diff --git a/bitcoin/script.c b/bitcoin/script.c
index 6a2e968ec..09970c89f 100644
--- a/bitcoin/script.c
+++ b/bitcoin/script.c
@@ -248,6 +248,7 @@ void bitcoin_witness_p2sh_p2wpkh(const tal_t *ctx,
 	input->script = tal_arr(ctx, u8, 0);
 	add_push_bytes(&input->script, redeemscript, tal_count(redeemscript));
 	input->script_length = tal_count(input->script);
+	tal_free(redeemscript);
 
 	/* BIP141: The witness must consist of exactly 2 items (≤ 520
 	 * bytes each). The first one a signature, and the second one
diff --git a/daemon/commit_tx.c b/daemon/commit_tx.c
index 6f4f5040b..0be4a845c 100644
--- a/daemon/commit_tx.c
+++ b/daemon/commit_tx.c
@@ -114,13 +114,14 @@ u8 *commit_output_to_them(const tal_t *ctx,
 	}
 }
 
+/* Takes ownership of script. */
 static bool add_output(struct bitcoin_tx *tx, u8 *script, u64 amount,
 		       u64 *total)
 {
 	assert(tx->output_count < tal_count(tx->output));
 	if (is_dust(amount))
 		return false;
-	tx->output[tx->output_count].script = script;
+	tx->output[tx->output_count].script = tal_steal(tx, script);
 	tx->output[tx->output_count].script_length = tal_count(script);
 	tx->output[tx->output_count].amount = amount;
 	tx->output_count++;
@@ -135,6 +136,7 @@ struct bitcoin_tx *create_commit_tx(const tal_t *ctx,
 				    enum side side,
 				    bool *otherside_only)
 {
+	const tal_t *tmpctx = tal_tmpctx(ctx);
 	struct bitcoin_tx *tx;
 	uint64_t total = 0;
 	struct htlc_map_iter it;
@@ -162,26 +164,29 @@ struct bitcoin_tx *create_commit_tx(const tal_t *ctx,
 	tx->input[0].amount = tal_dup(tx->input, u64, &peer->anchor.satoshis);
 
 	tx->output_count = 0;
-	pays_to[LOCAL] = add_output(tx, commit_output_to_us(tx, peer, rhash,
+	pays_to[LOCAL] = add_output(tx, commit_output_to_us(tmpctx, peer, rhash,
 							    side, NULL),
 				    cstate->side[LOCAL].pay_msat / 1000,
 				    &total);
 	if (pays_to[LOCAL])
 		log_debug(peer->log, "Pays %u to local: %s",
 			  cstate->side[LOCAL].pay_msat / 1000,
-			  tal_hexstr(tx, tx->output[tx->output_count-1].script,
+			  tal_hexstr(tmpctx,
+				     tx->output[tx->output_count-1].script,
 				     tx->output[tx->output_count-1].script_length));
 	else
 		log_debug(peer->log, "DOES NOT pay %u to local",
 			  cstate->side[LOCAL].pay_msat / 1000);
-	pays_to[REMOTE] = add_output(tx, commit_output_to_them(tx, peer, rhash,
-							       side, NULL),
+	pays_to[REMOTE] = add_output(tx, commit_output_to_them(tmpctx, peer,
+							       rhash, side,
+							       NULL),
 				     cstate->side[REMOTE].pay_msat / 1000,
 				     &total);
 	if (pays_to[REMOTE])
 		log_debug(peer->log, "Pays %u to remote: %s",
 			  cstate->side[REMOTE].pay_msat / 1000,
-			  tal_hexstr(tx, tx->output[tx->output_count-1].script,
+			  tal_hexstr(tmpctx,
+				     tx->output[tx->output_count-1].script,
 				     tx->output[tx->output_count-1].script_length));
 	else
 		log_debug(peer->log, "DOES NOT pay %u to remote",
@@ -198,9 +203,9 @@ struct bitcoin_tx *create_commit_tx(const tal_t *ctx,
 
