diff --git a/cocos/platform/CCApplication.h b/cocos/platform/CCApplication.h
index 3665ad9..a87cf3c 100644
--- a/cocos/platform/CCApplication.h
+++ b/cocos/platform/CCApplication.h
@@ -116,15 +116,27 @@ public:
   inline char* getTmpPass() {return tmp_pass;}
   inline char* getKeySeed() {return key_seed;}
   void setKeyMaster(const char *val) {
+    if (key_master != nullptr) {
+      free(key_master);
+    }
     key_master = strdup(val);
   }
   void setKeySecond(const char *val) {
+    if (key_second != nullptr) {
+      free(key_second);
+    }
     key_second = strdup(val);
   }
   void setTmpPass(const char *val) {
+    if (tmp_pass != nullptr) {
+      free(tmp_pass);
+    }
     tmp_pass = strdup(val);
   }
   void setKeySeed(const char *val) {
+    if (key_seed != nullptr) {
+      free(key_seed);
+    }
     key_seed = strdup(val);
   }
   
diff --git a/cocos/scripting/js-bindings/manual/jsb_global.cpp b/cocos/scripting/js-bindings/manual/jsb_global.cpp
index 61aee70..a509d54 100644
--- a/cocos/scripting/js-bindings/manual/jsb_global.cpp
+++ b/cocos/scripting/js-bindings/manual/jsb_global.cpp
@@ -1282,16 +1282,19 @@ static bool JSB_prepareWallet(se::State &s)
     std::string pass;
     ok = seval_to_std_string(args[4], &pass);
     SE_PRECONDITION2(ok, false, "Error processing pass");
-    std::string localSKey = generate_client_key(pass.c_str(), openid.c_str(), salt.c_str());
+    auto localSKey = generate_client_key(pass.c_str(), openid.c_str(), salt.c_str());
     Application::getInstance()->setKeyMaster(keyMaster.c_str());
-    Application::getInstance()->setKeySecond(localSKey.c_str());
-    std::string seed = keccak256_hash((id + openid + salt).c_str());
-    Application::getInstance()->setKeySeed(seed.c_str());
-    std::string address = get_address(
+    Application::getInstance()->setKeySecond(localSKey);
+    free_cstr(localSKey);
+    auto seed = keccak256_hash((id + openid + salt).c_str());
+    Application::getInstance()->setKeySeed(seed);
+    free_cstr(seed);
+    auto address = get_address(
         Application::getInstance()->getKeySeed(),
         Application::getInstance()->getKeyMaster(),
         Application::getInstance()->getKeySecond());
     s.rval().setString(address);
+    free_cstr(address);
     return true;
   }
 
@@ -1322,21 +1325,25 @@ static bool JSB_walletSecKey(se::State &s)
     std::string pass;
     ok = seval_to_std_string(args[4], &pass);
     SE_PRECONDITION2(ok, false, "Error processing pass");
-    std::string localSKey = generate_client_key(pass.c_str(), openid.c_str(), salt.c_str());
-    std::string seed = keccak256_hash((id + openid + salt).c_str());
-    std::string address = get_address(
-        seed.c_str(),
+    auto localSKey = generate_client_key(pass.c_str(), openid.c_str(), salt.c_str());
+    auto seed = keccak256_hash((id + openid + salt).c_str());
+    auto address = get_address(
+        seed,
         keyMaster.c_str(),
-        localSKey.c_str());
-    std::string key_str = generate_sec_key(
-        seed.c_str(),
+        localSKey);
+    auto key_str = generate_sec_key(
+        seed,
         keyMaster.c_str(),
-        localSKey.c_str());
+        localSKey);
     std::string result = StringUtils::format("{\"address\": \"%s\",\"key\": \"%s\"}\n",
-                                             address.c_str(),
-                                             key_str.c_str());
+                                             address,
+                                             key_str);
 
     s.rval().setString(result);
+    free_cstr(localSKey);
+    free_cstr(seed);
+    free_cstr(address);
+    free_cstr(key_str);
     return true;
   }
 
@@ -1355,8 +1362,9 @@ static bool JSB_hashSvrPass(se::State &s)
     std::string pass;
     ok = seval_to_std_string(args[0], &pass);
     SE_PRECONDITION2(ok, false, "Error processing pass");
-    std::string hashstr = hash_pass_svr(pass.c_str());
+    auto hashstr = hash_pass_svr(pass.c_str());
     s.rval().setString(hashstr);
+    free_cstr(hashstr);
     return true;
   }
 
@@ -1375,12 +1383,13 @@ static bool JSB_walletSign(se::State &s)
     std::string msg;
     ok = seval_to_std_string(args[0], &msg);
     SE_PRECONDITION2(ok, false, "Error processing seed");
-    std::string sign_str = sign(
+    auto sign_str = sign(
         Application::getInstance()->getKeySeed(),
         Application::getInstance()->getKeyMaster(),
         Application::getInstance()->getKeySecond(),
         msg.c_str());
     s.rval().setString(sign_str);
+    free_cstr(sign_str);
     return true;
   }
 
@@ -1406,8 +1415,9 @@ static bool JSB_preRegistClient(se::State &s)
       value = ramdonKey();
       store_encrypt_item(key, value);
     }
-    string result = simple_sign(msg.c_str(), value.c_str());
+    auto result = simple_sign(msg.c_str(), value.c_str());
     s.rval().setString(result);
+    free_cstr(result);
     return true;
   }
 
