 @@ func OpenState(
 	qcs storage.QuorumCertificates,
 	setups storage.EpochSetups,
 	commits storage.EpochCommits,
-	statuses storage.EpochStatuses,
+	protocolState storage.ProtocolState,
 	versionBeacons storage.VersionBeacons,
 ) (*State, error) {
 	isBootstrapped, err := IsBootstrapped(db)
@@ -625,7 +626,20 @@ func OpenState(
 	if !isBootstrapped {
 		return nil, fmt.Errorf("expected database to contain bootstrapped state")
 	}
-	state := newState(
+	globalParams, err := ReadGlobalParams(db)
+	if err != nil {
+		return nil, fmt.Errorf("could not read global params: %w", err)
+	}
+	instanceParams, err := ReadInstanceParams(db, headers, seals)
+	if err != nil {
+		return nil, fmt.Errorf("could not read instance params: %w", err)
+	}
+	params := &Params{
+		GlobalParams:   globalParams,
+		InstanceParams: instanceParams,
+	}
+
+	state, err := newState(
 		metrics,
 		db,
 		headers,
@@ -635,12 +649,12 @@ func OpenState(
 		qcs,
 		setups,
 		commits,
-		statuses,
+		protocolState,
 		versionBeacons,
-	) // populate the protocol state cache
-	err = state.populateCache()
+		params,
+	)
 	if err != nil {
-		return nil, fmt.Errorf("failed to populate cache: %w", err)
+		return nil, fmt.Errorf("could not create state: %w", err)
 	}
 
 	// report last finalized and sealed block height
@@ -657,8 +671,13 @@ func OpenState(
 	}
 	metrics.SealedHeight(sealed.Height)
 
+	epochFallbackTriggered, err := state.isEpochEmergencyFallbackTriggered()
+	if err != nil {
+		return nil, fmt.Errorf("could not check epoch emergency fallback flag: %w", err)
+	}
+
 	// update all epoch related metrics
-	err = state.updateEpochMetrics(finalSnapshot)
+	err = updateEpochMetrics(metrics, finalSnapshot, epochFallbackTriggered)
 	if err != nil {
 		return nil, fmt.Errorf("failed to update epoch metrics: %w", err)
 	}
@@ -667,13 +686,13 @@ func OpenState(
 }
 
 func (state *State) Params() protocol.Params {
-	return Params{state: state}
+	return state.params
 }
 
 // Sealed returns a snapshot for the latest sealed block. A latest sealed block
 // must always exist, so this function always returns a valid snapshot.
 func (state *State) Sealed() protocol.Snapshot {
-	cached := state.cachedSealed.Load()
+	cached := state.cachedLatestSealed.Load()
 	if cached == nil {
 		return invalid.NewSnapshotf("internal inconsistency: no cached sealed header")
 	}
@@ -683,7 +702,7 @@ func (state *State) Sealed() protocol.Snapshot {
 // Final returns a snapshot for the latest finalized block. A latest finalized
 // block must always exist, so this function always returns a valid snapshot.
 func (state *State) Final() protocol.Snapshot {
-	cached := state.cachedFinal.Load()
+	cached := state.cachedLatestFinal.Load()
 	if cached == nil {
 		return invalid.NewSnapshotf("internal inconsistency: no cached final header")
 	}
@@ -741,10 +760,11 @@ func newState(
 	qcs storage.QuorumCertificates,
 	setups storage.EpochSetups,
 	commits storage.EpochCommits,
-	statuses storage.EpochStatuses,
+	protocolStateSnapshots storage.ProtocolState,
 	versionBeacons storage.VersionBeacons,
-) *State {
-	return &State{
+	params protocol.Params,
+) (*State, error) {
+	state := &State{
 		metrics: metrics,
 		db:      db,
 		headers: headers,
@@ -753,18 +773,34 @@ func newState(
 		blocks:  blocks,
 		qcs:     qcs,
 		epoch: struct {
-			setups   storage.EpochSetups
-			commits  storage.EpochCommits
-			statuses storage.EpochStatuses
+			setups  storage.EpochSetups
+			commits storage.EpochCommits
 		}{
-			setups:   setups,
-			commits:  commits,
-			statuses: statuses,
+			setups:  setups,
+			commits: commits,
 		},
-		versionBeacons: versionBeacons,
-		cachedFinal:    new(atomic.Pointer[cachedHeader]),
-		cachedSealed:   new(atomic.Pointer[cachedHeader]),
+		params:                   params,
+		protocolStateSnapshotsDB: protocolStateSnapshots,
+		protocolState: protocol_state.NewMutableProtocolState(
+			protocolStateSnapshots,
+			params,
+			headers,
+			results,
+			setups,
+			commits,
+		),
+		versionBeacons:     versionBeacons,
+		cachedLatestFinal:  new(atomic.Pointer[cachedHeader]),
+		cachedLatestSealed: new(atomic.Pointer[cachedHeader]),
+	}
+
+	// populate the protocol state cache
+	err := state.populateCache()
+	if err != nil {
+		return nil, fmt.Errorf("failed to populate cache: %w", err)
 	}
+
+	return state, nil
 }
 
 // IsBootstrapped returns whether the database contains a bootstrapped state
@@ -782,51 +818,41 @@ func IsBootstrapped(db *badger.DB) (bool, error) {
 
 // updateEpochMetrics update the `consensus_compliance_current_epoch_counter` and the
 // `consensus_compliance_current_epoch_phase` metric
-func (state *State) updateEpochMetrics(snap protocol.Snapshot) error {
+func updateEpochMetrics(metrics module.ComplianceMetrics, snap protocol.Snapshot, epochFallbackTriggered bool) error {
 
 	// update epoch counter
 	counter, err := snap.Epochs().Current().Counter()
 	if err != nil {
 		return fmt.Errorf("could not get current epoch counter: %w", err)
 	}
-	state.metrics.CurrentEpochCounter(counter)
+	metrics.CurrentEpochCounter(counter)
 
 	// update epoch phase
 	phase, err := snap.Phase()
 	if err != nil {
 		return fmt.Errorf("could not get current epoch counter: %w", err)
 	}
-	state.metrics.CurrentEpochPhase(phase)
-
-	// update committed epoch final view
-	err = state.updateCommittedEpochFinalView(snap)
-	if err != nil {
-		return fmt.Errorf("could not update committed epoch final view")
-	}
+	metrics.CurrentEpochPhase(phase)
 
 	currentEpochFinalView, err := snap.Epochs().Current().FinalView()
 	if err != nil {
 		return fmt.Errorf("could not update current epoch final view: %w", err)
 	}
-	state.metrics.CurrentEpochFinalView(currentEpochFinalView)
+	metrics.CurrentEpochFinalView(currentEpochFinalView)
 
 	dkgPhase1FinalView, dkgPhase2FinalView, dkgPhase3FinalView, err := protocol.DKGPhaseViews(snap.Epochs().Current())
 	if err != nil {
 		return fmt.Errorf("could not get dkg phase final view: %w", err)
 	}
 
-	state.metrics.CurrentDKGPhase1FinalView(dkgPhase1FinalView)
-	state.metrics.CurrentDKGPhase2FinalView(dkgPhase2FinalView)
-	state.metrics.CurrentDKGPhase3FinalView(dkgPhase3FinalView)
+	metrics.CurrentDKGPhase1FinalView(dkgPhase1FinalView)
+	metrics.CurrentDKGPhase2FinalView(dkgPhase2FinalView)
+	metrics.CurrentDKGPhase3FinalView(dkgPhase3FinalView)
 
-	// EECC - check whether the epoch emergency fallback flag has been set
+	// EFM - check whether the epoch emergency fallback flag has been set
 	// in the database. If so, skip updating any epoch-related metrics.
-	epochFallbackTriggered, err := state.isEpochEmergencyFallbackTriggered()
-	if err != nil {
-		return fmt.Errorf("could not check epoch emergency fallback flag: %w", err)
-	}
 	if epochFallbackTriggered {
-		state.metrics.EpochEmergencyFallbackTriggered()
+		metrics.EpochEmergencyFallbackTriggered()
 	}
 
 	return nil
@@ -834,20 +860,16 @@ func (state *State) updateEpochMetrics(snap protocol.Snapshot) error {
 
 // boostrapVersionBeacon bootstraps version beacon, by adding the latest beacon
 // to an index, if present.
-func (state *State) boostrapVersionBeacon(
-	snapshot protocol.Snapshot,
-) func(*badger.Txn) error {
-	return func(txn *badger.Txn) error {
+func boostrapVersionBeacon(snapshot protocol.Snapshot) func(*transaction.Tx) error {
+	return func(tx *transaction.Tx) error {
 		versionBeacon, err := snapshot.VersionBeacon()
 		if err != nil {
 			return err
 		}
-
 		if versionBeacon == nil {
 			return nil
 		}
-
-		return operation.IndexVersionBeaconByHeight(versionBeacon)(txn)
+		return operation.IndexVersionBeaconByHeight(versionBeacon)(tx.DBTxn)
 	}
 }
 
@@ -855,27 +877,11 @@ func (state *State) boostrapVersionBeacon(
 // The cache must be populated before the State receives any queries.
 // No errors expected during normal operations.
 func (state *State) populateCache() error {
-
 	// cache the initial value for finalized block
 	err := state.db.View(func(tx *badger.Txn) error {
-		// root height
-		err := state.db.View(operation.RetrieveRootHeight(&state.finalizedRootHeight))
-		if err != nil {
-			return fmt.Errorf("could not read root block to populate cache: %w", err)
-		}
-		// sealed root height
-		err = state.db.View(operation.RetrieveSealedRootHeight(&state.sealedRootHeight))
-		if err != nil {
-			return fmt.Errorf("could not read sealed root block to populate cache: %w", err)
-		}
-		// spork root block height
-		err = state.db.View(operation.RetrieveSporkRootBlockHeight(&state.sporkRootBlockHeight))
-		if err != nil {
-			return fmt.Errorf("could not get spork root block height: %w", err)
-		}
 		// finalized header
 		var finalizedHeight uint64
-		err = operation.RetrieveFinalizedHeight(&finalizedHeight)(tx)
+		err := operation.RetrieveFinalizedHeight(&finalizedHeight)(tx)
 		if err != nil {
 			return fmt.Errorf("could not lookup finalized height: %w", err)
 		}
@@ -888,7 +894,7 @@ func (state *State) populateCache() error {
 		if err != nil {
 			return fmt.Errorf("could not get finalized block (id=%x): %w", cachedFinalHeader.id, err)
 		}
-		state.cachedFinal.Store(&cachedFinalHeader)
+		state.cachedLatestFinal.Store(&cachedFinalHeader)
 		// sealed header
 		var sealedHeight uint64
 		err = operation.RetrieveSealedHeight(&sealedHeight)(tx)
@@ -904,7 +910,12 @@ func (state *State) populateCache() error {
 		if err != nil {
 			return fmt.Errorf("could not get sealed block (id=%x): %w", cachedSealedHeader.id, err)
 		}
-		state.cachedSealed.Store(&cachedSealedHeader)
+		state.cachedLatestSealed.Store(&cachedSealedHeader)
+
+		state.finalizedRootHeight = state.Params().FinalizedRoot().Height
+		state.sealedRootHeight = state.Params().SealedRoot().Height
+		state.sporkRootBlockHeight = state.Params().SporkRootBlockHeight()
+
 		return nil
 	})
 	if err != nil {
@@ -914,45 +925,6 @@ func (state *State) populateCache() error {
 	return nil
 }
 
-// updateCommittedEpochFinalView updates the `committed_epoch_final_view` metric
-// based on the current epoch phase of the input snapshot. It should be called
-// at startup and during transitions between EpochSetup and EpochCommitted phases.
-//
-// For example, suppose we have epochs N and N+1.
-// If we are in epoch N's Staking or Setup Phase, then epoch N's final view should be the value of the metric.
-// If we are in epoch N's Committed Phase, then epoch N+1's final view should be the value of the metric.
-func (state *State) updateCommittedEpochFinalView(snap protocol.Snapshot) error {
-
-	phase, err := snap.Phase()
-	if err != nil {
-		return fmt.Errorf("could not get epoch phase: %w", err)
-	}
-
-	// update metric based of epoch phase
-	switch phase {
-	case flow.EpochPhaseStaking, flow.EpochPhaseSetup:
-
-		// if we are in Staking or Setup phase, then set the metric value to the current epoch's final view
-		finalView, err := snap.Epochs().Current().FinalView()
-		if err != nil {
-			return fmt.Errorf("could not get current epoch final view from snapshot: %w", err)
-		}
-		state.metrics.CommittedEpochFinalView(finalView)
-	case flow.EpochPhaseCommitted:
-
-		// if we are in Committed phase, then set the metric value to the next epoch's final view
-		finalView, err := snap.Epochs().Next().FinalView()
-		if err != nil {
-			return fmt.Errorf("could not get next epoch final view from snapshot: %w", err)
-		}
-		state.metrics.CommittedEpochFinalView(finalView)
-	default:
-		return fmt.Errorf("invalid phase: %s", phase)
-	}
-
-	return nil
-}
-
 // isEpochEmergencyFallbackTriggered checks whether epoch fallback has been globally triggered.
 // Returns:
 // * (true, nil) if epoch fallback is triggered
diff --git a/state/protocol/badger/state_test.go b/state/protocol/badger/state_test.go
index c6bcc59854f..91e1f23da64 100644
--- a/state/protocol/badger/state_test.go
+++ b/state/protocol/badger/state_test.go
@@ -46,7 +46,6 @@ func TestBootstrapAndOpen(t *testing.T) {
 		require.NoError(t, err)
 
 		complianceMetrics := new(mock.ComplianceMetrics)
-		complianceMetrics.On("CommittedEpochFinalView", finalView).Once()
 		complianceMetrics.On("CurrentEpochCounter", counter).Once()
 		complianceMetrics.On("CurrentEpochPhase", phase).Once()
 		complianceMetrics.On("CurrentEpochFinalView", finalView).Once()
@@ -72,7 +71,7 @@ func TestBootstrapAndOpen(t *testing.T) {
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 		)
 		require.NoError(t, err)
@@ -101,8 +100,8 @@ func TestBootstrapAndOpen_EpochCommitted(t *testing.T) {
 	require.NoError(t, err)
 
 	// build an epoch on the root state and return a snapshot from the committed phase
-	committedPhaseSnapshot := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState) protocol.Snapshot {
-		unittest.NewEpochBuilder(t, state).BuildEpoch().CompleteEpoch()
+	committedPhaseSnapshot := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState, mutableState protocol.MutableProtocolState) protocol.Snapshot {
+		unittest.NewEpochBuilder(t, mutableState, state).BuildEpoch().CompleteEpoch()
 
 		// find the point where we transition to the epoch committed phase
 		for height := rootBlock.Height + 1; ; height++ {
@@ -118,11 +117,6 @@ func TestBootstrapAndOpen_EpochCommitted(t *testing.T) {
 
 		complianceMetrics := new(mock.ComplianceMetrics)
 
-		// expect the final view metric to be set to next epoch's final view
-		finalView, err := committedPhaseSnapshot.Epochs().Next().FinalView()
-		require.NoError(t, err)
-		complianceMetrics.On("CommittedEpochFinalView", finalView).Once()
-
 		// expect counter to be set to current epochs counter
 		counter, err := committedPhaseSnapshot.Epochs().Current().Counter()
 		require.NoError(t, err)
@@ -157,7 +151,7 @@ func TestBootstrapAndOpen_EpochCommitted(t *testing.T) {
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 		)
 		require.NoError(t, err)
@@ -190,8 +184,8 @@ func TestBootstrap_EpochHeightBoundaries(t *testing.T) {
 	})
 
 	t.Run("with next epoch", func(t *testing.T) {
-		after := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState) protocol.Snapshot {
-			builder := unittest.NewEpochBuilder(t, state)
+		after := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState, mutableState protocol.MutableProtocolState) protocol.Snapshot {
+			builder := unittest.NewEpochBuilder(t, mutableState, state)
 			builder.BuildEpoch().CompleteEpoch()
 			heights, ok := builder.EpochHeights(1)
 			require.True(t, ok)
@@ -217,8 +211,8 @@ func TestBootstrap_EpochHeightBoundaries(t *testing.T) {
 	t.Run("with previous epoch", func(t *testing.T) {
 		var epoch1FinalHeight uint64
 		var epoch2FirstHeight uint64
-		after := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState) protocol.Snapshot {
-			builder := unittest.NewEpochBuilder(t, state)
+		after := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState, mutableState protocol.MutableProtocolState) protocol.Snapshot {
+			builder := unittest.NewEpochBuilder(t, mutableState, state)
 			builder.
 				BuildEpoch().CompleteEpoch(). // build epoch 2
 				BuildEpoch()                  // build epoch 3
@@ -260,26 +254,34 @@ func TestBootstrapNonRoot(t *testing.T) {
 	// start with a regular post-spork root snapshot
 	participants := unittest.CompleteIdentitySet()
 	rootSnapshot := unittest.RootSnapshotFixture(participants)
+	rootProtocolStateID := getRootProtocolStateID(t, rootSnapshot)
 	rootBlock, err := rootSnapshot.Head()
 	require.NoError(t, err)
 
 	// should be able to bootstrap from snapshot after sealing a non-root block
 	// ROOT <- B1 <- B2(R1) <- B3(S1) <- CHILD
 	t.Run("with sealed block", func(t *testing.T) {
-		after := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState) protocol.Snapshot {
+		after := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState, mutableState protocol.MutableProtocolState) protocol.Snapshot {
 			block1 := unittest.BlockWithParentFixture(rootBlock)
+			block1.SetPayload(unittest.PayloadFixture(unittest.WithProtocolStateID(rootProtocolStateID)))
 			buildFinalizedBlock(t, state, block1)
 
 			receipt1, seal1 := unittest.ReceiptAndSealForBlock(block1)
 			block2 := unittest.BlockWithParentFixture(block1.Header)
-			block2.SetPayload(unittest.PayloadFixture(unittest.WithReceipts(receipt1)))
+			block2.SetPayload(unittest.PayloadFixture(
+				unittest.WithReceipts(receipt1),
+				unittest.WithProtocolStateID(rootProtocolStateID)))
 			buildFinalizedBlock(t, state, block2)
 
+			seals := []*flow.Seal{seal1}
 			block3 := unittest.BlockWithParentFixture(block2.Header)
-			block3.SetPayload(unittest.PayloadFixture(unittest.WithSeals(seal1)))
+			block3.SetPayload(flow.Payload{
+				Seals:           seals,
+				ProtocolStateID: calculateExpectedStateId(t, mutableState)(block3.Header, seals),
+			})
 			buildFinalizedBlock(t, state, block3)
 
-			child := unittest.BlockWithParentFixture(block3.Header)
+			child := unittest.BlockWithParentProtocolState(block3)
 			buildBlock(t, state, child)
 
 			return state.AtBlockID(block3.ID())
@@ -302,8 +304,8 @@ func TestBootstrapNonRoot(t *testing.T) {
 	})
 
 	t.Run("with setup next epoch", func(t *testing.T) {
-		after := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState) protocol.Snapshot {
-			unittest.NewEpochBuilder(t, state).BuildEpoch()
+		after := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState, mutableState protocol.MutableProtocolState) protocol.Snapshot {
+			unittest.NewEpochBuilder(t, mutableState, state).BuildEpoch()
 
 			// find the point where we transition to the epoch setup phase
 			for height := rootBlock.Height + 1; ; height++ {
@@ -322,8 +324,8 @@ func TestBootstrapNonRoot(t *testing.T) {
 	})
 
 	t.Run("with committed next epoch", func(t *testing.T) {
-		after := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState) protocol.Snapshot {
-			unittest.NewEpochBuilder(t, state).BuildEpoch().CompleteEpoch()
+		after := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState, mutableState protocol.MutableProtocolState) protocol.Snapshot {
+			unittest.NewEpochBuilder(t, mutableState, state).BuildEpoch().CompleteEpoch()
 
 			// find the point where we transition to the epoch committed phase
 			for height := rootBlock.Height + 1; ; height++ {
@@ -342,8 +344,8 @@ func TestBootstrapNonRoot(t *testing.T) {
 	})
 
 	t.Run("with previous and next epoch", func(t *testing.T) {
-		after := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState) protocol.Snapshot {
-			unittest.NewEpochBuilder(t, state).
+		after := snapshotAfter(t, rootSnapshot, func(state *bprotocol.FollowerState, mutableState protocol.MutableProtocolState) protocol.Snapshot {
+			unittest.NewEpochBuilder(t, mutableState, state).
 				BuildEpoch().CompleteEpoch(). // build epoch 2
 				BuildEpoch()                  // build epoch 3
 
@@ -382,7 +384,7 @@ func TestBootstrap_InvalidIdentities(t *testing.T) {
 	})
 
 	t.Run("zero weight", func(t *testing.T) {
-		zeroWeightIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification), unittest.WithWeight(0))
+		zeroWeightIdentity := unittest.IdentityFixture(unittest.WithRole(flow.RoleVerification), unittest.WithInitialWeight(0))
 		participants := unittest.CompleteIdentitySet(zeroWeightIdentity)
 		root := unittest.RootSnapshotFixture(participants)
 		bootstrap(t, root, func(state *bprotocol.State, err error) {
@@ -426,7 +428,7 @@ func TestBootstrap_InvalidIdentities(t *testing.T) {
 		// randomly shuffle the identities so they are not canonically ordered
 		encodable := root.Encodable()
 		var err error
-		encodable.Identities, err = participants.Shuffle()
+		encodable.Epochs.Current.InitialIdentities, err = participants.ToSkeleton().Shuffle()
 		require.NoError(t, err)
 		root = inmem.SnapshotFromEncodable(encodable)
 		bootstrap(t, root, func(state *bprotocol.State, err error) {
@@ -541,7 +543,7 @@ func bootstrap(t *testing.T, rootSnapshot protocol.Snapshot, f func(*bprotocol.S
 		all.QuorumCertificates,
 		all.Setups,
 		all.EpochCommits,
-		all.Statuses,
+		all.ProtocolState,
 		all.VersionBeacons,
 		rootSnapshot,
 	)
@@ -554,10 +556,10 @@ func bootstrap(t *testing.T, rootSnapshot protocol.Snapshot, f func(*bprotocol.S
 //
 // This is used for generating valid snapshots to use when testing bootstrapping
 // from non-root states.
-func snapshotAfter(t *testing.T, rootSnapshot protocol.Snapshot, f func(*bprotocol.FollowerState) protocol.Snapshot) protocol.Snapshot {
+func snapshotAfter(t *testing.T, rootSnapshot protocol.Snapshot, f func(*bprotocol.FollowerState, protocol.MutableProtocolState) protocol.Snapshot) protocol.Snapshot {
 	var after protocol.Snapshot
-	protoutil.RunWithFollowerProtocolState(t, rootSnapshot, func(_ *badger.DB, state *bprotocol.FollowerState) {
-		snap := f(state)
+	protoutil.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(_ *badger.DB, state *bprotocol.ParticipantState, mutableState protocol.MutableProtocolState) {
+		snap := f(state.FollowerState, mutableState)
 		var err error
 		after, err = inmem.FromSnapshot(snap)
 		require.NoError(t, err)
@@ -585,8 +587,7 @@ func assertSealingSegmentBlocksQueryableAfterBootstrap(t *testing.T, snapshot pr
 		segment, err := state.Final().SealingSegment()
 		require.NoError(t, err)
 
-		rootBlock, err := state.Params().FinalizedRoot()
-		require.NoError(t, err)
+		rootBlock := state.Params().FinalizedRoot()
 
 		// root block should be the highest block from the sealing segment
 		assert.Equal(t, segment.Highest().Header, rootBlock)
diff --git a/state/protocol/badger/validity.go b/state/protocol/badger/validity.go
index acece515f64..e6db77d8974 100644
--- a/state/protocol/badger/validity.go
+++ b/state/protocol/badger/validity.go
@@ -8,190 +8,10 @@ import (
 	"github.com/onflow/flow-go/consensus/hotstuff/validator"
 	"github.com/onflow/flow-go/consensus/hotstuff/verification"
 	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/model/flow/factory"
 	"github.com/onflow/flow-go/model/flow/filter"
 	"github.com/onflow/flow-go/state/protocol"
 )
 
-// isValidExtendingEpochSetup checks whether an epoch setup service being
-// added to the state is valid. In addition to intrinsic validity, we also
-// check that it is valid w.r.t. the previous epoch setup event, and the
-// current epoch status.
-// Assumes all inputs besides extendingSetup are already validated.
-// Expected errors during normal operations:
-// * protocol.InvalidServiceEventError if the input service event is invalid to extend the currently active epoch status
-func isValidExtendingEpochSetup(extendingSetup *flow.EpochSetup, activeSetup *flow.EpochSetup, status *flow.EpochStatus) error {
-	// We should only have a single epoch setup event per epoch.
-	if status.NextEpoch.SetupID != flow.ZeroID {
-		// true iff EpochSetup event for NEXT epoch was already included before
-		return protocol.NewInvalidServiceEventErrorf("duplicate epoch setup service event: %x", status.NextEpoch.SetupID)
-	}
-
-	// The setup event should have the counter increased by one.
-	if extendingSetup.Counter != activeSetup.Counter+1 {
-		return protocol.NewInvalidServiceEventErrorf("next epoch setup has invalid counter (%d => %d)", activeSetup.Counter, extendingSetup.Counter)
-	}
-
-	// The first view needs to be exactly one greater than the current epoch final view
-	if extendingSetup.FirstView != activeSetup.FinalView+1 {
-		return protocol.NewInvalidServiceEventErrorf(
-			"next epoch first view must be exactly 1 more than current epoch final view (%d != %d+1)",
-			extendingSetup.FirstView,
-			activeSetup.FinalView,
-		)
-	}
-
-	// Finally, the epoch setup event must contain all necessary information.
-	err := verifyEpochSetup(extendingSetup, true)
-	if err != nil {
-		return protocol.NewInvalidServiceEventErrorf("invalid epoch setup: %w", err)
-	}
-
-	return nil
-}
-
-// verifyEpochSetup checks whether an `EpochSetup` event is syntactically correct.
-// The boolean parameter `verifyNetworkAddress` controls, whether we want to permit
-// nodes to share a networking address.
-// This is a side-effect-free function. Any error return indicates that the
-// EpochSetup event is not compliant with protocol rules.
-func verifyEpochSetup(setup *flow.EpochSetup, verifyNetworkAddress bool) error {
-	// STEP 1: general sanity checks
-	// the seed needs to be at least minimum length
-	if len(setup.RandomSource) != flow.EpochSetupRandomSourceLength {
-		return fmt.Errorf("seed has incorrect length (%d != %d)", len(setup.RandomSource), flow.EpochSetupRandomSourceLength)
-	}
-
-	// STEP 2: sanity checks of all nodes listed as participants
-	// there should be no duplicate node IDs
-	identLookup := make(map[flow.Identifier]struct{})
-	for _, participant := range setup.Participants {
-		_, ok := identLookup[participant.NodeID]
-		if ok {
-			return fmt.Errorf("duplicate node identifier (%x)", participant.NodeID)
-		}
-		identLookup[participant.NodeID] = struct{}{}
-	}
-
-	if verifyNetworkAddress {
-		// there should be no duplicate node addresses
-		addrLookup := make(map[string]struct{})
-		for _, participant := range setup.Participants {
-			_, ok := addrLookup[participant.Address]
-			if ok {
-				return fmt.Errorf("duplicate node address (%x)", participant.Address)
-			}
-			addrLookup[participant.Address] = struct{}{}
-		}
-	}
-
-	// the participants must be listed in canonical order
-	if !flow.IsIdentityListCanonical(setup.Participants) {
-		return fmt.Errorf("participants are not canonically ordered")
-	}
-
-	// STEP 3: sanity checks for individual roles
-	// IMPORTANT: here we remove all nodes with zero weight, as they are allowed to partake
-	// in communication but not in respective node functions
-	activeParticipants := setup.Participants.Filter(filter.HasWeight(true))
-
-	// we need at least one node of each role
-	roles := make(map[flow.Role]uint)
-	for _, participant := range activeParticipants {
-		roles[participant.Role]++
-	}
-	if roles[flow.RoleConsensus] < 1 {
-		return fmt.Errorf("need at least one consensus node")
-	}
-	if roles[flow.RoleCollection] < 1 {
-		return fmt.Errorf("need at least one collection node")
-	}
-	if roles[flow.RoleExecution] < 1 {
-		return fmt.Errorf("need at least one execution node")
-	}
-	if roles[flow.RoleVerification] < 1 {
-		return fmt.Errorf("need at least one verification node")
-	}
-
-	// first view must be before final view
-	if setup.FirstView >= setup.FinalView {
-		return fmt.Errorf("first view (%d) must be before final view (%d)", setup.FirstView, setup.FinalView)
-	}
-
-	// we need at least one collection cluster
-	if len(setup.Assignments) == 0 {
-		return fmt.Errorf("need at least one collection cluster")
-	}
-
-	// the collection cluster assignments need to be valid
-	_, err := factory.NewClusterList(setup.Assignments, activeParticipants.Filter(filter.HasRole(flow.RoleCollection)))
-	if err != nil {
-		return fmt.Errorf("invalid cluster assignments: %w", err)
-	}
-
-	return nil
-}
-
-// isValidExtendingEpochCommit checks whether an epoch commit service being
-// added to the state is valid. In addition to intrinsic validity, we also
-// check that it is valid w.r.t. the previous epoch setup event, and the
-// current epoch status.
-// Assumes all inputs besides extendingCommit are already validated.
-// Expected errors during normal operations:
-// * protocol.InvalidServiceEventError if the input service event is invalid to extend the currently active epoch status
-func isValidExtendingEpochCommit(extendingCommit *flow.EpochCommit, extendingSetup *flow.EpochSetup, activeSetup *flow.EpochSetup, status *flow.EpochStatus) error {
-
-	// We should only have a single epoch commit event per epoch.
-	if status.NextEpoch.CommitID != flow.ZeroID {
-		// true iff EpochCommit event for NEXT epoch was already included before
-		return protocol.NewInvalidServiceEventErrorf("duplicate epoch commit service event: %x", status.NextEpoch.CommitID)
-	}
-
-	// The epoch setup event needs to happen before the commit.
-	if status.NextEpoch.SetupID == flow.ZeroID {
-		return protocol.NewInvalidServiceEventErrorf("missing epoch setup for epoch commit")
-	}
-
-	// The commit event should have the counter increased by one.
-	if extendingCommit.Counter != activeSetup.Counter+1 {
-		return protocol.NewInvalidServiceEventErrorf("next epoch commit has invalid counter (%d => %d)", activeSetup.Counter, extendingCommit.Counter)
-	}
-
-	err := isValidEpochCommit(extendingCommit, extendingSetup)
-	if err != nil {
-		return protocol.NewInvalidServiceEventErrorf("invalid epoch commit: %s", err)
-	}
-
-	return nil
-}
-
-// isValidEpochCommit checks whether an epoch commit service event is intrinsically valid.
-// Assumes the input flow.EpochSetup event has already been validated.
-// Expected errors during normal operations:
-// * protocol.InvalidServiceEventError if the EpochCommit is invalid
-func isValidEpochCommit(commit *flow.EpochCommit, setup *flow.EpochSetup) error {
-
-	if len(setup.Assignments) != len(commit.ClusterQCs) {
-		return protocol.NewInvalidServiceEventErrorf("number of clusters (%d) does not number of QCs (%d)", len(setup.Assignments), len(commit.ClusterQCs))
-	}
-
-	if commit.Counter != setup.Counter {
-		return protocol.NewInvalidServiceEventErrorf("inconsistent epoch counter between commit (%d) and setup (%d) events in same epoch", commit.Counter, setup.Counter)
-	}
-
-	// make sure we have a valid DKG public key
-	if commit.DKGGroupKey == nil {
-		return protocol.NewInvalidServiceEventErrorf("missing DKG public group key")
-	}
-
-	participants := setup.Participants.Filter(filter.IsValidDKGParticipant)
-	if len(participants) != len(commit.DKGParticipantKeys) {
-		return protocol.NewInvalidServiceEventErrorf("participant list (len=%d) does not match dkg key list (len=%d)", len(participants), len(commit.DKGParticipantKeys))
-	}
-
-	return nil
-}
-
 // IsValidRootSnapshot checks internal consistency of root state snapshot
 // if verifyResultID allows/disallows Result ID verification
 func IsValidRootSnapshot(snap protocol.Snapshot, verifyResultID bool) error {
@@ -234,7 +54,7 @@ func IsValidRootSnapshot(snap protocol.Snapshot, verifyResultID bool) error {
 	if err != nil {
 		return fmt.Errorf("could not get identities for root snapshot: %w", err)
 	}
-	if !flow.IsIdentityListCanonical(identities) {
+	if !identities.Sorted(flow.Canonical[flow.Identity]) {
 		return fmt.Errorf("identities are not canonically ordered")
 	}
 
@@ -334,7 +154,7 @@ func validateRootQC(snap protocol.Snapshot) error {
 // validateClusterQC performs QC validation of single collection cluster
 // Returns nil on success
 func validateClusterQC(cluster protocol.Cluster) error {
-	committee, err := committees.NewStaticCommittee(cluster.Members(), flow.Identifier{}, nil, nil)
+	committee, err := committees.NewStaticReplicas(cluster.Members(), flow.Identifier{}, nil, nil)
 	if err != nil {
 		return fmt.Errorf("could not create static committee: %w", err)
 	}
@@ -413,12 +233,7 @@ func ValidRootSnapshotContainsEntityExpiryRange(snapshot protocol.Snapshot) erro
 	if err != nil {
 		return fmt.Errorf("could not query root snapshot head: %w", err)
 	}
-
-	sporkRootBlockHeight, err := snapshot.Params().SporkRootBlockHeight()
-	if err != nil {
-		return fmt.Errorf("could not query spork root block height: %w", err)
-	}
-
+	sporkRootBlockHeight := snapshot.Params().SporkRootBlockHeight()
 	sealingSegment, err := snapshot.SealingSegment()
 	if err != nil {
 		return fmt.Errorf("could not query sealing segment: %w", err)
diff --git a/state/protocol/badger/validity_test.go b/state/protocol/badger/validity_test.go
index f5349531841..e1bfa95bb62 100644
--- a/state/protocol/badger/validity_test.go
+++ b/state/protocol/badger/validity_test.go
@@ -3,11 +3,9 @@ package badger
 import (
 	"testing"
 
-	"github.com/onflow/crypto"
 	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/model/flow/filter"
 	"github.com/onflow/flow-go/state/protocol"
 	"github.com/onflow/flow-go/state/protocol/mock"
 	"github.com/onflow/flow-go/utils/unittest"
@@ -15,95 +13,6 @@ import (
 
 var participants = unittest.IdentityListFixture(20, unittest.WithAllRoles())
 
-func TestEpochSetupValidity(t *testing.T) {
-	t.Run("invalid first/final view", func(t *testing.T) {
-		_, result, _ := unittest.BootstrapFixture(participants)
-		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
-		// set an invalid final view for the first epoch
-		setup.FinalView = setup.FirstView
-
-		err := verifyEpochSetup(setup, true)
-		require.Error(t, err)
-	})
-
-	t.Run("non-canonically ordered identities", func(t *testing.T) {
-		_, result, _ := unittest.BootstrapFixture(participants)
-		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
-		// randomly shuffle the identities so they are not canonically ordered
-		var err error
-		setup.Participants, err = setup.Participants.Shuffle()
-		require.NoError(t, err)
-		err = verifyEpochSetup(setup, true)
-		require.Error(t, err)
-	})
-
-	t.Run("invalid cluster assignments", func(t *testing.T) {
-		_, result, _ := unittest.BootstrapFixture(participants)
-		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
-		// create an invalid cluster assignment (node appears in multiple clusters)
-		collector := participants.Filter(filter.HasRole(flow.RoleCollection))[0]
-		setup.Assignments = append(setup.Assignments, []flow.Identifier{collector.NodeID})
-
-		err := verifyEpochSetup(setup, true)
-		require.Error(t, err)
-	})
-
-	t.Run("short seed", func(t *testing.T) {
-		_, result, _ := unittest.BootstrapFixture(participants)
-		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
-		setup.RandomSource = unittest.SeedFixture(crypto.KeyGenSeedMinLen - 1)
-
-		err := verifyEpochSetup(setup, true)
-		require.Error(t, err)
-	})
-}
-
-func TestBootstrapInvalidEpochCommit(t *testing.T) {
-	t.Run("inconsistent counter", func(t *testing.T) {
-		_, result, _ := unittest.BootstrapFixture(participants)
-		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
-		commit := result.ServiceEvents[1].Event.(*flow.EpochCommit)
-		// use a different counter for the commit
-		commit.Counter = setup.Counter + 1
-
-		err := isValidEpochCommit(commit, setup)
-		require.Error(t, err)
-	})
-
-	t.Run("inconsistent cluster QCs", func(t *testing.T) {
-		_, result, _ := unittest.BootstrapFixture(participants)
-		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
-		commit := result.ServiceEvents[1].Event.(*flow.EpochCommit)
-		// add an extra QC to commit
-		extraQC := unittest.QuorumCertificateWithSignerIDsFixture()
-		commit.ClusterQCs = append(commit.ClusterQCs, flow.ClusterQCVoteDataFromQC(extraQC))
-
-		err := isValidEpochCommit(commit, setup)
-		require.Error(t, err)
-	})
-
-	t.Run("missing dkg group key", func(t *testing.T) {
-		_, result, _ := unittest.BootstrapFixture(participants)
-		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
-		commit := result.ServiceEvents[1].Event.(*flow.EpochCommit)
-		commit.DKGGroupKey = nil
-
-		err := isValidEpochCommit(commit, setup)
-		require.Error(t, err)
-	})
-
-	t.Run("inconsistent DKG participants", func(t *testing.T) {
-		_, result, _ := unittest.BootstrapFixture(participants)
-		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
-		commit := result.ServiceEvents[1].Event.(*flow.EpochCommit)
-		// add an extra DKG participant key
-		commit.DKGParticipantKeys = append(commit.DKGParticipantKeys, unittest.KeyFixture(crypto.BLSBLS12381).PublicKey())
-
-		err := isValidEpochCommit(commit, setup)
-		require.Error(t, err)
-	})
-}
-
 // TestEntityExpirySnapshotValidation tests that we perform correct sanity checks when
 // bootstrapping consensus nodes and access nodes we expect that we only bootstrap snapshots
 // with sufficient history.
diff --git a/state/protocol/state.go b/state/protocol/chain_state.go
similarity index 98%
rename from state/protocol/state.go
rename to state/protocol/chain_state.go
index e0285437c15..2b143091f6f 100644
--- a/state/protocol/state.go
+++ b/state/protocol/chain_state.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package protocol
 
 import (
diff --git a/state/protocol/cluster.go b/state/protocol/cluster.go
index a689adfc033..3001d026542 100644
--- a/state/protocol/cluster.go
+++ b/state/protocol/cluster.go
@@ -20,8 +20,10 @@ type Cluster interface {
 	// EpochCounter returns the epoch counter for this cluster.
 	EpochCounter() uint64
 
-	// Members returns the initial set of collector nodes in this cluster.
-	Members() flow.IdentityList
+	// Members returns the IdentitySkeletons of the cluster members in canonical order.
+	// This represents the cluster composition at the time the cluster was specified by the epoch smart
+	// contract (hence, we return IdentitySkeletons as opposed to full identities).
+	Members() flow.IdentitySkeletonList
 
 	// RootBlock returns the root block for this cluster.
 	RootBlock() *cluster.Block
diff --git a/state/protocol/convert.go b/state/protocol/convert.go
index 34a7dc97921..55ff0f9325d 100644
--- a/state/protocol/convert.go
+++ b/state/protocol/convert.go
@@ -33,6 +33,14 @@ func ToEpochSetup(epoch Epoch) (*flow.EpochSetup, error) {
 	if err != nil {
 		return nil, fmt.Errorf("could not get epoch dkg final views: %w", err)
 	}
+	targetDuration, err := epoch.TargetDuration()
+	if err != nil {
+		return nil, fmt.Errorf("could not get target duration: %w", err)
+	}
+	targetEndTime, err := epoch.TargetEndTime()
+	if err != nil {
+		return nil, fmt.Errorf("could not get target end time: %w", err)
+	}
 	participants, err := epoch.InitialIdentities()
 	if err != nil {
 		return nil, fmt.Errorf("could not get epoch participants: %w", err)
@@ -57,6 +65,8 @@ func ToEpochSetup(epoch Epoch) (*flow.EpochSetup, error) {
 		Participants:       participants,
 		Assignments:        assignments,
 		RandomSource:       randomSource,
+		TargetDuration:     targetDuration,
+		TargetEndTime:      targetEndTime,
 	}
 	return setup, nil
 }
@@ -123,7 +133,7 @@ func ToEpochCommit(epoch Epoch) (*flow.EpochCommit, error) {
 // participant keys from the DKG.
 // All errors indicate inconsistent or invalid inputs.
 // No errors are expected during normal operation.
-func GetDKGParticipantKeys(dkg DKG, participants flow.IdentityList) ([]crypto.PublicKey, error) {
+func GetDKGParticipantKeys(dkg DKG, participants flow.IdentitySkeletonList) ([]crypto.PublicKey, error) {
 
 	keys := make([]crypto.PublicKey, 0, len(participants))
 	for i, identity := range participants {
@@ -150,7 +160,7 @@ func GetDKGParticipantKeys(dkg DKG, participants flow.IdentityList) ([]crypto.Pu
 // DKG instance. The participants must exactly match the DKG instance configuration.
 // All errors indicate inconsistent or invalid inputs.
 // No errors are expected during normal operation.
-func ToDKGParticipantLookup(dkg DKG, participants flow.IdentityList) (map[flow.Identifier]flow.DKGParticipant, error) {
+func ToDKGParticipantLookup(dkg DKG, participants flow.IdentitySkeletonList) (map[flow.Identifier]flow.DKGParticipant, error) {
 
 	lookup := make(map[flow.Identifier]flow.DKGParticipant)
 	for _, identity := range participants {
diff --git a/state/protocol/convert_test.go b/state/protocol/convert_test.go
new file mode 100644
index 00000000000..4e28e98dcd7
--- /dev/null
+++ b/state/protocol/convert_test.go
@@ -0,0 +1,34 @@
+package protocol_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/state/protocol/inmem"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+func TestToEpochSetup(t *testing.T) {
+	expected := unittest.EpochSetupFixture()
+	epoch := inmem.NewSetupEpoch(expected)
+
+	got, err := protocol.ToEpochSetup(epoch)
+	require.NoError(t, err)
+	assert.True(t, expected.EqualTo(got))
+}
+
+func TestToEpochCommit(t *testing.T) {
+	setup := unittest.EpochSetupFixture()
+	expected := unittest.EpochCommitFixture(
+		unittest.CommitWithCounter(setup.Counter),
+		unittest.WithDKGFromParticipants(setup.Participants),
+		unittest.WithClusterQCsFromAssignments(setup.Assignments))
+	epoch := inmem.NewCommittedEpoch(setup, expected)
+
+	got, err := protocol.ToEpochCommit(epoch)
+	require.NoError(t, err)
+	assert.True(t, expected.EqualTo(got))
+}
diff --git a/state/protocol/epoch.go b/state/protocol/epoch.go
index 17a6f54da66..33f3a09d751 100644
--- a/state/protocol/epoch.go
+++ b/state/protocol/epoch.go
@@ -97,6 +97,24 @@ type Epoch interface {
 	// * state.ErrUnknownSnapshotReference - if the epoch is queried from an unresolvable snapshot.
 	FinalView() (uint64, error)
 
+	// TargetDuration returns the desired real-world duration for this epoch, in seconds.
+	// This target is specified by the FlowEpoch smart contract along the TargetEndTime in
+	// the EpochSetup event and used by the Cruise Control system to moderate the block rate.
+	// Error returns:
+	// * protocol.ErrNoPreviousEpoch - if the epoch represents a previous epoch which does not exist.
+	// * protocol.ErrNextEpochNotSetup - if the epoch represents a next epoch which has not been set up.
+	// * state.ErrUnknownSnapshotReference - if the epoch is queried from an unresolvable snapshot.
+	TargetDuration() (uint64, error)
+
+	// TargetEndTime returns the desired real-world end time for this epoch, represented as
+	// Unix Time (in units of seconds). This target is specified by the FlowEpoch smart contract in
+	// the EpochSetup event and used by the Cruise Control system to moderate the block rate.
+	// Error returns:
+	// * protocol.ErrNoPreviousEpoch - if the epoch represents a previous epoch which does not exist.
+	// * protocol.ErrNextEpochNotSetup - if the epoch represents a next epoch which has not been set up.
+	// * state.ErrUnknownSnapshotReference - if the epoch is queried from an unresolvable snapshot.
+	TargetEndTime() (uint64, error)
+
 	// RandomSource returns the underlying random source of this epoch.
 	// This source is currently generated by an on-chain contract using the
 	// UnsafeRandom() Cadence function.
@@ -112,7 +130,7 @@ type Epoch interface {
 	// * protocol.ErrNoPreviousEpoch - if the epoch represents a previous epoch which does not exist.
 	// * protocol.ErrNextEpochNotSetup - if the epoch represents a next epoch which has not been set up.
 	// * state.ErrUnknownSnapshotReference - if the epoch is queried from an unresolvable snapshot.
-	InitialIdentities() (flow.IdentityList, error)
+	InitialIdentities() (flow.IdentitySkeletonList, error)
 
 	// Clustering returns the cluster assignment for this epoch.
 	// Error returns:
diff --git a/state/protocol/events.go b/state/protocol/events.go
index c8dcf460159..5b93d47828b 100644
--- a/state/protocol/events.go
+++ b/state/protocol/events.go
@@ -84,8 +84,8 @@ type Consumer interface {
 	// NOTE: Only called once the phase transition has been finalized.
 	EpochCommittedPhaseStarted(currentEpochCounter uint64, first *flow.Header)
 
-	// EpochEmergencyFallbackTriggered is called when epoch fallback mode (EECC) is triggered.
-	// Since EECC is a permanent, spork-scoped state, this event is triggered only once.
+	// EpochEmergencyFallbackTriggered is called when epoch fallback mode [EFM] is triggered.
+	// Since EFM is a permanent, spork-scoped state, this event is triggered only once.
 	// After this event is triggered, no further epoch transitions will occur,
 	// no further epoch phase transitions will occur, and no further epoch-related
 	// related protocol events (the events defined in this interface) will be emitted.
diff --git a/state/protocol/events/distributor.go b/state/protocol/events/distributor.go
index db10f637756..cbed5d82651 100644
--- a/state/protocol/events/distributor.go
+++ b/state/protocol/events/distributor.go
@@ -7,12 +7,15 @@ import (
 	"github.com/onflow/flow-go/state/protocol"
 )
 
-// Distributor distributes events to a list of subscribers.
+// Distributor implements the `protocol.Consumer` interface for ingesting notifications emitted
+// by the protocol state. It distributes the notifications to all registered consumers.
 type Distributor struct {
 	subscribers []protocol.Consumer
 	mu          sync.RWMutex
 }
 
+var _ protocol.Consumer = (*Distributor)(nil)
+
 // NewDistributor returns a new events distributor.
 func NewDistributor() *Distributor {
 	return &Distributor{}
diff --git a/state/protocol/events/gadgets/views_test.go b/state/protocol/events/gadgets/views_test.go
index 484531c4b53..a0393398322 100644
--- a/state/protocol/events/gadgets/views_test.go
+++ b/state/protocol/events/gadgets/views_test.go
@@ -19,7 +19,7 @@ type viewsMachine struct {
 	expectedCalls int            // expected value of calls at any given time
 }
 
-func (m *viewsMachine) Init(_ *rapid.T) {
+func (m *viewsMachine) init(_ *rapid.T) {
 	m.views = NewViews()
 	m.callbacks = make(map[uint64]int)
 	m.calls = 0
@@ -27,7 +27,7 @@ func (m *viewsMachine) Init(_ *rapid.T) {
 }
 
 func (m *viewsMachine) OnView(t *rapid.T) {
-	view := rapid.Uint64().Draw(t, "view").(uint64)
+	view := rapid.Uint64().Draw(t, "view")
 	m.views.OnView(view, func(_ *flow.Header) {
 		m.calls++ // count actual number of calls invoked by Views
 	})
@@ -37,7 +37,7 @@ func (m *viewsMachine) OnView(t *rapid.T) {
 }
 
 func (m *viewsMachine) BlockFinalized(t *rapid.T) {
-	view := rapid.Uint64().Draw(t, "view").(uint64)
+	view := rapid.Uint64().Draw(t, "view")
 
 	block := unittest.BlockHeaderFixture()
 	block.View = view
@@ -58,5 +58,9 @@ func (m *viewsMachine) Check(t *rapid.T) {
 }
 
 func TestViewsRapid(t *testing.T) {
-	rapid.Check(t, rapid.Run(new(viewsMachine)))
+	rapid.Check(t, func(t *rapid.T) {
+		sm := new(viewsMachine)
+		sm.init(t)
+		t.Repeat(rapid.StateMachineActions(sm))
+	})
 }
diff --git a/state/protocol/inmem/cluster.go b/state/protocol/inmem/cluster.go
index fd2b0b85108..ea3fb4f3e9b 100644
--- a/state/protocol/inmem/cluster.go
+++ b/state/protocol/inmem/cluster.go
@@ -12,9 +12,9 @@ type Cluster struct {
 
 var _ protocol.Cluster = (*Cluster)(nil)
 
-func (c Cluster) Index() uint                     { return c.enc.Index }
-func (c Cluster) ChainID() flow.ChainID           { return c.enc.RootBlock.Header.ChainID }
-func (c Cluster) EpochCounter() uint64            { return c.enc.Counter }
-func (c Cluster) Members() flow.IdentityList      { return c.enc.Members }
-func (c Cluster) RootBlock() *clustermodel.Block  { return c.enc.RootBlock }
-func (c Cluster) RootQC() *flow.QuorumCertificate { return c.enc.RootQC }
+func (c Cluster) Index() uint                        { return c.enc.Index }
+func (c Cluster) ChainID() flow.ChainID              { return c.enc.RootBlock.Header.ChainID }
+func (c Cluster) EpochCounter() uint64               { return c.enc.Counter }
+func (c Cluster) Members() flow.IdentitySkeletonList { return c.enc.Members }
+func (c Cluster) RootBlock() *clustermodel.Block     { return c.enc.RootBlock }
+func (c Cluster) RootQC() *flow.QuorumCertificate    { return c.enc.RootQC }
diff --git a/state/protocol/inmem/convert.go b/state/protocol/inmem/convert.go
index 5a1150c2992..b2b90fb0e92 100644
--- a/state/protocol/inmem/convert.go
+++ b/state/protocol/inmem/convert.go
@@ -26,10 +26,6 @@ func FromSnapshot(from protocol.Snapshot) (*Snapshot, error) {
 	if err != nil {
 		return nil, fmt.Errorf("could not get head: %w", err)
 	}
-	snap.Identities, err = from.Identities(filter.Any)
-	if err != nil {
-		return nil, fmt.Errorf("could not get identities: %w", err)
-	}
 	snap.LatestResult, snap.LatestSeal, err = from.SealedResult()
 	if err != nil {
 		return nil, fmt.Errorf("could not get seal: %w", err)
@@ -43,10 +39,6 @@ func FromSnapshot(from protocol.Snapshot) (*Snapshot, error) {
 	if err != nil {
 		return nil, fmt.Errorf("could not get qc: %w", err)
 	}
-	snap.Phase, err = from.Phase()
-	if err != nil {
-		return nil, fmt.Errorf("could not get phase: %w", err)
-	}
 
 	// convert epochs
 	previous, err := FromEpoch(from.Epochs().Previous())
@@ -82,6 +74,12 @@ func FromSnapshot(from protocol.Snapshot) (*Snapshot, error) {
 	}
 	snap.Params = params.enc
 
+	protocolState, err := from.ProtocolState()
+	if err != nil {
+		return nil, fmt.Errorf("could not get protocol state: %w", err)
+	}
+	snap.ProtocolState = protocolState.Entry().ProtocolStateEntry
+
 	// convert version beacon
 	versionBeacon, err := from.VersionBeacon()
 	if err != nil {
@@ -96,32 +94,13 @@ func FromSnapshot(from protocol.Snapshot) (*Snapshot, error) {
 // FromParams converts any protocol.GlobalParams to a memory-backed Params.
 // TODO error docs
 func FromParams(from protocol.GlobalParams) (*Params, error) {
-	var (
-		params EncodableParams
-		err    error
-	)
-
-	params.ChainID, err = from.ChainID()
-	if err != nil {
-		return nil, fmt.Errorf("could not get chain id: %w", err)
-	}
-	params.SporkID, err = from.SporkID()
-	if err != nil {
-		return nil, fmt.Errorf("could not get spork id: %w", err)
-	}
-	params.SporkRootBlockHeight, err = from.SporkRootBlockHeight()
-	if err != nil {
-		return nil, fmt.Errorf("could not get spork root block height: %w", err)
-	}
-	params.ProtocolVersion, err = from.ProtocolVersion()
-	if err != nil {
-		return nil, fmt.Errorf("could not get protocol version: %w", err)
-	}
-	params.EpochCommitSafetyThreshold, err = from.EpochCommitSafetyThreshold()
-	if err != nil {
-		return nil, fmt.Errorf("could not get protocol version: %w", err)
+	params := EncodableParams{
+		ChainID:                    from.ChainID(),
+		SporkID:                    from.SporkID(),
+		SporkRootBlockHeight:       from.SporkRootBlockHeight(),
+		ProtocolVersion:            from.ProtocolVersion(),
+		EpochCommitSafetyThreshold: from.EpochCommitSafetyThreshold(),
 	}
-
 	return &Params{params}, nil
 }
 
@@ -157,6 +136,14 @@ func FromEpoch(from protocol.Epoch) (*Epoch, error) {
 	if err != nil {
 		return nil, fmt.Errorf("could not get random source: %w", err)
 	}
+	epoch.TargetDuration, err = from.TargetDuration()
+	if err != nil {
+		return nil, fmt.Errorf("could not get target epoch duration: %w", err)
+	}
+	epoch.TargetEndTime, err = from.TargetEndTime()
+	if err != nil {
+		return nil, fmt.Errorf("could not get target end time: %w", err)
+	}
 	epoch.DKGPhase1FinalView, epoch.DKGPhase2FinalView, epoch.DKGPhase3FinalView, err = protocol.DKGPhaseViews(from)
 	if err != nil {
 		return nil, fmt.Errorf("could not get dkg final views")
@@ -176,7 +163,7 @@ func FromEpoch(from protocol.Epoch) (*Epoch, error) {
 	if err != nil {
 		return nil, fmt.Errorf("could not get dkg: %w", err)
 	}
-	convertedDKG, err := FromDKG(dkg, epoch.InitialIdentities.Filter(filter.HasRole(flow.RoleConsensus)))
+	convertedDKG, err := FromDKG(dkg, epoch.InitialIdentities.Filter(filter.HasRole[flow.IdentitySkeleton](flow.RoleConsensus)))
 	if err != nil {
 		return nil, err
 	}
@@ -236,7 +223,7 @@ func FromCluster(from protocol.Cluster) (*Cluster, error) {
 // The given participant list must exactly match the DKG members.
 // All errors indicate inconsistent or invalid inputs.
 // No errors are expected during normal operation.
-func FromDKG(from protocol.DKG, participants flow.IdentityList) (*DKG, error) {
+func FromDKG(from protocol.DKG, participants flow.IdentitySkeletonList) (*DKG, error) {
 	var dkg EncodableDKG
 	dkg.GroupKey = encodable.RandomBeaconPubKey{PublicKey: from.GroupKey()}
 
@@ -254,6 +241,24 @@ func DKGFromEncodable(enc EncodableDKG) (*DKG, error) {
 	return &DKG{enc}, nil
 }
 
+// EncodableDKGFromEvents returns an EncodableDKG constructed from epoch setup and commit events.
+// No errors are expected during normal operations.
+func EncodableDKGFromEvents(setup *flow.EpochSetup, commit *flow.EpochCommit) (EncodableDKG, error) {
+	// filter initial participants to valid DKG participants
+	participants := setup.Participants.Filter(filter.IsValidDKGParticipant)
+	lookup, err := flow.ToDKGParticipantLookup(participants, commit.DKGParticipantKeys)
+	if err != nil {
+		return EncodableDKG{}, fmt.Errorf("could not construct dkg lookup: %w", err)
+	}
+
+	return EncodableDKG{
+		GroupKey: encodable.RandomBeaconPubKey{
+			PublicKey: commit.DKGGroupKey,
+		},
+		Participants: lookup,
+	}, nil
+}
+
 // ClusterFromEncodable returns a Cluster backed by the given encodable representation.
 func ClusterFromEncodable(enc EncodableCluster) (*Cluster, error) {
 	return &Cluster{enc}, nil
@@ -326,9 +331,14 @@ func SnapshotFromBootstrapStateWithParams(
 		EpochCommitSafetyThreshold: epochCommitSafetyThreshold, // see protocol.Params for details
 	}
 
+	rootProtocolState := ProtocolStateFromEpochServiceEvents(setup, commit)
+	if rootProtocolState.ID() != root.Payload.ProtocolStateID {
+		return nil, fmt.Errorf("incorrect protocol state ID in root block, expected (%x) but got (%x)",
+			root.Payload.ProtocolStateID, rootProtocolState.ID())
+	}
+
 	snap := SnapshotFromEncodable(EncodableSnapshot{
 		Head:         root.Header,
-		Identities:   setup.Participants,
 		LatestSeal:   seal,
 		LatestResult: result,
 		SealingSegment: &flow.SealingSegment{
@@ -339,10 +349,41 @@ func SnapshotFromBootstrapStateWithParams(
 			ExtraBlocks:      make([]*flow.Block, 0),
 		},
 		QuorumCertificate:   qc,
-		Phase:               flow.EpochPhaseStaking,
 		Epochs:              epochs,
 		Params:              params,
+		ProtocolState:       rootProtocolState,
 		SealedVersionBeacon: nil,
 	})
+
 	return snap, nil
 }
+
+// ProtocolStateFromEpochServiceEvents generates a protocol.ProtocolStateEntry for a root protocol state which is used for bootstrapping.
+//
+// CONTEXT: The EpochSetup event contains the IdentitySkeletons for each participant, thereby specifying active epoch members.
+// While ejection status is not part of the EpochSetup event, we can supplement this information as follows:
+//   - Per convention, service events are delivered (asynchronously) in an *order-preserving* manner. Furthermore,
+//     node ejection is also mediated by system smart contracts and delivered via service events.
+//   - Therefore, the EpochSetup event contains the up-to-date snapshot of the epoch participants. Any node ejection
+//     that happened before should be reflected in the EpochSetup event. Specifically, ejected
+//     nodes should be no longer listed in the EpochSetup event.
+//     Hence, when the EpochSetup event is emitted / processed, the ejected flag is false for all epoch participants.
+func ProtocolStateFromEpochServiceEvents(setup *flow.EpochSetup, commit *flow.EpochCommit) *flow.ProtocolStateEntry {
+	identities := make(flow.DynamicIdentityEntryList, 0, len(setup.Participants))
+	for _, identity := range setup.Participants {
+		identities = append(identities, &flow.DynamicIdentityEntry{
+			NodeID:  identity.NodeID,
+			Ejected: false,
+		})
+	}
+	return &flow.ProtocolStateEntry{
+		PreviousEpoch: nil,
+		CurrentEpoch: flow.EpochStateContainer{
+			SetupID:          setup.ID(),
+			CommitID:         commit.ID(),
+			ActiveIdentities: identities,
+		},
+		NextEpoch:                       nil,
+		InvalidEpochTransitionAttempted: false,
+	}
+}
diff --git a/state/protocol/inmem/convert_test.go b/state/protocol/inmem/convert_test.go
index 6da32088947..222ffac244f 100644
--- a/state/protocol/inmem/convert_test.go
+++ b/state/protocol/inmem/convert_test.go
@@ -23,9 +23,9 @@ func TestFromSnapshot(t *testing.T) {
 	identities := unittest.IdentityListFixture(10, unittest.WithAllRoles())
 	rootSnapshot := unittest.RootSnapshotFixture(identities)
 
-	util.RunWithFollowerProtocolState(t, rootSnapshot, func(db *badger.DB, state *bprotocol.FollowerState) {
-
-		epochBuilder := unittest.NewEpochBuilder(t, state)
+	util.RunWithFullProtocolStateAndMutator(t, rootSnapshot, func(db *badger.DB, fullState *bprotocol.ParticipantState, mutableState protocol.MutableProtocolState) {
+		state := fullState.FollowerState
+		epochBuilder := unittest.NewEpochBuilder(t, mutableState, state)
 		// build epoch 1 (prepare epoch 2)
 		epochBuilder.
 			BuildEpoch().
@@ -43,8 +43,7 @@ func TestFromSnapshot(t *testing.T) {
 
 		// test that we are able to retrieve an in-memory version of root snapshot
 		t.Run("root snapshot", func(t *testing.T) {
-			root, err := state.Params().FinalizedRoot()
-			require.NoError(t, err)
+			root := state.Params().FinalizedRoot()
 			expected := state.AtHeight(root.Height)
 			actual, err := inmem.FromSnapshot(expected)
 			require.NoError(t, err)
diff --git a/state/protocol/inmem/dkg.go b/state/protocol/inmem/dkg.go
index 54b3d682337..e2e78a60ca1 100644
--- a/state/protocol/inmem/dkg.go
+++ b/state/protocol/inmem/dkg.go
@@ -13,6 +13,10 @@ type DKG struct {
 
 var _ protocol.DKG = (*DKG)(nil)
 