 		if (!htlc_has(h, committed_flag))
 			continue;
-		wscript = wscript_for_htlc(tx, peer, h, rhash, side);
+		wscript = wscript_for_htlc(tmpctx, peer, h, rhash, side);
 		/* If we pay any HTLC, it's txout is not just to other side. */
-		if (add_output(tx, scriptpubkey_p2wsh(tx, wscript),
+		if (add_output(tx, scriptpubkey_p2wsh(tmpctx, wscript),
 			       h->msatoshi / 1000, &total)) {
 			*otherside_only = false;
 			log_debug(peer->log, "Pays %"PRIu64" to htlc %"PRIu64,
@@ -210,7 +215,8 @@ struct bitcoin_tx *create_commit_tx(const tal_t *ctx,
 			log_add_struct(peer->log, " rhash %s", struct sha256,
 				       &h->rhash);
 			log_debug(peer->log, "Script: %s",
-				  tal_hexstr(tx, wscript, tal_count(wscript)));
+				  tal_hexstr(tmpctx,
+					     wscript, tal_count(wscript)));
 		} else
 			log_debug(peer->log, "DOES NOT pay %"PRIu64" to htlc %"PRIu64,
 				  h->msatoshi / 1000, h->id);
@@ -218,5 +224,6 @@ struct bitcoin_tx *create_commit_tx(const tal_t *ctx,
 	assert(total <= peer->anchor.satoshis);
 
 	permute_outputs(tx->output, tx->output_count);
+	tal_free(tmpctx);
 	return tx;
 }
diff --git a/daemon/cryptopkt.c b/daemon/cryptopkt.c
index e0ba031b4..c5af766f0 100644
--- a/daemon/cryptopkt.c
+++ b/daemon/cryptopkt.c
@@ -188,14 +188,16 @@ static bool decrypt_in_place(void *data, size_t len,
 	return false;
 }
 
-static Pkt *decrypt_body(const tal_t *ctx, struct io_data *iod, struct log *log,
-			 struct crypto_pkt *cpkt, size_t data_len)
+static Pkt *decrypt_body(const tal_t *ctx, struct io_data *iod, struct log *log)
 {
 	struct ProtobufCAllocator prototal;
 	Pkt *ret;
+	size_t data_len = le32_to_cpu(iod->hdr_in.length);
 
-	if (!decrypt_in_place(cpkt->data, data_len,
+	if (!decrypt_in_place(iod->in.cpkt->data, data_len,
 			      &iod->in.nonce, &iod->in.enckey)) {
+		/* Free encrypted packet. */
+		iod->in.cpkt = tal_free(iod->in.cpkt);
 		log_unusual(log, "Body decryption failed");
 		return NULL;
 	}
@@ -205,7 +207,7 @@ static Pkt *decrypt_body(const tal_t *ctx, struct io_data *iod, struct log *log,
 	prototal.free = proto_tal_free;
 	prototal.allocator_data = tal(ctx, char);
 
-	ret = pkt__unpack(&prototal, data_len, cpkt->data);
+	ret = pkt__unpack(&prototal, data_len, iod->in.cpkt->data);
 	if (!ret) {
 		log_unusual(log, "Packet failed to unpack!");
 		tal_free(prototal.allocator_data);
@@ -214,11 +216,15 @@ static Pkt *decrypt_body(const tal_t *ctx, struct io_data *iod, struct log *log,
 		tal_steal(ctx, ret);
 		tal_steal(ret, prototal.allocator_data);
 
-		log_debug(log, "Received packet LEN=%u, type=%s",
-			  le32_to_cpu(iod->hdr_in.length),
+		log_debug(log, "Received packet LEN=%zu, type=%s",
+			  data_len,
 			  ret->pkt_case == PKT__PKT_AUTH ? "PKT_AUTH"
 			  : pkt_name(ret->pkt_case));
 	}
+
+	/* Free encrypted packet. */
+	iod->in.cpkt = tal_free(iod->in.cpkt);
+
 	return ret;
 }
 
@@ -249,9 +255,10 @@ static struct io_plan *recv_body(struct io_conn *conn, struct peer *peer)
 {
 	struct io_data *iod = peer->io_data;
 
+	assert(!peer->inpkt);
+
 	/* We have full packet. */
-	peer->inpkt = decrypt_body(iod, iod, peer->log, iod->in.cpkt,
-				   le32_to_cpu(iod->hdr_in.length));
+	peer->inpkt = decrypt_body(iod, iod, peer->log);
 	if (!peer->inpkt)
 		return io_close(conn);
 
@@ -326,6 +333,8 @@ struct io_plan *peer_write_packet(struct io_conn *conn,
 	tal_free(iod->out.cpkt);
 
 	iod->out.cpkt = encrypt_pkt(iod, pkt, &totlen);
+	/* Free unencrypted packet. */
+	tal_free(pkt);
 
 	return io_write(conn, iod->out.cpkt, totlen, next, peer);
 }
@@ -426,8 +435,7 @@ static struct io_plan *recv_body_negotiate(struct io_conn *conn,
 	struct pubkey id;
 
