From de33572829172495d19bd8494313a8f7ff9553b8 Mon Sep 17 00:00:00 2001
From: Charlie Chen <34498985+ws4charlie@users.noreply.github.com>
Date: Mon, 25 Sep 2023 14:20:37 -0500
Subject: [PATCH 1/5] cherry pick v9.0.8 hotfix to bitcoin outbound incident
 (#1188)

Co-authored-by: charliec <charliec@zetachain.com>
---
 zetaclient/utils.go | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/zetaclient/utils.go b/zetaclient/utils.go
index 6e782bf1f2..cb508c43a5 100644
--- a/zetaclient/utils.go
+++ b/zetaclient/utils.go
@@ -16,7 +16,7 @@ const (
 func getSatoshis(btc float64) (int64, error) {
 	// The amount is only considered invalid if it cannot be represented
 	// as an integer type.  This may happen if f is NaN or +-Infinity.
-	// BTC max amount is 21 mil and its at least 10^(-8) or one satoshi.
+	// BTC max amount is 21 mil and its at least 0 (Note: bitcoin allows creating 0-value outputs)
 	switch {
 	case math.IsNaN(btc):
 		fallthrough
@@ -26,8 +26,8 @@ func getSatoshis(btc float64) (int64, error) {
 		return 0, errors.New("invalid bitcoin amount")
 	case btc > 21000000.0:
 		return 0, errors.New("exceeded max bitcoin amount")
-	case btc < 0.00000001:
-		return 0, errors.New("cannot be less than 1 satoshi")
+	case btc < 0.0:
+		return 0, errors.New("cannot be less than zero")
 	}
 	return round(btc * satoshiPerBitcoin), nil
 }

From a4613fec9e210bf5b1b4ee1f384480b17dbd8a34 Mon Sep 17 00:00:00 2001
From: brewmaster012 <88689859+brewmaster012@users.noreply.github.com>
Date: Mon, 25 Sep 2023 17:47:37 -0500
Subject: [PATCH 2/5] fix: defensive nonce check in outbound tx voters (#975)

Co-authored-by: brewmaster012 <>
Co-authored-by: Tanmay <tanmay@zetachain.com>
---
 x/crosschain/client/integrationtests/cli_helpers.go    |  8 ++++----
 .../client/integrationtests/outbound_voter_test.go     | 10 +++++-----
 .../keeper/keeper_cross_chain_tx_vote_outbound_tx.go   |  4 ++++
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/x/crosschain/client/integrationtests/cli_helpers.go b/x/crosschain/client/integrationtests/cli_helpers.go
index 06a3198b1d..e86f1021c5 100644
--- a/x/crosschain/client/integrationtests/cli_helpers.go
+++ b/x/crosschain/client/integrationtests/cli_helpers.go
@@ -122,7 +122,7 @@ func BuildSignedTssVote(t testing.TB, val *network.Validator, denom string, acco
 	return WriteToNewTempFile(t, res.String())
 }
 
-func BuildSignedOutboundVote(t testing.TB, val *network.Validator, denom string, account authtypes.AccountI,
+func BuildSignedOutboundVote(t testing.TB, val *network.Validator, denom string, account authtypes.AccountI, nonce uint64,
 	cctxIndex, outTxHash, valueReceived, status string) *os.File {
 	cmd := cli.CmdCCTXOutboundVoter()
 	outboundVoterArgs := []string{
@@ -135,7 +135,7 @@ func BuildSignedOutboundVote(t testing.TB, val *network.Validator, denom string,
 		valueReceived,
 		status,
 		strconv.FormatInt(common.GoerliChain().ChainId, 10),
-		"1",
+		strconv.FormatUint(nonce, 10),
 		"Zeta",
 	}
 	txArgs := []string{
@@ -205,7 +205,7 @@ func GetBallotIdentifier(message string) string {
 	return msg.Digest()
 }
 
-func GetBallotIdentifierOutBound(cctxindex, outtxHash, valueReceived string) string {
+func GetBallotIdentifierOutBound(nonce uint64, cctxindex, outtxHash, valueReceived string) string {
 	msg := types.NewMsgVoteOnObservedOutboundTx(
 		"",
 		cctxindex,
@@ -217,7 +217,7 @@ func GetBallotIdentifierOutBound(cctxindex, outtxHash, valueReceived string) str
 		math.NewUintFromString(valueReceived),
 		0,
 		common.GoerliChain().ChainId,
-		1,
+		nonce,
 		common.CoinType_Zeta,
 	)
 	return msg.Digest()
diff --git a/x/crosschain/client/integrationtests/outbound_voter_test.go b/x/crosschain/client/integrationtests/outbound_voter_test.go
index 7671708295..92237b62b9 100644
--- a/x/crosschain/client/integrationtests/outbound_voter_test.go
+++ b/x/crosschain/client/integrationtests/outbound_voter_test.go
@@ -163,7 +163,7 @@ func (s *IntegrationTestSuite) TestCCTXOutBoundVoter() {
 			cctx := crosschaintypes.QueryGetCctxResponse{}
 			s.NoError(broadcaster.ClientCtx.Codec.UnmarshalJSON(out.Bytes(), &cctx))
 			s.Assert().Equal(crosschaintypes.CctxStatus_PendingOutbound, cctx.CrossChainTx.CctxStatus.Status)
-
+			nonce := cctx.CrossChainTx.GetCurrentOutTxParam().OutboundTxTssNonce
 			// Check the vote in the ballot and vote the outbound tx
 			fakeVotes := []string{}
 			for _, val := range s.network.Validators {
@@ -194,8 +194,8 @@ func (s *IntegrationTestSuite) TestCCTXOutBoundVoter() {
 				}
 
 				// Vote the outbound tx
-				signedTx := BuildSignedOutboundVote(s.T(), val, s.cfg.BondDenom, account, cctxIdentifier, outTxhash, test.valueReceived, votestring)
-				out, err = clitestutil.ExecTestCLICmd(broadcaster.ClientCtx, authcli.GetBroadcastCommand(), []string{signedTx.Name(), "--broadcast-mode", "sync"})
+				signedTx := BuildSignedOutboundVote(s.T(), val, s.cfg.BondDenom, account, nonce, cctxIdentifier, outTxhash, test.valueReceived, votestring)
+				out, err = clitestutil.ExecTestCLICmd(broadcaster.ClientCtx, authcli.GetBroadcastCommand(), []string{signedTx.Name(), "--broadcast-mode", "sync", "--output", "json"})
 				s.Require().NoError(err)
 			}
 			s.Require().NoError(s.network.WaitForNBlocks(2))
@@ -206,7 +206,7 @@ func (s *IntegrationTestSuite) TestCCTXOutBoundVoter() {
 			s.NoError(broadcaster.ClientCtx.Codec.UnmarshalJSON(out.Bytes(), &cctx))
 			s.Assert().Equal(test.cctxStatus, cctx.CrossChainTx.CctxStatus.Status)
 
-			outboundBallotIdentifier := GetBallotIdentifierOutBound(cctxIdentifier, test.name, test.valueReceived)
+			outboundBallotIdentifier := GetBallotIdentifierOutBound(nonce, cctxIdentifier, test.name, test.valueReceived)
 
 			out, err = clitestutil.ExecTestCLICmd(broadcaster.ClientCtx, observerCli.CmdBallotByIdentifier(), []string{outboundBallotIdentifier, "--output", "json"})
 			s.Require().NoError(err)
@@ -228,7 +228,7 @@ func (s *IntegrationTestSuite) TestCCTXOutBoundVoter() {
 				}
 			}
 			if len(fakeVotes) > 0 {
-				outboundFakeBallotIdentifier := GetBallotIdentifierOutBound(cctxIdentifier, test.name+"falseVote", test.valueReceived)
+				outboundFakeBallotIdentifier := GetBallotIdentifierOutBound(nonce, cctxIdentifier, test.name+"falseVote", test.valueReceived)
 				out, err = clitestutil.ExecTestCLICmd(broadcaster.ClientCtx, observerCli.CmdBallotByIdentifier(), []string{outboundFakeBallotIdentifier, "--output", "json"})
 				s.Require().NoError(err)
 				fakeBallot := observerTypes.QueryBallotByIdentifierResponse{}
diff --git a/x/crosschain/keeper/keeper_cross_chain_tx_vote_outbound_tx.go b/x/crosschain/keeper/keeper_cross_chain_tx_vote_outbound_tx.go
index 6b8f0b02a9..64783e6eaf 100644
--- a/x/crosschain/keeper/keeper_cross_chain_tx_vote_outbound_tx.go
+++ b/x/crosschain/keeper/keeper_cross_chain_tx_vote_outbound_tx.go
@@ -84,6 +84,10 @@ func (k msgServer) VoteOnObservedOutboundTx(goCtx context.Context, msg *types.Ms
 		return nil, sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, fmt.Sprintf("CCTX %s does not exist", msg.CctxHash))
 	}
 
+	if cctx.GetCurrentOutTxParam().OutboundTxTssNonce != msg.OutTxTssNonce {
+		return nil, sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, fmt.Sprintf("OutTxTssNonce %d does not match CCTX OutTxTssNonce %d", msg.OutTxTssNonce, cctx.GetCurrentOutTxParam().OutboundTxTssNonce))
+	}
+
 	ballotIndex := msg.Digest()
 	// Add votes and Set Ballot
 	ballot, isNew, err := k.zetaObserverKeeper.FindBallot(ctx, ballotIndex, observationChain, observationType)

From 6f038dab083d28b172987696d870f719685578c4 Mon Sep 17 00:00:00 2001
From: Lucas Bertrand <lucas.bertrand.22@gmail.com>
Date: Tue, 26 Sep 2023 10:32:43 +0200
Subject: [PATCH 3/5] refactor(`observer`): create admin policy group 1 and
 group 2 (#1169)

* proto

* rename policies

* test fix

* make generate

* fix smoke tests

* improve tests

* group 1 can disable inbound outbound

* comments

* add migration

* add migration

* fix import cycle

* apply comments + tests

---------

Co-authored-by: Tanmay <tanmay@zetachain.com>
---
 contrib/localnet/scripts/genesis.sh           |   5 +-
 .../zetacored_zetacore0/config/genesis.json   |   5 +-
 .../zetacored_zetacore1/config/genesis.json   |   5 +-
 docs/openapi/openapi.swagger.yaml             |  11 +-
 docs/spec/crosschain/messages.md              |   2 +-
 docs/spec/observer/messages.md                |   5 +-
 proto/observer/params.proto                   |   8 +-
 x/crosschain/keeper/gas_payment_test.go       |  30 ++--
 x/crosschain/keeper/keeper_out_tx_tracker.go  |   4 +-
 .../keeper/msg_server_whitelist_erc20.go      |   2 +-
 .../{keeper_tss_voter.go => msg_tss_voter.go} |   4 +-
 x/crosschain/keeper/test_privnet.go           |   2 +-
 ...blocker_deploy_system_contracts_privnet.go |   4 +-
 .../msg_server_deploy_fungible_coin_zrc20.go  |   2 +-
 ..._server_deploy_fungible_coin_zrc20_test.go |   6 +-
 .../keeper/msg_server_remove_foreign_coin.go  |   2 +-
 .../msg_server_remove_foreign_coin_test.go    |   5 +-
 .../msg_server_update_contract_bytecode.go    |   2 +-
 ...sg_server_update_contract_bytecode_test.go |  22 +--
 .../msg_server_update_system_contract.go      |   2 +-
 .../msg_server_update_system_contract_test.go |   5 +-
 .../msg_server_update_zrc20_paused_status.go  |   7 +-
 ..._server_update_zrc20_paused_status_test.go |  30 +++-
 .../msg_server_update_zrc20_withdraw_fee.go   |   2 +-
 ...g_server_update_zrc20_withdraw_fee_test.go |  11 +-
 x/observer/keeper/migrator.go                 |   6 +
 .../keeper/msg_server_update_core_params.go   |   4 +-
 .../msg_server_update_crosschain_flags.go     |   7 +-
 ...msg_server_update_crosschain_flags_test.go |  25 +++-
 x/observer/keeper/msg_server_update_keygen.go |   5 +-
 x/observer/keeper/observer_mapper.go          |   2 +-
 x/observer/migrations/v3/migrate.go           |  36 +++++
 x/observer/migrations/v3/migrate_test.go      |  51 +++++++
 x/observer/module.go                          |   5 +-
 x/observer/types/params.go                    |  22 +--
 x/observer/types/params.pb.go                 | 132 ++++++++----------
 36 files changed, 295 insertions(+), 183 deletions(-)
 rename x/crosschain/keeper/{keeper_tss_voter.go => msg_tss_voter.go} (97%)
 create mode 100644 x/observer/migrations/v3/migrate.go
 create mode 100644 x/observer/migrations/v3/migrate_test.go

diff --git a/contrib/localnet/scripts/genesis.sh b/contrib/localnet/scripts/genesis.sh
index db84982177..242dc8a56d 100755
--- a/contrib/localnet/scripts/genesis.sh
+++ b/contrib/localnet/scripts/genesis.sh
@@ -88,9 +88,10 @@ then
   cat $HOME/.zetacored/config/genesis.json | jq '.consensus_params["block"]["max_gas"]="500000000"' > $HOME/.zetacored/config/tmp_genesis.json && mv $HOME/.zetacored/config/tmp_genesis.json $HOME/.zetacored/config/genesis.json
   cat $HOME/.zetacored/config/genesis.json | jq '.app_state["gov"]["voting_params"]["voting_period"]="100s"' > $HOME/.zetacored/config/tmp_genesis.json && mv $HOME/.zetacored/config/tmp_genesis.json $HOME/.zetacored/config/genesis.json
 
