imdUSD gas review

Result and scope

There are small, defensible savings in the collateral-ratio arithmetic and in canonical question-number formatting. Avoiding identical secured-collateral writes also saves on common deposit paths, but regresses changed-term paths and grows the vault; treat it as a workload-dependent candidate, not a blanket recommendation. No production source change is delivered.

Pinned commit: 03e8d0c9ed18204a041e48141bbff44b48da226b. Review date: 2026-10-05. All numbers below are local measurements or explicitly labelled calculations. Passing local tests is not an independent security review or a mainnet readiness certificate.

Method and limits

Measured the unmodified pinned tree first with forge build --sizes, forge snapshot, and forge test --gas-report, from an archive in test/scratch/baseline. Repository tracked files were not edited. The actual configuration is Forge 1.8.3 (cae51ad458f6abb64852b7709eb784352429825d), Solidity 0.8.26, optimizer 200 runs, Cancun, bytecode_hash="none", isolate=true; default fuzz 256 runs, invariant 128 runs/depth 64/fail_on_revert=true. Dependencies and configuration were copied unchanged. No network, RPC, dependency installation, or fork was needed for measurements.

Each patch was applied independently, never stacked. Final candidate measurements use forge build --force --sizes and a full snapshot plus full gas-report rerun, with fuzz seed 0x42. Clean rebuilding matters: an initial incremental build refreshed production artifacts but left inherited test artifacts unchanged. Those preliminary candidate results were discarded, their gas-report runs interrupted, and are not used below. An initial root build also encountered the nested scratch tree; all authoritative runs use the separate archived project as their working directory.

Four original fixtures skip without fork endpoints: PermissionlessRelayTest, InHouseTest, ShareCollateralForkTest, SharePriceFeedForkTest. Thus “the full suite still passes” below means all runnable tests at the pinned checkout pass, with those same four skips. It does not claim those live integrations were exercised. Original configuration still contains Sepolia addresses and Intake/asker placeholders: this is a prelaunch optimization review, not a verification of deployed mainnet addresses.

Suite gas aggregates include reverts, fuzz distributions, and invariant traffic. They are not forecasts of typical user transactions. The controlled successful-call fixture deploys ParameterizedVault with a 24-decimal share mock at 7.95 IMD/share, IMD/ETH=0.001 and ETH/USD=2000, zero reserve, and fresh mock feeds. It measures actual last-call gas with vm.snapshotGasLastCall, avoiding gasleft subtraction across isolated top-level calls. Share-token internals and oracle calls are mocks, so absolute costs are not a live sIMD quote. Counts/frequencies below are illustrative; no mainnet usage dataset was supplied.

Baseline

Contract	Runtime bytes	Creation bytecode bytes
ParameterizedVault	20,262	42,917
CDPVault	16,665	25,930
OracleAsker	6,497	8,021
SwarmRelay	3,963	3,995
Treasury	12,001	12,148
PriceFeed	7,180	9,640
NhiFeed	7,401	10,082
SpotFeed	7,068	9,416
SharePriceFeed	1,552	2,184
UsdPriceFeed	2,230	2,417

forge build --sizes compiles successfully but exits 1: ApplicationConstructionFactory (26,408 runtime bytes) and SelfContainedInvariantFactory (26,275) exceed EIP-170. They are helpers in test/FactoryDeployment.t.sol and test/SelfContainedDeployment.invariant.t.sol, not the production vault. The same pre-existing helper-size failure remains for every candidate; it is not a failed compilation or a passing size check. ParameterizedVault has 4,314 runtime bytes and 6,235 creation-bytecode bytes of reported headroom. Constructor arguments are additional to the table: six static address arguments add 192 bytes, leaving 6,043 bytes below the initcode limit for the ordinary deployment payload. No claim here includes deployer-specific extra wrapping bytes.

Initial full snapshot: 516 passed, 0 failed, 4 skipped, 58 suites. Initial full gas report: 516 passed, 0 failed, 4 skipped, 58 suites. The initial runs used the default random seed; their fuzz-dependent aggregate counts are recorded evidence, not guaranteed identical on another default-seed run. All final paired full-suite runs use the fixed seed 0x42.

The following is the unmodified initial forge test --gas-report table, including the sample counts. A blank production row is not a zero cost: barkFor and submitAttestation are shown under their directly exercised test subclasses. Successful nested callback cost is measured separately below; the low callback median here is not its stipend usage.