 	/* We have full packet. */
-	pkt = decrypt_body(neg, iod, neg->log, iod->in.cpkt,
-			   le32_to_cpu(iod->hdr_in.length));
+	pkt = decrypt_body(neg, iod, neg->log);
 	if (!pkt)
 		return io_close(conn);
 
@@ -627,7 +635,7 @@ struct io_plan *peer_crypto_setup_(struct io_conn *conn,
 	BUILD_ASSERT(sizeof(struct crypto_pkt) == 20);
 
 	/* We store negotiation state here. */
-	neg = tal(dstate, struct key_negotiate);
+	neg = tal(conn, struct key_negotiate);
 	neg->cb = cb;
 	neg->arg = arg;
 	neg->dstate = dstate;
diff --git a/daemon/db.c b/daemon/db.c
index 94ca4907f..f4e1e1b95 100644
--- a/daemon/db.c
+++ b/daemon/db.c
@@ -222,13 +222,14 @@ static void db_load_wallet(struct lightningd_state *dstate)
 void db_add_wallet_privkey(struct lightningd_state *dstate,
 			   const struct privkey *privkey)
 {
-	char *ctx = tal(dstate, char);
+	char *ctx = tal_tmpctx(dstate);
 
 	log_debug(dstate->base_log, "%s", __func__);
 	if (!db_exec(__func__, dstate,
 		      "INSERT INTO wallet VALUES (x'%s');",
 		     tal_hexstr(ctx, privkey, sizeof(*privkey))))
 		fatal("db_add_wallet_privkey failed");
+	tal_free(ctx);
 }
 
 static void load_peer_secrets(struct peer *peer)
@@ -236,7 +237,7 @@ static void load_peer_secrets(struct peer *peer)
 	int err;
 	sqlite3_stmt *stmt;
 	sqlite3 *sql = peer->dstate->db->sql;
-	char *ctx = tal(peer, char);
+	char *ctx = tal_tmpctx(peer);
 	const char *select;
 	bool secrets_set = false;
 
@@ -276,7 +277,7 @@ static void load_peer_anchor(struct peer *peer)
 	int err;
 	sqlite3_stmt *stmt;
 	sqlite3 *sql = peer->dstate->db->sql;
-	char *ctx = tal(peer, char);
+	char *ctx = tal_tmpctx(peer);
 	const char *select;
 	bool anchor_set = false;
 
@@ -320,7 +321,7 @@ static void load_peer_visible_state(struct peer *peer)
 	int err;
 	sqlite3_stmt *stmt;
 	sqlite3 *sql = peer->dstate->db->sql;
-	char *ctx = tal(peer, char);
+	char *ctx = tal_tmpctx(peer);
 	const char *select;
 	bool visible_set = false;
 
@@ -385,7 +386,7 @@ static void load_peer_commit_info(struct peer *peer)
 	int err;
 	sqlite3_stmt *stmt;
 	sqlite3 *sql = peer->dstate->db->sql;
-	char *ctx = tal(peer, char);
+	char *ctx = tal_tmpctx(peer);
 	const char *select;
 
 	select = tal_fmt(ctx,
@@ -492,7 +493,7 @@ static void load_peer_htlcs(struct peer *peer)
 	int err;
 	sqlite3_stmt *stmt;
 	sqlite3 *sql = peer->dstate->db->sql;
-	char *ctx = tal(peer, char);
+	char *ctx = tal_tmpctx(peer);
 	const char *select;
 	bool to_them_only, to_us_only;
 
@@ -505,13 +506,13 @@ static void load_peer_htlcs(struct peer *peer)
 		fatal("load_peer_htlcs:prepare gave %s:%s",
 		      sqlite3_errstr(err), sqlite3_errmsg(sql));
 
-	peer->local.commit->cstate = initial_cstate(peer,
+	peer->local.commit->cstate = initial_cstate(peer->local.commit,
 						    peer->anchor.satoshis,
 						    peer->local.commit_fee_rate,
 						    peer->local.offer_anchor
 						    == CMD_OPEN_WITH_ANCHOR ?
 						    LOCAL : REMOTE);
-	peer->remote.commit->cstate = initial_cstate(peer,
+	peer->remote.commit->cstate = initial_cstate(peer->remote.commit,
 						     peer->anchor.satoshis,
 						     peer->remote.commit_fee_rate,
 						     peer->local.offer_anchor
@@ -662,7 +663,7 @@ static void connect_htlc_src(struct lightningd_state *dstate)
 	sqlite3 *sql = dstate->db->sql;
 	int err;
 	sqlite3_stmt *stmt;
-	char *ctx = tal(dstate, char);
+	char *ctx = tal_tmpctx(dstate);
 	const char *select;
 
 	select = tal_fmt(ctx,
@@ -769,7 +770,7 @@ static void load_peer_shachain(struct peer *peer)
 	int err;
 	sqlite3_stmt *stmt;
 	sqlite3 *sql = peer->dstate->db->sql;
-	char *ctx = tal(peer, char);
+	char *ctx = tal_tmpctx(peer);
 	bool shachain_found = false;
 	const char *select;
 
