diff --git a/src/vector.c b/src/vector.c
index c547b3f65..e06d1f6f5 100644
--- a/src/vector.c
+++ b/src/vector.c
@@ -351,31 +351,30 @@ dogecoin_bool serializeVector(vector* vec, char* out, size_t outlen, size_t* wri
  * @return 1 if the vector was deserialized successfully, 0 otherwise.
  */
 dogecoin_bool deserializeVector(vector* vec, const char* in, size_t inlen, size_t* read) {
-    if (!in || !inlen || !vec || !read) {
+    if (!in || inlen > MAX_SERIALIZE_SIZE || !vec || !read) {
         return false;
     }
 
     size_t offset = 0;
+
     while (offset < inlen) {
-        size_t len = strlen(in + offset);
-        if (!len) {
+        size_t len = strnlen(in + offset, MAX_SERIALIZE_SIZE - offset);
+        if (len == 0 || len >= MAX_SERIALIZE_SIZE) {
+            // Either a zero-length string or the string exceeds buffer size
             return false;
         }
 
-        char* str = dogecoin_malloc(len + 1);
+        char* str = strdup(in + offset);
         if (!str) {
-            return false;
+            return false; // Memory allocation failed
         }
 
-        memcpy(str, in + offset, len);
-        str[len] = '\0';
-
         if (!vector_add(vec, str)) {
-            dogecoin_free(str);
+            free(str); // Free the string if adding to the vector fails
             return false;
         }
 
-        offset += len;
+        offset += len + 1; // Move past the string and its null terminator
     }
 