Contract/artifact	Function	Min	Average	Median	Max	Calls
src/CDPVault.sol:CDPVault	bark	119078	120061	120455	120455	7
src/CDPVault.sol:CDPVault	bite	248306	251535	253150	253150	3
src/CDPVault.sol:CDPVault	draw	72980	263473	286439	287792	20
src/CDPVault.sol:CDPVault	lock	96755	109333	113797	113855	19
src/CDPVault.sol:CDPVault	wipe	222724	222724	222724	222724	1
src/OracleAsker.sol:OracleAsker	arm	43150	46137	48126	48126	5
src/OracleAsker.sol:OracleAsker	ask	24895	108356	43906	233415	22
src/OracleAsker.sol:OracleAsker	askPaid	25525	124378	114816	230534	6
src/OracleAsker.sol:OracleAsker	onOracleResult	27912	29030	29030	30148	2
src/ParameterizedVault.sol:ParameterizedVault	bark	104697	163105	166394	182381	26
src/ParameterizedVault.sol:ParameterizedVault	bite	239305	428862	458875	458875	22
src/ParameterizedVault.sol:ParameterizedVault	cash	27053	211437	206414	389736	5834
src/ParameterizedVault.sol:ParameterizedVault	cover	26831	160307	165772	255801	16
src/ParameterizedVault.sol:ParameterizedVault	draw	48821	217865	188329	339037	4590
src/ParameterizedVault.sol:ParameterizedVault	free	92764	148170	144939	206524	3096
src/ParameterizedVault.sol:ParameterizedVault	lock	97528	112330	104006	181897	4762
src/ParameterizedVault.sol:ParameterizedVault	lockIMD	29882	214741	248461	248568	8
src/ParameterizedVault.sol:ParameterizedVault	wipe	120153	151978	146614	254060	3712
src/SwarmRelay.sol:SwarmRelay	relay	33200	70883	65097	111270	6
src/SwarmRelay.sol:SwarmRelay	relayAndBark	176159	176159	176159	176159	2
src/SwarmRelay.sol:SwarmRelay	relayAndBite	53745	250870	353999	371099	5
src/Treasury.sol:Treasury	fundOracle	23985	103825	69380	189388	18
src/Treasury.sol:Treasury	payStream	34873	77498	61234	170255	10
src/Treasury.sol:Treasury	sync	29684	37154	29696	73898	2529
test/QuestionBinding.t.sol:BoundFeed	submitAttestation	61361	94593	64506	145659	11
test/helpers/BaselineVault.sol:BaselineVault	barkFor	26956	73117	73117	119278	2

Controlled successful-call comparisons

Gas units, independent changes. Savings are baseline minus candidate (negative means regression). All calls use ParameterizedVault. lockDebtFree is an initial 200-share deposit; lockWithDebt adds 10 shares to the same 200-share/$1,000 position, whose secured term is already debt-capped. lockIMDDebtFree wraps 1,000 underlying IMD. draw opens $1,000 debt; wipe repays $100 immediately. Free releases 10 shares with/without $1,000 debt. Liquidation measurements use an IMD price fall to 0.0004 ETH and NHI 0.5, giving zero grace, with a $100 bite. Cash burns $100 from a $1,600 self-funded position with 200 shares, no reserve; these are specified representative branches, not averages of every state.

Call	Baseline	Saturating after	Saved	Equal-write after	Saved
lockDebtFree	134,878	134,878	+0	134,447	+431
lockWithDebt	101,167	101,167	+0	100,736	+431
lockIMDDebtFree	168,820	168,820	+0	168,475	+345
draw	336,237	335,826	+411	336,283	-46
wipe	138,320	138,320	+0	138,366	-46
freeDebtFree	99,057	99,057	+0	98,626	+431
freeWithDebt	152,055	151,644	+411	151,624	+431
bark	159,726	159,315	+411	159,726	+0
barkFor	160,121	159,710	+411	160,121	+0
bite	302,267	301,445	+822	302,359	-92
cash	240,658	240,247	+411	240,273	+385

Ranking by savings times frequency

No empirical frequency is known. The explicit illustrative workload below follows the supplied hot-path order and exposes how to recompute the ranking. It is not a prediction: 800 debt-free locks + 200 capped-position locks, 800 debt-free lockIMD, 600 draws, 500 wipes, 200 debt-free and 200 debt-bearing frees, 100 barks, 50 barkFor, 50 bites, 20 cash, and 100 bound feed updates, each with two eight-digit block numbers. For decimal formatting the measured question-hash delta is used per bound update, not the whole multi-call test-body delta. Callbacks and relays carrying that same update are not double-counted. Untested workload branches contribute no claimed savings.