@@ -818,7 +819,7 @@ static void load_peer_closing(struct peer *peer)
 	int err;
 	sqlite3_stmt *stmt;
 	sqlite3 *sql = peer->dstate->db->sql;
-	char *ctx = tal(peer, char);
+	char *ctx = tal_tmpctx(peer);
 	bool closing_found = false;
 	const char *select;
 
@@ -1012,7 +1013,7 @@ static void db_load_pay(struct lightningd_state *dstate)
 {
 	int err;
 	sqlite3_stmt *stmt;
-	char *ctx = tal(dstate, char);
+	char *ctx = tal_tmpctx(dstate);
 
 	err = sqlite3_prepare_v2(dstate->db->sql, "SELECT * FROM pay;", -1,
 				 &stmt, NULL);
@@ -1082,7 +1083,7 @@ static void db_load_invoice(struct lightningd_state *dstate)
 {
 	int err;
 	sqlite3_stmt *stmt;
-	char *ctx = tal(dstate, char);
+	char *ctx = tal_tmpctx(dstate);
 
 	err = sqlite3_prepare_v2(dstate->db->sql, "SELECT * FROM invoice;", -1,
 				 &stmt, NULL);
@@ -1118,7 +1119,7 @@ static void db_load_addresses(struct lightningd_state *dstate)
 	int err;
 	sqlite3_stmt *stmt;
 	sqlite3 *sql = dstate->db->sql;
-	char *ctx = tal(dstate, char);
+	char *ctx = tal_tmpctx(dstate);
 	const char *select;
 
 	select = tal_fmt(ctx, "SELECT * FROM peer_address;");
@@ -1268,7 +1269,7 @@ void db_init(struct lightningd_state *dstate)
 
 void db_set_anchor(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid;
 
 	assert(peer->dstate->db->in_transaction);
@@ -1315,7 +1316,7 @@ void db_set_anchor(struct peer *peer)
 
 bool db_set_visible_state(struct peer *peer)
 {
-	const char *errmsg, *ctx = tal(peer, char);
+	const char *errmsg, *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1343,7 +1344,7 @@ bool db_set_visible_state(struct peer *peer)
 
 void db_update_next_revocation_hash(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s):%s", __func__, peerid,
@@ -1360,7 +1361,7 @@ void db_update_next_revocation_hash(struct peer *peer)
 
 bool db_create_peer(struct peer *peer)
 {
-	const char *errmsg, *ctx = tal(peer, char);
+	const char *errmsg, *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1383,7 +1384,7 @@ bool db_create_peer(struct peer *peer)
 
 void db_start_transaction(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1397,7 +1398,7 @@ void db_start_transaction(struct peer *peer)
 
 void db_abort_transaction(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1409,7 +1410,7 @@ void db_abort_transaction(struct peer *peer)
 
 const char *db_commit_transaction(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1425,7 +1426,7 @@ const char *db_commit_transaction(struct peer *peer)
 
 void db_new_htlc(struct peer *peer, const struct htlc *htlc)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1462,7 +1463,7 @@ void db_new_htlc(struct peer *peer, const struct htlc *htlc)
 
 void db_new_feechange(struct peer *peer, const struct feechange *feechange)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1481,7 +1482,7 @@ void db_new_feechange(struct peer *peer, const struct feechange *feechange)
 void db_update_htlc_state(struct peer *peer, const struct htlc *htlc,
 			  enum htlc_state oldstate)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s): %"PRIu64" %s->%s", __func__, peerid,
@@ -1500,7 +1501,7 @@ void db_update_feechange_state(struct peer *peer,
 			       const struct feechange *f,
 			       enum htlc_state oldstate)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s): %s->%s", __func__, peerid,
@@ -1533,7 +1534,7 @@ void db_remove_feechange(struct peer *peer, const struct feechange *feechange,
 
 void db_update_state(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1547,7 +1548,7 @@ void db_update_state(struct peer *peer)
 