+func NewDKG(enc EncodableDKG) *DKG {
+	return &DKG{enc: enc}
+}
+
 func (d DKG) Size() uint                 { return uint(len(d.enc.Participants)) }
 func (d DKG) GroupKey() crypto.PublicKey { return d.enc.GroupKey.PublicKey }
 
diff --git a/state/protocol/inmem/dynamic_protocol_state.go b/state/protocol/inmem/dynamic_protocol_state.go
new file mode 100644
index 00000000000..a480e3984f2
--- /dev/null
+++ b/state/protocol/inmem/dynamic_protocol_state.go
@@ -0,0 +1,50 @@
+package inmem
+
+import (
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/state/protocol"
+)
+
+// DynamicProtocolStateAdapter implements protocol.DynamicProtocolState by wrapping an InitialProtocolStateAdapter.
+type DynamicProtocolStateAdapter struct {
+	InitialProtocolStateAdapter
+	params protocol.GlobalParams
+}
+
+var _ protocol.DynamicProtocolState = (*DynamicProtocolStateAdapter)(nil)
+
+func NewDynamicProtocolStateAdapter(entry *flow.RichProtocolStateEntry, params protocol.GlobalParams) *DynamicProtocolStateAdapter {
+	return &DynamicProtocolStateAdapter{
+		InitialProtocolStateAdapter: InitialProtocolStateAdapter{
+			RichProtocolStateEntry: entry,
+		},
+		params: params,
+	}
+}
+
+func (s *DynamicProtocolStateAdapter) Identities() flow.IdentityList {
+	return s.RichProtocolStateEntry.CurrentEpochIdentityTable
+}
+
+func (s *DynamicProtocolStateAdapter) GlobalParams() protocol.GlobalParams {
+	return s.params
+}
+
+// InvalidEpochTransitionAttempted denotes whether an invalid epoch state transition was attempted
+// on the fork ending this block. Once the first block where this flag is true is finalized, epoch
+// fallback mode is triggered.
+// TODO for 'leaving Epoch Fallback via special service event': at the moment, this is a one-way transition and requires a spork to recover - need to revisit for sporkless EFM recovery
+func (s *DynamicProtocolStateAdapter) InvalidEpochTransitionAttempted() bool {
+	return s.ProtocolStateEntry.InvalidEpochTransitionAttempted
+}
+
+// PreviousEpochExists returns true if a previous epoch exists. This is true for all epoch
+// except those immediately following a spork.
+func (s *DynamicProtocolStateAdapter) PreviousEpochExists() bool {
+	return s.PreviousEpoch != nil
+}
+
+// EpochPhase returns the epoch phase for the current epoch.
+func (s *DynamicProtocolStateAdapter) EpochPhase() flow.EpochPhase {
+	return s.Entry().EpochPhase()
+}
diff --git a/state/protocol/inmem/dynamic_protocol_state_test.go b/state/protocol/inmem/dynamic_protocol_state_test.go
new file mode 100644
index 00000000000..b0c5d40ccde
--- /dev/null
+++ b/state/protocol/inmem/dynamic_protocol_state_test.go
@@ -0,0 +1,72 @@
+package inmem_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/state/protocol/inmem"
+	"github.com/onflow/flow-go/state/protocol/mock"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+// TestDynamicProtocolStateAdapter tests if the DynamicProtocolStateAdapter returns expected values when created
+// using constructor passing a RichProtocolStateEntry.
+func TestDynamicProtocolStateAdapter(t *testing.T) {
+	// construct a valid protocol state entry that has semantically correct DKGParticipantKeys
+	entry := unittest.ProtocolStateFixture(unittest.WithValidDKG())
+
+	globalParams := mock.NewGlobalParams(t)
+	adapter := inmem.NewDynamicProtocolStateAdapter(entry, globalParams)
+
+	t.Run("identities", func(t *testing.T) {
+		assert.Equal(t, entry.CurrentEpochIdentityTable, adapter.Identities())
+	})
+	t.Run("global-params", func(t *testing.T) {
+		expectedChainID := flow.Testnet
+		globalParams.On("ChainID").Return(expectedChainID, nil).Once()
+		actualChainID := adapter.GlobalParams().ChainID()
+		assert.Equal(t, expectedChainID, actualChainID)
+	})
+	t.Run("epoch-phase-staking", func(t *testing.T) {
+		entry := unittest.ProtocolStateFixture()
+		adapter := inmem.NewDynamicProtocolStateAdapter(entry, globalParams)
+		assert.Equal(t, flow.EpochPhaseStaking, adapter.EpochPhase())
+		assert.True(t, adapter.PreviousEpochExists())
+		assert.False(t, adapter.InvalidEpochTransitionAttempted())
+	})
+	t.Run("epoch-phase-setup", func(t *testing.T) {
+		entry := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState())
+		// cleanup the commit event, so we are in setup phase
+		entry.NextEpoch.CommitID = flow.ZeroID
+
+		adapter := inmem.NewDynamicProtocolStateAdapter(entry, globalParams)
+		assert.Equal(t, flow.EpochPhaseSetup, adapter.EpochPhase())
+		assert.True(t, adapter.PreviousEpochExists())
+		assert.False(t, adapter.InvalidEpochTransitionAttempted())
+	})
+	t.Run("epoch-phase-commit", func(t *testing.T) {
+		entry := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState())
+		adapter := inmem.NewDynamicProtocolStateAdapter(entry, globalParams)
+		assert.Equal(t, flow.EpochPhaseCommitted, adapter.EpochPhase())
+		assert.True(t, adapter.PreviousEpochExists())
+		assert.False(t, adapter.InvalidEpochTransitionAttempted())
+	})
+	t.Run("invalid-state-transition-attempted", func(t *testing.T) {
+		entry := unittest.ProtocolStateFixture(func(entry *flow.RichProtocolStateEntry) {
+			entry.InvalidEpochTransitionAttempted = true
+		})
+		adapter := inmem.NewDynamicProtocolStateAdapter(entry, globalParams)
+		assert.True(t, adapter.InvalidEpochTransitionAttempted())
+	})
+	t.Run("no-previous-epoch", func(t *testing.T) {
+		entry := unittest.ProtocolStateFixture(func(entry *flow.RichProtocolStateEntry) {
+			entry.PreviousEpoch = nil
+			entry.PreviousEpochSetup = nil
+			entry.PreviousEpochCommit = nil
+		})
+		adapter := inmem.NewDynamicProtocolStateAdapter(entry, globalParams)
+		assert.False(t, adapter.PreviousEpochExists())
+	})
+}
diff --git a/state/protocol/inmem/encodable.go b/state/protocol/inmem/encodable.go
index 4ab60a6aefe..cb3d648d814 100644
--- a/state/protocol/inmem/encodable.go
+++ b/state/protocol/inmem/encodable.go
@@ -9,14 +9,13 @@ import (
 // EncodableSnapshot is the encoding format for protocol.Snapshot
 type EncodableSnapshot struct {
 	Head                *flow.Header
-	Identities          flow.IdentityList
 	LatestSeal          *flow.Seal
 	LatestResult        *flow.ExecutionResult
 	SealingSegment      *flow.SealingSegment
 	QuorumCertificate   *flow.QuorumCertificate
-	Phase               flow.EpochPhase
 	Epochs              EncodableEpochs
 	Params              EncodableParams
+	ProtocolState       *flow.ProtocolStateEntry
 	SealedVersionBeacon *flow.SealedVersionBeacon
 }
 
@@ -36,7 +35,9 @@ type EncodableEpoch struct {
 	DKGPhase3FinalView uint64
 	FinalView          uint64
 	RandomSource       []byte
-	InitialIdentities  flow.IdentityList
+	TargetDuration     uint64 // desired real-world duration for the epoch, in seconds
+	TargetEndTime      uint64 // desired real-world end time for the epoch, in UNIX time [seconds]
+	InitialIdentities  flow.IdentitySkeletonList
 	Clustering         flow.ClusterList
 	Clusters           []EncodableCluster
 	DKG                *EncodableDKG
@@ -60,7 +61,7 @@ type EncodableFullDKG struct {
 type EncodableCluster struct {
 	Index     uint
 	Counter   uint64
-	Members   flow.IdentityList
+	Members   flow.IdentitySkeletonList
 	RootBlock *cluster.Block
 	RootQC    *flow.QuorumCertificate
 }
diff --git a/state/protocol/inmem/encodable_test.go b/state/protocol/inmem/encodable_test.go
index 22459e17b7a..bc9aba73383 100644
--- a/state/protocol/inmem/encodable_test.go
+++ b/state/protocol/inmem/encodable_test.go
@@ -37,26 +37,3 @@ func TestEncodeDecode(t *testing.T) {
 	decodedResult, decodedSeal := decodedSnapshot.LatestResult, decodedSnapshot.LatestSeal
 	assert.Equal(t, decodedResult.ID(), decodedSeal.ResultID)
 }
-
-// TestStrippedEncodeDecode tests that the protocol state snapshot can be encoded to JSON skipping the network address
-// and decoded back successfully
-func TestStrippedEncodeDecode(t *testing.T) {
-	participants := unittest.IdentityListFixture(10, unittest.WithAllRoles())
-	initialSnapshot := unittest.RootSnapshotFixture(participants)
-
-	// encode the snapshot
-	strippedSnapshot := inmem.StrippedInmemSnapshot(initialSnapshot.Encodable())
-	snapshotJson, err := json.Marshal(strippedSnapshot)
-	require.NoError(t, err)
-	// check that the json string does not contain "Address"
-	require.NotContains(t, snapshotJson, "Address")
-
-	// decode the snapshots
-	var decodedSnapshot inmem.EncodableSnapshot
-	err = json.Unmarshal(snapshotJson, &decodedSnapshot)
-	require.NoError(t, err)
-	// check that the network addresses for all the identities are still empty
-	assert.Len(t, decodedSnapshot.Identities.Filter(func(id *flow.Identity) bool {
-		return id.Address == ""
-	}), len(participants))
-}
diff --git a/state/protocol/inmem/epoch.go b/state/protocol/inmem/epoch.go
index a0be1b1d961..6dd481ac58f 100644
--- a/state/protocol/inmem/epoch.go
+++ b/state/protocol/inmem/epoch.go
@@ -3,7 +3,6 @@ package inmem
 import (
 	"fmt"
 
-	"github.com/onflow/flow-go/model/encodable"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/flow/factory"
 	"github.com/onflow/flow-go/model/flow/filter"
@@ -20,6 +19,10 @@ type Epoch struct {
 
 var _ protocol.Epoch = (*Epoch)(nil)
 
+func NewEpoch(enc EncodableEpoch) Epoch {
+	return Epoch{enc}
+}
+
 func (e Epoch) Encodable() EncodableEpoch {
 	return e.enc
 }
@@ -30,13 +33,27 @@ func (e Epoch) DKGPhase1FinalView() (uint64, error) { return e.enc.DKGPhase1Fina
 func (e Epoch) DKGPhase2FinalView() (uint64, error) { return e.enc.DKGPhase2FinalView, nil }
 func (e Epoch) DKGPhase3FinalView() (uint64, error) { return e.enc.DKGPhase3FinalView, nil }
 func (e Epoch) FinalView() (uint64, error)          { return e.enc.FinalView, nil }
-func (e Epoch) InitialIdentities() (flow.IdentityList, error) {
+func (e Epoch) InitialIdentities() (flow.IdentitySkeletonList, error) {
 	return e.enc.InitialIdentities, nil
 }
 func (e Epoch) RandomSource() ([]byte, error) {
 	return e.enc.RandomSource, nil
 }
 
+// TargetDuration returns the desired real-world duration for this epoch, in seconds.
+// This target is specified by the FlowEpoch smart contract in the EpochSetup event
+// and used by the Cruise Control system to moderate the block rate.
+func (e Epoch) TargetDuration() (uint64, error) {
+	return e.enc.TargetDuration, nil
+}
+
+// TargetEndTime returns the desired real-world end time for this epoch, represented as
+// Unix Time (in units of seconds). This target is specified by the FlowEpoch smart contract in
+// the EpochSetup event and used by the Cruise Control system to moderate the block rate.
+func (e Epoch) TargetEndTime() (uint64, error) {
+	return e.enc.TargetEndTime, nil
+}
+
 func (e Epoch) Clustering() (flow.ClusterList, error) {
 	return e.enc.Clustering, nil
 }
@@ -143,13 +160,26 @@ func (es *setupEpoch) FinalView() (uint64, error) {
 	return es.setupEvent.FinalView, nil
 }
 
+// TargetDuration returns the desired real-world duration for this epoch, in seconds.
+// This target is specified by the FlowEpoch smart contract in the EpochSetup event
+// and used by the Cruise Control system to moderate the block rate.
+func (es *setupEpoch) TargetDuration() (uint64, error) {
+	return es.setupEvent.TargetDuration, nil
+}
+
+// TargetEndTime returns the desired real-world end time for this epoch, represented as
+// Unix Time (in units of seconds). This target is specified by the FlowEpoch smart contract in
+// the EpochSetup event and used by the Cruise Control system to moderate the block rate.
+func (es *setupEpoch) TargetEndTime() (uint64, error) {
+	return es.setupEvent.TargetEndTime, nil
+}
+
 func (es *setupEpoch) RandomSource() ([]byte, error) {
 	return es.setupEvent.RandomSource, nil
 }
 
-func (es *setupEpoch) InitialIdentities() (flow.IdentityList, error) {
-	identities := es.setupEvent.Participants.Filter(filter.Any)
-	return identities, nil
+func (es *setupEpoch) InitialIdentities() (flow.IdentitySkeletonList, error) {
+	return es.setupEvent.Participants, nil
 }
 
 func (es *setupEpoch) Clustering() (flow.ClusterList, error) {
@@ -157,7 +187,7 @@ func (es *setupEpoch) Clustering() (flow.ClusterList, error) {
 }
 
 func ClusteringFromSetupEvent(setupEvent *flow.EpochSetup) (flow.ClusterList, error) {
-	collectorFilter := filter.HasRole(flow.RoleCollection)
+	collectorFilter := filter.HasRole[flow.IdentitySkeleton](flow.RoleCollection)
 	clustering, err := factory.NewClusterList(setupEvent.Assignments, setupEvent.Participants.Filter(collectorFilter))
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate ClusterList from collector identities: %w", err)
@@ -256,20 +286,11 @@ func (es *committedEpoch) ClusterByChainID(chainID flow.ChainID) (protocol.Clust
 }
 
 func (es *committedEpoch) DKG() (protocol.DKG, error) {
-	// filter initial participants to valid DKG participants
-	participants := es.setupEvent.Participants.Filter(filter.IsValidDKGParticipant)
-	lookup, err := flow.ToDKGParticipantLookup(participants, es.commitEvent.DKGParticipantKeys)
+	encodable, err := EncodableDKGFromEvents(es.setupEvent, es.commitEvent)
 	if err != nil {
-		return nil, fmt.Errorf("could not construct dkg lookup: %w", err)
+		return nil, fmt.Errorf("could not build encodable DKG from epoch events")
 	}
-
-	dkg, err := DKGFromEncodable(EncodableDKG{
-		GroupKey: encodable.RandomBeaconPubKey{
-			PublicKey: es.commitEvent.DKGGroupKey,
-		},
-		Participants: lookup,
-	})
-	return dkg, err
+	return DKGFromEncodable(encodable)
 }
 
 // startedEpoch represents an epoch (with counter N) that has started, but there is no _finalized_ transition
diff --git a/state/protocol/inmem/initial_protocol_state.go b/state/protocol/inmem/initial_protocol_state.go
new file mode 100644
index 00000000000..1b54f2b47a8
--- /dev/null
+++ b/state/protocol/inmem/initial_protocol_state.go
@@ -0,0 +1,62 @@
+package inmem
+
+import (
+	"fmt"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/state/protocol"
+)
+
+// InitialProtocolStateAdapter implements protocol.InitialProtocolState by wrapping a RichProtocolStateEntry.
+// TODO(yuraolex): for sake of avoiding errors in return values in interface methods this adapter pre-caches
+// some values. This is debatable as clustering for instance is not accessed frequently and could be lazily loaded.
+// The problem with lazy loading is handling error value from `inmem.ClusteringFromSetupEvent`. There are two ways to avoid it:
+// 1. Return error from interface method.
+// 2. Inject irrecoverable.Signaler into the adapter and panic on error since any error in that method has to be a severe implementation bug.
+type InitialProtocolStateAdapter struct {
+	*flow.RichProtocolStateEntry
+}
+
+var _ protocol.InitialProtocolState = (*InitialProtocolStateAdapter)(nil)
+
+func NewInitialProtocolStateAdapter(entry *flow.RichProtocolStateEntry) *InitialProtocolStateAdapter {
+	return &InitialProtocolStateAdapter{
+		RichProtocolStateEntry: entry,
+	}
+}
+
+func (s *InitialProtocolStateAdapter) Epoch() uint64 {
+	return s.CurrentEpochSetup.Counter
+}
+
+func (s *InitialProtocolStateAdapter) Clustering() (flow.ClusterList, error) {
+	clustering, err := ClusteringFromSetupEvent(s.CurrentEpochSetup)
+	if err != nil {
+		return nil, fmt.Errorf("could not extract cluster list from setup event: %w", err)
+	}
+	return clustering, nil
+}
+
+func (s *InitialProtocolStateAdapter) EpochSetup() *flow.EpochSetup {
+	return s.CurrentEpochSetup
+}
+
+func (s *InitialProtocolStateAdapter) EpochCommit() *flow.EpochCommit {
+	return s.CurrentEpochCommit
+}
+
+func (s *InitialProtocolStateAdapter) DKG() (protocol.DKG, error) {
+	dkg, err := EncodableDKGFromEvents(s.CurrentEpochSetup, s.CurrentEpochCommit)
+	if err != nil {
+		return nil, fmt.Errorf("could not construct encodable DKG from events: %w", err)
+	}
+
+	return NewDKG(dkg), nil
+}
+
+// Entry Returns low-level protocol state entry that was used to initialize this object.
+// It shouldn't be used by high-level logic, it is useful for some cases such as bootstrapping.
+// Prefer using other methods to access protocol state.
+func (s *InitialProtocolStateAdapter) Entry() *flow.RichProtocolStateEntry {
+	return s.RichProtocolStateEntry.Copy()
+}
diff --git a/state/protocol/inmem/initial_protocol_state_test.go b/state/protocol/inmem/initial_protocol_state_test.go
new file mode 100644
index 00000000000..2bd75d062a6
--- /dev/null
+++ b/state/protocol/inmem/initial_protocol_state_test.go
@@ -0,0 +1,57 @@
+package inmem_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/model/flow/filter"
+	"github.com/onflow/flow-go/state/protocol/inmem"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+// TestInitialProtocolStateAdapter tests if the InitialProtocolStateAdapter returns expected values when created
+// using constructor passing a RichProtocolStateEntry.
+func TestInitialProtocolStateAdapter(t *testing.T) {
+	// construct a valid protocol state entry that has semantically correct DKGParticipantKeys
+	entry := unittest.ProtocolStateFixture(unittest.WithValidDKG())
+
+	adapter := inmem.NewInitialProtocolStateAdapter(entry)
+
+	t.Run("clustering", func(t *testing.T) {
+		clustering, err := inmem.ClusteringFromSetupEvent(entry.CurrentEpochSetup)
+		require.NoError(t, err)
+		actual, err := adapter.Clustering()
+		require.NoError(t, err)
+		assert.Equal(t, clustering, actual)
+	})
+	t.Run("epoch", func(t *testing.T) {
+		assert.Equal(t, entry.CurrentEpochSetup.Counter, adapter.Epoch())
+	})
+	t.Run("setup", func(t *testing.T) {
+		assert.Equal(t, entry.CurrentEpochSetup, adapter.EpochSetup())
+	})
+	t.Run("commit", func(t *testing.T) {
+		assert.Equal(t, entry.CurrentEpochCommit, adapter.EpochCommit())
+	})
+	t.Run("dkg", func(t *testing.T) {
+		dkg, err := adapter.DKG()
+		require.NoError(t, err)
+		assert.Equal(t, entry.CurrentEpochCommit.DKGGroupKey, dkg.GroupKey())
+		assert.Equal(t, len(entry.CurrentEpochCommit.DKGParticipantKeys), int(dkg.Size()))
+		dkgParticipants := entry.CurrentEpochSetup.Participants.Filter(filter.IsValidDKGParticipant)
+		for _, identity := range dkgParticipants {
+			keyShare, err := dkg.KeyShare(identity.NodeID)
+			require.NoError(t, err)
+			index, err := dkg.Index(identity.NodeID)
+			require.NoError(t, err)
+			assert.Equal(t, entry.CurrentEpochCommit.DKGParticipantKeys[index], keyShare)
+		}
+	})
+	t.Run("entry", func(t *testing.T) {
+		actualEntry := adapter.Entry()
+		assert.Equal(t, entry, actualEntry, "entry should be equal to the one passed to the constructor")
+		assert.NotSame(t, entry, actualEntry, "entry should be a copy of the one passed to the constructor")
+	})
+}
diff --git a/state/protocol/inmem/params.go b/state/protocol/inmem/params.go
index 15f01f20f6a..46127051023 100644
--- a/state/protocol/inmem/params.go
+++ b/state/protocol/inmem/params.go
@@ -11,22 +11,28 @@ type Params struct {
 
 var _ protocol.GlobalParams = (*Params)(nil)
 
-func (p Params) ChainID() (flow.ChainID, error) {
-	return p.enc.ChainID, nil
+func NewParams(enc EncodableParams) *Params {
+	return &Params{
+		enc: enc,
+	}
 }
 
-func (p Params) SporkID() (flow.Identifier, error) {
-	return p.enc.SporkID, nil
+func (p Params) ChainID() flow.ChainID {
+	return p.enc.ChainID
 }
 
-func (p Params) SporkRootBlockHeight() (uint64, error) {
-	return p.enc.SporkRootBlockHeight, nil
+func (p Params) SporkID() flow.Identifier {
+	return p.enc.SporkID
 }
 
-func (p Params) ProtocolVersion() (uint, error) {
-	return p.enc.ProtocolVersion, nil
+func (p Params) SporkRootBlockHeight() uint64 {
+	return p.enc.SporkRootBlockHeight
 }
 
-func (p Params) EpochCommitSafetyThreshold() (uint64, error) {
-	return p.enc.EpochCommitSafetyThreshold, nil
+func (p Params) ProtocolVersion() uint {
+	return p.enc.ProtocolVersion
+}
+
+func (p Params) EpochCommitSafetyThreshold() uint64 {
+	return p.enc.EpochCommitSafetyThreshold
 }
diff --git a/state/protocol/inmem/snapshot.go b/state/protocol/inmem/snapshot.go
index a30c1b0fcad..d911641d2e2 100644
--- a/state/protocol/inmem/snapshot.go
+++ b/state/protocol/inmem/snapshot.go
@@ -1,8 +1,12 @@
 package inmem
 
 import (
+	"errors"
+	"fmt"
+
 	"github.com/onflow/flow-go/consensus/hotstuff/model"
 	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/model/flow/filter"
 	"github.com/onflow/flow-go/state/protocol"
 )
 
@@ -23,16 +27,26 @@ func (s Snapshot) QuorumCertificate() (*flow.QuorumCertificate, error) {
 	return s.enc.QuorumCertificate, nil
 }
 
-func (s Snapshot) Identities(selector flow.IdentityFilter) (flow.IdentityList, error) {
-	return s.enc.Identities.Filter(selector), nil
+func (s Snapshot) Identities(selector flow.IdentityFilter[flow.Identity]) (flow.IdentityList, error) {
+	protocolState, err := s.ProtocolState()
+	if err != nil {
+		return nil, fmt.Errorf("could not access protocol state: %w", err)
+	}
+	return protocolState.Identities().Filter(selector), nil
 }
 
 func (s Snapshot) Identity(nodeID flow.Identifier) (*flow.Identity, error) {
-	identity, ok := s.enc.Identities.ByNodeID(nodeID)
-	if !ok {
+	// filter identities at snapshot for node ID
+	identities, err := s.Identities(filter.HasNodeID[flow.Identity](nodeID))
+	if err != nil {
+		return nil, fmt.Errorf("could not get identities: %w", err)
+	}
+
+	// check if node ID is part of identities
+	if len(identities) == 0 {
 		return nil, protocol.IdentityNotFoundError{NodeID: nodeID}
 	}
-	return identity, nil
+	return identities[0], nil
 }
 
 func (s Snapshot) Commit() (flow.StateCommitment, error) {
@@ -53,7 +67,7 @@ func (s Snapshot) Descendants() ([]flow.Identifier, error) {
 }
 
 func (s Snapshot) Phase() (flow.EpochPhase, error) {
-	return s.enc.Phase, nil
+	return s.enc.ProtocolState.EpochPhase(), nil
 }
 
 func (s Snapshot) RandomSource() ([]byte, error) {
@@ -72,47 +86,72 @@ func (s Snapshot) Encodable() EncodableSnapshot {
 	return s.enc
 }
 
-func (s Snapshot) VersionBeacon() (*flow.SealedVersionBeacon, error) {
-	return s.enc.SealedVersionBeacon, nil
-}
-
-func SnapshotFromEncodable(enc EncodableSnapshot) *Snapshot {
-	return &Snapshot{
-		enc: enc,
+func (s Snapshot) ProtocolState() (protocol.DynamicProtocolState, error) {
+	epochs := s.Epochs()
+	previous := epochs.Previous()
+	current := epochs.Current()
+	next := epochs.Next()
+	var (
+		err                                                      error
+		previousEpochSetup, currentEpochSetup, nextEpochSetup    *flow.EpochSetup
+		previousEpochCommit, currentEpochCommit, nextEpochCommit *flow.EpochCommit
+	)
+
+	if _, err := previous.Counter(); err == nil {
+		// if there is a previous epoch, both setup and commit events must exist
+		previousEpochSetup, err = protocol.ToEpochSetup(previous)
+		if err != nil {
+			return nil, fmt.Errorf("could not get previous epoch setup event: %w", err)
+		}
+		previousEpochCommit, err = protocol.ToEpochCommit(previous)
+		if err != nil {
+			return nil, fmt.Errorf("could not get previous epoch commit event: %w", err)
+		}
 	}
-}
 
-// StrippedInmemSnapshot removes all the networking address in the snapshot
-func StrippedInmemSnapshot(snapshot EncodableSnapshot) EncodableSnapshot {
-	removeAddress := func(ids flow.IdentityList) {
-		for _, identity := range ids {
-			identity.Address = ""
-		}
+	// insert current epoch - both setup and commit events must exist
+	currentEpochSetup, err = protocol.ToEpochSetup(current)
+	if err != nil {
+		return nil, fmt.Errorf("could not get current epoch setup event: %w", err)
+	}
+	currentEpochCommit, err = protocol.ToEpochCommit(current)
+	if err != nil {
+		return nil, fmt.Errorf("could not get current epoch commit event: %w", err)
 	}
 
-	removeAddressFromEpoch := func(epoch *EncodableEpoch) {
-		if epoch == nil {
-			return
+	if _, err := next.Counter(); err == nil {
+		// if there is a next epoch, both setup event should exist, but commit event may not
+		nextEpochSetup, err = protocol.ToEpochSetup(next)
+		if err != nil {
+			return nil, fmt.Errorf("could not get next epoch setup event: %w", err)
 		}
-		removeAddress(epoch.InitialIdentities)
-		for _, cluster := range epoch.Clustering {
-			removeAddress(cluster)
-		}
-		for _, c := range epoch.Clusters {
-			removeAddress(c.Members)
+		nextEpochCommit, err = protocol.ToEpochCommit(next)
+		if err != nil && !errors.Is(err, protocol.ErrNextEpochNotCommitted) {
+			return nil, fmt.Errorf("could not get next epoch commit event: %w", err)
 		}
 	}
 
-	removeAddress(snapshot.Identities)
-	removeAddressFromEpoch(snapshot.Epochs.Previous)
-	removeAddressFromEpoch(&snapshot.Epochs.Current)
-	removeAddressFromEpoch(snapshot.Epochs.Next)
+	protocolStateEntry, err := flow.NewRichProtocolStateEntry(
+		s.enc.ProtocolState,
+		previousEpochSetup,
+		previousEpochCommit,
+		currentEpochSetup,
+		currentEpochCommit,
+		nextEpochSetup,
+		nextEpochCommit)
+	if err != nil {
+		return nil, fmt.Errorf("could not create protocol state entry: %w", err)
+	}
 
-	for _, event := range snapshot.LatestResult.ServiceEvents {
-		switch event.Type {
-		case flow.ServiceEventSetup:
-			removeAddress(event.Event.(*flow.EpochSetup).Participants)
-		}
+	return NewDynamicProtocolStateAdapter(protocolStateEntry, s.Params()), nil
+}
+
+func (s Snapshot) VersionBeacon() (*flow.SealedVersionBeacon, error) {
+	return s.enc.SealedVersionBeacon, nil
+}
+
+func SnapshotFromEncodable(enc EncodableSnapshot) *Snapshot {
+	return &Snapshot{
+		enc: enc,
 	}
-	return snapshot
 }
diff --git a/state/protocol/invalid/epoch.go b/state/protocol/invalid/epoch.go
index cf4777b4f33..ebda9919e3b 100644
--- a/state/protocol/invalid/epoch.go
+++ b/state/protocol/invalid/epoch.go
@@ -65,7 +65,7 @@ func (u *Epoch) DKGPhase3FinalView() (uint64, error) {
 	return 0, u.err
 }
 
-func (u *Epoch) InitialIdentities() (flow.IdentityList, error) {
+func (u *Epoch) InitialIdentities() (flow.IdentitySkeletonList, error) {
 	return nil, u.err
 }
 
@@ -89,6 +89,14 @@ func (u *Epoch) RandomSource() ([]byte, error) {
 	return nil, u.err
 }
 
+func (u *Epoch) TargetDuration() (uint64, error) {
+	return 0, u.err
+}
+
+func (u *Epoch) TargetEndTime() (uint64, error) {
+	return 0, u.err
+}
+
 func (u *Epoch) FirstHeight() (uint64, error) {
 	return 0, u.err
 }
diff --git a/state/protocol/invalid/params.go b/state/protocol/invalid/params.go
index a131d4517a8..d12c9bfd269 100644
--- a/state/protocol/invalid/params.go
+++ b/state/protocol/invalid/params.go
@@ -9,22 +9,22 @@ type Params struct {
 	err error
 }
 
-func (p Params) ChainID() (flow.ChainID, error) {
-	return "", p.err
+func (p Params) ChainID() flow.ChainID {
+	return ""
 }
 
-func (p Params) SporkID() (flow.Identifier, error) {
-	return flow.ZeroID, p.err
+func (p Params) SporkID() flow.Identifier {
+	return flow.ZeroID
 }
 
-func (p Params) SporkRootBlockHeight() (uint64, error) {
-	return 0, p.err
+func (p Params) SporkRootBlockHeight() uint64 {
+	return 0
 }
 
-func (p Params) ProtocolVersion() (uint, error) {
-	return 0, p.err
+func (p Params) ProtocolVersion() uint {
+	return 0
 }
 
-func (p Params) EpochCommitSafetyThreshold() (uint64, error) {
-	return 0, p.err
+func (p Params) EpochCommitSafetyThreshold() uint64 {
+	return 0
 }
diff --git a/state/protocol/invalid/snapshot.go b/state/protocol/invalid/snapshot.go
index 78ee386ebcb..637821307a9 100644
--- a/state/protocol/invalid/snapshot.go
+++ b/state/protocol/invalid/snapshot.go
@@ -44,7 +44,7 @@ func (u *Snapshot) Phase() (flow.EpochPhase, error) {
 	return 0, u.err
 }
 
-func (u *Snapshot) Identities(_ flow.IdentityFilter) (flow.IdentityList, error) {
+func (u *Snapshot) Identities(_ flow.IdentityFilter[flow.Identity]) (flow.IdentityList, error) {
 	return nil, u.err
 }
 
@@ -76,6 +76,10 @@ func (u *Snapshot) Params() protocol.GlobalParams {
 	return Params{u.err}
 }
 
+func (u *Snapshot) ProtocolState() (protocol.DynamicProtocolState, error) {
+	return nil, u.err
+}
+
 func (u *Snapshot) VersionBeacon() (*flow.SealedVersionBeacon, error) {
 	return nil, u.err
 }
diff --git a/state/protocol/mock/cluster.go b/state/protocol/mock/cluster.go
index aebb5a2af5b..00c6080c76e 100644
--- a/state/protocol/mock/cluster.go
+++ b/state/protocol/mock/cluster.go
@@ -57,15 +57,15 @@ func (_m *Cluster) Index() uint {
 }
 
 // Members provides a mock function with given fields:
-func (_m *Cluster) Members() flow.IdentityList {
+func (_m *Cluster) Members() flow.GenericIdentityList[flow.IdentitySkeleton] {
 	ret := _m.Called()
 
-	var r0 flow.IdentityList
-	if rf, ok := ret.Get(0).(func() flow.IdentityList); ok {
+	var r0 flow.GenericIdentityList[flow.IdentitySkeleton]
+	if rf, ok := ret.Get(0).(func() flow.GenericIdentityList[flow.IdentitySkeleton]); ok {
 		r0 = rf()
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(flow.IdentityList)
+			r0 = ret.Get(0).(flow.GenericIdentityList[flow.IdentitySkeleton])
 		}
 	}
 
diff --git a/state/protocol/mock/cluster_events.go b/state/protocol/mock/cluster_events.go
deleted file mode 100644
index 2e5a2bead49..00000000000
--- a/state/protocol/mock/cluster_events.go
+++ /dev/null
@@ -1,34 +0,0 @@
-// Code generated by mockery v2.21.4. DO NOT EDIT.
-
-package mock
-
-import (
-	mock "github.com/stretchr/testify/mock"
-
-	flow "github.com/onflow/flow-go/model/flow"
-)
-
-// ClusterEvents is an autogenerated mock type for the ClusterEvents type
-type ClusterEvents struct {
-	mock.Mock
-}
-
-// ActiveClustersChanged provides a mock function with given fields: _a0
-func (_m *ClusterEvents) ActiveClustersChanged(_a0 flow.ChainIDList) {
-	_m.Called(_a0)
-}
-
-type mockConstructorTestingTNewClusterEvents interface {
-	mock.TestingT
-	Cleanup(func())
-}
-
-// NewClusterEvents creates a new instance of ClusterEvents. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-func NewClusterEvents(t mockConstructorTestingTNewClusterEvents) *ClusterEvents {
-	mock := &ClusterEvents{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
diff --git a/state/protocol/mock/cluster_id_update_consumer.go b/state/protocol/mock/cluster_id_update_consumer.go
deleted file mode 100644
index a18339c6376..00000000000
--- a/state/protocol/mock/cluster_id_update_consumer.go
+++ /dev/null
@@ -1,34 +0,0 @@
-// Code generated by mockery v2.21.4. DO NOT EDIT.
-
-package mock
-
-import (
-	mock "github.com/stretchr/testify/mock"
-
-	flow "github.com/onflow/flow-go/model/flow"
-)
-
-// ClusterIDUpdateConsumer is an autogenerated mock type for the ClusterIDUpdateConsumer type
-type ClusterIDUpdateConsumer struct {
-	mock.Mock
-}
-
-// ClusterIdsUpdated provides a mock function with given fields: _a0
-func (_m *ClusterIDUpdateConsumer) ActiveClustersChanged(_a0 flow.ChainIDList) {
-	_m.Called(_a0)
-}
-
-type mockConstructorTestingTNewClusterIDUpdateConsumer interface {
-	mock.TestingT
-	Cleanup(func())
-}
-
-// NewClusterIDUpdateConsumer creates a new instance of ClusterIDUpdateConsumer. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-func NewClusterIDUpdateConsumer(t mockConstructorTestingTNewClusterIDUpdateConsumer) *ClusterIDUpdateConsumer {
-	mock := &ClusterIDUpdateConsumer{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
diff --git a/state/protocol/mock/dynamic_protocol_state.go b/state/protocol/mock/dynamic_protocol_state.go
new file mode 100644
index 00000000000..11843fe2ecd
--- /dev/null
+++ b/state/protocol/mock/dynamic_protocol_state.go
@@ -0,0 +1,218 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mock
+
+import (
+	flow "github.com/onflow/flow-go/model/flow"
+	mock "github.com/stretchr/testify/mock"
+
+	protocol "github.com/onflow/flow-go/state/protocol"
+)
+
+// DynamicProtocolState is an autogenerated mock type for the DynamicProtocolState type
+type DynamicProtocolState struct {
+	mock.Mock
+}
+
+// Clustering provides a mock function with given fields:
+func (_m *DynamicProtocolState) Clustering() (flow.ClusterList, error) {
+	ret := _m.Called()
+
+	var r0 flow.ClusterList
+	var r1 error
+	if rf, ok := ret.Get(0).(func() (flow.ClusterList, error)); ok {
+		return rf()
+	}
+	if rf, ok := ret.Get(0).(func() flow.ClusterList); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(flow.ClusterList)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// DKG provides a mock function with given fields:
+func (_m *DynamicProtocolState) DKG() (protocol.DKG, error) {
+	ret := _m.Called()
+
+	var r0 protocol.DKG
+	var r1 error
+	if rf, ok := ret.Get(0).(func() (protocol.DKG, error)); ok {
+		return rf()
+	}
+	if rf, ok := ret.Get(0).(func() protocol.DKG); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(protocol.DKG)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Entry provides a mock function with given fields:
+func (_m *DynamicProtocolState) Entry() *flow.RichProtocolStateEntry {
+	ret := _m.Called()
+
+	var r0 *flow.RichProtocolStateEntry
+	if rf, ok := ret.Get(0).(func() *flow.RichProtocolStateEntry); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*flow.RichProtocolStateEntry)
+		}
+	}
+
+	return r0
+}
+
+// Epoch provides a mock function with given fields:
+func (_m *DynamicProtocolState) Epoch() uint64 {
+	ret := _m.Called()
+
+	var r0 uint64
+	if rf, ok := ret.Get(0).(func() uint64); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	return r0
+}
+
+// EpochCommit provides a mock function with given fields:
+func (_m *DynamicProtocolState) EpochCommit() *flow.EpochCommit {
+	ret := _m.Called()
+
+	var r0 *flow.EpochCommit
+	if rf, ok := ret.Get(0).(func() *flow.EpochCommit); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*flow.EpochCommit)
+		}
+	}
+
+	return r0
+}
+
+// EpochPhase provides a mock function with given fields:
+func (_m *DynamicProtocolState) EpochPhase() flow.EpochPhase {
+	ret := _m.Called()
+
+	var r0 flow.EpochPhase
+	if rf, ok := ret.Get(0).(func() flow.EpochPhase); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(flow.EpochPhase)
+	}
+
+	return r0
+}
+
+// EpochSetup provides a mock function with given fields:
+func (_m *DynamicProtocolState) EpochSetup() *flow.EpochSetup {
+	ret := _m.Called()
+
+	var r0 *flow.EpochSetup
+	if rf, ok := ret.Get(0).(func() *flow.EpochSetup); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*flow.EpochSetup)
+		}
+	}
+
+	return r0
+}
+
+// GlobalParams provides a mock function with given fields:
+func (_m *DynamicProtocolState) GlobalParams() protocol.GlobalParams {
+	ret := _m.Called()
+
+	var r0 protocol.GlobalParams
+	if rf, ok := ret.Get(0).(func() protocol.GlobalParams); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(protocol.GlobalParams)
+		}
+	}
+
+	return r0
+}
+
+// Identities provides a mock function with given fields:
+func (_m *DynamicProtocolState) Identities() flow.GenericIdentityList[flow.Identity] {
+	ret := _m.Called()
+
+	var r0 flow.GenericIdentityList[flow.Identity]
+	if rf, ok := ret.Get(0).(func() flow.GenericIdentityList[flow.Identity]); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(flow.GenericIdentityList[flow.Identity])
+		}
+	}
+
+	return r0
+}
+
+// InvalidEpochTransitionAttempted provides a mock function with given fields:
+func (_m *DynamicProtocolState) InvalidEpochTransitionAttempted() bool {
+	ret := _m.Called()
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func() bool); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+// PreviousEpochExists provides a mock function with given fields:
+func (_m *DynamicProtocolState) PreviousEpochExists() bool {
+	ret := _m.Called()
+
+	var r0 bool
+	if rf, ok := ret.Get(0).(func() bool); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	return r0
+}
+
+type mockConstructorTestingTNewDynamicProtocolState interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewDynamicProtocolState creates a new instance of DynamicProtocolState. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewDynamicProtocolState(t mockConstructorTestingTNewDynamicProtocolState) *DynamicProtocolState {
+	mock := &DynamicProtocolState{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/state/protocol/mock/epoch.go b/state/protocol/mock/epoch.go
index d1bfabce547..e7ff13b19e4 100644
--- a/state/protocol/mock/epoch.go
+++ b/state/protocol/mock/epoch.go
@@ -311,19 +311,19 @@ func (_m *Epoch) FirstView() (uint64, error) {
 }
 
 // InitialIdentities provides a mock function with given fields:
-func (_m *Epoch) InitialIdentities() (flow.IdentityList, error) {
+func (_m *Epoch) InitialIdentities() (flow.GenericIdentityList[flow.IdentitySkeleton], error) {
 	ret := _m.Called()
 
-	var r0 flow.IdentityList
+	var r0 flow.GenericIdentityList[flow.IdentitySkeleton]
 	var r1 error
-	if rf, ok := ret.Get(0).(func() (flow.IdentityList, error)); ok {
+	if rf, ok := ret.Get(0).(func() (flow.GenericIdentityList[flow.IdentitySkeleton], error)); ok {
 		return rf()
 	}
-	if rf, ok := ret.Get(0).(func() flow.IdentityList); ok {
+	if rf, ok := ret.Get(0).(func() flow.GenericIdentityList[flow.IdentitySkeleton]); ok {
 		r0 = rf()
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(flow.IdentityList)
+			r0 = ret.Get(0).(flow.GenericIdentityList[flow.IdentitySkeleton])
 		}
 	}
 
@@ -362,6 +362,54 @@ func (_m *Epoch) RandomSource() ([]byte, error) {
 	return r0, r1
 }
 
+// TargetDuration provides a mock function with given fields:
+func (_m *Epoch) TargetDuration() (uint64, error) {
+	ret := _m.Called()
+
+	var r0 uint64
+	var r1 error
+	if rf, ok := ret.Get(0).(func() (uint64, error)); ok {
+		return rf()
+	}
+	if rf, ok := ret.Get(0).(func() uint64); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// TargetEndTime provides a mock function with given fields:
+func (_m *Epoch) TargetEndTime() (uint64, error) {
+	ret := _m.Called()
+
+	var r0 uint64
+	var r1 error
+	if rf, ok := ret.Get(0).(func() (uint64, error)); ok {
+		return rf()
+	}
+	if rf, ok := ret.Get(0).(func() uint64); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 type mockConstructorTestingTNewEpoch interface {
 	mock.TestingT
 	Cleanup(func())
diff --git a/state/protocol/mock/global_params.go b/state/protocol/mock/global_params.go
index 64829403fc3..d5aa2f2472b 100644
--- a/state/protocol/mock/global_params.go
+++ b/state/protocol/mock/global_params.go
@@ -13,86 +13,52 @@ type GlobalParams struct {
 }
 
 // ChainID provides a mock function with given fields:
-func (_m *GlobalParams) ChainID() (flow.ChainID, error) {
+func (_m *GlobalParams) ChainID() flow.ChainID {
 	ret := _m.Called()
 
 	var r0 flow.ChainID
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (flow.ChainID, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() flow.ChainID); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(flow.ChainID)
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // EpochCommitSafetyThreshold provides a mock function with given fields:
-func (_m *GlobalParams) EpochCommitSafetyThreshold() (uint64, error) {
+func (_m *GlobalParams) EpochCommitSafetyThreshold() uint64 {
 	ret := _m.Called()
 
 	var r0 uint64
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (uint64, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() uint64); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(uint64)
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // ProtocolVersion provides a mock function with given fields:
-func (_m *GlobalParams) ProtocolVersion() (uint, error) {
+func (_m *GlobalParams) ProtocolVersion() uint {
 	ret := _m.Called()
 
 	var r0 uint
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (uint, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() uint); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(uint)
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // SporkID provides a mock function with given fields:
-func (_m *GlobalParams) SporkID() (flow.Identifier, error) {
+func (_m *GlobalParams) SporkID() flow.Identifier {
 	ret := _m.Called()
 
 	var r0 flow.Identifier
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (flow.Identifier, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() flow.Identifier); ok {
 		r0 = rf()
 	} else {
@@ -101,37 +67,21 @@ func (_m *GlobalParams) SporkID() (flow.Identifier, error) {
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // SporkRootBlockHeight provides a mock function with given fields:
-func (_m *GlobalParams) SporkRootBlockHeight() (uint64, error) {
+func (_m *GlobalParams) SporkRootBlockHeight() uint64 {
 	ret := _m.Called()
 
 	var r0 uint64
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (uint64, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() uint64); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(uint64)
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 type mockConstructorTestingTNewGlobalParams interface {
diff --git a/state/protocol/mock/initial_protocol_state.go b/state/protocol/mock/initial_protocol_state.go
new file mode 100644
index 00000000000..7d667ae11ed
--- /dev/null
+++ b/state/protocol/mock/initial_protocol_state.go
@@ -0,0 +1,144 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mock
+
+import (
+	flow "github.com/onflow/flow-go/model/flow"
+	mock "github.com/stretchr/testify/mock"
+
+	protocol "github.com/onflow/flow-go/state/protocol"
+)
+
+// InitialProtocolState is an autogenerated mock type for the InitialProtocolState type
+type InitialProtocolState struct {
+	mock.Mock
+}
+
+// Clustering provides a mock function with given fields:
+func (_m *InitialProtocolState) Clustering() (flow.ClusterList, error) {
+	ret := _m.Called()
+
+	var r0 flow.ClusterList
+	var r1 error
+	if rf, ok := ret.Get(0).(func() (flow.ClusterList, error)); ok {
+		return rf()
+	}
+	if rf, ok := ret.Get(0).(func() flow.ClusterList); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(flow.ClusterList)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// DKG provides a mock function with given fields:
+func (_m *InitialProtocolState) DKG() (protocol.DKG, error) {
+	ret := _m.Called()
+
+	var r0 protocol.DKG
+	var r1 error
+	if rf, ok := ret.Get(0).(func() (protocol.DKG, error)); ok {
+		return rf()
+	}
+	if rf, ok := ret.Get(0).(func() protocol.DKG); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(protocol.DKG)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Entry provides a mock function with given fields:
+func (_m *InitialProtocolState) Entry() *flow.RichProtocolStateEntry {
+	ret := _m.Called()
+
+	var r0 *flow.RichProtocolStateEntry
+	if rf, ok := ret.Get(0).(func() *flow.RichProtocolStateEntry); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*flow.RichProtocolStateEntry)
+		}
+	}
+
+	return r0
+}
+
+// Epoch provides a mock function with given fields:
+func (_m *InitialProtocolState) Epoch() uint64 {
+	ret := _m.Called()
+
+	var r0 uint64
+	if rf, ok := ret.Get(0).(func() uint64); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	return r0
+}
+
+// EpochCommit provides a mock function with given fields:
+func (_m *InitialProtocolState) EpochCommit() *flow.EpochCommit {
+	ret := _m.Called()
+
+	var r0 *flow.EpochCommit
+	if rf, ok := ret.Get(0).(func() *flow.EpochCommit); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*flow.EpochCommit)
+		}
+	}
+
+	return r0
+}
+
+// EpochSetup provides a mock function with given fields:
+func (_m *InitialProtocolState) EpochSetup() *flow.EpochSetup {
+	ret := _m.Called()
+
+	var r0 *flow.EpochSetup
+	if rf, ok := ret.Get(0).(func() *flow.EpochSetup); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*flow.EpochSetup)
+		}
+	}
+
+	return r0
+}
+
+type mockConstructorTestingTNewInitialProtocolState interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewInitialProtocolState creates a new instance of InitialProtocolState. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewInitialProtocolState(t mockConstructorTestingTNewInitialProtocolState) *InitialProtocolState {
+	mock := &InitialProtocolState{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/state/protocol/mock/instance_params.go b/state/protocol/mock/instance_params.go
index 4398e7fa5b4..d7ea446260e 100644
--- a/state/protocol/mock/instance_params.go
+++ b/state/protocol/mock/instance_params.go
@@ -37,14 +37,10 @@ func (_m *InstanceParams) EpochFallbackTriggered() (bool, error) {
 }
 
 // FinalizedRoot provides a mock function with given fields:
-func (_m *InstanceParams) FinalizedRoot() (*flow.Header, error) {
+func (_m *InstanceParams) FinalizedRoot() *flow.Header {
 	ret := _m.Called()
 
 	var r0 *flow.Header
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (*flow.Header, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() *flow.Header); ok {
 		r0 = rf()
 	} else {
@@ -53,24 +49,14 @@ func (_m *InstanceParams) FinalizedRoot() (*flow.Header, error) {
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // Seal provides a mock function with given fields:
-func (_m *InstanceParams) Seal() (*flow.Seal, error) {
+func (_m *InstanceParams) Seal() *flow.Seal {
 	ret := _m.Called()
 
 	var r0 *flow.Seal
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (*flow.Seal, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() *flow.Seal); ok {
 		r0 = rf()
 	} else {
@@ -79,24 +65,14 @@ func (_m *InstanceParams) Seal() (*flow.Seal, error) {
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // SealedRoot provides a mock function with given fields:
-func (_m *InstanceParams) SealedRoot() (*flow.Header, error) {
+func (_m *InstanceParams) SealedRoot() *flow.Header {
 	ret := _m.Called()
 
 	var r0 *flow.Header
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (*flow.Header, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() *flow.Header); ok {
 		r0 = rf()
 	} else {
@@ -105,13 +81,7 @@ func (_m *InstanceParams) SealedRoot() (*flow.Header, error) {
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 type mockConstructorTestingTNewInstanceParams interface {
diff --git a/state/protocol/mock/mutable_protocol_state.go b/state/protocol/mock/mutable_protocol_state.go
new file mode 100644
index 00000000000..a7d77f02d7f
--- /dev/null
+++ b/state/protocol/mock/mutable_protocol_state.go
@@ -0,0 +1,98 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mock
+
+import (
+	flow "github.com/onflow/flow-go/model/flow"
+	mock "github.com/stretchr/testify/mock"
+
+	protocol "github.com/onflow/flow-go/state/protocol"
+)
+
+// MutableProtocolState is an autogenerated mock type for the MutableProtocolState type
+type MutableProtocolState struct {
+	mock.Mock
+}
+
+// AtBlockID provides a mock function with given fields: blockID
+func (_m *MutableProtocolState) AtBlockID(blockID flow.Identifier) (protocol.DynamicProtocolState, error) {
+	ret := _m.Called(blockID)
+
+	var r0 protocol.DynamicProtocolState
+	var r1 error
+	if rf, ok := ret.Get(0).(func(flow.Identifier) (protocol.DynamicProtocolState, error)); ok {
+		return rf(blockID)
+	}
+	if rf, ok := ret.Get(0).(func(flow.Identifier) protocol.DynamicProtocolState); ok {
+		r0 = rf(blockID)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(protocol.DynamicProtocolState)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(flow.Identifier) error); ok {
+		r1 = rf(blockID)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GlobalParams provides a mock function with given fields:
+func (_m *MutableProtocolState) GlobalParams() protocol.GlobalParams {
+	ret := _m.Called()
+
+	var r0 protocol.GlobalParams
+	if rf, ok := ret.Get(0).(func() protocol.GlobalParams); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(protocol.GlobalParams)
+		}
+	}
+
+	return r0
+}
+
+// Mutator provides a mock function with given fields: candidateView, parentID
+func (_m *MutableProtocolState) Mutator(candidateView uint64, parentID flow.Identifier) (protocol.StateMutator, error) {
+	ret := _m.Called(candidateView, parentID)
+
+	var r0 protocol.StateMutator
+	var r1 error
+	if rf, ok := ret.Get(0).(func(uint64, flow.Identifier) (protocol.StateMutator, error)); ok {
+		return rf(candidateView, parentID)
+	}
+	if rf, ok := ret.Get(0).(func(uint64, flow.Identifier) protocol.StateMutator); ok {
+		r0 = rf(candidateView, parentID)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(protocol.StateMutator)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(uint64, flow.Identifier) error); ok {
+		r1 = rf(candidateView, parentID)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+type mockConstructorTestingTNewMutableProtocolState interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewMutableProtocolState creates a new instance of MutableProtocolState. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewMutableProtocolState(t mockConstructorTestingTNewMutableProtocolState) *MutableProtocolState {
+	mock := &MutableProtocolState{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/state/protocol/mock/params.go b/state/protocol/mock/params.go
index a6000f165e5..a6d5f88e79b 100644
--- a/state/protocol/mock/params.go
+++ b/state/protocol/mock/params.go
@@ -13,51 +13,31 @@ type Params struct {
 }
 
 // ChainID provides a mock function with given fields:
-func (_m *Params) ChainID() (flow.ChainID, error) {
+func (_m *Params) ChainID() flow.ChainID {
 	ret := _m.Called()
 
 	var r0 flow.ChainID
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (flow.ChainID, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() flow.ChainID); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(flow.ChainID)
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // EpochCommitSafetyThreshold provides a mock function with given fields:
-func (_m *Params) EpochCommitSafetyThreshold() (uint64, error) {
+func (_m *Params) EpochCommitSafetyThreshold() uint64 {
 	ret := _m.Called()
 
 	var r0 uint64
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (uint64, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() uint64); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(uint64)
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // EpochFallbackTriggered provides a mock function with given fields:
@@ -85,14 +65,10 @@ func (_m *Params) EpochFallbackTriggered() (bool, error) {
 }
 
 // FinalizedRoot provides a mock function with given fields:
-func (_m *Params) FinalizedRoot() (*flow.Header, error) {
+func (_m *Params) FinalizedRoot() *flow.Header {
 	ret := _m.Called()
 
 	var r0 *flow.Header
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (*flow.Header, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() *flow.Header); ok {
 		r0 = rf()
 	} else {
@@ -101,48 +77,28 @@ func (_m *Params) FinalizedRoot() (*flow.Header, error) {
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // ProtocolVersion provides a mock function with given fields:
-func (_m *Params) ProtocolVersion() (uint, error) {
+func (_m *Params) ProtocolVersion() uint {
 	ret := _m.Called()
 
 	var r0 uint
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (uint, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() uint); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(uint)
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // Seal provides a mock function with given fields:
-func (_m *Params) Seal() (*flow.Seal, error) {
+func (_m *Params) Seal() *flow.Seal {
 	ret := _m.Called()
 
 	var r0 *flow.Seal
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (*flow.Seal, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() *flow.Seal); ok {
 		r0 = rf()
 	} else {
@@ -151,24 +107,14 @@ func (_m *Params) Seal() (*flow.Seal, error) {
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // SealedRoot provides a mock function with given fields:
-func (_m *Params) SealedRoot() (*flow.Header, error) {
+func (_m *Params) SealedRoot() *flow.Header {
 	ret := _m.Called()
 
 	var r0 *flow.Header
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (*flow.Header, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() *flow.Header); ok {
 		r0 = rf()
 	} else {
@@ -177,24 +123,14 @@ func (_m *Params) SealedRoot() (*flow.Header, error) {
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // SporkID provides a mock function with given fields:
-func (_m *Params) SporkID() (flow.Identifier, error) {
+func (_m *Params) SporkID() flow.Identifier {
 	ret := _m.Called()
 
 	var r0 flow.Identifier
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (flow.Identifier, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() flow.Identifier); ok {
 		r0 = rf()
 	} else {
@@ -203,37 +139,21 @@ func (_m *Params) SporkID() (flow.Identifier, error) {
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 // SporkRootBlockHeight provides a mock function with given fields:
-func (_m *Params) SporkRootBlockHeight() (uint64, error) {
+func (_m *Params) SporkRootBlockHeight() uint64 {
 	ret := _m.Called()
 
 	var r0 uint64
-	var r1 error
-	if rf, ok := ret.Get(0).(func() (uint64, error)); ok {
-		return rf()
-	}
 	if rf, ok := ret.Get(0).(func() uint64); ok {
 		r0 = rf()
 	} else {
 		r0 = ret.Get(0).(uint64)
 	}
 
-	if rf, ok := ret.Get(1).(func() error); ok {
-		r1 = rf()
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
+	return r0
 }
 
 type mockConstructorTestingTNewParams interface {
diff --git a/state/protocol/mock/protocol_state.go b/state/protocol/mock/protocol_state.go
new file mode 100644
index 00000000000..3baf2962503
--- /dev/null
+++ b/state/protocol/mock/protocol_state.go
@@ -0,0 +1,72 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mock
+
+import (
+	flow "github.com/onflow/flow-go/model/flow"
+	mock "github.com/stretchr/testify/mock"
+
+	protocol "github.com/onflow/flow-go/state/protocol"
+)
+
+// ProtocolState is an autogenerated mock type for the ProtocolState type
+type ProtocolState struct {
+	mock.Mock
+}
+
+// AtBlockID provides a mock function with given fields: blockID
+func (_m *ProtocolState) AtBlockID(blockID flow.Identifier) (protocol.DynamicProtocolState, error) {
+	ret := _m.Called(blockID)
+
+	var r0 protocol.DynamicProtocolState
+	var r1 error
+	if rf, ok := ret.Get(0).(func(flow.Identifier) (protocol.DynamicProtocolState, error)); ok {
+		return rf(blockID)
+	}
+	if rf, ok := ret.Get(0).(func(flow.Identifier) protocol.DynamicProtocolState); ok {
+		r0 = rf(blockID)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(protocol.DynamicProtocolState)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(flow.Identifier) error); ok {
+		r1 = rf(blockID)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GlobalParams provides a mock function with given fields:
+func (_m *ProtocolState) GlobalParams() protocol.GlobalParams {
+	ret := _m.Called()
+
+	var r0 protocol.GlobalParams
+	if rf, ok := ret.Get(0).(func() protocol.GlobalParams); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(protocol.GlobalParams)
+		}
+	}
+
+	return r0
+}
+
+type mockConstructorTestingTNewProtocolState interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewProtocolState creates a new instance of ProtocolState. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewProtocolState(t mockConstructorTestingTNewProtocolState) *ProtocolState {
+	mock := &ProtocolState{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/state/protocol/mock/snapshot.go b/state/protocol/mock/snapshot.go
index 95c22c64fb4..15aa41b035c 100644
--- a/state/protocol/mock/snapshot.go
+++ b/state/protocol/mock/snapshot.go
@@ -109,23 +109,23 @@ func (_m *Snapshot) Head() (*flow.Header, error) {
 }
 
 // Identities provides a mock function with given fields: selector
-func (_m *Snapshot) Identities(selector flow.IdentityFilter) (flow.IdentityList, error) {
+func (_m *Snapshot) Identities(selector flow.IdentityFilter[flow.Identity]) (flow.GenericIdentityList[flow.Identity], error) {
 	ret := _m.Called(selector)
 
-	var r0 flow.IdentityList
+	var r0 flow.GenericIdentityList[flow.Identity]
 	var r1 error
-	if rf, ok := ret.Get(0).(func(flow.IdentityFilter) (flow.IdentityList, error)); ok {
+	if rf, ok := ret.Get(0).(func(flow.IdentityFilter[flow.Identity]) (flow.GenericIdentityList[flow.Identity], error)); ok {
 		return rf(selector)
 	}
-	if rf, ok := ret.Get(0).(func(flow.IdentityFilter) flow.IdentityList); ok {
+	if rf, ok := ret.Get(0).(func(flow.IdentityFilter[flow.Identity]) flow.GenericIdentityList[flow.Identity]); ok {
 		r0 = rf(selector)
 	} else {
 		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(flow.IdentityList)
+			r0 = ret.Get(0).(flow.GenericIdentityList[flow.Identity])
 		}
 	}
 
-	if rf, ok := ret.Get(1).(func(flow.IdentityFilter) error); ok {
+	if rf, ok := ret.Get(1).(func(flow.IdentityFilter[flow.Identity]) error); ok {
 		r1 = rf(selector)
 	} else {
 		r1 = ret.Error(1)
@@ -200,6 +200,32 @@ func (_m *Snapshot) Phase() (flow.EpochPhase, error) {
 	return r0, r1
 }
 
+// ProtocolState provides a mock function with given fields:
+func (_m *Snapshot) ProtocolState() (protocol.DynamicProtocolState, error) {
+	ret := _m.Called()
+
+	var r0 protocol.DynamicProtocolState
+	var r1 error
+	if rf, ok := ret.Get(0).(func() (protocol.DynamicProtocolState, error)); ok {
+		return rf()
+	}
+	if rf, ok := ret.Get(0).(func() protocol.DynamicProtocolState); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(protocol.DynamicProtocolState)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func() error); ok {
+		r1 = rf()
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // QuorumCertificate provides a mock function with given fields:
 func (_m *Snapshot) QuorumCertificate() (*flow.QuorumCertificate, error) {
 	ret := _m.Called()
diff --git a/state/protocol/mock/state_mutator.go b/state/protocol/mock/state_mutator.go
new file mode 100644
index 00000000000..5bb20d4561e
--- /dev/null
+++ b/state/protocol/mock/state_mutator.go
@@ -0,0 +1,88 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mock
+
+import (
+	flow "github.com/onflow/flow-go/model/flow"
+	mock "github.com/stretchr/testify/mock"
+
+	transaction "github.com/onflow/flow-go/storage/badger/transaction"
+)
+
+// StateMutator is an autogenerated mock type for the StateMutator type
+type StateMutator struct {
+	mock.Mock
+}
+
+// ApplyServiceEventsFromValidatedSeals provides a mock function with given fields: seals
+func (_m *StateMutator) ApplyServiceEventsFromValidatedSeals(seals []*flow.Seal) error {
+	ret := _m.Called(seals)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func([]*flow.Seal) error); ok {
+		r0 = rf(seals)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// Build provides a mock function with given fields:
+func (_m *StateMutator) Build() (bool, *flow.ProtocolStateEntry, flow.Identifier, []func(*transaction.Tx) error) {
+	ret := _m.Called()
+
+	var r0 bool
+	var r1 *flow.ProtocolStateEntry
+	var r2 flow.Identifier
+	var r3 []func(*transaction.Tx) error
+	if rf, ok := ret.Get(0).(func() (bool, *flow.ProtocolStateEntry, flow.Identifier, []func(*transaction.Tx) error)); ok {
+		return rf()
+	}
+	if rf, ok := ret.Get(0).(func() bool); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	if rf, ok := ret.Get(1).(func() *flow.ProtocolStateEntry); ok {
+		r1 = rf()
+	} else {
+		if ret.Get(1) != nil {
+			r1 = ret.Get(1).(*flow.ProtocolStateEntry)
+		}
+	}
+
+	if rf, ok := ret.Get(2).(func() flow.Identifier); ok {
+		r2 = rf()
+	} else {
+		if ret.Get(2) != nil {
+			r2 = ret.Get(2).(flow.Identifier)
+		}
+	}
+
+	if rf, ok := ret.Get(3).(func() []func(*transaction.Tx) error); ok {
+		r3 = rf()
+	} else {
+		if ret.Get(3) != nil {
+			r3 = ret.Get(3).([]func(*transaction.Tx) error)
+		}
+	}
+
+	return r0, r1, r2, r3
+}
+
+type mockConstructorTestingTNewStateMutator interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewStateMutator creates a new instance of StateMutator. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewStateMutator(t mockConstructorTestingTNewStateMutator) *StateMutator {
+	mock := &StateMutator{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/state/protocol/params.go b/state/protocol/params.go
index be308d30145..214da10d214 100644
--- a/state/protocol/params.go
+++ b/state/protocol/params.go
@@ -20,24 +20,21 @@ type InstanceParams interface {
 	// FinalizedRoot returns the finalized root header of the current protocol state. This will be
 	// the head of the protocol state snapshot used to bootstrap this state and
 	// may differ from node to node for the same protocol state.
-	// No errors are expected during normal operation.
-	FinalizedRoot() (*flow.Header, error)
+	FinalizedRoot() *flow.Header
 