Rank	Independent patch	Calculated gas saved for stated workload	Adoption position
1	resecure	+831,900	Conditional only; reject unconditional rollout without state-mix data
2	decimal	+509,200	Recommend; same hashes, smaller bound feeds
3	saturating	+439,770	Recommend; exact local bound proof, shrinks vault

The general rule is sum(N_call × measured_delta_call); multiply total saved gas by the applicable gas price to estimate fees. A ranking can reverse if there are many oracle updates or many secured-term changes. Gas savings of separately tested patches are not guaranteed additive; a combined patch must be rebuilt and measured before adoption.

Proposals, exact diffs, and security properties

1. resecure

File/function: src/CDPVault.sol, _resecure, reached by collateral and principal changes.

Change: condition the two writes on the position term changing. Keep _advanceLag, _clampLag, and the transient increment in their original places; an early return from this function would be wrong.

Security property: aggregate secured collateral equals the sum of stored position terms. In every reachable state, the aggregate includes this position's previous term, so subtracting that term and re-adding the identical value is an identity with no overflow/underflow. Skipping the identical writes preserves state. There is no external call between these operations; the lag checkpoint still uses the old aggregate, clamps still run, and increases still enter the transaction-local exclusion. The arithmetic on changed terms stays checked. This does not narrow fields, alter storage layout, or skip an oracle read. The reasoning depends on the existing aggregate invariant, unlike the unconditional arithmetic identity in the first patch.

Tradeoff: ParameterizedVault grows 20,262 → 20,278 runtime bytes and 42,917 → 42,933 creation bytes (+16 each). The gas table gives both equal-term savings and changed-term regressions. Reject it as an unconditional default without a measured state mix. For the measured 431-gas equal-term saving and 46-gas changed-term regression, break-even is more than 46/431 = 0.107 equal-term calls per changed-term call (over 9.65% equal-term calls in that two-branch mix), before deployment cost. For other branch pairs, the break-even count ratio is changed-branch extra gas / equal-branch saved gas; include per-path frequencies and the deployment-size cost. In particular a debt-free lock is not representative of all locks.

--- a/src/CDPVault.sol
+++ b/src/CDPVault.sol
@@ -784,9 +784,9 @@
     function _resecure(Position storage position, uint256 price) private {
         uint256 before = position.secured;
         uint256 current = _secured(position, price);
-        position.secured = current;
+        if (current != before) position.secured = current;
         _advanceLag();
-        securedCollateral = securedCollateral - before + current;
+        if (current != before) securedCollateral = securedCollateral - before + current;
         _clampLag();
         if (current > before) _transientAdd(SECURED_THIS_TX_SLOT, current - before);
     }

Full-suite evidence: Ran 59 test suites in 163.42s (551.77s CPU time): 523 tests passed, 0 failed, 4 skipped (527 total tests); Ran 59 test suites in 248.42s (809.03s CPU time): 523 tests passed, 0 failed, 4 skipped (527 total tests). The full runnable suite still passes with the original four skips. Seven additional successful-call benchmark tests are included in these final runs.

2. decimal

File/function: src/SwarmFeed.sol, _decimal, used twice by expectedQuestionHash inside _requireQuestion during bound submitAttestation, including calls through relay, relayAndBark, relayAndBite, and the OracleAsker callback.

Change: widen local counters and loop values to uint256; input and all stored/ABI types remain uint64. This reduces narrow-integer cleanup and checked arithmetic overhead in the compiled loop. All arithmetic stays checked.

Gas: the same eight-digit production PriceFeed question hash costs 16,690 → 11,598, saving 5,092 gas. End-to-end callback measurements follow below. There is no saving for an unbound feed whose questionPolicy prefix is empty. Savings depend on digit count, not the block values' economic meaning.

Security property: value remains uint64. Each loop starts from the same value and divides by 10, producing the identical sequence and at most 20 digits. The second loop decrements exactly the count obtained in the first. Each digit is 48+(v%10), in [48,57]; the zero fast path, bytes-array bounds checks, and checked arithmetic remain. Therefore every output byte, canonical question hash, and signed-input acceptance decision is identical. No window, signature, panel, replay, freshness, deviation or relayer check changes, and no external call moves. An independent vm.toString-based reference tests zero, uint64 maximum and 1,024 fuzz pairs over the full uint64 domain with seed 0x43.

