WUFFS is, as it's name suggests, primarily about safety, but it gets performance advantages that fall out of safety (e.g it needs no runtime bounds or overflow/underflow checks because it proved these things can't happen at compile time)