diff --git a/Source/AbstractInterpretation/NativeLattice.cs b/Source/AbstractInterpretation/NativeLattice.cs
index 8b63e17f7..2881152ce 100644
--- a/Source/AbstractInterpretation/NativeLattice.cs
+++ b/Source/AbstractInterpretation/NativeLattice.cs
@@ -185,8 +185,7 @@ public void Analyze(Implementation impl, NativeLattice lattice, NativeLattice.El
       // We need to keep track of some information for each(some) block(s).  To do that efficiently,
       // we number the implementation's blocks sequentially, and then we can use arrays to store
       // the additional information.
-      var pre = new NativeLattice.Element[impl.Blocks
-        .Count]; // set to null if we never compute a join/widen at this block
+      var pre = new NativeLattice.Element[impl.Blocks.Count]; // set to null if we never compute a join/widen at this block
       var post = options.InstrumentInfer == CoreOptions.InstrumentationPlaces.Everywhere
         ? new NativeLattice.Element[impl.Blocks.Count]
         : null;
diff --git a/Source/Concurrency/YieldingProcInstrumentation.cs b/Source/Concurrency/YieldingProcInstrumentation.cs
index 2029b2025..d6ae3313a 100644
--- a/Source/Concurrency/YieldingProcInstrumentation.cs
+++ b/Source/Concurrency/YieldingProcInstrumentation.cs
@@ -551,7 +551,9 @@ private void DesugarConcurrency(Implementation impl, List<Cmd> preconditions)
       impl.Blocks.Add(unchangedCheckerBlock);
       impl.Blocks.Add(returnCheckerBlock);
       impl.Blocks.Add(returnBlock);
-      impl.Blocks.AddRange(implRefinementCheckingBlocks);
+      foreach (var block in implRefinementCheckingBlocks) {
+        impl.Blocks.Add(block);
+      }
       impl.Blocks.Insert(0, CreateInitialBlock(impl, preconditions));
     }
 
@@ -608,7 +610,9 @@ private void SplitBlocks(Implementation impl)
         b.TransferCmd = currTransferCmd;
       }
 
-      impl.Blocks.AddRange(newBlocks);
+      foreach (var newBlock in newBlocks) {
+        impl.Blocks.Add(newBlock);
+      }
     }
 
     private Block CreateNoninterferenceCheckerBlock()
diff --git a/Source/Core/AST/Expression/AbsyExpr.cs b/Source/Core/AST/Expression/AbsyExpr.cs
index 06305894f..d433e0739 100644
--- a/Source/Core/AST/Expression/AbsyExpr.cs
+++ b/Source/Core/AST/Expression/AbsyExpr.cs
@@ -3890,7 +3890,7 @@ public class CodeExpr : Expr
     public List<Variable> /*!*/
       LocVars;
 
-    [Rep] public List<Block /*!*/> /*!*/ Blocks;
+    [Rep] public IList<Block /*!*/> /*!*/ Blocks;
 
     [ContractInvariantMethod]
     void ObjectInvariant()
diff --git a/Source/Core/AST/Implementation.cs b/Source/Core/AST/Implementation.cs
index d1b497dfb..62d5438dd 100644
--- a/Source/Core/AST/Implementation.cs
+++ b/Source/Core/AST/Implementation.cs
@@ -10,10 +10,11 @@ namespace Microsoft.Boogie;
 public class Implementation : DeclWithFormals {
   public List<Variable> LocVars;
 
-  [Rep] public StmtList StructuredStmts;
+  [Rep] 
+  public StmtList StructuredStmts { get; set; }
 
-  [field: Rep]
-  public List<Block> Blocks {
+  [Rep]
+  public IList<Block> Blocks {
     get; 
     set;
   }
@@ -21,7 +22,7 @@ public List<Block> Blocks {
 
   // Blocks before applying passification etc.
   // Both are used only when /inline is set.
-  public List<Block> OriginalBlocks;
+  public IList<Block> OriginalBlocks;
   public List<Variable> OriginalLocVars;
     
   // Map filled in during passification to allow augmented error trace reporting
@@ -965,7 +966,7 @@ public void ComputePredecessorsForBlocks()
     this.BlockPredecessorsComputed = true;
   }
 