Size: PriceFeed 7,180 → 7,049 runtime and 9,640 → 9,509 creation; NhiFeed 7,401 → 7,270 and 10,082 → 9,951; SpotFeed 7,068 → 6,937 and 9,416 → 9,285. 131 bytes saved in each bound feed, runtime and creation. ParameterizedVault remains 20,262 / 42,917: it creates wrapper feeds, not these attestation feeds.

--- a/src/SwarmFeed.sol
+++ b/src/SwarmFeed.sol
@@ -202,10 +202,10 @@
     /// widening it for.
     function _decimal(uint64 value) private pure returns (bytes memory) {
         if (value == 0) return "0";
-        uint64 digits;
-        for (uint64 v = value; v != 0; v /= 10) ++digits;
+        uint256 digits;
+        for (uint256 v = value; v != 0; v /= 10) ++digits;
         bytes memory out = new bytes(digits);
-        for (uint64 v = value; v != 0; v /= 10) out[--digits] = bytes1(uint8(48 + (v % 10)));
+        for (uint256 v = value; v != 0; v /= 10) out[--digits] = bytes1(uint8(48 + (v % 10)));
         return out;
     }
 

Full-suite evidence: Ran 59 test suites in 220.74s (545.13s CPU time): 523 tests passed, 0 failed, 4 skipped (527 total tests); Ran 59 test suites in 233.57s (816.42s CPU time): 523 tests passed, 0 failed, 4 skipped (527 total tests). The full runnable suite still passes with the original four skips. Seven additional successful-call benchmark tests are included in these final runs.

3. saturating

File/function: src/CDPVault.sol, _saturatingAdd, used by _collateralRatio and therefore draw/free/liquidation/recovery/cash health calculations.

Change: mark only this already-guarded arithmetic as unchecked; retain the saturating comparison unchanged.

Proof: let M=2^256−1. Every uint256 a satisfies 0≤a≤M, so M−a cannot underflow. If b>M−a, the branch returns M without evaluating a+b. Otherwise b≤M−a implies a+b≤M, so that addition cannot overflow. Both branches return exactly the original value for every uint256 pair, including zero and M. No authority, guard, price read, rounding, event, error, nonReentrant modifier, or external call changes. The guard is not removed or weakened. This is the only proposed unchecked block.

Size: ParameterizedVault 20,262 → 20,251 runtime bytes and 42,917 → 42,906 creation bytes: 11 bytes saved in each. Controlled successful-call before/after gas is in the table above; zero-saving paths are shown explicitly. This is a modest arithmetic saving, not a redesign.

--- a/src/CDPVault.sol
+++ b/src/CDPVault.sol
@@ -1273,6 +1273,8 @@
     }
 
     function _saturatingAdd(uint256 a, uint256 b) private pure returns (uint256) {
-        return b > type(uint256).max - a ? type(uint256).max : a + b;
+        unchecked {
+            return b > type(uint256).max - a ? type(uint256).max : a + b;
+        }
     }
 }

Full-suite evidence: Ran 59 test suites in 201.30s (538.86s CPU time): 523 tests passed, 0 failed, 4 skipped (527 total tests); Ran 59 test suites in 234.10s (850.35s CPU time): 523 tests passed, 0 failed, 4 skipped (527 total tests). The full runnable suite still passes with the original four skips. Seven additional successful-call benchmark tests are included in these final runs.

Callback stipend

The original OracleAsker callback test uses ConfigurableSwarmFeed with no pinned question. Its measured value is useful but does not establish the cost of the production binding path. Additional tests use the exact production NhiFeed QUESTION_PREFIX and span bounds in a test feed, with a fixture signer, mainnet chain ID 1, toBlock=26,000,600 equal to the current block, and fromBlock=26,000,000. A mock Intake calls the actual OracleAsker → SwarmRelay → bound feed path with exactly 200,000 gas. The tests assert both successful callback completion and the accepted feed value, so catching an out-of-gas relay cannot count as a pass. The slot must clear in either case. Seeded-update and first-value paths are measured separately; the seeded fixture begins with lastToBlock zero, making its first advancing-window write conservative relative to an already populated window slot.