     *read = offset;
diff --git a/test/address_tests.c b/test/address_tests.c
index 7961adedf..5a92a0afe 100644
--- a/test/address_tests.c
+++ b/test/address_tests.c
@@ -177,73 +177,115 @@ void test_address()
     /* test getHDNodeAndExtKeyByPath */
     dogecoin_hdnode* hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/0'/0/0", extout, true);
     u_assert_str_eq(extout, "dgpv5BeiZXttUioRMzXUhD3s2uE9F23EhAwFu9meZeY9G99YS6hJCsQ9u6PRsAG3qfVwB1T7aQTVGLsmpxMiczV1dRDgzpbUxR7utpTRmN41iV7");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/0'/0/0", extout, true), "QNvtKnf9Qi7jCRiPNsHhvibNo6P5rSHR1zsg3MvaZVomB2J3VnAG");
+    char* privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/0'/0/0", extout, true);
+    u_assert_str_eq(privkeywif, "QNvtKnf9Qi7jCRiPNsHhvibNo6P5rSHR1zsg3MvaZVomB2J3VnAG");
     u_assert_str_eq(extout, "dgpv5BeiZXttUioRMzXUhD3s2uE9F23EhAwFu9meZeY9G99YS6hJCsQ9u6PRsAG3qfVwB1T7aQTVGLsmpxMiczV1dRDgzpbUxR7utpTRmN41iV7");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/0'/0/0", extout, false);
     u_assert_str_eq(extout, "dgub8vXjuDpn2sTkerBdjSfq9kmjhaQsXHxyBkYrikw84GCYz9ozcdwvYPo5SSDWqZUVT5d4jrG8CHiGsC1M7pdETPhoKiQa92znT2vG9YaytBH");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/0'/0/0", extout, false), "QNvtKnf9Qi7jCRiPNsHhvibNo6P5rSHR1zsg3MvaZVomB2J3VnAG");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/0'/0/0", extout, false);
+    u_assert_str_eq(privkeywif, "QNvtKnf9Qi7jCRiPNsHhvibNo6P5rSHR1zsg3MvaZVomB2J3VnAG");
     u_assert_str_eq(extout, "dgub8vXjuDpn2sTkerBdjSfq9kmjhaQsXHxyBkYrikw84GCYz9ozcdwvYPo5SSDWqZUVT5d4jrG8CHiGsC1M7pdETPhoKiQa92znT2vG9YaytBH");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/0'/0/1", extout, true);
     u_assert_str_eq(extout, "dgpv5BeiZXttUioRRXS57Kd9ypkyWcV3vey1MgrSYmhaeBE54J8zerFV5mJSdZWQxpg55L13GWn4BWGMm1mPgzCp5btqBudQtoyepBECGS3pUT5");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/0'/0/1", extout, true), "QX2zKvdkWv1CbqhwTT1pmMFsxm2trhcs1C45uR8htsKTXM3Fjakd");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/0'/0/1", extout, true);
+    u_assert_str_eq(privkeywif, "QX2zKvdkWv1CbqhwTT1pmMFsxm2trhcs1C45uR8htsKTXM3Fjakd");
     u_assert_str_eq(extout, "dgpv5BeiZXttUioRRXS57Kd9ypkyWcV3vey1MgrSYmhaeBE54J8zerFV5mJSdZWQxpg55L13GWn4BWGMm1mPgzCp5btqBudQtoyepBECGS3pUT5");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/0'/0/1", extout, false);
     u_assert_str_eq(extout, "dgub8vXjuDpn2sTkiP6E9ZF86gJZyArgkmzieHdeht6ZSJH5cMFh4coFj4i6CncZQKrXobLWphRcR5fwupY9rKkR3s5L5xLAeS6WK6KyKM7pGYN");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/0'/0/1", extout, false), "QX2zKvdkWv1CbqhwTT1pmMFsxm2trhcs1C45uR8htsKTXM3Fjakd");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/0'/0/1", extout, false);
+    u_assert_str_eq(privkeywif, "QX2zKvdkWv1CbqhwTT1pmMFsxm2trhcs1C45uR8htsKTXM3Fjakd");
     u_assert_str_eq(extout, "dgub8vXjuDpn2sTkiP6E9ZF86gJZyArgkmzieHdeht6ZSJH5cMFh4coFj4i6CncZQKrXobLWphRcR5fwupY9rKkR3s5L5xLAeS6WK6KyKM7pGYN");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/0'/1/0", extout, true);
     u_assert_str_eq(extout, "dgpv5B5FdsPKQH8hK3vUo5ZR9ZXktfUxv1PStiM2TfnwH9oct5nJwAUx28356eNXoUwcNwzvfVRSDVh85aV3CQdKpQo2Vm8MKyz7KsNAXTEMbeS");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/0'/1/0", extout, true), "QUcBMYx22178giKAWQxJV6qyRT5PMiRuTCW4JkKA7FNeWpj3PwZF");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/0'/1/0", extout, true);
+    u_assert_str_eq(privkeywif, "QUcBMYx22178giKAWQxJV6qyRT5PMiRuTCW4JkKA7FNeWpj3PwZF");
     u_assert_str_eq(extout, "dgpv5B5FdsPKQH8hK3vUo5ZR9ZXktfUxv1PStiM2TfnwH9oct5nJwAUx28356eNXoUwcNwzvfVRSDVh85aV3CQdKpQo2Vm8MKyz7KsNAXTEMbeS");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/0'/1/0", extout, false);
     u_assert_str_eq(extout, "dgub8uxGyZKCxRo2buadqKBPGR5MMDrbk8RABK8EcnBv5GrdS8u1Lw2ifRSifsT3wuVRsK45b9kugWkd2cREzkJLiGvwbY5txG2dKfsY3bndC93");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/0'/1/0", extout, false), "QUcBMYx22178giKAWQxJV6qyRT5PMiRuTCW4JkKA7FNeWpj3PwZF");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/0'/1/0", extout, false);
+    u_assert_str_eq(privkeywif, "QUcBMYx22178giKAWQxJV6qyRT5PMiRuTCW4JkKA7FNeWpj3PwZF");
     u_assert_str_eq(extout, "dgub8uxGyZKCxRo2buadqKBPGR5MMDrbk8RABK8EcnBv5GrdS8u1Lw2ifRSifsT3wuVRsK45b9kugWkd2cREzkJLiGvwbY5txG2dKfsY3bndC93");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/1'/0/0", extout, true);
     u_assert_str_eq(extout, "dgpv5Ckgu5gakCr2e4PpY8K64iGqoREfmRJAACxiX4ia6AToANXgttniNLr727cgx3ceih7xdMcejLb7bkL7AE8dWKRHCCW6Bgr4ZivSjoxTF3A");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/0/0", extout, true), "QQ44Mhbq9itBVntwhraNf3E9BEUYsh2paDtE5XsHjwsWnHYWQ3Yf");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/0/0", extout, true);
+    u_assert_str_eq(privkeywif, "QQ44Mhbq9itBVntwhraNf3E9BEUYsh2paDtE5XsHjwsWnHYWQ3Yf");
