diff --git a/pkg/acl/account/accountdata.go b/pkg/acl/account/accountdata.go
index a8b1c1b7..2ad6c9a0 100644
--- a/pkg/acl/account/accountdata.go
+++ b/pkg/acl/account/accountdata.go
@@ -2,8 +2,9 @@ package account
 
 import "github.com/anytypeio/go-anytype-infrastructure-experiments/util/keys"
 
-type AccountData struct {
+type AccountData struct { // TODO: create a convenient constructor for this
 	Identity string // TODO: this is essentially the same as sign key
 	SignKey  keys.SigningPrivKey
 	EncKey   keys.EncryptionPrivKey
+	Decoder  keys.SigningPubKeyDecoder
 }
diff --git a/pkg/acl/acltree/acltree.go b/pkg/acl/acltree/acltree.go
index 7a1ff2a1..27d0a1fc 100644
--- a/pkg/acl/acltree/acltree.go
+++ b/pkg/acl/acltree/acltree.go
@@ -4,8 +4,6 @@ import (
 	"github.com/anytypeio/go-anytype-infrastructure-experiments/pkg/acl/account"
 	"github.com/anytypeio/go-anytype-infrastructure-experiments/pkg/acl/treestorage"
 	"sync"
-
-	"github.com/anytypeio/go-anytype-infrastructure-experiments/util/keys"
 )
 
 type AddResultSummary int
@@ -61,11 +59,10 @@ func BuildACLTree(
 	t treestorage.TreeStorage,
 	acc *account.AccountData,
 	listener TreeUpdateListener) (ACLTree, error) {
-	decoder := keys.NewEd25519Decoder()
-	aclTreeBuilder := newACLTreeBuilder(t, decoder)
-	treeBuilder := newTreeBuilder(t, decoder)
-	snapshotValidator := newSnapshotValidator(decoder, acc)
-	aclStateBuilder := newACLStateBuilder(decoder, acc)
+	aclTreeBuilder := newACLTreeBuilder(t, acc.Decoder)
+	treeBuilder := newTreeBuilder(t, acc.Decoder)
+	snapshotValidator := newSnapshotValidator(acc.Decoder, acc) // TODO: this looks weird, change it
+	aclStateBuilder := newACLStateBuilder(acc.Decoder, acc)
 	changeBuilder := newChangeBuilder()
 
 	aclTree := &aclTree{
@@ -84,7 +81,10 @@ func BuildACLTree(
 	if err != nil {
 		return nil, err
 	}
-	aclTree.removeOrphans()
+	err = aclTree.removeOrphans()
+	if err != nil {
+		return nil, err
+	}
 	err = t.SetHeads(aclTree.Heads())
 	if err != nil {
 		return nil, err
diff --git a/pkg/acl/acltree/acltree_test.go b/pkg/acl/acltree/acltree_test.go
index 2720dfda..672ae41a 100644
--- a/pkg/acl/acltree/acltree_test.go
+++ b/pkg/acl/acltree/acltree_test.go
@@ -4,6 +4,7 @@ import (
 	"github.com/anytypeio/go-anytype-infrastructure-experiments/pkg/acl/account"
 	"github.com/anytypeio/go-anytype-infrastructure-experiments/pkg/acl/aclchanges/pb"
 	"github.com/anytypeio/go-anytype-infrastructure-experiments/pkg/acl/testutils/treestoragebuilder"
+	"github.com/anytypeio/go-anytype-infrastructure-experiments/util/keys"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -25,6 +26,7 @@ func TestACLTree_UserJoinBuild(t *testing.T) {
 		Identity: keychain.GetIdentity("A"),
 		SignKey:  keychain.SigningKeys["A"],
 		EncKey:   keychain.EncryptionKeys["A"],
+		Decoder:  keys.NewEd25519Decoder(),
 	}
 	listener := &mockListener{}
 	tree, err := BuildACLTree(thr, accountData, listener)
@@ -59,6 +61,7 @@ func TestACLTree_UserJoinUpdate_Append(t *testing.T) {
 		Identity: keychain.GetIdentity("A"),
 		SignKey:  keychain.SigningKeys["A"],
 		EncKey:   keychain.EncryptionKeys["A"],
+		Decoder:  keys.NewEd25519Decoder(),
 	}
 	listener := &mockListener{}
 	tree, err := BuildACLTree(thr, accountData, listener)
@@ -108,6 +111,7 @@ func TestACLTree_UserJoinUpdate_Rebuild(t *testing.T) {
 		Identity: keychain.GetIdentity("A"),
 		SignKey:  keychain.SigningKeys["A"],
 		EncKey:   keychain.EncryptionKeys["A"],
+		Decoder:  keys.NewEd25519Decoder(),
 	}
 	listener := &mockListener{}
 	tree, err := BuildACLTree(thr, accountData, listener)
@@ -158,6 +162,7 @@ func TestACLTree_UserRemoveBuild(t *testing.T) {
 		Identity: keychain.GetIdentity("A"),
 		SignKey:  keychain.SigningKeys["A"],
 		EncKey:   keychain.EncryptionKeys["A"],
+		Decoder:  keys.NewEd25519Decoder(),
 	}
 	listener := &mockListener{}
 	tree, err := BuildACLTree(thr, accountData, listener)
@@ -188,6 +193,7 @@ func TestACLTree_UserRemoveBeforeBuild(t *testing.T) {
 		Identity: keychain.GetIdentity("A"),
 		SignKey:  keychain.SigningKeys["A"],
 		EncKey:   keychain.EncryptionKeys["A"],
+		Decoder:  keys.NewEd25519Decoder(),
 	}
 	listener := &mockListener{}
 	tree, err := BuildACLTree(thr, accountData, listener)
@@ -219,6 +225,7 @@ func TestACLTree_InvalidSnapshotBuild(t *testing.T) {
 		Identity: keychain.GetIdentity("A"),
 		SignKey:  keychain.SigningKeys["A"],
 		EncKey:   keychain.EncryptionKeys["A"],
+		Decoder:  keys.NewEd25519Decoder(),
 	}
 	listener := &mockListener{}
 	tree, err := BuildACLTree(thr, accountData, listener)
@@ -249,6 +256,7 @@ func TestACLTree_ValidSnapshotBuild(t *testing.T) {
 		Identity: keychain.GetIdentity("A"),
 		SignKey:  keychain.SigningKeys["A"],
 		EncKey:   keychain.EncryptionKeys["A"],
+		Decoder:  keys.NewEd25519Decoder(),
 	}
 	listener := &mockListener{}
 	tree, err := BuildACLTree(thr, accountData, listener)
diff --git a/pkg/acl/acltree/acltreestorage.go b/pkg/acl/acltree/acltreestorage.go
index d8fd51f5..be30ca12 100644
--- a/pkg/acl/acltree/acltreestorage.go
+++ b/pkg/acl/acltree/acltreestorage.go
@@ -37,6 +37,9 @@ func BuildTreeStorageWithACL(
 		return nil, err
 	}
 