-  # set fungible admin account as admin for fungible token
+  # set admin account
   zetacored add-genesis-account zeta1srsq755t654agc0grpxj4y3w0znktrpr9tcdgk 100000000000000000000000000azeta
-  cat $HOME/.zetacored/config/genesis.json | jq '.app_state["observer"]["params"]["admin_policy"][2]["address"]="zeta1srsq755t654agc0grpxj4y3w0znktrpr9tcdgk"' > $HOME/.zetacored/config/tmp_genesis.json && mv $HOME/.zetacored/config/tmp_genesis.json $HOME/.zetacored/config/genesis.json
+  cat $HOME/.zetacored/config/genesis.json | jq '.app_state["observer"]["params"]["admin_policy"][0]["address"]="zeta1srsq755t654agc0grpxj4y3w0znktrpr9tcdgk"' > $HOME/.zetacored/config/tmp_genesis.json && mv $HOME/.zetacored/config/tmp_genesis.json $HOME/.zetacored/config/genesis.json
+  cat $HOME/.zetacored/config/genesis.json | jq '.app_state["observer"]["params"]["admin_policy"][1]["address"]="zeta1srsq755t654agc0grpxj4y3w0znktrpr9tcdgk"' > $HOME/.zetacored/config/tmp_genesis.json && mv $HOME/.zetacored/config/tmp_genesis.json $HOME/.zetacored/config/genesis.json
 
 # 3. Copy the genesis.json to all the nodes .And use it to create a gentx for every node
   zetacored gentx operator 1000000000000000000000azeta --chain-id=$CHAINID --keyring-backend=$KEYRING
diff --git a/contrib/localnet/zetacored/zetacored_zetacore0/config/genesis.json b/contrib/localnet/zetacored/zetacored_zetacore0/config/genesis.json
index 0cdc9e0a4e..52ac2072b8 100644
--- a/contrib/localnet/zetacored/zetacored_zetacore0/config/genesis.json
+++ b/contrib/localnet/zetacored/zetacored_zetacore0/config/genesis.json
@@ -637,10 +637,11 @@
         ],
         "admin_policy": [
           {
-            "address": "zeta1afk9zr2hn2jsac63h4hm60vl9z3e5u69gndzf7c99cqge3vzwjzsxn0x73"
+            "policy_type": "group1",
+            "address": "zeta1srsq755t654agc0grpxj4y3w0znktrpr9tcdgk"
           },
           {
-            "policy_type": 1,
+            "policy_type": "group2",
             "address": "zeta1srsq755t654agc0grpxj4y3w0znktrpr9tcdgk"
           }
         ]
diff --git a/contrib/localnet/zetacored/zetacored_zetacore1/config/genesis.json b/contrib/localnet/zetacored/zetacored_zetacore1/config/genesis.json
index 0cdc9e0a4e..52ac2072b8 100644
--- a/contrib/localnet/zetacored/zetacored_zetacore1/config/genesis.json
+++ b/contrib/localnet/zetacored/zetacored_zetacore1/config/genesis.json
@@ -637,10 +637,11 @@
         ],
         "admin_policy": [
           {
-            "address": "zeta1afk9zr2hn2jsac63h4hm60vl9z3e5u69gndzf7c99cqge3vzwjzsxn0x73"
+            "policy_type": "group1",
+            "address": "zeta1srsq755t654agc0grpxj4y3w0znktrpr9tcdgk"
           },
           {
-            "policy_type": 1,
+            "policy_type": "group2",
             "address": "zeta1srsq755t654agc0grpxj4y3w0znktrpr9tcdgk"
           }
         ]
diff --git a/docs/openapi/openapi.swagger.yaml b/docs/openapi/openapi.swagger.yaml
index ac8284ac42..cd342dc1f2 100644
--- a/docs/openapi/openapi.swagger.yaml
+++ b/docs/openapi/openapi.swagger.yaml
@@ -51057,14 +51057,9 @@ definitions:
   observerPolicy_Type:
     type: string
     enum:
-      - stop_inbound_cctx
-      - deploy_fungible_coin
-      - update_client_params
-      - update_keygen_block
-      - out_tx_tracker
-      - add_observer
-    default: stop_inbound_cctx
-    title: '- stop_inbound_cctx: some observer sees inbound tx'
+      - group1
+      - group2
+    default: group1
   observerQueryAllBlameRecordsResponse:
     type: object
     properties:
diff --git a/docs/spec/crosschain/messages.md b/docs/spec/crosschain/messages.md
index ba1161d149..41c32d9f13 100644
--- a/docs/spec/crosschain/messages.md
+++ b/docs/spec/crosschain/messages.md
@@ -32,7 +32,7 @@ message MsgRemoveFromOutTxTracker {
 
 ## MsgCreateTSSVoter
 
-Vote on creating a TSS key and recording the information about it (public
+CreateTSSVoter votes on creating a TSS key and recording the information about it (public
 key, participant and operator addresses, finalized and keygen heights).
 
 If the vote passes, the information about the TSS key is recorded on chain
diff --git a/docs/spec/observer/messages.md b/docs/spec/observer/messages.md
index 805a1f1731..5373e16993 100644
--- a/docs/spec/observer/messages.md
+++ b/docs/spec/observer/messages.md
@@ -16,7 +16,7 @@ message MsgAddObserver {
 
 ## MsgUpdateCoreParams
 
-Updates core parameters for a specific chain. Core parameters include
+UpdateCoreParams updates core parameters for a specific chain. Core parameters include
 confirmation count, outbound transaction schedule interval, ZETA token,
 connector and ERC20 custody contract addresses, etc.
 
@@ -57,8 +57,7 @@ message MsgUpdateCrosschainFlags {
 
 ## MsgUpdateKeygen
 
-Updates the block height of the keygen and sets the status to "pending
-keygen".
+UpdateKeygen updates the block height of the keygen and sets the status to "pending keygen".
 
 Only the admin policy account is authorized to broadcast this message.
 
diff --git a/proto/observer/params.proto b/proto/observer/params.proto
index e1f9f42b65..4d403b99d0 100644
--- a/proto/observer/params.proto
+++ b/proto/observer/params.proto
@@ -39,12 +39,8 @@ message ObserverParams {
 
 enum Policy_Type {
   option (gogoproto.goproto_enum_stringer) = true;
-  stop_inbound_cctx = 0; // some observer sees inbound tx
-  deploy_fungible_coin = 1;
-  update_client_params = 2;
-  update_keygen_block = 3;
-  out_tx_tracker = 4;
-  add_observer = 5;
+  group1 = 0;
+  group2 = 1;
 }
 
 message Admin_Policy {
diff --git a/x/crosschain/keeper/gas_payment_test.go b/x/crosschain/keeper/gas_payment_test.go
index a9c385c7d8..e917df3ea3 100644
--- a/x/crosschain/keeper/gas_payment_test.go
+++ b/x/crosschain/keeper/gas_payment_test.go
@@ -192,11 +192,15 @@ func setupZRC20Pool(
 	require.NoError(t, err)
 }
 
-func setAdminDeployFungibleCoin(ctx sdk.Context, zk testkeeper.ZetaKeepers, admin string) {
+func setAdminPolicies(ctx sdk.Context, zk testkeeper.ZetaKeepers, admin string) {
 	params := zk.ObserverKeeper.GetParams(ctx)
 	params.AdminPolicy = []*observertypes.Admin_Policy{
 		{
-			PolicyType: observertypes.Policy_Type_deploy_fungible_coin,
+			PolicyType: observertypes.Policy_Type_group1,
+			Address:    admin,
+		},
+		{
+			PolicyType: observertypes.Policy_Type_group2,
 			Address:    admin,
 		},
 	}
@@ -215,7 +219,7 @@ func TestKeeper_PayGasNativeAndUpdateCctx(t *testing.T) {
 		k, ctx, sdkk, zk := testkeeper.CrosschainKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, fungibletypes.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin)
 
 		// deploy gas coin and set fee params
 		chainID := getValidEthChainID(t)
@@ -283,7 +287,7 @@ func TestKeeper_PayGasNativeAndUpdateCctx(t *testing.T) {
 		k, ctx, sdkk, zk := testkeeper.CrosschainKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, fungibletypes.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin)
 
 		// deploy gas coin and set fee params
 		chainID := getValidEthChainID(t)
@@ -313,7 +317,7 @@ func TestKeeper_PayGasNativeAndUpdateCctx(t *testing.T) {
 		k, ctx, sdkk, zk := testkeeper.CrosschainKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, fungibletypes.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin)
 
 		// deploy gas coin and set fee params
 		chainID := getValidEthChainID(t)
@@ -356,7 +360,7 @@ func TestKeeper_PayGasInERC20AndUpdateCctx(t *testing.T) {
 
 		k.GetAuthKeeper().GetModuleAccount(ctx, fungibletypes.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin)
 
 		// deploy gas coin, erc20 and set fee params
 		chainID := getValidEthChainID(t)
@@ -449,7 +453,7 @@ func TestKeeper_PayGasInERC20AndUpdateCctx(t *testing.T) {
 		k, ctx, sdkk, zk := testkeeper.CrosschainKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, fungibletypes.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin)
 
 		// deploy gas coin and set fee params
 		chainID := getValidEthChainID(t)
@@ -479,7 +483,7 @@ func TestKeeper_PayGasInERC20AndUpdateCctx(t *testing.T) {
 		k, ctx, sdkk, zk := testkeeper.CrosschainKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, fungibletypes.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin)
 
 		// deploy gas coin, erc20 and set fee params
 		chainID := getValidEthChainID(t)
@@ -523,7 +527,7 @@ func TestKeeper_PayGasInERC20AndUpdateCctx(t *testing.T) {
 		k, ctx, sdkk, zk := testkeeper.CrosschainKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, fungibletypes.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin)
 
 		// deploy gas coin, erc20 and set fee params
 		chainID := getValidEthChainID(t)
@@ -577,7 +581,7 @@ func TestKeeper_PayGasInERC20AndUpdateCctx(t *testing.T) {
 		k, ctx, sdkk, zk := testkeeper.CrosschainKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, fungibletypes.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin)
 
 		// deploy gas coin, erc20 and set fee params
 		chainID := getValidEthChainID(t)
@@ -647,7 +651,7 @@ func TestKeeper_PayGasInZetaAndUpdateCctx(t *testing.T) {
 		k, ctx, sdkk, zk := testkeeper.CrosschainKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, fungibletypes.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin)
 
 		// deploy gas coin and set fee params
 		chainID := getValidEthChainID(t)
@@ -735,7 +739,7 @@ func TestKeeper_PayGasInZetaAndUpdateCctx(t *testing.T) {
 		k, ctx, sdkk, zk := testkeeper.CrosschainKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, fungibletypes.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin)
 
 		// deploy gas coin and set fee params
 		chainID := getValidEthChainID(t)
@@ -765,7 +769,7 @@ func TestKeeper_PayGasInZetaAndUpdateCctx(t *testing.T) {
 		k, ctx, sdkk, zk := testkeeper.CrosschainKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, fungibletypes.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin)
 
 		// deploy gas coin and set fee params
 		chainID := getValidEthChainID(t)
diff --git a/x/crosschain/keeper/keeper_out_tx_tracker.go b/x/crosschain/keeper/keeper_out_tx_tracker.go
index f0ed81f469..5053687bd4 100644
--- a/x/crosschain/keeper/keeper_out_tx_tracker.go
+++ b/x/crosschain/keeper/keeper_out_tx_tracker.go
@@ -170,7 +170,7 @@ func (k msgServer) AddToOutTxTracker(goCtx context.Context, msg *types.MsgAddToO
 	}
 
 	if msg.Proof == nil { // without proof, only certain accounts can send this message
-		adminPolicyAccount := k.zetaObserverKeeper.GetParams(ctx).GetAdminPolicyAccount(observertypes.Policy_Type_out_tx_tracker)
+		adminPolicyAccount := k.zetaObserverKeeper.GetParams(ctx).GetAdminPolicyAccount(observertypes.Policy_Type_group1)
 		isAdmin := msg.Creator == adminPolicyAccount
 
 		isObserver, err := k.zetaObserverKeeper.IsAuthorized(ctx, msg.Creator, chain)
@@ -275,7 +275,7 @@ func (k msgServer) AddToOutTxTracker(goCtx context.Context, msg *types.MsgAddToO
 // only the admin policy account is authorized to broadcast this message.
 func (k msgServer) RemoveFromOutTxTracker(goCtx context.Context, msg *types.MsgRemoveFromOutTxTracker) (*types.MsgRemoveFromOutTxTrackerResponse, error) {
 	ctx := sdk.UnwrapSDKContext(goCtx)
-	if msg.Creator != k.zetaObserverKeeper.GetParams(ctx).GetAdminPolicyAccount(observertypes.Policy_Type_out_tx_tracker) {
+	if msg.Creator != k.zetaObserverKeeper.GetParams(ctx).GetAdminPolicyAccount(observertypes.Policy_Type_group1) {
 		return &types.MsgRemoveFromOutTxTrackerResponse{}, observertypes.ErrNotAuthorizedPolicy
 	}
 
diff --git a/x/crosschain/keeper/msg_server_whitelist_erc20.go b/x/crosschain/keeper/msg_server_whitelist_erc20.go
index 5075ee69d4..b101d0b059 100644
--- a/x/crosschain/keeper/msg_server_whitelist_erc20.go
+++ b/x/crosschain/keeper/msg_server_whitelist_erc20.go
@@ -20,7 +20,7 @@ import (
 
 func (k Keeper) WhitelistERC20(goCtx context.Context, msg *types.MsgWhitelistERC20) (*types.MsgWhitelistERC20Response, error) {
 	ctx := sdk.UnwrapSDKContext(goCtx)
-	if msg.Creator != k.zetaObserverKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_deploy_fungible_coin) {
+	if msg.Creator != k.zetaObserverKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_group1) {
 		return nil, sdkerrors.Wrap(sdkerrors.ErrUnauthorized, "Deploy can only be executed by the correct policy account")
 	}
 	erc20Addr := ethcommon.HexToAddress(msg.Erc20Address)
diff --git a/x/crosschain/keeper/keeper_tss_voter.go b/x/crosschain/keeper/msg_tss_voter.go
similarity index 97%
rename from x/crosschain/keeper/keeper_tss_voter.go
rename to x/crosschain/keeper/msg_tss_voter.go
index 0dc818d48f..a5d6603252 100644
--- a/x/crosschain/keeper/keeper_tss_voter.go
+++ b/x/crosschain/keeper/msg_tss_voter.go
@@ -16,7 +16,7 @@ import (
 