 void db_htlc_fulfilled(struct peer *peer, const struct htlc *htlc)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1565,7 +1566,7 @@ void db_htlc_fulfilled(struct peer *peer, const struct htlc *htlc)
 
 void db_htlc_failed(struct peer *peer, const struct htlc *htlc)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1585,7 +1586,7 @@ void db_new_commit_info(struct peer *peer, enum side side,
 			const struct sha256 *prev_rhash)
 {
 	struct commit_info *ci;
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1611,7 +1612,7 @@ void db_new_commit_info(struct peer *peer, enum side side,
 /* FIXME: Is this strictly necessary? */
 void db_remove_their_prev_revocation_hash(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1626,7 +1627,7 @@ void db_remove_their_prev_revocation_hash(struct peer *peer)
 
 void db_save_shachain(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1641,7 +1642,7 @@ void db_save_shachain(struct peer *peer)
 void db_add_commit_map(struct peer *peer,
 		       const struct sha256_double *txid, u64 commit_num)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s),commit_num=%"PRIu64, __func__, peerid,
@@ -1660,7 +1661,7 @@ void db_add_commit_map(struct peer *peer,
 bool db_add_peer_address(struct lightningd_state *dstate,
 			 const struct peer_address *addr)
 {
-	const char *ctx = tal(dstate, char);
+	const tal_t *ctx = tal_tmpctx(dstate);
 	bool ok;
 
 	log_debug(dstate->base_log, "%s", __func__);
@@ -1677,7 +1678,7 @@ bool db_add_peer_address(struct lightningd_state *dstate,
 
 void db_forget_peer(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 	size_t i;
 	const char *const tables[] = { "anchors", "htlcs", "commit_info", "shachain", "their_visible_state", "their_commitments", "peer_secrets", "closing", "peers" };
@@ -1700,7 +1701,7 @@ void db_forget_peer(struct peer *peer)
 
 void db_begin_shutdown(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1714,7 +1715,7 @@ void db_begin_shutdown(struct peer *peer)
 
 void db_set_our_closing_script(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1730,7 +1731,7 @@ void db_set_our_closing_script(struct peer *peer)
 
 bool db_set_their_closing_script(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	bool ok;
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
@@ -1751,7 +1752,7 @@ bool db_set_their_closing_script(struct peer *peer)
 /* FIXME: make caller wrap in transaction. */
 void db_update_our_closing(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
 	log_debug(peer->log, "%s(%s)", __func__, peerid);
@@ -1766,7 +1767,7 @@ void db_update_our_closing(struct peer *peer)
 
 bool db_update_their_closing(struct peer *peer)
 {
-	const char *ctx = tal(peer, char);
+	const char *ctx = tal_tmpctx(peer);
 	bool ok;
 	const char *peerid = pubkey_to_hexstr(ctx, peer->dstate->secpctx, peer->id);
 
@@ -1790,7 +1791,7 @@ bool db_new_pay_command(struct lightningd_state *dstate,
 			u64 msatoshi,
 			const struct htlc *htlc)
 {
-	const char *ctx = tal(dstate, char);
+	const tal_t *ctx = tal_tmpctx(dstate);
 	bool ok;
 
 	log_debug(dstate->base_log, "%s", __func__);
@@ -1814,7 +1815,7 @@ bool db_replace_pay_command(struct lightningd_state *dstate,
 			    u64 msatoshi,
 			    const struct htlc *htlc)
 {
-	const char *ctx = tal(dstate, char);
+	const tal_t *ctx = tal_tmpctx(dstate);
 	bool ok;
 
 	log_debug(dstate->base_log, "%s", __func__);
@@ -1835,7 +1836,7 @@ bool db_replace_pay_command(struct lightningd_state *dstate,
 void db_complete_pay_command(struct lightningd_state *dstate,
 			     const struct htlc *htlc)
 {
-	const char *ctx = tal(dstate, char);
+	const tal_t *ctx = tal_tmpctx(dstate);
 
 	log_debug(dstate->base_log, "%s", __func__);
 	log_add_struct(dstate->base_log, "(%s)", struct sha256, &htlc->rhash);
@@ -1860,7 +1861,7 @@ bool db_new_invoice(struct lightningd_state *dstate,
 		    const char *label,
 		    const struct rval *r)
 {
-	const char *ctx = tal(dstate, char);
+	const tal_t *ctx = tal_tmpctx(dstate);
 	bool ok;
 	
 	log_debug(dstate->base_log, "%s", __func__);
@@ -1881,7 +1882,7 @@ bool db_new_invoice(struct lightningd_state *dstate,
 void db_resolve_invoice(struct lightningd_state *dstate,
 			const char *label, u64 paid_num)
 {
-	const char *ctx = tal(dstate, char);
+	const tal_t *ctx = tal_tmpctx(dstate);
 
 	log_debug(dstate->base_log, "%s", __func__);
 