     u_assert_str_eq(extout, "dgpv5Ckgu5gakCr2e4PpY8K64iGqoREfmRJAACxiX4ia6AToANXgttniNLr727cgx3ceih7xdMcejLb7bkL7AE8dWKRHCCW6Bgr4ZivSjoxTF3A");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/1'/0/0", extout, false);
     u_assert_str_eq(extout, "dgub8wdiEmcUJMWMvv3yaMw4BZpSFycJbYKsSojvgB7YtHWoiRePJfLV1eFkbM2up2rkvEeukK9ffXypdLscJKJH8MwTe8hvJcWhcMdwwjpLKmQ");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/0/0", extout, false), "QQ44Mhbq9itBVntwhraNf3E9BEUYsh2paDtE5XsHjwsWnHYWQ3Yf");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/0/0", extout, false);
+    u_assert_str_eq(privkeywif, "QQ44Mhbq9itBVntwhraNf3E9BEUYsh2paDtE5XsHjwsWnHYWQ3Yf");
     u_assert_str_eq(extout, "dgub8wdiEmcUJMWMvv3yaMw4BZpSFycJbYKsSojvgB7YtHWoiRePJfLV1eFkbM2up2rkvEeukK9ffXypdLscJKJH8MwTe8hvJcWhcMdwwjpLKmQ");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/1'/1/0", extout, true);
     u_assert_str_eq(extout, "dgpv5CnqDfc6af4vFmQ1afrYYH3SSM5wT1fXVNJuVzWBEPBB5X3oy8AFz88DawAtCcZDq6tDbJmdBTSgYPCHc3GB7sFdbbBAuyxn2vLAsKar9BT");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/1/0", extout, true), "QPa6TYKTk5qggHa8V2PaWWJUAB6TZnwgqzEqF91oKKEuExVyrykD");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/1/0", extout, true);
+    u_assert_str_eq(privkeywif, "QPa6TYKTk5qggHa8V2PaWWJUAB6TZnwgqzEqF91oKKEuExVyrykD");
     u_assert_str_eq(extout, "dgpv5CnqDfc6af4vFmQ1afrYYH3SSM5wT1fXVNJuVzWBEPBB5X3oy8AFz88DawAtCcZDq6tDbJmdBTSgYPCHc3GB7sFdbbBAuyxn2vLAsKar9BT");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/1'/1/0", extout, false);
     u_assert_str_eq(extout, "dgub8wfrZMXz8ojFYd4AcuUWf8b2tuTaH8hEmy67f6uA2WEBdaAWNti2dRXsADFSsM26nsiaPR81pZNE3Y2ws89HK46qtGifYJTb7RGzbhr8CiC");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/1/0", extout, false), "QPa6TYKTk5qggHa8V2PaWWJUAB6TZnwgqzEqF91oKKEuExVyrykD");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/1/0", extout, false);
+    u_assert_str_eq(privkeywif, "QPa6TYKTk5qggHa8V2PaWWJUAB6TZnwgqzEqF91oKKEuExVyrykD");
     u_assert_str_eq(extout, "dgub8wfrZMXz8ojFYd4AcuUWf8b2tuTaH8hEmy67f6uA2WEBdaAWNti2dRXsADFSsM26nsiaPR81pZNE3Y2ws89HK46qtGifYJTb7RGzbhr8CiC");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/1'/0/1", extout, true);
     u_assert_str_eq(extout, "dgpv5Ckgu5gakCr2g8NwFsi9aXXgBTXvzoFxwi8ybQHRmutQzYDoa8y4QD6w94EEYFtinVGD3ZzZG89t8pedriw9L8VgPYKeQsUHoZQaKcSEqwr");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/0/1", extout, true), "QPhPcYBCZPPc73Ldrdj6Ubc8SiiRqwRns6nuEqgzshiqJA6WEp62");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/0/1", extout, true);
+    u_assert_str_eq(privkeywif, "QPhPcYBCZPPc73Ldrdj6Ubc8SiiRqwRns6nuEqgzshiqJA6WEp62");
     u_assert_str_eq(extout, "dgpv5Ckgu5gakCr2g8NwFsi9aXXgBTXvzoFxwi8ybQHRmutQzYDoa8y4QD6w94EEYFtinVGD3ZzZG89t8pedriw9L8VgPYKeQsUHoZQaKcSEqwr");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/1'/0/1", extout, false);
     u_assert_str_eq(extout, "dgub8wdiEmcUJMWMxz36J7L7hP5Ge1uZpvHgEJvBkWgQa2wRYbLVyuWq3WWaiK3ZgYs893RqrgZN3QgRghPXkpRr7kdT44XVSaJuwMF1PTHi2mQ");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/0/1", extout, false), "QPhPcYBCZPPc73Ldrdj6Ubc8SiiRqwRns6nuEqgzshiqJA6WEp62");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/0/1", extout, false);
+    u_assert_str_eq(privkeywif, "QPhPcYBCZPPc73Ldrdj6Ubc8SiiRqwRns6nuEqgzshiqJA6WEp62");
     u_assert_str_eq(extout, "dgub8wdiEmcUJMWMxz36J7L7hP5Ge1uZpvHgEJvBkWgQa2wRYbLVyuWq3WWaiK3ZgYs893RqrgZN3QgRghPXkpRr7kdT44XVSaJuwMF1PTHi2mQ");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/1'/1/1", extout, true);
     u_assert_str_eq(extout, "dgpv5CnqDfc6af4vKYLZQfyGgYYVQcgkiGwqAm1qEirxruSwXwSQJoTLjSckPkbZDXRQs7X83esTtoBEmy4zr4UgJBHb8T1EMc6HYCsWgKk4JRh");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/1/1", extout, true), "QQiHajxrYwkCK1zkbmt2ZTKSQyy64jUPVbw4CDYJBchg975TRBJu");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/1/1", extout, true);
+    u_assert_str_eq(privkeywif, "QQiHajxrYwkCK1zkbmt2ZTKSQyy64jUPVbw4CDYJBchg975TRBJu");
     u_assert_str_eq(extout, "dgpv5CnqDfc6af4vKYLZQfyGgYYVQcgkiGwqAm1qEirxruSwXwSQJoTLjSckPkbZDXRQs7X83esTtoBEmy4zr4UgJBHb8T1EMc6HYCsWgKk4JRh");
+    dogecoin_free (privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
     hdnode = getHDNodeAndExtKeyByPath(masterkey_main_ext, "m/44'/3'/1'/1/1", extout, false);
     u_assert_str_eq(extout, "dgub8wfrZMXz8ojFcPziSubEoQ65sB4PYPyYTMo3PqFwf2Vx5zZ6ia17Nk2Py25c3dvq1e7ZnfBrurCS5wuagzRoBCXhJ2NeGU54NBytvuUuRyA");
-    u_assert_str_eq(getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/1/1", extout, false), "QQiHajxrYwkCK1zkbmt2ZTKSQyy64jUPVbw4CDYJBchg975TRBJu");
+    privkeywif = getHDNodePrivateKeyWIFByPath(masterkey_main_ext, "m/44'/3'/1'/1/1", extout, false);
+    u_assert_str_eq(privkeywif, "QQiHajxrYwkCK1zkbmt2ZTKSQyy64jUPVbw4CDYJBchg975TRBJu");
     u_assert_str_eq(extout, "dgub8wfrZMXz8ojFcPziSubEoQ65sB4PYPyYTMo3PqFwf2Vx5zZ6ia17Nk2Py25c3dvq1e7ZnfBrurCS5wuagzRoBCXhJ2NeGU54NBytvuUuRyA");
+    dogecoin_free(privkeywif);
+    dogecoin_hdnode_free (hdnode);
 