 // MESSAGES
 
-// Vote on creating a TSS key and recording the information about it (public
+// CreateTSSVoter votes on creating a TSS key and recording the information about it (public
 // key, participant and operator addresses, finalized and keygen heights).
 //
 // If the vote passes, the information about the TSS key is recorded on chain
@@ -117,7 +117,7 @@ func (k msgServer) CreateTSSVoter(goCtx context.Context, msg *types.MsgCreateTSS
 func (k msgServer) UpdateTssAddress(goCtx context.Context, msg *types.MsgUpdateTssAddress) (*types.MsgUpdateTssAddressResponse, error) {
 	ctx := sdk.UnwrapSDKContext(goCtx)
 	// TODO : Add a new policy type for updating the TSS address
-	if msg.Creator != k.zetaObserverKeeper.GetParams(ctx).GetAdminPolicyAccount(observerTypes.Policy_Type_update_keygen_block) {
+	if msg.Creator != k.zetaObserverKeeper.GetParams(ctx).GetAdminPolicyAccount(observerTypes.Policy_Type_group2) {
 		return nil, errorsmod.Wrap(sdkerrors.ErrUnauthorized, "Update can only be executed by the correct policy account")
 	}
 	tss, ok := k.CheckIfTssPubkeyHasBeenGenerated(ctx, msg.TssPubkey)
diff --git a/x/crosschain/keeper/test_privnet.go b/x/crosschain/keeper/test_privnet.go
index 80efb8bb12..db2f68b2ad 100644
--- a/x/crosschain/keeper/test_privnet.go
+++ b/x/crosschain/keeper/test_privnet.go
@@ -12,7 +12,7 @@ import (
 
 func (k Keeper) TestWhitelistERC20(ctx sdk.Context) error {
 	goCtx := sdk.UnwrapSDKContext(ctx)
-	creator := k.zetaObserverKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_deploy_fungible_coin)
+	creator := k.zetaObserverKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_group1)
 	msg := types.NewMsgWhitelistERC20(creator, types.ModuleAddressEVM.Hex(), common.GoerliChain().ChainId, "test", "testerc20", 17, 90_000)
 
 	_, err := k.WhitelistERC20(goCtx, msg)
diff --git a/x/fungible/keeper/begin_blocker_deploy_system_contracts_privnet.go b/x/fungible/keeper/begin_blocker_deploy_system_contracts_privnet.go
index 579767fe35..18301cb3d8 100644
--- a/x/fungible/keeper/begin_blocker_deploy_system_contracts_privnet.go
+++ b/x/fungible/keeper/begin_blocker_deploy_system_contracts_privnet.go
@@ -132,7 +132,7 @@ func (k Keeper) TestUpdateSystemContractAddress(goCtx context.Context) error {
 	if err != nil {
 		return sdkerrors.Wrapf(err, "failed to DeploySystemContract")
 	}
-	creator := k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(observertypes.Policy_Type_deploy_fungible_coin)
+	creator := k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(observertypes.Policy_Type_group1)
 	msg := types.NewMsgUpdateSystemContract(creator, SystemContractAddress.Hex())
 	_, err = k.UpdateSystemContract(ctx, msg)
 	k.Logger(ctx).Info("System contract updated", "new address", SystemContractAddress.String())
@@ -143,7 +143,7 @@ func (k Keeper) TestUpdateZRC20WithdrawFee(goCtx context.Context) error {
 	ctx := sdk.UnwrapSDKContext(goCtx)
 
 	foreignCoins := k.GetAllForeignCoins(ctx)
-	creator := k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(observertypes.Policy_Type_deploy_fungible_coin)
+	creator := k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(observertypes.Policy_Type_group1)
 
 	for _, foreignCoin := range foreignCoins {
 		msg := types.NewMsgUpdateZRC20WithdrawFee(creator, foreignCoin.Zrc20ContractAddress, sdk.NewUint(uint64(foreignCoin.ForeignChainId)))
diff --git a/x/fungible/keeper/msg_server_deploy_fungible_coin_zrc20.go b/x/fungible/keeper/msg_server_deploy_fungible_coin_zrc20.go
index db782a6491..b1debf076a 100644
--- a/x/fungible/keeper/msg_server_deploy_fungible_coin_zrc20.go
+++ b/x/fungible/keeper/msg_server_deploy_fungible_coin_zrc20.go
@@ -37,7 +37,7 @@ func (k msgServer) DeployFungibleCoinZRC20(goCtx context.Context, msg *types.Msg
 	var address common.Address
 	var err error
 
-	if msg.Creator != k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_deploy_fungible_coin) {
+	if msg.Creator != k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_group2) {
 		return nil, sdkerrors.Wrap(sdkerrors.ErrUnauthorized, "Deploy can only be executed by the correct policy account")
 	}
 	if msg.Decimals > 255 {
diff --git a/x/fungible/keeper/msg_server_deploy_fungible_coin_zrc20_test.go b/x/fungible/keeper/msg_server_deploy_fungible_coin_zrc20_test.go
index 5eef132e3f..e40c1af9ae 100644
--- a/x/fungible/keeper/msg_server_deploy_fungible_coin_zrc20_test.go
+++ b/x/fungible/keeper/msg_server_deploy_fungible_coin_zrc20_test.go
@@ -21,7 +21,7 @@ func TestMsgServer_DeployFungibleCoinZRC20(t *testing.T) {
 		msgServer := keeper.NewMsgServerImpl(*k)
 		k.GetAuthKeeper().GetModuleAccount(ctx, types.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 		chainID := getValidChainID(t)
 
 		deploySystemContracts(t, ctx, k, sdkk.EvmKeeper)
@@ -102,7 +102,7 @@ func TestMsgServer_DeployFungibleCoinZRC20(t *testing.T) {
 		k, ctx, sdkk, zk := keepertest.FungibleKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, types.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 		chainID := getValidChainID(t)
 
 		deploySystemContracts(t, ctx, k, sdkk.EvmKeeper)
@@ -126,7 +126,7 @@ func TestMsgServer_DeployFungibleCoinZRC20(t *testing.T) {
 		k, ctx, sdkk, zk := keepertest.FungibleKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, types.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 
 		deploySystemContracts(t, ctx, k, sdkk.EvmKeeper)
 
diff --git a/x/fungible/keeper/msg_server_remove_foreign_coin.go b/x/fungible/keeper/msg_server_remove_foreign_coin.go
index eb0f5a3c72..8231e2f9a2 100644
--- a/x/fungible/keeper/msg_server_remove_foreign_coin.go
+++ b/x/fungible/keeper/msg_server_remove_foreign_coin.go
@@ -14,7 +14,7 @@ import (
 // Only the admin policy account is authorized to broadcast this message.
 func (k msgServer) RemoveForeignCoin(goCtx context.Context, msg *types.MsgRemoveForeignCoin) (*types.MsgRemoveForeignCoinResponse, error) {
 	ctx := sdk.UnwrapSDKContext(goCtx)
-	if msg.Creator != k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_deploy_fungible_coin) {
+	if msg.Creator != k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_group2) {
 		return nil, sdkerrors.Wrap(sdkerrors.ErrUnauthorized, "Removal can only be executed by the correct policy account")
 	}
 	index := msg.Name
diff --git a/x/fungible/keeper/msg_server_remove_foreign_coin_test.go b/x/fungible/keeper/msg_server_remove_foreign_coin_test.go
index c866d81f21..fedfe7315b 100644
--- a/x/fungible/keeper/msg_server_remove_foreign_coin_test.go
+++ b/x/fungible/keeper/msg_server_remove_foreign_coin_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/zeta-chain/zetacore/testutil/sample"
 	"github.com/zeta-chain/zetacore/x/fungible/keeper"
 	"github.com/zeta-chain/zetacore/x/fungible/types"
+	observertypes "github.com/zeta-chain/zetacore/x/observer/types"
 )
 
 func TestMsgServer_RemoveForeignCoin(t *testing.T) {
@@ -17,7 +18,7 @@ func TestMsgServer_RemoveForeignCoin(t *testing.T) {
 		msgServer := keeper.NewMsgServerImpl(*k)
 		k.GetAuthKeeper().GetModuleAccount(ctx, types.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 		chainID := getValidChainID(t)
 
 		deploySystemContracts(t, ctx, k, sdkk.EvmKeeper)
@@ -51,7 +52,7 @@ func TestMsgServer_RemoveForeignCoin(t *testing.T) {
 		msgServer := keeper.NewMsgServerImpl(*k)
 		k.GetAuthKeeper().GetModuleAccount(ctx, types.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 
 		_, err := msgServer.RemoveForeignCoin(ctx, types.NewMsgRemoveForeignCoin(admin, sample.EthAddress().Hex()))
 		require.Error(t, err)
diff --git a/x/fungible/keeper/msg_server_update_contract_bytecode.go b/x/fungible/keeper/msg_server_update_contract_bytecode.go
index ed66882fe4..8664be1121 100644
--- a/x/fungible/keeper/msg_server_update_contract_bytecode.go
+++ b/x/fungible/keeper/msg_server_update_contract_bytecode.go
@@ -20,7 +20,7 @@ func (k Keeper) UpdateContractBytecode(goCtx context.Context, msg *types.MsgUpda
 	ctx := sdk.UnwrapSDKContext(goCtx)
 
 	// check authorization
-	if msg.Creator != k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(observertypes.Policy_Type_deploy_fungible_coin) {
+	if msg.Creator != k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(observertypes.Policy_Type_group2) {
 		return nil, cosmoserror.Wrap(sdkerrors.ErrUnauthorized, "Deploy can only be executed by the correct policy account")
 	}
 
diff --git a/x/fungible/keeper/msg_server_update_contract_bytecode_test.go b/x/fungible/keeper/msg_server_update_contract_bytecode_test.go
index 8db3f53bdf..fc5900d342 100644
--- a/x/fungible/keeper/msg_server_update_contract_bytecode_test.go
+++ b/x/fungible/keeper/msg_server_update_contract_bytecode_test.go
@@ -17,11 +17,11 @@ import (
 	observertypes "github.com/zeta-chain/zetacore/x/observer/types"
 )
 
-func setAdminDeployFungibleCoin(ctx sdk.Context, zk keepertest.ZetaKeepers, admin string) {
+func setAdminPolicies(ctx sdk.Context, zk keepertest.ZetaKeepers, admin string, policyType observertypes.Policy_Type) {
 	zk.ObserverKeeper.SetParams(ctx, observertypes.Params{
 		AdminPolicy: []*observertypes.Admin_Policy{
 			{
-				PolicyType: observertypes.Policy_Type_deploy_fungible_coin,
+				PolicyType: policyType,
 				Address:    admin,
 			},
 		},
@@ -35,7 +35,7 @@ func TestKeeper_UpdateContractBytecode(t *testing.T) {
 		admin := sample.AccAddress()
 
 		// set admin policy
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 
 		// sample chainIDs and addresses
 		chainList := zetacommon.DefaultChainsList()
@@ -156,7 +156,7 @@ func TestKeeper_UpdateContractBytecode(t *testing.T) {
 		admin := sample.AccAddress()
 
 		// deploy a connector
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 		wzeta, _, _, oldConnector, _ := deploySystemContracts(t, ctx, k, sdkk.EvmKeeper)
 
 		// deploy a new connector that will become official connector
@@ -188,7 +188,7 @@ func TestKeeper_UpdateContractBytecode(t *testing.T) {
 	t.Run("should fail invalid contract address", func(t *testing.T) {
 		k, ctx, _, zk := keepertest.FungibleKeeper(t)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 
 		_, err := k.UpdateContractBytecode(ctx, &types.MsgUpdateContractBytecode{
 			Creator:            admin,
@@ -204,7 +204,7 @@ func TestKeeper_UpdateContractBytecode(t *testing.T) {
 		})
 		mockEVMKeeper := keepertest.GetFungibleEVMMock(t, k)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 		contractAddr := sample.EthAddress()
 
 		mockEVMKeeper.On(
@@ -228,7 +228,7 @@ func TestKeeper_UpdateContractBytecode(t *testing.T) {
 		k.GetAuthKeeper().GetModuleAccount(ctx, types.ModuleName)
 		admin := sample.AccAddress()
 