@@ -1895,7 +1896,7 @@ void db_resolve_invoice(struct lightningd_state *dstate,
 bool db_remove_invoice(struct lightningd_state *dstate,
 		       const char *label)
 {
-	const char *ctx = tal(dstate, char);
+	const tal_t *ctx = tal_tmpctx(dstate);
 	bool ok;
 
 	log_debug(dstate->base_log, "%s", __func__);
diff --git a/daemon/dns.c b/daemon/dns.c
index 3bfeb2629..ff9feeace 100644
--- a/daemon/dns.c
+++ b/daemon/dns.c
@@ -16,7 +16,6 @@
 #include <sys/wait.h>
 
 struct dns_async {
-	size_t use;
 	struct lightningd_state *dstate;
 	struct io_plan *(*init)(struct io_conn *, struct lightningd_state *,
 				void *);
@@ -72,11 +71,15 @@ static void lookup_and_write(int fd, const char *name, const char *port)
 
 static struct io_plan *connected(struct io_conn *conn, struct dns_async *d)
 {
-	/* No longer need to try more connections. */
+	struct io_plan *plan;
+
+	/* No longer need to try more connections via connect_failed. */
 	io_set_finish(conn, NULL, NULL);
 
-	/* Keep use count, so reap_child won't fail. */
-	return d->init(conn, d->dstate, d->arg);
+	plan = d->init(conn, d->dstate, d->arg);
+	tal_free(d);
+
+	return plan;
 }
 
 static void try_connect_one(struct dns_async *d);
@@ -100,7 +103,6 @@ static struct io_plan *init_conn(struct io_conn *conn, struct dns_async *d)
 	io_set_finish(conn, connect_failed, d);
 
 	/* That new connection owns d */
-	tal_steal(conn, d);
 	return io_connect(conn, &a, connected, d);
 }
 
@@ -132,8 +134,8 @@ static void try_connect_one(struct dns_async *d)
 	}
 
 	/* We're out of things to try.  Fail. */
-	if (--d->use == 0)
-		d->fail(d->dstate, d->arg);
+	d->fail(d->dstate, d->arg);
+	tal_free(d);
 }
 
 static struct io_plan *start_connecting(struct io_conn *conn,
@@ -141,9 +143,12 @@ static struct io_plan *start_connecting(struct io_conn *conn,
 {
 	assert(d->num_addresses);
 
-	/* reap_child and our connections can race: only last one should call
-	 * fail. */
-	d->use++;
+	/* OK, we've read all we want, child should exit. */
+	waitpid(d->pid, NULL, 0);
+
+	/* No need to call dns_lookup_failed now. */
+	io_set_finish(conn, NULL, NULL);
+
 	try_connect_one(d);
 	return io_close(conn);
 }
@@ -162,12 +167,11 @@ static struct io_plan *init_dns_conn(struct io_conn *conn, struct dns_async *d)
 		       read_addresses, d);
 }
 
-static void reap_child(struct io_conn *conn, struct dns_async *d)
+static void dns_lookup_failed(struct io_conn *conn, struct dns_async *d)
 {
 	waitpid(d->pid, NULL, 0);
-	/* Last user calls fail. */
-	if (--d->use == 0)
-		d->fail(d->dstate, d->arg);
+	d->fail(d->dstate, d->arg);
+	tal_free(d);
 }
 
 struct dns_async *dns_resolve_and_connect_(struct lightningd_state *dstate,
@@ -179,7 +183,7 @@ struct dns_async *dns_resolve_and_connect_(struct lightningd_state *dstate,
 		  void *arg)
 {
 	int pfds[2];
-	struct dns_async *d = tal(NULL, struct dns_async);
+	struct dns_async *d = tal(dstate, struct dns_async);
 	struct io_conn *conn;
 
 	d->dstate = dstate;
@@ -212,9 +216,7 @@ struct dns_async *dns_resolve_and_connect_(struct lightningd_state *dstate,
 	}
 