 	// SealedRoot returns the sealed root block. If it's different from FinalizedRoot() block,
 	// it means the node is bootstrapped from mid-spork.
-	// No errors are expected during normal operation.
-	SealedRoot() (*flow.Header, error)
+	SealedRoot() *flow.Header
 
-	// Seal returns the root block seal of the current protocol state. This will be
-	// the seal for the root block used to bootstrap this state and may differ from
-	// node to node for the same protocol state.
-	// No errors are expected during normal operation.
-	Seal() (*flow.Seal, error)
+	// Seal returns the root block seal of the current protocol state. This is the seal for the
+	// `SealedRoot` block that was used to bootstrap this state. It may differ from node to node.
+	Seal() *flow.Seal
 
-	// EpochFallbackTriggered returns whether epoch fallback mode (EECC) has been triggered.
-	// EECC is a permanent, spork-scoped state which is triggered when the next
-	// epoch fails to be committed in the allocated time. Once EECC is triggered,
+	// EpochFallbackTriggered returns whether Epoch Fallback Mode [EFM] has been triggered.
+	// EFM is a permanent, spork-scoped state which is triggered when the next
+	// epoch fails to be committed in the allocated time. Once EFM is triggered,
 	// it will remain in effect until the next spork.
+	// TODO for 'leaving Epoch Fallback via special service event'
 	// No errors are expected during normal operation.
 	EpochFallbackTriggered() (bool, error)
 }
@@ -49,32 +46,33 @@ type GlobalParams interface {
 
 	// ChainID returns the chain ID for the current Flow network. The chain ID
 	// uniquely identifies a Flow network in perpetuity across epochs and sporks.
-	// No errors are expected during normal operation.
-	ChainID() (flow.ChainID, error)
+	ChainID() flow.ChainID
 
 	// SporkID returns the unique identifier for this network within the current spork.
 	// This ID is determined at the beginning of a spork during bootstrapping and is
 	// part of the root protocol state snapshot.
-	// No errors are expected during normal operation.
-	SporkID() (flow.Identifier, error)
+	SporkID() flow.Identifier
 
 	// SporkRootBlockHeight returns the height of the spork's root block.
 	// This value is determined at the beginning of a spork during bootstrapping.
 	// If node uses a sealing segment for bootstrapping then this value will be carried over
 	// as part of snapshot.
-	// No errors are expected during normal operation.
-	SporkRootBlockHeight() (uint64, error)
+	SporkRootBlockHeight() uint64
 
 	// ProtocolVersion returns the protocol version, the major software version
 	// of the protocol software.
-	// No errors are expected during normal operation.
-	ProtocolVersion() (uint, error)
+	ProtocolVersion() uint
 