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 		wzeta, _, _, _, _ := deploySystemContracts(t, ctx, k, sdkk.EvmKeeper)
 
 		// can't update the bytecode of the wzeta contract
@@ -245,7 +245,7 @@ func TestKeeper_UpdateContractBytecode(t *testing.T) {
 		k.GetAuthKeeper().GetModuleAccount(ctx, types.ModuleName)
 		admin := sample.AccAddress()
 
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 		_, _, _, connector, _ := deploySystemContracts(t, ctx, k, sdkk.EvmKeeper)
 
 		// remove system contract
@@ -266,7 +266,7 @@ func TestKeeper_UpdateContractBytecode(t *testing.T) {
 		})
 		mockEVMKeeper := keepertest.GetFungibleEVMMock(t, k)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 
 		// set the contract as the connector
 		contract := sample.EthAddress()
@@ -297,7 +297,7 @@ func TestKeeper_UpdateContractBytecode(t *testing.T) {
 		})
 		mockEVMKeeper := keepertest.GetFungibleEVMMock(t, k)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 		contractAddr := sample.EthAddress()
 		newBytecodeAddr := sample.EthAddress()
 
@@ -334,7 +334,7 @@ func TestKeeper_UpdateContractBytecode(t *testing.T) {
 		})
 		mockEVMKeeper := keepertest.GetFungibleEVMMock(t, k)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 		contractAddr := sample.EthAddress()
 		newBytecodeAddr := sample.EthAddress()
 
diff --git a/x/fungible/keeper/msg_server_update_system_contract.go b/x/fungible/keeper/msg_server_update_system_contract.go
index dcdb2f6bfc..f6de594ecf 100644
--- a/x/fungible/keeper/msg_server_update_system_contract.go
+++ b/x/fungible/keeper/msg_server_update_system_contract.go
@@ -16,7 +16,7 @@ import (
 
 func (k Keeper) UpdateSystemContract(goCtx context.Context, msg *types.MsgUpdateSystemContract) (*types.MsgUpdateSystemContractResponse, error) {
 	ctx := sdk.UnwrapSDKContext(goCtx)
-	if msg.Creator != k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_deploy_fungible_coin) {
+	if msg.Creator != k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_group2) {
 		return nil, sdkerrors.Wrap(sdkerrors.ErrUnauthorized, "Deploy can only be executed by the correct policy account")
 	}
 	newSystemContractAddr := ethcommon.HexToAddress(msg.NewSystemContractAddress)
diff --git a/x/fungible/keeper/msg_server_update_system_contract_test.go b/x/fungible/keeper/msg_server_update_system_contract_test.go
index 1d38265022..ebd72cd0d5 100644
--- a/x/fungible/keeper/msg_server_update_system_contract_test.go
+++ b/x/fungible/keeper/msg_server_update_system_contract_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/zeta-chain/zetacore/testutil/sample"
 	"github.com/zeta-chain/zetacore/x/fungible/keeper"
 	"github.com/zeta-chain/zetacore/x/fungible/types"
+	observertypes "github.com/zeta-chain/zetacore/x/observer/types"
 )
 
 func TestKeeper_UpdateSystemContract(t *testing.T) {
@@ -21,7 +22,7 @@ func TestKeeper_UpdateSystemContract(t *testing.T) {
 		k, ctx, sdkk, zk := keepertest.FungibleKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, types.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 
 		queryZRC20SystemContract := func(contract common.Address) string {
 			abi, err := zrc20.ZRC20MetaData.GetAbi()
@@ -92,7 +93,7 @@ func TestKeeper_UpdateSystemContract(t *testing.T) {
 		k, ctx, sdkk, zk := keepertest.FungibleKeeper(t)
 		k.GetAuthKeeper().GetModuleAccount(ctx, types.ModuleName)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 
 		// deploy a new system contracts
 		wzeta, factory, router, _, oldSystemContract := deploySystemContracts(t, ctx, k, sdkk.EvmKeeper)
diff --git a/x/fungible/keeper/msg_server_update_zrc20_paused_status.go b/x/fungible/keeper/msg_server_update_zrc20_paused_status.go
index 0e5fe54c35..2c0b89a4d0 100644
--- a/x/fungible/keeper/msg_server_update_zrc20_paused_status.go
+++ b/x/fungible/keeper/msg_server_update_zrc20_paused_status.go
@@ -25,7 +25,12 @@ func (k Keeper) UpdateZRC20PausedStatus(
 	}
 
 	// check if the sender is the admin
-	if msg.Creator != k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_deploy_fungible_coin) {
+	// unpausing requires group2 admin
+	requirePolicyAccount := zetaObserverTypes.Policy_Type_group1
+	if msg.Action == types.UpdatePausedStatusAction_UNPAUSE {
+		requirePolicyAccount = zetaObserverTypes.Policy_Type_group2
+	}
+	if msg.Creator != k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(requirePolicyAccount) {
 		return nil, cosmoserrors.Wrap(sdkerrors.ErrUnauthorized, "Update can only be executed by the correct policy account")
 	}
 
diff --git a/x/fungible/keeper/msg_server_update_zrc20_paused_status_test.go b/x/fungible/keeper/msg_server_update_zrc20_paused_status_test.go
index cdf27ed943..33f02d8745 100644
--- a/x/fungible/keeper/msg_server_update_zrc20_paused_status_test.go
+++ b/x/fungible/keeper/msg_server_update_zrc20_paused_status_test.go
@@ -8,13 +8,13 @@ import (
 	keepertest "github.com/zeta-chain/zetacore/testutil/keeper"
 	"github.com/zeta-chain/zetacore/testutil/sample"
 	"github.com/zeta-chain/zetacore/x/fungible/types"
+	observertypes "github.com/zeta-chain/zetacore/x/observer/types"
 )
 
 func TestKeeper_UpdateZRC20PausedStatus(t *testing.T) {
 	t.Run("can update the paused status of zrc20", func(t *testing.T) {
 		k, ctx, _, zk := keepertest.FungibleKeeper(t)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
 
 		requireUnpaused := func(zrc20 string) {
 			fc, found := k.GetForeignCoins(ctx, zrc20)
@@ -36,6 +36,8 @@ func TestKeeper_UpdateZRC20PausedStatus(t *testing.T) {
 		requireUnpaused(zrc20B)
 		requireUnpaused(zrc20C)
 
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group1)
+
 		// can pause zrc20
 		_, err := k.UpdateZRC20PausedStatus(ctx, types.NewMsgUpdateZRC20PausedStatus(
 			admin,
@@ -50,6 +52,8 @@ func TestKeeper_UpdateZRC20PausedStatus(t *testing.T) {
 		requirePaused(zrc20B)
 		requireUnpaused(zrc20C)
 
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
+
 		// can unpause zrc20
 		_, err = k.UpdateZRC20PausedStatus(ctx, types.NewMsgUpdateZRC20PausedStatus(
 			admin,
@@ -63,6 +67,8 @@ func TestKeeper_UpdateZRC20PausedStatus(t *testing.T) {
 		requirePaused(zrc20B)
 		requireUnpaused(zrc20C)
 
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group1)
+
 		// can pause already paused zrc20
 		_, err = k.UpdateZRC20PausedStatus(ctx, types.NewMsgUpdateZRC20PausedStatus(
 			admin,
@@ -76,6 +82,8 @@ func TestKeeper_UpdateZRC20PausedStatus(t *testing.T) {
 		requirePaused(zrc20B)
 		requireUnpaused(zrc20C)
 
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
+
 		// can unpause already unpaused zrc20
 		_, err = k.UpdateZRC20PausedStatus(ctx, types.NewMsgUpdateZRC20PausedStatus(
 			admin,
@@ -89,6 +97,8 @@ func TestKeeper_UpdateZRC20PausedStatus(t *testing.T) {
 		requirePaused(zrc20B)
 		requireUnpaused(zrc20C)
 
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group1)
+
 		// can pause all zrc20
 		_, err = k.UpdateZRC20PausedStatus(ctx, types.NewMsgUpdateZRC20PausedStatus(
 			admin,
@@ -104,6 +114,8 @@ func TestKeeper_UpdateZRC20PausedStatus(t *testing.T) {
 		requirePaused(zrc20B)
 		requirePaused(zrc20C)
 
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
+
 		// can unpause all zrc20
 		_, err = k.UpdateZRC20PausedStatus(ctx, types.NewMsgUpdateZRC20PausedStatus(
 			admin,
@@ -123,7 +135,7 @@ func TestKeeper_UpdateZRC20PausedStatus(t *testing.T) {
 	t.Run("should fail if invalid message", func(t *testing.T) {
 		k, ctx, _, zk := keepertest.FungibleKeeper(t)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group1)
 
 		invalidMsg := types.NewMsgUpdateZRC20PausedStatus(admin, []string{}, types.UpdatePausedStatusAction_PAUSE)
 		require.ErrorIs(t, invalidMsg.ValidateBasic(), sdkerrors.ErrInvalidRequest)
@@ -133,20 +145,30 @@ func TestKeeper_UpdateZRC20PausedStatus(t *testing.T) {
 	})
 
 	t.Run("should fail if not authorized", func(t *testing.T) {
-		k, ctx, _, _ := keepertest.FungibleKeeper(t)
+		k, ctx, _, zk := keepertest.FungibleKeeper(t)
 
 		_, err := k.UpdateZRC20PausedStatus(ctx, types.NewMsgUpdateZRC20PausedStatus(
 			sample.AccAddress(),
 			[]string{sample.EthAddress().String()},
 			types.UpdatePausedStatusAction_PAUSE,
 		))
+
+		admin := sample.AccAddress()
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group1)
+
+		_, err = k.UpdateZRC20PausedStatus(ctx, types.NewMsgUpdateZRC20PausedStatus(
+			sample.AccAddress(),
+			[]string{sample.EthAddress().String()},
+			types.UpdatePausedStatusAction_UNPAUSE,
+		))
+
 		require.ErrorIs(t, err, sdkerrors.ErrUnauthorized)
 	})
 
 	t.Run("should fail if zrc20 does not exist", func(t *testing.T) {
 		k, ctx, _, zk := keepertest.FungibleKeeper(t)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group1)
 
 		zrc20A, zrc20B := sample.EthAddress().String(), sample.EthAddress().String()
 		k.SetForeignCoins(ctx, sample.ForeignCoins(t, zrc20A))
diff --git a/x/fungible/keeper/msg_server_update_zrc20_withdraw_fee.go b/x/fungible/keeper/msg_server_update_zrc20_withdraw_fee.go
index 56e75381e6..7c72496770 100644
--- a/x/fungible/keeper/msg_server_update_zrc20_withdraw_fee.go
+++ b/x/fungible/keeper/msg_server_update_zrc20_withdraw_fee.go
@@ -17,7 +17,7 @@ func (k Keeper) UpdateZRC20WithdrawFee(goCtx context.Context, msg *types.MsgUpda
 	ctx := sdk.UnwrapSDKContext(goCtx)
 
 	// check signer permission
-	if msg.Creator != k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_deploy_fungible_coin) {
+	if msg.Creator != k.observerKeeper.GetParams(ctx).GetAdminPolicyAccount(zetaObserverTypes.Policy_Type_group2) {
 		return nil, cosmoserrors.Wrap(sdkerrors.ErrUnauthorized, "deploy can only be executed by the correct policy account")
 	}
 
diff --git a/x/fungible/keeper/msg_server_update_zrc20_withdraw_fee_test.go b/x/fungible/keeper/msg_server_update_zrc20_withdraw_fee_test.go
index 28a967b248..1b2cc0374b 100644
--- a/x/fungible/keeper/msg_server_update_zrc20_withdraw_fee_test.go
+++ b/x/fungible/keeper/msg_server_update_zrc20_withdraw_fee_test.go
@@ -15,6 +15,7 @@ import (
 	keepertest "github.com/zeta-chain/zetacore/testutil/keeper"
 	"github.com/zeta-chain/zetacore/testutil/sample"
 	"github.com/zeta-chain/zetacore/x/fungible/types"
+	observertypes "github.com/zeta-chain/zetacore/x/observer/types"
 )
 
 func TestKeeper_UpdateZRC20WithdrawFee(t *testing.T) {
@@ -25,7 +26,7 @@ func TestKeeper_UpdateZRC20WithdrawFee(t *testing.T) {
 
 		// set coin admin
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 
 		// deploy the system contract and a ZRC20 contract
 		deploySystemContracts(t, ctx, k, sdkk.EvmKeeper)
@@ -64,7 +65,7 @@ func TestKeeper_UpdateZRC20WithdrawFee(t *testing.T) {
 	t.Run("should fail if invalid zrc20 address", func(t *testing.T) {
 		k, ctx, _, zk := keepertest.FungibleKeeper(t)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 
 		_, err := k.UpdateZRC20WithdrawFee(ctx, types.NewMsgUpdateZRC20WithdrawFee(
 			admin,
@@ -77,7 +78,7 @@ func TestKeeper_UpdateZRC20WithdrawFee(t *testing.T) {
 	t.Run("should fail if can't retrieve the foreign coin", func(t *testing.T) {
 		k, ctx, _, zk := keepertest.FungibleKeeper(t)
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 
 		_, err := k.UpdateZRC20WithdrawFee(ctx, types.NewMsgUpdateZRC20WithdrawFee(
 			admin,
@@ -93,7 +94,7 @@ func TestKeeper_UpdateZRC20WithdrawFee(t *testing.T) {
 