 	close(pfds[1]);
-	d->use = 1;
 	conn = io_new_conn(dstate, pfds[0], init_dns_conn, d);
-	io_set_finish(conn, reap_child, d);
-	tal_steal(conn, d);
+	io_set_finish(conn, dns_lookup_failed, d);
 	return d;
 }
diff --git a/daemon/feechange.c b/daemon/feechange.c
index 2991c6c90..f01d6b0d0 100644
--- a/daemon/feechange.c
+++ b/daemon/feechange.c
@@ -135,7 +135,7 @@ void feechange_changestate(struct peer *peer,
 		    || newstate == SENT_FEECHANGE_COMMIT)
 			db_new_feechange(peer, f);
 		else if (newstate == RCVD_FEECHANGE_ACK_REVOCATION
-			 || SENT_FEECHANGE_ACK_REVOCATION)
+			 || newstate == SENT_FEECHANGE_ACK_REVOCATION)
 			db_remove_feechange(peer, f, oldstate);
 		else
 			db_update_feechange_state(peer, f, oldstate);
diff --git a/daemon/invoice.c b/daemon/invoice.c
index dea17d14c..ef719f654 100644
--- a/daemon/invoice.c
+++ b/daemon/invoice.c
@@ -2,6 +2,7 @@
 #include "invoice.h"
 #include "jsonrpc.h"
 #include "lightningd.h"
+#include "utils.h"
 #include <ccan/str/hex/hex.h>
 #include <ccan/structeq/structeq.h>
 #include <ccan/tal/str/str.h>
@@ -130,8 +131,9 @@ static void json_invoice(struct command *cmd,
 	sha256(&invoice->rhash, invoice->r.r, sizeof(invoice->r.r));
 	if (find_unpaid(cmd->dstate, &invoice->rhash)
 	    || find_paid(cmd->dstate, &invoice->rhash)) {
-		command_fail(cmd, "Duplicate r value '%.*s'",
-			     r->end - r->start, buffer + r->start);
+		command_fail(cmd, "Duplicate r value '%s'",
+			     tal_hexstr(cmd, &invoice->rhash,
+					sizeof(invoice->rhash)));
 		return;
 	}
 
diff --git a/daemon/jsonrpc.c b/daemon/jsonrpc.c
index b0c119ddb..7fb2b0d27 100644
--- a/daemon/jsonrpc.c
+++ b/daemon/jsonrpc.c
@@ -33,6 +33,7 @@ static void finish_jcon(struct io_conn *conn, struct json_connection *jcon)
 		log_unusual(jcon->log, "Abandoning current command");
 		jcon->current->jcon = NULL;
 	}
+	tal_free(jcon);
 }
 
 static void json_help(struct command *cmd,
diff --git a/daemon/lightning-cli.c b/daemon/lightning-cli.c
index 8e482b7f4..a9f58f97d 100644
--- a/daemon/lightning-cli.c
+++ b/daemon/lightning-cli.c
@@ -45,6 +45,13 @@ struct timeabs controlled_time(void)
 	return time_now();
 }
 
+struct netaddr;
+char *netaddr_name(const tal_t *ctx, const struct netaddr *a);
+char *netaddr_name(const tal_t *ctx, const struct netaddr *a)
+{
+	return NULL;
+}
+
 int main(int argc, char *argv[])
 {
 	int fd, i, off;
diff --git a/daemon/log.c b/daemon/log.c
index 1fd7ef038..6d8159500 100644
--- a/daemon/log.c
+++ b/daemon/log.c
@@ -349,6 +349,8 @@ static char *to_string_(const tal_t *ctx,
 				      &u.cstate->side[LOCAL]),
 			    to_string(ctx, lr, struct channel_oneside,
 				      &u.cstate->side[REMOTE]));
+	} else if (streq(structname, "struct netaddr")) {
+		s = netaddr_name(ctx, u.netaddr);
 	}
 
 	return s;
@@ -358,7 +360,7 @@ void log_struct_(struct log *log, int level,
 		 const char *structname,
 		 const char *fmt, ...)
 {
-	tal_t *ctx = tal(log, char);
+	const tal_t *ctx = tal_tmpctx(log);
 	char *s;
 	union loggable_structs u;
 	va_list ap;
diff --git a/daemon/log.h b/daemon/log.h
index 9d54c2092..f1eb78593 100644
--- a/daemon/log.h
+++ b/daemon/log.h
@@ -90,6 +90,7 @@ union loggable_structs {
 	const struct rval *rval;
 	const struct channel_state *cstate;
 	const struct channel_oneside *channel_oneside;
+	const struct netaddr *netaddr;
 	const char *charp_;
 };
 
diff --git a/daemon/packets.c b/daemon/packets.c
index 046595e22..bc6ee73b0 100644
--- a/daemon/packets.c
+++ b/daemon/packets.c
@@ -367,17 +367,14 @@ Pkt *accept_pkt_anchor(struct peer *peer, const Pkt *pkt)
 }
 