-	// EpochCommitSafetyThreshold defines a deadline for sealing the EpochCommit
+	// EpochCommitSafetyThreshold [t] defines a deadline for sealing the EpochCommit
 	// service event near the end of each epoch - the "epoch commitment deadline".
 	// Given a safety threshold t, the deadline for an epoch with final view f is:
 	//   Epoch Commitment Deadline: d=f-t
 	//
+	//                     Epoch Commitment Deadline
+	//   EPOCH N           ↓                 EPOCH N+1
+	//   ...---------------|---------------| |-----...
+	//   view:             d<·····t·······>f
+	//
 	// DEFINITION:
 	// This deadline is used to determine when to trigger epoch emergency fallback mode.
 	// Epoch Emergency Fallback mode is triggered when the EpochCommit service event
@@ -88,32 +86,38 @@ type GlobalParams interface {
 	// * The seal for block A was included in some block C, s.t C is an ancestor of R
 	//
 	// When we finalize the first block B with B.View >= d:
-	// HAPPY PATH: If an EpochCommit service event has been sealed w.r.t. B, no action is taken.
-	// FALLBACK PATH: If no EpochCommit service event has been sealed w.r.t. B, epoch fallback mode (EECC) is triggered.
+	//  - HAPPY PATH: If an EpochCommit service event has been sealed w.r.t. B, no action is taken.
+	//  - FALLBACK PATH: If no EpochCommit service event has been sealed w.r.t. B,
+	//    Epoch Fallback Mode [EFM] is triggered.
 	//
 	// CONTEXT:
 	// The epoch commitment deadline exists to ensure that all nodes agree on
-	// whether epoch fallback mode is triggered for a particular epoch, before
-	// the epoch actually ends. Although the use of this deadline DOES NOT
-	// guarantee these properties, it is a simpler way to assure them with high
-	// likelihood, given reasonable configuration.
-	// In particular, all nodes will agree about EECC being triggered (or not)
-	// if at least one block with view in [d, f] is finalized - in other words
-	// at least one block is finalized after the epoch commitment deadline, and
-	// before the next epoch begins.
+	// whether Epoch Fallback Mode is triggered for a particular epoch, before
+	// the epoch actually ends. In particular, all nodes will agree about EFM
+	// being triggered (or not) if at least one block with view in [d, f] is
+	// finalized - in other words, we require at least one block being finalized
+	// after the epoch commitment deadline, and before the next epoch begins.
 	//
-	// When selecting a threshold value, ensure:
-	// * The deadline is after the end of the DKG, with enough buffer between
-	//   the two that the EpochCommit event is overwhelmingly likely to be emitted
-	//   before the deadline, if it is emitted at all.
-	// * The buffer between the deadline and the final view of the epoch is large
-	//   enough that the network is overwhelming likely to finalize at least one
-	//   block with a view in this range
+	// It should be noted that we are employing a heuristic here, which succeeds with
+	// overwhelming probability of nearly 1. However, theoretically it is possible that
+	// no blocks are finalized within t views. In this edge case, the nodes would have not
+	// detected the epoch commit phase failing and the protocol would just halt at the end
+	// of the epoch. However, we emphasize that this is extremely unlikely, because the
+	// probability of randomly selecting t faulty leaders in sequence decays to zero
+	// exponentially with increasing t. Furthermore, failing to finalize blocks for a
+	// noticeable period entails halting block sealing, which would trigger human
+	// intervention on much smaller time scales than t views.
+	// Therefore, t should be chosen such that it takes more than 30mins to pass t views
+	// under happy path operation. Significant larger values are ok, but t views equalling
+	// 30 mins should be seen as a lower bound.
 	//
-	//                /- Epoch Commitment Deadline
-	// EPOCH N        v        EPOCH N+1
-	// ...------------|------||-----...
+	// When selecting a threshold value, ensure:
+	//  * The deadline is after the end of the DKG, with enough buffer between
+	//    the two that the EpochCommit event is overwhelmingly likely to be emitted
+	//    before the deadline, if it is emitted at all.
+	//  * The buffer between the deadline and the final view of the epoch is large
+	//    enough that the network is overwhelming likely to finalize at least one
+	//    block with a view in this range
 	//
-	// No errors are expected during normal operation.
-	EpochCommitSafetyThreshold() (uint64, error)
+	EpochCommitSafetyThreshold() uint64
 }
diff --git a/state/protocol/protocol_state.go b/state/protocol/protocol_state.go
new file mode 100644
index 00000000000..e305ffc7f77
--- /dev/null
+++ b/state/protocol/protocol_state.go
@@ -0,0 +1,179 @@
+package protocol
+
+import (
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/storage/badger/transaction"
+)
+
+// InitialProtocolState returns constant data for given epoch.
+// This interface can be only obtained for epochs that have progressed to epoch commit event.
+type InitialProtocolState interface {
+	// Epoch returns counter of epoch.
+	Epoch() uint64
+	// Clustering returns initial clustering from epoch setup.
+	// No errors are expected during normal operations.
+	Clustering() (flow.ClusterList, error)
+	// EpochSetup returns original epoch setup event that was used to initialize the protocol state.
+	EpochSetup() *flow.EpochSetup
+	// EpochCommit returns original epoch commit event that was used to update the protocol state.
+	EpochCommit() *flow.EpochCommit
+	// DKG returns information about DKG that was obtained from EpochCommit event.
+	// No errors are expected during normal operations.
+	DKG() (DKG, error)
+	// Entry Returns low-level protocol state entry that was used to initialize this object.
+	// It shouldn't be used by high-level logic, it is useful for some cases such as bootstrapping.
+	// Prefer using other methods to access protocol state.
+	Entry() *flow.RichProtocolStateEntry
+}
+
+// DynamicProtocolState extends the InitialProtocolState with data that can change from block to block.
+// It can be used to access the identity table at given block.
+type DynamicProtocolState interface {
+	InitialProtocolState
+
+	// InvalidEpochTransitionAttempted denotes whether an invalid epoch state transition was attempted
+	// on the fork ending this block. Once the first block where this flag is true is finalized, epoch
+	// fallback mode is triggered.
+	// TODO for 'leaving Epoch Fallback via special service event': at the moment, this is a one-way transition and requires a spork to recover - need to revisit for sporkless EFM recovery
+	InvalidEpochTransitionAttempted() bool
+	// PreviousEpochExists returns true if a previous epoch exists. This is true for all epoch
+	// except those immediately following a spork.
+	PreviousEpochExists() bool
+	// EpochPhase returns the epoch phase for the current epoch.
+	EpochPhase() flow.EpochPhase
+
+	// Identities returns identities (in canonical ordering) that can participate in the current or previous
+	// or next epochs. Let P be the set of identities in the previous epoch, C be the set of identities in
+	// the current epoch, and N be the set of identities in the next epoch.
+	// The set of authorized identities this function returns is different depending on epoch state:
+	// EpochStaking phase:
+	//   - nodes in C with status `flow.EpochParticipationStatusActive`
+	//   - nodes in P-C with status `flow.EpochParticipationStatusLeaving`
+	// EpochSetup/EpochCommitted phase:
+	//   - nodes in C with status `flow.EpochParticipationStatusActive`
+	//   - nodes in N-C with status `flow.EpochParticipationStatusJoining`
+	Identities() flow.IdentityList
+	// GlobalParams returns params that are same for all nodes in the network.
+	GlobalParams() GlobalParams
+}
+
+// ProtocolState is the read-only interface for protocol state, it allows to query information
+// on a per-block and per-epoch basis.
+type ProtocolState interface {
+	// ByEpoch returns an object with static protocol state information by epoch number.
+	// To be able to use this interface we need to observe both epoch setup and commit events.
+	// Not available for next epoch unless we have observed an EpochCommit event.
+	// No errors are expected during normal operations.
+	// TODO(yuraolex): check return types
+	// TODO(yuraolex): decide if we really need this approach. It's unclear if it's useful to query
+	//  by epoch counter. To implement it we need an additional index by epoch counter. Alternatively we need a way to map
+	//  epoch counter -> block ID. It gets worse if we consider that we need a way to get the epoch counter itself at caller side.
+	//ByEpoch(epoch uint64) (InitialProtocolState, error)
+
+	// AtBlockID returns protocol state at block ID.
+	// The resulting protocol state is returned AFTER applying updates that are contained in block.
+	// Can be queried for any block that has been added to the block tree.
+	// Returns:
+	// - (DynamicProtocolState, nil) - if there is a protocol state associated with given block ID.
+	// - (nil, storage.ErrNotFound) - if there is no protocol state associated with given block ID.
+	// - (nil, exception) - any other error should be treated as exception.
+	AtBlockID(blockID flow.Identifier) (DynamicProtocolState, error)
+
+	// GlobalParams returns params that are the same for all nodes in the network.
+	GlobalParams() GlobalParams
+}
+
+type MutableProtocolState interface {
+	ProtocolState
+
+	// Mutator instantiates a `StateMutator` based on the previous protocol state.
+	// Has to be called for each block to evolve the protocol state.
+	// Expected errors during normal operations:
+	//  * `storage.ErrNotFound` if no protocol state for parent block is known.
+	Mutator(candidateView uint64, parentID flow.Identifier) (StateMutator, error)
+}
+
+// StateMutator is a stateful object to evolve the protocol state. It is instantiated from the parent block's protocol state.
+// State-changing operations can be iteratively applied and the StateMutator will internally evolve its in-memory state.
+// While the StateMutator does not modify the database, it internally tracks the necessary database updates to persist its
+// dependencies (specifically EpochSetup and EpochCommit events). Upon calling `Build` the StateMutator returns the updated
+// protocol state, its ID and all database updates necessary for persisting the updated protocol state.
+//
+// The StateMutator is used by a replica's compliance layer to update protocol state when observing state-changing service in
+// blocks. It is used by the primary in the block building process to obtain the correct protocol state for a proposal.
+// Specifically, the leader may include state-changing service events in the block payload. The flow protocol prescribes that
+// the proposal needs to include the ID of the protocol state, _after_ processing the payload incl. all state-changing events.
+// Therefore, the leader instantiates a StateMutator, applies the service events to it and builds the updated protocol state ID.
+//
+// Not safe for concurrent use.
+type StateMutator interface {
+	// Build returns:
+	//   - hasChanges: flag whether there were any changes; otherwise, `updatedState` and `stateID` equal the parent state
+	//   - updatedState: the ProtocolState after applying all updates.
+	//   - stateID: the hash commitment to the `updatedState`
+	//   - dbUpdates: database updates necessary for persisting the updated protocol state's *dependencies*.
+	//     If hasChanges is false, updatedState is empty. Caution: persisting the `updatedState` itself and adding
+	//     it to the relevant indices is _not_ in `dbUpdates`. Persisting and indexing `updatedState` is the responsibility
+	//     of the calling code (specifically `FollowerState`).
+	//
+	// updated protocol state entry, state ID and a flag indicating if there were any changes.
+	Build() (hasChanges bool, updatedState *flow.ProtocolStateEntry, stateID flow.Identifier, dbUpdates []transaction.DeferredDBUpdate)
+
+	// ApplyServiceEventsFromValidatedSeals applies the state changes that are delivered via
+	// sealed service events:
+	//   - iterating over the sealed service events in order of increasing height
+	//   - identifying state-changing service event and calling into the embedded
+	//     ProtocolStateMachine to apply the respective state update
+	//   - tracking deferred database updates necessary to persist the updated
+	//     protocol state's *dependencies*. Persisting and indexing `updatedState`
+	//     is the responsibility of the calling code (specifically `FollowerState`)
+	//
+	// All updates only mutate the `StateMutator`'s internal in-memory copy of the
+	// protocol state, without changing the parent state (i.e. the state we started from).
+	//
+	// SAFETY REQUIREMENT:
+	// The StateMutator assumes that the proposal has passed the following correctness checks!
+	//   - The seals in the payload continuously follow the ancestry of this fork. Specifically,
+	//     there are no gaps in the seals.
+	//   - The seals guarantee correctness of the sealed execution result, including the contained
+	//     service events. This is actively checked by the verification node, whose aggregated
+	//     approvals in the form of a seal attest to the correctness of the sealed execution result,
+	//     including the contained.
+	//
+	// Consensus nodes actively verify protocol compliance for any block proposal they receive,
+	// including integrity of each seal individually as well as the seals continuously following the
+	// fork. Light clients only process certified blocks, which guarantees that consensus nodes already
+	// ran those checks and found the proposal to be valid.
+	//
+	// Details on SERVICE EVENTS:
+	// Consider a chain where a service event is emitted during execution of block A.
+	// Block B contains an execution receipt for A. Block C contains a seal for block
+	// A's execution result.
+	//
+	//	A <- .. <- B(RA) <- .. <- C(SA)
+	//
+	// Service Events are included within execution results, which are stored
+	// opaquely as part of the block payload in block B. We only validate, process and persist
+	// the typed service event to storage once we process C, the block containing the
+	// seal for block A. This is because we rely on the sealing subsystem to validate
+	// correctness of the service event before processing it.
+	// Consequently, any change to the protocol state introduced by a service event
+	// emitted during execution of block A would only become visible when querying
+	// C or its descendants.
+	//
+	// Error returns:
+	//   - Per convention, the input seals from the block payload have already confirmed to be protocol compliant.
+	//     Hence, the service events in the sealed execution results represent the honest execution path.
+	//     Therefore, the sealed service events should encode a valid evolution of the protocol state -- provided
+	//     the system smart contracts are correct.
+	//   - As we can rule out byzantine attacks as the source of failures, the only remaining sources of problems
+	//     can be (a) bugs in the system smart contracts or (b) bugs in the node implementation.
+	//     A service event not representing a valid state transition despite all consistency checks passing
+	//     is interpreted as case (a) and handled internally within the StateMutator. In short, we go into Epoch
+	//     Fallback Mode by copying the parent state (a valid state snapshot) and setting the
+	//     `InvalidEpochTransitionAttempted` flag. All subsequent Epoch-lifecycle events are ignored.
+	//   - A consistency or sanity check failing within the StateMutator is likely the symptom of an internal bug
+	//     in the node software or state corruption, i.e. case (b). This is the only scenario where the error return
+	//     of this function is not nil. If such an exception is returned, continuing is not an option.
+	ApplyServiceEventsFromValidatedSeals(seals []*flow.Seal) error
+}
diff --git a/state/protocol/protocol_state/base_statemachine.go b/state/protocol/protocol_state/base_statemachine.go
new file mode 100644
index 00000000000..e6965fe193e
--- /dev/null
+++ b/state/protocol/protocol_state/base_statemachine.go
@@ -0,0 +1,156 @@
+package protocol_state
+
+import (
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/state/protocol"
+)
+
+// ProtocolStateMachine implements a low-level interface for state-changing operations on the protocol state.
+// It is used by higher level logic to evolve the protocol state when certain events that are stored in blocks are observed.
+// The ProtocolStateMachine is stateful and internally tracks the current protocol state. A separate instance is created for
+// each block that is being processed.
+type ProtocolStateMachine interface {
+	// Build returns updated protocol state entry, state ID and a flag indicating if there were any changes.
+	// CAUTION:
+	// Do NOT call Build, if the ProtocolStateMachine instance has returned a `protocol.InvalidServiceEventError`
+	// at any time during its lifetime. After this error, the ProtocolStateMachine is left with a potentially
+	// dysfunctional state and should be discarded.
+	Build() (updatedState *flow.ProtocolStateEntry, stateID flow.Identifier, hasChanges bool)
+
+	// ProcessEpochSetup updates current protocol state with data from epoch setup event.
+	// Processing epoch setup event also affects identity table for current epoch.
+	// Observing an epoch setup event, transitions protocol state from staking to setup phase, we stop returning
+	// identities from previous+current epochs and start returning identities from current+next epochs.
+	// As a result of this operation protocol state for the next epoch will be created.
+	// Returned boolean indicates if event triggered a transition in the state machine or not.
+	// Implementors must never return (true, error).
+	// Expected errors indicating that we are leaving the happy-path of the epoch transitions
+	//   - `protocol.InvalidServiceEventError` - if the service event is invalid or is not a valid state transition for the current protocol state.
+	//     CAUTION: the protocolStateMachine is left with a potentially dysfunctional state when this error occurs. Do NOT call the Build method
+	//     after such error and discard the protocolStateMachine!
+	ProcessEpochSetup(epochSetup *flow.EpochSetup) (bool, error)
+
+	// ProcessEpochCommit updates current protocol state with data from epoch commit event.
+	// Observing an epoch setup commit, transitions protocol state from setup to commit phase.
+	// At this point, we have finished construction of the next epoch.
+	// As a result of this operation protocol state for next epoch will be committed.
+	// Returned boolean indicates if event triggered a transition in the state machine or not.
+	// Implementors must never return (true, error).
+	// Expected errors indicating that we are leaving the happy-path of the epoch transitions
+	//   - `protocol.InvalidServiceEventError` - if the service event is invalid or is not a valid state transition for the current protocol state.
+	//     CAUTION: the protocolStateMachine is left with a potentially dysfunctional state when this error occurs. Do NOT call the Build method
+	//     after such error and discard the protocolStateMachine!
+	ProcessEpochCommit(epochCommit *flow.EpochCommit) (bool, error)
+
+	// EjectIdentity updates identity table by changing the node's participation status to 'ejected'.
+	// Should pass identity which is already present in the table, otherwise an exception will be raised.
+	// Expected errors during normal operations:
+	// - `protocol.InvalidServiceEventError` if the updated identity is not found in current and adjacent epochs.
+	EjectIdentity(nodeID flow.Identifier) error
+
+	// TransitionToNextEpoch discards current protocol state and transitions to the next epoch.
+	// Epoch transition is only allowed when:
+	// - next epoch has been set up,
+	// - next epoch has been committed,
+	// - candidate block is in the next epoch.
+	// No errors are expected during normal operations.
+	TransitionToNextEpoch() error
+
+	// View returns the view that is associated with this ProtocolStateMachine.
+	// The view of the ProtocolStateMachine equals the view of the block carrying the respective updates.
+	View() uint64
+
+	// ParentState returns parent protocol state that is associated with this ProtocolStateMachine.
+	ParentState() *flow.RichProtocolStateEntry
+}
+
+// baseProtocolStateMachine implements common logic for evolving protocol state both in happy path and epoch fallback
+// operation modes. It partially implements `ProtocolStateMachine` and is used as building block for more complex implementations.
+type baseProtocolStateMachine struct {
+	parentState *flow.RichProtocolStateEntry
+	state       *flow.ProtocolStateEntry
+	view        uint64
+
+	// The following fields are maps from NodeID → DynamicIdentityEntry for the nodes that are *active* in the respective epoch.
+	// Active means that these nodes are authorized to contribute to extending the chain. Formally, a node is active if and only
+	// if it is listed in the EpochSetup event for the respective epoch. Note that map values are pointers, so writes to map values
+	// will modify the respective DynamicIdentityEntry in `state`.
+
+	prevEpochIdentitiesLookup    map[flow.Identifier]*flow.DynamicIdentityEntry // lookup for nodes active in the previous epoch, may be nil or empty
+	currentEpochIdentitiesLookup map[flow.Identifier]*flow.DynamicIdentityEntry // lookup for nodes active in the current epoch, never nil or empty
+	nextEpochIdentitiesLookup    map[flow.Identifier]*flow.DynamicIdentityEntry // lookup for nodes active in the next epoch, may be nil or empty
+}
+
+// Build returns updated protocol state entry, state ID and a flag indicating if there were any changes.
+// CAUTION:
+// Do NOT call Build, if the ProtocolStateMachine instance has returned a `protocol.InvalidServiceEventError`
+// at any time during its lifetime. After this error, the ProtocolStateMachine is left with a potentially
+// dysfunctional state and should be discarded.
+func (u *baseProtocolStateMachine) Build() (updatedState *flow.ProtocolStateEntry, stateID flow.Identifier, hasChanges bool) {
+	updatedState = u.state.Copy()
+	stateID = updatedState.ID()
+	hasChanges = stateID != u.parentState.ID()
+	return
+}
+
+// View returns the view that is associated with this state protocolStateMachine.
+// The view of the ProtocolStateMachine equals the view of the block carrying the respective updates.
+func (u *baseProtocolStateMachine) View() uint64 {
+	return u.view
+}
+
+// ParentState returns parent protocol state that is associated with this state protocolStateMachine.
+func (u *baseProtocolStateMachine) ParentState() *flow.RichProtocolStateEntry {
+	return u.parentState
+}
+
+// ensureLookupPopulated ensures that current and next epoch identities lookups are populated.
+// We use this to avoid populating lookups on every UpdateIdentity call.
+func (u *baseProtocolStateMachine) ensureLookupPopulated() {
+	if len(u.currentEpochIdentitiesLookup) > 0 {
+		return
+	}
+	u.rebuildIdentityLookup()
+}
+
+// rebuildIdentityLookup re-generates lookups of *active* participants for
+// previous (optional, if u.state.PreviousEpoch ≠ nil), current (required) and
+// next epoch (optional, if u.state.NextEpoch ≠ nil).
+func (u *baseProtocolStateMachine) rebuildIdentityLookup() {
+	if u.state.PreviousEpoch != nil {
+		u.prevEpochIdentitiesLookup = u.state.PreviousEpoch.ActiveIdentities.Lookup()
+	} else {
+		u.prevEpochIdentitiesLookup = nil
+	}
+	u.currentEpochIdentitiesLookup = u.state.CurrentEpoch.ActiveIdentities.Lookup()
+	if u.state.NextEpoch != nil {
+		u.nextEpochIdentitiesLookup = u.state.NextEpoch.ActiveIdentities.Lookup()
+	} else {
+		u.nextEpochIdentitiesLookup = nil
+	}
+}
+
+// EjectIdentity updates identity table by changing the node's participation status to 'ejected'.
+// Should pass identity which is already present in the table, otherwise an exception will be raised.
+// Expected errors during normal operations:
+// - `protocol.InvalidServiceEventError` if the updated identity is not found in current and adjacent epochs.
+func (u *baseProtocolStateMachine) EjectIdentity(nodeID flow.Identifier) error {
+	u.ensureLookupPopulated()
+	prevEpochIdentity, foundInPrev := u.prevEpochIdentitiesLookup[nodeID]
+	if foundInPrev {
+		prevEpochIdentity.Ejected = true
+	}
+	currentEpochIdentity, foundInCurrent := u.currentEpochIdentitiesLookup[nodeID]
+	if foundInCurrent {
+		currentEpochIdentity.Ejected = true
+	}
+	nextEpochIdentity, foundInNext := u.nextEpochIdentitiesLookup[nodeID]
+	if foundInNext {
+		nextEpochIdentity.Ejected = true
+	}
+	if !foundInPrev && !foundInCurrent && !foundInNext {
+		return protocol.NewInvalidServiceEventErrorf("expected to find identity for "+
+			"prev, current or next epoch, but (%v) was not found", nodeID)
+	}
+	return nil
+}
diff --git a/state/protocol/protocol_state/epoch_fallback_statemachine.go b/state/protocol/protocol_state/epoch_fallback_statemachine.go
new file mode 100644
index 00000000000..8439ab4a205
--- /dev/null
+++ b/state/protocol/protocol_state/epoch_fallback_statemachine.go
@@ -0,0 +1,50 @@
+package protocol_state
+
+import (
+	"github.com/onflow/flow-go/model/flow"
+)
+
+// epochFallbackStateMachine is a special structure that encapsulates logic for processing service events
+// when protocol is in epoch fallback mode. The epochFallbackStateMachine ignores EpochSetup and EpochCommit
+// events but still processes ejection events.
+//
+// Whenever invalid epoch state transition has been observed only epochFallbackStateMachines must be created for subsequent views.
+// TODO for 'leaving Epoch Fallback via special service event': this might need to change.
+type epochFallbackStateMachine struct {
+	baseProtocolStateMachine
+}
+
+var _ ProtocolStateMachine = (*epochFallbackStateMachine)(nil)
+
+// newEpochFallbackStateMachine constructs a state machine for epoch fallback, it automatically sets
+// InvalidEpochTransitionAttempted to true, thereby recording that we have entered epoch fallback mode.
+func newEpochFallbackStateMachine(view uint64, parentState *flow.RichProtocolStateEntry) *epochFallbackStateMachine {
+	state := parentState.ProtocolStateEntry.Copy()
+	state.InvalidEpochTransitionAttempted = true
+	return &epochFallbackStateMachine{
+		baseProtocolStateMachine: baseProtocolStateMachine{
+			parentState: parentState,
+			state:       state,
+			view:        view,
+		},
+	}
+}
+
+// ProcessEpochSetup processes epoch setup service events, for epoch fallback we are ignoring this event.
+func (m *epochFallbackStateMachine) ProcessEpochSetup(_ *flow.EpochSetup) (bool, error) {
+	// won't process if we are in fallback mode
+	return false, nil
+}
+
+// ProcessEpochCommit processes epoch commit service events, for epoch fallback we are ignoring this event.
+func (m *epochFallbackStateMachine) ProcessEpochCommit(_ *flow.EpochCommit) (bool, error) {
+	// won't process if we are in fallback mode
+	return false, nil
+}
+
+// TransitionToNextEpoch performs transition to next epoch, in epoch fallback no transitions are possible.
+// TODO for 'leaving Epoch Fallback via special service event' this might need to change.
+func (m *epochFallbackStateMachine) TransitionToNextEpoch() error {
+	// won't process if we are in fallback mode
+	return nil
+}
diff --git a/state/protocol/protocol_state/epoch_fallback_statemachine_test.go b/state/protocol/protocol_state/epoch_fallback_statemachine_test.go
new file mode 100644
index 00000000000..a03b29295fe
--- /dev/null
+++ b/state/protocol/protocol_state/epoch_fallback_statemachine_test.go
@@ -0,0 +1,77 @@
+package protocol_state
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+func TestEpochFallbackStateMachine(t *testing.T) {
+	suite.Run(t, new(EpochFallbackStateMachineSuite))
+}
+
+// ProtocolStateMachineSuite is a dedicated test suite for testing happy path state machine.
+type EpochFallbackStateMachineSuite struct {
+	BaseProtocolStateMachineSuite
+	stateMachine *epochFallbackStateMachine
+}
+
+func (s *EpochFallbackStateMachineSuite) SetupTest() {
+	s.BaseProtocolStateMachineSuite.SetupTest()
+	s.parentProtocolState.InvalidEpochTransitionAttempted = true
+	s.stateMachine = newEpochFallbackStateMachine(s.candidate.View, s.parentProtocolState.Copy())
+}
+
+// ProcessEpochSetupIsNoop ensures that processing epoch setup event is noop.
+func (s *EpochFallbackStateMachineSuite) TestProcessEpochSetupIsNoop() {
+	setup := unittest.EpochSetupFixture()
+	applied, err := s.stateMachine.ProcessEpochSetup(setup)
+	require.NoError(s.T(), err)
+	require.False(s.T(), applied)
+	updatedState, stateID, hasChanges := s.stateMachine.Build()
+	require.False(s.T(), hasChanges)
+	require.Equal(s.T(), s.parentProtocolState.ID(), updatedState.ID())
+	require.Equal(s.T(), updatedState.ID(), stateID)
+	require.Equal(s.T(), s.parentProtocolState.ID(), s.stateMachine.ParentState().ID())
+}
+
+// ProcessEpochCommitIsNoop ensures that processing epoch commit event is noop.
+func (s *EpochFallbackStateMachineSuite) TestProcessEpochCommitIsNoop() {
+	commit := unittest.EpochCommitFixture()
+	applied, err := s.stateMachine.ProcessEpochCommit(commit)
+	require.NoError(s.T(), err)
+	require.False(s.T(), applied)
+	updatedState, stateID, hasChanges := s.stateMachine.Build()
+	require.False(s.T(), hasChanges)
+	require.Equal(s.T(), s.parentProtocolState.ID(), updatedState.ID())
+	require.Equal(s.T(), updatedState.ID(), stateID)
+	require.Equal(s.T(), s.parentProtocolState.ID(), s.stateMachine.ParentState().ID())
+}
+
+// TestTransitionToNextEpoch ensures that transition to next epoch is not possible.
+func (s *EpochFallbackStateMachineSuite) TestTransitionToNextEpoch() {
+	err := s.stateMachine.TransitionToNextEpoch()
+	require.NoError(s.T(), err)
+	updatedState, updateStateID, hasChanges := s.stateMachine.Build()
+	require.False(s.T(), hasChanges)
+	require.Equal(s.T(), updatedState.ID(), updateStateID)
+	require.Equal(s.T(), s.parentProtocolState.ID(), updateStateID)
+}
+
+// TestNewEpochFallbackStateMachine tests that creating epoch fallback state machine sets
+// `InvalidEpochTransitionAttempted` to true to record that we have entered epoch fallback mode[EFM].
+func (s *EpochFallbackStateMachineSuite) TestNewEpochFallbackStateMachine() {
+	s.parentProtocolState.InvalidEpochTransitionAttempted = false
+	s.stateMachine = newEpochFallbackStateMachine(s.candidate.View, s.parentProtocolState.Copy())
+	require.Equal(s.T(), s.parentProtocolState.ID(), s.stateMachine.ParentState().ID())
+	require.Equal(s.T(), s.candidate.View, s.stateMachine.View())
+
+	updatedState, stateID, hasChanges := s.stateMachine.Build()
+	require.True(s.T(), hasChanges, "InvalidEpochTransitionAttempted has to be updated")
+	require.True(s.T(), updatedState.InvalidEpochTransitionAttempted, "InvalidEpochTransitionAttempted has to be set")
+	require.Equal(s.T(), updatedState.ID(), stateID)
+	require.NotEqual(s.T(), s.parentProtocolState.ID(), stateID)
+}
diff --git a/state/protocol/protocol_state/mock/protocol_state_machine.go b/state/protocol/protocol_state/mock/protocol_state_machine.go
new file mode 100644
index 00000000000..ac877b77132
--- /dev/null
+++ b/state/protocol/protocol_state/mock/protocol_state_machine.go
@@ -0,0 +1,169 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mock
+
+import (
+	flow "github.com/onflow/flow-go/model/flow"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// ProtocolStateMachine is an autogenerated mock type for the ProtocolStateMachine type
+type ProtocolStateMachine struct {
+	mock.Mock
+}
+
+// Build provides a mock function with given fields:
+func (_m *ProtocolStateMachine) Build() (*flow.ProtocolStateEntry, flow.Identifier, bool) {
+	ret := _m.Called()
+
+	var r0 *flow.ProtocolStateEntry
+	var r1 flow.Identifier
+	var r2 bool
+	if rf, ok := ret.Get(0).(func() (*flow.ProtocolStateEntry, flow.Identifier, bool)); ok {
+		return rf()
+	}
+	if rf, ok := ret.Get(0).(func() *flow.ProtocolStateEntry); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*flow.ProtocolStateEntry)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func() flow.Identifier); ok {
+		r1 = rf()
+	} else {
+		if ret.Get(1) != nil {
+			r1 = ret.Get(1).(flow.Identifier)
+		}
+	}
+
+	if rf, ok := ret.Get(2).(func() bool); ok {
+		r2 = rf()
+	} else {
+		r2 = ret.Get(2).(bool)
+	}
+
+	return r0, r1, r2
+}
+
+// EjectIdentity provides a mock function with given fields: nodeID
+func (_m *ProtocolStateMachine) EjectIdentity(nodeID flow.Identifier) error {
+	ret := _m.Called(nodeID)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(flow.Identifier) error); ok {
+		r0 = rf(nodeID)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// ParentState provides a mock function with given fields:
+func (_m *ProtocolStateMachine) ParentState() *flow.RichProtocolStateEntry {
+	ret := _m.Called()
+
+	var r0 *flow.RichProtocolStateEntry
+	if rf, ok := ret.Get(0).(func() *flow.RichProtocolStateEntry); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*flow.RichProtocolStateEntry)
+		}
+	}
+
+	return r0
+}
+
+// ProcessEpochCommit provides a mock function with given fields: epochCommit
+func (_m *ProtocolStateMachine) ProcessEpochCommit(epochCommit *flow.EpochCommit) (bool, error) {
+	ret := _m.Called(epochCommit)
+
+	var r0 bool
+	var r1 error
+	if rf, ok := ret.Get(0).(func(*flow.EpochCommit) (bool, error)); ok {
+		return rf(epochCommit)
+	}
+	if rf, ok := ret.Get(0).(func(*flow.EpochCommit) bool); ok {
+		r0 = rf(epochCommit)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	if rf, ok := ret.Get(1).(func(*flow.EpochCommit) error); ok {
+		r1 = rf(epochCommit)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// ProcessEpochSetup provides a mock function with given fields: epochSetup
+func (_m *ProtocolStateMachine) ProcessEpochSetup(epochSetup *flow.EpochSetup) (bool, error) {
+	ret := _m.Called(epochSetup)
+
+	var r0 bool
+	var r1 error
+	if rf, ok := ret.Get(0).(func(*flow.EpochSetup) (bool, error)); ok {
+		return rf(epochSetup)
+	}
+	if rf, ok := ret.Get(0).(func(*flow.EpochSetup) bool); ok {
+		r0 = rf(epochSetup)
+	} else {
+		r0 = ret.Get(0).(bool)
+	}
+
+	if rf, ok := ret.Get(1).(func(*flow.EpochSetup) error); ok {
+		r1 = rf(epochSetup)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// TransitionToNextEpoch provides a mock function with given fields:
+func (_m *ProtocolStateMachine) TransitionToNextEpoch() error {
+	ret := _m.Called()
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func() error); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// View provides a mock function with given fields:
+func (_m *ProtocolStateMachine) View() uint64 {
+	ret := _m.Called()
+
+	var r0 uint64
+	if rf, ok := ret.Get(0).(func() uint64); ok {
+		r0 = rf()
+	} else {
+		r0 = ret.Get(0).(uint64)
+	}
+
+	return r0
+}
+
+type mockConstructorTestingTNewProtocolStateMachine interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewProtocolStateMachine creates a new instance of ProtocolStateMachine. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewProtocolStateMachine(t mockConstructorTestingTNewProtocolStateMachine) *ProtocolStateMachine {
+	mock := &ProtocolStateMachine{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/state/protocol/protocol_state/mutator.go b/state/protocol/protocol_state/mutator.go
new file mode 100644
index 00000000000..f649dcee1b3
--- /dev/null
+++ b/state/protocol/protocol_state/mutator.go
@@ -0,0 +1,295 @@
+package protocol_state
+
+import (
+	"fmt"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/irrecoverable"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/storage"
+	"github.com/onflow/flow-go/storage/badger/transaction"
+)
+
+// StateMachineFactoryMethod is a factory to create state machines for evolving the protocol state.
+// Currently, we have `protocolStateMachine` and `epochFallbackStateMachine` as ProtocolStateMachine
+// implementations, whose constructors both have the same signature as StateMachineFactoryMethod.
+type StateMachineFactoryMethod = func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error)
+
+// stateMutator is a stateful object to evolve the protocol state. It is instantiated from the parent block's protocol state.
+// State-changing operations can be iteratively applied and the stateMutator will internally evolve its in-memory state.
+// While the StateMutator does not modify the database, it internally tracks the necessary database updates to persist its
+// dependencies (specifically EpochSetup and EpochCommit events). Upon calling `Build` the stateMutator returns the updated
+// protocol state, its ID and all database updates necessary for persisting the updated protocol state.
+//
+// The StateMutator is used by a replica's compliance layer to update protocol state when observing state-changing service in
+// blocks. It is used by the primary in the block building process to obtain the correct protocol state for a proposal.
+// Specifically, the leader may include state-changing service events in the block payload. The flow protocol prescribes that
+// the proposal needs to include the ID of the protocol state, _after_ processing the payload incl. all state-changing events.
+// Therefore, the leader instantiates a StateMutator, applies the service events to it and builds the updated protocol state ID.
+//
+// Not safe for concurrent use.
+type stateMutator struct {
+	headers                          storage.Headers
+	results                          storage.ExecutionResults
+	setups                           storage.EpochSetups
+	commits                          storage.EpochCommits
+	stateMachine                     ProtocolStateMachine
+	epochFallbackStateMachineFactory func() (ProtocolStateMachine, error)
+	pendingDbUpdates                 []transaction.DeferredDBUpdate
+}
+
+var _ protocol.StateMutator = (*stateMutator)(nil)
+
+// newStateMutator creates a new instance of stateMutator.
+// stateMutator performs initialization of state machine depending on the operation mode of the protocol.
+// No errors are expected during normal operations.
+func newStateMutator(
+	headers storage.Headers,
+	results storage.ExecutionResults,
+	setups storage.EpochSetups,
+	commits storage.EpochCommits,
+	params protocol.GlobalParams,
+	candidateView uint64,
+	parentState *flow.RichProtocolStateEntry,
+	happyPathStateMachineFactory StateMachineFactoryMethod,
+	epochFallbackStateMachineFactory StateMachineFactoryMethod,
+) (*stateMutator, error) {
+	var (
+		stateMachine ProtocolStateMachine
+		err          error
+	)
+	candidateAttemptsInvalidEpochTransition := epochFallbackTriggeredByIncorporatingCandidate(candidateView, params, parentState)
+	if parentState.InvalidEpochTransitionAttempted || candidateAttemptsInvalidEpochTransition {
+		// Case 1: InvalidEpochTransitionAttempted is true, indicating that we have encountered an invalid
+		//         epoch service event or an invalid state transition previously in this fork.
+		// Case 2: Incorporating the candidate block is itself an invalid epoch transition.
+		//
+		// In either case, Epoch Fallback Mode [EFM] has been tentatively triggered on this fork,
+		// and we must use only the `epochFallbackStateMachine` along this fork.
+		//
+		// TODO for 'leaving Epoch Fallback via special service event': this might need to change.
+		stateMachine, err = epochFallbackStateMachineFactory(candidateView, parentState)
+	} else {
+		stateMachine, err = happyPathStateMachineFactory(candidateView, parentState)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("could not initialize protocol state machine: %w", err)
+	}
+
+	return &stateMutator{
+		headers:      headers,
+		results:      results,
+		setups:       setups,
+		commits:      commits,
+		stateMachine: stateMachine,
+		// instead of storing arguments that later might be used when entering EFM, capture them in factory method.
+		epochFallbackStateMachineFactory: func() (ProtocolStateMachine, error) {
+			return epochFallbackStateMachineFactory(candidateView, parentState)
+		},
+	}, nil
+}
+
+// Build returns:
+//   - hasChanges: flag whether there were any changes; otherwise, `updatedState` and `stateID` equal the parent state
+//   - updatedState: the ProtocolState after applying all updates.
+//   - stateID: the hash commitment to the `updatedState`
+//   - dbUpdates: database updates necessary for persisting the updated protocol state's *dependencies*.
+//     If hasChanges is false, updatedState is empty. Caution: persisting the `updatedState` itself and adding
+//     it to the relevant indices is _not_ in `dbUpdates`. Persisting and indexing `updatedState` is the responsibility
+//     of the calling code (specifically `FollowerState`).
+//
+// updated protocol state entry, state ID and a flag indicating if there were any changes.
+func (m *stateMutator) Build() (hasChanges bool, updatedState *flow.ProtocolStateEntry, stateID flow.Identifier, dbUpdates []transaction.DeferredDBUpdate) {
+	updatedState, stateID, hasChanges = m.stateMachine.Build()
+	dbUpdates = m.pendingDbUpdates
+	return
+}
+
+// ApplyServiceEventsFromValidatedSeals applies the state changes that are delivered via
+// sealed service events:
+//   - iterating over the sealed service events in order of increasing height
+//   - identifying state-changing service event and calling into the embedded
+//     ProtocolStateMachine to apply the respective state update
+//   - tracking deferred database updates necessary to persist the updated
+//     protocol state's *dependencies*. Persisting and indexing `updatedState`
+//     is the responsibility of the calling code (specifically `FollowerState`)
+//
+// All updates only mutate the `StateMutator`'s internal in-memory copy of the
+// protocol state, without changing the parent state (i.e. the state we started from).
+//
+// SAFETY REQUIREMENT:
+// The StateMutator assumes that the proposal has passed the following correctness checks!
+//   - The seals in the payload continuously follow the ancestry of this fork. Specifically,
+//     there are no gaps in the seals.
+//   - The seals guarantee correctness of the sealed execution result, including the contained
+//     service events. This is actively checked by the verification node, whose aggregated
+//     approvals in the form of a seal attest to the correctness of the sealed execution result,
+//     including the contained.
+//
+// Consensus nodes actively verify protocol compliance for any block proposal they receive,
+// including integrity of each seal individually as well as the seals continuously following the
+// fork. Light clients only process certified blocks, which guarantees that consensus nodes already
+// ran those checks and found the proposal to be valid.
+//
+// Details on SERVICE EVENTS:
+// Consider a chain where a service event is emitted during execution of block A.
+// Block B contains an execution receipt for A. Block C contains a seal for block
+// A's execution result.
+//
+//	A <- .. <- B(RA) <- .. <- C(SA)
+//
+// Service Events are included within execution results, which are stored
+// opaquely as part of the block payload in block B. We only validate, process and persist
+// the typed service event to storage once we process C, the block containing the
+// seal for block A. This is because we rely on the sealing subsystem to validate
+// correctness of the service event before processing it.
+// Consequently, any change to the protocol state introduced by a service event
+// emitted during execution of block A would only become visible when querying
+// C or its descendants.
+//
+// Error returns:
+//   - Per convention, the input seals from the block payload have already been confirmed to be protocol compliant.
+//     Hence, the service events in the sealed execution results represent the honest execution path.
+//     Therefore, the sealed service events should encode a valid evolution of the protocol state -- provided
+//     the system smart contracts are correct.
+//   - As we can rule out byzantine attacks as the source of failures, the only remaining sources of problems
+//     can be (a) bugs in the system smart contracts or (b) bugs in the node implementation.
+//     A service event not representing a valid state transition despite all consistency checks passing
+//     is interpreted as case (a) and handled internally within the StateMutator. In short, we go into Epoch
+//     Fallback Mode by copying the parent state (a valid state snapshot) and setting the
+//     `InvalidEpochTransitionAttempted` flag. All subsequent Epoch-lifecycle events are ignored.
+//   - A consistency or sanity check failing within the StateMutator is likely the symptom of an internal bug
+//     in the node software or state corruption, i.e. case (b). This is the only scenario where the error return
+//     of this function is not nil. If such an exception is returned, continuing is not an option.
+func (m *stateMutator) ApplyServiceEventsFromValidatedSeals(seals []*flow.Seal) error {
+	parentProtocolState := m.stateMachine.ParentState()
+
+	// perform protocol state transition to next epoch if next epoch is committed and we are at first block of epoch
+	phase := parentProtocolState.EpochPhase()
+	if phase == flow.EpochPhaseCommitted {
+		activeSetup := parentProtocolState.CurrentEpochSetup
+		if m.stateMachine.View() > activeSetup.FinalView {
+			// TODO: this is a temporary workaround to allow for the epoch transition to be triggered
+			// most likely it will be not needed when we refactor protocol state entries and define strict safety rules.
+			err := m.stateMachine.TransitionToNextEpoch()
+			if err != nil {
+				return fmt.Errorf("could not transition protocol state to next epoch: %w", err)
+			}
+		}
+	}
+
+	// We apply service events from blocks which are sealed by this candidate block.
+	// The block's payload might contain epoch preparation service events for the next
+	// epoch. In this case, we need to update the tentative protocol state.
+	// We need to validate whether all information is available in the protocol
+	// state to go to the next epoch when needed. In cases where there is a bug
+	// in the smart contract, it could be that this happens too late and we should trigger epoch fallback mode.
+
+	// block payload may not specify seals in order, so order them by block height before processing
+	orderedSeals, err := protocol.OrderedSeals(seals, m.headers)
+	if err != nil {
+		// Per API contract, the input seals must have already passed verification, which necessitates
+		// successful ordering. Hence, calling protocol.OrderedSeals with the same inputs that succeeded
+		// earlier now failed. In all cases, this is an exception.
+		return irrecoverable.NewExceptionf("ordering already validated seals unexpectedly failed: %w", err)
+	}
+	results := make([]*flow.ExecutionResult, 0, len(orderedSeals))
+	for _, seal := range orderedSeals {
+		result, err := m.results.ByID(seal.ResultID)
+		if err != nil {
+			return fmt.Errorf("could not get result (id=%x) for seal (id=%x): %w", seal.ResultID, seal.ID(), err)
+		}
+		results = append(results, result)
+	}
+	dbUpdates, err := m.applyServiceEventsFromOrderedResults(results)
+	if err != nil {
+		if protocol.IsInvalidServiceEventError(err) {
+			dbUpdates, err = m.transitionToEpochFallbackMode(results)
+			if err != nil {
+				return irrecoverable.NewExceptionf("could not transition to epoch fallback mode: %w", err)
+			}
+		} else {
+			return irrecoverable.NewExceptionf("could not apply service events from ordered results: %w", err)
+		}
+	}
+	m.pendingDbUpdates = append(m.pendingDbUpdates, dbUpdates...)
+	return nil
+}
+
+// applyServiceEventsFromOrderedResults applies the service events contained within the list of results
+// to the pending state tracked by `stateMutator`.
+// Each result corresponds to one seal that was included in the payload of the block being processed by this `stateMutator`.
+// Results must be ordered by block height.
+// Expected errors during normal operations:
+// - `protocol.InvalidServiceEventError` if any service event is invalid or is not a valid state transition for the current protocol state
+func (m *stateMutator) applyServiceEventsFromOrderedResults(results []*flow.ExecutionResult) ([]func(tx *transaction.Tx) error, error) {
+	var dbUpdates []transaction.DeferredDBUpdate
+	for _, result := range results {
+		for _, event := range result.ServiceEvents {
+			switch ev := event.Event.(type) {
+			case *flow.EpochSetup:
+				processed, err := m.stateMachine.ProcessEpochSetup(ev)
+				if err != nil {
+					return nil, fmt.Errorf("could not process epoch setup event: %w", err)
+				}
+
+				if processed {
+					// we'll insert the setup event when we insert the block
+					dbUpdates = append(dbUpdates, m.setups.StoreTx(ev))
+				}
+
+			case *flow.EpochCommit:
+				processed, err := m.stateMachine.ProcessEpochCommit(ev)
+				if err != nil {
+					return nil, fmt.Errorf("could not process epoch commit event: %w", err)
+				}
+
+				if processed {
+					// we'll insert the commit event when we insert the block
+					dbUpdates = append(dbUpdates, m.commits.StoreTx(ev))
+				}
+			case *flow.VersionBeacon:
+				// do nothing for now
+			default:
+				return nil, fmt.Errorf("invalid service event type (type_name=%s, go_type=%T)", event.Type, ev)
+			}
+		}
+	}
+	return dbUpdates, nil
+}
+
+// transitionToEpochFallbackMode transitions the protocol state to Epoch Fallback Mode [EFM].
+// This is implemented by switching to a different state machine implementation, which ignores all service events and epoch transitions.
+// At the moment, this is a one-way transition: once we enter EFM, the only way to return to normal is with a spork.
+func (m *stateMutator) transitionToEpochFallbackMode(results []*flow.ExecutionResult) ([]func(tx *transaction.Tx) error, error) {
+	var err error
+	m.stateMachine, err = m.epochFallbackStateMachineFactory()
+	if err != nil {
+		return nil, fmt.Errorf("could not create epoch fallback state machine: %w", err)
+	}
+	dbUpdates, err := m.applyServiceEventsFromOrderedResults(results)
+	if err != nil {
+		return nil, irrecoverable.NewExceptionf("could not apply service events after transition to epoch fallback mode: %w", err)
+	}
+	return dbUpdates, nil
+}
+
+// epochFallbackTriggeredByIncorporatingCandidate checks whether incorporating the input block B
+// would trigger epoch fallback mode [EFM] along the current fork. We trigger epoch fallback mode
+// when:
+//  1. The next epoch has not been committed as of B (EpochPhase ≠ flow.EpochPhaseCommitted) AND
+//  2. B is the first incorporated block with view greater than or equal to the epoch commitment
+//     deadline for the current epoch
+//
+// In protocol terms, condition 1 means that an EpochCommit service event for the upcoming epoch has
+// not yet been sealed as of block B. Formally, a service event S is considered sealed as of block B if:
+//   - S was emitted during execution of some block A, s.t. A is an ancestor of B.
+//   - The seal for block A was included in some block C, s.t C is an ancestor of B.
+//
+// For further details see `params.EpochCommitSafetyThreshold()`.
+func epochFallbackTriggeredByIncorporatingCandidate(candidateView uint64, params protocol.GlobalParams, parentState *flow.RichProtocolStateEntry) bool {
+	if parentState.EpochPhase() == flow.EpochPhaseCommitted { // Requirement 1
+		return false
+	}
+	return candidateView+params.EpochCommitSafetyThreshold() >= parentState.CurrentEpochSetup.FinalView // Requirement 2
+}
diff --git a/state/protocol/protocol_state/mutator_test.go b/state/protocol/protocol_state/mutator_test.go
new file mode 100644
index 00000000000..9a900a2294f
--- /dev/null
+++ b/state/protocol/protocol_state/mutator_test.go
@@ -0,0 +1,494 @@
+package protocol_state
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/irrecoverable"
+	"github.com/onflow/flow-go/state/protocol"
+	protocolmock "github.com/onflow/flow-go/state/protocol/mock"
+	protocolstatemock "github.com/onflow/flow-go/state/protocol/protocol_state/mock"
+	"github.com/onflow/flow-go/storage/badger/transaction"
+	storagemock "github.com/onflow/flow-go/storage/mock"
+	"github.com/onflow/flow-go/utils/rand"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+func TestProtocolStateMutator(t *testing.T) {
+	suite.Run(t, new(StateMutatorSuite))
+}
+
+type StateMutatorSuite struct {
+	suite.Suite
+	protocolStateDB *storagemock.ProtocolState
+	headersDB       *storagemock.Headers
+	resultsDB       *storagemock.ExecutionResults
+	setupsDB        *storagemock.EpochSetups
+	commitsDB       *storagemock.EpochCommits
+	globalParams    *protocolmock.GlobalParams
+	parentState     *flow.RichProtocolStateEntry
+	stateMachine    *protocolstatemock.ProtocolStateMachine
+	candidateView   uint64
+
+	mutator *stateMutator
+}
+
+func (s *StateMutatorSuite) SetupTest() {
+	s.protocolStateDB = storagemock.NewProtocolState(s.T())
+	s.headersDB = storagemock.NewHeaders(s.T())
+	s.resultsDB = storagemock.NewExecutionResults(s.T())
+	s.setupsDB = storagemock.NewEpochSetups(s.T())
+	s.commitsDB = storagemock.NewEpochCommits(s.T())
+	s.globalParams = protocolmock.NewGlobalParams(s.T())
+	s.globalParams.On("EpochCommitSafetyThreshold").Return(uint64(1_000))
+	s.parentState = unittest.ProtocolStateFixture()
+	s.candidateView = s.parentState.CurrentEpochSetup.FirstView + 1
+	s.stateMachine = protocolstatemock.NewProtocolStateMachine(s.T())
+
+	var err error
+	s.mutator, err = newStateMutator(
+		s.headersDB,
+		s.resultsDB,
+		s.setupsDB,
+		s.commitsDB,
+		s.globalParams,
+		s.candidateView,
+		s.parentState,
+		func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+			return s.stateMachine, nil
+		},
+		func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+			require.Fail(s.T(), "entering epoch fallback is not expected")
+			return nil, fmt.Errorf("not expecting epoch fallback")
+		},
+	)
+	require.NoError(s.T(), err)
+}
+
+// TestOnHappyPathNoDbChanges tests that stateMutator doesn't cache any db updates when there are no changes.
+func (s *StateMutatorSuite) TestOnHappyPathNoDbChanges() {
+	parentState := unittest.ProtocolStateFixture()
+	s.stateMachine.On("ParentState").Return(parentState)
+	s.stateMachine.On("Build").Return(parentState.ProtocolStateEntry, parentState.ID(), false)
+	err := s.mutator.ApplyServiceEventsFromValidatedSeals([]*flow.Seal{})
+	require.NoError(s.T(), err)
+	hasChanges, updatedState, updatedStateID, dbUpdates := s.mutator.Build()
+	require.False(s.T(), hasChanges)
+	require.Equal(s.T(), parentState.ProtocolStateEntry, updatedState)
+	require.Equal(s.T(), parentState.ID(), updatedStateID)
+	require.Empty(s.T(), dbUpdates)
+}
+
+// TestHappyPathWithDbChanges tests that `stateMutator` returns cached db updates when building protocol state after applying service events.
+// Whenever `stateMutator` successfully processes an epoch setup or epoch commit event, it has to create a deferred db update to store the event.
+// Deferred db updates are cached in `stateMutator` and returned when building protocol state when calling `Build`.
+func (s *StateMutatorSuite) TestHappyPathWithDbChanges() {
+	parentState := unittest.ProtocolStateFixture()
+	s.stateMachine.On("ParentState").Return(parentState)
+	s.stateMachine.On("Build").Return(unittest.ProtocolStateFixture().ProtocolStateEntry,
+		unittest.IdentifierFixture(), true)
+
+	epochSetup := unittest.EpochSetupFixture()
+	epochCommit := unittest.EpochCommitFixture()
+	result := unittest.ExecutionResultFixture(func(result *flow.ExecutionResult) {
+		result.ServiceEvents = []flow.ServiceEvent{epochSetup.ServiceEvent(), epochCommit.ServiceEvent()}
+	})
+
+	block := unittest.BlockHeaderFixture()
+	seal := unittest.Seal.Fixture(unittest.Seal.WithBlockID(block.ID()))
+	s.headersDB.On("ByBlockID", seal.BlockID).Return(block, nil)
+	s.resultsDB.On("ByID", seal.ResultID).Return(result, nil)
+
+	epochSetupStored := mock.Mock{}
+	epochSetupStored.On("EpochSetupStored").Return()
+	s.stateMachine.On("ProcessEpochSetup", epochSetup).Return(true, nil).Once()
+	s.setupsDB.On("StoreTx", epochSetup).Return(func(*transaction.Tx) error {
+		epochSetupStored.MethodCalled("EpochSetupStored")
+		return nil
+	}).Once()
+
+	epochCommitStored := mock.Mock{}
+	epochCommitStored.On("EpochCommitStored").Return()
+	s.stateMachine.On("ProcessEpochCommit", epochCommit).Return(true, nil).Once()
+	s.commitsDB.On("StoreTx", epochCommit).Return(func(*transaction.Tx) error {
+		epochCommitStored.MethodCalled("EpochCommitStored")
+		return nil
+	}).Once()
+
+	err := s.mutator.ApplyServiceEventsFromValidatedSeals([]*flow.Seal{seal})
+	require.NoError(s.T(), err)
+
+	_, _, _, dbUpdates := s.mutator.Build()
+	// in next loop we assert that we have received expected deferred db updates by executing them
+	// and expecting that corresponding mock methods will be called
+	tx := &transaction.Tx{}
+	for _, dbUpdate := range dbUpdates {
+		err := dbUpdate(tx)
+		require.NoError(s.T(), err)
+	}
+	// make sure that mock methods were indeed called
+	epochSetupStored.AssertExpectations(s.T())
+	epochCommitStored.AssertExpectations(s.T())
+}
+
+// TestStateMutator_Constructor tests the behaviour of the StateMutator constructor.
+// We expect the constructor to select the appropriate state machine constructor, and
+// to handle (pass-through) exceptions from the state machine constructor.
+func (s *StateMutatorSuite) TestStateMutator_Constructor() {
+	s.Run("EpochStaking phase", func() {
+		// Since we are before the epoch commitment deadline, we should use the happy-path state machine
+		s.Run("before commitment deadline", func() {
+			expectedConstructorCalled := false
+			s.candidateView = s.parentState.CurrentEpochSetup.FirstView + 1
+			mutator, err := newStateMutator(s.headersDB, s.resultsDB, s.setupsDB, s.commitsDB, s.globalParams, s.candidateView, s.parentState,
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					expectedConstructorCalled = true // expect happy-path constructor
+					return s.stateMachine, nil
+				},
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					s.T().Fail()
+					return s.stateMachine, nil
+				},
+			)
+			require.NoError(s.T(), err)
+			assert.NotNil(s.T(), mutator)
+			assert.True(s.T(), expectedConstructorCalled)
+		})
+		// Since we are past the epoch commitment deadline, and have not entered the EpochCommitted
+		// phase, we should use the epoch fallback state machine.
+		s.Run("past commitment deadline", func() {
+			expectedConstructorCalled := false
+			s.candidateView = s.parentState.CurrentEpochSetup.FinalView - 1
+			mutator, err := newStateMutator(s.headersDB, s.resultsDB, s.setupsDB, s.commitsDB, s.globalParams, s.candidateView, s.parentState,
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					s.T().Fail()
+					return s.stateMachine, nil
+				},
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					expectedConstructorCalled = true // expect epoch-fallback state machine
+					return s.stateMachine, nil
+				},
+			)
+			require.NoError(s.T(), err)
+			assert.NotNil(s.T(), mutator)
+			assert.True(s.T(), expectedConstructorCalled)
+		})
+	})
+
+	s.Run("EpochSetup phase", func() {
+		s.parentState = unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState())
+		s.parentState.NextEpochCommit = nil
+		s.parentState.NextEpoch.CommitID = flow.ZeroID
+
+		// Since we are before the epoch commitment deadline, we should use the happy-path state machine
+		s.Run("before commitment deadline", func() {
+			expectedConstructorCalled := false
+			s.candidateView = s.parentState.CurrentEpochSetup.FirstView + 1
+			mutator, err := newStateMutator(s.headersDB, s.resultsDB, s.setupsDB, s.commitsDB, s.globalParams, s.candidateView, s.parentState,
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					expectedConstructorCalled = true // expect happy-path constructor
+					return s.stateMachine, nil
+				},
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					s.T().Fail()
+					return s.stateMachine, nil
+				},
+			)
+			require.NoError(s.T(), err)
+			assert.NotNil(s.T(), mutator)
+			assert.True(s.T(), expectedConstructorCalled)
+		})
+		// Since we are past the epoch commitment deadline, and have not entered the EpochCommitted
+		// phase, we should use the epoch fallback state machine.
+		s.Run("past commitment deadline", func() {
+			expectedConstructorCalled := false
+			s.candidateView = s.parentState.CurrentEpochSetup.FinalView - 1
+			mutator, err := newStateMutator(s.headersDB, s.resultsDB, s.setupsDB, s.commitsDB, s.globalParams, s.candidateView, s.parentState,
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					s.T().Fail()
+					return s.stateMachine, nil
+				},
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					expectedConstructorCalled = true // expect epoch-fallback state machine
+					return s.stateMachine, nil
+				},
+			)
+			require.NoError(s.T(), err)
+			assert.NotNil(s.T(), mutator)
+			assert.True(s.T(), expectedConstructorCalled)
+		})
+	})
+
+	s.Run("EpochCommitted phase", func() {
+		s.parentState = unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState())
+		// Since we are before the epoch commitment deadline, we should use the happy-path state machine
+		s.Run("before commitment deadline", func() {
+			expectedConstructorCalled := false
+			s.candidateView = s.parentState.CurrentEpochSetup.FirstView + 1
+			mutator, err := newStateMutator(s.headersDB, s.resultsDB, s.setupsDB, s.commitsDB, s.globalParams, s.candidateView, s.parentState,
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					expectedConstructorCalled = true // expect happy-path constructor
+					return s.stateMachine, nil
+				},
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					s.T().Fail()
+					return s.stateMachine, nil
+				},
+			)
+			require.NoError(s.T(), err)
+			assert.NotNil(s.T(), mutator)
+			assert.True(s.T(), expectedConstructorCalled)
+		})
+		// Despite being past the epoch commitment deadline, since we are in the EpochCommitted phase
+		// already, we should proceed with the happy-path state machine
+		s.Run("past commitment deadline", func() {
+			expectedConstructorCalled := false
+			s.candidateView = s.parentState.CurrentEpochSetup.FinalView - 1
+			mutator, err := newStateMutator(s.headersDB, s.resultsDB, s.setupsDB, s.commitsDB, s.globalParams, s.candidateView, s.parentState,
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					expectedConstructorCalled = true // expect happy-path constructor
+					return s.stateMachine, nil
+				},
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					s.T().Fail()
+					return s.stateMachine, nil
+				},
+			)
+			require.NoError(s.T(), err)
+			assert.NotNil(s.T(), mutator)
+			assert.True(s.T(), expectedConstructorCalled)
+		})
+	})
+
+	// if a state machine constructor returns an error, the stateMutator constructor should fail
+	// and propagate the error to the caller
+	s.Run("state machine constructor returns error", func() {
+		s.Run("happy-path", func() {
+			exception := irrecoverable.NewExceptionf("exception")
+			mutator, err := newStateMutator(s.headersDB, s.resultsDB, s.setupsDB, s.commitsDB, s.globalParams, s.candidateView, s.parentState,
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					return nil, exception
+				},
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					s.T().Fail()
+					return s.stateMachine, nil
+				},
+			)
+			assert.Error(s.T(), err)
+			assert.ErrorIs(s.T(), err, exception)
+			assert.Nil(s.T(), mutator)
+		})
+		s.Run("epoch-fallback", func() {
+			s.parentState.InvalidEpochTransitionAttempted = true // ensure we use epoch-fallback state machine
+			exception := irrecoverable.NewExceptionf("exception")
+			mutator, err := newStateMutator(s.headersDB, s.resultsDB, s.setupsDB, s.commitsDB, s.globalParams, s.candidateView, s.parentState,
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					s.T().Fail()
+					return s.stateMachine, nil
+				},
+				func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+					return nil, exception
+				},
+			)
+			assert.Error(s.T(), err)
+			assert.ErrorIs(s.T(), err, exception)
+			assert.Nil(s.T(), mutator)
+		})
+	})
+}
+
+// TestApplyServiceEvents_InvalidEpochSetup tests that handleServiceEvents rejects invalid epoch setup event and sets
+// InvalidEpochTransitionAttempted flag in protocol.ProtocolStateMachine.
+func (s *StateMutatorSuite) TestApplyServiceEvents_InvalidEpochSetup() {
+	s.Run("invalid-epoch-setup", func() {
+		mutator, err := newStateMutator(
+			s.headersDB,
+			s.resultsDB,
+			s.setupsDB,
+			s.commitsDB,
+			s.globalParams,
+			s.candidateView,
+			s.parentState,
+			func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+				return s.stateMachine, nil
+			},
+			func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+				epochFallbackStateMachine := protocolstatemock.NewProtocolStateMachine(s.T())
+				epochFallbackStateMachine.On("ProcessEpochSetup", mock.Anything).Return(false, nil)
+				return epochFallbackStateMachine, nil
+			},
+		)
+		require.NoError(s.T(), err)
+		parentState := unittest.ProtocolStateFixture()
+		s.stateMachine.On("ParentState").Return(parentState)
+
+		epochSetup := unittest.EpochSetupFixture()
+		result := unittest.ExecutionResultFixture(func(result *flow.ExecutionResult) {
+			result.ServiceEvents = []flow.ServiceEvent{epochSetup.ServiceEvent()}
+		})
+
+		block := unittest.BlockHeaderFixture()
+		seal := unittest.Seal.Fixture(unittest.Seal.WithBlockID(block.ID()))
+		s.headersDB.On("ByBlockID", seal.BlockID).Return(block, nil)
+		s.resultsDB.On("ByID", seal.ResultID).Return(result, nil)
+
+		s.stateMachine.On("ProcessEpochSetup", epochSetup).Return(false, protocol.NewInvalidServiceEventErrorf("")).Once()
+
+		err = mutator.ApplyServiceEventsFromValidatedSeals([]*flow.Seal{seal})
+		require.NoError(s.T(), err)
+	})
+	s.Run("process-epoch-setup-exception", func() {
+		parentState := unittest.ProtocolStateFixture()
+		s.stateMachine.On("ParentState").Return(parentState)
+
+		epochSetup := unittest.EpochSetupFixture()
+		result := unittest.ExecutionResultFixture(func(result *flow.ExecutionResult) {
+			result.ServiceEvents = []flow.ServiceEvent{epochSetup.ServiceEvent()}
+		})
+
+		block := unittest.BlockHeaderFixture()
+		seal := unittest.Seal.Fixture(unittest.Seal.WithBlockID(block.ID()))
+		s.headersDB.On("ByBlockID", seal.BlockID).Return(block, nil)
+		s.resultsDB.On("ByID", seal.ResultID).Return(result, nil)
+
+		exception := errors.New("exception")
+		s.stateMachine.On("ProcessEpochSetup", epochSetup).Return(false, exception).Once()
+
+		err := s.mutator.ApplyServiceEventsFromValidatedSeals([]*flow.Seal{seal})
+		require.Error(s.T(), err)
+		require.False(s.T(), protocol.IsInvalidServiceEventError(err))
+	})
+}
+
+// TestApplyServiceEvents_InvalidEpochCommit tests that handleServiceEvents rejects invalid epoch commit event and sets
+// InvalidEpochTransitionAttempted flag in protocol.ProtocolStateMachine.
+func (s *StateMutatorSuite) TestApplyServiceEvents_InvalidEpochCommit() {
+	s.Run("invalid-epoch-commit", func() {
+		mutator, err := newStateMutator(
+			s.headersDB,
+			s.resultsDB,
+			s.setupsDB,
+			s.commitsDB,
+			s.globalParams,
+			s.candidateView,
+			s.parentState,
+			func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+				return s.stateMachine, nil
+			},
+			func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) {
+				epochFallbackStateMachine := protocolstatemock.NewProtocolStateMachine(s.T())
+				epochFallbackStateMachine.On("ProcessEpochCommit", mock.Anything).Return(false, nil)
+				return epochFallbackStateMachine, nil
+			},
+		)
+		require.NoError(s.T(), err)
+
+		parentState := unittest.ProtocolStateFixture()
+		s.stateMachine.On("ParentState").Return(parentState)
+
+		epochCommit := unittest.EpochCommitFixture()
+		result := unittest.ExecutionResultFixture(func(result *flow.ExecutionResult) {
+			result.ServiceEvents = []flow.ServiceEvent{epochCommit.ServiceEvent()}
+		})
+
+		block := unittest.BlockHeaderFixture()
+		seal := unittest.Seal.Fixture(unittest.Seal.WithBlockID(block.ID()))
+		s.headersDB.On("ByBlockID", seal.BlockID).Return(block, nil)
+		s.resultsDB.On("ByID", seal.ResultID).Return(result, nil)
+
+		s.stateMachine.On("ProcessEpochCommit", epochCommit).Return(false, protocol.NewInvalidServiceEventErrorf("")).Once()
+
+		err = mutator.ApplyServiceEventsFromValidatedSeals([]*flow.Seal{seal})
+		require.NoError(s.T(), err)
+	})
+	s.Run("process-epoch-commit-exception", func() {
+		parentState := unittest.ProtocolStateFixture()
+		s.stateMachine.On("ParentState").Return(parentState)
+
+		epochCommit := unittest.EpochCommitFixture()
+		result := unittest.ExecutionResultFixture(func(result *flow.ExecutionResult) {
+			result.ServiceEvents = []flow.ServiceEvent{epochCommit.ServiceEvent()}
+		})
+
+		block := unittest.BlockHeaderFixture()
+		seal := unittest.Seal.Fixture(unittest.Seal.WithBlockID(block.ID()))
+		s.headersDB.On("ByBlockID", seal.BlockID).Return(block, nil)
+		s.resultsDB.On("ByID", seal.ResultID).Return(result, nil)
+
+		exception := errors.New("exception")
+		s.stateMachine.On("ProcessEpochCommit", epochCommit).Return(false, exception).Once()
+
+		err := s.mutator.ApplyServiceEventsFromValidatedSeals([]*flow.Seal{seal})
+		require.Error(s.T(), err)
+		require.False(s.T(), protocol.IsInvalidServiceEventError(err))
+	})
+}
+
+// TestApplyServiceEventsSealsOrdered tests that handleServiceEvents processes seals in order of block height.
+func (s *StateMutatorSuite) TestApplyServiceEventsSealsOrdered() {
+	parentState := unittest.ProtocolStateFixture()
+	s.stateMachine.On("ParentState").Return(parentState)
+
+	blocks := unittest.ChainFixtureFrom(10, unittest.BlockHeaderFixture())
+	var seals []*flow.Seal
+	resultByHeight := make(map[flow.Identifier]uint64)
+	for _, block := range blocks {
+		receipt, seal := unittest.ReceiptAndSealForBlock(block)
+		resultByHeight[seal.ResultID] = block.Header.Height
+		s.headersDB.On("ByBlockID", seal.BlockID).Return(block.Header, nil).Once()
+		s.resultsDB.On("ByID", seal.ResultID).Return(&receipt.ExecutionResult, nil).Once()
+		seals = append(seals, seal)
+	}
+
+	// shuffle seals to make sure they are not ordered in the payload, so `ApplyServiceEventsFromValidatedSeals` needs to explicitly sort them.
+	require.NoError(s.T(), rand.Shuffle(uint(len(seals)), func(i, j uint) {
+		seals[i], seals[j] = seals[j], seals[i]
+	}))
+
+	err := s.mutator.ApplyServiceEventsFromValidatedSeals(seals)
+	require.NoError(s.T(), err)
+
+	// assert that results were queried in order of executed block height
+	// if seals were properly ordered before processing, then results should be ordered by block height
+	lastExecutedBlockHeight := uint64(0)
+	for _, call := range s.resultsDB.Calls {
+		resultID := call.Arguments.Get(0).(flow.Identifier)
+		executedBlockHeight, found := resultByHeight[resultID]
+		require.True(s.T(), found)
+		require.Less(s.T(), lastExecutedBlockHeight, executedBlockHeight, "seals must be ordered by block height")
+	}
+}
+
+// TestApplyServiceEventsTransitionToNextEpoch tests that handleServiceEvents transitions to the next epoch
+// when epoch has been committed, and we are at the first block of the next epoch.
+func (s *StateMutatorSuite) TestApplyServiceEventsTransitionToNextEpoch() {
+	parentState := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState())
+	s.stateMachine.On("ParentState").Return(parentState)
+	// we are at the first block of the next epoch
+	s.stateMachine.On("View").Return(parentState.CurrentEpochSetup.FinalView + 1)
+	s.stateMachine.On("TransitionToNextEpoch").Return(nil).Once()
+	err := s.mutator.ApplyServiceEventsFromValidatedSeals([]*flow.Seal{})
+	require.NoError(s.T(), err)
+}
+
+// TestApplyServiceEventsTransitionToNextEpoch_Error tests that error that has been
+// observed in handleServiceEvents when transitioning to the next epoch is propagated to the caller.
+func (s *StateMutatorSuite) TestApplyServiceEventsTransitionToNextEpoch_Error() {
+	parentState := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState())
+
+	s.stateMachine.On("ParentState").Return(parentState)
+	// we are at the first block of the next epoch
+	s.stateMachine.On("View").Return(parentState.CurrentEpochSetup.FinalView + 1)
+	exception := errors.New("exception")
+	s.stateMachine.On("TransitionToNextEpoch").Return(exception).Once()
+	err := s.mutator.ApplyServiceEventsFromValidatedSeals([]*flow.Seal{})
+	require.ErrorIs(s.T(), err, exception)
+	require.False(s.T(), protocol.IsInvalidServiceEventError(err))
+}
diff --git a/state/protocol/protocol_state/protocol_state.go b/state/protocol/protocol_state/protocol_state.go
new file mode 100644
index 00000000000..d9ae8d310ca
--- /dev/null
+++ b/state/protocol/protocol_state/protocol_state.go
@@ -0,0 +1,102 @@
+package protocol_state
+
+import (
+	"fmt"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/state/protocol/inmem"
+	"github.com/onflow/flow-go/storage"
+)
+
+// ProtocolState is an implementation of the read-only interface for protocol state, it allows querying information
+// on a per-block and per-epoch basis.
+// It is backed by a storage.ProtocolState and an in-memory protocol.GlobalParams.
+type ProtocolState struct {
+	protocolStateDB storage.ProtocolState
+	globalParams    protocol.GlobalParams
+}
+
+var _ protocol.ProtocolState = (*ProtocolState)(nil)
+
+func NewProtocolState(protocolStateDB storage.ProtocolState, globalParams protocol.GlobalParams) *ProtocolState {
+	return &ProtocolState{
+		protocolStateDB: protocolStateDB,
+		globalParams:    globalParams,
+	}
+}
+
+// AtBlockID returns protocol state at block ID.
+// Resulting protocol state is returned AFTER applying updates that are contained in block.
+// Returns:
+// - (DynamicProtocolState, nil) - if there is a protocol state associated with given block ID.
+// - (nil, storage.ErrNotFound) - if there is no protocol state associated with given block ID.
+// - (nil, exception) - any other error should be treated as exception.
+func (s *ProtocolState) AtBlockID(blockID flow.Identifier) (protocol.DynamicProtocolState, error) {
+	protocolStateEntry, err := s.protocolStateDB.ByBlockID(blockID)
+	if err != nil {
+		return nil, fmt.Errorf("could not query protocol state at block (%x): %w", blockID, err)
+	}
+	return inmem.NewDynamicProtocolStateAdapter(protocolStateEntry, s.globalParams), nil
+}
+
+// GlobalParams returns an interface which can be used to query global protocol parameters.
+func (s *ProtocolState) GlobalParams() protocol.GlobalParams {
+	return s.globalParams
+}
+
+// MutableProtocolState is an implementation of the mutable interface for protocol state, it allows to evolve the protocol state
+// by acting as factory for protocol.StateMutator which can be used to apply state-changing operations.
+type MutableProtocolState struct {
+	ProtocolState
+	headers storage.Headers
+	results storage.ExecutionResults
+	setups  storage.EpochSetups
+	commits storage.EpochCommits
+}
+
+var _ protocol.MutableProtocolState = (*MutableProtocolState)(nil)
+
+// NewMutableProtocolState creates a new instance of MutableProtocolState.
+func NewMutableProtocolState(
+	protocolStateDB storage.ProtocolState,
+	globalParams protocol.GlobalParams,
+	headers storage.Headers,
+	results storage.ExecutionResults,
+	setups storage.EpochSetups,
+	commits storage.EpochCommits,
+) *MutableProtocolState {
+	return &MutableProtocolState{
+		ProtocolState: *NewProtocolState(protocolStateDB, globalParams),
+		headers:       headers,
+		results:       results,
+		setups:        setups,
+		commits:       commits,
+	}
+}
+
+// Mutator instantiates a `protocol.StateMutator` based on the previous protocol state.
+// Has to be called for each block to evolve the protocol state.
+// Expected errors during normal operations:
+//   - `storage.ErrNotFound` if no protocol state for parent block is known.
+func (s *MutableProtocolState) Mutator(candidateView uint64, parentID flow.Identifier) (protocol.StateMutator, error) {
+	parentState, err := s.protocolStateDB.ByBlockID(parentID)
+	if err != nil {
+		return nil, fmt.Errorf("could not query parent protocol state at block (%x): %w", parentID, err)
+	}
+	return newStateMutator(
+		s.headers,
+		s.results,
+		s.setups,
+		s.commits,
+		s.globalParams,
+		candidateView,
+		parentState,
+		func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) { // needed for translating from concrete implementation type to interface type
+			return newStateMachine(candidateView, parentState)
+		},
+		func(candidateView uint64, parentState *flow.RichProtocolStateEntry) (ProtocolStateMachine, error) { // needed for translating from concrete implementation type to interface type
+			return newEpochFallbackStateMachine(candidateView, parentState), nil
+		},
+	)
+}
diff --git a/state/protocol/protocol_state/protocol_state_test.go b/state/protocol/protocol_state/protocol_state_test.go
new file mode 100644
index 00000000000..27e1b591284
--- /dev/null
+++ b/state/protocol/protocol_state/protocol_state_test.go
@@ -0,0 +1,104 @@
+package protocol_state
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/state/protocol/mock"
+	"github.com/onflow/flow-go/storage"
+	storagemock "github.com/onflow/flow-go/storage/mock"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+// TestProtocolState_AtBlockID
+func TestProtocolState_AtBlockID(t *testing.T) {
+	entry := unittest.ProtocolStateFixture(unittest.WithValidDKG())
+	otherEntry := unittest.ProtocolStateFixture(unittest.WithValidDKG())
+	blockID := unittest.IdentifierFixture()
+	otherBlockID := unittest.IdentifierFixture()
+
+	protocolStateDB := storagemock.NewProtocolState(t)
+	protocolStateDB.On("ByBlockID", blockID).Return(entry, nil).Once()
+	protocolStateDB.On("ByBlockID", otherBlockID).Return(otherEntry, nil).Once()
+
+	globalParams := mock.NewGlobalParams(t)
+	protocolState := NewProtocolState(protocolStateDB, globalParams)
+	t.Run("retrieve state for existing blocks", func(t *testing.T) {
+		dynamicProtocolState, err := protocolState.AtBlockID(blockID)
+		require.NoError(t, err)
+
+		assert.Equal(t, entry.CurrentEpochIdentityTable, dynamicProtocolState.Identities())
+
+		other, err := protocolState.AtBlockID(otherBlockID)
+		require.NoError(t, err)
+		require.NotEqual(t, dynamicProtocolState.Identities(), other.Identities())
+	})
+	t.Run("retrieve state for non-existing block yields storage.ErrNotFound error", func(t *testing.T) {
+		blockID := unittest.IdentifierFixture()
+		protocolStateDB.On("ByBlockID", blockID).Return(nil, storage.ErrNotFound).Once()
+		_, err := protocolState.AtBlockID(blockID)
+		require.ErrorIs(t, err, storage.ErrNotFound)
+	})
+	t.Run("exception during retrieve is propagated", func(t *testing.T) {
+		blockID := unittest.IdentifierFixture()
+		exception := errors.New("exception")
+		protocolStateDB.On("ByBlockID", blockID).Return(nil, exception).Once()
+		_, err := protocolState.AtBlockID(blockID)
+		require.ErrorIs(t, err, exception)
+	})
+	t.Run("retrieve global-params", func(t *testing.T) {
+		expectedChainID := flow.Testnet
+		globalParams.On("ChainID").Return(expectedChainID, nil).Once()
+		actualChainID := protocolState.GlobalParams().ChainID()
+		assert.Equal(t, expectedChainID, actualChainID)
+	})
+}
+
+// TestMutableProtocolState_Mutator tests happy path of creating a state mutator, and that `Mutator` returns an error
+// if the parent protocol state has not been found.
+func TestMutableProtocolState_Mutator(t *testing.T) {
+	protocolStateDB := storagemock.NewProtocolState(t)
+	globalParams := mock.NewGlobalParams(t)
+	globalParams.On("EpochCommitSafetyThreshold").Return(uint64(1000))
+	headersDB := storagemock.NewHeaders(t)
+	resultsDB := storagemock.NewExecutionResults(t)
+	setupsDB := storagemock.NewEpochSetups(t)
+	commitsDB := storagemock.NewEpochCommits(t)
+
+	mutableState := NewMutableProtocolState(
+		protocolStateDB,
+		globalParams,
+		headersDB,
+		resultsDB,
+		setupsDB,
+		commitsDB)
+
+	t.Run("happy-path", func(t *testing.T) {
+		parentState := unittest.ProtocolStateFixture()
+		candidate := unittest.BlockHeaderFixture()
+		protocolStateDB.On("ByBlockID", candidate.ParentID).Return(parentState, nil)
+		mutator, err := mutableState.Mutator(candidate.View, candidate.ParentID)
+		require.NoError(t, err)
+		require.NotNil(t, mutator)
+	})
+	t.Run("parent-not-found", func(t *testing.T) {
+		candidate := unittest.BlockHeaderFixture()
+		protocolStateDB.On("ByBlockID", candidate.ParentID).Return(nil, storage.ErrNotFound)
+		mutator, err := mutableState.Mutator(candidate.View, candidate.ParentID)
+		require.ErrorIs(t, err, storage.ErrNotFound)
+		require.Nil(t, mutator)
+	})
+	t.Run("invalid-state-transition-triggered", func(t *testing.T) {
+		parentState := unittest.ProtocolStateFixture()
+		parentState.InvalidEpochTransitionAttempted = true
+		candidate := unittest.BlockHeaderFixture()
+		protocolStateDB.On("ByBlockID", candidate.ParentID).Return(parentState, nil)
+		mutator, err := mutableState.Mutator(candidate.View, candidate.ParentID)
+		require.NoError(t, err)
+		require.NotNil(t, mutator)
+	})
+}
diff --git a/state/protocol/protocol_state/protocol_statemachine.go b/state/protocol/protocol_state/protocol_statemachine.go
new file mode 100644
index 00000000000..19e9bcabfe2
--- /dev/null
+++ b/state/protocol/protocol_state/protocol_statemachine.go
@@ -0,0 +1,183 @@
+package protocol_state
+
+import (
+	"fmt"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module/irrecoverable"
+	"github.com/onflow/flow-go/state/protocol"
+)
+
+// protocolStateMachine is a dedicated structure that encapsulates all logic for evolving protocol state, based on the content
+// of a new block. It guarantees protocol-compliant evolution of the protocol state by implementing the
+// following state transitions:
+//   - epoch setup: transitions current epoch from staking to setup phase, creates next epoch protocol state when processed.
+//   - epoch commit: transitions current epoch from setup to commit phase, commits next epoch protocol state when processed.
+//   - epoch transition: on the first block of the new epoch (Formally, the block's parent is still in the last epoch,
+//     while the new block has a view in the next epoch. Caution: the block's view is not necessarily the first view
+//     in the epoch, as there might be leader failures)
+//   - identity changes: updates identity table for previous (if available), current, and next epoch (if available).
+//
+// All updates are applied to a copy of parent protocol state, so parent protocol state is not modified. The stateMachine internally
+// tracks the current protocol state. A separate instance should be created for each block to processing the updates therein.
+type protocolStateMachine struct {
+	baseProtocolStateMachine
+}
+
+var _ ProtocolStateMachine = (*protocolStateMachine)(nil)
+
+// newStateMachine creates a new protocol state protocolStateMachine.
+// An exception is returned in case the `InvalidEpochTransitionAttempted` flag is set in the `parentState`. This means that
+// the protocol state evolution has reached an undefined state from the perspective of the happy path state machine.
+func newStateMachine(view uint64, parentState *flow.RichProtocolStateEntry) (*protocolStateMachine, error) {
+	if parentState.InvalidEpochTransitionAttempted {
+		return nil, irrecoverable.NewExceptionf("cannot create happy path protocol state machine at view (%d) for a parent state"+
+			"which is in Epoch Fallback Mode", view)
+	}
+	return &protocolStateMachine{
+		baseProtocolStateMachine: baseProtocolStateMachine{
+			parentState: parentState,
+			state:       parentState.ProtocolStateEntry.Copy(),
+			view:        view,
+		},
+	}, nil
+}
+
+// ProcessEpochSetup updates the protocol state with data from the epoch setup event.
+// Observing an epoch setup event also affects the identity table for current epoch:
+//   - it transitions the protocol state from Staking to Epoch Setup phase
+//   - we stop returning identities from previous+current epochs and instead returning identities from current+next epochs.
+//
+// As a result of this operation protocol state for the next epoch will be created.
+// Returned boolean indicates if event triggered a transition in the state machine or not.
+// Implementors must never return (true, error).
+// Expected errors indicating that we are leaving the happy-path of the epoch transitions
+//   - `protocol.InvalidServiceEventError` - if the service event is invalid or is not a valid state transition for the current protocol state.
+//     CAUTION: the protocolStateMachine is left with a potentially dysfunctional state when this error occurs. Do NOT call the Build method
+//     after such error and discard the protocolStateMachine!
+func (u *protocolStateMachine) ProcessEpochSetup(epochSetup *flow.EpochSetup) (bool, error) {
+	err := protocol.IsValidExtendingEpochSetup(epochSetup, u.parentState.ProtocolStateEntry, u.parentState.CurrentEpochSetup)
+	if err != nil {
+		return false, fmt.Errorf("invalid epoch setup event: %w", err)
+	}
+	if u.state.NextEpoch != nil {
+		return false, protocol.NewInvalidServiceEventErrorf("repeated setup for epoch %d", epochSetup.Counter)
+	}
+
+	// When observing setup event for subsequent epoch, construct the EpochStateContainer for `ProtocolStateEntry.NextEpoch`.
+	// Context:
+	// Note that the `EpochStateContainer.ActiveIdentities` only contains the nodes that are *active* in the next epoch. Active means
+	// that these nodes are authorized to contribute to extending the chain. Nodes are listed in `ActiveIdentities` if and only if
+	// they are part of the EpochSetup event for the respective epoch.
+	//
+	// sanity checking SAFETY-CRITICAL INVARIANT (I):
+	//   - Per convention, the `flow.EpochSetup` event should list the IdentitySkeletons in canonical order. This is useful
+	//     for most efficient construction of the full active Identities for an epoch. We enforce this here at the gateway
+	//     to the protocol state, when we incorporate new information from the EpochSetup event.
+	//   - Note that the system smart contracts manage the identity table as an unordered set! For the protocol state, we desire a fixed
+	//     ordering to simplify various implementation details, like the DKG. Therefore, we order identities in `flow.EpochSetup` during
+	//     conversion from cadence to Go in the function `convert.ServiceEvent(flow.ChainID, flow.Event)` in package `model/convert`
+	// sanity checking SAFETY-CRITICAL INVARIANT (II):
+	// While ejection status and dynamic weight are not part of the EpochSetup event, we can supplement this information as follows:
+	//   - Per convention, service events are delivered (asynchronously) in an *order-preserving* manner. Furthermore, weight changes or
+	//     node ejection is entirely mediated by system smart contracts and delivered via service events.
+	//   - Therefore, the EpochSetup event contains the up-to-date snapshot of the epoch participants. Any weight changes or node ejection
+	//     that happened before should be reflected in the EpochSetup event. Specifically, the initial weight should be reduced and ejected
+	//     nodes should be no longer listed in the EpochSetup event.
+	//   - Hence, the following invariant must be satisfied by the system smart contracts for all active nodes in the upcoming epoch:
+	//      (i) The Ejected flag is false. Node X being ejected in epoch N (necessarily via a service event emitted by the system
+	//          smart contracts earlier) but also being listed in the setup event for the subsequent epoch (service event emitted by
+	//          the system smart contracts later) is illegal.
+	//     (ii) When the EpochSetup event is emitted / processed, the weight of all active nodes equals their InitialWeight and
+
+	// For collector clusters, we rely on invariants (I) and (II) holding. See `committees.Cluster` for details, specifically function
+	// `constructInitialClusterIdentities(..)`. While the system smart contract must satisfy this invariant, we run a sanity check below.
+	activeIdentitiesLookup := u.parentState.CurrentEpoch.ActiveIdentities.Lookup() // lookup NodeID → DynamicIdentityEntry for nodes _active_ in the current epoch
+	nextEpochActiveIdentities := make(flow.DynamicIdentityEntryList, 0, len(epochSetup.Participants))
+	prevNodeID := epochSetup.Participants[0].NodeID
+	for idx, nextEpochIdentitySkeleton := range epochSetup.Participants {
+		// sanity checking invariant (I):
+		if idx > 0 && !flow.IsIdentifierCanonical(prevNodeID, nextEpochIdentitySkeleton.NodeID) {
+			return false, protocol.NewInvalidServiceEventErrorf("epoch setup event lists active participants not in canonical ordering")
+		}
+		prevNodeID = nextEpochIdentitySkeleton.NodeID
+
+		// sanity checking invariant (II.i):
+		currentEpochDynamicProperties, found := activeIdentitiesLookup[nextEpochIdentitySkeleton.NodeID]
+		if found && currentEpochDynamicProperties.Ejected { // invariance violated
+			return false, protocol.NewInvalidServiceEventErrorf("node %v is ejected in current epoch %d but readmitted by EpochSetup event for epoch %d", nextEpochIdentitySkeleton.NodeID, u.parentState.CurrentEpochSetup.Counter, epochSetup.Counter)
+		}
+
+		nextEpochActiveIdentities = append(nextEpochActiveIdentities, &flow.DynamicIdentityEntry{
+			NodeID:  nextEpochIdentitySkeleton.NodeID,
+			Ejected: false, // according to invariant (II.i)
+		})
+	}
+
+	// construct data container specifying next epoch
+	u.state.NextEpoch = &flow.EpochStateContainer{
+		SetupID:          epochSetup.ID(),
+		CommitID:         flow.ZeroID,
+		ActiveIdentities: nextEpochActiveIdentities,
+	}
+
+	// subsequent epoch commit event and update identities afterwards.
+	u.nextEpochIdentitiesLookup = u.state.NextEpoch.ActiveIdentities.Lookup()
+	return true, nil
+}
+
+// ProcessEpochCommit updates current protocol state with data from epoch commit event.
+// Observing an epoch setup commit, transitions protocol state from setup to commit phase.
+// At this point, we have finished construction of the next epoch.
+// As a result of this operation protocol state for next epoch will be committed.
+// Returned boolean indicates if event triggered a transition in the state machine or not.
+// Implementors must never return (true, error).
+// Expected errors indicating that we are leaving the happy-path of the epoch transitions
+//   - `protocol.InvalidServiceEventError` - if the service event is invalid or is not a valid state transition for the current protocol state.
+//     CAUTION: the protocolStateMachine is left with a potentially dysfunctional state when this error occurs. Do NOT call the Build method
+//     after such error and discard the protocolStateMachine!
+func (u *protocolStateMachine) ProcessEpochCommit(epochCommit *flow.EpochCommit) (bool, error) {
+	if u.state.NextEpoch == nil {
+		return false, protocol.NewInvalidServiceEventErrorf("protocol state has been setup yet")
+	}
+	if u.state.NextEpoch.CommitID != flow.ZeroID {
+		return false, protocol.NewInvalidServiceEventErrorf("protocol state has already a commit event")
+	}
+	err := protocol.IsValidExtendingEpochCommit(epochCommit, u.parentState.ProtocolStateEntry, u.parentState.NextEpochSetup)
+	if err != nil {
+		return false, fmt.Errorf("invalid epoch commit event: %w", err)
+	}
+
+	u.state.NextEpoch.CommitID = epochCommit.ID()
+	return true, nil
+}
+
+// TransitionToNextEpoch updates the notion of 'current epoch', 'previous' and 'next epoch' in the protocol
+// state. An epoch transition is only allowed when:
+// - next epoch has been set up,
+// - next epoch has been committed,
+// - invalid state transition has not been attempted (this is ensured by constructor),
+// - candidate block is in the next epoch.
+// No errors are expected during normal operations.
+func (u *protocolStateMachine) TransitionToNextEpoch() error {
+	nextEpoch := u.state.NextEpoch
+	// Check if there is next epoch protocol state
+	if nextEpoch == nil {
+		return fmt.Errorf("protocol state has not been setup yet")
+	}
+	// Check if there is a commit event for next epoch
+	if nextEpoch.CommitID == flow.ZeroID {
+		return fmt.Errorf("protocol state has not been committed yet")
+	}
+	// Check if we are at the next epoch, only then a transition is allowed
+	if u.view < u.parentState.NextEpochSetup.FirstView {
+		return fmt.Errorf("protocol state transition is only allowed when enterring next epoch")
+	}
+	u.state = &flow.ProtocolStateEntry{
+		PreviousEpoch:                   &u.state.CurrentEpoch,
+		CurrentEpoch:                    *u.state.NextEpoch,
+		InvalidEpochTransitionAttempted: false,
+	}
+	u.rebuildIdentityLookup()
+	return nil
+}
diff --git a/state/protocol/protocol_state/protocol_statemachine_test.go b/state/protocol/protocol_state/protocol_statemachine_test.go
new file mode 100644
index 00000000000..edc6cc68848
--- /dev/null
+++ b/state/protocol/protocol_state/protocol_statemachine_test.go
@@ -0,0 +1,512 @@
+package protocol_state
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/model/flow/filter"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+func TestProtocolStateMachine(t *testing.T) {
+	suite.Run(t, new(ProtocolStateMachineSuite))
+}
+
+// BaseProtocolStateMachineSuite is a base test suite that holds common functionality for testing protocol state machines.
+// It reflects the portion of data which is present in baseProtocolStateMachine.
+type BaseProtocolStateMachineSuite struct {
+	suite.Suite
+
+	parentProtocolState *flow.RichProtocolStateEntry
+	parentBlock         *flow.Header
+	candidate           *flow.Header
+}
+
+func (s *BaseProtocolStateMachineSuite) SetupTest() {
+	s.parentProtocolState = unittest.ProtocolStateFixture()
+	s.parentBlock = unittest.BlockHeaderFixture(unittest.HeaderWithView(s.parentProtocolState.CurrentEpochSetup.FirstView + 1))
+	s.candidate = unittest.BlockHeaderWithParentFixture(s.parentBlock)
+}
+
+// ProtocolStateMachineSuite is a dedicated test suite for testing happy path state machine.
+type ProtocolStateMachineSuite struct {
+	BaseProtocolStateMachineSuite
+	stateMachine *protocolStateMachine
+}
+
+func (s *ProtocolStateMachineSuite) SetupTest() {
+	s.BaseProtocolStateMachineSuite.SetupTest()
+	var err error
+	s.stateMachine, err = newStateMachine(s.candidate.View, s.parentProtocolState.Copy())
+	require.NoError(s.T(), err)
+}
+
+// TestNewstateMachine tests if the constructor correctly setups invariants for protocolStateMachine.
+func (s *ProtocolStateMachineSuite) TestNewstateMachine() {
+	require.NotSame(s.T(), s.stateMachine.parentState, s.stateMachine.state, "except to take deep copy of parent state")
+	require.Nil(s.T(), s.stateMachine.parentState.NextEpoch)
+	require.Nil(s.T(), s.stateMachine.state.NextEpoch)
+	require.Equal(s.T(), s.candidate.View, s.stateMachine.View())
+	require.Equal(s.T(), s.parentProtocolState, s.stateMachine.ParentState())
+}
+
+// TestTransitionToNextEpoch tests a scenario where the protocolStateMachine processes first block from next epoch.
+// It has to discard the parent state and build a new state with data from next epoch.
+func (s *ProtocolStateMachineSuite) TestTransitionToNextEpoch() {
+	// update protocol state with next epoch information
+	unittest.WithNextEpochProtocolState()(s.parentProtocolState)
+
+	candidate := unittest.BlockHeaderFixture(
+		unittest.HeaderWithView(s.parentProtocolState.CurrentEpochSetup.FinalView + 1))
+	var err error
+	// since the candidate block is from next epoch, protocolStateMachine should transition to next epoch
+	s.stateMachine, err = newStateMachine(candidate.View, s.parentProtocolState.Copy())
+	require.NoError(s.T(), err)
+	err = s.stateMachine.TransitionToNextEpoch()
+	require.NoError(s.T(), err)
+	updatedState, stateID, hasChanges := s.stateMachine.Build()
+	require.True(s.T(), hasChanges)
+	require.NotEqual(s.T(), s.parentProtocolState.ID(), updatedState.ID())
+	require.Equal(s.T(), updatedState.ID(), stateID)
+	require.Equal(s.T(), s.parentProtocolState.ID(), s.stateMachine.ParentState().ID(), "should not modify parent protocol state")
+	require.Equal(s.T(), updatedState.CurrentEpoch.ID(), s.parentProtocolState.NextEpoch.ID(), "should transition into next epoch")
+	require.Nil(s.T(), updatedState.NextEpoch, "next epoch protocol state should be nil")
+}
+
+// TestTransitionToNextEpochNotAllowed tests different scenarios where transition to next epoch is not allowed.
+func (s *ProtocolStateMachineSuite) TestTransitionToNextEpochNotAllowed() {
+	s.Run("no next epoch protocol state", func() {
+		protocolState := unittest.ProtocolStateFixture()
+		candidate := unittest.BlockHeaderFixture(
+			unittest.HeaderWithView(protocolState.CurrentEpochSetup.FinalView + 1))
+		stateMachine, err := newStateMachine(candidate.View, protocolState)
+		require.NoError(s.T(), err)
+		err = stateMachine.TransitionToNextEpoch()
+		require.Error(s.T(), err, "should not allow transition to next epoch if there is no next epoch protocol state")
+	})
+	s.Run("next epoch not committed", func() {
+		protocolState := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState(), func(entry *flow.RichProtocolStateEntry) {
+			entry.NextEpoch.CommitID = flow.ZeroID
+			entry.NextEpochCommit = nil
+		})
+		candidate := unittest.BlockHeaderFixture(
+			unittest.HeaderWithView(protocolState.CurrentEpochSetup.FinalView + 1))
+		stateMachine, err := newStateMachine(candidate.View, protocolState)
+		require.NoError(s.T(), err)
+		err = stateMachine.TransitionToNextEpoch()
+		require.Error(s.T(), err, "should not allow transition to next epoch if it is not committed")
+	})
+	s.Run("candidate block is not from next epoch", func() {
+		protocolState := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState())
+		candidate := unittest.BlockHeaderFixture(
+			unittest.HeaderWithView(protocolState.CurrentEpochSetup.FinalView))
+		stateMachine, err := newStateMachine(candidate.View, protocolState)
+		require.NoError(s.T(), err)
+		err = stateMachine.TransitionToNextEpoch()
+		require.Error(s.T(), err, "should not allow transition to next epoch if next block is not first block from next epoch")
+	})
+}
+
+// TestBuild tests if the protocolStateMachine returns correct protocol state.
+func (s *ProtocolStateMachineSuite) TestBuild() {
+	updatedState, stateID, hasChanges := s.stateMachine.Build()
+	require.Equal(s.T(), stateID, s.parentProtocolState.ID(), "should return same protocol state")
+	require.False(s.T(), hasChanges, "should not have changes")
+	require.NotSame(s.T(), updatedState, s.stateMachine.state, "should return a copy of protocol state")
+	require.Equal(s.T(), updatedState.ID(), stateID, "should return correct ID")
+	require.Equal(s.T(), s.parentProtocolState.ID(), s.stateMachine.ParentState().ID(), "should not modify parent protocol state")
+
+	updatedDynamicIdentity := s.parentProtocolState.CurrentEpochIdentityTable[0].NodeID
+	err := s.stateMachine.EjectIdentity(updatedDynamicIdentity)
+	require.NoError(s.T(), err)
+	updatedState, stateID, hasChanges = s.stateMachine.Build()
+	require.True(s.T(), hasChanges, "should have changes")
+	require.NotEqual(s.T(), stateID, s.parentProtocolState.ID(), "protocol state was modified but still has same ID")
+	require.Equal(s.T(), updatedState.ID(), stateID, "should return correct ID")
+	require.Equal(s.T(), s.parentProtocolState.ID(), s.stateMachine.ParentState().ID(), "should not modify parent protocol state")
+}
+
+// TestCreateStateMachineAfterInvalidStateTransitionAttempted tests if creating state machine after observing invalid state transition
+// results in error .
+func (s *ProtocolStateMachineSuite) TestCreateStateMachineAfterInvalidStateTransitionAttempted() {
+	s.parentProtocolState.InvalidEpochTransitionAttempted = true
+	var err error
+	// create new protocolStateMachine with next epoch information
+	s.stateMachine, err = newStateMachine(s.candidate.View, s.parentProtocolState.Copy())
+	require.Error(s.T(), err)
+}
+
+// TestProcessEpochCommit tests if processing epoch commit event correctly updates internal state of protocolStateMachine and
+// correctly behaves when invariants are violated.
+func (s *ProtocolStateMachineSuite) TestProcessEpochCommit() {
+	var err error
+	s.Run("invalid counter", func() {
+		s.stateMachine, err = newStateMachine(s.candidate.View, s.parentProtocolState.Copy())
+		require.NoError(s.T(), err)
+		commit := unittest.EpochCommitFixture(func(commit *flow.EpochCommit) {
+			commit.Counter = s.parentProtocolState.CurrentEpochSetup.Counter + 10 // set invalid counter for next epoch
+		})
+		_, err := s.stateMachine.ProcessEpochCommit(commit)
+		require.Error(s.T(), err)
+		require.True(s.T(), protocol.IsInvalidServiceEventError(err))
+	})
+	s.Run("no next epoch protocol state", func() {
+		s.stateMachine, err = newStateMachine(s.candidate.View, s.parentProtocolState.Copy())
+		require.NoError(s.T(), err)
+		commit := unittest.EpochCommitFixture(func(commit *flow.EpochCommit) {
+			commit.Counter = s.parentProtocolState.CurrentEpochSetup.Counter + 1
+		})
+		_, err := s.stateMachine.ProcessEpochCommit(commit)
+		require.Error(s.T(), err)
+		require.True(s.T(), protocol.IsInvalidServiceEventError(err))
+	})
+	s.Run("conflicting epoch commit", func() {
+		s.stateMachine, err = newStateMachine(s.candidate.View, s.parentProtocolState.Copy())
+		require.NoError(s.T(), err)
+		setup := unittest.EpochSetupFixture(
+			unittest.SetupWithCounter(s.parentProtocolState.CurrentEpochSetup.Counter+1),
+			unittest.WithFirstView(s.parentProtocolState.CurrentEpochSetup.FinalView+1),
+			unittest.WithFinalView(s.parentProtocolState.CurrentEpochSetup.FinalView+1000),
+		)
+		// processing setup event results in creating next epoch protocol state
+		_, err := s.stateMachine.ProcessEpochSetup(setup)
+		require.NoError(s.T(), err)
+
+		updatedState, _, _ := s.stateMachine.Build()
+
+		parentState, err := flow.NewRichProtocolStateEntry(updatedState,
+			s.parentProtocolState.PreviousEpochSetup,
+			s.parentProtocolState.PreviousEpochCommit,
+			s.parentProtocolState.CurrentEpochSetup,
+			s.parentProtocolState.CurrentEpochCommit,
+			setup,
+			nil,
+		)
+		require.NoError(s.T(), err)
+		s.stateMachine, err = newStateMachine(s.candidate.View+1, parentState)
+		require.NoError(s.T(), err)
+		commit := unittest.EpochCommitFixture(
+			unittest.CommitWithCounter(setup.Counter),
+			unittest.WithDKGFromParticipants(setup.Participants),
+		)
+
+		_, err = s.stateMachine.ProcessEpochCommit(commit)
+		require.NoError(s.T(), err)
+
+		// processing another epoch commit has to be an error since we have already processed one
+		_, err = s.stateMachine.ProcessEpochCommit(commit)
+		require.Error(s.T(), err)
+		require.True(s.T(), protocol.IsInvalidServiceEventError(err))
+
+		newState, _, _ := s.stateMachine.Build()
+		require.Equal(s.T(), commit.ID(), newState.NextEpoch.CommitID, "next epoch should be committed since we have observed, a valid event")
+	})
+	s.Run("happy path processing", func() {
+		s.stateMachine, err = newStateMachine(s.candidate.View, s.parentProtocolState.Copy())
+		require.NoError(s.T(), err)
+		setup := unittest.EpochSetupFixture(
+			unittest.SetupWithCounter(s.parentProtocolState.CurrentEpochSetup.Counter+1),
+			unittest.WithFirstView(s.parentProtocolState.CurrentEpochSetup.FinalView+1),
+			unittest.WithFinalView(s.parentProtocolState.CurrentEpochSetup.FinalView+1000),
+		)
+		// processing setup event results in creating next epoch protocol state
+		_, err := s.stateMachine.ProcessEpochSetup(setup)
+		require.NoError(s.T(), err)
+
+		updatedState, stateID, hasChanges := s.stateMachine.Build()
+		require.True(s.T(), hasChanges)
+		require.NotEqual(s.T(), s.parentProtocolState.ID(), updatedState.ID())
+		require.Equal(s.T(), updatedState.ID(), stateID)
+		require.Equal(s.T(), s.parentProtocolState.ID(), s.stateMachine.ParentState().ID(), "should not modify parent protocol state")
+
+		parentState, err := flow.NewRichProtocolStateEntry(updatedState,
+			s.parentProtocolState.PreviousEpochSetup,
+			s.parentProtocolState.PreviousEpochCommit,
+			s.parentProtocolState.CurrentEpochSetup,
+			s.parentProtocolState.CurrentEpochCommit,
+			setup,
+			nil,
+		)
+		require.NoError(s.T(), err)
+		s.stateMachine, err = newStateMachine(s.candidate.View+1, parentState.Copy())
+		require.NoError(s.T(), err)
+		commit := unittest.EpochCommitFixture(
+			unittest.CommitWithCounter(setup.Counter),
+			unittest.WithDKGFromParticipants(setup.Participants),
+		)
+
+		_, err = s.stateMachine.ProcessEpochCommit(commit)
+		require.NoError(s.T(), err)
+
+		newState, newStateID, newStateHasChanges := s.stateMachine.Build()
+		require.True(s.T(), newStateHasChanges)
+		require.Equal(s.T(), commit.ID(), newState.NextEpoch.CommitID, "next epoch should be committed")
+		require.Equal(s.T(), newState.ID(), newStateID)
+		require.NotEqual(s.T(), s.parentProtocolState.ID(), newState.ID())
+		require.NotEqual(s.T(), updatedState.ID(), newState.ID())
+		require.Equal(s.T(), parentState.ID(), s.stateMachine.ParentState().ID(),
+			"should not modify parent protocol state")
+	})
+}
+
+// TestUpdateIdentityUnknownIdentity tests if updating the identity of unknown node results in an error.
+func (s *ProtocolStateMachineSuite) TestUpdateIdentityUnknownIdentity() {
+	err := s.stateMachine.EjectIdentity(unittest.IdentifierFixture())
+	require.Error(s.T(), err, "should not be able to update data of unknown identity")
+	require.True(s.T(), protocol.IsInvalidServiceEventError(err))
+
+	updatedState, updatedStateID, hasChanges := s.stateMachine.Build()
+	require.False(s.T(), hasChanges, "should not have changes")
+	require.Equal(s.T(), updatedState.ID(), s.parentProtocolState.ID())
+	require.Equal(s.T(), updatedState.ID(), updatedStateID)
+}
+
+// TestUpdateIdentityHappyPath tests if identity updates are correctly processed and reflected in the resulting protocol state.
+func (s *ProtocolStateMachineSuite) TestUpdateIdentityHappyPath() {
+	// update protocol state to have next epoch protocol state
+	unittest.WithNextEpochProtocolState()(s.parentProtocolState)
+	var err error
+	s.stateMachine, err = newStateMachine(s.candidate.View, s.parentProtocolState.Copy())
+	require.NoError(s.T(), err)
+
+	currentEpochParticipants := s.parentProtocolState.CurrentEpochIdentityTable.Copy()
+	ejectedChanges, err := currentEpochParticipants.Sample(2)
+	require.NoError(s.T(), err)
+
+	for _, update := range ejectedChanges {
+		err := s.stateMachine.EjectIdentity(update.NodeID)
+		require.NoError(s.T(), err)
+	}
+	updatedState, updatedStateID, hasChanges := s.stateMachine.Build()
+	require.True(s.T(), hasChanges, "should have changes")
+	require.Equal(s.T(), updatedState.ID(), updatedStateID)
+	require.NotEqual(s.T(), s.parentProtocolState.ID(), updatedState.ID())
+	require.Equal(s.T(), s.parentProtocolState.ID(), s.stateMachine.ParentState().ID(),
+		"should not modify parent protocol state")
+
+	// assert that all changes made in the previous epoch are preserved
+	currentEpochLookup := updatedState.CurrentEpoch.ActiveIdentities.Lookup()
+	nextEpochLookup := updatedState.NextEpoch.ActiveIdentities.Lookup()
+
+	for _, updated := range ejectedChanges {
+		currentEpochIdentity, foundInCurrentEpoch := currentEpochLookup[updated.NodeID]
+		if foundInCurrentEpoch {
+			require.Equal(s.T(), updated.NodeID, currentEpochIdentity.NodeID)
+			require.True(s.T(), currentEpochIdentity.Ejected)
+		}
+
+		nextEpochIdentity, foundInNextEpoch := nextEpochLookup[updated.NodeID]
+		if foundInNextEpoch {
+			require.Equal(s.T(), updated.NodeID, nextEpochIdentity.NodeID)
+			require.True(s.T(), nextEpochIdentity.Ejected)
+		}
+		require.True(s.T(), foundInCurrentEpoch || foundInNextEpoch, "identity should be found in either current or next epoch")
+	}
+}
+
+// TestProcessEpochSetupInvariants tests if processing epoch setup when invariants are violated doesn't update internal structures.
+func (s *ProtocolStateMachineSuite) TestProcessEpochSetupInvariants() {
+	s.Run("invalid counter", func() {
+		setup := unittest.EpochSetupFixture(func(setup *flow.EpochSetup) {
+			setup.Counter = s.parentProtocolState.CurrentEpochSetup.Counter + 10 // set invalid counter for next epoch
+		})
+		_, err := s.stateMachine.ProcessEpochSetup(setup)
+		require.Error(s.T(), err)
+		require.True(s.T(), protocol.IsInvalidServiceEventError(err))
+	})
+	s.Run("processing second epoch setup", func() {
+		stateMachine, err := newStateMachine(s.candidate.View, s.parentProtocolState.Copy())
+		require.NoError(s.T(), err)
+		setup := unittest.EpochSetupFixture(
+			unittest.SetupWithCounter(s.parentProtocolState.CurrentEpochSetup.Counter+1),
+			unittest.WithFirstView(s.parentProtocolState.CurrentEpochSetup.FinalView+1),
+			unittest.WithFinalView(s.parentProtocolState.CurrentEpochSetup.FinalView+1000),
+		)
+		_, err = stateMachine.ProcessEpochSetup(setup)
+		require.NoError(s.T(), err)
+
+		_, err = stateMachine.ProcessEpochSetup(setup)
+		require.Error(s.T(), err)
+		require.True(s.T(), protocol.IsInvalidServiceEventError(err))
+	})
+	s.Run("participants not sorted", func() {
+		stateMachine, err := newStateMachine(s.candidate.View, s.parentProtocolState.Copy())
+		require.NoError(s.T(), err)
+		setup := unittest.EpochSetupFixture(func(setup *flow.EpochSetup) {
+			setup.Counter = s.parentProtocolState.CurrentEpochSetup.Counter + 1
+			var err error
+			setup.Participants, err = setup.Participants.Shuffle()
+			require.NoError(s.T(), err)
+		})
+		_, err = stateMachine.ProcessEpochSetup(setup)
+		require.Error(s.T(), err)
+		require.True(s.T(), protocol.IsInvalidServiceEventError(err))
+	})
+	s.Run("epoch setup state conflicts with protocol state", func() {
+		conflictingIdentity := s.parentProtocolState.ProtocolStateEntry.CurrentEpoch.ActiveIdentities[0]
+		conflictingIdentity.Ejected = true
+
+		stateMachine, err := newStateMachine(s.candidate.View, s.parentProtocolState.Copy())
+		require.NoError(s.T(), err)
+		setup := unittest.EpochSetupFixture(func(setup *flow.EpochSetup) {
+			setup.Counter = s.parentProtocolState.CurrentEpochSetup.Counter + 1
+			// using same identities as in previous epoch should result in an error since
+			// we have ejected conflicting identity but it was added back in epoch setup
+			// such epoch setup event is invalid.
+			setup.Participants = s.parentProtocolState.CurrentEpochSetup.Participants
+		})
+
+		_, err = stateMachine.ProcessEpochSetup(setup)
+		require.Error(s.T(), err)
+		require.True(s.T(), protocol.IsInvalidServiceEventError(err))
+	})
+}
+
+// TestProcessEpochSetupHappyPath tests if processing epoch setup when invariants are not violated updates internal structures.
+// We test correct construction of the *active identities* for the current and next epoch. Specifically, observing an EpochSetup
+// event should leave `PreviousEpoch` and `CurrentEpoch`'s EpochStateContainer unchanged.
+// The next epoch's EpochStateContainer should reference the EpochSetup event and hold the respective ActiveIdentities.
+func (s *ProtocolStateMachineSuite) TestProcessEpochSetupHappyPath() {
+	setupParticipants := unittest.IdentityListFixture(5, unittest.WithAllRoles()).Sort(flow.Canonical[flow.Identity])
+	setupParticipants[0].InitialWeight = 13
+	setup := unittest.EpochSetupFixture(
+		unittest.SetupWithCounter(s.parentProtocolState.CurrentEpochSetup.Counter+1),
+		unittest.WithFirstView(s.parentProtocolState.CurrentEpochSetup.FinalView+1),
+		unittest.WithFinalView(s.parentProtocolState.CurrentEpochSetup.FinalView+1000),
+		unittest.WithParticipants(setupParticipants.ToSkeleton()),
+	)
+
+	// for next epoch we will have all the identities from setup event
+	expectedNextEpochActiveIdentities := flow.DynamicIdentityEntryListFromIdentities(setupParticipants)
+
+	// process actual event
+	_, err := s.stateMachine.ProcessEpochSetup(setup)
+	require.NoError(s.T(), err)
+
+	updatedState, _, hasChanges := s.stateMachine.Build()
+	require.True(s.T(), hasChanges, "should have changes")
+	require.Equal(s.T(), s.parentProtocolState.PreviousEpoch, updatedState.PreviousEpoch, "previous epoch's EpochStateContainer should not change")
+	require.Equal(s.T(), s.parentProtocolState.CurrentEpoch, updatedState.CurrentEpoch, "current epoch's EpochStateContainer should not change")
+	nextEpoch := updatedState.NextEpoch
+	require.NotNil(s.T(), nextEpoch, "should have next epoch protocol state")
+	require.Equal(s.T(), nextEpoch.SetupID, setup.ID(),
+		"should have correct setup ID for next protocol state")
+	require.Equal(s.T(), nextEpoch.CommitID, flow.ZeroID, "ID for EpochCommit event should still be nil")
+	require.Equal(s.T(), expectedNextEpochActiveIdentities, nextEpoch.ActiveIdentities,
+		"should have filled active identities for next epoch")
+}
+
+// TestProcessEpochSetupWithSameParticipants tests that processing epoch setup with overlapping participants results in correctly
+// built updated protocol state. It should build a union of participants from current and next epoch for current and
+// next epoch protocol states respectively.
+func (s *ProtocolStateMachineSuite) TestProcessEpochSetupWithSameParticipants() {
+	participantsFromCurrentEpochSetup, err := flow.ComposeFullIdentities(
+		s.parentProtocolState.CurrentEpochSetup.Participants,
+		s.parentProtocolState.CurrentEpoch.ActiveIdentities,
+		flow.EpochParticipationStatusActive,
+	)
+	require.NoError(s.T(), err)
+	// Function `ComposeFullIdentities` verified that `Participants` and `ActiveIdentities` have identical ordering w.r.t nodeID.
+	// By construction, `participantsFromCurrentEpochSetup` lists the full Identities in the same ordering as `Participants` and
+	// `ActiveIdentities`. By confirming that `participantsFromCurrentEpochSetup` follows canonical ordering, we can conclude that
+	// also `Participants` and `ActiveIdentities` are canonically ordered.
+	require.True(s.T(), participantsFromCurrentEpochSetup.Sorted(flow.Canonical[flow.Identity]), "participants in current epoch's setup event are not in canonical order")
+
+	overlappingNodes, err := participantsFromCurrentEpochSetup.Sample(2)
+	require.NoError(s.T(), err)
+	setupParticipants := append(unittest.IdentityListFixture(len(s.parentProtocolState.CurrentEpochIdentityTable), unittest.WithAllRoles()),
+		overlappingNodes...).Sort(flow.Canonical[flow.Identity])
+	setup := unittest.EpochSetupFixture(
+		unittest.SetupWithCounter(s.parentProtocolState.CurrentEpochSetup.Counter+1),
+		unittest.WithFirstView(s.parentProtocolState.CurrentEpochSetup.FinalView+1),
+		unittest.WithFinalView(s.parentProtocolState.CurrentEpochSetup.FinalView+1000),
+		unittest.WithParticipants(setupParticipants.ToSkeleton()),
+	)
+	_, err = s.stateMachine.ProcessEpochSetup(setup)
+	require.NoError(s.T(), err)
+	updatedState, _, _ := s.stateMachine.Build()
+
+	require.Equal(s.T(), s.parentProtocolState.CurrentEpoch.ActiveIdentities,
+		updatedState.CurrentEpoch.ActiveIdentities,
+		"should not change active identities for current epoch")
+
+	expectedNextEpochActiveIdentities := flow.DynamicIdentityEntryListFromIdentities(setupParticipants)
+	require.Equal(s.T(), expectedNextEpochActiveIdentities, updatedState.NextEpoch.ActiveIdentities,
+		"should have filled active identities for next epoch")
+}
+
+// TestEpochSetupAfterIdentityChange tests that after processing epoch an setup event, all previously made changes to the identity table
+// are preserved and reflected in the resulting protocol state.
+func (s *ProtocolStateMachineSuite) TestEpochSetupAfterIdentityChange() {
+	participantsFromCurrentEpochSetup := s.parentProtocolState.CurrentEpochIdentityTable.Filter(func(i *flow.Identity) bool {
+		_, exists := s.parentProtocolState.CurrentEpochSetup.Participants.ByNodeID(i.NodeID)
+		return exists
+	}).Sort(flow.Canonical[flow.Identity])
+	ejectedChanges, err := participantsFromCurrentEpochSetup.Sample(2)
+	require.NoError(s.T(), err)
+	for _, update := range ejectedChanges {
+		err := s.stateMachine.EjectIdentity(update.NodeID)
+		require.NoError(s.T(), err)
+	}
+	updatedState, _, _ := s.stateMachine.Build()
+
+	// Construct a valid flow.RichProtocolStateEntry for next block
+	// We do this by copying the parent protocol state and updating the identities manually
+	updatedRichProtocolState := &flow.RichProtocolStateEntry{
+		ProtocolStateEntry:        updatedState,
+		PreviousEpochSetup:        s.parentProtocolState.PreviousEpochSetup,
+		PreviousEpochCommit:       s.parentProtocolState.PreviousEpochCommit,
+		CurrentEpochSetup:         s.parentProtocolState.CurrentEpochSetup,
+		CurrentEpochCommit:        s.parentProtocolState.CurrentEpochCommit,
+		NextEpochSetup:            nil,
+		NextEpochCommit:           nil,
+		CurrentEpochIdentityTable: s.parentProtocolState.CurrentEpochIdentityTable.Copy(),
+		NextEpochIdentityTable:    flow.IdentityList{},
+	}
+	// Update enriched data with the changes made to the low-level updated table
+	for _, identity := range ejectedChanges {
+		toBeUpdated, _ := updatedRichProtocolState.CurrentEpochIdentityTable.ByNodeID(identity.NodeID)
+		toBeUpdated.EpochParticipationStatus = flow.EpochParticipationStatusEjected
+	}
+
+	// now we can use it to construct protocolStateMachine for next block, which will process epoch setup event.
+	nextBlock := unittest.BlockHeaderWithParentFixture(s.candidate)
+	s.stateMachine, err = newStateMachine(nextBlock.View, updatedRichProtocolState)
+	require.NoError(s.T(), err)
+
+	setup := unittest.EpochSetupFixture(
+		unittest.SetupWithCounter(s.parentProtocolState.CurrentEpochSetup.Counter+1),
+		unittest.WithFirstView(s.parentProtocolState.CurrentEpochSetup.FinalView+1),
+		unittest.WithFinalView(s.parentProtocolState.CurrentEpochSetup.FinalView+1000),
+		func(setup *flow.EpochSetup) {
+			// add those nodes that were changed in the previous epoch, but not those that were ejected
+			// it's important to exclude ejected nodes, since we expect that service smart contract has emitted ejection operation
+			// and service events are delivered (asynchronously) in an *order-preserving* manner meaning if ejection has happened before
+			// epoch setup then there is no possible way that it will include ejected node unless there is a severe bug in the service contract.
+			setup.Participants = setup.Participants.Filter(
+				filter.Not(filter.In(ejectedChanges.ToSkeleton()))).Sort(flow.Canonical[flow.IdentitySkeleton])
+		},
+	)
+
+	_, err = s.stateMachine.ProcessEpochSetup(setup)
+	require.NoError(s.T(), err)
+
+	updatedState, _, _ = s.stateMachine.Build()
+
+	// assert that all changes made in previous epoch are preserved
+	currentEpochLookup := updatedState.CurrentEpoch.ActiveIdentities.Lookup()
+	nextEpochLookup := updatedState.NextEpoch.ActiveIdentities.Lookup()
+
+	for _, updated := range ejectedChanges {
+		currentEpochIdentity := currentEpochLookup[updated.NodeID]
+		require.Equal(s.T(), updated.NodeID, currentEpochIdentity.NodeID)
+		require.True(s.T(), currentEpochIdentity.Ejected)
+
+		_, foundInNextEpoch := nextEpochLookup[updated.NodeID]
+		require.False(s.T(), foundInNextEpoch)
+	}
+}
diff --git a/state/protocol/snapshot.go b/state/protocol/snapshot.go
index ca781b6e6cb..579aa103917 100644
--- a/state/protocol/snapshot.go
+++ b/state/protocol/snapshot.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package protocol
 
 import (
@@ -50,12 +48,12 @@ type Snapshot interface {
 	// epoch. At the end of an epoch, this includes identities scheduled to join
 	// in the next epoch but are not active yet.
 	//
-	// Identities are guaranteed to be returned in canonical order (flow.Canonical).
+	// Identities are guaranteed to be returned in canonical order (flow.Canonical[flow.Identity]).
 	//
 	// It allows us to provide optional upfront filters which can be used by the
 	// implementation to speed up database lookups.
 	// TODO document error returns
-	Identities(selector flow.IdentityFilter) (flow.IdentityList, error)
+	Identities(selector flow.IdentityFilter[flow.Identity]) (flow.IdentityList, error)
 