 		// setup
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 		zrc20 := sample.EthAddress()
 		k.SetForeignCoins(ctx, sample.ForeignCoins(t, zrc20.String()))
 
@@ -113,7 +114,7 @@ func TestKeeper_UpdateZRC20WithdrawFee(t *testing.T) {
 
 		// setup
 		admin := sample.AccAddress()
-		setAdminDeployFungibleCoin(ctx, zk, admin)
+		setAdminPolicies(ctx, zk, admin, observertypes.Policy_Type_group2)
 		zrc20Addr := sample.EthAddress()
 		k.SetForeignCoins(ctx, sample.ForeignCoins(t, zrc20Addr.String()))
 
diff --git a/x/observer/keeper/migrator.go b/x/observer/keeper/migrator.go
index 4af2f09020..daed1e08f8 100644
--- a/x/observer/keeper/migrator.go
+++ b/x/observer/keeper/migrator.go
@@ -3,6 +3,7 @@ package keeper
 import (
 	sdk "github.com/cosmos/cosmos-sdk/types"
 	v2 "github.com/zeta-chain/zetacore/x/observer/migrations/v2"
+	v3 "github.com/zeta-chain/zetacore/x/observer/migrations/v3"
 )
 
 // Migrator is a struct for handling in-place store migrations.
@@ -21,3 +22,8 @@ func NewMigrator(keeper Keeper) Migrator {
 func (m Migrator) Migrate1to2(ctx sdk.Context) error {
 	return v2.MigrateStore(ctx, m.observerKeeper.storeKey, m.observerKeeper.cdc)
 }
+
+// Migrate2to3 migrates the store from consensus version 2 to 3
+func (m Migrator) Migrate2to3(ctx sdk.Context) error {
+	return v3.MigrateStore(ctx, m.observerKeeper)
+}
diff --git a/x/observer/keeper/msg_server_update_core_params.go b/x/observer/keeper/msg_server_update_core_params.go
index efece06a53..87fbbc9606 100644
--- a/x/observer/keeper/msg_server_update_core_params.go
+++ b/x/observer/keeper/msg_server_update_core_params.go
@@ -7,7 +7,7 @@ import (
 	"github.com/zeta-chain/zetacore/x/observer/types"
 )
 
-// Updates core parameters for a specific chain. Core parameters include
+// UpdateCoreParams updates core parameters for a specific chain. Core parameters include
 // confirmation count, outbound transaction schedule interval, ZETA token,
 // connector and ERC20 custody contract addresses, etc.
 //
@@ -16,7 +16,7 @@ import (
 // Only the admin policy account is authorized to broadcast this message.
 func (k msgServer) UpdateCoreParams(goCtx context.Context, msg *types.MsgUpdateCoreParams) (*types.MsgUpdateCoreParamsResponse, error) {
 	ctx := sdk.UnwrapSDKContext(goCtx)
-	if msg.Creator != k.GetParams(ctx).GetAdminPolicyAccount(types.Policy_Type_update_client_params) {
+	if msg.Creator != k.GetParams(ctx).GetAdminPolicyAccount(types.Policy_Type_group2) {
 		return &types.MsgUpdateCoreParamsResponse{}, types.ErrNotAuthorizedPolicy
 	}
 	if !k.GetParams(ctx).IsChainIDSupported(msg.CoreParams.ChainId) {
diff --git a/x/observer/keeper/msg_server_update_crosschain_flags.go b/x/observer/keeper/msg_server_update_crosschain_flags.go
index edcea2b931..57d4478163 100644
--- a/x/observer/keeper/msg_server_update_crosschain_flags.go
+++ b/x/observer/keeper/msg_server_update_crosschain_flags.go
@@ -12,8 +12,13 @@ import (
 func (k msgServer) UpdateCrosschainFlags(goCtx context.Context, msg *types.MsgUpdateCrosschainFlags) (*types.MsgUpdateCrosschainFlagsResponse, error) {
 	ctx := sdk.UnwrapSDKContext(goCtx)
 
+	requiredGroup := types.Policy_Type_group1
+	if msg.IsInboundEnabled || msg.IsOutboundEnabled || msg.GasPriceIncreaseFlags != nil {
+		requiredGroup = types.Policy_Type_group2
+	}
+
 	// check permission
-	if msg.Creator != k.GetParams(ctx).GetAdminPolicyAccount(types.Policy_Type_stop_inbound_cctx) {
+	if msg.Creator != k.GetParams(ctx).GetAdminPolicyAccount(requiredGroup) {
 		return &types.MsgUpdateCrosschainFlagsResponse{}, types.ErrNotAuthorizedPolicy
 	}
 
diff --git a/x/observer/keeper/msg_server_update_crosschain_flags_test.go b/x/observer/keeper/msg_server_update_crosschain_flags_test.go
index 790ec1e762..73c8a4d9de 100644
--- a/x/observer/keeper/msg_server_update_crosschain_flags_test.go
+++ b/x/observer/keeper/msg_server_update_crosschain_flags_test.go
@@ -13,11 +13,11 @@ import (
 	observertypes "github.com/zeta-chain/zetacore/x/observer/types"
 )
 
-func setAdminCrossChainFlags(ctx sdk.Context, k *keeper.Keeper, admin string) {
+func setAdminCrossChainFlags(ctx sdk.Context, k *keeper.Keeper, admin string, group types.Policy_Type) {
 	k.SetParams(ctx, observertypes.Params{
 		AdminPolicy: []*observertypes.Admin_Policy{
 			{
-				PolicyType: observertypes.Policy_Type_stop_inbound_cctx,
+				PolicyType: group,
 				Address:    admin,
 			},
 		},
@@ -29,7 +29,8 @@ func TestMsgServer_UpdateCrosschainFlags(t *testing.T) {
 		k, ctx := keepertest.ObserverKeeper(t)
 		srv := keeper.NewMsgServerImpl(*k)
 		admin := sample.AccAddress()
-		setAdminCrossChainFlags(ctx, k, admin)
+
+		setAdminCrossChainFlags(ctx, k, admin, types.Policy_Type_group2)
 
 		_, err := srv.UpdateCrosschainFlags(sdk.WrapSDKContext(ctx), &types.MsgUpdateCrosschainFlags{
 			Creator:           admin,
@@ -51,6 +52,8 @@ func TestMsgServer_UpdateCrosschainFlags(t *testing.T) {
 		require.Equal(t, time.Minute*42, flags.GasPriceIncreaseFlags.RetryInterval)
 		require.Equal(t, uint32(42), flags.GasPriceIncreaseFlags.GasPriceIncreasePercent)
 
+		setAdminCrossChainFlags(ctx, k, admin, types.Policy_Type_group2)
+
 		// can update flags again
 		_, err = srv.UpdateCrosschainFlags(sdk.WrapSDKContext(ctx), &types.MsgUpdateCrosschainFlags{
 			Creator:           admin,
@@ -72,6 +75,9 @@ func TestMsgServer_UpdateCrosschainFlags(t *testing.T) {
 		require.Equal(t, time.Minute*43, flags.GasPriceIncreaseFlags.RetryInterval)
 		require.Equal(t, uint32(43), flags.GasPriceIncreaseFlags.GasPriceIncreasePercent)
 
+		// group 1 should be able to disable inbound and outbound
+		setAdminCrossChainFlags(ctx, k, admin, types.Policy_Type_group1)
+
 		// if gas price increase flags is nil, it should not be updated
 		_, err = srv.UpdateCrosschainFlags(sdk.WrapSDKContext(ctx), &types.MsgUpdateCrosschainFlags{
 			Creator:           admin,
@@ -93,6 +99,8 @@ func TestMsgServer_UpdateCrosschainFlags(t *testing.T) {
 		_, found = k.GetCrosschainFlags(ctx)
 		require.False(t, found)
 
+		setAdminCrossChainFlags(ctx, k, admin, types.Policy_Type_group2)
+
 		_, err = srv.UpdateCrosschainFlags(sdk.WrapSDKContext(ctx), &types.MsgUpdateCrosschainFlags{
 			Creator:           admin,
 			IsInboundEnabled:  false,
@@ -120,5 +128,16 @@ func TestMsgServer_UpdateCrosschainFlags(t *testing.T) {
 		})
 		require.Error(t, err)
 		require.Equal(t, types.ErrNotAuthorizedPolicy, err)
+
+		admin := sample.AccAddress()
+		setAdminCrossChainFlags(ctx, k, admin, types.Policy_Type_group1)
+
+		_, err = srv.UpdateCrosschainFlags(sdk.WrapSDKContext(ctx), &types.MsgUpdateCrosschainFlags{
+			Creator:           admin,
+			IsInboundEnabled:  false,
+			IsOutboundEnabled: true,
+		})
+		require.Error(t, err)
+		require.Equal(t, types.ErrNotAuthorizedPolicy, err)
 	})
 }
diff --git a/x/observer/keeper/msg_server_update_keygen.go b/x/observer/keeper/msg_server_update_keygen.go
index a4280a07cc..17c66e82c4 100644
--- a/x/observer/keeper/msg_server_update_keygen.go
+++ b/x/observer/keeper/msg_server_update_keygen.go
@@ -7,14 +7,13 @@ import (
 	"github.com/zeta-chain/zetacore/x/observer/types"
 )
 
-// Updates the block height of the keygen and sets the status to "pending
-// keygen".
+// UpdateKeygen updates the block height of the keygen and sets the status to "pending keygen".
 //
 // Only the admin policy account is authorized to broadcast this message.
 func (k msgServer) UpdateKeygen(goCtx context.Context, msg *types.MsgUpdateKeygen) (*types.MsgUpdateKeygenResponse, error) {
 
 	ctx := sdk.UnwrapSDKContext(goCtx)
-	if msg.Creator != k.GetParams(ctx).GetAdminPolicyAccount(types.Policy_Type_update_keygen_block) {
+	if msg.Creator != k.GetParams(ctx).GetAdminPolicyAccount(types.Policy_Type_group1) {
 		return &types.MsgUpdateKeygenResponse{}, types.ErrNotAuthorizedPolicy
 	}
 	keygen, found := k.GetKeygen(ctx)
diff --git a/x/observer/keeper/observer_mapper.go b/x/observer/keeper/observer_mapper.go
index dcf63c11df..35119516c6 100644
--- a/x/observer/keeper/observer_mapper.go
+++ b/x/observer/keeper/observer_mapper.go
@@ -90,7 +90,7 @@ func (k Keeper) GetAllObserverMappersForAddress(ctx sdk.Context, address string)
 // Once added, the function also resets keygen and pauses inbound so that a new TSS can be generated.
 func (k msgServer) AddObserver(goCtx context.Context, msg *types.MsgAddObserver) (*types.MsgAddObserverResponse, error) {
 	ctx := sdk.UnwrapSDKContext(goCtx)
-	if msg.Creator != k.GetParams(ctx).GetAdminPolicyAccount(types.Policy_Type_add_observer) {
+	if msg.Creator != k.GetParams(ctx).GetAdminPolicyAccount(types.Policy_Type_group2) {
 		return &types.MsgAddObserverResponse{}, types.ErrNotAuthorizedPolicy
 	}
 	pubkey, _ := common.NewPubKey(msg.ZetaclientGranteePubkey)
diff --git a/x/observer/migrations/v3/migrate.go b/x/observer/migrations/v3/migrate.go
new file mode 100644
index 0000000000..875ccc80fe
--- /dev/null
+++ b/x/observer/migrations/v3/migrate.go
@@ -0,0 +1,36 @@
+package v3
+
+import (
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	"github.com/zeta-chain/zetacore/x/observer/types"
+)
+
+type ObserverKeeper interface {
+	GetParamsIsExists(ctx sdk.Context) types.Params
+	SetParams(ctx sdk.Context, params types.Params)
+}
+
+// MigrateStore migrates the x/observer module state from the consensus version 2 to 3
+// This migration update the policy group
+func MigrateStore(ctx sdk.Context, k ObserverKeeper) error {
+	// Get first admin policy group
+	p := k.GetParamsIsExists(ctx)
+	if len(p.AdminPolicy) == 0 || p.AdminPolicy[0] == nil {
+		return nil
+	}
+
+	admin := p.AdminPolicy[0].Address
+	p.AdminPolicy = []*types.Admin_Policy{
+		{
+			Address:    admin,
+			PolicyType: types.Policy_Type_group1,
+		},
+		{
+			Address:    admin,
+			PolicyType: types.Policy_Type_group2,
+		},
+	}
+	k.SetParams(ctx, p)
+
+	return nil
+}
diff --git a/x/observer/migrations/v3/migrate_test.go b/x/observer/migrations/v3/migrate_test.go
new file mode 100644
index 0000000000..604fd0a9c7
--- /dev/null
+++ b/x/observer/migrations/v3/migrate_test.go
@@ -0,0 +1,51 @@
+package v3_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	keepertest "github.com/zeta-chain/zetacore/testutil/keeper"
+	"github.com/zeta-chain/zetacore/testutil/sample"
+	v3 "github.com/zeta-chain/zetacore/x/observer/migrations/v3"
+	"github.com/zeta-chain/zetacore/x/observer/types"
+)
+
+func TestMigrateStore(t *testing.T) {
+	k, ctx := keepertest.ObserverKeeper(t)
+
+	// nothing if no admin policy
+	params := types.DefaultParams()
+	params.AdminPolicy = []*types.Admin_Policy{}
+	k.SetParams(ctx, params)
+	err := v3.MigrateStore(ctx, k)
+	require.NoError(t, err)
+	params = k.GetParams(ctx)
+	require.Len(t, params.AdminPolicy, 0)
+
+	// update admin policy
+	admin := sample.AccAddress()
+	params = types.DefaultParams()
+	params.AdminPolicy = []*types.Admin_Policy{
+		{
+			Address:    admin,
+			PolicyType: 0,
+		},
+		{
+			Address:    sample.AccAddress(),
+			PolicyType: 5,
+		},
+		{
+			Address:    admin,
+			PolicyType: 10,
+		},
+	}
+	k.SetParams(ctx, params)
+	err = v3.MigrateStore(ctx, k)
+	require.NoError(t, err)
+	params = k.GetParams(ctx)
+	require.Len(t, params.AdminPolicy, 2)
+	require.Equal(t, params.AdminPolicy[0].PolicyType, types.Policy_Type_group1)
+	require.Equal(t, params.AdminPolicy[1].PolicyType, types.Policy_Type_group2)
+	require.Equal(t, params.AdminPolicy[0].Address, admin)
+	require.Equal(t, params.AdminPolicy[1].Address, admin)
+}
diff --git a/x/observer/module.go b/x/observer/module.go
index 785196d0cc..1f991b978c 100644
--- a/x/observer/module.go
+++ b/x/observer/module.go
@@ -147,6 +147,9 @@ func (am AppModule) RegisterServices(cfg module.Configurator) {
 	if err := cfg.RegisterMigration(types.ModuleName, 1, m.Migrate1to2); err != nil {
 		panic(err)
 	}
+	if err := cfg.RegisterMigration(types.ModuleName, 2, m.Migrate2to3); err != nil {
+		panic(err)
+	}
 }
 