Gas recorded by MockIntake includes its call overhead; it is not a refund-adjusted transaction gas price. These tests are finite payload/state fixtures, not a universal bound for arbitrary signature/answer sizes or proof of a deployed Intake implementation.

Bound NHI callback case	Baseline	Decimal patch	Saved	Remaining from 200,000 after patch
First	151,534	146,442	5,092	53,558
Update	118,482	113,390	5,092	86,610

Additional-test exception: the baseline bound-first callback successfully delivered and updated the feed within the 200,000-gas stipend, but failed the scratch fixture's stricter 150,000-gas headroom assertion (151,534 >= 150,000). The decimal candidate passes both first-value and update cases with that exact same assertion. No test threshold was relaxed. This added diagnostic was run after the original full suites, so it is not concealed by the 523-pass original-suite-plus-benchmark totals. The measured first-value headroom improves from 48,466 to 53,558 gas (about 26.8% of the stipend after the patch).

No change to arm, ask, askPaid, onOracleResult, Treasury.fundOracle/payStream/sync, or relay itself is proposed. These functions do not inherit the vault arithmetic patch; only delivery to a bound feed inherits the decimal savings.

Measured but rejected, and already-efficient paths

• Unconditional equal-write rollout: measured in full, with its exact diff and proof above, but not recommended blindly because changed secured terms pay extra and vault bytecode grows. Keep it only if observed equal-term call savings dominate; the illustrative workload is not that observation.
• Incremental-build comparisons: rejected as evidence. After copying cached outputs, production sizes changed while inherited SeedableFeed artifacts did not. Final results use clean rebuilds, and clean decimal builds do shrink SeedableFeed artifacts. Preliminary interrupted gas logs must not be cited as completed runs.
• Unbound callback as production-cost evidence: measured by the existing stipend test but rejected as the only basis for a mainnet bound-feed conclusion. The additional tests above exercise the question-prefix/window path. No claim of a decimal saving is made for unbound ConfigurableSwarmFeed deliveries.
• Gas-neutral simplifications: none is recommended; the admitted arithmetic candidate saves gas and shrinks the vault, and the formatting candidate saves gas and shrinks feeds. No cosmetic cleanup is counted as a saving.

Static inspection, not measured optimization claims: lock's actual received-balance check and lockIMD's received-share measurement/forceApprove cleanup protect collateral accounting and token compatibility. Their calls and order stay intact. Price-dependent paths use raw primary/spot prices for divergence and USD/share-denominated prices for solvency: these are different checks. The repayment recovery path tolerates stale observations without incorrectly clearing a mark. Caching or dropping those reads is not established safe here.

SwarmRelay.relay is already a thin forwarder. Batch-length checks and relayAndBite's balance deltas protect atomicity, donations and custody. No worthwhile safe change to those functions was demonstrated. OracleAsker keeps price caps, in-flight exclusion, cooldown/arming rules, exact allowances and callback catch behavior. Treasury.fundOracle protects both daily spend and excess asker accumulation; payStream protects bad-debt funds; sync correctly counts receipts without treating withdrawals as negative income. Nothing measured justifies weakening any of them.

The vault already uses factories for Treasury/work-oracle creation, immutables for fixed references, and transient exclusion of same-transaction capital. Those are efficient existing choices. Replacing governed reads with constants, removing nonReentrant, changing parameter values, narrowing stored monetary amounts, weakening freshness/divergence checks, or reordering external calls is outside the admissible set and is not proposed.

Reproduction and audit trail

From a clean checkout of the pinned commit, archive it into a separate scratch directory (do not run Forge at the parent with nested copies under test/). Run the baseline commands first. For each independent candidate create another copy, apply its inline diff, retain foundry.toml/remappings/dependencies byte-for-byte, and run:

FOUNDRY_FUZZ_SEED=0x42 forge build --force --sizes
FOUNDRY_FUZZ_SEED=0x42 forge snapshot --snap candidate.snap
FOUNDRY_FUZZ_SEED=0x42 forge test --gas-report
forge test --match-contract GasBench -vv
forge test --match-contract GasMoreBench -vv
forge test --match-contract OracleBoundBench -vv
forge test --match-contract GasQuestionBench --fuzz-seed 0x43 --fuzz-runs 1024 -vv

The last two fixtures are relevant to baseline/decimal; the extra liquidation fixture is relevant to baseline/saturating/resecure. The scratch-only benchmark sources and orchestration scripts are in artifacts/GasBench.t.sol, GasMoreBench.t.sol, OracleBoundBench.t.sol, GasQuestionBench.t.sol, run-experiments.py, final-measure.py and the run-extra/run-question/run-more scripts. Copy fixture sources into each scratch project's test/ so their relative helper imports resolve. No benchmark is a proposed source change. The complete original suite is always rerun, not merely matched tests. Main result tables are embedded above so this report remains useful if auxiliary evidence files are not separately uploaded.