 	// Identity attempts to retrieve the node with the given identifier at the
 	// selected point of the protocol state history. It will error if it doesn't exist.
@@ -137,6 +135,12 @@ type Snapshot interface {
 	// Returns invalid.Params with state.ErrUnknownSnapshotReference if snapshot reference block is unknown.
 	Params() GlobalParams
 
+	// ProtocolState returns the dynamic protocol state that the Head block commits to. The
+	// compliance layer guarantees that only valid blocks are appended to the protocol state.
+	// Returns state.ErrUnknownSnapshotReference if snapshot reference block is unknown.
+	// All other errors should be treated as exceptions.
+	ProtocolState() (DynamicProtocolState, error)
+
 	// VersionBeacon returns the latest sealed version beacon.
 	// If no version beacon has been sealed so far during the current spork, returns nil.
 	// The latest VersionBeacon is only updated for finalized blocks. This means that, when
diff --git a/state/protocol/snapshots/dynamic_bootstrap.go b/state/protocol/snapshots/dynamic_bootstrap.go
new file mode 100644
index 00000000000..6647fa101bf
--- /dev/null
+++ b/state/protocol/snapshots/dynamic_bootstrap.go
@@ -0,0 +1,122 @@
+package snapshots
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/state/protocol"
+)
+
+var ErrSnapshotPhaseMismatch = errors.New("snapshot does not contain a valid sealing segment")
+var ErrSnapshotHistoryLimit = errors.New("reached the snapshot history limit")
+
+// GetDynamicBootstrapSnapshot returns `refSnapshot` if it is valid for use in dynamic bootstrapping.
+// Otherwise returns an error. (Effectively this validates that the input snapshot can be used in dynamic bootstrapping.)
+// Expected error returns during normal operations:
+// * ErrSnapshotPhaseMismatch - snapshot does not contain a valid sealing segment
+// All other errors should be treated as exceptions.
+func GetDynamicBootstrapSnapshot(state protocol.State, refSnapshot protocol.Snapshot) (protocol.Snapshot, error) {
+	return getValidSnapshot(state, refSnapshot, 0, false, 0)
+}
+
+// GetClosestDynamicBootstrapSnapshot will return a valid snapshot for dynamic bootstrapping
+// Expected error returns during normal operations:
+// If a snapshot does contain an invalid sealing segment query the state
+// by height of each block in the segment and return a snapshot at the point
+// where the transition happens.
+// * ErrSnapshotPhaseMismatch - snapshot does not contain a valid sealing segment
+// * ErrSnapshotHistoryLimit - reached the snapshot history limit
+// All other errors should be treated as exceptions.
+func GetClosestDynamicBootstrapSnapshot(state protocol.State, refSnapshot protocol.Snapshot, snapshotHistoryLimit int) (protocol.Snapshot, error) {
+	return getValidSnapshot(state, refSnapshot, 0, true, snapshotHistoryLimit)
+}
+
+// GetCounterAndPhase returns the current epoch counter and phase, at `height`.
+// No errors are expected during normal operation.
+func GetCounterAndPhase(state protocol.State, height uint64) (uint64, flow.EpochPhase, error) {
+	snapshot := state.AtHeight(height)
+
+	counter, err := snapshot.Epochs().Current().Counter()
+	if err != nil {
+		return 0, 0, fmt.Errorf("failed to get counter for block (height=%d): %w", height, err)
+	}
+
+	phase, err := snapshot.Phase()
+	if err != nil {
+		return 0, 0, fmt.Errorf("failed to get phase for block (height=%d): %w", height, err)
+	}
+
+	return counter, phase, nil
+}
+
+func IsEpochOrPhaseDifferent(counter1, counter2 uint64, phase1, phase2 flow.EpochPhase) bool {
+	return counter1 != counter2 || phase1 != phase2
+}
+
+// getValidSnapshot will return a valid snapshot that has a sealing segment which
+// 1. does not contain any blocks that span an epoch transition
+// 2. does not contain any blocks that span an epoch phase transition
+// If a snapshot does contain an invalid sealing segment query the state
+// by height of each block in the segment and return a snapshot at the point
+// where the transition happens.
+// Expected error returns during normal operations:
+// * ErrSnapshotPhaseMismatch - snapshot does not contain a valid sealing segment
+// * ErrSnapshotHistoryLimit - failed to find a valid snapshot after checking `snapshotHistoryLimit` blocks
+// All other errors should be treated as exceptions.
+func getValidSnapshot(
+	state protocol.State,
+	snapshot protocol.Snapshot,
+	blocksVisited int,
+	findNextValidSnapshot bool,
+	snapshotHistoryLimit int,
+) (protocol.Snapshot, error) {
+	segment, err := snapshot.SealingSegment()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get sealing segment: %w", err)
+	}
+
+	counterAtHighest, phaseAtHighest, err := GetCounterAndPhase(state, segment.Highest().Header.Height)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get counter and phase at highest block in the segment: %w", err)
+	}
+
+	counterAtLowest, phaseAtLowest, err := GetCounterAndPhase(state, segment.Sealed().Header.Height)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get counter and phase at lowest block in the segment: %w", err)
+	}
+
+	// Check if the counters and phase are different this indicates that the sealing segment
+	// of the snapshot requested spans either an epoch transition or phase transition.
+	if IsEpochOrPhaseDifferent(counterAtHighest, counterAtLowest, phaseAtHighest, phaseAtLowest) {
+		if !findNextValidSnapshot {
+			return nil, ErrSnapshotPhaseMismatch
+		}
+
+		// Visit each node in strict order of decreasing height starting at head
+		// to find the block that straddles the transition boundary.
+		for i := len(segment.Blocks) - 1; i >= 0; i-- {
+			blocksVisited++
+
+			// NOTE: Check if we have reached our history limit, in edge cases
+			// where the sealing segment is abnormally long we want to short circuit
+			// the recursive calls and return an error. The API caller can retry.
+			if blocksVisited > snapshotHistoryLimit {
+				return nil, fmt.Errorf("%w: (%d)", ErrSnapshotHistoryLimit, snapshotHistoryLimit)
+			}
+
+			counterAtBlock, phaseAtBlock, err := GetCounterAndPhase(state, segment.Blocks[i].Header.Height)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get epoch counter and phase for snapshot at block %s: %w", segment.Blocks[i].ID(), err)
+			}
+
+			// Check if this block straddles the transition boundary, if it does return the snapshot
+			// at that block height.
+			if IsEpochOrPhaseDifferent(counterAtHighest, counterAtBlock, phaseAtHighest, phaseAtBlock) {
+				return getValidSnapshot(state, state.AtHeight(segment.Blocks[i].Header.Height), blocksVisited, true, snapshotHistoryLimit)
+			}
+		}
+	}
+
+	return snapshot, nil
+}
diff --git a/state/protocol/util.go b/state/protocol/util.go
index 6457bf93b6d..a81e8fbd250 100644
--- a/state/protocol/util.go
+++ b/state/protocol/util.go
@@ -17,8 +17,8 @@ func IsNodeAuthorizedAt(snapshot Snapshot, id flow.Identifier) (bool, error) {
 	return CheckNodeStatusAt(
 		snapshot,
 		id,
-		filter.HasWeight(true),
-		filter.Not(filter.Ejected),
+		filter.HasInitialWeight[flow.Identity](true),
+		filter.IsValidCurrentEpochParticipant,
 	)
 }
 
@@ -32,9 +32,9 @@ func IsNodeAuthorizedWithRoleAt(snapshot Snapshot, id flow.Identifier, role flow
 	return CheckNodeStatusAt(
 		snapshot,
 		id,
-		filter.HasWeight(true),
-		filter.Not(filter.Ejected),
-		filter.HasRole(role),
+		filter.HasInitialWeight[flow.Identity](true),
+		filter.IsValidCurrentEpochParticipant,
+		filter.HasRole[flow.Identity](role),
 	)
 }
 
@@ -44,7 +44,7 @@ func IsNodeAuthorizedWithRoleAt(snapshot Snapshot, id flow.Identifier, role flow
 //   - state.ErrUnknownSnapshotReference if snapshot references an unknown block
 //
 // All other errors are unexpected and potential symptoms of internal state corruption.
-func CheckNodeStatusAt(snapshot Snapshot, id flow.Identifier, checks ...flow.IdentityFilter) (bool, error) {
+func CheckNodeStatusAt(snapshot Snapshot, id flow.Identifier, checks ...flow.IdentityFilter[flow.Identity]) (bool, error) {
 	identity, err := snapshot.Identity(id)
 	if IsIdentityNotFound(err) {
 		return false, nil
@@ -65,10 +65,7 @@ func CheckNodeStatusAt(snapshot Snapshot, id flow.Identifier, checks ...flow.Ide
 // IsSporkRootSnapshot returns whether the given snapshot is the state snapshot
 // representing the initial state for a spork.
 func IsSporkRootSnapshot(snapshot Snapshot) (bool, error) {
-	sporkRootBlockHeight, err := snapshot.Params().SporkRootBlockHeight()
-	if err != nil {
-		return false, fmt.Errorf("could not get snapshot root block height: %w", err)
-	}
+	sporkRootBlockHeight := snapshot.Params().SporkRootBlockHeight()
 	head, err := snapshot.Head()
 	if err != nil {
 		return false, fmt.Errorf("could not get snapshot head: %w", err)
@@ -126,14 +123,14 @@ func FindGuarantors(state State, guarantee *flow.CollectionGuarantee) ([]flow.Id
 //   - ErrMultipleSealsForSameHeight in case there are seals repeatedly sealing block at the same height
 //   - ErrDiscontinuousSeals in case there are height-gaps in the sealed blocks
 //   - storage.ErrNotFound if any of the seals references an unknown block
-func OrderedSeals(payload *flow.Payload, headers storage.Headers) ([]*flow.Seal, error) {
-	numSeals := uint64(len(payload.Seals))
+func OrderedSeals(blockSeals []*flow.Seal, headers storage.Headers) ([]*flow.Seal, error) {
+	numSeals := uint64(len(blockSeals))
 	if numSeals == 0 {
 		return nil, nil
 	}
 	heights := make([]uint64, numSeals)
 	minHeight := uint64(math.MaxUint64)
-	for i, seal := range payload.Seals {
+	for i, seal := range blockSeals {
 		header, err := headers.ByBlockID(seal.BlockID)
 		if err != nil {
 			return nil, fmt.Errorf("could not get block (id=%x) for seal: %w", seal.BlockID, err) // storage.ErrNotFound or exception
@@ -146,7 +143,7 @@ func OrderedSeals(payload *flow.Payload, headers storage.Headers) ([]*flow.Seal,
 	// As seals in a valid payload must have consecutive heights, we can populate
 	// the ordered output by shifting by minHeight.
 	seals := make([]*flow.Seal, numSeals)
-	for i, seal := range payload.Seals {
+	for i, seal := range blockSeals {
 		idx := heights[i] - minHeight
 		// (0) Per construction, `minHeight` is the smallest value in the `heights` slice. Hence, `idx ≥ 0`
 		// (1) But if there are gaps in the heights of the sealed blocks (byzantine inputs),
diff --git a/state/protocol/util/testing.go b/state/protocol/util/testing.go
index 24eb8016f6f..91fad8f2f6e 100644
--- a/state/protocol/util/testing.go
+++ b/state/protocol/util/testing.go
@@ -17,6 +17,7 @@ import (
 	pbadger "github.com/onflow/flow-go/state/protocol/badger"
 	"github.com/onflow/flow-go/state/protocol/events"
 	mockprotocol "github.com/onflow/flow-go/state/protocol/mock"
+	"github.com/onflow/flow-go/state/protocol/protocol_state"
 	"github.com/onflow/flow-go/storage"
 	"github.com/onflow/flow-go/storage/util"
 	"github.com/onflow/flow-go/utils/unittest"
@@ -77,7 +78,7 @@ func RunWithBootstrapState(t testing.TB, rootSnapshot protocol.Snapshot, f func(
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
@@ -103,7 +104,7 @@ func RunWithFullProtocolState(t testing.TB, rootSnapshot protocol.Snapshot, f fu
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
@@ -111,7 +112,17 @@ func RunWithFullProtocolState(t testing.TB, rootSnapshot protocol.Snapshot, f fu
 		receiptValidator := MockReceiptValidator()
 		sealValidator := MockSealValidator(all.Seals)
 		mockTimer := MockBlockTimer()
-		fullState, err := pbadger.NewFullConsensusState(log, tracer, consumer, state, all.Index, all.Payloads, mockTimer, receiptValidator, sealValidator)
+		fullState, err := pbadger.NewFullConsensusState(
+			log,
+			tracer,
+			consumer,
+			state,
+			all.Index,
+			all.Payloads,
+			mockTimer,
+			receiptValidator,
+			sealValidator,
+		)
 		require.NoError(t, err)
 		f(db, fullState)
 	})
@@ -133,7 +144,7 @@ func RunWithFullProtocolStateAndMetrics(t testing.TB, rootSnapshot protocol.Snap
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
@@ -141,7 +152,17 @@ func RunWithFullProtocolStateAndMetrics(t testing.TB, rootSnapshot protocol.Snap
 		receiptValidator := MockReceiptValidator()
 		sealValidator := MockSealValidator(all.Seals)
 		mockTimer := MockBlockTimer()
-		fullState, err := pbadger.NewFullConsensusState(log, tracer, consumer, state, all.Index, all.Payloads, mockTimer, receiptValidator, sealValidator)
+		fullState, err := pbadger.NewFullConsensusState(
+			log,
+			tracer,
+			consumer,
+			state,
+			all.Index,
+			all.Payloads,
+			mockTimer,
+			receiptValidator,
+			sealValidator,
+		)
 		require.NoError(t, err)
 		f(db, fullState)
 	})
@@ -164,14 +185,24 @@ func RunWithFullProtocolStateAndValidator(t testing.TB, rootSnapshot protocol.Sn
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
 		require.NoError(t, err)
 		sealValidator := MockSealValidator(all.Seals)
 		mockTimer := MockBlockTimer()
-		fullState, err := pbadger.NewFullConsensusState(log, tracer, consumer, state, all.Index, all.Payloads, mockTimer, validator, sealValidator)
+		fullState, err := pbadger.NewFullConsensusState(
+			log,
+			tracer,
+			consumer,
+			state,
+			all.Index,
+			all.Payloads,
+			mockTimer,
+			validator,
+			sealValidator,
+		)
 		require.NoError(t, err)
 		f(db, fullState)
 	})
@@ -194,13 +225,21 @@ func RunWithFollowerProtocolState(t testing.TB, rootSnapshot protocol.Snapshot,
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
 		require.NoError(t, err)
 		mockTimer := MockBlockTimer()
-		followerState, err := pbadger.NewFollowerState(log, tracer, consumer, state, all.Index, all.Payloads, mockTimer)
+		followerState, err := pbadger.NewFollowerState(
+			log,
+			tracer,
+			consumer,
+			state,
+			all.Index,
+			all.Payloads,
+			mockTimer,
+		)
 		require.NoError(t, err)
 		f(db, followerState)
 	})
@@ -222,7 +261,7 @@ func RunWithFullProtocolStateAndConsumer(t testing.TB, rootSnapshot protocol.Sna
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
@@ -230,13 +269,23 @@ func RunWithFullProtocolStateAndConsumer(t testing.TB, rootSnapshot protocol.Sna
 		receiptValidator := MockReceiptValidator()
 		sealValidator := MockSealValidator(all.Seals)
 		mockTimer := MockBlockTimer()
-		fullState, err := pbadger.NewFullConsensusState(log, tracer, consumer, state, all.Index, all.Payloads, mockTimer, receiptValidator, sealValidator)
+		fullState, err := pbadger.NewFullConsensusState(
+			log,
+			tracer,
+			consumer,
+			state,
+			all.Index,
+			all.Payloads,
+			mockTimer,
+			receiptValidator,
+			sealValidator,
+		)
 		require.NoError(t, err)
 		f(db, fullState)
 	})
 }
 
-func RunWithFullProtocolStateAndMetricsAndConsumer(t testing.TB, rootSnapshot protocol.Snapshot, metrics module.ComplianceMetrics, consumer protocol.Consumer, f func(*badger.DB, *pbadger.ParticipantState)) {
+func RunWithFullProtocolStateAndMetricsAndConsumer(t testing.TB, rootSnapshot protocol.Snapshot, metrics module.ComplianceMetrics, consumer protocol.Consumer, f func(*badger.DB, *pbadger.ParticipantState, protocol.MutableProtocolState)) {
 	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
 		tracer := trace.NewNoopTracer()
 		log := zerolog.Nop()
@@ -251,7 +300,7 @@ func RunWithFullProtocolStateAndMetricsAndConsumer(t testing.TB, rootSnapshot pr
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
@@ -259,9 +308,27 @@ func RunWithFullProtocolStateAndMetricsAndConsumer(t testing.TB, rootSnapshot pr
 		receiptValidator := MockReceiptValidator()
 		sealValidator := MockSealValidator(all.Seals)
 		mockTimer := MockBlockTimer()
-		fullState, err := pbadger.NewFullConsensusState(log, tracer, consumer, state, all.Index, all.Payloads, mockTimer, receiptValidator, sealValidator)
+		fullState, err := pbadger.NewFullConsensusState(
+			log,
+			tracer,
+			consumer,
+			state,
+			all.Index,
+			all.Payloads,
+			mockTimer,
+			receiptValidator,
+			sealValidator,
+		)
 		require.NoError(t, err)
-		f(db, fullState)
+		mutableProtocolState := protocol_state.NewMutableProtocolState(
+			all.ProtocolState,
+			state.Params(),
+			all.Headers,
+			all.Results,
+			all.Setups,
+			all.EpochCommits,
+		)
+		f(db, fullState, mutableProtocolState)
 	})
 }
 
@@ -282,14 +349,71 @@ func RunWithFollowerProtocolStateAndHeaders(t testing.TB, rootSnapshot protocol.
 			all.QuorumCertificates,
 			all.Setups,
 			all.EpochCommits,
-			all.Statuses,
+			all.ProtocolState,
 			all.VersionBeacons,
 			rootSnapshot,
 		)
 		require.NoError(t, err)
 		mockTimer := MockBlockTimer()
-		followerState, err := pbadger.NewFollowerState(log, tracer, consumer, state, all.Index, all.Payloads, mockTimer)
+		followerState, err := pbadger.NewFollowerState(
+			log,
+			tracer,
+			consumer,
+			state,
+			all.Index,
+			all.Payloads,
+			mockTimer,
+		)
 		require.NoError(t, err)
 		f(db, followerState, all.Headers, all.Index)
 	})
 }
+
+func RunWithFullProtocolStateAndMutator(t testing.TB, rootSnapshot protocol.Snapshot, f func(*badger.DB, *pbadger.ParticipantState, protocol.MutableProtocolState)) {
+	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
+		metrics := metrics.NewNoopCollector()
+		tracer := trace.NewNoopTracer()
+		log := zerolog.Nop()
+		consumer := events.NewNoop()
+		all := util.StorageLayer(t, db)
+		state, err := pbadger.Bootstrap(
+			metrics,
+			db,
+			all.Headers,
+			all.Seals,
+			all.Results,
+			all.Blocks,
+			all.QuorumCertificates,
+			all.Setups,
+			all.EpochCommits,
+			all.ProtocolState,
+			all.VersionBeacons,
+			rootSnapshot,
+		)
+		require.NoError(t, err)
+		receiptValidator := MockReceiptValidator()
+		sealValidator := MockSealValidator(all.Seals)
+		mockTimer := MockBlockTimer()
+		fullState, err := pbadger.NewFullConsensusState(
+			log,
+			tracer,
+			consumer,
+			state,
+			all.Index,
+			all.Payloads,
+			mockTimer,
+			receiptValidator,
+			sealValidator,
+		)
+		require.NoError(t, err)
+		mutableProtocolState := protocol_state.NewMutableProtocolState(
+			all.ProtocolState,
+			state.Params(),
+			all.Headers,
+			all.Results,
+			all.Setups,
+			all.EpochCommits,
+		)
+		f(db, fullState, mutableProtocolState)
+	})
+}
diff --git a/state/protocol/util_test.go b/state/protocol/util_test.go
index 7858f5767b7..81e9489815c 100644
--- a/state/protocol/util_test.go
+++ b/state/protocol/util_test.go
@@ -39,7 +39,7 @@ func TestOrderedSeals(t *testing.T) {
 		payload := flow.EmptyPayload()
 		headers := storagemock.NewHeaders(t)
 
-		ordered, err := protocol.OrderedSeals(&payload, headers)
+		ordered, err := protocol.OrderedSeals(payload.Seals, headers)
 		require.NoError(t, err)
 		require.Empty(t, ordered)
 	})
@@ -49,7 +49,7 @@ func TestOrderedSeals(t *testing.T) {
 		payload := unittest.PayloadFixture(unittest.WithSeals(seals...))
 		headers.On("ByBlockID", mock.Anything).Return(nil, storage.ErrNotFound)
 
-		ordered, err := protocol.OrderedSeals(&payload, headers)
+		ordered, err := protocol.OrderedSeals(payload.Seals, headers)
 		require.ErrorIs(t, err, storage.ErrNotFound)
 		require.Empty(t, ordered)
 	})
@@ -60,7 +60,7 @@ func TestOrderedSeals(t *testing.T) {
 		exception := errors.New("exception")
 		headers.On("ByBlockID", mock.Anything).Return(nil, exception)
 
-		ordered, err := protocol.OrderedSeals(&payload, headers)
+		ordered, err := protocol.OrderedSeals(payload.Seals, headers)
 		require.ErrorIs(t, err, exception)
 		require.Empty(t, ordered)
 	})
@@ -75,7 +75,7 @@ func TestOrderedSeals(t *testing.T) {
 		}
 		payload := unittest.PayloadFixture(unittest.WithSeals(seals...))
 
-		ordered, err := protocol.OrderedSeals(&payload, headers)
+		ordered, err := protocol.OrderedSeals(payload.Seals, headers)
 		require.NoError(t, err)
 		require.Equal(t, seals, ordered)
 	})
@@ -96,7 +96,7 @@ func TestOrderedSeals(t *testing.T) {
 		})
 		payload := unittest.PayloadFixture(unittest.WithSeals(unorderedSeals...))
 
-		ordered, err := protocol.OrderedSeals(&payload, headers)
+		ordered, err := protocol.OrderedSeals(payload.Seals, headers)
 		require.NoError(t, err)
 		require.Equal(t, orderedSeals, ordered)
 	})
diff --git a/state/protocol/validity.go b/state/protocol/validity.go
new file mode 100644
index 00000000000..52e6254a51c
--- /dev/null
+++ b/state/protocol/validity.go
@@ -0,0 +1,172 @@
+package protocol
+
+import (
+	"fmt"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/model/flow/factory"
+	"github.com/onflow/flow-go/model/flow/filter"
+)
+
+// IsValidExtendingEpochSetup checks whether an EpochSetup service event being added to the state is valid.
+// In addition to intrinsic validity, we also check that it is valid w.r.t. the previous epoch setup event,
+// and the current epoch status.
+// CAUTION: This function assumes that all inputs besides extendingCommit are already validated.
+// Expected errors during normal operations:
+// * protocol.InvalidServiceEventError if the input service event is invalid to extend the currently active epoch status
+func IsValidExtendingEpochSetup(extendingSetup *flow.EpochSetup, protocolStateEntry *flow.ProtocolStateEntry, currentEpochSetupEvent *flow.EpochSetup) error {
+	// Enforce EpochSetup is valid w.r.t to current epoch state
+	if protocolStateEntry.NextEpoch != nil { // We should only have a single epoch setup event per epoch.
+		// true iff EpochSetup event for NEXT epoch was already included before
+		return NewInvalidServiceEventErrorf("duplicate epoch setup service event: %x", protocolStateEntry.NextEpoch.SetupID)
+	}
+	if extendingSetup.Counter != currentEpochSetupEvent.Counter+1 { // The setup event should have the counter increased by one.
+		return NewInvalidServiceEventErrorf("next epoch setup has invalid counter (%d => %d)", currentEpochSetupEvent.Counter, extendingSetup.Counter)
+	}
+	if extendingSetup.FirstView != currentEpochSetupEvent.FinalView+1 { // The first view needs to be exactly one greater than the current epoch final view
+		return NewInvalidServiceEventErrorf(
+			"next epoch first view must be exactly 1 more than current epoch final view (%d != %d+1)",
+			extendingSetup.FirstView,
+			currentEpochSetupEvent.FinalView,
+		)
+	}
+
+	// Enforce the EpochSetup event is syntactically correct
+	err := IsValidEpochSetup(extendingSetup, true)
+	if err != nil {
+		return NewInvalidServiceEventErrorf("invalid epoch setup: %w", err)
+	}
+	return nil
+}
+
+// IsValidEpochSetup checks whether an `EpochSetup` event is syntactically correct. The boolean parameter `verifyNetworkAddress`
+// controls, whether we want to permit nodes to share a networking address.
+// This is a side-effect-free function. Any error return indicates that the EpochSetup event is not compliant with protocol rules.
+func IsValidEpochSetup(setup *flow.EpochSetup, verifyNetworkAddress bool) error {
+	// 1. CHECK: Enforce protocol compliance of Epoch parameters:
+	// - RandomSource of entropy in Epoch Setup event should the protocol-prescribed length
+	// - first view must be before final view
+	if len(setup.RandomSource) != flow.EpochSetupRandomSourceLength {
+		return fmt.Errorf("seed has incorrect length (%d != %d)", len(setup.RandomSource), flow.EpochSetupRandomSourceLength)
+	}
+	if setup.FirstView >= setup.FinalView {
+		return fmt.Errorf("first view (%d) must be before final view (%d)", setup.FirstView, setup.FinalView)
+	}
+
+	// 2. CHECK: Enforce protocol compliance active participants:
+	// (a) each has a unique node ID,
+	// (b) each has a unique network address (if `verifyNetworkAddress` is true),
+	// (c) participants are sorted in canonical order.
+	//     Note that the system smart contracts manage the identity table as an unordered set! For the protocol state, we desire a fixed
+	//     ordering to simplify various implementation details, like the DKG. Therefore, we order identities in `flow.EpochSetup` during
+	//     conversion from cadence to Go in the function `convert.ServiceEvent(flow.ChainID, flow.Event)` in package `model/convert`
+	identLookup := make(map[flow.Identifier]struct{})
+	for _, participant := range setup.Participants { // (a) enforce uniqueness of NodeIDs
+		_, ok := identLookup[participant.NodeID]
+		if ok {
+			return fmt.Errorf("duplicate node identifier (%x)", participant.NodeID)
+		}
+		identLookup[participant.NodeID] = struct{}{}
+	}
+
+	if verifyNetworkAddress { // (b) enforce uniqueness of networking address
+		addrLookup := make(map[string]struct{})
+		for _, participant := range setup.Participants {
+			_, ok := addrLookup[participant.Address]
+			if ok {
+				return fmt.Errorf("duplicate node address (%x)", participant.Address)
+			}
+			addrLookup[participant.Address] = struct{}{}
+		}
+	}
+
+	if !setup.Participants.Sorted(flow.Canonical[flow.IdentitySkeleton]) { // (c) enforce canonical ordering
+		return fmt.Errorf("participants are not canonically ordered")
+	}
+
+	// 3. CHECK: Enforce sufficient number of nodes for each role
+	// IMPORTANT: here we remove all nodes with zero weight, as they are allowed to partake in communication but not in respective node functions
+	activeParticipants := setup.Participants.Filter(filter.HasInitialWeight[flow.IdentitySkeleton](true))
+	activeNodeCountByRole := make(map[flow.Role]uint)
+	for _, participant := range activeParticipants {
+		activeNodeCountByRole[participant.Role]++
+	}
+	if activeNodeCountByRole[flow.RoleConsensus] < 1 {
+		return fmt.Errorf("need at least one consensus node")
+	}
+	if activeNodeCountByRole[flow.RoleCollection] < 1 {
+		return fmt.Errorf("need at least one collection node")
+	}
+	if activeNodeCountByRole[flow.RoleExecution] < 1 {
+		return fmt.Errorf("need at least one execution node")
+	}
+	if activeNodeCountByRole[flow.RoleVerification] < 1 {
+		return fmt.Errorf("need at least one verification node")
+	}
+
+	// 4. CHECK: Enforce protocol compliance of collector cluster assignment
+	//   (0) there is at least one collector cluster
+	//   (a) assignment only contains nodes with collector role and positive weight
+	//   (b) collectors have unique node IDs
+	//   (c) each collector is assigned exactly to one cluster and is only listed once within that cluster
+	//   (d) cluster contains at least one collector (i.e. is not empty)
+	//   (e) cluster is composed of known nodes
+	//   (f) cluster assignment lists the nodes in canonical ordering
+	if len(setup.Assignments) == 0 { // enforce (0): at least one cluster
+		return fmt.Errorf("need at least one collection cluster")
+	}
+	// Unpacking the cluster assignments (NodeIDs → IdentitySkeletons) enforces (a) - (f)
+	_, err := factory.NewClusterList(setup.Assignments, activeParticipants.Filter(filter.HasRole[flow.IdentitySkeleton](flow.RoleCollection)))
+	if err != nil {
+		return fmt.Errorf("invalid cluster assignments: %w", err)
+	}
+	return nil
+}
+
+// IsValidExtendingEpochCommit checks whether an EpochCommit service event being added to the state is valid.
+// In addition to intrinsic validity, we also check that it is valid w.r.t. the previous epoch setup event, and
+// the current epoch status.
+// CAUTION: This function assumes that all inputs besides extendingCommit are already validated.
+// Expected errors during normal operations:
+// * protocol.InvalidServiceEventError if the input service event is invalid to extend the currently active epoch
+func IsValidExtendingEpochCommit(extendingCommit *flow.EpochCommit, protocolStateEntry *flow.ProtocolStateEntry, nextEpochSetupEvent *flow.EpochSetup) error {
+	// The epoch setup event needs to happen before the commit.
+	if protocolStateEntry.NextEpoch == nil {
+		return NewInvalidServiceEventErrorf("missing epoch setup for epoch commit")
+	}
+	// Enforce EpochSetup is valid w.r.t to current epoch state
+	if protocolStateEntry.NextEpoch.CommitID != flow.ZeroID { // We should only have a single epoch commit event per epoch.
+		return NewInvalidServiceEventErrorf("duplicate epoch commit service event: %x", protocolStateEntry.NextEpoch.CommitID)
+	}
+	// Enforce the EpochSetup event is syntactically correct and compatible with the respective EpochSetup
+	err := IsValidEpochCommit(extendingCommit, nextEpochSetupEvent)
+	if err != nil {
+		return NewInvalidServiceEventErrorf("invalid epoch commit: %s", err)
+	}
+	return nil
+}
+
+// IsValidEpochCommit checks whether an epoch commit service event is intrinsically valid.
+// Assumes the input flow.EpochSetup event has already been validated.
+// Expected errors during normal operations:
+// * protocol.InvalidServiceEventError if the EpochCommit is invalid
+func IsValidEpochCommit(commit *flow.EpochCommit, setup *flow.EpochSetup) error {
+	if len(setup.Assignments) != len(commit.ClusterQCs) {
+		return NewInvalidServiceEventErrorf("number of clusters (%d) does not number of QCs (%d)", len(setup.Assignments), len(commit.ClusterQCs))
+	}
+
+	if commit.Counter != setup.Counter {
+		return NewInvalidServiceEventErrorf("inconsistent epoch counter between commit (%d) and setup (%d) events in same epoch", commit.Counter, setup.Counter)
+	}
+
+	// make sure we have a valid DKG public key
+	if commit.DKGGroupKey == nil {
+		return NewInvalidServiceEventErrorf("missing DKG public group key")
+	}
+
+	participants := setup.Participants.Filter(filter.IsValidDKGParticipant)
+	if len(participants) != len(commit.DKGParticipantKeys) {
+		return NewInvalidServiceEventErrorf("participant list (len=%d) does not match dkg key list (len=%d)", len(participants), len(commit.DKGParticipantKeys))
+	}
+	return nil
+}
diff --git a/state/protocol/validity_test.go b/state/protocol/validity_test.go
new file mode 100644
index 00000000000..4254ae59e89
--- /dev/null
+++ b/state/protocol/validity_test.go
@@ -0,0 +1,238 @@
+package protocol_test
+
+import (
+	"testing"
+
+	"github.com/onflow/crypto"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/model/flow/filter"
+	"github.com/onflow/flow-go/state/protocol"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+var participants = unittest.IdentityListFixture(20, unittest.WithAllRoles())
+
+func TestEpochSetupValidity(t *testing.T) {
+	t.Run("invalid first/final view", func(t *testing.T) {
+		_, result, _ := unittest.BootstrapFixture(participants)
+		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
+		// set an invalid final view for the first epoch
+		setup.FinalView = setup.FirstView
+
+		err := protocol.IsValidEpochSetup(setup, true)
+		require.Error(t, err)
+	})
+
+	t.Run("non-canonically ordered identities", func(t *testing.T) {
+		_, result, _ := unittest.BootstrapFixture(participants)
+		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
+		// randomly shuffle the identities so they are not canonically ordered
+		var err error
+		setup.Participants, err = setup.Participants.Shuffle()
+		require.NoError(t, err)
+		err = protocol.IsValidEpochSetup(setup, true)
+		require.Error(t, err)
+	})
+
+	t.Run("invalid cluster assignments", func(t *testing.T) {
+		_, result, _ := unittest.BootstrapFixture(participants)
+		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
+		// create an invalid cluster assignment (node appears in multiple clusters)
+		collector := participants.Filter(filter.HasRole[flow.Identity](flow.RoleCollection))[0]
+		setup.Assignments = append(setup.Assignments, []flow.Identifier{collector.NodeID})
+
+		err := protocol.IsValidEpochSetup(setup, true)
+		require.Error(t, err)
+	})
+
+	t.Run("short seed", func(t *testing.T) {
+		_, result, _ := unittest.BootstrapFixture(participants)
+		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
+		setup.RandomSource = unittest.SeedFixture(crypto.KeyGenSeedMinLen - 1)
+
+		err := protocol.IsValidEpochSetup(setup, true)
+		require.Error(t, err)
+	})
+
+	t.Run("node role missing", func(t *testing.T) {
+		_, result, _ := unittest.BootstrapFixture(participants)
+		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
+		allWithoutExecutionNodes := setup.Participants.Filter(func(identitySkeleton *flow.IdentitySkeleton) bool {
+			return identitySkeleton.Role != flow.RoleExecution
+		})
+		setup.Participants = allWithoutExecutionNodes
+
+		err := protocol.IsValidEpochSetup(setup, true)
+		require.Error(t, err)
+	})
+
+	t.Run("network addresses are not unique", func(t *testing.T) {
+		_, result, _ := unittest.BootstrapFixture(participants)
+		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
+		setup.Participants[0].Address = setup.Participants[1].Address
+
+		err := protocol.IsValidEpochSetup(setup, true)
+		require.Error(t, err)
+	})
+
+	t.Run("no cluster assignment", func(t *testing.T) {
+		_, result, _ := unittest.BootstrapFixture(participants)
+		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
+		setup.Assignments = flow.AssignmentList{}
+
+		err := protocol.IsValidEpochSetup(setup, true)
+		require.Error(t, err)
+	})
+}
+
+func TestBootstrapInvalidEpochCommit(t *testing.T) {
+	t.Run("inconsistent counter", func(t *testing.T) {
+		_, result, _ := unittest.BootstrapFixture(participants)
+		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
+		commit := result.ServiceEvents[1].Event.(*flow.EpochCommit)
+		// use a different counter for the commit
+		commit.Counter = setup.Counter + 1
+
+		err := protocol.IsValidEpochCommit(commit, setup)
+		require.Error(t, err)
+	})
+
+	t.Run("inconsistent cluster QCs", func(t *testing.T) {
+		_, result, _ := unittest.BootstrapFixture(participants)
+		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
+		commit := result.ServiceEvents[1].Event.(*flow.EpochCommit)
+		// add an extra QC to commit
+		extraQC := unittest.QuorumCertificateWithSignerIDsFixture()
+		commit.ClusterQCs = append(commit.ClusterQCs, flow.ClusterQCVoteDataFromQC(extraQC))
+
+		err := protocol.IsValidEpochCommit(commit, setup)
+		require.Error(t, err)
+	})
+
+	t.Run("missing dkg group key", func(t *testing.T) {
+		_, result, _ := unittest.BootstrapFixture(participants)
+		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
+		commit := result.ServiceEvents[1].Event.(*flow.EpochCommit)
+		commit.DKGGroupKey = nil
+
+		err := protocol.IsValidEpochCommit(commit, setup)
+		require.Error(t, err)
+	})
+
+	t.Run("inconsistent DKG participants", func(t *testing.T) {
+		_, result, _ := unittest.BootstrapFixture(participants)
+		setup := result.ServiceEvents[0].Event.(*flow.EpochSetup)
+		commit := result.ServiceEvents[1].Event.(*flow.EpochCommit)
+		// add an extra DKG participant key
+		commit.DKGParticipantKeys = append(commit.DKGParticipantKeys, unittest.KeyFixture(crypto.BLSBLS12381).PublicKey())
+
+		err := protocol.IsValidEpochCommit(commit, setup)
+		require.Error(t, err)
+	})
+}
+
+// TestIsValidExtendingEpochSetup tests that implementation enforces the following protocol rules in case they are violated:
+// (a) We should only have a single epoch setup event per epoch.
+// (b) The setup event should have the counter increased by one
+// (c) The first view needs to be exactly one greater than the current epoch final view
+// additionally we require other conditions, but they are tested by separate test `TestEpochSetupValidity`.
+func TestIsValidExtendingEpochSetup(t *testing.T) {
+	t.Run("happy path", func(t *testing.T) {
+		protocolState := unittest.ProtocolStateFixture()
+		currentEpochSetup := protocolState.CurrentEpochSetup
+		extendingSetup := unittest.EpochSetupFixture(
+			unittest.WithFirstView(currentEpochSetup.FinalView+1),
+			unittest.WithFinalView(currentEpochSetup.FinalView+1000),
+			unittest.SetupWithCounter(currentEpochSetup.Counter+1),
+			unittest.WithParticipants(participants.ToSkeleton()),
+		)
+		err := protocol.IsValidExtendingEpochSetup(extendingSetup, protocolState.ProtocolStateEntry, currentEpochSetup)
+		require.NoError(t, err)
+	})
+	t.Run("(a) We should only have a single epoch setup event per epoch.", func(t *testing.T) {
+		protocolState := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState())
+		currentEpochSetup := protocolState.CurrentEpochSetup
+		extendingSetup := unittest.EpochSetupFixture(
+			unittest.WithFirstView(currentEpochSetup.FinalView+1),
+			unittest.WithFinalView(currentEpochSetup.FinalView+1000),
+			unittest.SetupWithCounter(currentEpochSetup.Counter+1),
+			unittest.WithParticipants(participants.ToSkeleton()),
+		)
+		err := protocol.IsValidExtendingEpochSetup(extendingSetup, protocolState.ProtocolStateEntry, currentEpochSetup)
+		require.Error(t, err)
+	})
+	t.Run("(b) The setup event should have the counter increased by one", func(t *testing.T) {
+		protocolState := unittest.ProtocolStateFixture()
+		currentEpochSetup := protocolState.CurrentEpochSetup
+		extendingSetup := unittest.EpochSetupFixture(
+			unittest.WithFirstView(currentEpochSetup.FinalView+1),
+			unittest.WithFinalView(currentEpochSetup.FinalView+1000),
+			unittest.SetupWithCounter(currentEpochSetup.Counter+2),
+			unittest.WithParticipants(participants.ToSkeleton()),
+		)
+		err := protocol.IsValidExtendingEpochSetup(extendingSetup, protocolState.ProtocolStateEntry, currentEpochSetup)
+		require.Error(t, err)
+	})
+	t.Run("(c) The first view needs to be exactly one greater than the current epoch final view", func(t *testing.T) {
+		protocolState := unittest.ProtocolStateFixture()
+		currentEpochSetup := protocolState.CurrentEpochSetup
+		extendingSetup := unittest.EpochSetupFixture(
+			unittest.WithFirstView(currentEpochSetup.FinalView+2),
+			unittest.WithFinalView(currentEpochSetup.FinalView+1000),
+			unittest.SetupWithCounter(currentEpochSetup.Counter+1),
+			unittest.WithParticipants(participants.ToSkeleton()),
+		)
+		err := protocol.IsValidExtendingEpochSetup(extendingSetup, protocolState.ProtocolStateEntry, currentEpochSetup)
+		require.Error(t, err)
+	})
+}
+
+// TestIsValidExtendingEpochCommit tests that implementation enforces the following protocol rules in case they are violated:
+// (a) The epoch setup event needs to happen before the commit.
+// (b) We should only have a single epoch commit event per epoch.
+// additionally we require other conditions, but they are tested by separate test `TestEpochCommitValidity`.
+func TestIsValidExtendingEpochCommit(t *testing.T) {
+	t.Run("happy path", func(t *testing.T) {
+		protocolState := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState(), func(entry *flow.RichProtocolStateEntry) {
+			entry.NextEpochCommit = nil
+			entry.NextEpoch.CommitID = flow.ZeroID
+		})
+
+		nextEpochSetup := protocolState.NextEpochSetup
+		extendingSetup := unittest.EpochCommitFixture(
+			unittest.CommitWithCounter(nextEpochSetup.Counter),
+			unittest.WithDKGFromParticipants(nextEpochSetup.Participants),
+		)
+		err := protocol.IsValidExtendingEpochCommit(extendingSetup, protocolState.ProtocolStateEntry, nextEpochSetup)
+		require.NoError(t, err)
+	})
+	t.Run("(a) The epoch setup event needs to happen before the commit", func(t *testing.T) {
+		protocolState := unittest.ProtocolStateFixture()
+		currentEpochSetup := protocolState.CurrentEpochSetup
+		nextEpochSetup := unittest.EpochSetupFixture(
+			unittest.WithFirstView(currentEpochSetup.FinalView+1),
+			unittest.WithFinalView(currentEpochSetup.FinalView+1000),
+			unittest.SetupWithCounter(currentEpochSetup.Counter+1),
+			unittest.WithParticipants(participants.ToSkeleton()),
+		)
+		extendingSetup := unittest.EpochCommitFixture(
+			unittest.CommitWithCounter(nextEpochSetup.Counter),
+			unittest.WithDKGFromParticipants(nextEpochSetup.Participants),
+		)
+		err := protocol.IsValidExtendingEpochCommit(extendingSetup, protocolState.ProtocolStateEntry, nextEpochSetup)
+		require.Error(t, err)
+	})
+	t.Run("We should only have a single epoch commit event per epoch", func(t *testing.T) {
+		protocolState := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState())
+
+		nextEpochSetup := protocolState.NextEpochSetup
+		extendingSetup := unittest.EpochCommitFixture(
+			unittest.CommitWithCounter(nextEpochSetup.Counter),
+			unittest.WithDKGFromParticipants(nextEpochSetup.Participants),
+		)
+		err := protocol.IsValidExtendingEpochCommit(extendingSetup, protocolState.ProtocolStateEntry, nextEpochSetup)
+		require.Error(t, err)
+	})
+}
diff --git a/storage/all.go b/storage/all.go
index 4eb4f20d4a5..a8bfb26d0d3 100644
--- a/storage/all.go
+++ b/storage/all.go
@@ -11,7 +11,6 @@ type All struct {
 	QuorumCertificates      QuorumCertificates
 	Setups                  EpochSetups
 	EpochCommits            EpochCommits
-	Statuses                EpochStatuses
 	Results                 ExecutionResults
 	Receipts                ExecutionReceipts
 	ChunkDataPacks          ChunkDataPacks
@@ -21,6 +20,7 @@ type All struct {
 	TransactionResults      TransactionResults
 	Collections             Collections
 	Events                  Events
+	ProtocolState           ProtocolState
 	VersionBeacons          VersionBeacons
 	RegisterIndex           RegisterIndex
 }
diff --git a/storage/badger/all.go b/storage/badger/all.go
index 58bc45e6848..8d1a718044c 100644
--- a/storage/badger/all.go
+++ b/storage/badger/all.go
@@ -19,7 +19,8 @@ func InitAll(metrics module.CacheMetrics, db *badger.DB) *storage.All {
 	qcs := NewQuorumCertificates(metrics, db, DefaultCacheSize)
 	setups := NewEpochSetups(metrics, db)
 	epochCommits := NewEpochCommits(metrics, db)
-	statuses := NewEpochStatuses(metrics, db)
+	protocolState := NewProtocolState(metrics, setups, epochCommits, db,
+		DefaultProtocolStateCacheSize, DefaultProtocolStateByBlockIDCacheSize)
 	versionBeacons := NewVersionBeacons(db)
 
 	commits := NewCommits(metrics, db)
@@ -39,7 +40,7 @@ func InitAll(metrics module.CacheMetrics, db *badger.DB) *storage.All {
 		QuorumCertificates: qcs,
 		Setups:             setups,
 		EpochCommits:       epochCommits,
-		Statuses:           statuses,
+		ProtocolState:      protocolState,
 		VersionBeacons:     versionBeacons,
 		Results:            results,
 		Receipts:           receipts,
diff --git a/storage/badger/blocks.go b/storage/badger/blocks.go
index 9d3b64a1ffc..6b75d0e3313 100644
--- a/storage/badger/blocks.go
+++ b/storage/badger/blocks.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package badger
 
 import (
diff --git a/storage/badger/chunk_consumer_test.go b/storage/badger/chunk_consumer_test.go
index 05af3a1ca29..c33fabc06b7 100644
--- a/storage/badger/chunk_consumer_test.go
+++ b/storage/badger/chunk_consumer_test.go
@@ -8,4 +8,5 @@ import "testing"
 // 4. can read after init
 // 5. can read after set
 func TestChunkConsumer(t *testing.T) {
+	// TODO
 }
diff --git a/storage/badger/cleaner.go b/storage/badger/cleaner.go
index d9cd07997e7..2c5e92873b6 100644
--- a/storage/badger/cleaner.go
+++ b/storage/badger/cleaner.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package badger
 
 import (
diff --git a/storage/badger/cluster_payloads.go b/storage/badger/cluster_payloads.go
index 0fc3ba3ee28..6a7efae75b1 100644
--- a/storage/badger/cluster_payloads.go
+++ b/storage/badger/cluster_payloads.go
@@ -47,6 +47,7 @@ func NewClusterPayloads(cacheMetrics module.CacheMetrics, db *badger.DB) *Cluste
 func (cp *ClusterPayloads) storeTx(blockID flow.Identifier, payload *cluster.Payload) func(*transaction.Tx) error {
 	return cp.cache.PutTx(blockID, payload)
 }
+
 func (cp *ClusterPayloads) retrieveTx(blockID flow.Identifier) func(*badger.Txn) (*cluster.Payload, error) {
 	return func(tx *badger.Txn) (*cluster.Payload, error) {
 		val, err := cp.cache.Get(blockID)(tx)
diff --git a/storage/badger/epoch_commits.go b/storage/badger/epoch_commits.go
index 20dadaccdba..7e520fc7634 100644
--- a/storage/badger/epoch_commits.go
+++ b/storage/badger/epoch_commits.go
@@ -1,6 +1,8 @@
 package badger
 
 import (
+	"fmt"
+
 	"github.com/dgraph-io/badger/v2"
 
 	"github.com/onflow/flow-go/model/flow"
@@ -48,7 +50,7 @@ func (ec *EpochCommits) retrieveTx(commitID flow.Identifier) func(tx *badger.Txn
 	return func(tx *badger.Txn) (*flow.EpochCommit, error) {
 		val, err := ec.cache.Get(commitID)(tx)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("could not retrieve EpochCommit event with id %x: %w", commitID, err)
 		}
 		return val, nil
 	}
diff --git a/storage/badger/epoch_setups.go b/storage/badger/epoch_setups.go
index 24757067f8f..9f0c0d1e7ca 100644
--- a/storage/badger/epoch_setups.go
+++ b/storage/badger/epoch_setups.go
@@ -1,6 +1,8 @@
 package badger
 
 import (
+	"fmt"
+
 	"github.com/dgraph-io/badger/v2"
 
 	"github.com/onflow/flow-go/model/flow"
@@ -49,7 +51,7 @@ func (es *EpochSetups) retrieveTx(setupID flow.Identifier) func(tx *badger.Txn)
 	return func(tx *badger.Txn) (*flow.EpochSetup, error) {
 		val, err := es.cache.Get(setupID)(tx)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("could not retrieve EpochSetup event with id %x: %w", setupID, err)
 		}
 		return val, nil
 	}
diff --git a/storage/badger/epoch_statuses.go b/storage/badger/epoch_statuses.go
deleted file mode 100644
index 2d64fcfea8f..00000000000
--- a/storage/badger/epoch_statuses.go
+++ /dev/null
@@ -1,65 +0,0 @@
-package badger
-
-import (
-	"github.com/dgraph-io/badger/v2"
-
-	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/module"
-	"github.com/onflow/flow-go/module/metrics"
-	"github.com/onflow/flow-go/storage/badger/operation"
-	"github.com/onflow/flow-go/storage/badger/transaction"
-)
-
-type EpochStatuses struct {
-	db    *badger.DB
-	cache *Cache[flow.Identifier, *flow.EpochStatus]
-}
-
-// NewEpochStatuses ...
-func NewEpochStatuses(collector module.CacheMetrics, db *badger.DB) *EpochStatuses {
-
-	store := func(blockID flow.Identifier, status *flow.EpochStatus) func(*transaction.Tx) error {
-		return transaction.WithTx(operation.InsertEpochStatus(blockID, status))
-	}
-
-	retrieve := func(blockID flow.Identifier) func(*badger.Txn) (*flow.EpochStatus, error) {
-		return func(tx *badger.Txn) (*flow.EpochStatus, error) {
-			var status flow.EpochStatus
-			err := operation.RetrieveEpochStatus(blockID, &status)(tx)
-			return &status, err
-		}
-	}
-
-	es := &EpochStatuses{
-		db: db,
-		cache: newCache[flow.Identifier, *flow.EpochStatus](collector, metrics.ResourceEpochStatus,
-			withLimit[flow.Identifier, *flow.EpochStatus](4*flow.DefaultTransactionExpiry),
-			withStore(store),
-			withRetrieve(retrieve)),
-	}
-
-	return es
-}
-
-func (es *EpochStatuses) StoreTx(blockID flow.Identifier, status *flow.EpochStatus) func(tx *transaction.Tx) error {
-	return es.cache.PutTx(blockID, status)
-}
-
-func (es *EpochStatuses) retrieveTx(blockID flow.Identifier) func(tx *badger.Txn) (*flow.EpochStatus, error) {
-	return func(tx *badger.Txn) (*flow.EpochStatus, error) {
-		val, err := es.cache.Get(blockID)(tx)
-		if err != nil {
-			return nil, err
-		}
-		return val, nil
-	}
-}
-
-// ByBlockID will return the epoch status for the given block
-// Error returns:
-// * storage.ErrNotFound if EpochStatus for the block does not exist
-func (es *EpochStatuses) ByBlockID(blockID flow.Identifier) (*flow.EpochStatus, error) {
-	tx := es.db.NewTransaction(false)
-	defer tx.Discard()
-	return es.retrieveTx(blockID)(tx)
-}
diff --git a/storage/badger/epoch_statuses_test.go b/storage/badger/epoch_statuses_test.go
deleted file mode 100644
index ce560bee9d2..00000000000
--- a/storage/badger/epoch_statuses_test.go
+++ /dev/null
@@ -1,40 +0,0 @@
-package badger_test
-
-import (
-	"errors"
-	"testing"
-
-	"github.com/dgraph-io/badger/v2"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/onflow/flow-go/module/metrics"
-	"github.com/onflow/flow-go/storage"
-	"github.com/onflow/flow-go/utils/unittest"
-
-	badgerstorage "github.com/onflow/flow-go/storage/badger"
-	"github.com/onflow/flow-go/storage/badger/operation"
-	"github.com/onflow/flow-go/storage/badger/transaction"
-)
-
-func TestEpochStatusesStoreAndRetrieve(t *testing.T) {
-	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
-		metrics := metrics.NewNoopCollector()
-		store := badgerstorage.NewEpochStatuses(metrics, db)
-
-		blockID := unittest.IdentifierFixture()
-		expected := unittest.EpochStatusFixture()
-
-		_, err := store.ByBlockID(unittest.IdentifierFixture())
-		assert.True(t, errors.Is(err, storage.ErrNotFound))
-
-		// store epoch status
-		err = operation.RetryOnConflictTx(db, transaction.Update, store.StoreTx(blockID, expected))
-		require.NoError(t, err)
-
-		// retreive status
-		actual, err := store.ByBlockID(blockID)
-		require.NoError(t, err)
-		require.Equal(t, expected, actual)
-	})
-}
diff --git a/storage/badger/events.go b/storage/badger/events.go
index 8acea496c92..ca7cb5105ec 100644
--- a/storage/badger/events.go
+++ b/storage/badger/events.go
@@ -86,6 +86,7 @@ func (e *Events) Store(blockID flow.Identifier, blockEvents []flow.EventsList) e
 }
 
 // ByBlockID returns the events for the given block ID
+// Note: This method will return an empty slice and no error if no entries for the blockID are found
 func (e *Events) ByBlockID(blockID flow.Identifier) ([]flow.Event, error) {
 	tx := e.db.NewTransaction(false)
 	defer tx.Discard()
@@ -97,6 +98,7 @@ func (e *Events) ByBlockID(blockID flow.Identifier) ([]flow.Event, error) {
 }
 
 // ByBlockIDTransactionID returns the events for the given block ID and transaction ID
+// Note: This method will return an empty slice and no error if no entries for the blockID are found
 func (e *Events) ByBlockIDTransactionID(blockID flow.Identifier, txID flow.Identifier) ([]flow.Event, error) {
 	events, err := e.ByBlockID(blockID)
 	if err != nil {
@@ -112,6 +114,8 @@ func (e *Events) ByBlockIDTransactionID(blockID flow.Identifier, txID flow.Ident
 	return matched, nil
 }
 
+// ByBlockIDTransactionIndex returns the events for the given block ID and transaction index
+// Note: This method will return an empty slice and no error if no entries for the blockID are found
 func (e *Events) ByBlockIDTransactionIndex(blockID flow.Identifier, txIndex uint32) ([]flow.Event, error) {
 	events, err := e.ByBlockID(blockID)
 	if err != nil {
@@ -128,6 +132,7 @@ func (e *Events) ByBlockIDTransactionIndex(blockID flow.Identifier, txIndex uint
 }
 
 // ByBlockIDEventType returns the events for the given block ID and event type
+// Note: This method will return an empty slice and no error if no entries for the blockID are found
 func (e *Events) ByBlockIDEventType(blockID flow.Identifier, eventType flow.EventType) ([]flow.Event, error) {
 	events, err := e.ByBlockID(blockID)
 	if err != nil {
diff --git a/storage/badger/headers.go b/storage/badger/headers.go
index 49574e5abc9..cea044f445b 100644
--- a/storage/badger/headers.go
+++ b/storage/badger/headers.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package badger
 
 import (
diff --git a/storage/badger/index.go b/storage/badger/index.go
index 49d87b928da..fd8aa75e813 100644
--- a/storage/badger/index.go
+++ b/storage/badger/index.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package badger
 
 import (
diff --git a/storage/badger/operation/collections.go b/storage/badger/operation/collections.go
index 4b8e0faf761..3f6c22abd68 100644
--- a/storage/badger/operation/collections.go
+++ b/storage/badger/operation/collections.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/collections_test.go b/storage/badger/operation/collections_test.go
index 9bbe14386c8..14d645e0593 100644
--- a/storage/badger/operation/collections_test.go
+++ b/storage/badger/operation/collections_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/commits.go b/storage/badger/operation/commits.go
index c7f13afd49f..260983da739 100644
--- a/storage/badger/operation/commits.go
+++ b/storage/badger/operation/commits.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/common.go b/storage/badger/operation/common.go
index 6dbe96224b4..1c293348231 100644
--- a/storage/badger/operation/common.go
+++ b/storage/badger/operation/common.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/common_test.go b/storage/badger/operation/common_test.go
index 65f64fbd5cb..b887409cf6f 100644
--- a/storage/badger/operation/common_test.go
+++ b/storage/badger/operation/common_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/epoch.go b/storage/badger/operation/epoch.go
index b5fcef7e029..eafc2f54ce3 100644
--- a/storage/badger/operation/epoch.go
+++ b/storage/badger/operation/epoch.go
@@ -25,18 +25,10 @@ func RetrieveEpochCommit(eventID flow.Identifier, event *flow.EpochCommit) func(
 	return retrieve(makePrefix(codeEpochCommit, eventID), event)
 }
 
-func InsertEpochStatus(blockID flow.Identifier, status *flow.EpochStatus) func(*badger.Txn) error {
-	return insert(makePrefix(codeBlockEpochStatus, blockID), status)
-}
-
-func RetrieveEpochStatus(blockID flow.Identifier, status *flow.EpochStatus) func(*badger.Txn) error {
-	return retrieve(makePrefix(codeBlockEpochStatus, blockID), status)
-}
-
 // SetEpochEmergencyFallbackTriggered sets a flag in the DB indicating that
 // epoch emergency fallback has been triggered, and the block where it was triggered.
 //
-// EECC can be triggered in two ways:
+// EFM can be triggered in two ways:
 //  1. Finalizing the first block past the epoch commitment deadline, when the
 //     next epoch has not yet been committed (see protocol.Params for more detail)
 //  2. Finalizing a fork in which an invalid service event was incorporated.
@@ -60,7 +52,7 @@ func CheckEpochEmergencyFallbackTriggered(triggered *bool) func(*badger.Txn) err
 		var blockID flow.Identifier
 		err := RetrieveEpochEmergencyFallbackTriggeredBlockID(&blockID)(tx)
 		if errors.Is(err, storage.ErrNotFound) {
-			// flag unset, EECC not triggered
+			// flag unset, EFM not triggered
 			*triggered = false
 			return nil
 		} else if err != nil {
@@ -68,7 +60,7 @@ func CheckEpochEmergencyFallbackTriggered(triggered *bool) func(*badger.Txn) err
 			*triggered = false
 			return err
 		}
-		// flag is set, EECC triggered
+		// flag is set, EFM triggered
 		*triggered = true
 		return err
 	}
diff --git a/storage/badger/operation/epoch_test.go b/storage/badger/operation/epoch_test.go
index a9d4938e486..d9ebf41117f 100644
--- a/storage/badger/operation/epoch_test.go
+++ b/storage/badger/operation/epoch_test.go
@@ -12,7 +12,7 @@ import (
 
 func TestEpochEmergencyFallback(t *testing.T) {
 
-	// the block ID where EECC was triggered
+	// the block ID where EFM was triggered
 	blockID := unittest.IdentifierFixture()
 
 	t.Run("reading when unset should return false", func(t *testing.T) {
diff --git a/storage/badger/operation/events.go b/storage/badger/operation/events.go
index f49c937c412..f7b0a1ee2d2 100644
--- a/storage/badger/operation/events.go
+++ b/storage/badger/operation/events.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/headers.go b/storage/badger/operation/headers.go
index bd1c377cc16..0ab0dd6b1ac 100644
--- a/storage/badger/operation/headers.go
+++ b/storage/badger/operation/headers.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/headers_test.go b/storage/badger/operation/headers_test.go
index 60270cd24ca..80d39de2854 100644
--- a/storage/badger/operation/headers_test.go
+++ b/storage/badger/operation/headers_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/heights.go b/storage/badger/operation/heights.go
index 0c6573ab24c..9e4efe79c91 100644
--- a/storage/badger/operation/heights.go
+++ b/storage/badger/operation/heights.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/heights_test.go b/storage/badger/operation/heights_test.go
index 5cfa1a77099..30ad8452c46 100644
--- a/storage/badger/operation/heights_test.go
+++ b/storage/badger/operation/heights_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/interactions_test.go b/storage/badger/operation/interactions_test.go
index b976a2dafd1..b30d43d90bf 100644
--- a/storage/badger/operation/interactions_test.go
+++ b/storage/badger/operation/interactions_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/modifiers.go b/storage/badger/operation/modifiers.go
index 3965b5d204c..b8808e2b89b 100644
--- a/storage/badger/operation/modifiers.go
+++ b/storage/badger/operation/modifiers.go
@@ -21,6 +21,17 @@ func SkipDuplicates(op func(*badger.Txn) error) func(tx *badger.Txn) error {
 	}
 }
 