-  public static void ComputePredecessorsForBlocks(List<Block> blocks)
+  public static void ComputePredecessorsForBlocks(IList<Block> blocks)
   {
     foreach (var block in blocks) {
       if (block.TransferCmd is not GotoCmd gtc) {
diff --git a/Source/Core/AST/Program.cs b/Source/Core/AST/Program.cs
index 810b73232..fe1b21359 100644
--- a/Source/Core/AST/Program.cs
+++ b/Source/Core/AST/Program.cs
@@ -498,7 +498,7 @@ public static Graph<Implementation> BuildCallGraph(CoreOptions options, Program
     return callGraph;
   }
 
-  public static Graph<Block> GraphFromBlocksSubset(IReadOnlyList<Block> blocks, IReadOnlySet<Block> subset = null, bool forward = true)
+  public static Graph<Block> GraphFromBlocksSubset(IList<Block> blocks, IReadOnlySet<Block> subset = null, bool forward = true)
   {
     var result = new Graph<Block>();
     if (!blocks.Any())
@@ -529,7 +529,7 @@ void AddEdge(Block a, Block b) {
     return result;
   }
   
-  public static Graph<Block> GraphFromBlocks(IReadOnlyList<Block> blocks, bool forward = true) {
+  public static Graph<Block> GraphFromBlocks(IList<Block> blocks, bool forward = true) {
     return GraphFromBlocksSubset(blocks, null, forward);
   }
 
diff --git a/Source/Core/Analysis/BlockCoalescer.cs b/Source/Core/Analysis/BlockCoalescer.cs
index 12219f7c7..c149d3bae 100644
--- a/Source/Core/Analysis/BlockCoalescer.cs
+++ b/Source/Core/Analysis/BlockCoalescer.cs
@@ -85,7 +85,7 @@ public static void CoalesceInPlace(List<Block> blocks) {
     blocks.AddRange(coalesced);
   }
   
-  public static List<Block> CoalesceFromRootBlock(List<Block> blocks)
+  public static IList<Block> CoalesceFromRootBlock(IList<Block> blocks)
   {
     if (!blocks.Any())
     {
diff --git a/Source/Core/Duplicator.cs b/Source/Core/Duplicator.cs
index 75ca3f65c..22b9db295 100644
--- a/Source/Core/Duplicator.cs
+++ b/Source/Core/Duplicator.cs
@@ -142,7 +142,7 @@ public override List<Block> VisitBlockSeq(List<Block> blockSeq)
       return base.VisitBlockSeq(new List<Block>(blockSeq));
     }
 
-    public override List<Block /*!*/> /*!*/ VisitBlockList(List<Block /*!*/> /*!*/ blocks)
+    public override IList<Block> /*!*/ VisitBlockList(IList<Block> blocks /*!*/ /*!*/)
     {
       //Contract.Requires(cce.NonNullElements(blocks));
       Contract.Ensures(cce.NonNullElements(Contract.Result<List<Block>>()));
diff --git a/Source/Core/Inline.cs b/Source/Core/Inline.cs
index d67732fa2..60e2c7a33 100644
--- a/Source/Core/Inline.cs
+++ b/Source/Core/Inline.cs
@@ -354,7 +354,7 @@ private int InlineCallCmd(Block block, CallCmd callCmd, Implementation impl, Lis
       return nextlblCount;
     }
 
-    public virtual List<Block /*!*/> /*!*/ DoInlineBlocks(List<Block /*!*/> /*!*/ blocks, ref bool inlinedSomething)
+    public virtual List<Block /*!*/> /*!*/ DoInlineBlocks(IList<Block /*!*/> /*!*/ blocks, ref bool inlinedSomething)
     {
       Contract.Requires(cce.NonNullElements(blocks));
       Contract.Ensures(cce.NonNullElements(Contract.Result<List<Block>>()));
@@ -625,8 +625,7 @@ private List<Cmd> RemoveAsserts(List<Cmd> cmds)
       Contract.Requires(codeCopier.oldSubstMap != null);
 