-	thr.SetHeads([]string{change.CID()})
+	err = thr.SetHeads([]string{change.CID()})
+	if err != nil {
+		return nil, err
+	}
 	return thr, nil
 }
diff --git a/pkg/acl/acltree/acltreestorage_test.go b/pkg/acl/acltree/acltreestorage_test.go
index 76f3a55d..68f0fac9 100644
--- a/pkg/acl/acltree/acltreestorage_test.go
+++ b/pkg/acl/acltree/acltreestorage_test.go
@@ -31,15 +31,27 @@ func Test_BuildTreeStorageWithACL(t *testing.T) {
 	if err != nil {
 		t.Fatalf("build should not return error")
 	}
-	if len(thr.Heads()) == 0 {
+
+	heads, err := thr.Heads()
+	if err != nil {
+		t.Fatalf("should return heads: %v", err)
+	}
+	if len(heads) == 0 {
 		t.Fatalf("tree storage should have non-empty heads")
 	}
-	if thr.Header() == nil {
-		t.Fatalf("tree storage should have non-empty header")
+
+	header, err := thr.Header()
+	if err != nil {
+		t.Fatalf("tree storage header should return without error: %v", err)
 	}
-	assert.Equal(t, thr.Heads()[0], thr.Header().FirstChangeId)
-	assert.NotEmpty(t, thr.TreeID())
-	ch, err := thr.GetChange(context.Background(), thr.Header().FirstChangeId)
+	assert.Equal(t, heads[0], header.FirstChangeId)
+
+	treeId, err := thr.TreeID()
+	if err != nil {
+		t.Fatalf("tree id should return without error: %v", err)
+	}
+	assert.NotEmpty(t, treeId)
+	ch, err := thr.GetChange(context.Background(), header.FirstChangeId)
 	if err != nil {
 		t.Fatalf("get change should not return error: %v", err)
 	}
diff --git a/pkg/acl/example/plaintextdocument/document_test.go b/pkg/acl/example/plaintextdocument/document_test.go
index f5e1badb..e44cc3f3 100644
--- a/pkg/acl/example/plaintextdocument/document_test.go
+++ b/pkg/acl/example/plaintextdocument/document_test.go
@@ -4,6 +4,7 @@ import (
 	"github.com/anytypeio/go-anytype-infrastructure-experiments/pkg/acl/account"
 	"github.com/anytypeio/go-anytype-infrastructure-experiments/pkg/acl/testutils/treestoragebuilder"
 	"github.com/anytypeio/go-anytype-infrastructure-experiments/pkg/acl/treestorage"
+	"github.com/anytypeio/go-anytype-infrastructure-experiments/util/keys"
 	"github.com/stretchr/testify/assert"
 	"testing"
 )
@@ -16,6 +17,7 @@ func TestDocument_NewPlainTextDocument(t *testing.T) {
 		Identity: keychain.GetIdentity("A"),
 		SignKey:  keychain.SigningKeys["A"],
 		EncKey:   keychain.EncryptionKeys["A"],
+		Decoder:  keys.NewEd25519Decoder(),
 	}
 
 	doc, err := NewPlainTextDocument(data, treestorage.NewInMemoryTreeStorage, "Some text")
@@ -33,6 +35,7 @@ func TestDocument_PlainTextDocument_AddText(t *testing.T) {
 		Identity: keychain.GetIdentity("A"),
 		SignKey:  keychain.SigningKeys["A"],
 		EncKey:   keychain.EncryptionKeys["A"],
+		Decoder:  keys.NewEd25519Decoder(),
 	}
 
 	doc, err := NewPlainTextDocument(data, treestorage.NewInMemoryTreeStorage, "Some text")