+func SkipDuplicatesTx(op func(*transaction.Tx) error) func(tx *transaction.Tx) error {
+	return func(tx *transaction.Tx) error {
+		err := op(tx)
+		if errors.Is(err, storage.ErrAlreadyExists) {
+			metrics.GetStorageCollector().SkipDuplicate()
+			return nil
+		}
+		return err
+	}
+}
+
 func SkipNonExist(op func(*badger.Txn) error) func(tx *badger.Txn) error {
 	return func(tx *badger.Txn) error {
 		err := op(tx)
diff --git a/storage/badger/operation/modifiers_test.go b/storage/badger/operation/modifiers_test.go
index ffeda8440ad..8824077c3c7 100644
--- a/storage/badger/operation/modifiers_test.go
+++ b/storage/badger/operation/modifiers_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/seals.go b/storage/badger/operation/payload.go
similarity index 90%
rename from storage/badger/operation/seals.go
rename to storage/badger/operation/payload.go
index 961f9826e34..91fc0488122 100644
--- a/storage/badger/operation/seals.go
+++ b/storage/badger/operation/payload.go
@@ -30,6 +30,14 @@ func IndexPayloadResults(blockID flow.Identifier, resultIDs []flow.Identifier) f
 	return insert(makePrefix(codePayloadResults, blockID), resultIDs)
 }
 
+func IndexPayloadProtocolStateID(blockID flow.Identifier, stateID flow.Identifier) func(*badger.Txn) error {
+	return insert(makePrefix(codePayloadProtocolStateID, blockID), stateID)
+}
+
+func LookupPayloadProtocolStateID(blockID flow.Identifier, stateID *flow.Identifier) func(*badger.Txn) error {
+	return retrieve(makePrefix(codePayloadProtocolStateID, blockID), stateID)
+}
+
 func LookupPayloadReceipts(blockID flow.Identifier, receiptIDs *[]flow.Identifier) func(*badger.Txn) error {
 	return retrieve(makePrefix(codePayloadReceipts, blockID), receiptIDs)
 }
diff --git a/storage/badger/operation/seals_test.go b/storage/badger/operation/payload_test.go
similarity index 96%
rename from storage/badger/operation/seals_test.go
rename to storage/badger/operation/payload_test.go
index 73846bbfbed..1a91914c0e7 100644
--- a/storage/badger/operation/seals_test.go
+++ b/storage/badger/operation/payload_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/prefix.go b/storage/badger/operation/prefix.go
index 36c33137c80..bda72d02424 100644
--- a/storage/badger/operation/prefix.go
+++ b/storage/badger/operation/prefix.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
@@ -36,36 +34,38 @@ const (
 	codeSealedRootHeight        = 27 // the height of the highest sealed block contained in the root snapshot
 
 	// codes for single entity storage
-	// 31 was used for identities before epochs
 	codeHeader               = 30
+	_                        = 31 // DEPRECATED: 31 was used for identities before epochs
 	codeGuarantee            = 32
 	codeSeal                 = 33
 	codeTransaction          = 34
 	codeCollection           = 35
 	codeExecutionResult      = 36
-	codeExecutionReceiptMeta = 36
 	codeResultApproval       = 37
 	codeChunk                = 38
+	codeExecutionReceiptMeta = 39 // NOTE: prior to Mainnet25, this erroneously had the same value as codeExecutionResult (36)
 
-	// codes for indexing single identifier by identifier/integeter
+	// codes for indexing single identifier by identifier/integer
 	codeHeightToBlock              = 40 // index mapping height to block ID
 	codeBlockIDToLatestSealID      = 41 // index mapping a block its last payload seal
 	codeClusterBlockToRefBlock     = 42 // index cluster block ID to reference block ID
 	codeRefHeightToClusterBlock    = 43 // index reference block height to cluster block IDs
 	codeBlockIDToFinalizedSeal     = 44 // index _finalized_ seal by sealed block ID
 	codeBlockIDToQuorumCertificate = 45 // index of quorum certificates by block ID
+	codeProtocolStateByBlockID     = 46 // index of protocol state entry by block ID
 
 	// codes for indexing multiple identifiers by identifier
-	// NOTE: 51 was used for identity indexes before epochs
-	codeBlockChildren     = 50 // index mapping block ID to children blocks
-	codePayloadGuarantees = 52 // index mapping block ID to payload guarantees
-	codePayloadSeals      = 53 // index mapping block ID to payload seals
-	codeCollectionBlock   = 54 // index mapping collection ID to block ID
-	codeOwnBlockReceipt   = 55 // index mapping block ID to execution receipt ID for execution nodes
-	codeBlockEpochStatus  = 56 // index mapping block ID to epoch status
-	codePayloadReceipts   = 57 // index mapping block ID  to payload receipts
-	codePayloadResults    = 58 // index mapping block ID to payload results
-	codeAllBlockReceipts  = 59 // index mapping of blockID to multiple receipts
+	codeBlockChildren          = 50 // index mapping block ID to children blocks
+	_                          = 51 // DEPRECATED: 51 was used for identity indexes before epochs
+	codePayloadGuarantees      = 52 // index mapping block ID to payload guarantees
+	codePayloadSeals           = 53 // index mapping block ID to payload seals
+	codeCollectionBlock        = 54 // index mapping collection ID to block ID
+	codeOwnBlockReceipt        = 55 // index mapping block ID to execution receipt ID for execution nodes
+	_                          = 56 // DEPRECATED: 56 was used for block->epoch status prior to Dynamic Protocol State in Mainnet25
+	codePayloadReceipts        = 57 // index mapping block ID to payload receipts
+	codePayloadResults         = 58 // index mapping block ID to payload results
+	codeAllBlockReceipts       = 59 // index mapping of blockID to multiple receipts
+	codePayloadProtocolStateID = 60 // index mapping block ID to payload protocol state ID
 
 	// codes related to protocol level information
 	codeEpochSetup       = 61 // EpochSetup service event, keyed by ID
@@ -74,6 +74,7 @@ const (
 	codeDKGStarted       = 64 // flag that the DKG for an epoch has been started
 	codeDKGEnded         = 65 // flag that the DKG for an epoch has ended (stores end state)
 	codeVersionBeacon    = 67 // flag for storing version beacons
+	codeProtocolState    = 68
 
 	// code for ComputationResult upload status storage
 	// NOTE: for now only GCP uploader is supported. When other uploader (AWS e.g.) needs to
diff --git a/storage/badger/operation/prefix_test.go b/storage/badger/operation/prefix_test.go
index 4a2af4332e4..444311ece22 100644
--- a/storage/badger/operation/prefix_test.go
+++ b/storage/badger/operation/prefix_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/protocol_state.go b/storage/badger/operation/protocol_state.go
new file mode 100644
index 00000000000..3534a5b4679
--- /dev/null
+++ b/storage/badger/operation/protocol_state.go
@@ -0,0 +1,39 @@
+package operation
+
+import (
+	"github.com/dgraph-io/badger/v2"
+
+	"github.com/onflow/flow-go/model/flow"
+)
+
+// InsertProtocolState inserts a protocol state by ID.
+// Error returns:
+//   - storage.ErrAlreadyExists if the key already exists in the database.
+//   - generic error in case of unexpected failure from the database layer or encoding failure.
+func InsertProtocolState(protocolStateID flow.Identifier, protocolState *flow.ProtocolStateEntry) func(*badger.Txn) error {
+	return insert(makePrefix(codeProtocolState, protocolStateID), protocolState)
+}
+
+// RetrieveProtocolState retrieves a protocol state by ID.
+// Error returns:
+//   - storage.ErrNotFound if the key does not exist in the database
+//   - generic error in case of unexpected failure from the database layer
+func RetrieveProtocolState(protocolStateID flow.Identifier, protocolState *flow.ProtocolStateEntry) func(*badger.Txn) error {
+	return retrieve(makePrefix(codeProtocolState, protocolStateID), protocolState)
+}
+
+// IndexProtocolState indexes a protocol state by block ID.
+// Error returns:
+//   - storage.ErrAlreadyExists if the key already exists in the database.
+//   - generic error in case of unexpected failure from the database layer or encoding failure.
+func IndexProtocolState(blockID flow.Identifier, protocolStateID flow.Identifier) func(*badger.Txn) error {
+	return insert(makePrefix(codeProtocolStateByBlockID, blockID), protocolStateID)
+}
+
+// LookupProtocolState finds protocol state ID by block ID.
+// Error returns:
+//   - storage.ErrNotFound if the key does not exist in the database
+//   - generic error in case of unexpected failure from the database layer
+func LookupProtocolState(blockID flow.Identifier, protocolStateID *flow.Identifier) func(*badger.Txn) error {
+	return retrieve(makePrefix(codeProtocolStateByBlockID, blockID), protocolStateID)
+}
diff --git a/storage/badger/operation/protocol_state_test.go b/storage/badger/operation/protocol_state_test.go
new file mode 100644
index 00000000000..1f29e1b7b49
--- /dev/null
+++ b/storage/badger/operation/protocol_state_test.go
@@ -0,0 +1,39 @@
+package operation
+
+import (
+	"testing"
+
+	"github.com/dgraph-io/badger/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+// TestInsertProtocolState tests if basic badger operations on ProtocolState work as expected.
+func TestInsertProtocolState(t *testing.T) {
+	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
+		expected := unittest.ProtocolStateFixture().ProtocolStateEntry
+
+		protocolStateID := expected.ID()
+		err := db.Update(InsertProtocolState(protocolStateID, expected))
+		require.Nil(t, err)
+
+		var actual flow.ProtocolStateEntry
+		err = db.View(RetrieveProtocolState(protocolStateID, &actual))
+		require.Nil(t, err)
+
+		assert.Equal(t, expected, &actual)
+
+		blockID := unittest.IdentifierFixture()
+		err = db.Update(IndexProtocolState(blockID, protocolStateID))
+		require.Nil(t, err)
+
+		var actualProtocolStateID flow.Identifier
+		err = db.View(LookupProtocolState(blockID, &actualProtocolStateID))
+		require.Nil(t, err)
+
+		assert.Equal(t, protocolStateID, actualProtocolStateID)
+	})
+}
diff --git a/storage/badger/operation/receipts.go b/storage/badger/operation/receipts.go
index 3dc923af8cb..7224819cb6c 100644
--- a/storage/badger/operation/receipts.go
+++ b/storage/badger/operation/receipts.go
@@ -17,7 +17,7 @@ func BatchInsertExecutionReceiptMeta(receiptID flow.Identifier, meta *flow.Execu
 	return batchWrite(makePrefix(codeExecutionReceiptMeta, receiptID), meta)
 }
 
-// RetrieveExecutionReceipt retrieves a execution receipt meta by ID.
+// RetrieveExecutionReceiptMeta retrieves a execution receipt meta by ID.
 func RetrieveExecutionReceiptMeta(receiptID flow.Identifier, meta *flow.ExecutionReceiptMeta) func(*badger.Txn) error {
 	return retrieve(makePrefix(codeExecutionReceiptMeta, receiptID), meta)
 }
diff --git a/storage/badger/operation/receipts_test.go b/storage/badger/operation/receipts_test.go
index 1c41f739ebb..85273afc05b 100644
--- a/storage/badger/operation/receipts_test.go
+++ b/storage/badger/operation/receipts_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/results_test.go b/storage/badger/operation/results_test.go
index 3a3ea267037..6907f254ac9 100644
--- a/storage/badger/operation/results_test.go
+++ b/storage/badger/operation/results_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/operation/transaction_results.go b/storage/badger/operation/transaction_results.go
index ed215aaedf7..7d5fcf47086 100644
--- a/storage/badger/operation/transaction_results.go
+++ b/storage/badger/operation/transaction_results.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package operation
 
 import (
diff --git a/storage/badger/payloads.go b/storage/badger/payloads.go
index ec75103cde3..c4d57277c72 100644
--- a/storage/badger/payloads.go
+++ b/storage/badger/payloads.go
@@ -144,10 +144,11 @@ func (p *Payloads) retrieveTx(blockID flow.Identifier) func(tx *badger.Txn) (*fl
 			results = append(results, result)
 		}
 		payload := &flow.Payload{
-			Seals:      seals,
-			Guarantees: guarantees,
-			Receipts:   receipts,
-			Results:    results,
+			Seals:           seals,
+			Guarantees:      guarantees,
+			Receipts:        receipts,
+			Results:         results,
+			ProtocolStateID: idx.ProtocolStateID,
 		}
 
 		return payload, nil
diff --git a/storage/badger/procedure/index.go b/storage/badger/procedure/index.go
index 0b4e56c7fd2..32d066176d6 100644
--- a/storage/badger/procedure/index.go
+++ b/storage/badger/procedure/index.go
@@ -27,6 +27,10 @@ func InsertIndex(blockID flow.Identifier, index *flow.Index) func(tx *badger.Txn
 		if err != nil {
 			return fmt.Errorf("could not store results index: %w", err)
 		}
+		err = operation.IndexPayloadProtocolStateID(blockID, index.ProtocolStateID)(tx)
+		if err != nil {
+			return fmt.Errorf("could not store protocol state id: %w", err)
+		}
 		return nil
 	}
 }
@@ -53,12 +57,18 @@ func RetrieveIndex(blockID flow.Identifier, index *flow.Index) func(tx *badger.T
 		if err != nil {
 			return fmt.Errorf("could not retrieve receipts index: %w", err)
 		}
+		var stateID flow.Identifier
+		err = operation.LookupPayloadProtocolStateID(blockID, &stateID)(tx)
+		if err != nil {
+			return fmt.Errorf("could not retrieve protocol state id: %w", err)
+		}
 
 		*index = flow.Index{
-			CollectionIDs: collIDs,
-			SealIDs:       sealIDs,
-			ReceiptIDs:    receiptIDs,
-			ResultIDs:     resultsIDs,
+			CollectionIDs:   collIDs,
+			SealIDs:         sealIDs,
+			ReceiptIDs:      receiptIDs,
+			ResultIDs:       resultsIDs,
+			ProtocolStateID: stateID,
 		}
 		return nil
 	}
diff --git a/storage/badger/protocol_state.go b/storage/badger/protocol_state.go
new file mode 100644
index 00000000000..101ed11104a
--- /dev/null
+++ b/storage/badger/protocol_state.go
@@ -0,0 +1,256 @@
+package badger
+
+import (
+	"fmt"
+
+	"github.com/dgraph-io/badger/v2"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/module"
+	"github.com/onflow/flow-go/module/irrecoverable"
+	"github.com/onflow/flow-go/module/metrics"
+	"github.com/onflow/flow-go/storage"
+	"github.com/onflow/flow-go/storage/badger/operation"
+	"github.com/onflow/flow-go/storage/badger/transaction"
+)
+
+// DefaultProtocolStateCacheSize is the default size for primary protocol state cache.
+// Minimally, we have 3 entries per epoch (one on epoch Switchover, one on receiving the Epoch Setup and one when seeing the Epoch Commit event).
+// Lets be generous and assume we have 20 different Protocol States per epoch.
+var DefaultProtocolStateCacheSize uint = 20
+
+// DefaultProtocolStateByBlockIDCacheSize is the default value for secondary byBlockIdCache.
+// We want to be able to cover a broad interval of views without cache misses, so we use a bigger value.
+var DefaultProtocolStateByBlockIDCacheSize uint = 1000
+
+// ProtocolState implements persistent storage for storing Protocol States.
+// Protocol state uses an embedded cache without storing capabilities(store happens on first retrieval) to avoid unnecessary
+// operations and to speed up access to frequently used Protocol State.
+type ProtocolState struct {
+	db *badger.DB
+
+	// cache is essentially an in-memory map from `ProtocolStateEntry.ID()` -> `RichProtocolStateEntry`
+	// We do _not_ populate this cache which holds the RichProtocolStateEntrys on store. This is because
+	//   (i) we don't have the RichProtocolStateEntry on store readily available and
+	//  (ii) new RichProtocolStateEntry are really rare throughout an epoch, so the total cost of populating
+	//       the cache becomes negligible over several views.
+	// In the future, we might want to populate the cache on store, if we want to maintain frequently-changing
+	// information in the protocol state, like the latest sealed block. This should be a smaller amount of work,
+	// because the `ProtocolStateEntry` is generated by `StateMutator.Build()`. The `StateMutator` should already
+	// have the needed Epoch Setup and Commit events, since it starts with a RichProtocolStateEntry for the parent
+	// state and consumes Epoch Setup and Epoch Commit events. Though, we leave this optimization for later.
+	//
+	// `cache` only holds the distinct Protocol States. On the happy path, we expect something like 3 entries per epoch.
+	// On the optimal happy path we have 3 entries per epoch: one entry on epoch Switchover, one on receiving the Epoch Setup
+	// and one when seeing the Epoch Commit event. Let's be generous and assume we have 20 different Protocol States per epoch.
+	// Beyond that, we are certainly leaving the domain of normal operations that we optimize for. Therefore, a cache size of
+	// roughly 100 is a reasonable balance between performance and memory consumption.
+	cache *Cache[flow.Identifier, *flow.RichProtocolStateEntry]
+
+	// byBlockIdCache is essentially an in-memory map from `Block.ID()` -> `ProtocolStateEntry.ID()`. The full
+	// Protocol state can be retrieved from the `cache` above.
+	// We populate the `byBlockIdCache` on store, because a new entry is added for every block and we probably also
+	// query the Protocol state for every block. So argument (ii) from above does not apply here. Furthermore,
+	// argument (i) from above also does not apply, because we already have the Protocol State's ID on store,
+	// so populating the cache is easy.
+	//
+	// `byBlockIdCache` will contain an entry for every block. We want to be able to cover a broad interval of views
+	// without cache misses, so a cache size of roughly 1000 entries is reasonable.
+	byBlockIdCache *Cache[flow.Identifier, flow.Identifier]
+}
+
+var _ storage.ProtocolState = (*ProtocolState)(nil)
+
+// NewProtocolState creates a ProtocolState instance, which is a database of Protocol State.
+// It supports storing, caching and retrieving by ID or the additionally indexed block ID.
+func NewProtocolState(collector module.CacheMetrics,
+	epochSetups storage.EpochSetups,
+	epochCommits storage.EpochCommits,
+	db *badger.DB,
+	stateCacheSize uint,
+	stateByBlockIDCacheSize uint,
+) *ProtocolState {
+	retrieveByProtocolStateID := func(protocolStateID flow.Identifier) func(tx *badger.Txn) (*flow.RichProtocolStateEntry, error) {
+		var protocolStateEntry flow.ProtocolStateEntry
+		return func(tx *badger.Txn) (*flow.RichProtocolStateEntry, error) {
+			err := operation.RetrieveProtocolState(protocolStateID, &protocolStateEntry)(tx)
+			if err != nil {
+				return nil, err
+			}
+			result, err := newRichProtocolStateEntry(&protocolStateEntry, epochSetups, epochCommits)
+			if err != nil {
+				return nil, fmt.Errorf("could not create rich protocol state entry: %w", err)
+			}
+			return result, nil
+		}
+	}
+
+	storeByBlockID := func(blockID flow.Identifier, protocolStateID flow.Identifier) func(*transaction.Tx) error {
+		return func(tx *transaction.Tx) error {
+			err := transaction.WithTx(operation.IndexProtocolState(blockID, protocolStateID))(tx)
+			if err != nil {
+				return fmt.Errorf("could not index protocol state for block (%x): %w", blockID[:], err)
+			}
+			return nil
+		}
+	}
+
+	retrieveByBlockID := func(blockID flow.Identifier) func(tx *badger.Txn) (flow.Identifier, error) {
+		return func(tx *badger.Txn) (flow.Identifier, error) {
+			var protocolStateID flow.Identifier
+			err := operation.LookupProtocolState(blockID, &protocolStateID)(tx)
+			if err != nil {
+				return flow.ZeroID, fmt.Errorf("could not lookup protocol state ID for block (%x): %w", blockID[:], err)
+			}
+			return protocolStateID, nil
+		}
+	}
+
+	return &ProtocolState{
+		db: db,
+		cache: newCache[flow.Identifier, *flow.RichProtocolStateEntry](collector, metrics.ResourceProtocolState,
+			withLimit[flow.Identifier, *flow.RichProtocolStateEntry](stateCacheSize),
+			withStore(noopStore[flow.Identifier, *flow.RichProtocolStateEntry]),
+			withRetrieve(retrieveByProtocolStateID)),
+		byBlockIdCache: newCache[flow.Identifier, flow.Identifier](collector, metrics.ResourceProtocolStateByBlockID,
+			withLimit[flow.Identifier, flow.Identifier](stateByBlockIDCacheSize),
+			withStore(storeByBlockID),
+			withRetrieve(retrieveByBlockID)),
+	}
+}
+
+// StoreTx returns an anonymous function (intended to be executed as part of a badger transaction),
+// which persists the given protocol state as part of a DB tx. Per convention, the identities in
+// the Protocol State must be in canonical order for the current and next epoch (if present),
+// otherwise an exception is returned.
+// Expected errors of the returned anonymous function:
+//   - storage.ErrAlreadyExists if a Protocol State with the given id is already stored
+func (s *ProtocolState) StoreTx(protocolStateID flow.Identifier, protocolState *flow.ProtocolStateEntry) func(*transaction.Tx) error {
+	// front-load sanity checks:
+	if !protocolState.CurrentEpoch.ActiveIdentities.Sorted(flow.IdentifierCanonical) {
+		return transaction.Fail(fmt.Errorf("sanity check failed: identities are not sorted"))
+	}
+	if protocolState.NextEpoch != nil && !protocolState.NextEpoch.ActiveIdentities.Sorted(flow.IdentifierCanonical) {
+		return transaction.Fail(fmt.Errorf("sanity check failed: next epoch identities are not sorted"))
+	}
+
+	// happy path: return anonymous function, whose future execution (as part of a transaction) will store the protocolState
+	return transaction.WithTx(operation.InsertProtocolState(protocolStateID, protocolState))
+}
+
+// Index returns an anonymous function that is intended to be executed as part of a database transaction.
+// In a nutshell, we want to maintain a map from `blockID` to `protocolStateID`, where `blockID` references the
+// block that _proposes_ the Protocol State.
+// Upon call, the anonymous function persists the specific map entry in the node's database.
+// Protocol convention:
+//   - Consider block B, whose ingestion might potentially lead to an updated protocol state. For example,
+//     the protocol state changes if we seal some execution results emitting service events.
+//   - For the key `blockID`, we use the identity of block B which _proposes_ this Protocol State. As value,
+//     the hash of the resulting protocol state at the end of processing B is to be used.
+//   - CAUTION: The protocol state requires confirmation by a QC and will only become active at the child block,
+//     _after_ validating the QC.
+//
+// Expected errors during normal operations:
+//   - storage.ErrAlreadyExists if a Protocol State for the given blockID has already been indexed
+func (s *ProtocolState) Index(blockID flow.Identifier, protocolStateID flow.Identifier) func(*transaction.Tx) error {
+	return s.byBlockIdCache.PutTx(blockID, protocolStateID)
+}
+
+// ByID returns the protocol state by its ID.
+// Expected errors during normal operations:
+//   - storage.ErrNotFound if no protocol state with the given Identifier is known.
+func (s *ProtocolState) ByID(protocolStateID flow.Identifier) (*flow.RichProtocolStateEntry, error) {
+	tx := s.db.NewTransaction(false)
+	defer tx.Discard()
+	return s.cache.Get(protocolStateID)(tx)
+}
+
+// ByBlockID retrieves the Protocol State that the block with the given ID proposes.
+// CAUTION: this protocol state requires confirmation by a QC and will only become active at the child block,
+// _after_ validating the QC. Protocol convention:
+//   - Consider block B, whose ingestion might potentially lead to an updated protocol state. For example,
+//     the protocol state changes if we seal some execution results emitting service events.
+//   - For the key `blockID`, we use the identity of block B which _proposes_ this Protocol State. As value,
+//     the hash of the resulting protocol state at the end of processing B is to be used.
+//   - CAUTION: The protocol state requires confirmation by a QC and will only become active at the child block,
+//     _after_ validating the QC.
+//
+// Expected errors during normal operations:
+//   - storage.ErrNotFound if no protocol state has been indexed for the given block.
+func (s *ProtocolState) ByBlockID(blockID flow.Identifier) (*flow.RichProtocolStateEntry, error) {
+	tx := s.db.NewTransaction(false)
+	defer tx.Discard()
+	protocolStateID, err := s.byBlockIdCache.Get(blockID)(tx)
+	if err != nil {
+		return nil, fmt.Errorf("could not lookup protocol state ID for block (%x): %w", blockID[:], err)
+	}
+	return s.cache.Get(protocolStateID)(tx)
+}
+
+// newRichProtocolStateEntry constructs a rich protocol state entry from a protocol state entry.
+// It queries and fills in epoch setups and commits for previous and current epochs and possibly next epoch.
+// No errors are expected during normal operation.
+func newRichProtocolStateEntry(
+	protocolState *flow.ProtocolStateEntry,
+	setups storage.EpochSetups,
+	commits storage.EpochCommits,
+) (*flow.RichProtocolStateEntry, error) {
+	var (
+		previousEpochSetup  *flow.EpochSetup
+		previousEpochCommit *flow.EpochCommit
+		nextEpochSetup      *flow.EpochSetup
+		nextEpochCommit     *flow.EpochCommit
+		err                 error
+	)
+	// query and fill in epoch setups and commits for previous and current epochs
+	if protocolState.PreviousEpoch != nil {
+		previousEpochSetup, err = setups.ByID(protocolState.PreviousEpoch.SetupID)
+		if err != nil {
+			return nil, fmt.Errorf("could not retrieve previous epoch setup: %w", err)
+		}
+		previousEpochCommit, err = commits.ByID(protocolState.PreviousEpoch.CommitID)
+		if err != nil {
+			return nil, fmt.Errorf("could not retrieve previous epoch commit: %w", err)
+		}
+	}
+
+	currentEpochSetup, err := setups.ByID(protocolState.CurrentEpoch.SetupID)
+	if err != nil {
+		return nil, fmt.Errorf("could not retrieve current epoch setup: %w", err)
+	}
+	currentEpochCommit, err := commits.ByID(protocolState.CurrentEpoch.CommitID)
+	if err != nil {
+		return nil, fmt.Errorf("could not retrieve current epoch commit: %w", err)
+	}
+
+	// if next epoch has been set up, fill in data for it as well
+	nextEpoch := protocolState.NextEpoch
+	if nextEpoch != nil {
+		nextEpochSetup, err = setups.ByID(nextEpoch.SetupID)
+		if err != nil {
+			return nil, fmt.Errorf("could not retrieve next epoch's setup event: %w", err)
+		}
+		if nextEpoch.CommitID != flow.ZeroID {
+			nextEpochCommit, err = commits.ByID(nextEpoch.CommitID)
+			if err != nil {
+				return nil, fmt.Errorf("could not retrieve next epoch's commit event: %w", err)
+			}
+		}
+	}
+
+	result, err := flow.NewRichProtocolStateEntry(
+		protocolState,
+		previousEpochSetup,
+		previousEpochCommit,
+		currentEpochSetup,
+		currentEpochCommit,
+		nextEpochSetup,
+		nextEpochCommit,
+	)
+	if err != nil {
+		// observing an error here would be an indication of severe data corruption or bug in our code since
+		// all data should be available and correctly structured at this point.
+		return nil, irrecoverable.NewExceptionf("critical failure while instantiating RichProtocolStateEntry: %w", err)
+	}
+	return result, nil
+}
diff --git a/storage/badger/protocol_state_test.go b/storage/badger/protocol_state_test.go
new file mode 100644
index 00000000000..19f288e01aa
--- /dev/null
+++ b/storage/badger/protocol_state_test.go
@@ -0,0 +1,274 @@
+package badger
+
+import (
+	"testing"
+
+	"github.com/dgraph-io/badger/v2"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/model/flow/mapfunc"
+	"github.com/onflow/flow-go/module/metrics"
+	"github.com/onflow/flow-go/storage/badger/transaction"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+// TestProtocolStateStorage tests if the protocol state is stored, retrieved and indexed correctly
+func TestProtocolStateStorage(t *testing.T) {
+	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
+		metrics := metrics.NewNoopCollector()
+
+		setups := NewEpochSetups(metrics, db)
+		commits := NewEpochCommits(metrics, db)
+		store := NewProtocolState(metrics, setups, commits, db, DefaultProtocolStateCacheSize, DefaultProtocolStateByBlockIDCacheSize)
+
+		expected := unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState())
+		protocolStateID := expected.ID()
+		blockID := unittest.IdentifierFixture()
+
+		// store protocol state and auxiliary info
+		err := transaction.Update(db, func(tx *transaction.Tx) error {
+			// store epoch events to be able to retrieve them later
+			err := setups.StoreTx(expected.PreviousEpochSetup)(tx)
+			require.NoError(t, err)
+			err = setups.StoreTx(expected.CurrentEpochSetup)(tx)
+			require.NoError(t, err)
+			err = setups.StoreTx(expected.NextEpochSetup)(tx)
+			require.NoError(t, err)
+			err = commits.StoreTx(expected.PreviousEpochCommit)(tx)
+			require.NoError(t, err)
+			err = commits.StoreTx(expected.CurrentEpochCommit)(tx)
+			require.NoError(t, err)
+			err = commits.StoreTx(expected.NextEpochCommit)(tx)
+			require.NoError(t, err)
+
+			err = store.StoreTx(protocolStateID, expected.ProtocolStateEntry)(tx)
+			require.NoError(t, err)
+			return store.Index(blockID, protocolStateID)(tx)
+		})
+		require.NoError(t, err)
+
+		// fetch protocol state
+		actual, err := store.ByID(protocolStateID)
+		require.NoError(t, err)
+		require.Equal(t, expected, actual)
+
+		assertRichProtocolStateValidity(t, actual)
+
+		// fetch protocol state by block ID
+		actualByBlockID, err := store.ByBlockID(blockID)
+		require.NoError(t, err)
+		require.Equal(t, expected, actualByBlockID)
+
+		assertRichProtocolStateValidity(t, actualByBlockID)
+	})
+}
+
+// TestProtocolStateStoreInvalidProtocolState tests that storing protocol state which has unsorted identities fails for
+// current and next epoch protocol states.
+func TestProtocolStateStoreInvalidProtocolState(t *testing.T) {
+	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
+		metrics := metrics.NewNoopCollector()
+		setups := NewEpochSetups(metrics, db)
+		commits := NewEpochCommits(metrics, db)
+		store := NewProtocolState(metrics, setups, commits, db, DefaultProtocolStateCacheSize, DefaultProtocolStateByBlockIDCacheSize)
+		invalid := unittest.ProtocolStateFixture().ProtocolStateEntry
+		// swap first and second elements to break canonical order
+		invalid.CurrentEpoch.ActiveIdentities[0], invalid.CurrentEpoch.ActiveIdentities[1] = invalid.CurrentEpoch.ActiveIdentities[1], invalid.CurrentEpoch.ActiveIdentities[0]
+
+		err := transaction.Update(db, store.StoreTx(invalid.ID(), invalid))
+		require.Error(t, err)
+
+		invalid = unittest.ProtocolStateFixture(unittest.WithNextEpochProtocolState()).ProtocolStateEntry
+		// swap first and second elements to break canonical order
+		invalid.NextEpoch.ActiveIdentities[0], invalid.NextEpoch.ActiveIdentities[1] = invalid.NextEpoch.ActiveIdentities[1], invalid.NextEpoch.ActiveIdentities[0]
+
+		err = transaction.Update(db, store.StoreTx(invalid.ID(), invalid))
+		require.Error(t, err)
+	})
+}
+
+// TestProtocolStateMergeParticipants tests that merging participants between epochs works correctly. We always take participants
+// from current epoch and additionally add participants from previous epoch if they are not present in current epoch.
+// If the same participant is in the previous and current epochs, we should see it only once in the merged list and the dynamic portion has to be from current epoch.
+func TestProtocolStateMergeParticipants(t *testing.T) {
+	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
+		metrics := metrics.NewNoopCollector()
+
+		setups := NewEpochSetups(metrics, db)
+		commits := NewEpochCommits(metrics, db)
+		store := NewProtocolState(metrics, setups, commits, db, DefaultProtocolStateCacheSize, DefaultProtocolStateByBlockIDCacheSize)
+
+		stateEntry := unittest.ProtocolStateFixture()
+		// change address of participant in current epoch, so we can distinguish it from the one in previous epoch
+		// when performing assertion.
+		newAddress := "123"
+		nodeID := stateEntry.CurrentEpochSetup.Participants[1].NodeID
+		stateEntry.CurrentEpochSetup.Participants[1].Address = newAddress
+		stateEntry.CurrentEpoch.SetupID = stateEntry.CurrentEpochSetup.ID()
+		identity, _ := stateEntry.CurrentEpochIdentityTable.ByNodeID(nodeID)
+		identity.Address = newAddress
+		protocolStateID := stateEntry.ID()
+
+		// store protocol state and auxiliary info
+		err := transaction.Update(db, func(tx *transaction.Tx) error {
+			// store epoch events to be able to retrieve them later
+			err := setups.StoreTx(stateEntry.PreviousEpochSetup)(tx)
+			require.NoError(t, err)
+			err = setups.StoreTx(stateEntry.CurrentEpochSetup)(tx)
+			require.NoError(t, err)
+			err = commits.StoreTx(stateEntry.PreviousEpochCommit)(tx)
+			require.NoError(t, err)
+			err = commits.StoreTx(stateEntry.CurrentEpochCommit)(tx)
+			require.NoError(t, err)
+
+			return store.StoreTx(protocolStateID, stateEntry.ProtocolStateEntry)(tx)
+		})
+		require.NoError(t, err)
+
+		// fetch protocol state
+		actual, err := store.ByID(protocolStateID)
+		require.NoError(t, err)
+		require.Equal(t, stateEntry, actual)
+
+		assertRichProtocolStateValidity(t, actual)
+		identity, ok := actual.CurrentEpochIdentityTable.ByNodeID(nodeID)
+		require.True(t, ok)
+		require.Equal(t, newAddress, identity.Address)
+	})
+}
+
+// TestProtocolStateRootSnapshot tests that storing and retrieving root protocol state (in case of bootstrap) works as expected.
+// Specifically, this means that no prior epoch exists (situation after a spork) from the perspective of the freshly-sporked network.
+func TestProtocolStateRootSnapshot(t *testing.T) {
+	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
+		metrics := metrics.NewNoopCollector()
+
+		setups := NewEpochSetups(metrics, db)
+		commits := NewEpochCommits(metrics, db)
+		store := NewProtocolState(metrics, setups, commits, db, DefaultProtocolStateCacheSize, DefaultProtocolStateByBlockIDCacheSize)
+		expected := unittest.RootProtocolStateFixture()
+
+		protocolStateID := expected.ID()
+		blockID := unittest.IdentifierFixture()
+
+		// store protocol state and auxiliary info
+		err := transaction.Update(db, func(tx *transaction.Tx) error {
+			// store epoch events to be able to retrieve them later
+			err := setups.StoreTx(expected.CurrentEpochSetup)(tx)
+			require.NoError(t, err)
+			err = commits.StoreTx(expected.CurrentEpochCommit)(tx)
+			require.NoError(t, err)
+
+			err = store.StoreTx(protocolStateID, expected.ProtocolStateEntry)(tx)
+			require.NoError(t, err)
+			return store.Index(blockID, protocolStateID)(tx)
+		})
+		require.NoError(t, err)
+
+		// fetch protocol state
+		actual, err := store.ByID(protocolStateID)
+		require.NoError(t, err)
+		require.Equal(t, expected, actual)
+
+		assertRichProtocolStateValidity(t, actual)
+
+		// fetch protocol state by block ID
+		actualByBlockID, err := store.ByBlockID(blockID)
+		require.NoError(t, err)
+		require.Equal(t, expected, actualByBlockID)
+
+		assertRichProtocolStateValidity(t, actualByBlockID)
+	})
+}
+
+// assertRichProtocolStateValidity checks if RichProtocolState holds its invariant and is correctly populated by storage layer.
+func assertRichProtocolStateValidity(t *testing.T, state *flow.RichProtocolStateEntry) {
+	// invariants:
+	//  - CurrentEpochSetup and CurrentEpochCommit are for the same epoch. Never nil.
+	//  - CurrentEpochSetup and CurrentEpochCommit IDs match respective commitments in the `ProtocolStateEntry`.
+	assert.Equal(t, state.CurrentEpochSetup.Counter, state.CurrentEpochCommit.Counter, "current epoch setup and commit should be for the same epoch")
+	assert.Equal(t, state.CurrentEpochSetup.ID(), state.ProtocolStateEntry.CurrentEpoch.SetupID, "epoch setup should be for correct event ID")
+	assert.Equal(t, state.CurrentEpochCommit.ID(), state.ProtocolStateEntry.CurrentEpoch.CommitID, "epoch commit should be for correct event ID")
+
+	var (
+		previousEpochParticipants flow.IdentityList
+		err                       error
+	)
+	// invariant: PreviousEpochSetup and PreviousEpochCommit should be present if respective ID is not zero.
+	if state.PreviousEpoch != nil {
+		// invariant: PreviousEpochSetup and PreviousEpochCommit are for the same epoch. Never nil.
+		assert.Equal(t, state.PreviousEpochSetup.Counter+1, state.CurrentEpochSetup.Counter, "current epoch (%d) should be following right after previous epoch (%d)", state.CurrentEpochSetup.Counter, state.PreviousEpochSetup.Counter)
+		assert.Equal(t, state.PreviousEpochSetup.Counter, state.PreviousEpochCommit.Counter, "previous epoch setup and commit should be for the same epoch")
+
+		// invariant: PreviousEpochSetup and PreviousEpochCommit IDs are the equal to the ID of the protocol state entry. Never nil.
+		assert.Equal(t, state.PreviousEpochSetup.ID(), state.ProtocolStateEntry.PreviousEpoch.SetupID, "epoch setup should be for correct event ID")
+		assert.Equal(t, state.PreviousEpochCommit.ID(), state.ProtocolStateEntry.PreviousEpoch.CommitID, "epoch commit should be for correct event ID")
+
+		// invariant: ComposeFullIdentities ensures that we can build full identities of previous epoch's active participants. This step also confirms that the
+		// previous epoch's `Participants` [IdentitySkeletons] and `ActiveIdentities` [DynamicIdentity properties] list the same nodes in canonical ordering.
+		previousEpochParticipants, err = flow.ComposeFullIdentities(
+			state.PreviousEpochSetup.Participants,
+			state.PreviousEpoch.ActiveIdentities,
+			flow.EpochParticipationStatusActive,
+		)
+		assert.NoError(t, err, "should be able to reconstruct previous epoch active participants")
+		// Function `ComposeFullIdentities` verified that `Participants` and `ActiveIdentities` have identical ordering w.r.t nodeID.
+		// By construction, `participantsFromCurrentEpochSetup` lists the full Identities in the same ordering as `Participants` and
+		// `ActiveIdentities`. By confirming that `participantsFromCurrentEpochSetup` follows canonical ordering, we can conclude that
+		// also `Participants` and `ActiveIdentities` are canonically ordered.
+		require.True(t, previousEpochParticipants.Sorted(flow.Canonical[flow.Identity]), "participants in previous epoch's setup event are not in canonical order")
+	}
+
+	// invariant: ComposeFullIdentities ensures that we can build full identities of current epoch's *active* participants. This step also confirms that the
+	// current epoch's `Participants` [IdentitySkeletons] and `ActiveIdentities` [DynamicIdentity properties] list the same nodes in canonical ordering.
+	participantsFromCurrentEpochSetup, err := flow.ComposeFullIdentities(
+		state.CurrentEpochSetup.Participants,
+		state.CurrentEpoch.ActiveIdentities,
+		flow.EpochParticipationStatusActive,
+	)
+	assert.NoError(t, err, "should be able to reconstruct current epoch active participants")
+	require.True(t, participantsFromCurrentEpochSetup.Sorted(flow.Canonical[flow.Identity]), "participants in current epoch's setup event are not in canonical order")
+
+	// invariants for `CurrentEpochIdentityTable`:
+	//  - full identity table containing *active* nodes for the current epoch + weight-zero identities of adjacent epoch
+	//  - Identities are sorted in canonical order. Without duplicates. Never nil.
+	var allIdentities, participantsFromNextEpochSetup flow.IdentityList
+	if state.NextEpoch != nil {
+		// setup/commit phase
+		// invariant: ComposeFullIdentities ensures that we can build full identities of next epoch's *active* participants. This step also confirms that the
+		// next epoch's `Participants` [IdentitySkeletons] and `ActiveIdentities` [DynamicIdentity properties] list the same nodes in canonical ordering.
+		participantsFromNextEpochSetup, err = flow.ComposeFullIdentities(
+			state.NextEpochSetup.Participants,
+			state.NextEpoch.ActiveIdentities,
+			flow.EpochParticipationStatusActive,
+		)
+		assert.NoError(t, err, "should be able to reconstruct next epoch active participants")
+		allIdentities = participantsFromCurrentEpochSetup.Union(participantsFromNextEpochSetup.Copy().Map(mapfunc.WithEpochParticipationStatus(flow.EpochParticipationStatusJoining)))
+	} else {
+		// staking phase
+		allIdentities = participantsFromCurrentEpochSetup.Union(previousEpochParticipants.Copy().Map(mapfunc.WithEpochParticipationStatus(flow.EpochParticipationStatusLeaving)))
+	}
+	assert.Equal(t, allIdentities, state.CurrentEpochIdentityTable, "identities should be a full identity table for the current epoch, without duplicates")
+	require.True(t, allIdentities.Sorted(flow.Canonical[flow.Identity]), "current epoch's identity table is not in canonical order")
+
+	// check next epoch; only applicable during setup/commit phase
+	if state.NextEpoch == nil { // during staking phase, next epoch is not yet specified; hence there is nothing else to check
+		return
+	}
+
+	// invariants:
+	//  - NextEpochSetup and NextEpochCommit are for the same epoch. Never nil.
+	//  - NextEpochSetup and NextEpochCommit IDs match respective commitments in the `ProtocolStateEntry`.
+	assert.Equal(t, state.CurrentEpochSetup.Counter+1, state.NextEpochSetup.Counter, "next epoch (%d) should be following right after current epoch (%d)", state.NextEpochSetup.Counter, state.CurrentEpochSetup.Counter)
+	assert.Equal(t, state.NextEpochSetup.Counter, state.NextEpochCommit.Counter, "next epoch setup and commit should be for the same epoch")
+	assert.Equal(t, state.NextEpochSetup.ID(), state.NextEpoch.SetupID, "epoch setup should be for correct event ID")
+	assert.Equal(t, state.NextEpochCommit.ID(), state.NextEpoch.CommitID, "epoch commit should be for correct event ID")
+
+	// invariants for `NextEpochIdentityTable`:
+	//  - full identity table containing *active* nodes for next epoch + weight-zero identities of current epoch
+	//  - Identities are sorted in canonical order. Without duplicates. Never nil.
+	allIdentities = participantsFromNextEpochSetup.Union(participantsFromCurrentEpochSetup.Copy().Map(mapfunc.WithEpochParticipationStatus(flow.EpochParticipationStatusLeaving)))
+	assert.Equal(t, allIdentities, state.NextEpochIdentityTable, "identities should be a full identity table for the next epoch, without duplicates")
+}
diff --git a/storage/badger/seals.go b/storage/badger/seals.go
index 5ae5cbe71af..064ce3d3d54 100644
--- a/storage/badger/seals.go
+++ b/storage/badger/seals.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package badger
 
 import (
diff --git a/storage/badger/transaction/deferred_update.go b/storage/badger/transaction/deferred_update.go
new file mode 100644
index 00000000000..8b2d7badd18
--- /dev/null
+++ b/storage/badger/transaction/deferred_update.go
@@ -0,0 +1,188 @@
+package transaction
+
+import (
+	"github.com/dgraph-io/badger/v2"
+)
+
+// DeferredDBUpdate is a shorthand notation for an anonymous function that takes
+// a `transaction.Tx` as input and runs some database operations as part of that transaction.
+type DeferredDBUpdate = func(*Tx) error
+
+// DeferredBadgerUpdate is a shorthand notation for an anonymous function that takes
+// a badger transaction as input and runs some database operations as part of that transaction.
+type DeferredBadgerUpdate = func(*badger.Txn) error
+
+// DeferredDbOps is a utility for accumulating deferred database interactions that
+// are supposed to be executed in one atomic transaction. It supports:
+//   - Deferred database operations that work directly on Badger transactions.
+//   - Deferred database operations that work on `transaction.Tx`.
+//     Tx is a storage-layer abstraction, with support for callbacks that are executed
+//     after the underlying database transaction completed _successfully_.
+//
+// ORDER OF EXECUTION
+// We extend the process in which `transaction.Tx` executes database operations, schedules
+// callbacks, and executed the callbacks. Specifically, DeferredDbOps proceeds as follows:
+//
+//  0. Record functors added via `AddBadgerOp`, `AddDbOp`, `OnSucceed` ...
+//     • some functor's may schedule callbacks (depending on their type), which are executed
+//     after the underlying database transaction completed _successfully_.
+//     • `OnSucceed` is treated exactly the same way:
+//     it schedules a callback during its execution, but it has no database actions.
+//  1. Execute the functors in the order they were added
+//  2. During each functor's execution:
+//     • some functor's may schedule callbacks (depending on their type)
+//     • record those callbacks in the order they are scheduled (no execution yet)
+//  3. If and only if the underlying database transaction succeeds, run the callbacks
+//
+// DESIGN PATTERN
+//   - DeferredDbOps is stateful, i.e. it needs to be passed as pointer variable.
+//   - Do not instantiate Tx directly. Instead, use one of the following
+//     transaction.Update(db, DeferredDbOps.Pending())
+//     transaction.View(db, DeferredDbOps.Pending())
+//     operation.RetryOnConflictTx(db, transaction.Update, DeferredDbOps.Pending())
+//
+// NOT CONCURRENCY SAFE
+type DeferredDbOps struct {
+	pending DeferredDBUpdate
+}
+
+// NewDeferredDbOps instantiates a DeferredDbOps. Initially, it behaves like a no-op until functors are added.
+func NewDeferredDbOps() *DeferredDbOps {
+	return &DeferredDbOps{
+		pending: func(tx *Tx) error { return nil }, // initially nothing is pending, i.e. no-op
+	}
+}
+
+// Pending returns a DeferredDBUpdate that includes all database operations and callbacks
+// that were added so far. Caution, DeferredDbOps keeps its internal state of deferred operations.
+// Pending() can be called multiple times, but should only be executed in a database transaction
+// once to avoid conflicts.
+func (d *DeferredDbOps) Pending() DeferredDBUpdate {
+	return d.pending
+}
+
+// AddBadgerOp schedules the given DeferredBadgerUpdate to be executed as part of the future transaction.
+// For adding multiple DeferredBadgerUpdates, use `AddBadgerOps(ops ...DeferredBadgerUpdate)` if easily possible, as
+// it reduces the call stack compared to adding the functors individually via `AddBadgerOp(op DeferredBadgerUpdate)`.
+// This method returns a self-reference for chaining.
+func (d *DeferredDbOps) AddBadgerOp(op DeferredBadgerUpdate) *DeferredDbOps {
+	prior := d.pending
+	d.pending = func(tx *Tx) error {
+		err := prior(tx)
+		if err != nil {
+			return err
+		}
+		err = op(tx.DBTxn)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+	return d
+}
+
+// AddBadgerOps schedules the given DeferredBadgerUpdates to be executed as part of the future transaction.
+// This method returns a self-reference for chaining.
+func (d *DeferredDbOps) AddBadgerOps(ops ...DeferredBadgerUpdate) *DeferredDbOps {
+	if len(ops) < 1 {
+		return d
+	}
+
+	prior := d.pending
+	d.pending = func(tx *Tx) error {
+		err := prior(tx)
+		if err != nil {
+			return err
+		}
+		for _, op := range ops {
+			err = op(tx.DBTxn)
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+	return d
+}
+
+// AddDbOp schedules the given DeferredDBUpdate to be executed as part of the future transaction.
+// For adding multiple DeferredBadgerUpdates, use `AddDbOps(ops ...DeferredDBUpdate)` if easily possible, as
+// it reduces the call stack compared to adding the functors individually via `AddDbOp(op DeferredDBUpdate)`.
+// This method returns a self-reference for chaining.
+func (d *DeferredDbOps) AddDbOp(op DeferredDBUpdate) *DeferredDbOps {
+	prior := d.pending
+	d.pending = func(tx *Tx) error {
+		err := prior(tx)
+		if err != nil {
+			return err
+		}
+		err = op(tx)
+		if err != nil {
+			return err
+		}
+		return nil
+	}
+	return d
+}
+
+// AddDbOps schedules the given DeferredDBUpdates to be executed as part of the future transaction.
+// This method returns a self-reference for chaining.
+func (d *DeferredDbOps) AddDbOps(ops ...DeferredDBUpdate) *DeferredDbOps {
+	if len(ops) < 1 {
+		return d
+	}
+
+	prior := d.pending
+	d.pending = func(tx *Tx) error {
+		err := prior(tx)
+		if err != nil {
+			return err
+		}
+		for _, op := range ops {
+			err = op(tx)
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+	return d
+}
+
+// OnSucceed adds a callback to be executed after the deferred database operations have succeeded. For
+// adding multiple callbacks, use `OnSucceeds(callbacks ...func())` if easily possible, as it reduces
+// the call stack compared to adding the functors individually via `OnSucceed(callback func())`.
+// This method returns a self-reference for chaining.
+func (d *DeferredDbOps) OnSucceed(callback func()) *DeferredDbOps {
+	prior := d.pending
+	d.pending = func(tx *Tx) error {
+		err := prior(tx)
+		if err != nil {
+			return err
+		}
+		tx.OnSucceed(callback)
+		return nil
+	}
+	return d
+}
+
+// OnSucceeds adds callbacks to be executed after the deferred database operations have succeeded.
+// This method returns a self-reference for chaining.
+func (d *DeferredDbOps) OnSucceeds(callbacks ...func()) *DeferredDbOps {
+	if len(callbacks) < 1 {
+		return d
+	}
+
+	prior := d.pending
+	d.pending = func(tx *Tx) error {
+		err := prior(tx)
+		if err != nil {
+			return err
+		}
+		for _, c := range callbacks {
+			tx.OnSucceed(c)
+		}
+		return nil
+	}
+	return d
+}
diff --git a/storage/badger/transaction/deferred_update_test.go b/storage/badger/transaction/deferred_update_test.go
new file mode 100644
index 00000000000..18125fbdfb0
--- /dev/null
+++ b/storage/badger/transaction/deferred_update_test.go
@@ -0,0 +1,260 @@
+package transaction_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/dgraph-io/badger/v2"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/storage/badger/transaction"
+	"github.com/onflow/flow-go/utils/unittest"
+)
+
+// TestEmpty verifies that DeferredDbOps behaves like a no-op if nothing is scheduled
+func TestEmpty(t *testing.T) {
+	deferredDbOps := transaction.NewDeferredDbOps()
+	// deferredDbOps.Pending() should be a no-op and therefore not care that transaction.Tx is nil
+	err := deferredDbOps.Pending()(nil)
+	require.NoError(t, err)
+}
+
+// TestAddBaderOp adds 1 or 2 DeferredBadgerUpdate(s) and verifies that they are executed in the expected order
+func Test_AddBaderOp(t *testing.T) {
+	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
+		t.Run("single DeferredBadgerUpdate", func(t *testing.T) {
+			m := NewCallMonitor(t)
+			deferredDbOps := transaction.NewDeferredDbOps().
+				AddBadgerOp(m.MakeBadgerUpdate())
+			err := transaction.Update(db, deferredDbOps.Pending())
+			require.NoError(t, err)
+		})
+
+		t.Run("two DeferredBadgerUpdates added individually", func(t *testing.T) {
+			m := NewCallMonitor(t)
+			deferredDbOps := transaction.NewDeferredDbOps().
+				AddBadgerOp(m.MakeBadgerUpdate()).
+				AddBadgerOp(m.MakeBadgerUpdate())
+			err := transaction.Update(db, deferredDbOps.Pending())
+			require.NoError(t, err)
+		})
+
+		t.Run("two DeferredBadgerUpdates added as a sequence", func(t *testing.T) {
+			m := NewCallMonitor(t)
+			deferredDbOps := transaction.NewDeferredDbOps()
+			deferredDbOps.AddBadgerOps(
+				m.MakeBadgerUpdate(),
+				m.MakeBadgerUpdate())
+			err := transaction.Update(db, deferredDbOps.Pending())
+			require.NoError(t, err)
+		})
+	})
+}
+
+// TestDbOp adds 1 or 2 DeferredDBUpdate(s) and verifies that they are executed in the expected order
+func Test_AddDbOp(t *testing.T) {
+	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
+		t.Run("single DeferredDBUpdate without callback", func(t *testing.T) {
+			m := NewCallMonitor(t)
+			deferredDbOps := transaction.NewDeferredDbOps().
+				AddDbOp(m.MakeDBUpdate(0))
+			err := transaction.Update(db, deferredDbOps.Pending())
+			require.NoError(t, err)
+		})
+
+		t.Run("single DeferredDBUpdate with one callback", func(t *testing.T) {
+			m := NewCallMonitor(t)
+			deferredDbOps := transaction.NewDeferredDbOps().
+				AddDbOp(m.MakeDBUpdate(1))
+			err := transaction.Update(db, deferredDbOps.Pending())
+			require.NoError(t, err)
+		})
+
+		t.Run("single DeferredDBUpdate with multiple callbacks", func(t *testing.T) {
+			m := NewCallMonitor(t)
+			deferredDbOps := transaction.NewDeferredDbOps().
+				AddDbOp(m.MakeDBUpdate(21))
+			err := transaction.Update(db, deferredDbOps.Pending())
+			require.NoError(t, err)
+		})
+
+		t.Run("two DeferredDBUpdates added individually", func(t *testing.T) {
+			m := NewCallMonitor(t)
+			deferredDbOps := transaction.NewDeferredDbOps().
+				AddDbOp(m.MakeDBUpdate(17)).
+				AddDbOp(m.MakeDBUpdate(0))
+			err := transaction.Update(db, deferredDbOps.Pending())
+			require.NoError(t, err)
+		})
+
+		t.Run("two DeferredDBUpdates added as a sequence", func(t *testing.T) {
+			m := NewCallMonitor(t)
+			deferredDbOps := transaction.NewDeferredDbOps()
+			deferredDbOps.AddDbOps(
+				m.MakeDBUpdate(0),
+				m.MakeDBUpdate(17))
+			err := transaction.Update(db, deferredDbOps.Pending())
+			require.NoError(t, err)
+		})
+	})
+}
+
+// Test_AddOnSucceedCallback adds 1 or 2 callback(s) and verifies that they are executed in the expected order
+func Test_AddOnSucceedCallback(t *testing.T) {
+	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
+		t.Run("single callback", func(t *testing.T) {
+			m := NewCallMonitor(t)
+			deferredDbOps := transaction.NewDeferredDbOps().
+				OnSucceed(m.MakeCallback())
+			err := transaction.Update(db, deferredDbOps.Pending())
+			require.NoError(t, err)
+		})
+
+		t.Run("two callbacks added individually", func(t *testing.T) {
+			m := NewCallMonitor(t)
+			deferredDbOps := transaction.NewDeferredDbOps().
+				OnSucceed(m.MakeCallback()).
+				OnSucceed(m.MakeCallback())
+			err := transaction.Update(db, deferredDbOps.Pending())
+			require.NoError(t, err)
+		})
+
+		t.Run("many callbacks added as a sequence", func(t *testing.T) {
+			m := NewCallMonitor(t)
+			deferredDbOps := transaction.NewDeferredDbOps().
+				OnSucceeds(m.MakeCallbacks(11)...)
+			err := transaction.Update(db, deferredDbOps.Pending())
+			require.NoError(t, err)
+		})
+	})
+}
+
+// Test_EverythingMixed uses all ways to add functors in combination and verifies that they are executed in the expected order
+func Test_EverythingMixed(t *testing.T) {
+	unittest.RunWithBadgerDB(t, func(db *badger.DB) {
+		m := NewCallMonitor(t)
+		deferredDbOps := transaction.NewDeferredDbOps().
+			OnSucceed(m.MakeCallback()).
+			AddDbOp(m.MakeDBUpdate(1)).
+			AddBadgerOp(m.MakeBadgerUpdate()).
+			OnSucceeds(m.MakeCallbacks(3)...).
+			AddDbOp(m.MakeDBUpdate(0)).
+			AddBadgerOps(
+				m.MakeBadgerUpdate(),
+				m.MakeBadgerUpdate(),
+				m.MakeBadgerUpdate()).
+			OnSucceeds(
+				m.MakeCallback(),
+				m.MakeCallback()).
+			AddDbOps(
+				m.MakeDBUpdate(7),
+				m.MakeDBUpdate(0),
+				m.MakeDBUpdate(1)).
+			OnSucceed(m.MakeCallback())
+		err := transaction.Update(db, deferredDbOps.Pending())
+		require.NoError(t, err)
+	})
+}
+
+/* ***************************************** Testing Utility CallMonitor ***************************************** */
+
+// CallMonitor is a utility for testing that DeferredDbOps calls its input functors and callbacks
+// in the correct order. DeferredDbOps is expected to proceed as follows:
+//
+//  0. Record functors added via `AddBadgerOp`, `AddDbOp`, `OnSucceed` ...
+//  1. Execute the functors in the order they were added
+//  2. During each functor's execution:
+//     - some functor's may schedule callbacks (depending on their type)
+//     - record those callbacks in the order they are scheduled (no execution yet)
+//     `OnSucceed` schedules its callback during its execution at this step as well
+//  3. If and only if the underlying database transaction _successfully_ completed, run the callbacks
+//
+// To verify the correct order of calls, the CallMonitor generates functors. Each functor has a
+// dedicated index value. When the functor is called, it checks that its index matches the functor index
+// that the CallMonitor expects to be executed next. For callbacks, we proceed analogously.
+//
+// Usage note:
+// The call CallMonitor assumes that functors are added to DeferredDbOps exactly in the order that
+// CallMonitor generates them. This works very intuitively, when the tests proceed as in the following example:
+//
+//	m := NewCallMonitor(t)
+//	deferredDbOps := transaction.NewDeferredDbOps()
+//	deferredDbOps.AddBadgerOp(m.MakeBadgerUpdate()) // here, we add the functor right when it is generated
+//	transaction.Update(db, deferredDbOps.Pending())
+type CallMonitor struct {
+	generatedTxFunctors int
+	generatedCallbacks  int
+
+	T                        *testing.T
+	nextExpectedTxFunctorIdx int
+	nextExpectedCallbackIdx  int
+}
+
+func NewCallMonitor(t *testing.T) *CallMonitor {
+	return &CallMonitor{T: t}
+}
+
+func (cm *CallMonitor) MakeDBUpdate(withCallbacks int) transaction.DeferredDBUpdate {
+	myFunctorIdx := cm.generatedTxFunctors       // copy into local scope. Determined when we construct functor
+	callbacks := cm.MakeCallbacks(withCallbacks) // pre-generate callback functors
+	functor := func(tx *transaction.Tx) error {
+		for _, c := range callbacks {
+			tx.OnSucceed(c) // schedule callback
+		}
+		if cm.nextExpectedTxFunctorIdx != myFunctorIdx {
+			// nextExpectedTxFunctorIdx holds the Index of the Functor that was generated next. DeferredDbOps
+			// should execute the functors in the order they were added, which is violated. Hence, we fail:
+			cm.T.Errorf("expected next Functor Index is %d but my value is %d", cm.nextExpectedTxFunctorIdx, myFunctorIdx)
+			return fmt.Errorf("expected next Functor Index is %d but my value is %d", cm.nextExpectedTxFunctorIdx, myFunctorIdx)
+		}
+
+		// happy path:
+		cm.nextExpectedTxFunctorIdx += 1
+		return nil
+	}
+
+	cm.generatedTxFunctors += 1
+	return functor
+}
+
+func (cm *CallMonitor) MakeBadgerUpdate() transaction.DeferredBadgerUpdate {
+	myFunctorIdx := cm.generatedTxFunctors // copy into local scope. Determined when we construct functor
+	functor := func(tx *badger.Txn) error {
+		if cm.nextExpectedTxFunctorIdx != myFunctorIdx {
+			// nextExpectedTxFunctorIdx holds the Index of the Functor that was generated next. DeferredDbOps
+			// should execute the functors in the order they were added, which is violated. Hence, we fail:
+			cm.T.Errorf("expected next Functor Index is %d but my value is %d", cm.nextExpectedTxFunctorIdx, myFunctorIdx)
+			return fmt.Errorf("expected next Functor Index is %d but my value is %d", cm.nextExpectedTxFunctorIdx, myFunctorIdx)
+		}
+
+		// happy path:
+		cm.nextExpectedTxFunctorIdx += 1
+		return nil
+	}
+
+	cm.generatedTxFunctors += 1
+	return functor
+}
+
+func (cm *CallMonitor) MakeCallback() func() {
+	myFunctorIdx := cm.generatedCallbacks // copy into local scope. Determined when we construct callback
+	functor := func() {
+		if cm.nextExpectedCallbackIdx != myFunctorIdx {
+			// nextExpectedCallbackIdx holds the Index of the callback that was generated next. DeferredDbOps
+			// should execute the callback in the order they were scheduled, which is violated. Hence, we fail:
+			cm.T.Errorf("expected next Callback Index is %d but my value is %d", cm.nextExpectedCallbackIdx, myFunctorIdx)
+		}
+		cm.nextExpectedCallbackIdx += 1 // happy path
+	}
+
+	cm.generatedCallbacks += 1
+	return functor
+}
+
+func (cm *CallMonitor) MakeCallbacks(numberCallbacks int) []func() {
+	callbacks := make([]func(), 0, numberCallbacks)
+	for ; 0 < numberCallbacks; numberCallbacks-- {
+		callbacks = append(callbacks, cm.MakeCallback())
+	}
+	return callbacks
+}
diff --git a/storage/badger/transaction/tx.go b/storage/badger/transaction/tx.go
index 4235389ad6d..827f183d110 100644
--- a/storage/badger/transaction/tx.go
+++ b/storage/badger/transaction/tx.go
@@ -6,26 +6,68 @@ import (
 	ioutils "github.com/onflow/flow-go/utils/io"
 )
 