       Contract.Ensures(cce.NonNullElements(Contract.Result<List<Block>>()));
-      List<Block /*!*/> /*!*/
-        implBlocks = cce.NonNull(impl.OriginalBlocks);
+      var /*!*/ implBlocks = cce.NonNull(impl.OriginalBlocks);
       Contract.Assert(implBlocks.Count > 0);
 
       Procedure proc = impl.Proc;
diff --git a/Source/Core/StandardVisitor.cs b/Source/Core/StandardVisitor.cs
index 0c72da8df..e16f7160c 100644
--- a/Source/Core/StandardVisitor.cs
+++ b/Source/Core/StandardVisitor.cs
@@ -219,7 +219,7 @@ public virtual List<Block> VisitBlockSeq(List<Block> blockSeq)
       return blockSeq;
     }
 
-    public virtual List<Block /*!*/> /*!*/ VisitBlockList(List<Block /*!*/> /*!*/ blocks)
+    public virtual IList<Block> /*!*/ VisitBlockList(IList<Block> blocks /*!*/ /*!*/)
     {
       Contract.Requires(blocks != null);
       Contract.Ensures(Contract.Result<List<Block>>() != null);
@@ -1150,14 +1150,12 @@ public override List<Block> VisitBlockSeq(List<Block> blockSeq)
       return blockSeq;
     }
 
-    public override List<Block /*!*/> /*!*/ VisitBlockList(List<Block /*!*/> /*!*/ blocks)
+    public override IList<Block> /*!*/ VisitBlockList(IList<Block> blocks /*!*/ /*!*/)
     {
       Contract.Ensures(Contract.Result<List<Block>>() == blocks);
-      for (int i = 0, n = blocks.Count; i < n; i++)
-      {
-        this.VisitBlock(blocks[i]);
+      foreach (var block in blocks) {
+        this.VisitBlock(block);
       }
-
       return blocks;
     }
 
diff --git a/Source/Provers/LeanAuto/LeanAutoGenerator.cs b/Source/Provers/LeanAuto/LeanAutoGenerator.cs
index dde6fa6d1..82684398f 100644
--- a/Source/Provers/LeanAuto/LeanAutoGenerator.cs
+++ b/Source/Provers/LeanAuto/LeanAutoGenerator.cs
@@ -879,7 +879,7 @@ public override List<Block> VisitBlockSeq(List<Block> blockSeq)
     throw new LeanConversionException(Token.NoToken, $"Internal: List<Block> should never be directly visited ({blockSeq}).");
   }
 
-  public override List<Block> VisitBlockList(List<Block> blocks)
+  public override IList<Block> VisitBlockList(IList<Block> blocks)
   {
     throw new LeanConversionException(Token.NoToken, $"Internal: List<Block> should never be directly visited ({blocks}).");
   }
diff --git a/Source/Provers/SMTLib/SMTLibProcess.cs b/Source/Provers/SMTLib/SMTLibProcess.cs
index ac0627019..65fc55e62 100644
--- a/Source/Provers/SMTLib/SMTLibProcess.cs
+++ b/Source/Provers/SMTLib/SMTLibProcess.cs
@@ -69,7 +69,7 @@ public SMTLibProcess(SMTLibOptions libOptions, SMTLibSolverOptions options)
       }
       catch (System.ComponentModel.Win32Exception e)
       {
-        throw new ProverException(string.Format("Unable to start the process {0}: {1}", psi.FileName, e.Message));
+        throw new ProverException($"Unable to start the process {psi.FileName}: {e.Message}");
       }
     }
 
diff --git a/Source/VCExpr/Boogie2VCExpr.cs b/Source/VCExpr/Boogie2VCExpr.cs
index a4596afe0..8b4682f17 100644
--- a/Source/VCExpr/Boogie2VCExpr.cs
+++ b/Source/VCExpr/Boogie2VCExpr.cs
@@ -889,7 +889,7 @@ public override List<Block> VisitBlockSeq(List<Block> blockSeq)
       throw new cce.UnreachableException();
     }
 
