Skip to content
Security
Command

/gas

Gas profile — find expensive operations and suggest optimizations with before/after numbers.

From plugin
rugproof
1145 skills23 agents45 commands4 hooks
> /plugin marketplace add omermaksutii/RugProof
> /plugin install rugproof@rugproof

Command definition

gas.md
description: Gas profile — find expensive operations and suggest optimizations with before/after numbers.
argument-hint: "<file-or-contract>"
allowed-tools: Read, Write, Bash, Agent, Skill, mcp__forge-runner__*

/gas — gas profile and optimization

Procedure

Step 1 — Run forge gas report

mcp__forge-runner__gas_report()

Returns per-function gas costs from the existing test suite.

Step 2 — Identify expensive ops

Dispatch `gas-optimizer` subagent. It looks for:

  • **Storage reads in loops** — should be cached in memory
  • **SSTORE on cold slots** that could be merged into one slot (packing)
  • **String revert reasons** — use custom errors (`error InsufficientBalance();`)
  • **Unbounded loops over storage**
  • **`x = x + 1` instead of `++x` / `unchecked { ++x }`** in safe loops
  • **Memory vs calldata** for read-only function params (calldata is cheaper)
  • **Public vs external** for fns called only externally (external is cheaper)
  • **Repeated keccak256 of constants** — precompute
  • **`require` over short-circuit** when both sides are equally cheap
  • **Bool storage flags** — pack into bitfields if grouped
  • **Modifier with body inlined vs reusable** — inline can be cheaper

Step 3 — Generate suggestions

For each opportunity, produce a diff. Estimate gas saved using a benchmark test.

Step 4 — Apply and measure

If `--apply`, apply the patches and re-run gas report. Show before/after.

Step 5 — Output

Gas profile for src/Vault.sol:

  Function          Avg   Min   Max   Median
  deposit           147K  142K  158K  144K
  withdraw          203K  189K  225K  198K   ← top spender
  rebalance         412K  398K  431K  410K   ← top spender

Optimization opportunities:

  1. withdraw():
     - Cache `users[msg.sender]` in memory (called 4× in fn body)
     - Estimated savings: 8K gas/call
  2. rebalance():
     - Replace `string memory reason` with custom errors
     - Estimated savings: 12K gas/call
  3. Storage layout:
     - Pack `bool paused` + `uint8 feeRate` + `address admin` into one slot
     - Saves one SSTORE per init: 20K gas

Apply with `--apply`. Re-runs the gas report and shows deltas.

Notes

  • Don't sacrifice readability for marginal gas wins.
  • Avoid assembly optimizations unless gas savings are >10K and the code is well-commented.
  • Re-audit any gas-optimized code — assembly substitutions are a common bug source.
Read more
@omermaksutii
Ships withrugproof

Rugproof your code before someone else does. 🌐 Live site: omermaksutii.github.io/RugProof 📦 Latest: v1.0.0 — 45 commands · 23 agents · 45 skills · 13 MCP servers · tested, offline-first, with rule packs, a benchmark, non-EVM coverage, and post-deploy

1152 skills23 agents
Get the whole plugin

Stars on GitHub

Momentum

stars in total
11
Star history of omermaksutii/RugProof on GitHub, a chart by star-history.com

Other commands on rugproof.

audit-deep

audit-deep

Command

Deep audit — same as /audit but spawns more parallel subagents, runs multi-pass review, and chases exploit chains across files.

@omermaksutii@omermaksutiiInstall Command
audit-deps

audit-deps

Command

Audit third-party dependencies — resolve installed versions, cross-reference known-vulnerable releases, and flag vendored code…

@omermaksutii@omermaksutiiInstall Command
audit-diff

audit-diff

Command

Diff two Rugproof audit reports (before vs after) to track regressions — what's new, what's fixed, and whether the grade moved.

@omermaksutii@omermaksutiiInstall Command
audit-history

audit-history

Command

Pull past public audits (Code4rena, Sherlock, Spearbit, etc.) for a deployed contract or known protocol.

@omermaksutii@omermaksutiiInstall Command
audit-live

audit-live

Command

Audit a deployed contract on a live chain. Pulls verified source from the block explorer, optionally forks the chain for…

@omermaksutii@omermaksutiiInstall Command

More commands from other plugins.

deslop-reborn

deslop-reborn

Command

One iteration of the IronClaw Reborn de-slop loop — take ONE Reborn crate, fan out parallel review sub-agents (thermo-nuclear…

@nearai@nearaiInstall Command
audit

audit

Command

Audit a file, directory, or whole repo for insecure default configuration: fallback secrets, default credentials, fail-open…

@trailofbits@trailofbitsInstall Command
arsenal

arsenal

Command

Show which external bug-bounty tools are installed on this machine and print install hints for the missing ones. Curated from…

@awarexone@awarexoneInstall Command