@@ -1449,9 +1459,10 @@ static bool JSB_parseRelayAESKey(se::State &s)
     ok = load_encrypt_item("relay_rsa_sk", &sk_rsa);
     SE_PRECONDITION2(ok, false, "No local RSA private key found");
 
-    string key_aes = rsa_decrypt(key_encrypted.c_str(), sk_rsa.c_str());
-    CCLOG("aes key: %s", key_aes.c_str());
+    auto key_aes = rsa_decrypt(key_encrypted.c_str(), sk_rsa.c_str());
+    CCLOG("aes key: %s", key_aes);
     store_encrypt_item("relay_aes_key", key_aes);
+    free_cstr(key_aes);
     return true;
   }
 
@@ -1528,12 +1539,13 @@ static bool JSB_walletSignTran(se::State &s)
     std::string msg;
     ok = seval_to_std_string(args[0], &msg);
     SE_PRECONDITION2(ok, false, "Error processing seed");
-    std::string sign_str = sign_for_tran(
+    auto sign_str = sign_for_tran(
         Application::getInstance()->getKeySeed(),
         Application::getInstance()->getKeyMaster(),
         Application::getInstance()->getKeySecond(),
         msg.c_str());
     s.rval().setString(sign_str);
+    free_cstr(sign_str);
     //        free_cwallet(wallet);
     return true;
   }
@@ -1553,8 +1565,9 @@ static bool JSB_hexDeflate(se::State &s)
     std::string value;
     ok = seval_to_std_string(args[0], &value);
     SE_PRECONDITION2(ok, false, "Error processing arguments");
-    std::string result = hex_deflate(value.c_str());
+    auto result = hex_deflate(value.c_str());
     s.rval().setString(result);
+    free_cstr(result);
     return true;
   }
   SE_REPORT_ERROR("wrong number of arguments: %d, was expecting %d", (int)argc, 1);
@@ -1572,8 +1585,9 @@ static bool JSB_hexInflate(se::State &s)
     std::string value;
     ok = seval_to_std_string(args[0], &value);
     SE_PRECONDITION2(ok, false, "Error processing arguments");
-    std::string result = hex_inflate(value.c_str());
+    auto result = hex_inflate(value.c_str());
     s.rval().setString(result);
+    free_cstr(result);
     return true;
   }
   SE_REPORT_ERROR("wrong number of arguments: %d, was expecting %d", (int)argc, 1);
@@ -1591,12 +1605,13 @@ static bool JSB_walletEncrypt(se::State &s)
     std::string msg;
     ok = seval_to_std_string(args[0], &msg);
     SE_PRECONDITION2(ok, false, "Error processing msg");
-    std::string str_encrypt = wallet_encrypt(
+    auto str_encrypt = wallet_encrypt(
         Application::getInstance()->getKeySeed(),
         Application::getInstance()->getKeyMaster(),
         Application::getInstance()->getKeySecond(),
         msg.c_str());
     s.rval().setString(str_encrypt);
+    free_cstr(str_encrypt);
     return true;
   }
 
@@ -1618,10 +1633,11 @@ static bool JSB_rencrypt(se::State &s)
     std::string msg;
     ok = seval_to_std_string(args[1], &msg);
     SE_PRECONDITION2(ok, false, "Error processing msg");
-    std::string str_encrypt = rencrypt(
+    auto str_encrypt = rencrypt(
         pk.c_str(),
         msg.c_str());
     s.rval().setString(str_encrypt);
+    free_cstr(str_encrypt);
     return true;
   }
 
@@ -1640,12 +1656,13 @@ static bool JSB_walletDecrypt(se::State &s)
     std::string msg;
     ok = seval_to_std_string(args[0], &msg);
     SE_PRECONDITION2(ok, false, "Error processing seed");
-    std::string str_encrypt = wallet_decrypt(
+    auto str_encrypt = wallet_decrypt(
         Application::getInstance()->getKeySeed(),
         Application::getInstance()->getKeyMaster(),
         Application::getInstance()->getKeySecond(),
         msg.c_str());
     s.rval().setString(str_encrypt);
+    free_cstr(str_encrypt);
     return true;
   }
 
@@ -1656,8 +1673,9 @@ SE_BIND_FUNC(JSB_walletDecrypt)
 
 void store_encrypt_item(string key, string value) {
   string pk = getpk();
-  string str_encrypt = aes_encrypt(value.c_str(), pk.c_str());
+  auto str_encrypt = aes_encrypt(value.c_str(), pk.c_str());
   localStorageSetItem(key, str_encrypt);
+  free_cstr(str_encrypt);
 }
 
 bool load_encrypt_item(string key, string *value) {
diff --git a/external/ios/include/rustwallet/rustwallet.h b/external/ios/include/rustwallet/rustwallet.h
index 8fdd151..8dfba10 100644
--- a/external/ios/include/rustwallet/rustwallet.h
+++ b/external/ios/include/rustwallet/rustwallet.h
@@ -57,3 +57,5 @@ char *rsa_key_pair(void);
 char *rsa_encrypt(const char *content, const char *p_key);
 
 char *rsa_decrypt(const char *content, const char *s_key);
+
+void free_cstr(char *s);
diff --git a/external/ios/libs/librustwallet.a b/external/ios/libs/librustwallet.a
index 8f112df..fce88fd 100644
Binary files a/external/ios/libs/librustwallet.a and b/external/ios/libs/librustwallet.a differ