-    public override List<Block /*!*/> /*!*/ VisitBlockList(List<Block /*!*/> /*!*/ blocks)
+    public override IList<Block> /*!*/ VisitBlockList(IList<Block> blocks /*!*/ /*!*/)
     {
       //Contract.Requires(cce.NonNullElements(blocks));
       Contract.Ensures(cce.NonNullElements(Contract.Result<List<Block>>()));
diff --git a/Source/VCGeneration/BlockTransformations.cs b/Source/VCGeneration/BlockTransformations.cs
index 250f46f8b..591e87daf 100644
--- a/Source/VCGeneration/BlockTransformations.cs
+++ b/Source/VCGeneration/BlockTransformations.cs
@@ -96,7 +96,7 @@ private static bool ContainsAssert(Block b)
   
   public static bool IsNonTrivialAssert (Cmd c) { return c is AssertCmd { Expr: not LiteralExpr { asBool: true } }; }
 
-  public static void DeleteStraightLineBlocksWithoutCommands(List<Block> blocks) {
+  public static void DeleteStraightLineBlocksWithoutCommands(IList<Block> blocks) {
     var toVisit = new HashSet<Block>(blocks);
     var removed = new HashSet<Block>();
     while(toVisit.Count > 0) {
diff --git a/Source/VCGeneration/ConditionGeneration.cs b/Source/VCGeneration/ConditionGeneration.cs
index 58581fe69..425959f0a 100644
--- a/Source/VCGeneration/ConditionGeneration.cs
+++ b/Source/VCGeneration/ConditionGeneration.cs
@@ -450,7 +450,7 @@ public static void EmitImpl(VCGenOptions options, ImplementationRun run, bool pr
       options.PrintDesugarings = oldPrintDesugaringSetting;
     }
 
-    public static void ResetPredecessors(List<Block> blocks)
+    public static void ResetPredecessors(IList<Block> blocks)
     {
       Contract.Requires(blocks != null);
       foreach (Block b in blocks)
@@ -686,7 +686,7 @@ protected Dictionary<Variable, Expr> Convert2PassiveCmd(ImplementationRun run, M
 
       var start = DateTime.UtcNow;
 
-      Dictionary<Variable, Expr> r = ConvertBlocks2PassiveCmd(run.OutputWriter, implementation.Blocks, implementation.Proc.Modifies, mvInfo, implementation.debugInfos);
+      var r = ConvertBlocks2PassiveCmd(run.OutputWriter, implementation.Blocks, implementation.Proc.Modifies, mvInfo, implementation.debugInfos);
 
       var end = DateTime.UtcNow;
 
@@ -722,7 +722,7 @@ protected Dictionary<Variable, Expr> Convert2PassiveCmd(ImplementationRun run, M
       return r;
     }
 
-    protected Dictionary<Variable, Expr> ConvertBlocks2PassiveCmd(TextWriter traceWriter, List<Block> blocks, List<IdentifierExpr> modifies,
+    protected Dictionary<Variable, Expr> ConvertBlocks2PassiveCmd(TextWriter traceWriter, IList<Block> blocks, List<IdentifierExpr> modifies,
       ModelViewInfo mvInfo, Dictionary<Cmd, List<object>> debugInfos)
     {
       Contract.Requires(blocks != null);
@@ -1427,7 +1427,7 @@ public Block CreateBlockBetween(int predIndex, Block succ)
       return newBlock;
     }
 
-    protected void AddBlocksBetween(List<Block> blocks)
+    protected void AddBlocksBetween(IList<Block> blocks)
     {
       Contract.Requires(blocks != null);
 
@@ -1451,7 +1451,9 @@ protected void AddBlocksBetween(List<Block> blocks)
         }
       }
 
-      blocks.AddRange(tweens); // must wait until iteration is done before changing the list
+      foreach (var tween in tweens) {
+        blocks.Add(tween); // must wait until iteration is done before changing the list
+      }
 