+// Tx wraps a badger transaction and includes and additional slice for callbacks.
+// The callbacks are executed after the badger transaction completed _successfully_.
+// DESIGN PATTERN
+//   - DBTxn should never be nil
+//   - at initialization, `callbacks` is empty
+//   - While business logic code operates on `DBTxn`, it can append additional callbacks
+//     via the `OnSucceed` method. This generally happens during the transaction execution.
+//
+// CAUTION:
+//   - Tx is stateful (calls to `OnSucceed` change its internal state).
+//     Therefore, Tx needs to be passed as pointer variable.
+//   - Do not instantiate Tx outside of this package. Instead, use `Update` or `View`
+//     functions.
+//   - Whether a transaction is considered to have succeeded depends only on the return value
+//     of the outermost function. For example, consider a chain of 3 functions: f3( f2( f1(x)))
+//     Lets assume f1 fails with an `storage.ErrAlreadyExists` sentinel, which f2 expects and
+//     therefore discards. f3 could then succeed, i.e. return nil.
+//     Consequently, the entire list of callbacks is executed, including f1's callback if it
+//     added one. Callback implementations therefore need to account for this edge case.
+//   - not concurrency safe
 type Tx struct {
 	DBTxn     *dbbadger.Txn
 	callbacks []func()
 }
 
-// OnSucceed adds a callback to execute after the batch has
-// been successfully flushed.
-// useful for implementing the cache where we will only cache
-// after the batch has been successfully flushed
+// OnSucceed adds a callback to execute after the batch has been successfully flushed.
+// Useful for implementing the cache where we will only cache after the batch of database
+// operations has been successfully applied.
+// CAUTION:
+// Whether a transaction is considered to have succeeded depends only on the return value
+// of the outermost function. For example, consider a chain of 3 functions: f3( f2( f1(x)))
+// Lets assume f1 fails with an `storage.ErrAlreadyExists` sentinel, which f2 expects and
+// therefore discards. f3 could then succeed, i.e. return nil.
+// Consequently, the entire list of callbacks is executed, including f1's callback if it
+// added one. Callback implementations therefore need to account for this edge case.
 func (b *Tx) OnSucceed(callback func()) {
 	b.callbacks = append(b.callbacks, callback)
 }
 
-// Update creates a badger transaction, passing it to a chain of functions,
-// if all succeed. Useful to use callback to update cache in order to ensure data
-// in badgerDB and cache are consistent.
+// Update creates a badger transaction, passing it to a chain of functions.
+// Only if transaction succeeds, we run `callbacks` that were appended during the
+// transaction execution. The callbacks are useful update caches in order to reduce
+// cache misses.
 func Update(db *dbbadger.DB, f func(*Tx) error) error {
 	dbTxn := db.NewTransaction(true)
-	defer dbTxn.Discard()
+	err := run(f, dbTxn)
+	dbTxn.Discard()
+	return err
+}
+
+// View creates a read-only badger transaction, passing it to a chain of functions.
+// Only if transaction succeeds, we run `callbacks` that were appended during the
+// transaction execution. The callbacks are useful update caches in order to reduce
+// cache misses.
+func View(db *dbbadger.DB, f func(*Tx) error) error {
+	dbTxn := db.NewTransaction(false)
+	err := run(f, dbTxn)
+	dbTxn.Discard()
+	return err
+}
 
+func run(f func(*Tx) error, dbTxn *dbbadger.Txn) error {
 	tx := &Tx{DBTxn: dbTxn}
 	err := f(tx)
 	if err != nil {
@@ -43,6 +85,16 @@ func Update(db *dbbadger.DB, f func(*Tx) error) error {
 	return nil
 }
 
+// Fail returns an anonymous function, whose future execution returns the error e. This
+// is useful for front-loading sanity checks. On the happy path (dominant), this function
+// will generally not be used. However, if one of the front-loaded sanity checks fails,
+// we include `transaction.Fail(e)` in place of the business logic handling the happy path.
+func Fail(e error) func(*Tx) error {
+	return func(tx *Tx) error {
+		return e
+	}
+}
+
 // WithTx is useful when transaction is used without adding callback.
 func WithTx(f func(*dbbadger.Txn) error) func(*Tx) error {
 	return func(tx *Tx) error {
diff --git a/storage/blocks.go b/storage/blocks.go
index 506588e4869..965aae1df6d 100644
--- a/storage/blocks.go
+++ b/storage/blocks.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package storage
 
 import (
diff --git a/storage/epoch_commits.go b/storage/epoch_commits.go
index 97c23ca99a9..5dffa581a3a 100644
--- a/storage/epoch_commits.go
+++ b/storage/epoch_commits.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package storage
 
 import (
diff --git a/storage/epoch_setups.go b/storage/epoch_setups.go
index d5023e68579..2cb88f8c2cc 100644
--- a/storage/epoch_setups.go
+++ b/storage/epoch_setups.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package storage
 
 import (
diff --git a/storage/epoch_statuses.go b/storage/epoch_statuses.go
deleted file mode 100644
index 45b591cb0ae..00000000000
--- a/storage/epoch_statuses.go
+++ /dev/null
@@ -1,19 +0,0 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
-package storage
-
-import (
-	"github.com/onflow/flow-go/model/flow"
-	"github.com/onflow/flow-go/storage/badger/transaction"
-)
-
-type EpochStatuses interface {
-
-	// StoreTx stores a new epoch state in a DB transaction while going through the cache.
-	StoreTx(blockID flow.Identifier, state *flow.EpochStatus) func(*transaction.Tx) error
-
-	// ByBlockID will return the epoch status for the given block
-	// Error returns:
-	// * storage.ErrNotFound if EpochStatus for the block does not exist
-	ByBlockID(flow.Identifier) (*flow.EpochStatus, error)
-}
diff --git a/storage/headers.go b/storage/headers.go
index ccd58899e94..ee3c57289d4 100644
--- a/storage/headers.go
+++ b/storage/headers.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package storage
 
 import (
diff --git a/storage/merkle/node.go b/storage/merkle/node.go
index edea5410c8e..f5e7d8c7ae1 100644
--- a/storage/merkle/node.go
+++ b/storage/merkle/node.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package merkle
 
 import (
diff --git a/storage/merkle/tree.go b/storage/merkle/tree.go
index 4470422999f..f50c7f5686a 100644
--- a/storage/merkle/tree.go
+++ b/storage/merkle/tree.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package merkle
 
 import (
@@ -21,6 +19,7 @@ import (
 // Therefore, the range of valid key length in bytes is [1, 8191] (the corresponding
 // range in bits is [8, 65528]) .
 const maxKeyLength = 8191
+
 const maxKeyLenBits = maxKeyLength * 8
 
 var EmptyTreeRootHash []byte
diff --git a/storage/merkle/tree_test.go b/storage/merkle/tree_test.go
index aea20cca8db..8d0a601c6c0 100644
--- a/storage/merkle/tree_test.go
+++ b/storage/merkle/tree_test.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package merkle
 
 import (
diff --git a/storage/mock/epoch_states.go b/storage/mock/epoch_states.go
deleted file mode 100644
index c7a8916e81f..00000000000
--- a/storage/mock/epoch_states.go
+++ /dev/null
@@ -1,55 +0,0 @@
-// Code generated by mockery v1.0.0. DO NOT EDIT.
-
-package mock
-
-import (
-	badger "github.com/dgraph-io/badger/v2"
-
-	flow "github.com/onflow/flow-go/model/flow"
-
-	mock "github.com/stretchr/testify/mock"
-)
-
-// EpochStates is an autogenerated mock type for the EpochStates type
-type EpochStates struct {
-	mock.Mock
-}
-
-// ByBlockID provides a mock function with given fields: _a0
-func (_m *EpochStates) ByBlockID(_a0 flow.Identifier) (*flow.EpochStatus, error) {
-	ret := _m.Called(_a0)
-
-	var r0 *flow.EpochStatus
-	if rf, ok := ret.Get(0).(func(flow.Identifier) *flow.EpochStatus); ok {
-		r0 = rf(_a0)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*flow.EpochStatus)
-		}
-	}
-
-	var r1 error
-	if rf, ok := ret.Get(1).(func(flow.Identifier) error); ok {
-		r1 = rf(_a0)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// StoreTx provides a mock function with given fields: blockID, state
-func (_m *EpochStates) StoreTx(blockID flow.Identifier, state *flow.EpochStatus) func(*badger.Txn) error {
-	ret := _m.Called(blockID, state)
-
-	var r0 func(*badger.Txn) error
-	if rf, ok := ret.Get(0).(func(flow.Identifier, *flow.EpochStatus) func(*badger.Txn) error); ok {
-		r0 = rf(blockID, state)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(func(*badger.Txn) error)
-		}
-	}
-
-	return r0
-}
diff --git a/storage/mock/epoch_statuses.go b/storage/mock/epoch_statuses.go
deleted file mode 100644
index e21c7f1617f..00000000000
--- a/storage/mock/epoch_statuses.go
+++ /dev/null
@@ -1,72 +0,0 @@
-// Code generated by mockery v2.21.4. DO NOT EDIT.
-
-package mock
-
-import (
-	flow "github.com/onflow/flow-go/model/flow"
-	mock "github.com/stretchr/testify/mock"
-
-	transaction "github.com/onflow/flow-go/storage/badger/transaction"
-)
-
-// EpochStatuses is an autogenerated mock type for the EpochStatuses type
-type EpochStatuses struct {
-	mock.Mock
-}
-
-// ByBlockID provides a mock function with given fields: _a0
-func (_m *EpochStatuses) ByBlockID(_a0 flow.Identifier) (*flow.EpochStatus, error) {
-	ret := _m.Called(_a0)
-
-	var r0 *flow.EpochStatus
-	var r1 error
-	if rf, ok := ret.Get(0).(func(flow.Identifier) (*flow.EpochStatus, error)); ok {
-		return rf(_a0)
-	}
-	if rf, ok := ret.Get(0).(func(flow.Identifier) *flow.EpochStatus); ok {
-		r0 = rf(_a0)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*flow.EpochStatus)
-		}
-	}
-
-	if rf, ok := ret.Get(1).(func(flow.Identifier) error); ok {
-		r1 = rf(_a0)
-	} else {
-		r1 = ret.Error(1)
-	}
-
-	return r0, r1
-}
-
-// StoreTx provides a mock function with given fields: blockID, state
-func (_m *EpochStatuses) StoreTx(blockID flow.Identifier, state *flow.EpochStatus) func(*transaction.Tx) error {
-	ret := _m.Called(blockID, state)
-
-	var r0 func(*transaction.Tx) error
-	if rf, ok := ret.Get(0).(func(flow.Identifier, *flow.EpochStatus) func(*transaction.Tx) error); ok {
-		r0 = rf(blockID, state)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(func(*transaction.Tx) error)
-		}
-	}
-
-	return r0
-}
-
-type mockConstructorTestingTNewEpochStatuses interface {
-	mock.TestingT
-	Cleanup(func())
-}
-
-// NewEpochStatuses creates a new instance of EpochStatuses. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
-func NewEpochStatuses(t mockConstructorTestingTNewEpochStatuses) *EpochStatuses {
-	mock := &EpochStatuses{}
-	mock.Mock.Test(t)
-
-	t.Cleanup(func() { mock.AssertExpectations(t) })
-
-	return mock
-}
diff --git a/storage/mock/protocol_state.go b/storage/mock/protocol_state.go
new file mode 100644
index 00000000000..407bbc8a699
--- /dev/null
+++ b/storage/mock/protocol_state.go
@@ -0,0 +1,114 @@
+// Code generated by mockery v2.21.4. DO NOT EDIT.
+
+package mock
+
+import (
+	flow "github.com/onflow/flow-go/model/flow"
+	mock "github.com/stretchr/testify/mock"
+
+	transaction "github.com/onflow/flow-go/storage/badger/transaction"
+)
+
+// ProtocolState is an autogenerated mock type for the ProtocolState type
+type ProtocolState struct {
+	mock.Mock
+}
+
+// ByBlockID provides a mock function with given fields: blockID
+func (_m *ProtocolState) ByBlockID(blockID flow.Identifier) (*flow.RichProtocolStateEntry, error) {
+	ret := _m.Called(blockID)
+
+	var r0 *flow.RichProtocolStateEntry
+	var r1 error
+	if rf, ok := ret.Get(0).(func(flow.Identifier) (*flow.RichProtocolStateEntry, error)); ok {
+		return rf(blockID)
+	}
+	if rf, ok := ret.Get(0).(func(flow.Identifier) *flow.RichProtocolStateEntry); ok {
+		r0 = rf(blockID)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*flow.RichProtocolStateEntry)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(flow.Identifier) error); ok {
+		r1 = rf(blockID)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// ByID provides a mock function with given fields: id
+func (_m *ProtocolState) ByID(id flow.Identifier) (*flow.RichProtocolStateEntry, error) {
+	ret := _m.Called(id)
+
+	var r0 *flow.RichProtocolStateEntry
+	var r1 error
+	if rf, ok := ret.Get(0).(func(flow.Identifier) (*flow.RichProtocolStateEntry, error)); ok {
+		return rf(id)
+	}
+	if rf, ok := ret.Get(0).(func(flow.Identifier) *flow.RichProtocolStateEntry); ok {
+		r0 = rf(id)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*flow.RichProtocolStateEntry)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(flow.Identifier) error); ok {
+		r1 = rf(id)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Index provides a mock function with given fields: blockID, protocolStateID
+func (_m *ProtocolState) Index(blockID flow.Identifier, protocolStateID flow.Identifier) func(*transaction.Tx) error {
+	ret := _m.Called(blockID, protocolStateID)
+
+	var r0 func(*transaction.Tx) error
+	if rf, ok := ret.Get(0).(func(flow.Identifier, flow.Identifier) func(*transaction.Tx) error); ok {
+		r0 = rf(blockID, protocolStateID)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(func(*transaction.Tx) error)
+		}
+	}
+
+	return r0
+}
+
+// StoreTx provides a mock function with given fields: protocolStateID, protocolState
+func (_m *ProtocolState) StoreTx(protocolStateID flow.Identifier, protocolState *flow.ProtocolStateEntry) func(*transaction.Tx) error {
+	ret := _m.Called(protocolStateID, protocolState)
+
+	var r0 func(*transaction.Tx) error
+	if rf, ok := ret.Get(0).(func(flow.Identifier, *flow.ProtocolStateEntry) func(*transaction.Tx) error); ok {
+		r0 = rf(protocolStateID, protocolState)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(func(*transaction.Tx) error)
+		}
+	}
+
+	return r0
+}
+
+type mockConstructorTestingTNewProtocolState interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewProtocolState creates a new instance of ProtocolState. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewProtocolState(t mockConstructorTestingTNewProtocolState) *ProtocolState {
+	mock := &ProtocolState{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
diff --git a/storage/payloads.go b/storage/payloads.go
index d9926a966f9..0094c6a2ad9 100644
--- a/storage/payloads.go
+++ b/storage/payloads.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package storage
 
 import (
diff --git a/storage/protocol_state.go b/storage/protocol_state.go
new file mode 100644
index 00000000000..9fa905d3924
--- /dev/null
+++ b/storage/protocol_state.go
@@ -0,0 +1,52 @@
+package storage
+
+import (
+	"github.com/onflow/flow-go/model/flow"
+	"github.com/onflow/flow-go/storage/badger/transaction"
+)
+
+// ProtocolState represents persistent storage for protocol state entries.
+type ProtocolState interface {
+	// StoreTx returns an anonymous function (intended to be executed as part of a badger transaction),
+	// which persists the given protocol state as part of a DB tx. Per convention, the identities in
+	// the Protocol State must be in canonical order for the current and next epoch (if present),
+	// otherwise an exception is returned.
+	// Expected errors of the returned anonymous function:
+	//   - storage.ErrAlreadyExists if a Protocol State with the given id is already stored
+	StoreTx(protocolStateID flow.Identifier, protocolState *flow.ProtocolStateEntry) func(*transaction.Tx) error
+
+	// Index returns an anonymous function that is intended to be executed as part of a database transaction.
+	// In a nutshell, we want to maintain a map from `blockID` to `protocolStateID`, where `blockID` references the
+	// block that _proposes_ the Protocol State.
+	// Upon call, the anonymous function persists the specific map entry in the node's database.
+	// Protocol convention:
+	//   - Consider block B, whose ingestion might potentially lead to an updated protocol state. For example,
+	//     the protocol state changes if we seal some execution results emitting service events.
+	//   - For the key `blockID`, we use the identity of block B which _proposes_ this Protocol State. As value,
+	//     the hash of the resulting protocol state at the end of processing B is to be used.
+	//   - CAUTION: The protocol state requires confirmation by a QC and will only become active at the child block,
+	//     _after_ validating the QC.
+	//
+	// Expected errors during normal operations:
+	//   - storage.ErrAlreadyExists if a Protocol State for the given blockID has already been indexed
+	Index(blockID flow.Identifier, protocolStateID flow.Identifier) func(*transaction.Tx) error
+
+	// ByID returns the protocol state by its ID.
+	// Expected errors during normal operations:
+	//   - storage.ErrNotFound if no protocol state with the given Identifier is known.
+	ByID(id flow.Identifier) (*flow.RichProtocolStateEntry, error)
+
+	// ByBlockID retrieves the Protocol State that the block with the given ID proposes.
+	// CAUTION: this protocol state requires confirmation by a QC and will only become active at the child block,
+	// _after_ validating the QC. Protocol convention:
+	//   - Consider block B, whose ingestion might potentially lead to an updated protocol state. For example,
+	//     the protocol state changes if we seal some execution results emitting service events.
+	//   - For the key `blockID`, we use the identity of block B which _proposes_ this Protocol State. As value,
+	//     the hash of the resulting protocol state at the end of processing B is to be used.
+	//   - CAUTION: The protocol state requires confirmation by a QC and will only become active at the child block,
+	//     _after_ validating the QC.
+	//
+	// Expected errors during normal operations:
+	//   - storage.ErrNotFound if no protocol state has been indexed for the given block.
+	ByBlockID(blockID flow.Identifier) (*flow.RichProtocolStateEntry, error)
+}
diff --git a/storage/receipts.go b/storage/receipts.go
index 1aa95c6368c..0c1209e77cc 100644
--- a/storage/receipts.go
+++ b/storage/receipts.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package storage
 
 import (
diff --git a/storage/results.go b/storage/results.go
index 39fd4d810e1..ee1d1cd40c5 100644
--- a/storage/results.go
+++ b/storage/results.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package storage
 
 import (
diff --git a/storage/seals.go b/storage/seals.go
index c394098d30d..43fb783ea72 100644
--- a/storage/seals.go
+++ b/storage/seals.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package storage
 
 import (
diff --git a/tools/test_matrix_generator/default-test-matrix-config.json b/tools/test_matrix_generator/default-test-matrix-config.json
new file mode 100644
index 00000000000..a62ac6aec5a
--- /dev/null
+++ b/tools/test_matrix_generator/default-test-matrix-config.json
@@ -0,0 +1,33 @@
+{
+  "includeOthers": true,
+  "packages": [
+    {"name": "admin"},
+    {"name":  "cmd"},
+    {"name":  "consensus"},
+    {"name":  "fvm"},
+    {"name":  "ledger"},
+    {"name":  "state"},
+    {"name":  "storage"},
+    {"name":  "utils"},
+    {"name":  "engine", "runner":  "buildjet-4vcpu-ubuntu-2004" ,"subpackages": [
+      {"name": "engine/access"},
+      {"name": "engine/collection"},
+      {"name": "engine/common"},
+      {"name": "engine/consensus"},
+      {"name": "engine/execution/computation"},
+      {"name": "engine/execution"},
+      {"name": "engine/verification"},
+      {"name": "engine/execution/ingestion", "runner":  "buildjet-8vcpu-ubuntu-2004"}
+    ]},
+    {"name":  "module", "runner":  "buildjet-4vcpu-ubuntu-2004" ,"subpackages": [{"name": "module/dkg"}]},
+    {"name":  "network", "subpackages": [
+      {"name": "network/alsp"},
+      {"name": "network/p2p/connection"},
+      {"name": "network/p2p/scoring"},
+      {"name": "network/p2p", "runner":  "buildjet-16vcpu-ubuntu-2004"},
+      {"name": "network/test/cohort1", "runner":  "buildjet-16vcpu-ubuntu-2004"},
+      {"name": "network/test/cohort2", "runner":  "buildjet-4vcpu-ubuntu-2004"},
+      {"name": "network/p2p/node", "runner":  "buildjet-4vcpu-ubuntu-2004"}
+    ]}
+  ]
+}
diff --git a/tools/test_matrix_generator/insecure-module-test-matrix-config.json b/tools/test_matrix_generator/insecure-module-test-matrix-config.json
new file mode 100644
index 00000000000..59e7aa6ecb0
--- /dev/null
+++ b/tools/test_matrix_generator/insecure-module-test-matrix-config.json
@@ -0,0 +1,10 @@
+{
+  "packagesPath": "./insecure",
+  "includeOthers": false,
+  "packages": [
+      {"name":  "insecure", "runner":  "buildjet-4vcpu-ubuntu-2004" ,"subpackages": [
+      {"name": "insecure/integration/functional/test/gossipsub/rpc_inspector", "runner":  "buildjet-8vcpu-ubuntu-2004"},
+      {"name": "insecure/integration/functional/test/gossipsub/scoring", "runner":  "buildjet-8vcpu-ubuntu-2004"}
+    ]}
+  ]
+}
diff --git a/tools/test_matrix_generator/integration-module-test-matrix-config.json b/tools/test_matrix_generator/integration-module-test-matrix-config.json
new file mode 100644
index 00000000000..379ee6ab64e
--- /dev/null
+++ b/tools/test_matrix_generator/integration-module-test-matrix-config.json
@@ -0,0 +1,9 @@
+{
+  "packagesPath": "./integration",
+  "includeOthers": false,
+  "packages": [{
+      "name": "integration",
+      "runner": "buildjet-4vcpu-ubuntu-2004",
+      "exclude": ["integration/tests"]
+    }]
+}
diff --git a/tools/test_matrix_generator/matrix.go b/tools/test_matrix_generator/matrix.go
new file mode 100644
index 00000000000..2a0aeef3797
--- /dev/null
+++ b/tools/test_matrix_generator/matrix.go
@@ -0,0 +1,230 @@
+package main
+
+import (
+	"bytes"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/spf13/pflag"
+	"golang.org/x/tools/go/packages"
+)
+
+var (
+	//go:embed default-test-matrix-config.json
+	defaultTestMatrixConfig string
+
+	//go:embed insecure-module-test-matrix-config.json
+	insecureModuleTestMatrixConfig string
+
+	//go:embed integration-module-test-matrix-config.json
+	integrationModuleTestMatrixConfig string
+
+	matrixConfigFile string
+)
+
+const (
+	flowPackagePrefix = "github.com/onflow/flow-go/"
+	ciMatrixName      = "dynamicMatrix"
+	defaultCIRunner   = "ubuntu-20.04"
+)
+
+// flowGoPackage configuration for a package to be tested.
+type flowGoPackage struct {
+	// Name the name of the package where test are located.
+	Name string `json:"name"`
+	// Runner the runner used for the top level github actions job that runs the tests all the tests in the parent package.
+	Runner string `json:"runner,omitempty"`
+	// Exclude list of packages to exclude from top level parent package test matrix.
+	Exclude []string `json:"exclude,omitempty"`
+	// Subpackages list of subpackages of the parent package that should be run in their own github actions job.
+	Subpackages []*subpackage `json:"subpackages,omitempty"`
+}
+
+// subpackage configuration for a subpackage.
+type subpackage struct {
+	Name   string `json:"name"`
+	Runner string `json:"runner,omitempty"`
+}
+
+// config the test matrix configuration for a package.
+type config struct {
+	// PackagesPath director where to load packages from.
+	PackagesPath string `json:"packagesPath,omitempty"`
+	// IncludeOthers when set to true will put all packages and subpackages of the packages path into a test matrix that will run in a job called others.
+	IncludeOthers bool `json:"includeOthers,omitempty"`
+	// Packages configurations for all packages that test should be run from.
+	Packages []*flowGoPackage `json:"packages"`
+}
+
+// testMatrix represents a single GitHub Actions test matrix combination that consists of a name and a list of flow-go packages associated with that name.
+type testMatrix struct {
+	Name     string `json:"name"`
+	Packages string `json:"packages"`
+	Runner   string `json:"runner"`
+}
+
+// newTestMatrix returns a new testMatrix, if runner is empty "" set the runner to the defaultCIRunner.
+func newTestMatrix(name, runner, pkgs string) *testMatrix {
+	t := &testMatrix{
+		Name:     name,
+		Packages: pkgs,
+		Runner:   runner,
+	}
+
+	if t.Runner == "" {
+		t.Runner = defaultCIRunner
+	}
+
+	return t
+}
+
+// Generates a list of packages to test that will be passed to GitHub Actions
+func main() {
+	pflag.Parse()
+
+	var configFile string
+	switch matrixConfigFile {
+	case "insecure":
+		configFile = insecureModuleTestMatrixConfig
+	case "integration":
+		configFile = integrationModuleTestMatrixConfig
+	default:
+		configFile = defaultTestMatrixConfig
+	}
+
+	packageConfig := loadPackagesConfig(configFile)
+
+	testMatrices := buildTestMatrices(packageConfig, listAllFlowPackages)
+	printCIString(testMatrices)
+}
+
+// printCIString encodes the test matrices and prints the json string to stdout. The CI runner will read this json string
+// and make the data available for our github workflows.
+func printCIString(testMatrices []*testMatrix) {
+	// generate JSON output that will be read in by CI matrix
+	// can't use json.MarshalIndent because fromJSON() in CI can’t read JSON with any spaces
+	b, err := json.Marshal(testMatrices)
+	if err != nil {
+		panic(fmt.Errorf("failed to marshal test matrices json: %w", err))
+	}
+	// this string will be read by CI to generate groups of tests to run in separate CI jobs
+	testMatrixStr := "::set-output name=" + ciMatrixName + "::" + string(b)
+	// very important to add newline character at the end of the compacted JSON - otherwise fromJSON() in CI will throw unmarshalling error
+	fmt.Println(testMatrixStr)
+}
+
+// buildTestMatrices builds the test matrices.
+func buildTestMatrices(packageConfig *config, flowPackages func(dir string) []*packages.Package) []*testMatrix {
+	testMatrices := make([]*testMatrix, 0)
+	seenPaths := make(map[string]struct{})
+	seenPath := func(p string) {
+		seenPaths[p] = struct{}{}
+	}
+	seen := func(p string) bool {
+		_, seen := seenPaths[p]
+		return seen
+	}
+
+	for _, topLevelPkg := range packageConfig.Packages {
+		allPackages := flowPackages(topLevelPkg.Name)
+		// first build test matrix for each of the subpackages and mark all complete paths seen
+		subPkgMatrices := processSubpackages(topLevelPkg.Subpackages, allPackages, seenPath)
+		testMatrices = append(testMatrices, subPkgMatrices...)
+		// now build top level test matrix
+		topLevelTestMatrix := processTopLevelPackage(topLevelPkg, allPackages, seenPath, seen)
+		testMatrices = append(testMatrices, topLevelTestMatrix)
+	}
+
+	// any packages left out of the explicit Packages field will be run together as "others" from the config PackagesPath
+	if packageConfig.IncludeOthers {
+		allPkgs := flowPackages(packageConfig.PackagesPath)
+		if othersTestMatrix := buildOthersTestMatrix(allPkgs, seen); othersTestMatrix != nil {
+			testMatrices = append(testMatrices, othersTestMatrix)
+		}
+	}
+	return testMatrices
+}
+
+// processSubpackages creates a test matrix for all subpackages provided.
+func processSubpackages(subPkgs []*subpackage, allPkgs []*packages.Package, seenPath func(p string)) []*testMatrix {
+	testMatrices := make([]*testMatrix, 0)
+	for _, subPkg := range subPkgs {
+		pkgPath := fullGoPackagePath(subPkg.Name)
+		// this is the list of allPackages that used with the go test command
+		var testPkgStrBuilder strings.Builder
+		for _, p := range allPkgs {
+			if strings.HasPrefix(p.PkgPath, pkgPath) {
+				testPkgStrBuilder.WriteString(fmt.Sprintf("%s ", p.PkgPath))
+				seenPath(p.PkgPath)
+			}
+		}
+		testMatrices = append(testMatrices, newTestMatrix(subPkg.Name, subPkg.Runner, testPkgStrBuilder.String()))
+	}
+	return testMatrices
+}
+
+// processTopLevelPackages creates test matrix for the top level package excluding any packages from the exclude list.
+func processTopLevelPackage(pkg *flowGoPackage, allPkgs []*packages.Package, seenPath func(p string), seen func(p string) bool) *testMatrix {
+	var topLevelTestPkgStrBuilder strings.Builder
+	for _, p := range allPkgs {
+		if !seen(p.PkgPath) {
+			includePkg := true
+			for _, exclude := range pkg.Exclude {
+				if strings.HasPrefix(p.PkgPath, fullGoPackagePath(exclude)) {
+					includePkg = false
+				}
+			}
+
+			if includePkg && strings.HasPrefix(p.PkgPath, fullGoPackagePath(pkg.Name)) {
+				topLevelTestPkgStrBuilder.WriteString(fmt.Sprintf("%s ", p.PkgPath))
+				seenPath(p.PkgPath)
+			}
+		}
+	}
+	return newTestMatrix(pkg.Name, pkg.Runner, topLevelTestPkgStrBuilder.String())
+}
+
+// buildOthersTestMatrix builds an others test matrix that includes all packages in a path not explicitly set in the packages list of a config.
+func buildOthersTestMatrix(allPkgs []*packages.Package, seen func(p string) bool) *testMatrix {
+	var othersTestPkgStrBuilder strings.Builder
+	for _, otherPkg := range allPkgs {
+		if !seen(otherPkg.PkgPath) {
+			othersTestPkgStrBuilder.WriteString(fmt.Sprintf("%s ", otherPkg.PkgPath))
+		}
+	}
+
+	if othersTestPkgStrBuilder.Len() > 0 {
+		return newTestMatrix("others", "", othersTestPkgStrBuilder.String())
+	}
+
+	return nil
+}
+
+func listAllFlowPackages(dir string) []*packages.Package {
+	flowPackages, err := packages.Load(&packages.Config{Dir: dir}, "./...")
+	if err != nil {
+		panic(err)
+	}
+	return flowPackages
+}
+
+func loadPackagesConfig(configFile string) *config {
+	var packageConfig config
+	buf := bytes.NewBufferString(configFile)
+	err := json.NewDecoder(buf).Decode(&packageConfig)
+	if err != nil {
+		panic(fmt.Errorf("failed to decode package config json %w: %s", err, configFile))
+	}
+	return &packageConfig
+}
+
+func fullGoPackagePath(pkg string) string {
+	return fmt.Sprintf("%s%s", flowPackagePrefix, pkg)
+}
+
+func init() {
+	// Add flags to the FlagSet
+	pflag.StringVarP(&matrixConfigFile, "config", "c", "", "the config file used to generate the test matrix")
+}
diff --git a/tools/test_matrix_generator/matrix_test.go b/tools/test_matrix_generator/matrix_test.go
new file mode 100644
index 00000000000..a155b541f62
--- /dev/null
+++ b/tools/test_matrix_generator/matrix_test.go
@@ -0,0 +1,161 @@
+package main
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/tools/go/packages"
+)
+
+// TestLoadPackagesConfig ensure packages config json loads as expected.
+func TestLoadPackagesConfig(t *testing.T) {
+	configFile := `{"packagesPath": ".", "includeOthers": true, "packages": [{"name": "testPackage"}]}`
+	config := loadPackagesConfig(configFile)
+	if config.PackagesPath != "." || !config.IncludeOthers || len(config.Packages) != 1 {
+		t.Errorf("loadPackagesConfig failed for valid input")
+	}
+
+	invalidConfigFile := "invalidJSON"
+	defer func() {
+		if recover() == nil {
+			t.Errorf("loadPackagesConfig did not panic for invalid JSON input")
+		}
+	}()
+	loadPackagesConfig(invalidConfigFile)
+}
+
+// TestBuildMatrices ensures test matrices are built from config json as expected.
+func TestBuildMatrices(t *testing.T) {
+	t.Run("top level package only default runner", func(t *testing.T) {
+		name := "counter"
+		configFile := fmt.Sprintf(`{"packagesPath": ".", "includeOthers": true, "packages": [{"name": "%s"}]}`, name)
+		allPackges := goPackageFixture("counter/count", "counter/print/int", "counter/log")
+		cfg := loadPackagesConfig(configFile)
+		matrices := buildTestMatrices(cfg, func(dir string) []*packages.Package {
+			return allPackges
+		})
+		require.Equal(t, name, matrices[0].Name)
+		require.Equal(t, defaultCIRunner, matrices[0].Runner)
+		require.Equal(t, fmt.Sprintf("%s %s %s ", allPackges[0].PkgPath, allPackges[1].PkgPath, allPackges[2].PkgPath), matrices[0].Packages)
+		fmt.Println(matrices[0].Name, matrices[0].Runner, matrices[0].Packages)
+	})
+	t.Run("top level package only override runner", func(t *testing.T) {
+		name := "counter"
+		runner := "buildjet-4vcpu-ubuntu-2204"
+		configFile := fmt.Sprintf(`{"packagesPath": ".", "packages": [{"name": "%s", "runner":  "%s"}]}`, name, runner)
+		allPackges := goPackageFixture("counter/count", "counter/print/int", "counter/log")
+		cfg := loadPackagesConfig(configFile)
+		matrices := buildTestMatrices(cfg, func(dir string) []*packages.Package {
+			return allPackges
+		})
+		require.Equal(t, name, matrices[0].Name)
+		require.Equal(t, runner, matrices[0].Runner)
+		require.Equal(t, fmt.Sprintf("%s %s %s ", allPackges[0].PkgPath, allPackges[1].PkgPath, allPackges[2].PkgPath), matrices[0].Packages)
+	})
+	t.Run("top level package with sub packages include others", func(t *testing.T) {
+		topLevelPkgName := "network"
+		subPkg1 := "network/p2p/node"
+		subPkg2 := "module/chunks"
+		subPkg3 := "crypto/hash"
+		subPkg4 := "model/bootstrap"
+		subPkg1Runner := "buildjet-4vcpu-ubuntu-2204"
+		configFile := fmt.Sprintf(`
+			{"packagesPath": ".", "includeOthers": true, "packages": [{"name": "%s", "subpackages": [{"name": "%s", "runner": "%s"}, {"name": "%s"}, {"name": "%s"}, {"name": "%s"}]}]}`,
+			topLevelPkgName, subPkg1, subPkg1Runner, subPkg2, subPkg3, subPkg4)
+		allPackges := goPackageFixture(
+			"network",
+			"network/alsp",
+			"network/cache",
+			"network/channels",
+			"network/p2p/node",
+			"network/p2p/node/internal",
+			"module",
+			"module/chunks/chunky",
+			"crypto/hash",
+			"crypto/random",
+			"crypto/hash/ecc",
+			"model/bootstrap",
+			"model/bootstrap/info",
+			"model",
+		)
+		cfg := loadPackagesConfig(configFile)
+		matrices := buildTestMatrices(cfg, func(dir string) []*packages.Package {
+			return allPackges
+		})
+		require.Len(t, matrices, 6)
+		for _, matrix := range matrices {
+			switch matrix.Name {
+			case topLevelPkgName:
+				require.Equal(t, defaultCIRunner, matrix.Runner)
+				require.Equal(t, fmt.Sprintf("%s %s %s %s ", allPackges[0].PkgPath, allPackges[1].PkgPath, allPackges[2].PkgPath, allPackges[3].PkgPath), matrix.Packages)
+			case subPkg1:
+				require.Equal(t, subPkg1Runner, matrix.Runner)
+				require.Equal(t, fmt.Sprintf("%s %s ", allPackges[4].PkgPath, allPackges[5].PkgPath), matrix.Packages)
+			case subPkg2:
+				require.Equal(t, defaultCIRunner, matrix.Runner)
+				require.Equal(t, fmt.Sprintf("%s ", allPackges[7].PkgPath), matrix.Packages)
+			case subPkg3:
+				require.Equal(t, defaultCIRunner, matrix.Runner)
+				require.Equal(t, fmt.Sprintf("%s %s ", allPackges[8].PkgPath, allPackges[10].PkgPath), matrix.Packages)
+			case subPkg4:
+				require.Equal(t, defaultCIRunner, matrix.Runner)
+				require.Equal(t, fmt.Sprintf("%s %s ", allPackges[11].PkgPath, allPackges[12].PkgPath), matrix.Packages)
+			case "others":
+				require.Equal(t, defaultCIRunner, matrix.Runner)
+				require.Equal(t, fmt.Sprintf("%s %s %s ", allPackges[6].PkgPath, allPackges[9].PkgPath, allPackges[13].PkgPath), matrix.Packages)
+			default:
+				require.Fail(t, fmt.Sprintf("unexpected matrix name: %s", matrix.Name))
+			}
+		}
+	})
+	t.Run("top level package with sub packages and exclude", func(t *testing.T) {
+		topLevelPkgName := "network"
+		subPkg1 := "network/p2p/node"
+		subPkg1Runner := "buildjet-4vcpu-ubuntu-2204"
+		configFile := fmt.Sprintf(`
+			{"packagesPath": ".", "packages": [{"name": "%s", "exclude": ["network/alsp"], "subpackages": [{"name": "%s", "runner": "%s"}]}]}`,
+			topLevelPkgName, subPkg1, subPkg1Runner)
+		allPackges := goPackageFixture(
+			"network",
+			"network/alsp",
+			"network/cache",
+			"network/channels",
+			"network/p2p/node",
+			"network/p2p/node/internal",
+			"module",
+			"module/chunks/chunky",
+			"crypto/hash",
+			"crypto/random",
+			"crypto/hash/ecc",
+			"model/bootstrap",
+			"model/bootstrap/info",
+			"model",
+		)
+		cfg := loadPackagesConfig(configFile)
+		matrices := buildTestMatrices(cfg, func(dir string) []*packages.Package {
+			return allPackges
+		})
+		require.Len(t, matrices, 2)
+		for _, matrix := range matrices {
+			switch matrix.Name {
+			case topLevelPkgName:
+				require.Equal(t, defaultCIRunner, matrix.Runner)
+				require.Equal(t, fmt.Sprintf("%s %s %s ", allPackges[0].PkgPath, allPackges[2].PkgPath, allPackges[3].PkgPath), matrix.Packages)
+			case subPkg1:
+				require.Equal(t, subPkg1Runner, matrix.Runner)
+				require.Equal(t, fmt.Sprintf("%s %s ", allPackges[4].PkgPath, allPackges[5].PkgPath), matrix.Packages)
+			default:
+				require.Fail(t, fmt.Sprintf("unexpected matrix name: %s", matrix.Name))
+			}
+		}
+	})
+}
+
+func goPackageFixture(pkgs ...string) []*packages.Package {
+	goPkgs := make([]*packages.Package, len(pkgs))
+	for i, pkg := range pkgs {
+		goPkgs[i] = &packages.Package{PkgPath: fullGoPackagePath(pkg)}
+	}
+	return goPkgs
+}
diff --git a/utils/binstat/binstat.go b/utils/binstat/binstat.go
index a77e5800035..e6e26ee2afa 100644
--- a/utils/binstat/binstat.go
+++ b/utils/binstat/binstat.go
@@ -63,8 +63,12 @@ uint64_t gettid() { return syscall(SYS_gettid); }
 #include <stdint.h>
 #include <pthread.h>
 uint64_t gettid() { uint64_t tid; pthread_threadid_np(NULL, &tid); return tid; }
+#elif defined(_WIN32)
+#include <stdint.h>
+#include <windows.h>
+uint64_t gettid() { return (uint64_t)GetCurrentThreadId(); }
 #else
-#   error "Unknown platform; __linux__ or __APPLE__ supported"
+#   error "Unknown platform; __linux__ or __APPLE__ or _WIN32 expected"
 #endif
 */
 import "C"
@@ -238,7 +242,7 @@ func init() {
 	}
 
 	t2 := runtimeNanoAsTimeDuration()
-	if t2 <= t1 {
+	if t2 < t1 {
 		panic(fmt.Sprintf("ERROR: BINSTAT: INTERNAL: t1=%d but t2=%d\n", t1, t2))
 	}
 }
diff --git a/utils/logging/identifier.go b/utils/logging/identifier.go
index 1cac5cd522c..4df1ca9af3e 100644
--- a/utils/logging/identifier.go
+++ b/utils/logging/identifier.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package logging
 
 import (
diff --git a/utils/logging/json.go b/utils/logging/json.go
index bcf4e49c285..3c9e50908a7 100644
--- a/utils/logging/json.go
+++ b/utils/logging/json.go
@@ -1,5 +1,3 @@
-// (c) 2019 Dapper Labs - ALL RIGHTS RESERVED
-
 package logging
 
 import (
diff --git a/utils/test_matrix/test_matrix.go b/utils/test_matrix/test_matrix.go
deleted file mode 100644
index 9a5cb9f9713..00000000000
--- a/utils/test_matrix/test_matrix.go
+++ /dev/null
@@ -1,159 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"fmt"
-	"os"
-	"strings"
-
-	"golang.org/x/tools/go/packages"
-)
-
-const flowPackagePrefix = "github.com/onflow/flow-go/"
-const ciMatrixName = "dynamicMatrix"
-const ciDefaultRunner = "ubuntu-latest"
-
-// testMatrix represents a single GitHub Actions test matrix combination that consists of a name and a list of flow-go packages associated with that name.
-type testMatrix struct {
-	Name     string `json:"name"`
-	Packages string `json:"packages"`
-	Runner   string `json:"runner"`
-}
-
-type targets struct {
-	runners  map[string]string
-	packages map[string][]string
-}
-
-// Generates a list of packages to test that will be passed to GitHub Actions
-func main() {
-	if len(os.Args) == 1 {
-		fmt.Fprintln(os.Stderr, "must have at least 1 package listed")
-		return
-	}
-
-	allFlowPackages := listAllFlowPackages()
-
-	targetPackages, seenPackages := listTargetPackages(os.Args[1:], allFlowPackages)
-
-	otherPackages := listOtherPackages(allFlowPackages, seenPackages)
-
-	testMatrix := generateTestMatrix(targetPackages, otherPackages)
-
-	// generate JSON output that will be read in by CI matrix
-	// can't use json.MarshalIndent because fromJSON() in CI can’t read JSON with any spaces
-	testMatrixBytes, err := json.Marshal(testMatrix)
-	if err != nil {
-		panic(err)
-	}
-
-	// this string will be read by CI to generate groups of tests to run in separate CI jobs
-	testMatrixStr := "::set-output name=" + ciMatrixName + "::" + string(testMatrixBytes)
-
-	// very important to add newline character at the end of the compacted JSON - otherwise fromJSON() in CI will throw unmarshalling error
-	fmt.Println(testMatrixStr)
-}
-
-func generateTestMatrix(targetPackages targets, otherPackages []string) []testMatrix {
-	var testMatrices []testMatrix
-
-	for packageName := range targetPackages.packages {
-		targetTestMatrix := testMatrix{
-			Name:     packageName,
-			Packages: strings.Join(targetPackages.packages[packageName], " "),
-			Runner:   targetPackages.runners[packageName],
-		}
-		testMatrices = append(testMatrices, targetTestMatrix)
-	}
-
-	// add the other packages after all target packages added
-	otherTestMatrix := testMatrix{
-		Name:     "others",
-		Packages: strings.Join(otherPackages, " "),
-		Runner:   ciDefaultRunner,
-	}
-
-	testMatrices = append(testMatrices, otherTestMatrix)
-
-	return testMatrices
-}
-
-// listTargetPackages returns a map-list of target packages to run as separate CI jobs, based on a list of target package prefixes.
-// It also returns a list of the "seen" packages that can then be used to extract the remaining packages to run (in a separate CI job).
-func listTargetPackages(targetPackagePrefixes []string, allFlowPackages []string) (targets, map[string]string) {
-	targetPackages := make(map[string][]string)
-	targetRunners := make(map[string]string)
-
-	// Stores list of packages already seen / allocated to other lists. Needed for the last package which will
-	// have all the leftover packages that weren't allocated to a separate list (CI job).
-	// It's a map, not a list, to make it easier to check if a package was seen or not.
-	seenPackages := make(map[string]string)
-
-	// iterate over the target packages to run as separate CI jobs
-	for _, targetPackagePrefix := range targetPackagePrefixes {
-		var targetPackage []string
-
-		// assume package name specified without runner
-		targetPackagePrefixNoRunner := targetPackagePrefix
-
-		// check if specify CI runner to use for the package, otherwise use default
-		colonIndex := strings.Index(targetPackagePrefix, ":")
-		if colonIndex != -1 {
-			targetPackagePrefixNoRunner = targetPackagePrefix[:colonIndex] // strip out runner from package name
-			targetRunners[targetPackagePrefixNoRunner] = targetPackagePrefix[colonIndex+1:]
-		} else {
-			// use default CI runner if didn't specify runner
-			targetRunners[targetPackagePrefix] = ciDefaultRunner
-		}
-
-		// go through all packages to see which ones to pull out
-		for _, allPackage := range allFlowPackages {
-			if strings.HasPrefix(allPackage, flowPackagePrefix+targetPackagePrefixNoRunner) {
-				// if the package was already seen, don't append it to the list
-				// this is to support listing sub-sub packages in a CI job without duplicating those sub-sub packages
-				// in the parent package job
-				_, seen := seenPackages[allPackage]
-				if seen {
-					continue
-				}
-				targetPackage = append(targetPackage, allPackage)
-				seenPackages[allPackage] = allPackage
-			}
-		}
-		if len(targetPackage) == 0 {
-			panic("no packages exist with prefix " + targetPackagePrefixNoRunner)
-		}
-		targetPackages[targetPackagePrefixNoRunner] = targetPackage
-	}
-	return targets{targetRunners, targetPackages}, seenPackages
-}
-
-// listOtherPackages compiles the remaining packages that don't match any of the target packages.
-func listOtherPackages(allFlowPackages []string, seenPackages map[string]string) []string {
-	var otherPackages []string
-
-	for _, allFlowPackage := range allFlowPackages {
-		_, seen := seenPackages[allFlowPackage]
-		if !seen {
-			otherPackages = append(otherPackages, allFlowPackage)
-		}
-	}
-
-	if len(otherPackages) == 0 {
-		panic("other packages list can't be 0")
-	}
-	return otherPackages
-}
-
-func listAllFlowPackages() []string {
-	flowPackages, err := packages.Load(&packages.Config{}, "./...")
-
-	if err != nil {
-		panic(err)
-	}
-	var flowPackagesStr []string
-	for _, p := range flowPackages {
-		flowPackagesStr = append(flowPackagesStr, p.PkgPath)
-	}
-	return flowPackagesStr
-}
diff --git a/utils/test_matrix/test_matrix_test.go b/utils/test_matrix/test_matrix_test.go
deleted file mode 100644
index db5accb6fc2..00000000000
--- a/utils/test_matrix/test_matrix_test.go
+++ /dev/null
@@ -1,245 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// Can't have a const []string so resorting to using a test helper function.
-func getAllFlowPackages() []string {
-	return []string{
-		flowPackagePrefix + "abc",
-		flowPackagePrefix + "abc/123",
-		flowPackagePrefix + "abc/def",
-		flowPackagePrefix + "abc/def/ghi",
-		flowPackagePrefix + "abc/def/ghi/jkl",
-		flowPackagePrefix + "abc/def/ghi/jkl/mno",
-		flowPackagePrefix + "abc/def/ghi/jkl/mno/pqr",
-		flowPackagePrefix + "abc/def/ghi/mno/abc",
-		flowPackagePrefix + "abc/def/ghi/mno/def",
-		flowPackagePrefix + "abc/def/ghi/mno/ghi",
-		flowPackagePrefix + "abc/def/jkl",
-		flowPackagePrefix + "abc/def/jkl/mno",
-		flowPackagePrefix + "abc/def/jkl/mno/pqr",
-		flowPackagePrefix + "def",
-		flowPackagePrefix + "def/abc",
-		flowPackagePrefix + "ghi",
-		flowPackagePrefix + "jkl",
-		flowPackagePrefix + "mno/abc",
-		flowPackagePrefix + "pqr",
-		flowPackagePrefix + "stu",
-		flowPackagePrefix + "vwx",
-		flowPackagePrefix + "vwx/ghi",
-		flowPackagePrefix + "yz",
-	}
-}
-
-// TestListTargetPackages_DefaultRunners tests that the target packages are included in the target packages and seen packages.
-// All packages use default CI runners.
-func TestListTargetPackages_DefaultRunners(t *testing.T) {
-	target, seenPackages := listTargetPackages([]string{"abc", "ghi"}, getAllFlowPackages())
-	require.Equal(t, 2, len(target.packages))
-
-	// check all TARGET
-	// these are the expected target packages that start with "abc"
-	require.Equal(t, 13, len(target.packages["abc"]))
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc")
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc/123")
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc/def")
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc/def/ghi")
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc/def/ghi/jkl")
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc/def/ghi/jkl/mno")
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc/def/ghi/jkl/mno/pqr")
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc/def/ghi/mno/abc")
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc/def/ghi/mno/def")
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc/def/ghi/mno/ghi")
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc/def/jkl")
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc/def/jkl/mno")
-	require.Contains(t, target.packages["abc"], flowPackagePrefix+"abc/def/jkl/mno/pqr")
-
-	// there should be 1 package that starts with "ghi"
-	require.Equal(t, 1, len(target.packages["ghi"]))
-	require.Contains(t, target.packages["ghi"], flowPackagePrefix+"ghi")
-
-	// check all CI RUNNERS for each target package
-	require.Equal(t, 2, len(target.runners))
-	require.Equal(t, target.runners["abc"], ciDefaultRunner)
-	require.Equal(t, target.runners["ghi"], ciDefaultRunner)
-
-	// check all SEEN packages
-	// these are all expected packages that start with "abc" or "ghi"
-	require.Equal(t, 14, len(seenPackages))
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/123")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi/jkl")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi/jkl/mno")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi/jkl/mno/pqr")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi/mno/abc")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi/mno/def")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi/mno/ghi")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/jkl")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/jkl/mno")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/jkl/mno/pqr")
-
-	require.Contains(t, seenPackages, flowPackagePrefix+"ghi")
-}
-
-// TestListTargetSubPackages_CustomRunners tests that if a subpackage is specified as a target package, then the sub package and
-// all children of the sub package are also included in the target packages.
-func TestListTargetSubPackages_CustomRunners(t *testing.T) {
-	target, seenPackages := listTargetPackages([]string{"abc/def:foo_runner"}, getAllFlowPackages())
-	require.Equal(t, 1, len(target.packages))
-
-	// check all TARGET packages
-	// there should be 2 target subpackages that starts with "abc/def"
-	require.Equal(t, 11, len(target.packages["abc/def"]))
-	require.Contains(t, target.packages["abc/def"], flowPackagePrefix+"abc/def")
-	require.Contains(t, target.packages["abc/def"], flowPackagePrefix+"abc/def/ghi")
-	require.Contains(t, target.packages["abc/def"], flowPackagePrefix+"abc/def/ghi/jkl")
-	require.Contains(t, target.packages["abc/def"], flowPackagePrefix+"abc/def/ghi/jkl/mno")
-	require.Contains(t, target.packages["abc/def"], flowPackagePrefix+"abc/def/ghi/jkl/mno/pqr")
-	require.Contains(t, target.packages["abc/def"], flowPackagePrefix+"abc/def/ghi/mno/abc")
-	require.Contains(t, target.packages["abc/def"], flowPackagePrefix+"abc/def/ghi/mno/def")
-	require.Contains(t, target.packages["abc/def"], flowPackagePrefix+"abc/def/ghi/mno/ghi")
-	require.Contains(t, target.packages["abc/def"], flowPackagePrefix+"abc/def/jkl")
-	require.Contains(t, target.packages["abc/def"], flowPackagePrefix+"abc/def/jkl/mno")
-	require.Contains(t, target.packages["abc/def"], flowPackagePrefix+"abc/def/jkl/mno/pqr")
-
-	// check all CI RUNNERS for each target package
-	require.Equal(t, 1, len(target.runners))
-	require.Equal(t, target.runners["abc/def"], "foo_runner")
-
-	// check all SEEN packages
-	// there should be 11 seen subpackages that start with "abc/def"
-	require.Equal(t, 11, len(seenPackages))
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi/jkl")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi/jkl/mno")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi/jkl/mno/pqr")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi/mno/abc")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi/mno/def")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/ghi/mno/ghi")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/jkl")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/jkl/mno")
-	require.Contains(t, seenPackages, flowPackagePrefix+"abc/def/jkl/mno/pqr")
-}
-
-// TestListOtherPackages tests that the remaining packages that don't match any of the target packages are included
-func TestListOtherPackages(t *testing.T) {
-	var seenPackages = make(map[string]string)
-	seenPackages[flowPackagePrefix+"abc/def"] = flowPackagePrefix + "abc/def"
-	seenPackages[flowPackagePrefix+"abc/def/ghi"] = flowPackagePrefix + "abc/def/ghi"
-	seenPackages[flowPackagePrefix+"ghi"] = flowPackagePrefix + "ghi"
-	seenPackages[flowPackagePrefix+"mno/abc"] = flowPackagePrefix + "mno/abc"
-	seenPackages[flowPackagePrefix+"stu"] = flowPackagePrefix + "stu"
-
-	otherPackages := listOtherPackages(getAllFlowPackages(), seenPackages)
-
-	require.Equal(t, 18, len(otherPackages))
-
-	require.Contains(t, otherPackages, flowPackagePrefix+"abc")
-	require.Contains(t, otherPackages, flowPackagePrefix+"abc/123")
-	require.Contains(t, otherPackages, flowPackagePrefix+"abc/def/ghi/jkl")
-	require.Contains(t, otherPackages, flowPackagePrefix+"abc/def/ghi/jkl/mno")
-	require.Contains(t, otherPackages, flowPackagePrefix+"abc/def/ghi/jkl/mno/pqr")
-	require.Contains(t, otherPackages, flowPackagePrefix+"abc/def/ghi/mno/abc")
-	require.Contains(t, otherPackages, flowPackagePrefix+"abc/def/ghi/mno/def")
-	require.Contains(t, otherPackages, flowPackagePrefix+"abc/def/ghi/mno/ghi")
-	require.Contains(t, otherPackages, flowPackagePrefix+"abc/def/jkl")
-	require.Contains(t, otherPackages, flowPackagePrefix+"abc/def/jkl/mno")
-	require.Contains(t, otherPackages, flowPackagePrefix+"abc/def/jkl/mno/pqr")
-	require.Contains(t, otherPackages, flowPackagePrefix+"def")
-	require.Contains(t, otherPackages, flowPackagePrefix+"def/abc")
-	require.Contains(t, otherPackages, flowPackagePrefix+"jkl")
-	require.Contains(t, otherPackages, flowPackagePrefix+"pqr")
-	require.Contains(t, otherPackages, flowPackagePrefix+"vwx")
-	require.Contains(t, otherPackages, flowPackagePrefix+"vwx/ghi")
-	require.Contains(t, otherPackages, flowPackagePrefix+"yz")
-}
-
-// TestGenerateTestMatrix_CustomRunners tests that the test matrix is generated correctly where the target packages include top level
-// packages as well as sub packages. It also tests having 2 different custom CI runners, as well as default runners.
-func TestGenerateTestMatrix_CustomRunners(t *testing.T) {
-	target, seenPackages := listTargetPackages([]string{"abc/def", "def:foo-runner", "ghi", "vwx/ghi:foo-runner2"}, getAllFlowPackages())
-	require.Equal(t, 4, len(target.packages))
-	require.Equal(t, 4, len(target.runners))
-	require.Equal(t, 15, len(seenPackages))
-
-	otherPackages := listOtherPackages(getAllFlowPackages(), seenPackages)
-
-	matrix := generateTestMatrix(target, otherPackages)
-
-	// should be 4 groups in test matrix: abc/def, def, ghi, vwx/ghi, others
-	require.Equal(t, 5, len(matrix))
-
-	require.Contains(t, matrix, testMatrix{
-		Name:     "abc/def",
-		Packages: "github.com/onflow/flow-go/abc/def github.com/onflow/flow-go/abc/def/ghi github.com/onflow/flow-go/abc/def/ghi/jkl github.com/onflow/flow-go/abc/def/ghi/jkl/mno github.com/onflow/flow-go/abc/def/ghi/jkl/mno/pqr github.com/onflow/flow-go/abc/def/ghi/mno/abc github.com/onflow/flow-go/abc/def/ghi/mno/def github.com/onflow/flow-go/abc/def/ghi/mno/ghi github.com/onflow/flow-go/abc/def/jkl github.com/onflow/flow-go/abc/def/jkl/mno github.com/onflow/flow-go/abc/def/jkl/mno/pqr",
-		Runner:   "ubuntu-latest"},
-	)
-	require.Contains(t, matrix, testMatrix{
-		Name:     "def",
-		Packages: "github.com/onflow/flow-go/def github.com/onflow/flow-go/def/abc",
-		Runner:   "foo-runner"},
-	)
-	require.Contains(t, matrix, testMatrix{
-		Name:     "ghi",
-		Packages: "github.com/onflow/flow-go/ghi",
-		Runner:   "ubuntu-latest"},
-	)
-	require.Contains(t, matrix, testMatrix{
-		Name:     "vwx/ghi",
-		Packages: "github.com/onflow/flow-go/vwx/ghi",
-		Runner:   "foo-runner2"},
-	)
-	require.Contains(t, matrix, testMatrix{
-		Name:     "others",
-		Packages: "github.com/onflow/flow-go/abc github.com/onflow/flow-go/abc/123 github.com/onflow/flow-go/jkl github.com/onflow/flow-go/mno/abc github.com/onflow/flow-go/pqr github.com/onflow/flow-go/stu github.com/onflow/flow-go/vwx github.com/onflow/flow-go/yz",
-		Runner:   "ubuntu-latest"},
-	)
-}
-
-// TestGenerateTestMatrix_SubSubPackages tests that the test matrix is generated correctly where the target packages
-// include 2nd and 3rd level sub packages. It also tests having 2 different custom CI runners, as well as default runners.
-func TestGenerateTestMatrix_SubSubPackages(t *testing.T) {
-	target, seenPackages := listTargetPackages([]string{"abc/def/ghi:foo-runner1", "abc/def/jkl:foo-runner2", "abc"}, getAllFlowPackages())
-	require.Equal(t, 3, len(target.packages))
-	require.Equal(t, 3, len(target.runners))
-	require.Equal(t, 13, len(seenPackages))
-
-	otherPackages := listOtherPackages(getAllFlowPackages(), seenPackages)
-
-	matrix := generateTestMatrix(target, otherPackages)
-
-	// should be 4 groups in test matrix: abc/def/ghi, abc/def/jkl, abc, others
-	require.Equal(t, 4, len(matrix))
-
-	require.Contains(t, matrix, testMatrix{
-		Name:     "abc/def/ghi",
-		Packages: "github.com/onflow/flow-go/abc/def/ghi github.com/onflow/flow-go/abc/def/ghi/jkl github.com/onflow/flow-go/abc/def/ghi/jkl/mno github.com/onflow/flow-go/abc/def/ghi/jkl/mno/pqr github.com/onflow/flow-go/abc/def/ghi/mno/abc github.com/onflow/flow-go/abc/def/ghi/mno/def github.com/onflow/flow-go/abc/def/ghi/mno/ghi",
-		Runner:   "foo-runner1"},
-	)
-
-	require.Contains(t, matrix, testMatrix{
-		Name:     "abc/def/jkl",
-		Packages: "github.com/onflow/flow-go/abc/def/jkl github.com/onflow/flow-go/abc/def/jkl/mno github.com/onflow/flow-go/abc/def/jkl/mno/pqr",
-		Runner:   "foo-runner2"},
-	)
-
-	// parent package should not have any packages from its sub packages because they were already included in the sub package groups
-	require.Contains(t, matrix, testMatrix{
-		Name:     "abc",
-		Packages: "github.com/onflow/flow-go/abc github.com/onflow/flow-go/abc/123 github.com/onflow/flow-go/abc/def",
-		Runner:   "ubuntu-latest"},
-	)
-
-	require.Contains(t, matrix, testMatrix{
-		Name:     "others",
-		Packages: "github.com/onflow/flow-go/def github.com/onflow/flow-go/def/abc github.com/onflow/flow-go/ghi github.com/onflow/flow-go/jkl github.com/onflow/flow-go/mno/abc github.com/onflow/flow-go/pqr github.com/onflow/flow-go/stu github.com/onflow/flow-go/vwx github.com/onflow/flow-go/vwx/ghi github.com/onflow/flow-go/yz",
-		Runner:   "ubuntu-latest"},
-	)
-}
diff --git a/utils/unittest/chain_suite.go b/utils/unittest/chain_suite.go
index 0905929874a..5d232c50aa2 100644
--- a/utils/unittest/chain_suite.go
+++ b/utils/unittest/chain_suite.go
@@ -420,7 +420,7 @@ func StateSnapshotForKnownBlock(block *flow.Header, identities map[flow.Identifi
 		},
 	)
 	snapshot.On("Identities", mock.Anything).Return(
-		func(selector flow.IdentityFilter) flow.IdentityList {
+		func(selector flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			var idts flow.IdentityList
 			for _, i := range identities {
 				if selector(i) {
@@ -429,7 +429,7 @@ func StateSnapshotForKnownBlock(block *flow.Header, identities map[flow.Identifi
 			}
 			return idts
 		},
-		func(selector flow.IdentityFilter) error {
+		func(selector flow.IdentityFilter[flow.Identity]) error {
 			return nil
 		},
 	)
diff --git a/utils/unittest/cluster.go b/utils/unittest/cluster.go
index a88f4c6c13a..f1365cc1dde 100644
--- a/utils/unittest/cluster.go
+++ b/utils/unittest/cluster.go
@@ -12,7 +12,7 @@ import (
 