 // RegisterInvariants registers the observer module's invariants.
@@ -171,7 +174,7 @@ func (am AppModule) ExportGenesis(ctx sdk.Context, cdc codec.JSONCodec) json.Raw
 }
 
 // ConsensusVersion implements ConsensusVersion.
-func (AppModule) ConsensusVersion() uint64 { return 2 }
+func (AppModule) ConsensusVersion() uint64 { return 3 }
 
 // BeginBlock executes all ABCI BeginBlock logic respective to the observer module.
 func (am AppModule) BeginBlock(ctx sdk.Context, _ abci.RequestBeginBlock) {
diff --git a/x/observer/types/params.go b/x/observer/types/params.go
index 660a4e12f9..765846a32a 100644
--- a/x/observer/types/params.go
+++ b/x/observer/types/params.go
@@ -37,29 +37,11 @@ func DefaultParams() Params {
 func DefaultAdminPolicy() []*Admin_Policy {
 	return []*Admin_Policy{
 		{
-			PolicyType: Policy_Type_out_tx_tracker,
+			PolicyType: Policy_Type_group1,
 			Address:    GroupID1Address,
 		},
 		{
-			PolicyType: Policy_Type_stop_inbound_cctx,
-			Address:    GroupID1Address,
-		},
-		// NOTE: smoke test setting depends on this type being at position 2
-		// contrib/localnet/scripts/genesis.sh:93
-		{
-			PolicyType: Policy_Type_deploy_fungible_coin,
-			Address:    GroupID1Address,
-		},
-		{
-			PolicyType: Policy_Type_update_client_params,
-			Address:    GroupID1Address,
-		},
-		{
-			PolicyType: Policy_Type_update_keygen_block,
-			Address:    GroupID1Address,
-		},
-		{
-			PolicyType: Policy_Type_add_observer,
+			PolicyType: Policy_Type_group2,
 			Address:    GroupID1Address,
 		},
 	}
diff --git a/x/observer/types/params.pb.go b/x/observer/types/params.pb.go
index cae7a895d9..609e56c5ca 100644
--- a/x/observer/types/params.pb.go
+++ b/x/observer/types/params.pb.go
@@ -29,30 +29,18 @@ const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package
 type Policy_Type int32
 
 const (
-	Policy_Type_stop_inbound_cctx    Policy_Type = 0
-	Policy_Type_deploy_fungible_coin Policy_Type = 1
-	Policy_Type_update_client_params Policy_Type = 2
-	Policy_Type_update_keygen_block  Policy_Type = 3
-	Policy_Type_out_tx_tracker       Policy_Type = 4
-	Policy_Type_add_observer         Policy_Type = 5
+	Policy_Type_group1 Policy_Type = 0
+	Policy_Type_group2 Policy_Type = 1
 )
 
 var Policy_Type_name = map[int32]string{
-	0: "stop_inbound_cctx",
-	1: "deploy_fungible_coin",
-	2: "update_client_params",
-	3: "update_keygen_block",
-	4: "out_tx_tracker",
-	5: "add_observer",
+	0: "group1",
+	1: "group2",
 }
 
 var Policy_Type_value = map[string]int32{
-	"stop_inbound_cctx":    0,
-	"deploy_fungible_coin": 1,
-	"update_client_params": 2,
-	"update_keygen_block":  3,
-	"out_tx_tracker":       4,
-	"add_observer":         5,
+	"group1": 0,
+	"group2": 1,
 }
 
 func (x Policy_Type) String() string {
@@ -327,7 +315,7 @@ func (m *Admin_Policy) GetPolicyType() Policy_Type {
 	if m != nil {
 		return m.PolicyType
 	}
-	return Policy_Type_stop_inbound_cctx
+	return Policy_Type_group1
 }
 
 func (m *Admin_Policy) GetAddress() string {
@@ -409,61 +397,57 @@ func init() {
 func init() { proto.RegisterFile("observer/params.proto", fileDescriptor_4542fa62877488a1) }
 