       #endregion
     }
diff --git a/Source/VCGeneration/ManualSplit.cs b/Source/VCGeneration/ManualSplit.cs
index 5b47299b7..e96cc73ea 100644
--- a/Source/VCGeneration/ManualSplit.cs
+++ b/Source/VCGeneration/ManualSplit.cs
@@ -11,7 +11,7 @@ public class ManualSplit : Split
   public IImplementationPartOrigin Token { get; }
   
   public ManualSplit(VCGenOptions options, 
-    Func<List<Block>> blocks, 
+    Func<IList<Block>> blocks, 
     VerificationConditionGenerator parent, 
     ImplementationRun run, 
     IImplementationPartOrigin origin, int? randomSeed = null) 
diff --git a/Source/VCGeneration/Prune/Pruner.cs b/Source/VCGeneration/Prune/Pruner.cs
index 39d479405..43af44c9d 100644
--- a/Source/VCGeneration/Prune/Pruner.cs
+++ b/Source/VCGeneration/Prune/Pruner.cs
@@ -57,7 +57,7 @@ public class Pruner {
      * See Checker.Setup for more information.
      * Data type constructor declarations are not pruned and they do affect VC generation.
      */
-    public static IEnumerable<Declaration> GetLiveDeclarations(VCGenOptions options, Program program, List<Block>? blocks)
+    public static IEnumerable<Declaration> GetLiveDeclarations(VCGenOptions options, Program program, IList<Block>? blocks)
     {
       if (program.DeclarationDependencies == null || blocks == null || !options.Prune)
       {
@@ -83,7 +83,7 @@ bool TraverseDeclaration(object parent, object child) {
       }
     }
 
-    private static RevealedState GetRevealedState(List<Block> blocks)
+    private static RevealedState GetRevealedState(IList<Block> blocks)
     {
       var controlFlowGraph = GetControlFlowGraph(blocks);
       var starts = controlFlowGraph.Nodes.Where(n => !controlFlowGraph.Predecessors(n).Any()).ToList();
@@ -97,7 +97,7 @@ private static RevealedState GetRevealedState(List<Block> blocks)
         Aggregate(RevealedState.AllHidden, RevealedAnalysis.MergeStates);
     }
 
-    public static Graph<Absy> GetControlFlowGraph(List<Block> blocks)
+    public static Graph<Absy> GetControlFlowGraph(IList<Block> blocks)
     {
       /*
        * Generally the blocks created by splitting have unset block.Predecessors fields
diff --git a/Source/VCGeneration/SmokeTester.cs b/Source/VCGeneration/SmokeTester.cs
index 350567ebb..140ee3319 100644
--- a/Source/VCGeneration/SmokeTester.cs
+++ b/Source/VCGeneration/SmokeTester.cs
@@ -262,7 +262,7 @@ async Task<bool> CheckUnreachable(TextWriter traceWriter, Block cur, List<Cmd> s
     Block copy = CopyBlock(cur);
     Contract.Assert(copy != null);
     copy.Cmds = seq;
-    List<Block> backup = run.Implementation.Blocks;
+    var backup = run.Implementation.Blocks;
     Contract.Assert(backup != null);
     run.Implementation.Blocks = GetCopiedBlocks();
     copy.TransferCmd = new ReturnCmd(Token.NoToken);
diff --git a/Source/VCGeneration/Splits/BlockRewriter.cs b/Source/VCGeneration/Splits/BlockRewriter.cs
index edeec0497..7c8769b71 100644
--- a/Source/VCGeneration/Splits/BlockRewriter.cs
+++ b/Source/VCGeneration/Splits/BlockRewriter.cs
@@ -19,10 +19,10 @@ public class BlockRewriter {
   public List<Block> OrderedBlocks { get; }
   public VCGenOptions Options { get; }
   public Graph<Block> Dag { get; }
-  public Func<IImplementationPartOrigin, List<Block>, ManualSplit> CreateSplit { get; }
+  public Func<IImplementationPartOrigin, IList<Block>, ManualSplit> CreateSplit { get; }
 
-  public BlockRewriter(VCGenOptions options, List<Block> blocks,
-    Func<IImplementationPartOrigin, List<Block>, ManualSplit> createSplit) {
+  public BlockRewriter(VCGenOptions options, IList<Block> blocks,
+    Func<IImplementationPartOrigin, IList<Block>, ManualSplit> createSplit) {
     this.Options = options;
     CreateSplit = createSplit;
     Dag = Program.GraphFromBlocks(blocks);
diff --git a/Source/VCGeneration/Splits/FocusAttributeHandler.cs b/Source/VCGeneration/Splits/FocusAttributeHandler.cs
index dbb4a60d1..ed6c3402b 100644
--- a/Source/VCGeneration/Splits/FocusAttributeHandler.cs
+++ b/Source/VCGeneration/Splits/FocusAttributeHandler.cs
@@ -19,7 +19,7 @@ public class FocusAttributeHandler {
   /// We recurse twice for each focus, leading to potentially 2^N splits
   /// </summary>
   public static List<ManualSplit> GetParts(VCGenOptions options, ImplementationRun run, 
-    Func<IImplementationPartOrigin, List<Block>, ManualSplit> createPart)
+    Func<IImplementationPartOrigin, IList<Block>, ManualSplit> createPart)
   {
     var rewriter = new BlockRewriter(options, run.Implementation.Blocks, createPart);
     