 // TransactionForCluster generates a transaction that will be assigned to the
 // target cluster ID.
-func TransactionForCluster(clusters flow.ClusterList, target flow.IdentityList) flow.TransactionBody {
+func TransactionForCluster(clusters flow.ClusterList, target flow.IdentitySkeletonList) flow.TransactionBody {
 	tx := TransactionBodyFixture()
 	return AlterTransactionForCluster(tx, clusters, target, func(*flow.TransactionBody) {})
 }
@@ -22,7 +22,7 @@ func TransactionForCluster(clusters flow.ClusterList, target flow.IdentityList)
 //
 // The `after` function is run after each modification to allow for any content
 // dependent changes to the transaction (eg. signing it).
-func AlterTransactionForCluster(tx flow.TransactionBody, clusters flow.ClusterList, target flow.IdentityList, after func(tx *flow.TransactionBody)) flow.TransactionBody {
+func AlterTransactionForCluster(tx flow.TransactionBody, clusters flow.ClusterList, target flow.IdentitySkeletonList, after func(tx *flow.TransactionBody)) flow.TransactionBody {
 
 	// Bound to avoid infinite loop in case the routing algorithm is broken
 	for i := 0; i < 10000; i++ {
@@ -46,12 +46,12 @@ func AlterTransactionForCluster(tx flow.TransactionBody, clusters flow.ClusterLi
 
 // ClusterAssignment creates an assignment list with n clusters and with nodes
 // evenly distributed among clusters.
-func ClusterAssignment(n uint, nodes flow.IdentityList) flow.AssignmentList {
+func ClusterAssignment(n uint, nodes flow.IdentitySkeletonList) flow.AssignmentList {
 
-	collectors := nodes.Filter(filter.HasRole(flow.RoleCollection))
+	collectors := nodes.Filter(filter.HasRole[flow.IdentitySkeleton](flow.RoleCollection))
 
 	// order, so the same list results in the same
-	slices.SortFunc(collectors, flow.Canonical)
+	slices.SortFunc(collectors, flow.Canonical[flow.IdentitySkeleton])
 
 	assignments := make(flow.AssignmentList, n)
 	for i, collector := range collectors {
@@ -62,9 +62,9 @@ func ClusterAssignment(n uint, nodes flow.IdentityList) flow.AssignmentList {
 	return assignments
 }
 
-func ClusterList(n uint, nodes flow.IdentityList) flow.ClusterList {
+func ClusterList(n uint, nodes flow.IdentitySkeletonList) flow.ClusterList {
 	assignments := ClusterAssignment(n, nodes)
-	clusters, err := factory.NewClusterList(assignments, nodes.Filter(filter.HasRole(flow.RoleCollection)))
+	clusters, err := factory.NewClusterList(assignments, nodes.Filter(filter.HasRole[flow.IdentitySkeleton](flow.RoleCollection)))
 	if err != nil {
 		panic(err)
 	}
diff --git a/utils/unittest/epoch_builder.go b/utils/unittest/epoch_builder.go
index 321522f582a..b1cb5193933 100644
--- a/utils/unittest/epoch_builder.go
+++ b/utils/unittest/epoch_builder.go
@@ -70,27 +70,29 @@ func (epoch EpochHeights) CommittedRange() []uint64 {
 
 // EpochBuilder is a testing utility for building epochs into chain state.
 type EpochBuilder struct {
-	t          *testing.T
-	states     []protocol.FollowerState
-	blocksByID map[flow.Identifier]*flow.Block
-	blocks     []*flow.Block
-	built      map[uint64]*EpochHeights
-	setupOpts  []func(*flow.EpochSetup)  // options to apply to the EpochSetup event
-	commitOpts []func(*flow.EpochCommit) // options to apply to the EpochCommit event
+	t                    *testing.T
+	mutableProtocolState protocol.MutableProtocolState
+	states               []protocol.FollowerState
+	blocksByID           map[flow.Identifier]*flow.Block
+	blocks               []*flow.Block
+	built                map[uint64]*EpochHeights
+	setupOpts            []func(*flow.EpochSetup)  // options to apply to the EpochSetup event
+	commitOpts           []func(*flow.EpochCommit) // options to apply to the EpochCommit event
 }
 
 // NewEpochBuilder returns a new EpochBuilder which will build epochs using the
 // given states. At least one state must be provided. If more than one are
 // provided they must have the same initial state.
-func NewEpochBuilder(t *testing.T, states ...protocol.FollowerState) *EpochBuilder {
+func NewEpochBuilder(t *testing.T, mutator protocol.MutableProtocolState, states ...protocol.FollowerState) *EpochBuilder {
 	require.True(t, len(states) >= 1, "must provide at least one state")
 
 	builder := &EpochBuilder{
-		t:          t,
-		states:     states,
-		blocksByID: make(map[flow.Identifier]*flow.Block),
-		blocks:     make([]*flow.Block, 0),
-		built:      make(map[uint64]*EpochHeights),
+		t:                    t,
+		mutableProtocolState: mutator,
+		states:               states,
+		blocksByID:           make(map[flow.Identifier]*flow.Block),
+		blocks:               make([]*flow.Block, 0),
+		built:                make(map[uint64]*EpochHeights),
 	}
 	return builder
 }
@@ -159,20 +161,20 @@ func (builder *EpochBuilder) BuildEpoch() *EpochBuilder {
 
 	// prepare default values for the service events based on the current state
 	identities, err := state.Final().Identities(filter.Any)
-	require.Nil(builder.t, err)
+	require.NoError(builder.t, err)
 	epoch := state.Final().Epochs().Current()
 	counter, err := epoch.Counter()
-	require.Nil(builder.t, err)
+	require.NoError(builder.t, err)
 	finalView, err := epoch.FinalView()
-	require.Nil(builder.t, err)
+	require.NoError(builder.t, err)
 
 	// retrieve block A
 	A, err := state.Final().Head()
-	require.Nil(builder.t, err)
+	require.NoError(builder.t, err)
 
 	// check that block A satisfies initial condition
 	phase, err := state.Final().Phase()
-	require.Nil(builder.t, err)
+	require.NoError(builder.t, err)
 	require.Equal(builder.t, flow.EpochPhaseStaking, phase)
 
 	// Define receipts and seals for block B payload. They will be nil if A is
@@ -201,7 +203,7 @@ func (builder *EpochBuilder) BuildEpoch() *EpochBuilder {
 
 	// defaults for the EpochSetup event
 	setupDefaults := []func(*flow.EpochSetup){
-		WithParticipants(identities),
+		WithParticipants(identities.ToSkeleton()),
 		SetupWithCounter(counter + 1),
 		WithFirstView(finalView + 1),
 		WithFinalView(finalView + 1_000_000),
@@ -364,11 +366,22 @@ func (builder *EpochBuilder) BuildBlocks(n uint) {
 }
 
 // addBlock adds the given block to the state by: extending the state,
-// finalizing the block, marking the block as valid, and caching the block.
+// finalizing the block, and caching the block.
 func (builder *EpochBuilder) addBlock(block *flow.Block) {
+	stateMutator, err := builder.mutableProtocolState.Mutator(block.Header.View, block.Header.ParentID)
+	require.NoError(builder.t, err)
+
+	err = stateMutator.ApplyServiceEventsFromValidatedSeals(block.Payload.Seals)
+	require.NoError(builder.t, err)
+
+	_, _, updatedStateId, _ := stateMutator.Build()
+	require.NoError(builder.t, err)
+
+	block.Payload.ProtocolStateID = updatedStateId
+	block.Header.PayloadHash = block.Payload.Hash()
 	blockID := block.ID()
 	for _, state := range builder.states {
-		err := state.ExtendCertified(context.Background(), block, CertifyBlock(block.Header))
+		err = state.ExtendCertified(context.Background(), block, CertifyBlock(block.Header))
 		require.NoError(builder.t, err)
 
 		err = state.Finalize(context.Background(), blockID)
diff --git a/utils/unittest/execution_state.go b/utils/unittest/execution_state.go
index 5e0b3d3620f..1225de5936c 100644
--- a/utils/unittest/execution_state.go
+++ b/utils/unittest/execution_state.go
@@ -23,7 +23,7 @@ const ServiceAccountPrivateKeySignAlgo = crypto.ECDSAP256
 const ServiceAccountPrivateKeyHashAlgo = hash.SHA2_256
 
 // Pre-calculated state commitment with root account with the above private key
-const GenesisStateCommitmentHex = "e4674bba14f59af783bbf70b2a43c1696a7d9888eeaca86cf74b033580fe1c23"
+const GenesisStateCommitmentHex = "f52a276f66910559916f46d5d4e59013e8f4b217f0ca01f098e16e9a76c921c5"
 
 var GenesisStateCommitment flow.StateCommitment
 
@@ -87,10 +87,7 @@ func genesisCommitHexByChainID(chainID flow.ChainID) string {
 		return GenesisStateCommitmentHex
 	}
 	if chainID == flow.Testnet {
-		return "bfe964655cf13711b93dbaf156aaebbc24a607beed69dd36d71b593832b5129c"
+		return "b048e9114f816d26f71aeb6aa425161b281ebeddbcd323a5f30e571ac911dfa3"
 	}
-	if chainID == flow.Sandboxnet {
-		return "e1c08b17f9e5896f03fe28dd37ca396c19b26628161506924fbf785834646ea1"
-	}
-	return "a56a2750708bc981eb949a3b02a41061dc6b7e6bfa9f31a19a48f560f616bed3"
+	return "ef65504ae38f3666acdd1a3cc260620464827082a7c554751527a82bdee4dc89"
 }
diff --git a/utils/unittest/fixtures.go b/utils/unittest/fixtures.go
index b6a8e624d19..78c699519d1 100644
--- a/utils/unittest/fixtures.go
+++ b/utils/unittest/fixtures.go
@@ -33,6 +33,7 @@ import (
 	"github.com/onflow/flow-go/model/encoding"
 	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/model/flow/filter"
+	"github.com/onflow/flow-go/model/flow/mapfunc"
 	"github.com/onflow/flow-go/model/messages"
 	"github.com/onflow/flow-go/model/verification"
 	"github.com/onflow/flow-go/module"
@@ -193,6 +194,35 @@ func BlockFixture() flow.Block {
 	return *BlockWithParentFixture(header)
 }
 
+func ChainBlockFixture(n int) []*flow.Block {
+	root := BlockHeaderFixture()
+	return ChainBlockFixtureWithRoot(root, n)
+}
+
+func ChainBlockFixtureWithRoot(root *flow.Header, n int) []*flow.Block {
+	bs := make([]*flow.Block, 0, n)
+	parent := root
+	for i := 0; i < n; i++ {
+		b := BlockWithParentFixture(parent)
+		bs = append(bs, b)
+		parent = b.Header
+	}
+	return bs
+}
+
+func RechainBlocks(blocks []*flow.Block) {
+	if len(blocks) == 0 {
+		return
+	}
+
+	parent := blocks[0]
+
+	for _, block := range blocks[1:] {
+		block.Header.ParentID = parent.ID()
+		parent = block
+	}
+}
+
 func FullBlockFixture() flow.Block {
 	block := BlockFixture()
 	payload := block.Payload
@@ -205,6 +235,7 @@ func FullBlockFixture() flow.Block {
 		ExecutionReceiptFixture(WithResult(payload.Results[0])).Meta(),
 		ExecutionReceiptFixture(WithResult(payload.Results[1])).Meta(),
 	}
+	payload.ProtocolStateID = IdentifierFixture()
 
 	header := block.Header
 	header.PayloadHash = payload.Hash()
@@ -287,6 +318,7 @@ func WithAllTheFixins(payload *flow.Payload) {
 		payload.Receipts = flow.ExecutionReceiptMetaList{receipt.Meta()}
 		payload.Results = flow.ExecutionResultList{&receipt.ExecutionResult}
 	}
+	payload.ProtocolStateID = IdentifierFixture()
 }
 
 func WithSeals(seals ...*flow.Seal) func(*flow.Payload) {
@@ -310,6 +342,12 @@ func WithReceipts(receipts ...*flow.ExecutionReceipt) func(*flow.Payload) {
 	}
 }
 
+func WithProtocolStateID(stateID flow.Identifier) func(payload *flow.Payload) {
+	return func(payload *flow.Payload) {
+		payload.ProtocolStateID = stateID
+	}
+}
+
 // WithReceiptsAndNoResults will add receipt to payload only
 func WithReceiptsAndNoResults(receipts ...*flow.ExecutionReceipt) func(*flow.Payload) {
 	return func(payload *flow.Payload) {
@@ -338,6 +376,16 @@ func BlockWithParentFixture(parent *flow.Header) *flow.Block {
 	}
 }
 
+func BlockWithParentProtocolState(parent *flow.Block) *flow.Block {
+	payload := PayloadFixture(WithProtocolStateID(parent.Payload.ProtocolStateID))
+	header := BlockHeaderWithParentFixture(parent.Header)
+	header.PayloadHash = payload.Hash()
+	return &flow.Block{
+		Header:  header,
+		Payload: &payload,
+	}
+}
+
 func BlockWithGuaranteesFixture(guarantees []*flow.CollectionGuarantee) *flow.Block {
 	payload := PayloadFixture(WithGuarantees(guarantees...))
 	header := BlockHeaderFixture()
@@ -586,6 +634,17 @@ func WithCollection(collection *flow.Collection) func(guarantee *flow.Collection
 	}
 }
 
+func AddCollectionsToBlock(block *flow.Block, collections []*flow.Collection) {
+	gs := make([]*flow.CollectionGuarantee, 0, len(collections))
+	for _, collection := range collections {
+		g := collection.Guarantee()
+		gs = append(gs, &g)
+	}
+
+	block.Payload.Guarantees = gs
+	block.SetPayload(*block.Payload)
+}
+
 func CollectionGuaranteeFixture(options ...func(*flow.CollectionGuarantee)) *flow.CollectionGuarantee {
 	guarantee := &flow.CollectionGuarantee{
 		CollectionID:  IdentifierFixture(),
@@ -1028,16 +1087,17 @@ func WithRole(role flow.Role) func(*flow.Identity) {
 	}
 }
 
-// WithWeight sets the weight on an identity fixture.
-func WithWeight(weight uint64) func(*flow.Identity) {
+// WithInitialWeight sets the initial weight on an identity fixture.
+func WithInitialWeight(weight uint64) func(*flow.Identity) {
 	return func(identity *flow.Identity) {
-		identity.Weight = weight
+		identity.InitialWeight = weight
 	}
 }
 
-func WithEjected(ejected bool) func(*flow.Identity) {
+// WithParticipationStatus sets the epoch participation status on an identity fixture.
+func WithParticipationStatus(status flow.EpochParticipationStatus) func(*flow.Identity) {
 	return func(identity *flow.Identity) {
-		identity.Ejected = ejected
+		identity.EpochParticipationStatus = status
 	}
 }
 
@@ -1072,7 +1132,7 @@ func NodeConfigFixture(opts ...func(*flow.Identity)) bootstrap.NodeConfig {
 	return bootstrap.NodeConfig{
 		Role:    identity.Role,
 		Address: identity.Address,
-		Weight:  identity.Weight,
+		Weight:  identity.InitialWeight,
 	}
 }
 
@@ -1091,9 +1151,16 @@ func NodeInfosFixture(n int, opts ...func(*flow.Identity)) []bootstrap.NodeInfo
 	return nodeInfos
 }
 
+func PrivateNodeInfoFixture(opts ...func(*flow.Identity)) bootstrap.NodeInfo {
+	return PrivateNodeInfosFixture(1, opts...)[0]
+}
+
 func PrivateNodeInfosFixture(n int, opts ...func(*flow.Identity)) []bootstrap.NodeInfo {
-	il := IdentityListFixture(n, opts...)
-	nodeInfos := make([]bootstrap.NodeInfo, 0, n)
+	return PrivateNodeInfosFromIdentityList(IdentityListFixture(n, opts...))
+}
+
+func PrivateNodeInfosFromIdentityList(il flow.IdentityList) []bootstrap.NodeInfo {
+	nodeInfos := make([]bootstrap.NodeInfo, 0, len(il))
 	for _, identity := range il {
 		nodeInfo := bootstrap.PrivateNodeInfoFromIdentity(identity, KeyFixture(crypto.ECDSAP256), KeyFixture(crypto.BLSBLS12381))
 		nodeInfos = append(nodeInfos, nodeInfo)
@@ -1106,11 +1173,16 @@ func IdentityFixture(opts ...func(*flow.Identity)) *flow.Identity {
 	nodeID := IdentifierFixture()
 	stakingKey := StakingPrivKeyByIdentifier(nodeID)
 	identity := flow.Identity{
-		NodeID:        nodeID,
-		Address:       fmt.Sprintf("address-%x", nodeID[0:7]),
-		Role:          flow.RoleConsensus,
-		Weight:        1000,
-		StakingPubKey: stakingKey.PublicKey(),
+		IdentitySkeleton: flow.IdentitySkeleton{
+			NodeID:        nodeID,
+			Address:       fmt.Sprintf("address-%x", nodeID[0:7]),
+			Role:          flow.RoleConsensus,
+			InitialWeight: 1000,
+			StakingPubKey: stakingKey.PublicKey(),
+		},
+		DynamicIdentity: flow.DynamicIdentity{
+			EpochParticipationStatus: flow.EpochParticipationStatusActive,
+		},
 	}
 	for _, apply := range opts {
 		apply(&identity)
@@ -1973,10 +2045,10 @@ func VoteWithBeaconSig() func(*hotstuff.Vote) {
 	}
 }
 
-func WithParticipants(participants flow.IdentityList) func(*flow.EpochSetup) {
+func WithParticipants(participants flow.IdentitySkeletonList) func(*flow.EpochSetup) {
 	return func(setup *flow.EpochSetup) {
-		setup.Participants = participants.Sort(flow.Canonical)
-		setup.Assignments = ClusterAssignment(1, participants)
+		setup.Participants = participants.Sort(flow.Canonical[flow.IdentitySkeleton])
+		setup.Assignments = ClusterAssignment(1, participants.ToSkeleton())
 	}
 }
 
@@ -2007,11 +2079,13 @@ func EpochSetupFixture(opts ...func(setup *flow.EpochSetup)) *flow.EpochSetup {
 		Counter:            uint64(rand.Uint32()),
 		FirstView:          uint64(0),
 		FinalView:          uint64(rand.Uint32() + 1000),
-		Participants:       participants.Sort(flow.Canonical),
+		Participants:       participants.Sort(flow.Canonical[flow.Identity]).ToSkeleton(),
 		RandomSource:       SeedFixture(flow.EpochSetupRandomSourceLength),
 		DKGPhase1FinalView: 100,
 		DKGPhase2FinalView: 200,
 		DKGPhase3FinalView: 300,
+		TargetDuration:     60 * 60,
+		TargetEndTime:      uint64(time.Now().Add(time.Hour).Unix()),
 	}
 	for _, apply := range opts {
 		apply(setup)
@@ -2022,23 +2096,6 @@ func EpochSetupFixture(opts ...func(setup *flow.EpochSetup)) *flow.EpochSetup {
 	return setup
 }
 
-func EpochStatusFixture() *flow.EpochStatus {
-	return &flow.EpochStatus{
-		PreviousEpoch: flow.EventIDs{
-			SetupID:  IdentifierFixture(),
-			CommitID: IdentifierFixture(),
-		},
-		CurrentEpoch: flow.EventIDs{
-			SetupID:  IdentifierFixture(),
-			CommitID: IdentifierFixture(),
-		},
-		NextEpoch: flow.EventIDs{
-			SetupID:  IdentifierFixture(),
-			CommitID: IdentifierFixture(),
-		},
-	}
-}
-
 func IndexFixture() *flow.Index {
 	return &flow.Index{
 		CollectionIDs: IdentifierListFixture(5),
@@ -2047,7 +2104,7 @@ func IndexFixture() *flow.Index {
 	}
 }
 
-func WithDKGFromParticipants(participants flow.IdentityList) func(*flow.EpochCommit) {
+func WithDKGFromParticipants(participants flow.IdentitySkeletonList) func(*flow.EpochCommit) {
 	count := len(participants.Filter(filter.IsValidDKGParticipant))
 	return func(commit *flow.EpochCommit) {
 		commit.DKGParticipantKeys = PublicKeysFixture(count, crypto.BLSBLS12381)
@@ -2066,9 +2123,9 @@ func WithClusterQCsFromAssignments(assignments flow.AssignmentList) func(*flow.E
 	}
 }
 
-func DKGParticipantLookup(participants flow.IdentityList) map[flow.Identifier]flow.DKGParticipant {
+func DKGParticipantLookup(participants flow.IdentitySkeletonList) map[flow.Identifier]flow.DKGParticipant {
 	lookup := make(map[flow.Identifier]flow.DKGParticipant)
-	for i, node := range participants.Filter(filter.HasRole(flow.RoleConsensus)) {
+	for i, node := range participants.Filter(filter.HasRole[flow.IdentitySkeleton](flow.RoleConsensus)) {
 		lookup[node.NodeID] = flow.DKGParticipant{
 			Index:    uint(i),
 			KeyShare: KeyFixture(crypto.BLSBLS12381).PublicKey(),
@@ -2148,18 +2205,20 @@ func BootstrapFixtureWithChainID(
 
 	counter := uint64(1)
 	setup := EpochSetupFixture(
-		WithParticipants(participants),
+		WithParticipants(participants.ToSkeleton()),
 		SetupWithCounter(counter),
 		WithFirstView(root.Header.View),
-		WithFinalView(root.Header.View+1000),
+		WithFinalView(root.Header.View+100_000),
 	)
 	commit := EpochCommitFixture(
 		CommitWithCounter(counter),
 		WithClusterQCsFromAssignments(setup.Assignments),
-		WithDKGFromParticipants(participants),
+		WithDKGFromParticipants(participants.ToSkeleton()),
 	)
 
+	root.SetPayload(flow.Payload{ProtocolStateID: inmem.ProtocolStateFromEpochServiceEvents(setup, commit).ID()})
 	stateCommit := GenesisStateCommitmentByChainID(chainID)
+
 	result := BootstrapExecutionResultFixture(root, stateCommit)
 	result.ServiceEvents = []flow.ServiceEvent{
 		setup.ServiceEvent(),
@@ -2185,7 +2244,7 @@ func RootSnapshotFixtureWithChainID(
 	chainID flow.ChainID,
 	opts ...func(*flow.Block),
 ) *inmem.Snapshot {
-	block, result, seal := BootstrapFixtureWithChainID(participants.Sort(flow.Canonical), chainID, opts...)
+	block, result, seal := BootstrapFixtureWithChainID(participants.Sort(flow.Canonical[flow.Identity]), chainID, opts...)
 	qc := QuorumCertificateFixture(QCWithRootBlockID(block.ID()))
 	root, err := inmem.SnapshotFromBootstrapState(block, result, seal, qc)
 	if err != nil {
@@ -2568,6 +2627,188 @@ func ChunkExecutionDataFixture(t *testing.T, minSize int, opts ...func(*executio
 	}
 }
 
+// RootProtocolStateFixture creates a fixture with correctly structured data for root protocol state.
+// This can be useful for testing bootstrap when there is no previous epoch.
+func RootProtocolStateFixture() *flow.RichProtocolStateEntry {
+	currentEpochSetup := EpochSetupFixture(func(setup *flow.EpochSetup) {
+		setup.Counter = 1
+	})
+	currentEpochCommit := EpochCommitFixture(func(commit *flow.EpochCommit) {
+		commit.Counter = currentEpochSetup.Counter
+	})
+
+	allIdentities := make(flow.IdentityList, 0, len(currentEpochSetup.Participants))
+	for _, identity := range currentEpochSetup.Participants {
+		allIdentities = append(allIdentities, &flow.Identity{
+			IdentitySkeleton: *identity,
+			DynamicIdentity: flow.DynamicIdentity{
+				EpochParticipationStatus: flow.EpochParticipationStatusActive,
+			},
+		})
+	}
+	return &flow.RichProtocolStateEntry{
+		ProtocolStateEntry: &flow.ProtocolStateEntry{
+			PreviousEpoch: nil,
+			CurrentEpoch: flow.EpochStateContainer{
+				SetupID:          currentEpochSetup.ID(),
+				CommitID:         currentEpochCommit.ID(),
+				ActiveIdentities: flow.DynamicIdentityEntryListFromIdentities(allIdentities),
+			},
+			InvalidEpochTransitionAttempted: false,
+			NextEpoch:                       nil,
+		},
+		PreviousEpochSetup:        nil,
+		PreviousEpochCommit:       nil,
+		CurrentEpochSetup:         currentEpochSetup,
+		CurrentEpochCommit:        currentEpochCommit,
+		NextEpochSetup:            nil,
+		NextEpochCommit:           nil,
+		CurrentEpochIdentityTable: allIdentities,
+		NextEpochIdentityTable:    flow.IdentityList{},
+	}
+}
+
+// ProtocolStateFixture creates a fixture with correctly structured data. The returned Identity Table
+// represents the common situation during the staking phase of Epoch N+1:
+//   - we are currently in Epoch N
+//   - previous epoch N-1 is known (specifically EpochSetup and EpochCommit events)
+//   - network is currently in the staking phase to setup the next epoch, hence no service
+//     events for the next epoch exist
+//
+// In particular, the following consistency requirements hold:
+//   - Epoch setup and commit counters are set to match.
+//   - Identities are constructed from setup events.
+//   - Identities are sorted in canonical order.
+func ProtocolStateFixture(options ...func(*flow.RichProtocolStateEntry)) *flow.RichProtocolStateEntry {
+	prevEpochSetup := EpochSetupFixture()
+	prevEpochCommit := EpochCommitFixture(func(commit *flow.EpochCommit) {
+		commit.Counter = prevEpochSetup.Counter
+	})
+	currentEpochSetup := EpochSetupFixture(func(setup *flow.EpochSetup) {
+		setup.Counter = prevEpochSetup.Counter + 1
+		// reuse same participant for current epoch
+		sameParticipant := *prevEpochSetup.Participants[1]
+		setup.Participants = append(setup.Participants, &sameParticipant)
+		setup.Participants = setup.Participants.Sort(flow.Canonical[flow.IdentitySkeleton])
+	})
+	currentEpochCommit := EpochCommitFixture(func(commit *flow.EpochCommit) {
+		commit.Counter = currentEpochSetup.Counter
+	})
+
+	buildDefaultIdentities := func(setup *flow.EpochSetup) flow.IdentityList {
+		epochIdentities := make(flow.IdentityList, 0, len(setup.Participants))
+		for _, identity := range setup.Participants {
+			epochIdentities = append(epochIdentities, &flow.Identity{
+				IdentitySkeleton: *identity,
+				DynamicIdentity: flow.DynamicIdentity{
+					EpochParticipationStatus: flow.EpochParticipationStatusActive,
+				},
+			})
+		}
+		return epochIdentities.Sort(flow.Canonical[flow.Identity])
+	}
+
+	prevEpochIdentities := buildDefaultIdentities(prevEpochSetup)
+	currentEpochIdentities := buildDefaultIdentities(currentEpochSetup)
+	allIdentities := currentEpochIdentities.Union(
+		prevEpochIdentities.Map(mapfunc.WithEpochParticipationStatus(flow.EpochParticipationStatusLeaving)))
+
+	entry := &flow.RichProtocolStateEntry{
+		ProtocolStateEntry: &flow.ProtocolStateEntry{
+			CurrentEpoch: flow.EpochStateContainer{
+				SetupID:          currentEpochSetup.ID(),
+				CommitID:         currentEpochCommit.ID(),
+				ActiveIdentities: flow.DynamicIdentityEntryListFromIdentities(currentEpochIdentities),
+			},
+			PreviousEpoch: &flow.EpochStateContainer{
+				SetupID:          prevEpochSetup.ID(),
+				CommitID:         prevEpochCommit.ID(),
+				ActiveIdentities: flow.DynamicIdentityEntryListFromIdentities(prevEpochIdentities),
+			},
+			InvalidEpochTransitionAttempted: false,
+			NextEpoch:                       nil,
+		},
+		PreviousEpochSetup:        prevEpochSetup,
+		PreviousEpochCommit:       prevEpochCommit,
+		CurrentEpochSetup:         currentEpochSetup,
+		CurrentEpochCommit:        currentEpochCommit,
+		NextEpochSetup:            nil,
+		NextEpochCommit:           nil,
+		CurrentEpochIdentityTable: allIdentities,
+		NextEpochIdentityTable:    flow.IdentityList{},
+	}
+
+	for _, option := range options {
+		option(entry)
+	}
+
+	return entry
+}
+
+// WithNextEpochProtocolState creates a fixture with correctly structured data for next epoch.
+// The resulting Identity Table represents the common situation during the epoch commit phase for Epoch N+1:
+//   - We are currently in Epoch N.
+//   - The previous epoch N-1 is known (specifically EpochSetup and EpochCommit events).
+//   - The network has completed the epoch setup phase, i.e. published the EpochSetup and EpochCommit events for epoch N+1.
+func WithNextEpochProtocolState() func(entry *flow.RichProtocolStateEntry) {
+	return func(entry *flow.RichProtocolStateEntry) {
+		nextEpochSetup := EpochSetupFixture(func(setup *flow.EpochSetup) {
+			setup.Counter = entry.CurrentEpochSetup.Counter + 1
+			setup.FirstView = entry.CurrentEpochSetup.FinalView + 1
+			setup.FinalView = setup.FirstView + 1000
+			// reuse same participant for current epoch
+			sameParticipant := *entry.CurrentEpochSetup.Participants[1]
+			setup.Participants[1] = &sameParticipant
+			setup.Participants = setup.Participants.Sort(flow.Canonical[flow.IdentitySkeleton])
+		})
+		nextEpochCommit := EpochCommitFixture(func(commit *flow.EpochCommit) {
+			commit.Counter = nextEpochSetup.Counter
+		})
+
+		nextEpochParticipants := make(flow.IdentityList, 0, len(nextEpochSetup.Participants))
+		for _, identity := range nextEpochSetup.Participants {
+			nextEpochParticipants = append(nextEpochParticipants, &flow.Identity{
+				IdentitySkeleton: *identity,
+				DynamicIdentity: flow.DynamicIdentity{
+					EpochParticipationStatus: flow.EpochParticipationStatusActive,
+				},
+			})
+		}
+		nextEpochParticipants = nextEpochParticipants.Sort(flow.Canonical[flow.Identity])
+
+		currentEpochParticipants := entry.CurrentEpochIdentityTable.Filter(func(identity *flow.Identity) bool {
+			_, found := entry.CurrentEpochSetup.Participants.ByNodeID(identity.NodeID)
+			return found
+		}).Sort(flow.Canonical[flow.Identity])
+
+		entry.CurrentEpochIdentityTable = currentEpochParticipants.Union(
+			nextEpochParticipants.Map(mapfunc.WithEpochParticipationStatus(flow.EpochParticipationStatusJoining)))
+		entry.NextEpochIdentityTable = nextEpochParticipants.Union(
+			currentEpochParticipants.Map(mapfunc.WithEpochParticipationStatus(flow.EpochParticipationStatusLeaving)))
+
+		entry.NextEpoch = &flow.EpochStateContainer{
+			SetupID:          nextEpochSetup.ID(),
+			CommitID:         nextEpochCommit.ID(),
+			ActiveIdentities: flow.DynamicIdentityEntryListFromIdentities(nextEpochParticipants),
+		}
+		entry.NextEpochSetup = nextEpochSetup
+		entry.NextEpochCommit = nextEpochCommit
+	}
+}
+
+// WithValidDKG updated protocol state with correctly structured data for DKG.
+func WithValidDKG() func(*flow.RichProtocolStateEntry) {
+	return func(entry *flow.RichProtocolStateEntry) {
+		commit := entry.CurrentEpochCommit
+		dkgParticipants := entry.CurrentEpochSetup.Participants.Filter(filter.IsValidDKGParticipant)
+		lookup := DKGParticipantLookup(dkgParticipants)
+		commit.DKGParticipantKeys = make([]crypto.PublicKey, len(lookup))
+		for _, participant := range lookup {
+			commit.DKGParticipantKeys[participant.Index] = participant.KeyShare
+		}
+	}
+}
+
 func CreateSendTxHttpPayload(tx flow.TransactionBody) map[string]interface{} {
 	tx.Arguments = [][]uint8{} // fix how fixture creates nil values
 	auth := make([]string, len(tx.Authorizers))
diff --git a/utils/unittest/generator/events.go b/utils/unittest/generator/events.go
index bd77da80f7b..8c4ee63e275 100644
--- a/utils/unittest/generator/events.go
+++ b/utils/unittest/generator/events.go
@@ -2,6 +2,12 @@ package generator
 
 import (
 	"fmt"
+	"testing"
+
+	"github.com/onflow/cadence/runtime/stdlib"
+	"github.com/stretchr/testify/require"
+
+	"github.com/onflow/flow-go/fvm/evm/testutils"
 
 	"github.com/onflow/cadence"
 	"github.com/onflow/cadence/encoding/ccf"
@@ -113,3 +119,82 @@ func GetEventsWithEncoding(n int, version entities.EventEncodingVersion) []flow.
 	}
 	return events
 }
+
+// GenerateAccountCreateEvent returns a mock account creation event.
+func GenerateAccountCreateEvent(t *testing.T, address flow.Address) flow.Event {
+	cadenceEvent := cadence.NewEvent(
+		[]cadence.Value{
+			cadence.NewAddress(address),
+		}).WithType(&cadence.EventType{
+		Location:            stdlib.FlowLocation{},
+		QualifiedIdentifier: "AccountCreated",
+		Fields: []cadence.Field{
+			{
+				Identifier: "address",
+				Type:       cadence.AddressType{},
+			},
+		},
+	})
+
+	payload, err := ccf.Encode(cadenceEvent)
+	require.NoError(t, err)
+
+	event := unittest.EventFixture(
+		flow.EventType(cadenceEvent.EventType.Location.TypeID(nil, cadenceEvent.EventType.QualifiedIdentifier)),
+		0,
+		0,
+		unittest.IdentifierFixture(),
+		0,
+	)
+
+	event.Payload = payload
+
+	return event
+}
+
+// GenerateAccountContractEvent returns a mock account contract event.
+func GenerateAccountContractEvent(t *testing.T, qualifiedIdentifier string, address flow.Address) flow.Event {
+	contractName, err := cadence.NewString("EventContract")
+	require.NoError(t, err)
+
+	cadenceEvent := cadence.NewEvent(
+		[]cadence.Value{
+			cadence.NewAddress(address),
+			cadence.NewArray(
+				testutils.ConvertToCadence([]byte{111, 43, 164, 202, 220, 174, 148, 17, 253, 161, 9, 124, 237, 83, 227, 75, 115, 149, 141, 83, 129, 145, 252, 68, 122, 137, 80, 155, 89, 233, 136, 213}),
+			).WithType(cadence.NewConstantSizedArrayType(32, cadence.TheUInt8Type)),
+			contractName,
+		}).WithType(&cadence.EventType{
+		Location:            stdlib.FlowLocation{},
+		QualifiedIdentifier: qualifiedIdentifier,
+		Fields: []cadence.Field{
+			{
+				Identifier: "address",
+				Type:       cadence.AddressType{},
+			},
+			{
+				Identifier: "codeHash",
+				Type:       cadence.NewConstantSizedArrayType(32, cadence.TheUInt8Type),
+			},
+			{
+				Identifier: "contract",
+				Type:       cadence.StringType{},
+			},
+		},
+	})
+
+	payload, err := ccf.Encode(cadenceEvent)
+	require.NoError(t, err)
+
+	event := unittest.EventFixture(
+		flow.EventType(cadenceEvent.EventType.Location.TypeID(nil, cadenceEvent.EventType.QualifiedIdentifier)),
+		0,
+		0,
+		unittest.IdentifierFixture(),
+		0,
+	)
+
+	event.Payload = payload
+
+	return event
+}
diff --git a/utils/unittest/mocks/protocol_state.go b/utils/unittest/mocks/protocol_state.go
index 91672b74419..c48421ec0b2 100644
--- a/utils/unittest/mocks/protocol_state.go
+++ b/utils/unittest/mocks/protocol_state.go
@@ -42,40 +42,40 @@ type Params struct {
 	state *ProtocolState
 }
 
-func (p *Params) ChainID() (flow.ChainID, error) {
-	return p.state.root.Header.ChainID, nil
+func (p *Params) ChainID() flow.ChainID {
+	return p.state.root.Header.ChainID
 }
 
-func (p *Params) SporkID() (flow.Identifier, error) {
-	return flow.ZeroID, fmt.Errorf("not implemented")
+func (p *Params) SporkID() flow.Identifier {
+	return flow.ZeroID
 }
 
-func (p *Params) SporkRootBlockHeight() (uint64, error) {
-	return 0, fmt.Errorf("not implemented")
+func (p *Params) SporkRootBlockHeight() uint64 {
+	return 0
 }
 
-func (p *Params) ProtocolVersion() (uint, error) {
-	return 0, fmt.Errorf("not implemented")
+func (p *Params) ProtocolVersion() uint {
+	return 0
 }
 
-func (p *Params) EpochCommitSafetyThreshold() (uint64, error) {
-	return 0, fmt.Errorf("not implemented")
+func (p *Params) EpochCommitSafetyThreshold() uint64 {
+	return 0
 }
 
 func (p *Params) EpochFallbackTriggered() (bool, error) {
 	return false, fmt.Errorf("not implemented")
 }
 
-func (p *Params) FinalizedRoot() (*flow.Header, error) {
-	return p.state.root.Header, nil
+func (p *Params) FinalizedRoot() *flow.Header {
+	return p.state.root.Header
 }
 
-func (p *Params) SealedRoot() (*flow.Header, error) {
+func (p *Params) SealedRoot() *flow.Header {
 	return p.FinalizedRoot()
 }
 
-func (p *Params) Seal() (*flow.Seal, error) {
-	return nil, fmt.Errorf("not implemented")
+func (p *Params) Seal() *flow.Seal {
+	return nil
 }
 
 func (ps *ProtocolState) Params() protocol.Params {
diff --git a/utils/unittest/protocol_state.go b/utils/unittest/protocol_state.go
index f5dbcb88073..13aa0162eaa 100644
--- a/utils/unittest/protocol_state.go
+++ b/utils/unittest/protocol_state.go
@@ -22,7 +22,7 @@ func FinalizedProtocolStateWithParticipants(participants flow.IdentityList) (
 	// set up protocol snapshot mock
 	snapshot := &mockprotocol.Snapshot{}
 	snapshot.On("Identities", mock.Anything).Return(
-		func(filter flow.IdentityFilter) flow.IdentityList {
+		func(filter flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 			return participants.Filter(filter)
 		},
 		nil,
@@ -73,24 +73,34 @@ func FinalizedProtocolStateWithParticipants(participants flow.IdentityList) (
 // a receipt for the block (BR), the second (BS) containing a seal for the block.
 // B <- BR(Result_B) <- BS(Seal_B)
 // Returns the two generated blocks.
-func SealBlock(t *testing.T, st protocol.ParticipantState, block *flow.Block, receipt *flow.ExecutionReceipt, seal *flow.Seal) (br *flow.Header, bs *flow.Header) {
+func SealBlock(t *testing.T, st protocol.ParticipantState, mutableProtocolState protocol.MutableProtocolState, block *flow.Block, receipt *flow.ExecutionReceipt, seal *flow.Seal) (br *flow.Block, bs *flow.Block) {
 
 	block2 := BlockWithParentFixture(block.Header)
 	block2.SetPayload(flow.Payload{
-		Receipts: []*flow.ExecutionReceiptMeta{receipt.Meta()},
-		Results:  []*flow.ExecutionResult{&receipt.ExecutionResult},
+		Receipts:        []*flow.ExecutionReceiptMeta{receipt.Meta()},
+		Results:         []*flow.ExecutionResult{&receipt.ExecutionResult},
+		ProtocolStateID: block.Payload.ProtocolStateID,
 	})
 	err := st.Extend(context.Background(), block2)
 	require.NoError(t, err)
 
 	block3 := BlockWithParentFixture(block2.Header)
+	stateMutator, err := mutableProtocolState.Mutator(block3.Header.View, block3.Header.ParentID)
+	require.NoError(t, err)
+	seals := []*flow.Seal{seal}
+	err = stateMutator.ApplyServiceEventsFromValidatedSeals(seals)
+	require.NoError(t, err)
+	_, _, updatedStateId, _ := stateMutator.Build()
+	require.NoError(t, err)
+
 	block3.SetPayload(flow.Payload{
-		Seals: []*flow.Seal{seal},
+		Seals:           seals,
+		ProtocolStateID: updatedStateId,
 	})
 	err = st.Extend(context.Background(), block3)
 	require.NoError(t, err)
 
-	return block2.Header, block3.Header
+	return block2, block3
 }
 
 // InsertAndFinalize inserts, then finalizes, the input block.
diff --git a/utils/unittest/service_events_fixtures.go b/utils/unittest/service_events_fixtures.go
index 856b5405c87..9248968fc39 100644
--- a/utils/unittest/service_events_fixtures.go
+++ b/utils/unittest/service_events_fixtures.go
@@ -3,9 +3,15 @@ package unittest
 import (
 	"crypto/rand"
 	"encoding/hex"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/onflow/cadence"
 	"github.com/onflow/cadence/encoding/ccf"
+	jsoncdc "github.com/onflow/cadence/encoding/json"
 	"github.com/onflow/cadence/runtime/common"
 	"github.com/onflow/crypto"
 
@@ -41,6 +47,8 @@ func EpochSetupFixtureByChainID(chain flow.ChainID) (flow.Event, *flow.EpochSetu
 		DKGPhase2FinalView: 160,
 		DKGPhase3FinalView: 170,
 		RandomSource:       randomSource,
+		TargetDuration:     200,
+		TargetEndTime:      2000000000,
 		Assignments: flow.AssignmentList{
 			{
 				flow.MustHexStringToIdentifier("0000000000000000000000000000000000000000000000000000000000000001"),
@@ -51,14 +59,14 @@ func EpochSetupFixtureByChainID(chain flow.ChainID) (flow.Event, *flow.EpochSetu
 				flow.MustHexStringToIdentifier("0000000000000000000000000000000000000000000000000000000000000004"),
 			},
 		},
-		Participants: flow.IdentityList{
+		Participants: flow.IdentitySkeletonList{
 			{
 				Role:          flow.RoleCollection,
 				NodeID:        flow.MustHexStringToIdentifier("0000000000000000000000000000000000000000000000000000000000000001"),
 				Address:       "1.flow.com",
 				NetworkPubKey: MustDecodePublicKeyHex(crypto.ECDSAP256, "378dbf45d85c614feb10d8bd4f78f4b6ef8eec7d987b937e123255444657fb3da031f232a507e323df3a6f6b8f50339c51d188e80c0e7a92420945cc6ca893fc"),
 				StakingPubKey: MustDecodePublicKeyHex(crypto.BLSBLS12381, "af4aade26d76bb2ab15dcc89adcef82a51f6f04b3cb5f4555214b40ec89813c7a5f95776ea4fe449de48166d0bbc59b919b7eabebaac9614cf6f9461fac257765415f4d8ef1376a2365ec9960121888ea5383d88a140c24c29962b0a14e4e4e7"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 			{
 				Role:          flow.RoleCollection,
@@ -66,7 +74,7 @@ func EpochSetupFixtureByChainID(chain flow.ChainID) (flow.Event, *flow.EpochSetu
 				Address:       "2.flow.com",
 				NetworkPubKey: MustDecodePublicKeyHex(crypto.ECDSAP256, "378dbf45d85c614feb10d8bd4f78f4b6ef8eec7d987b937e123255444657fb3da031f232a507e323df3a6f6b8f50339c51d188e80c0e7a92420945cc6ca893fc"),
 				StakingPubKey: MustDecodePublicKeyHex(crypto.BLSBLS12381, "af4aade26d76bb2ab15dcc89adcef82a51f6f04b3cb5f4555214b40ec89813c7a5f95776ea4fe449de48166d0bbc59b919b7eabebaac9614cf6f9461fac257765415f4d8ef1376a2365ec9960121888ea5383d88a140c24c29962b0a14e4e4e7"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 			{
 				Role:          flow.RoleCollection,
@@ -74,7 +82,7 @@ func EpochSetupFixtureByChainID(chain flow.ChainID) (flow.Event, *flow.EpochSetu
 				Address:       "3.flow.com",
 				NetworkPubKey: MustDecodePublicKeyHex(crypto.ECDSAP256, "378dbf45d85c614feb10d8bd4f78f4b6ef8eec7d987b937e123255444657fb3da031f232a507e323df3a6f6b8f50339c51d188e80c0e7a92420945cc6ca893fc"),
 				StakingPubKey: MustDecodePublicKeyHex(crypto.BLSBLS12381, "af4aade26d76bb2ab15dcc89adcef82a51f6f04b3cb5f4555214b40ec89813c7a5f95776ea4fe449de48166d0bbc59b919b7eabebaac9614cf6f9461fac257765415f4d8ef1376a2365ec9960121888ea5383d88a140c24c29962b0a14e4e4e7"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 			{
 				Role:          flow.RoleCollection,
@@ -82,7 +90,7 @@ func EpochSetupFixtureByChainID(chain flow.ChainID) (flow.Event, *flow.EpochSetu
 				Address:       "4.flow.com",
 				NetworkPubKey: MustDecodePublicKeyHex(crypto.ECDSAP256, "378dbf45d85c614feb10d8bd4f78f4b6ef8eec7d987b937e123255444657fb3da031f232a507e323df3a6f6b8f50339c51d188e80c0e7a92420945cc6ca893fc"),
 				StakingPubKey: MustDecodePublicKeyHex(crypto.BLSBLS12381, "af4aade26d76bb2ab15dcc89adcef82a51f6f04b3cb5f4555214b40ec89813c7a5f95776ea4fe449de48166d0bbc59b919b7eabebaac9614cf6f9461fac257765415f4d8ef1376a2365ec9960121888ea5383d88a140c24c29962b0a14e4e4e7"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 			{
 				Role:          flow.RoleConsensus,
@@ -90,7 +98,7 @@ func EpochSetupFixtureByChainID(chain flow.ChainID) (flow.Event, *flow.EpochSetu
 				Address:       "11.flow.com",
 				NetworkPubKey: MustDecodePublicKeyHex(crypto.ECDSAP256, "cfdfe8e4362c8f79d11772cb7277ab16e5033a63e8dd5d34caf1b041b77e5b2d63c2072260949ccf8907486e4cfc733c8c42ca0e4e208f30470b0d950856cd47"),
 				StakingPubKey: MustDecodePublicKeyHex(crypto.BLSBLS12381, "8207559cd7136af378bba53a8f0196dee3849a3ab02897c1995c3e3f6ca0c4a776c3ae869d1ddbb473090054be2400ad06d7910aa2c5d1780220fdf3765a3c1764bce10c6fe66a5a2be51a422e878518bd750424bb56b8a0ecf0f8ad2057e83f"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 			{
 				Role:          flow.RoleExecution,
@@ -98,7 +106,7 @@ func EpochSetupFixtureByChainID(chain flow.ChainID) (flow.Event, *flow.EpochSetu
 				Address:       "21.flow.com",
 				NetworkPubKey: MustDecodePublicKeyHex(crypto.ECDSAP256, "d64318ba0dbf68f3788fc81c41d507c5822bf53154530673127c66f50fe4469ccf1a054a868a9f88506a8999f2386d86fcd2b901779718cba4fb53c2da258f9e"),
 				StakingPubKey: MustDecodePublicKeyHex(crypto.BLSBLS12381, "880b162b7ec138b36af401d07868cb08d25746d905395edbb4625bdf105d4bb2b2f4b0f4ae273a296a6efefa7ce9ccb914e39947ce0e83745125cab05d62516076ff0173ed472d3791ccef937597c9ea12381d76f547a092a4981d77ff3fba83"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 			{
 				Role:          flow.RoleVerification,
@@ -106,7 +114,7 @@ func EpochSetupFixtureByChainID(chain flow.ChainID) (flow.Event, *flow.EpochSetu
 				Address:       "31.flow.com",
 				NetworkPubKey: MustDecodePublicKeyHex(crypto.ECDSAP256, "697241208dcc9142b6f53064adc8ff1c95760c68beb2ba083c1d005d40181fd7a1b113274e0163c053a3addd47cd528ec6a1f190cf465aac87c415feaae011ae"),
 				StakingPubKey: MustDecodePublicKeyHex(crypto.BLSBLS12381, "b1f97d0a06020eca97352e1adde72270ee713c7daf58da7e74bf72235321048b4841bdfc28227964bf18e371e266e32107d238358848bcc5d0977a0db4bda0b4c33d3874ff991e595e0f537c7b87b4ddce92038ebc7b295c9ea20a1492302aa7"),
-				Weight:        100,
+				InitialWeight: 100,
 			},
 		},
 	}
@@ -114,7 +122,7 @@ func EpochSetupFixtureByChainID(chain flow.ChainID) (flow.Event, *flow.EpochSetu
 	return event, expected
 }
 
-// EpochCommitFixture returns an EpochCommit service event as a Cadence event
+// EpochCommitFixtureByChainID returns an EpochCommit service event as a Cadence event
 // representation and as a protocol model representation.
 func EpochCommitFixtureByChainID(chain flow.ChainID) (flow.Event, *flow.EpochCommit) {
 
@@ -172,8 +180,7 @@ func VersionBeaconFixtureByChainID(chain flow.ChainID) (flow.Event, *flow.Versio
 	return event, expected
 }
 
-func createEpochSetupEvent(randomSource []byte) cadence.Event {
-	randomSourceHex := hex.EncodeToString(randomSource)
+func createEpochSetupEvent(randomSourceHex string) cadence.Event {
 
 	return cadence.NewEvent([]cadence.Value{
 		// counter
@@ -202,6 +209,12 @@ func createEpochSetupEvent(randomSource []byte) cadence.Event {
 
 		// DKGPhase3FinalView
 		cadence.UInt64(170),
+
+		// targetDuration
+		cadence.UInt64(200),
+
+		// targetEndTime
+		cadence.UInt64(2000000000),
 	}).WithType(newFlowEpochEpochSetupEventType())
 }
 
@@ -530,7 +543,7 @@ func createEpochNodes() cadence.Array {
 
 func createEpochCollectors() cadence.Array {
 
-	clusterType := newFlowClusterQCClusterStructType()
+	clusterType := NewFlowClusterQCClusterStructType()
 
 	voteType := newFlowClusterQCVoteStructType()
 
@@ -592,7 +605,7 @@ func createEpochCollectors() cadence.Array {
 	}).WithType(cadence.NewVariableSizedArrayType(clusterType))
 }
 
-func createEpochCommittedEvent() cadence.Event {
+func createEpochCommitEvent() cadence.Event {
 
 	clusterQCType := newFlowClusterQCClusterQCStructType()
 
@@ -651,7 +664,7 @@ func createEpochCommittedEvent() cadence.Event {
 			cadence.String("8c588266db5f5cda629e83f8aa04ae9413593fac19e4865d06d291c9d14fbdd9bdb86a7a12f9ef8590c79cb635e3163315d193087e9336092987150d0cd2b14ac6365f7dc93eec573752108b8c12368abb65f0652d9f644e5aed611c37926950"),
 			cadence.String("87a339e4e5c74f089da20a33f515d8c8f4464ab53ede5a74aa2432cd1ae66d522da0c122249ee176cd747ddc83ca81090498389384201614caf51eac392c1c0a916dfdcfbbdf7363f9552b6468434add3d3f6dc91a92bbe3ee368b59b7828488"),
 		}).WithType(cadence.NewVariableSizedArrayType(cadence.StringType{})),
-	}).WithType(newFlowEpochEpochCommittedEventType())
+	}).WithType(newFlowEpochEpochCommitEventType())
 }
 
 func createVersionBeaconEvent() cadence.Event {
@@ -692,76 +705,6 @@ func createVersionBeaconEvent() cadence.Event {
 	}).WithType(NewNodeVersionBeaconVersionBeaconEventType())
 }
 
-func newFlowClusterQCVoteStructType() cadence.Type {
-
-	// A.01cf0e2f2f715450.FlowClusterQC.Vote
-
-	address, _ := common.HexToAddress("01cf0e2f2f715450")
-	location := common.NewAddressLocation(nil, address, "FlowClusterQC")
-
-	return &cadence.StructType{
-		Location:            location,
-		QualifiedIdentifier: "FlowClusterQC.Vote",
-		Fields: []cadence.Field{
-			{
-				Identifier: "nodeID",
-				Type:       cadence.StringType{},
-			},
-			{
-				Identifier: "signature",
-				Type:       cadence.NewOptionalType(cadence.StringType{}),
-			},
-			{
-				Identifier: "message",
-				Type:       cadence.NewOptionalType(cadence.StringType{}),
-			},
-			{
-				Identifier: "clusterIndex",
-				Type:       cadence.UInt16Type{},
-			},
-			{
-				Identifier: "weight",
-				Type:       cadence.UInt64Type{},
-			},
-		},
-	}
-}
-
-func newFlowClusterQCClusterStructType() *cadence.StructType {
-
-	// A.01cf0e2f2f715450.FlowClusterQC.Cluster
-
-	address, _ := common.HexToAddress("01cf0e2f2f715450")
-	location := common.NewAddressLocation(nil, address, "FlowClusterQC")
-
-	return &cadence.StructType{
-		Location:            location,
-		QualifiedIdentifier: "FlowClusterQC.Cluster",
-		Fields: []cadence.Field{
-			{
-				Identifier: "index",
-				Type:       cadence.UInt16Type{},
-			},
-			{
-				Identifier: "nodeWeights",
-				Type:       cadence.NewDictionaryType(cadence.StringType{}, cadence.UInt64Type{}),
-			},
-			{
-				Identifier: "totalWeight",
-				Type:       cadence.UInt64Type{},
-			},
-			{
-				Identifier: "generatedVotes",
-				Type:       cadence.NewDictionaryType(cadence.StringType{}, newFlowClusterQCVoteStructType()),
-			},
-			{
-				Identifier: "uniqueVoteMessageTotalWeights",
-				Type:       cadence.NewDictionaryType(cadence.StringType{}, cadence.UInt64Type{}),
-			},
-		},
-	}
-}
-
 func newFlowIDTableStakingNodeInfoStructType() *cadence.StructType {
 
 	// A.01cf0e2f2f715450.FlowIDTableStaking.NodeInfo
@@ -862,7 +805,7 @@ func newFlowEpochEpochSetupEventType() *cadence.EventType {
 			},
 			{
 				Identifier: "collectorClusters",
-				Type:       cadence.NewVariableSizedArrayType(newFlowClusterQCClusterStructType()),
+				Type:       cadence.NewVariableSizedArrayType(NewFlowClusterQCClusterStructType()),
 			},
 			{
 				Identifier: "randomSource",
@@ -880,11 +823,19 @@ func newFlowEpochEpochSetupEventType() *cadence.EventType {
 				Identifier: "DKGPhase3FinalView",
 				Type:       cadence.UInt64Type{},
 			},
+			{
+				Identifier: "targetDuration",
+				Type:       cadence.UInt64Type{},
+			},
+			{
+				Identifier: "targetEndTime",
+				Type:       cadence.UInt64Type{},
+			},
 		},
 	}
 }
 
-func newFlowEpochEpochCommittedEventType() *cadence.EventType {
+func newFlowEpochEpochCommitEventType() *cadence.EventType {
 
 	// A.01cf0e2f2f715450.FlowEpoch.EpochCommitted
 
@@ -1028,7 +979,8 @@ func ufix64FromString(s string) cadence.UFix64 {
 }
 
 func EpochSetupFixtureCCF(randomSource []byte) []byte {
-	b, err := ccf.Encode(createEpochSetupEvent(randomSource))
+	randomSourceHex := hex.EncodeToString(randomSource)
+	b, err := ccf.Encode(createEpochSetupEvent(randomSourceHex))
 	if err != nil {
 		panic(err)
 	}
@@ -1046,34 +998,7 @@ func EpochSetupCCFWithNonHexRandomSource() []byte {
 		randomSource = randomSource + "aa"
 	}
 
-	event := cadence.NewEvent([]cadence.Value{
-		// counter
-		cadence.NewUInt64(1),
-
-		// nodeInfo
-		createEpochNodes(),
-
-		// firstView
-		cadence.NewUInt64(100),
-
-		// finalView
-		cadence.NewUInt64(200),
-
-		// collectorClusters
-		createEpochCollectors(),
-
-		// randomSource
-		cadence.String(randomSource),
-
-		// DKGPhase1FinalView
-		cadence.UInt64(150),
-
-		// DKGPhase2FinalView
-		cadence.UInt64(160),
-
-		// DKGPhase3FinalView
-		cadence.UInt64(170),
-	}).WithType(newFlowEpochEpochSetupEventType())
+	event := createEpochSetupEvent(randomSource)
 
 	b, err := ccf.Encode(event)
 	if err != nil {
@@ -1087,7 +1012,7 @@ func EpochSetupCCFWithNonHexRandomSource() []byte {
 }
 
 var EpochCommitFixtureCCF = func() []byte {
-	b, err := ccf.Encode(createEpochCommittedEvent())
+	b, err := ccf.Encode(createEpochCommitEvent())
 	if err != nil {
 		panic(err)
 	}
@@ -1109,3 +1034,89 @@ var VersionBeaconFixtureCCF = func() []byte {
 	}
 	return b
 }()
+
+func newFlowClusterQCVoteStructType() *cadence.StructType {
+
+	// A.01cf0e2f2f715450.FlowClusterQC.Vote
+
+	address, _ := common.HexToAddress("01cf0e2f2f715450")
+	location := common.NewAddressLocation(nil, address, "FlowClusterQC")
+
+	return &cadence.StructType{
+		Location:            location,
+		QualifiedIdentifier: "FlowClusterQC.Vote",
+		Fields: []cadence.Field{
+			{
+				Identifier: "nodeID",
+				Type:       cadence.StringType{},
+			},
+			{
+				Identifier: "signature",
+				Type:       cadence.NewOptionalType(cadence.StringType{}),
+			},
+			{
+				Identifier: "message",
+				Type:       cadence.NewOptionalType(cadence.StringType{}),
+			},
+			{
+				Identifier: "clusterIndex",
+				Type:       cadence.UInt16Type{},
+			},
+			{
+				Identifier: "weight",
+				Type:       cadence.UInt64Type{},
+			},
+		},
+	}
+}
+
+func VerifyCdcArguments(t *testing.T, expected []cadence.Value, actual []interface{}) {
+
+	for index, arg := range actual {
+
+		// marshal to bytes
+		bz, err := json.Marshal(arg)
+		require.NoError(t, err)
+
+		// parse cadence value
+		decoded, err := jsoncdc.Decode(nil, bz)
+		require.NoError(t, err)
+
+		assert.Equal(t, expected[index], decoded)
+	}
+}
+
+func NewFlowClusterQCClusterStructType() *cadence.StructType {
+
+	// A.01cf0e2f2f715450.FlowClusterQC.Cluster
+
+	address, _ := common.HexToAddress("01cf0e2f2f715450")
+	location := common.NewAddressLocation(nil, address, "FlowClusterQC")
+
+	return &cadence.StructType{
+		Location:            location,
+		QualifiedIdentifier: "FlowClusterQC.Cluster",
+		Fields: []cadence.Field{
+			{
+				Identifier: "index",
+				Type:       cadence.UInt16Type{},
+			},
+			{
+				Identifier: "nodeWeights",
+				Type:       cadence.NewDictionaryType(cadence.StringType{}, cadence.UInt64Type{}),
+			},
+			{
+				Identifier: "totalWeight",
+				Type:       cadence.UInt64Type{},
+			},
+			{
+				Identifier: "generatedVotes",
+				Type:       cadence.NewDictionaryType(cadence.StringType{}, newFlowClusterQCVoteStructType()),
+			},
+			{
+				Identifier: "uniqueVoteMessageTotalWeights",
+				Type:       cadence.NewDictionaryType(cadence.StringType{}, cadence.UInt64Type{}),
+			},
+		},
+	}
+}
diff --git a/utils/unittest/updatable_provider.go b/utils/unittest/updatable_provider.go
index 9661f7039a6..c2b023f1258 100644
--- a/utils/unittest/updatable_provider.go
+++ b/utils/unittest/updatable_provider.go
@@ -29,7 +29,7 @@ func (p *UpdatableIDProvider) SetIdentities(identities flow.IdentityList) {
 	p.identities = identities
 }
 
-func (p *UpdatableIDProvider) Identities(filter flow.IdentityFilter) flow.IdentityList {
+func (p *UpdatableIDProvider) Identities(filter flow.IdentityFilter[flow.Identity]) flow.IdentityList {
 	p.mu.RLock()
 	defer p.mu.RUnlock()
 	return p.identities.Filter(filter)
diff --git a/utils/unittest/version_beacon.go b/utils/unittest/version_beacon.go
index 6518de747ef..0af4f627ab4 100644
--- a/utils/unittest/version_beacon.go
+++ b/utils/unittest/version_beacon.go
@@ -20,11 +20,14 @@ import (
 func AddVersionBeacon(t *testing.T, beacon *flow.VersionBeacon, state protocol.FollowerState) {
 
 	final, err := state.Final().Head()
+	require.NoError(t, err)
 
+	protocolState, err := state.Final().ProtocolState()
 	require.NoError(t, err)
+	protocolStateID := protocolState.Entry().ID()
 
 	A := BlockWithParentFixture(final)
-	A.SetPayload(flow.Payload{})
+	A.SetPayload(PayloadFixture(WithProtocolStateID(protocolStateID)))
 	addToState(t, state, A, true)
 
 	receiptA := ReceiptForBlockFixture(A)
@@ -32,8 +35,9 @@ func AddVersionBeacon(t *testing.T, beacon *flow.VersionBeacon, state protocol.F
 
 	B := BlockWithParentFixture(A.Header)
 	B.SetPayload(flow.Payload{
-		Receipts: []*flow.ExecutionReceiptMeta{receiptA.Meta()},
-		Results:  []*flow.ExecutionResult{&receiptA.ExecutionResult},
+		Receipts:        []*flow.ExecutionReceiptMeta{receiptA.Meta()},
+		Results:         []*flow.ExecutionResult{&receiptA.ExecutionResult},
+		ProtocolStateID: protocolStateID,
 	})
 	addToState(t, state, B, true)
 
@@ -43,7 +47,8 @@ func AddVersionBeacon(t *testing.T, beacon *flow.VersionBeacon, state protocol.F
 
 	C := BlockWithParentFixture(B.Header)
 	C.SetPayload(flow.Payload{
-		Seals: sealsForB,
+		Seals:           sealsForB,
+		ProtocolStateID: protocolStateID,
 	})
 	addToState(t, state, C, true)
 }