 #if WIN32 || USE_UNISTRING
     // mnemonic to HD keys and addresses
@@ -259,7 +301,6 @@ void test_address()
 #endif
 
     /*free up VLAs*/
-    dogecoin_hdnode_free(hdnode);
     free(masterkey_main);
     free(masterkey_test);
     free(p2pkh_master_pubkey_main);
diff --git a/test/hash_tests.c b/test/hash_tests.c
index b3280507b..9ce5387a0 100644
--- a/test/hash_tests.c
+++ b/test/hash_tests.c
@@ -116,8 +116,12 @@ void test_hash()
     dogecoin_tx_serialize(hw->cstr, tx);
     u_assert_uint64_eq(siphash_u256(1, 2, (uint256*)hw->get_hash(hw)), 0x79751e980c2a0a35ULL);
 
+    dogecoin_free(hash_in);
     dogecoin_free(hasher);
     dogecoin_free(hasher2);
     dogecoin_free(hasher3);
+    dogecoin_free(hw->ctx);
+    dogecoin_free(hw->hash);
     dogecoin_free(hw);
+    dogecoin_tx_free(tx);
 }
diff --git a/test/scrypt_tests.c b/test/scrypt_tests.c
index f3d57c372..597030bc2 100644
--- a/test/scrypt_tests.c
+++ b/test/scrypt_tests.c
@@ -15,7 +15,9 @@ void test_scrypt() {
     int i = 0;
     for (; i < HASHCOUNT; i++) {
         unsigned char inputbytes[80];
-        memcpy_safe(inputbytes, parse_hex(inputhex[i]), 80);
+        unsigned char* parsed = parse_hex(inputhex[i]);
+        memcpy_safe(inputbytes, parsed, 80);
+        dogecoin_free(parsed);
 #if defined(USE_SSE2)
         // Test SSE2 scrypt
         scrypt_1024_1_1_256_sp_sse2((const char*)&inputbytes[0], BEGIN(scrypthash), scratchpad);
diff --git a/test/vector_tests.c b/test/vector_tests.c
index b0269c1cd..adec735a9 100644
--- a/test/vector_tests.c
+++ b/test/vector_tests.c
@@ -97,7 +97,7 @@ void test_vector()
     size_t len = 15;
     size_t written = 0;
     size_t read = 0;
-    vec = vector_new(1, NULL);
+    vec = vector_new(1, free);
     res = vector_add(vec, strdup("TEST0"));
     assert(res == true);
     res = vector_add(vec, strdup("TEST1"));