diff --git a/Source/VCGeneration/Splits/IsolateAttributeOnAssertsHandler.cs b/Source/VCGeneration/Splits/IsolateAttributeOnAssertsHandler.cs
index ec865264c..cbe1b7f04 100644
--- a/Source/VCGeneration/Splits/IsolateAttributeOnAssertsHandler.cs
+++ b/Source/VCGeneration/Splits/IsolateAttributeOnAssertsHandler.cs
@@ -11,7 +11,7 @@ namespace VCGeneration;
 class IsolateAttributeOnAssertsHandler {
 
   public static (List<ManualSplit> IsolatedParts, ManualSplit Remainder) GetParts(VCGenOptions options, ManualSplit partToDivide, 
-    Func<IImplementationPartOrigin, List<Block>, ManualSplit> createPart) {
+    Func<IImplementationPartOrigin, IList<Block>, ManualSplit> createPart) {
     var rewriter = new BlockRewriter(options, partToDivide.Blocks, createPart);
       
     var splitOnEveryAssert = partToDivide.Options.VcsSplitOnEveryAssert;
diff --git a/Source/VCGeneration/Splits/IsolateAttributeOnJumpsHandler.cs b/Source/VCGeneration/Splits/IsolateAttributeOnJumpsHandler.cs
index 5b6ab5f49..0dc5e72ad 100644
--- a/Source/VCGeneration/Splits/IsolateAttributeOnJumpsHandler.cs
+++ b/Source/VCGeneration/Splits/IsolateAttributeOnJumpsHandler.cs
@@ -13,7 +13,7 @@ namespace VCGeneration;
 
 class IsolateAttributeOnJumpsHandler {
   public static (List<ManualSplit> Isolated, ManualSplit Remainder) GetParts(VCGenOptions options, ManualSplit partToDivide, 
-    Func<IImplementationPartOrigin, List<Block>, ManualSplit> createPart) {
+    Func<IImplementationPartOrigin, IList<Block>, ManualSplit> createPart) {
 
     var rewriter = new BlockRewriter(options, partToDivide.Blocks, createPart);
     
diff --git a/Source/VCGeneration/Splits/ManualSplitFinder.cs b/Source/VCGeneration/Splits/ManualSplitFinder.cs
index 4b553b055..d125f503a 100644
--- a/Source/VCGeneration/Splits/ManualSplitFinder.cs
+++ b/Source/VCGeneration/Splits/ManualSplitFinder.cs
@@ -11,7 +11,7 @@ namespace VCGeneration;
 public static class ManualSplitFinder {
   
   public static IEnumerable<ManualSplit> GetParts(VCGenOptions options, ImplementationRun run,
-    Func<IImplementationPartOrigin, List<Block>, ManualSplit> createPart) {
+    Func<IImplementationPartOrigin, IList<Block>, ManualSplit> createPart) {
     
     var focussedParts = FocusAttributeHandler.GetParts(options, run, createPart);
     var result = focussedParts.SelectMany(focussedPart => {
diff --git a/Source/VCGeneration/Splits/Split.cs b/Source/VCGeneration/Splits/Split.cs
index 1d12f7f53..ef80d61fe 100644
--- a/Source/VCGeneration/Splits/Split.cs
+++ b/Source/VCGeneration/Splits/Split.cs
@@ -22,8 +22,8 @@ public class Split : ProofRun
 
       public int RandomSeed { get; }
 
-      private List<Block> blocks;
-      public List<Block> Blocks => blocks ??= getBlocks();
+      private IList<Block> blocks;
+      public IList<Block> Blocks => blocks ??= getBlocks();
 
       readonly List<Block> bigBlocks = new();
       public List<AssertCmd> Asserts => Blocks.SelectMany(block => block.Cmds.OfType<AssertCmd>()).ToList();
@@ -74,7 +74,7 @@ public readonly VerificationConditionGenerator /*!*/
       public int SplitIndex { get; set; }
       public VerificationConditionGenerator.ErrorReporter reporter;
 