Local raw evidence: baseline-build.txt, baseline-snapshot.txt, baseline.snap, baseline-gas.txt; {baseline,saturating,resecure,decimal}-final-{build,snapshot,gas,bench,callback}.txt and -final.snap; baseline/saturating/resecure-more.txt; baseline/decimal-bound-callback.txt and -question.txt. Full fixture source and logs permit local replay; figures do not have independent verifier authority.

Solidity's language reference documents checked versus unchecked arithmetic; it supports the arithmetic proof, not the gas measurements. Protocol behavior and configuration are pinned source facts in src/CDPVault.sol, src/SwarmFeed.sol, src/ParameterizedVault.sol, src/DeploymentConfig.sol, docs/MAINNET-RUNBOOK.md and docs/PARAMETERS-2026-10-05.md. Economic prices in those documents were not refreshed or revalidated; no economic parameter change is justified by this gas review.

Remaining uncertainty: actual user/state frequencies, live sIMD transfer/deposit overhead, live Intake implementation, fork-only coverage, combined-patch compiler effects, and independent security review before adoption. There is no claim that these three local experiments exhaust every possible safe optimization.

Additional cross-checks

The three candidate trees each preserve 46 protected configuration/dependency files byte-for-byte, and 25 compiled production ABIs compare equal to the baseline. Their only source difference is the inline patch in CDPVault.sol or SwarmFeed.sol. git diff --exit-code at the delivered repository root is clean; artifacts remain untracked/ignored and were not added to Git.

These deterministic existing-test snapshots also support the call-path attribution. These are whole test-body gas totals, including preparation/signing, not isolated call quotes, and are excluded from the frequency model:

Existing test	Baseline	Saturating	Decimal
QuestionBindingTest.test_theRightQuestionIsAcceptedFromAnyone	204,084	204,084	198,992
RelayBundlingTest.test_aRelayedMarkMovesNoTokens	285,981	285,570	285,981
RelayBundlingTest.test_bundlingPaysTheKeeperExactlyWhatADirectCallWould	1,994,353	1,991,065	1,994,353
OracleAskerTest.test_deliveryRelaysIntoTheFeedInsideTheIntakeStipend (unbound fixture)	413,382	413,382	413,382

The direct bound submission and the end-to-end bound callback each improve by 5,092 gas. The unchanged unbound paths demonstrate why a generic relay average must not be used to estimate bound-feed savings.

Second-seed fuzz rerun (--match-test testFuzz --fuzz-seed 0x43 --fuzz-runs 1024), baseline: Ran 18 test suites in 8.66s (32.43s CPU time): 40 tests passed, 0 failed, 0 skipped (40 total tests).

Second-seed fuzz rerun (--match-test testFuzz --fuzz-seed 0x43 --fuzz-runs 1024), saturating: Ran 17 test suites in 12.04s (43.68s CPU time): 39 tests passed, 0 failed, 0 skipped (39 total tests).

Second-seed fuzz rerun (--match-test testFuzz --fuzz-seed 0x43 --fuzz-runs 1024), resecure: Ran 17 test suites in 14.42s (53.53s CPU time): 39 tests passed, 0 failed, 0 skipped (39 total tests).

Second-seed fuzz rerun (--match-test testFuzz --fuzz-seed 0x43 --fuzz-runs 1024), decimal: Ran 18 test suites in 8.52s (38.38s CPU time): 40 tests passed, 0 failed, 0 skipped (40 total tests).

Self-contained benchmark appendix

To reproduce the isolated measurements without separately uploaded supporting files, save the following fixtures under test/ in each scratch copy. The helpers they import already exist at the pinned commit. Run the commands above after applying one inline proposal at a time. The generated bound callback fixture intentionally fails the baseline's additional 150,000-gas assertion; retain that assertion and report the failure, as this review does. The original production suite passes independently.