 var fileDescriptor_4542fa62877488a1 = []byte{
-	// 859 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x55, 0x41, 0x6f, 0x23, 0x35,
-	0x18, 0xcd, 0x24, 0xe9, 0x6e, 0xfb, 0x4d, 0x9a, 0x4e, 0xbd, 0x2d, 0x1d, 0x52, 0x91, 0x86, 0x20,
-	0x41, 0x58, 0xd4, 0x04, 0x15, 0x4e, 0x08, 0x0e, 0x6d, 0xf6, 0x40, 0xa5, 0x22, 0xaa, 0xd9, 0x70,
-	0x60, 0x2f, 0x96, 0xe3, 0x71, 0x13, 0x2b, 0x13, 0x7b, 0x64, 0x7b, 0x96, 0x84, 0x5f, 0xc1, 0x11,
-	0x09, 0x21, 0x71, 0xe0, 0xc0, 0x8f, 0xe0, 0x07, 0xec, 0x71, 0x8f, 0x88, 0xc3, 0x0a, 0xb5, 0x17,
-	0x7e, 0x06, 0xb2, 0x67, 0x26, 0x9b, 0x6e, 0x51, 0xa5, 0x3d, 0xe5, 0x1b, 0xbf, 0xf7, 0x3d, 0x7f,
-	0xf3, 0xfc, 0xe2, 0x81, 0x7d, 0x39, 0xd6, 0x4c, 0x3d, 0x67, 0x6a, 0x90, 0x12, 0x45, 0xe6, 0xba,
-	0x9f, 0x2a, 0x69, 0x24, 0x3a, 0xfc, 0x91, 0x19, 0x42, 0xa7, 0x84, 0x8b, 0xbe, 0xab, 0xa4, 0x62,
-	0xfd, 0x92, 0xd9, 0x7a, 0x44, 0xe5, 0x7c, 0x2e, 0xc5, 0x20, 0xff, 0xc9, 0x3b, 0x5a, 0x7b, 0x13,
-	0x39, 0x91, 0xae, 0x1c, 0xd8, 0xaa, 0x58, 0x3d, 0x58, 0xc9, 0x97, 0x45, 0x0e, 0x74, 0x9f, 0x41,
-	0x73, 0x28, 0x15, 0xbb, 0x74, 0x9b, 0x5e, 0x70, 0x6d, 0xd0, 0xd7, 0xe0, 0xdb, 0x6d, 0x70, 0x3e,
-	0x47, 0xe8, 0x75, 0x6a, 0x3d, 0xff, 0xe4, 0xa3, 0xfe, 0x3d, 0x83, 0xf4, 0x5f, 0x2b, 0x44, 0x40,
-	0x57, 0x75, 0xf7, 0xcf, 0x3a, 0xc0, 0x6b, 0x08, 0x1d, 0x03, 0xa2, 0x52, 0x5c, 0x71, 0x35, 0x27,
-	0x86, 0x4b, 0x81, 0xa9, 0xcc, 0x84, 0x09, 0xbd, 0x8e, 0xd7, 0xab, 0x47, 0xbb, 0xeb, 0xc8, 0xd0,
-	0x02, 0xa8, 0x07, 0xc1, 0x84, 0x68, 0x9c, 0x2a, 0x4e, 0x19, 0x36, 0x9c, 0xce, 0x98, 0x0a, 0xab,
-	0x8e, 0xdc, 0x9c, 0x10, 0x7d, 0x69, 0x97, 0x47, 0x6e, 0x15, 0x75, 0xa0, 0xc1, 0x05, 0x36, 0x8b,
-	0x92, 0x55, 0x73, 0x2c, 0xe0, 0x62, 0xb4, 0x28, 0x18, 0x5d, 0xd8, 0x96, 0x99, 0x59, 0xa3, 0xd4,
-	0x1d, 0xc5, 0x97, 0x99, 0x59, 0x71, 0x1e, 0xc3, 0xee, 0x0f, 0xc4, 0xd0, 0x29, 0xce, 0xcc, 0x42,
-	0x96, 0xbc, 0x0d, 0xc7, 0xdb, 0x71, 0xc0, 0x77, 0x66, 0x21, 0x0b, 0xee, 0x57, 0xe0, 0x0e, 0x06,
-	0x1b, 0x39, 0x63, 0xf6, 0x45, 0x84, 0x51, 0x84, 0x1a, 0x4c, 0xe2, 0x58, 0x31, 0xad, 0xc3, 0xcd,
-	0x8e, 0xd7, 0xdb, 0x8a, 0x42, 0x4b, 0x19, 0x59, 0xc6, 0xb0, 0x20, 0x9c, 0xe6, 0x38, 0xfa, 0x12,
-	0x5a, 0x54, 0x0a, 0xc1, 0xa8, 0x91, 0xea, 0x6e, 0xf7, 0x56, 0xde, 0xbd, 0x62, 0xbc, 0xd9, 0x3d,
-	0x84, 0x36, 0x53, 0xf4, 0xe4, 0x53, 0x4c, 0x33, 0x6d, 0x64, 0xbc, 0xbc, 0xab, 0x00, 0x4e, 0xe1,
-	0xd0, 0xb1, 0x86, 0x39, 0xe9, 0x4d, 0x91, 0x77, 0x61, 0xd3, 0x9d, 0x26, 0xe6, 0x71, 0xe8, 0x77,
-	0xbc, 0x5e, 0x2d, 0x7a, 0xe8, 0x9e, 0xcf, 0x63, 0x74, 0x0a, 0xef, 0xc9, 0xcc, 0x8c, 0x65, 0x26,
-	0x62, 0xeb, 0x98, 0xa6, 0x53, 0x16, 0x67, 0x09, 0xc3, 0x5c, 0x18, 0xa6, 0x9e, 0x93, 0x24, 0x6c,
-	0x38, 0x7e, 0xab, 0x24, 0x8d, 0x16, 0x4f, 0x0b, 0xca, 0x79, 0xc1, 0xb0, 0x23, 0xfe, 0xaf, 0x44,
-	0x22, 0xe5, 0x8c, 0x4c, 0x19, 0x89, 0xc3, 0x6d, 0xa7, 0x71, 0x78, 0x57, 0xe3, 0xa2, 0xa4, 0x74,
-	0x7f, 0xa9, 0x42, 0xf3, 0xdb, 0x22, 0x62, 0x45, 0x84, 0x3e, 0x80, 0x0d, 0x37, 0xa5, 0x4b, 0x8d,
-	0x7f, 0xb2, 0xdd, 0x2f, 0xa2, 0x3f, 0xb4, 0x8b, 0x51, 0x8e, 0xa1, 0xef, 0x21, 0x18, 0x93, 0x24,
-	0x91, 0x06, 0x9b, 0xa9, 0x62, 0x7a, 0x2a, 0x93, 0xd8, 0x45, 0x62, 0xeb, 0xac, 0xff, 0xe2, 0xd5,
-	0x51, 0xe5, 0xef, 0x57, 0x47, 0x1f, 0x4e, 0xb8, 0x99, 0x66, 0x63, 0xdb, 0x3d, 0xa0, 0x52, 0xcf,
-	0xa5, 0x2e, 0x7e, 0x8e, 0x75, 0x3c, 0x1b, 0x98, 0x65, 0xca, 0x74, 0xff, 0x09, 0xa3, 0xd1, 0x4e,
-	0xae, 0x33, 0x2a, 0x65, 0xd0, 0x15, 0x1c, 0xcc, 0xb9, 0xc0, 0x65, 0xf0, 0x71, 0xcc, 0x12, 0x36,
-	0x71, 0x99, 0x75, 0x89, 0x7a, 0xfb, 0x1d, 0xf6, 0xe7, 0x5c, 0x94, 0xef, 0xf8, 0x64, 0x25, 0x86,
-	0xde, 0x87, 0x06, 0xd7, 0x58, 0x67, 0x69, 0x2a, 0x95, 0x61, 0xb1, 0x8b, 0xe1, 0x66, 0xe4, 0x73,
-	0xfd, 0xb4, 0x5c, 0xea, 0x6a, 0x68, 0x9c, 0xc6, 0x76, 0x98, 0x4b, 0x99, 0x70, 0xba, 0x44, 0xe7,
-	0xe0, 0xa7, 0xae, 0xc2, 0x56, 0xdd, 0x19, 0xd4, 0x3c, 0xe9, 0xdd, 0xfb, 0xb7, 0xcd, 0x3b, 0xf1,
-	0x68, 0x99, 0xb2, 0x08, 0xf2, 0x66, 0x5b, 0xa3, 0x10, 0x1e, 0x96, 0x49, 0xaa, 0xba, 0x24, 0x95,
-	0x8f, 0xdd, 0x7f, 0x3d, 0x78, 0x50, 0x1c, 0xc5, 0x08, 0x76, 0x56, 0x36, 0xdc, 0xba, 0x2a, 0x3e,
-	0xb9, 0x77, 0xcf, 0xdb, 0x07, 0x1a, 0x35, 0xe5, 0xed, 0x03, 0xbe, 0x80, 0x06, 0x71, 0x6f, 0x95,
-	0x8f, 0x13, 0x56, 0x9d, 0xe4, 0xc7, 0xf7, 0x4a, 0xae, 0xdb, 0x10, 0xf9, 0xae, 0xbd, 0xf0, 0xe4,
-	0x73, 0x78, 0xa7, 0x48, 0xc2, 0x9c, 0x98, 0x4c, 0x71, 0xb3, 0xc4, 0xe3, 0x44, 0xd2, 0x99, 0x76,
-	0x79, 0xa8, 0x45, 0x7b, 0x39, 0xfa, 0x4d, 0x01, 0x9e, 0x39, 0xec, 0x8b, 0xfa, 0xcf, 0xbf, 0x1d,
-	0x55, 0x1e, 0xff, 0xea, 0x81, 0xbf, 0x66, 0x10, 0xda, 0x87, 0x5d, 0x6d, 0x64, 0x8a, 0xb9, 0xc8,
-	0x63, 0x4d, 0xa9, 0x59, 0x04, 0x15, 0x14, 0xc2, 0x5e, 0xcc, 0xd2, 0x44, 0x2e, 0xf1, 0x55, 0x26,
-	0x26, 0x7c, 0x9c, 0x30, 0x4c, 0x25, 0x17, 0x81, 0x67, 0x91, 0x2c, 0x8d, 0x89, 0x61, 0x98, 0x26,
-	0x9c, 0x09, 0x53, 0xb8, 0x14, 0x54, 0xd1, 0x01, 0x3c, 0x2a, 0x90, 0x19, 0x5b, 0x4e, 0x98, 0xc8,
-	0x87, 0x0a, 0x6a, 0x08, 0x41, 0xb3, 0xbc, 0xa6, 0x14, 0xb1, 0x17, 0x4d, 0x50, 0x47, 0x81, 0x75,
-	0x24, 0x5e, 0x45, 0x2e, 0xd8, 0x68, 0xd5, 0xff, 0xf8, 0xbd, 0xed, 0x9d, 0x9d, 0xbf, 0xb8, 0x6e,
-	0x7b, 0x2f, 0xaf, 0xdb, 0xde, 0x3f, 0xd7, 0x6d, 0xef, 0xa7, 0x9b, 0x76, 0xe5, 0xe5, 0x4d, 0xbb,
-	0xf2, 0xd7, 0x4d, 0xbb, 0xf2, 0x6c, 0xb0, 0x96, 0x3d, 0xeb, 0xd6, 0xb1, 0x33, 0x6e, 0x50, 0x1a,
-	0x37, 0x58, 0xac, 0xbe, 0x01, 0x79, 0x10, 0xc7, 0x0f, 0xdc, 0xa7, 0xe0, 0xb3, 0xff, 0x02, 0x00,
-	0x00, 0xff, 0xff, 0x13, 0xbd, 0x55, 0x51, 0x84, 0x06, 0x00, 0x00,
+	// 792 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x94, 0xcf, 0x6f, 0x1b, 0x45,
+	0x14, 0xc7, 0xbd, 0x89, 0x9b, 0x26, 0x6f, 0x1d, 0x27, 0x5d, 0x5a, 0xba, 0x38, 0xc2, 0x31, 0x46,
+	0x02, 0xd3, 0x2a, 0x36, 0x18, 0x4e, 0x08, 0x0e, 0x89, 0x7b, 0x20, 0x52, 0x10, 0xd1, 0xd6, 0x1c,
+	0xe8, 0x65, 0x34, 0x9e, 0x9d, 0xda, 0x23, 0xaf, 0xf7, 0xad, 0x66, 0x66, 0x8b, 0xcd, 0x5f, 0xc1,
+	0x11, 0x89, 0x0b, 0x07, 0x0e, 0xfc, 0x11, 0xfc, 0x01, 0x3d, 0xf6, 0x88, 0x38, 0x54, 0x28, 0xb9,
+	0xf0, 0x67, 0xa0, 0x7d, 0xfb, 0xa3, 0x4e, 0x82, 0x22, 0xf5, 0xe4, 0xb7, 0xf3, 0x3e, 0xef, 0x3b,
+	0x6f, 0xde, 0x7c, 0x3d, 0xf0, 0x00, 0x27, 0x46, 0xea, 0x17, 0x52, 0x0f, 0x12, 0xae, 0xf9, 0xc2,
+	0xf4, 0x13, 0x8d, 0x16, 0xbd, 0x83, 0x9f, 0xa4, 0xe5, 0x62, 0xc6, 0x55, 0xdc, 0xa7, 0x08, 0xb5,
+	0xec, 0x97, 0x64, 0xeb, 0x1d, 0x81, 0x8b, 0x05, 0xc6, 0x83, 0xfc, 0x27, 0xaf, 0x68, 0xdd, 0x9f,
+	0xe2, 0x14, 0x29, 0x1c, 0x64, 0x51, 0xb1, 0xfa, 0xb0, 0x92, 0x2f, 0x83, 0x3c, 0xd1, 0x7d, 0x06,
+	0xcd, 0x11, 0x6a, 0x79, 0x4e, 0x9b, 0x9e, 0x29, 0x63, 0xbd, 0x6f, 0xc0, 0xcd, 0xb6, 0x61, 0x79,
+	0x1f, 0xbe, 0xd3, 0xd9, 0xec, 0xb9, 0xc3, 0x8f, 0xfb, 0xb7, 0x34, 0xd2, 0x7f, 0xa3, 0x10, 0x80,
+	0xa8, 0xe2, 0xee, 0x9f, 0x75, 0x80, 0x37, 0x29, 0xef, 0x08, 0x3c, 0x81, 0xf1, 0x73, 0xa5, 0x17,
+	0xdc, 0x2a, 0x8c, 0x99, 0xc0, 0x34, 0xb6, 0xbe, 0xd3, 0x71, 0x7a, 0xf5, 0xe0, 0xde, 0x7a, 0x66,
+	0x94, 0x25, 0xbc, 0x1e, 0xec, 0x4f, 0xb9, 0x61, 0x89, 0x56, 0x42, 0x32, 0xab, 0xc4, 0x5c, 0x6a,
+	0x7f, 0x83, 0xe0, 0xe6, 0x94, 0x9b, 0xf3, 0x6c, 0x79, 0x4c, 0xab, 0x5e, 0x07, 0x1a, 0x2a, 0x66,
+	0x76, 0x59, 0x52, 0x9b, 0x44, 0x81, 0x8a, 0xc7, 0xcb, 0x82, 0xe8, 0xc2, 0x2e, 0xa6, 0x76, 0x0d,
+	0xa9, 0x13, 0xe2, 0x62, 0x6a, 0x2b, 0xe6, 0x11, 0xdc, 0xfb, 0x91, 0x5b, 0x31, 0x63, 0xa9, 0x5d,
+	0x62, 0xc9, 0xdd, 0x21, 0x6e, 0x8f, 0x12, 0xdf, 0xdb, 0x25, 0x16, 0xec, 0xd7, 0x40, 0x17, 0xc3,
+	0x2c, 0xce, 0x65, 0x76, 0x90, 0xd8, 0x6a, 0x2e, 0x2c, 0xe3, 0x61, 0xa8, 0xa5, 0x31, 0xfe, 0x76,
+	0xc7, 0xe9, 0xed, 0x04, 0x7e, 0x86, 0x8c, 0x33, 0x62, 0x54, 0x00, 0xc7, 0x79, 0xde, 0xfb, 0x0a,
+	0x5a, 0x02, 0xe3, 0x58, 0x0a, 0x8b, 0xfa, 0x66, 0xf5, 0x4e, 0x5e, 0x5d, 0x11, 0xd7, 0xab, 0x47,
+	0xd0, 0x96, 0x5a, 0x0c, 0x3f, 0x65, 0x22, 0x35, 0x16, 0xc3, 0xd5, 0x4d, 0x05, 0x20, 0x85, 0x03,
+	0xa2, 0x46, 0x39, 0x74, 0x5d, 0xe4, 0x3d, 0xd8, 0xa6, 0xdb, 0x64, 0x2a, 0xf4, 0xdd, 0x8e, 0xd3,
+	0xdb, 0x0c, 0xee, 0xd2, 0xf7, 0x69, 0xe8, 0x1d, 0xc3, 0xfb, 0x98, 0xda, 0x09, 0xa6, 0x71, 0x98,
+	0x4d, 0xcc, 0x88, 0x99, 0x0c, 0xd3, 0x48, 0x32, 0x15, 0x5b, 0xa9, 0x5f, 0xf0, 0xc8, 0x6f, 0x10,
+	0xdf, 0x2a, 0xa1, 0xf1, 0xf2, 0x69, 0x81, 0x9c, 0x16, 0x44, 0xd6, 0xe2, 0xff, 0x4a, 0x44, 0x88,
+	0x73, 0x3e, 0x93, 0x3c, 0xf4, 0x77, 0x49, 0xe3, 0xe0, 0xa6, 0xc6, 0x59, 0x89, 0x74, 0x7f, 0xdd,
+	0x80, 0xe6, 0x77, 0x85, 0xc5, 0x0a, 0x0b, 0x7d, 0x08, 0x77, 0xa8, 0x4b, 0x72, 0x8d, 0x3b, 0xdc,
+	0xed, 0x17, 0xd6, 0x1f, 0x65, 0x8b, 0x41, 0x9e, 0xf3, 0x7e, 0x80, 0xfd, 0x09, 0x8f, 0x22, 0xb4,
+	0xcc, 0xce, 0xb4, 0x34, 0x33, 0x8c, 0x42, 0xb2, 0xc4, 0xce, 0x49, 0xff, 0xe5, 0xeb, 0xc3, 0xda,
+	0xdf, 0xaf, 0x0f, 0x3f, 0x9a, 0x2a, 0x3b, 0x4b, 0x27, 0x59, 0xf5, 0x40, 0xa0, 0x59, 0xa0, 0x29,
+	0x7e, 0x8e, 0x4c, 0x38, 0x1f, 0xd8, 0x55, 0x22, 0x4d, 0xff, 0x89, 0x14, 0xc1, 0x5e, 0xae, 0x33,
+	0x2e, 0x65, 0xbc, 0xe7, 0xf0, 0x70, 0xa1, 0x62, 0x56, 0x1a, 0x9f, 0x85, 0x32, 0x92, 0x53, 0xf2,
+	0x2c, 0x39, 0xea, 0xed, 0x77, 0x78, 0xb0, 0x50, 0x71, 0x79, 0xc6, 0x27, 0x95, 0x98, 0xf7, 0x01,
+	0x34, 0x94, 0x61, 0x26, 0x4d, 0x12, 0xd4, 0x56, 0x86, 0x64, 0xc3, 0xed, 0xc0, 0x55, 0xe6, 0x69,
+	0xb9, 0xd4, 0x35, 0xd0, 0x38, 0x0e, 0xb3, 0x66, 0xce, 0x31, 0x52, 0x62, 0xe5, 0x9d, 0x82, 0x9b,
+	0x50, 0xc4, 0x32, 0x75, 0x1a, 0x50, 0x73, 0xd8, 0xbb, 0xf5, 0x6f, 0x9b, 0x57, 0xb2, 0xf1, 0x2a,
+	0x91, 0x01, 0xe4, 0xc5, 0x59, 0xec, 0xf9, 0x70, 0xb7, 0x74, 0xd2, 0x06, 0x39, 0xa9, 0xfc, 0xec,
+	0xfe, 0xeb, 0xc0, 0x56, 0x71, 0x15, 0x63, 0xd8, 0xab, 0xc6, 0x70, 0xe5, 0xa9, 0x78, 0x7c, 0xeb,
+	0x9e, 0x57, 0x2f, 0x34, 0x68, 0xe2, 0xd5, 0x0b, 0x3e, 0x83, 0x06, 0xa7, 0x53, 0xe5, 0xed, 0xf8,
+	0x1b, 0x24, 0xf9, 0xc9, 0xad, 0x92, 0xeb, 0x63, 0x08, 0x5c, 0x2a, 0x2f, 0x66, 0xf2, 0x05, 0xbc,
+	0x5b, 0x38, 0x61, 0xc1, 0x6d, 0xaa, 0x95, 0x5d, 0xb1, 0x49, 0x84, 0x62, 0x6e, 0xc8, 0x0f, 0x9b,
+	0xc1, 0xfd, 0x3c, 0xfb, 0x6d, 0x91, 0x3c, 0xa1, 0xdc, 0x97, 0xf5, 0x5f, 0x7e, 0x3b, 0xac, 0x3d,
+	0x7a, 0x0c, 0xee, 0xda, 0x7c, 0x3c, 0x80, 0xad, 0xa9, 0xc6, 0x34, 0xf9, 0x6c, 0xbf, 0x56, 0xc5,
+	0xc3, 0x7d, 0xa7, 0x55, 0xff, 0xe3, 0xf7, 0xb6, 0x73, 0x72, 0xfa, 0xf2, 0xa2, 0xed, 0xbc, 0xba,
+	0x68, 0x3b, 0xff, 0x5c, 0xb4, 0x9d, 0x9f, 0x2f, 0xdb, 0xb5, 0x57, 0x97, 0xed, 0xda, 0x5f, 0x97,
+	0xed, 0xda, 0xb3, 0xc1, 0x9a, 0x11, 0xb2, 0xd6, 0x8f, 0xe8, 0x14, 0x83, 0xf2, 0x14, 0x83, 0x65,
+	0xf5, 0x20, 0xe7, 0xae, 0x98, 0x6c, 0xd1, 0xbb, 0xfc, 0xf9, 0x7f, 0x01, 0x00, 0x00, 0xff, 0xff,
+	0x7f, 0x57, 0xd8, 0xba, 0x11, 0x06, 0x00, 0x00,
 }
 
 func (m *CoreParamsList) Marshal() (dAtA []byte, err error) {

From 706fe2f440bf41708c349d73fa55bef26a1cc158 Mon Sep 17 00:00:00 2001
From: Grant Zukel <80433392+gzukel@users.noreply.github.com>
Date: Tue, 26 Sep 2023 15:15:16 -0600
Subject: [PATCH 4/5] fix: added upgrade name, and allow download. allows to
 test release can. (#1195)