-      public Split(VCGenOptions options, Func<List<Block /*!*/>> /*!*/ getBlocks,
+      public Split(VCGenOptions options, Func<IList<Block /*!*/>> /*!*/ getBlocks,
         VerificationConditionGenerator /*!*/ parent, ImplementationRun run, int? randomSeed = null)
       {
         Contract.Requires(parent != null);
@@ -199,7 +199,7 @@ public void DumpDot(int splitNum)
       }
 
       int bsid;
-      private readonly Func<List<Block>> getBlocks;
+      private readonly Func<IList<Block>> getBlocks;
 
       BlockStats GetBlockStats(Block b)
       {
diff --git a/Source/VCGeneration/Splits/SplitAttributeHandler.cs b/Source/VCGeneration/Splits/SplitAttributeHandler.cs
index 8adb35a41..a71952000 100644
--- a/Source/VCGeneration/Splits/SplitAttributeHandler.cs
+++ b/Source/VCGeneration/Splits/SplitAttributeHandler.cs
@@ -77,7 +77,7 @@ private static bool ShouldSplitHere(Cmd c) {
     return predicateCmd.Attributes.FindBoolAttribute("split_here");
   }
 
-  private static Dictionary<Block, Cmd?> GetMapFromBlockStartToSplit(List<Block> blocks, Dictionary<Block, List<Cmd>> splitsPerBlock) {
+  private static Dictionary<Block, Cmd?> GetMapFromBlockStartToSplit(IList<Block> blocks, Dictionary<Block, List<Cmd>> splitsPerBlock) {
     var todo = new Stack<Block>();
     var blockAssignments = new Dictionary<Block, Cmd?>();
     var immediateDominators = Program.GraphFromBlocks(blocks).ImmediateDominator();
@@ -169,7 +169,7 @@ List<Cmd> GetCommandsForBlockWithSplit(Block currentBlock)
     }
   }
 
-  private static List<Block> UpdateBlocks(IReadOnlyList<Block> blocks,
+  private static List<Block> UpdateBlocks(IList<Block> blocks,
     Func<Block, List<Cmd>> getCommands)
   {
     var newBlocks = new List<Block>(blocks.Count);
diff --git a/Source/VCGeneration/VerificationConditionGenerator.cs b/Source/VCGeneration/VerificationConditionGenerator.cs
index 8d79243ed..db6af4f90 100644
--- a/Source/VCGeneration/VerificationConditionGenerator.cs
+++ b/Source/VCGeneration/VerificationConditionGenerator.cs
@@ -475,7 +475,7 @@ public class ErrorReporter : ProverInterface.ErrorHandler
 
       ControlFlowIdMap<Absy> absyIds;
 
-      List<Block> blocks;
+      IList<Block> blocks;
 
       protected Dictionary<Cmd, List<object>> debugInfos;
 
@@ -506,7 +506,7 @@ public override void AddCoveredElement(TrackedNodeComponent elt)
 
       public ErrorReporter(VCGenOptions options,
         ControlFlowIdMap<Absy> /*!*/ absyIds,
-        List<Block /*!*/> /*!*/ blocks,
+        IList<Block /*!*/> /*!*/ blocks,
         Dictionary<Cmd, List<object>> debugInfos,
         VerifierCallback /*!*/ callback,
         ModelViewInfo mvInfo,
@@ -1480,7 +1480,7 @@ public static Counterexample AssertCmdToCloneCounterexample(VCGenOptions options
      *
      */
 
-    VCExpr LetVC(List<Block> blocks,
+    VCExpr LetVC(IList<Block> blocks,
       VCExpr controlFlowVariableExpr,
       ControlFlowIdMap<Absy> absyIds,
       ProverContext proverCtxt,