GasBench.t.sol

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
import {Test} from "forge-std/Test.sol";
import {TreasuryFactoryEtch} from "./helpers/TreasuryFactoryEtch.sol";
import {MockIMD} from "src/MockIMD.sol";
import {ParameterizedVault} from "src/ParameterizedVault.sol";
import {TestSwarmFeed} from "./helpers/TestSwarmFeed.sol";
import {MirroredSwarmFeed} from "./helpers/MirroredSwarmFeed.sol";
import {ReserveUsdAggregator} from "./helpers/WorkBackingFixture.sol";
import {MockShareVault} from "./helpers/MockShareVault.sol";
import {APPROVED_OPERATOR, CHAINLINK_ETH_USD} from "src/DeploymentConfig.sol";
contract GasBench is Test {
    MockIMD imd;
    MockShareVault share;
    ParameterizedVault vault;
    address constant USER = address(0xB0B);
    function setUp() public {
        TreasuryFactoryEtch.etch(vm);
        vm.chainId(1);
        vm.warp(1_000_000);
        imd = new MockIMD();
        share = new MockShareVault(imd, 7.95e12);
        TestSwarmFeed primary = new TestSwarmFeed(0.001 ether);
        TestSwarmFeed health = new TestSwarmFeed(0.9 ether);
        vm.etch(CHAINLINK_ETH_USD, address(new ReserveUsdAggregator()).code);
        ReserveUsdAggregator(CHAINLINK_ETH_USD).setDecimals(8);
        ReserveUsdAggregator(CHAINLINK_ETH_USD).set(2_000e8, block.timestamp);
        vault = new ParameterizedVault(address(share), address(0), address(0), address(primary), address(health), address(new MirroredSwarmFeed(address(primary))));
        vm.prank(APPROVED_OPERATOR);
        imd.mint(USER, 20_000 ether);
        vm.startPrank(USER);
        imd.approve(address(share), type(uint256).max);
        share.deposit(10_000 ether, USER);
        share.approve(address(vault), type(uint256).max);
        imd.approve(address(vault), type(uint256).max);
        vm.stopPrank();
    }
    function opened() private {
        vm.startPrank(USER);
        vault.lock(200e24);
        vault.draw(1_000 ether);
        vm.stopPrank();
    }
    function measure(string memory label) private {
        uint256 used = vm.snapshotGasLastCall("GasBench", label);
        emit log_named_uint(label, used);
    }
    function test_lockDebtFree() public { vm.prank(USER); vault.lock(200e24); measure("lockDebtFree"); }
    function test_lockWithDebt() public { opened(); vm.prank(USER); vault.lock(10e24); measure("lockWithDebt"); }
    function test_lockIMDDebtFree() public { vm.prank(USER); vault.lockIMD(1_000 ether); measure("lockIMDDebtFree"); }
    function test_draw() public { vm.startPrank(USER); vault.lock(200e24); vault.draw(1_000 ether); vm.stopPrank(); measure("draw"); }
    function test_wipe() public { opened(); vm.prank(USER); vault.wipe(100 ether); measure("wipe"); }
    function test_freeDebtFree() public { vm.startPrank(USER); vault.lock(200e24); vault.free(10e24); vm.stopPrank(); measure("freeDebtFree"); }
    function test_freeWithDebt() public { opened(); vm.prank(USER); vault.free(10e24); measure("freeWithDebt"); }
}

GasMoreBench.t.sol

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
import {GasBench} from "./GasBench.t.sol";
import {TestSwarmFeed} from "./helpers/TestSwarmFeed.sol";
contract GasMoreBench is GasBench {
    function distressed() private {
        vm.startPrank(USER);
        vault.lock(200e24);
        vault.draw(1_000 ether);
        vm.stopPrank();
        TestSwarmFeed(address(vault.priceFeed())).setValue(0.0004 ether);
        TestSwarmFeed(address(vault.nhiFeed())).setValue(0.5 ether);
    }
    function test_bark() public { distressed(); vault.bark(USER); emit log_named_uint("bark",vm.snapshotGasLastCall("More","bark")); }
    function test_barkFor() public { distressed(); vault.barkFor(USER,address(this)); emit log_named_uint("barkFor",vm.snapshotGasLastCall("More","barkFor")); }
    function test_bite() public { distressed(); vault.bark(USER); vm.prank(USER); vault.bite(USER,100 ether); emit log_named_uint("bite",vm.snapshotGasLastCall("More","bite")); }
    function test_cash() public {
        vm.startPrank(USER); vault.lock(200e24); vault.draw(1_600 ether); vault.cash(100 ether,0,USER); vm.stopPrank();
        emit log_named_uint("cash",vm.snapshotGasLastCall("More","cash"));
    }
}