* added upgrade name, and allow download. allows to test release can.
---
 .../scripts/raise_gov_proposal.py             |  6 ++--
 .github/workflows/upgrade_path_testing.yaml   | 34 ++++++++++++++-----
 2 files changed, 29 insertions(+), 11 deletions(-)

diff --git a/.github/actions/upgrade-testing/scripts/raise_gov_proposal.py b/.github/actions/upgrade-testing/scripts/raise_gov_proposal.py
index 4a49c2f6f2..cd33a1a116 100644
--- a/.github/actions/upgrade-testing/scripts/raise_gov_proposal.py
+++ b/.github/actions/upgrade-testing/scripts/raise_gov_proposal.py
@@ -16,7 +16,7 @@
             "@type": "/cosmos.upgrade.v1beta1.MsgSoftwareUpgrade",
             "authority": os.environ["GOV_ADDRESS"],
             "plan": {
-                "name": os.environ['VERSION'],
+                "name": os.environ['UPGRADE_NAME'],
                 "time": "0001-01-01T00:00:00Z",
                 "height": str(UPGRADE_HEIGHT).split('.')[0],
                 "info": os.environ["UPGRADE_INFO"],
@@ -44,13 +44,13 @@
 # -y
 # """
 
-GOV_PROPOSAL = f"""zetacored tx gov submit-legacy-proposal software-upgrade "{os.environ['VERSION']}" \
+GOV_PROPOSAL = f"""zetacored tx gov submit-legacy-proposal software-upgrade "{os.environ['UPGRADE_NAME']}" \
     --from "{os.environ['MONIKER']}" \
     --deposit {os.environ["DEPOSIT"]} \
     --upgrade-height "{str(UPGRADE_HEIGHT).split('.')[0]}" \
     --upgrade-info '{os.environ["UPGRADE_INFO"]}' \
     --title "{os.environ['VERSION']}" \
-    --description "Zeta Release {os.environ['VERSION']}" \
+    --description "Zeta Release {os.environ['UPGRADE_NAME']}" \
     --chain-id "{os.environ['CHAINID']}" \
     --node "{os.environ['NODE']}" \
     --keyring-backend test \
diff --git a/.github/workflows/upgrade_path_testing.yaml b/.github/workflows/upgrade_path_testing.yaml
index 418fe3b84b..fffc7fcbda 100644
--- a/.github/workflows/upgrade_path_testing.yaml
+++ b/.github/workflows/upgrade_path_testing.yaml
@@ -4,11 +4,13 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'The new version to upgrade to from latest state.'
+        description: 'The new version of tag you are going to download the binary from..'
         required: true
-        default: 'v9.0.6'
-
-
+        default: 'v10.0.0-rc2'
+      upgrade_name:
+        description: 'The version that is set in setup_handlers.go'
+        required: true
+        default: 'v10.0.0'
 
 jobs:
   upgrade_path_test_state_export:
@@ -26,9 +28,10 @@ jobs:
       LOG_LEVEL: "INFO"
       CHAINID: "localnet_101-1"
       DAEMON_HOME: "/home/runner/.zetacored"
+      UPGRADE_NAME: "${{ github.event.inputs.upgrade_name }}"
       DAEMON_NAME: "zetacored"
       DENOM: "azeta"
-      DAEMON_ALLOW_DOWNLOAD_BINARIES: "false"
+      DAEMON_ALLOW_DOWNLOAD_BINARIES: "true"
       DAEMON_RESTART_AFTER_UPGRADE: "true"
       MONIKER: "zeta"
       BLOCK_TIME_SECONDS: "6"
@@ -91,6 +94,7 @@ jobs:
           mkdir -p /home/runner/.zetacored/zetavisor
           mkdir -p /home/runner/.zetacored/zetavisor/genesis/bin
           mkdir -p /home/runner/.zetacored/zetavisor/upgrades/${{ github.event.inputs.version }}/bin
+          mkdir -p /home/runner/.zetacored/zetavisor/upgrades/${{ github.event.inputs.upgrade_name }}/bin
 
       - name: "DOWNLOAD_STATE_EXPORT_AND_BINARIES"
         run: |
@@ -100,12 +104,26 @@ jobs:
           echo "*********DOWNLOAD UPGRADE BINARY AND PUT IN ZETAVISOR UPGRADES FOLDER*********"
           wget -q ${github_binary_version_link} -O /home/runner/.zetacored/zetavisor/upgrades/${{ github.event.inputs.version }}/bin/zetacored
           ZETACORED_CHECKSUM=$(shasum -b -a 256 /home/runner/.zetacored/zetavisor/upgrades/${{ github.event.inputs.version }}/bin/zetacored | cut -d ' ' -f 1)
+          sudo chmod a+x /home/runner/.zetacored/zetavisor/upgrades/${{ github.event.inputs.version }}/bin/zetacored
+
+          echo "UPGRADE_INFO=${UPGRADE_INFO}" >> ${GITHUB_ENV}
+          ls -lah /home/runner/.zetacored/zetavisor/upgrades/
+          ls -lah /home/runner/.zetacored/zetavisor/upgrades/${{ github.event.inputs.version }}/bin/zetacored
+
+          wget -q ${github_binary_version_link} -O /home/runner/.zetacored/zetavisor/upgrades/${{ github.event.inputs.upgrade_name }}/bin/zetacored
+          ZETACORED_CHECKSUM=$(shasum -b -a 256 /home/runner/.zetacored/zetavisor/upgrades/${{ github.event.inputs.upgrade_name }}/bin/zetacored | cut -d ' ' -f 1)
+          sudo chmod a+x /home/runner/.zetacored/zetavisor/upgrades/${{ github.event.inputs.upgrade_name }}/bin/zetacored
+
+          echo "UPGRADE_INFO=${UPGRADE_INFO}" >> ${GITHUB_ENV}
+          ls -lah /home/runner/.zetacored/zetavisor/upgrades/
+          ls -lah /home/runner/.zetacored/zetavisor/upgrades/${{ github.event.inputs.upgrade_name }}/bin/zetacored
+
           echo "ZETACORED_CHECKSUM=${ZETACORED_CHECKSUM}" >> ${GITHUB_ENV}
           UPGRADE_INFO='{"binaries": {"zetacored-linux/amd64": "https://github.com/zeta-chain/node/releases/download/${{ github.event.inputs.version }}/zetacored-ubuntu-22-amd64?checksum=sha256:'${ZETACORED_CHECKSUM}'"}}'
           echo ${UPGRADE_INFO}
-          echo "UPGRADE_INFO=${UPGRADE_INFO}" >> ${GITHUB_ENV}
-          sudo chmod a+x /home/runner/.zetacored/zetavisor/upgrades/${{ github.event.inputs.version }}/bin/zetacored
-                    
+
+          
+          
           echo "*********DOWNLOAD CURRENT BINARY AND PUT IN ZETAVISOR GENESIS & CURRENT FOLDER*********"
           current_version=$(curl https://rpc-archive.athens.zetachain.com:26657/abci_info -s | jq .result.response.version -r | tr -d '\n')
           echo "STARTING_VERSION=${current_version}" >> ${GITHUB_ENV}

From 007ff12dacf5142933bdce06ad2da724a992bd6e Mon Sep 17 00:00:00 2001
From: Lucas Bertrand <lucas.bertrand.22@gmail.com>
Date: Wed, 27 Sep 2023 22:40:47 +0200
Subject: [PATCH 5/5] chore: switch back to `cosmos/cosmos-sdk` (#1193)

* remove replace

* go mod tidy
---
 go.mod | 3 +--
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/go.mod b/go.mod
index 2ac6cf2de1..037cb886c0 100644
--- a/go.mod
+++ b/go.mod
@@ -303,7 +303,7 @@ require (
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/api v0.114.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.30.0 // indirect
+	google.golang.org/protobuf v1.30.0
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
@@ -317,7 +317,6 @@ replace (
 	github.com/btcsuite/btcd => github.com/btcsuite/btcd v0.22.3
 	github.com/confio/ics23/go => github.com/cosmos/cosmos-sdk/ics23/go v0.8.0
 
-	github.com/cosmos/cosmos-sdk => github.com/brewmaster012/cosmos-sdk v0.46.14-0.20230818184835-7b40e2ee9f2f
 	github.com/gogo/protobuf => github.com/regen-network/protobuf v1.3.3-alpha.regen.1
 	// replace broken goleveldb
 	github.com/syndtr/goleveldb => github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7
diff --git a/go.sum b/go.sum
index 741d11222e..3ccf99bb4d 100644
--- a/go.sum
+++ b/go.sum
@@ -725,8 +725,6 @@ github.com/bombsimon/wsl/v3 v3.3.0/go.mod h1:st10JtZYLE4D5sC7b8xV4zTKZwAQjCH/Hy2
 github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
 github.com/breml/bidichk v0.2.3/go.mod h1:8u2C6DnAy0g2cEq+k/A2+tr9O1s+vHGxWn0LTc70T2A=
 github.com/breml/errchkjson v0.3.0/go.mod h1:9Cogkyv9gcT8HREpzi3TiqBxCqDzo8awa92zSDFcofU=
-github.com/brewmaster012/cosmos-sdk v0.46.14-0.20230818184835-7b40e2ee9f2f h1:iFcUpBqZvMf/7VMi1yOsFV1UdAn8aOhLZvLkfRlJWQk=
-github.com/brewmaster012/cosmos-sdk v0.46.14-0.20230818184835-7b40e2ee9f2f/go.mod h1:EfY521ATNEla8eJ6oJuZBdgP5+p360s7InnRqX+TWdM=
 github.com/brewmaster012/go-tss v0.0.0-20230724230849-ce080275bbad h1:/Jqi03d/vQ9SXDjubEKYGpv2usH5Ejjrmrdv405UFNo=
 github.com/brewmaster012/go-tss v0.0.0-20230724230849-ce080275bbad/go.mod h1:RYOe4ihG8KkoQQhW6ljiyxyW6F3CoZA3ozyyEb5HVmI=
 github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
@@ -1018,6 +1016,8 @@ github.com/cosmos/btcutil v1.0.5 h1:t+ZFcX77LpKtDBhjucvnOH8C2l2ioGsBNEQ3jef8xFk=
 github.com/cosmos/btcutil v1.0.5/go.mod h1:IyB7iuqZMJlthe2tkIFL33xPyzbFYP0XVdS8P5lUPis=
 github.com/cosmos/cosmos-proto v1.0.0-beta.3 h1:VitvZ1lPORTVxkmF2fAp3IiA61xVwArQYKXTdEcpW6o=
 github.com/cosmos/cosmos-proto v1.0.0-beta.3/go.mod h1:t8IASdLaAq+bbHbjq4p960BvcTqtwuAxid3b/2rOD6I=
+github.com/cosmos/cosmos-sdk v0.46.13 h1:LhL6WDBadczqBuCW0t5BHUzGQR3vbujdOYOfU0ORt+o=
+github.com/cosmos/cosmos-sdk v0.46.13/go.mod h1:EfY521ATNEla8eJ6oJuZBdgP5+p360s7InnRqX+TWdM=
 github.com/cosmos/cosmos-sdk/ics23/go v0.8.0 h1:iKclrn3YEOwk4jQHT2ulgzuXyxmzmPczUalMwW4XH9k=
 github.com/cosmos/cosmos-sdk/ics23/go v0.8.0/go.mod h1:2a4dBq88TUoqoWAU5eu0lGvpFP3wWDPgdHPargtyw30=
 github.com/cosmos/go-bip39 v0.0.0-20180819234021-555e2067c45d/go.mod h1:tSxLoYXyBmiFeKpvmq4dzayMdCjCnu8uqmCysIGBT2Y=