diff --git a/src/vm/trace/mod.rs b/src/vm/trace/mod.rs
index 504da1938f..1f0537acb9 100644
--- a/src/vm/trace/mod.rs
+++ b/src/vm/trace/mod.rs
@@ -17,6 +17,7 @@ pub fn get_perm_range_check_limits(
     trace
         .iter()
         .try_fold(None, |offsets: Option<(isize, isize)>, trace| {
+            //TODO: try to use instruction cache; this is about 10-15% of proof runs
             let instruction = memory.get_integer((0, trace.pc).into())?;
             let instruction = instruction
                 .to_u64()
diff --git a/src/vm/vm_core.rs b/src/vm/vm_core.rs
index 51dcd1272f..e7e563145f 100644
--- a/src/vm/vm_core.rs
+++ b/src/vm/vm_core.rs
@@ -694,12 +694,16 @@ impl VirtualMachine {
                 Some(Ok(opt_fp)) if opt_fp != fp => fp = opt_fp,
                 _ => break,
             }
+            //TODO: use cache
             // Try to check if the call instruction is (instruction0, instruction1) or just
             // instruction1 (with no immediate).
             let call_pc = match (ret_pc - 1)
                 .ok()
                 .map(|r| self.segments.memory.get_integer(r))
             {
+                //FIXME: what if this looks like a call but is actually just a number passed as
+                //immediate?
+                //Maybe we should just keep a call stack?
                 Some(Ok(instruction1)) => {
                     match is_call_instruction(&instruction1) {
                         true => (ret_pc - 1).unwrap(), // This unwrap wont fail as it is checked before