GasQuestionBench.t.sol

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;
import {Test} from "forge-std/Test.sol";
import {PriceFeed} from "src/PriceFeed.sol";
contract PrefixFeed is PriceFeed {
    constructor() PriceFeed(3600,2000) {}
    function prefix() external pure returns (bytes memory) { return QUESTION_PREFIX; }
}
contract GasQuestionBench is Test {
    PrefixFeed feed;
    function setUp() public { feed = new PrefixFeed(); }
    function check(uint64 fromBlock,uint64 toBlock) private view {
        bytes32 referenceHash = keccak256(abi.encodePacked(feed.prefix(),vm.toString(uint256(fromBlock)),',"toBlock":',vm.toString(uint256(toBlock)),"}}"));
        assertEq(feed.expectedQuestionHash(fromBlock,toBlock),referenceHash);
    }
    function testFuzz_fullUint64Domain(uint64 fromBlock,uint64 toBlock) public view { check(fromBlock,toBlock); }
    function test_zeroAndMaximum() public view { check(0,type(uint64).max); check(type(uint64).max,0); }
    function test_eightDigitWindowGas() public {
        feed.expectedQuestionHash(26_000_000,26_000_600);
        emit log_named_uint("eightDigitWindow",vm.snapshotGasLastCall("QuestionBench","eightDigitWindow"));
    }
}

make-bound-bench.py

Save this generator under artifacts/ in a scratch checkout, run it there, and copy artifacts/OracleBoundBench.t.sol to test/. It copies the production NHI prefix and the existing test signer/setup; it changes no production constant.

from pathlib import Path
import re
root=Path(__file__).resolve().parent.parent
original=(root/'test/OracleAsker.t.sol').read_text()
def fn(name):
    start=original.index('    function '+name+'(')
    brace=original.index('{',start); depth=1; end=brace+1
    while depth:
        depth += (original[end]=='{')-(original[end]=='}'); end+=1
    return original[start:end]+'\n'
prefix=re.search(r'bytes internal constant QUESTION_PREFIX = (hex"[^"]+");',(root/'src/NhiFeed.sol').read_text()).group(1)
imports=original[:original.index('/// @notice')]
helper='''contract CallbackBoundFeed is ConfigurableSwarmFeed {
    constructor(address a,address r,uint256 c,uint8 t,uint256 age,uint256 dev) ConfigurableSwarmFeed(a,r,c,t,age,dev) {}
    function questionPolicy() internal pure override returns (bytes memory,uint64,uint64) { return (PREFIX,150,1200); }
    bytes private constant PREFIX = '''+prefix+''';
}
'''
state=original[original.index('contract OracleAskerTest'):original.index('    function setUp()')].replace('OracleAskerTest','OracleBoundBench').replace('ConfigurableSwarmFeed','CallbackBoundFeed')
setup=fn('setUp').replace('ConfigurableSwarmFeed','CallbackBoundFeed').replace('vm.chainId(11155111)','vm.chainId(1)').replace('vm.roll(1_000)','vm.roll(26_000_600)').replace('        _setPool(IMD_ETH);','').replace('        healthFeed.seed(0.9 ether);','')
a=fn('_attestation').replace('keccak256("q")','healthFeed.expectedQuestionHash(26_000_000, 26_000_600)').replace('a.fromBlock = 100','a.fromBlock = 26_000_000').replace('a.toBlock = 200','a.toBlock = 26_000_600')
test=fn('test_deliveryRelaysIntoTheFeedInsideTheIntakeStipend').replace('test_deliveryRelaysIntoTheFeedInsideTheIntakeStipend','test_boundFirstCallback')
update=test.replace('test_boundFirstCallback','test_boundUpdateCallback').replace('        vm.warp(', '        healthFeed.seed(0.9 ether);\n        vm.warp(',1)
output=imports+helper+state+setup+test+update+a+fn('_sign').replace('ConfigurableSwarmFeed','CallbackBoundFeed')+'}\n'
(root/'artifacts/OracleBoundBench.t.sol').write_text(output)