At the moment we use wasmi for executing code in the sandbox, which is rather slow compared to even non-highly-optimizing compilers such as lightbeam. A step for improving this would be to integrate wasmtime/lightbeam there.

Note that we at this moment assume that wasm executed in sandbox is untrusted. The reason for that is that the primary user of the sandboxing capability is the srml-contract module. This might, however, change because especially taking into the account that sandbox is designed to be more or less universal.

Furthermore, there was an idea of a feature for srml-contract, that allows governance to mark some code_hash as trusted allowing to us to employ the highest tier compiler available on board of the node to compile this code. This would require specifying the desired properties of compiler when instantiating a wasm module with the sandbox.

We have similar problem for the runtime #2634 , so it might make sense to think about the complete solution.