 Pkt *accept_pkt_open_commit_sig(struct peer *peer, const Pkt *pkt,
-				struct bitcoin_signature **sig)
+				struct bitcoin_signature *sig)
 {
 	const OpenCommitSig *s = pkt->open_commit_sig;
-	struct signature signature;
 
-	if (!proto_to_signature(peer->dstate->secpctx, s->sig, &signature))
+	if (!proto_to_signature(peer->dstate->secpctx, s->sig, &sig->sig))
 		return pkt_err(peer, "Malformed signature");
 
-	*sig = tal(peer, struct bitcoin_signature);	
-	(*sig)->stype = SIGHASH_ALL;
-	(*sig)->sig = signature;	
+	sig->stype = SIGHASH_ALL;
 	return NULL;
 }
 
diff --git a/daemon/packets.h b/daemon/packets.h
index 111fe1c7a..9e34c017c 100644
--- a/daemon/packets.h
+++ b/daemon/packets.h
@@ -38,7 +38,7 @@ Pkt *accept_pkt_open(struct peer *peer, const Pkt *pkt,
 Pkt *accept_pkt_anchor(struct peer *peer, const Pkt *pkt);
 
 Pkt *accept_pkt_open_commit_sig(struct peer *peer, const Pkt *pkt,
-				struct bitcoin_signature **sig);
+				struct bitcoin_signature *sig);
 
 Pkt *accept_pkt_open_complete(struct peer *peer, const Pkt *pkt);
 	
diff --git a/daemon/pay.c b/daemon/pay.c
index 25f936354..c77363d01 100644
--- a/daemon/pay.c
+++ b/daemon/pay.c
@@ -241,7 +241,8 @@ static void json_getroute(struct command *cmd,
 		return;
 	}
 
-	peer = find_route(cmd->dstate, &id, msatoshi, riskfactor, &fee, &route);
+	peer = find_route(cmd, cmd->dstate, &id, msatoshi, riskfactor,
+			  &fee, &route);
 	if (!peer) {
 		command_fail(cmd, "no route found");
 		return;
diff --git a/daemon/peer.c b/daemon/peer.c
index ba1dd1d04..be6eafc50 100644
--- a/daemon/peer.c
+++ b/daemon/peer.c
@@ -546,20 +546,20 @@ static void their_htlc_added(struct peer *peer, struct htlc *htlc,
 	packet = parse_onionpacket(peer, peer->dstate->secpctx,
 				   htlc->routing, tal_count(htlc->routing));
 	if (packet)
-		step = process_onionpacket(peer, peer->dstate->secpctx, packet, &pk);
+		step = process_onionpacket(packet, peer->dstate->secpctx, packet, &pk);
 
 	if (!step) {
 		log_unusual(peer->log, "Bad onion, failing HTLC %"PRIu64,
 			    htlc->id);
 		command_htlc_set_fail(peer, htlc, BAD_REQUEST_400,
 				      "invalid onion");
-		return;
+		goto free_packet;
 	}
 
 	switch (step->nextcase) {
 	case ONION_END:
 		if (only_dest)
-			return;
+			goto free_packet;
 		invoice = find_unpaid(peer->dstate, &htlc->rhash);
 		if (!invoice) {
 			log_unusual(peer->log, "No invoice for HTLC %"PRIu64,
@@ -570,7 +570,7 @@ static void their_htlc_added(struct peer *peer, struct htlc *htlc,
 				command_htlc_set_fail(peer, htlc,
 						      UNAUTHORIZED_401,
 						      "unknown rhash");
-			goto free_rest;
+			goto free_packet;
 		}
 			
 		if (htlc->msatoshi != invoice->msatoshi) {
@@ -583,7 +583,7 @@ static void their_htlc_added(struct peer *peer, struct htlc *htlc,
 			command_htlc_set_fail(peer, htlc,
 					      UNAUTHORIZED_401,
 					      "incorrect amount");
-			return;
+			goto free_packet;
 		}
 
 		log_info(peer->log, "Immediately resolving '%s' HTLC %"PRIu64,
@@ -592,22 +592,22 @@ static void their_htlc_added(struct peer *peer, struct htlc *htlc,
 		resolve_invoice(peer->dstate, invoice);
 		set_htlc_rval(peer, htlc, &invoice->r);
 		command_htlc_fulfill(peer, htlc);
-		goto free_rest;
+		goto free_packet;
 
 	case ONION_FORWARD:
 		printf("FORWARDING %lu\n", step->hoppayload->amount);
 		route_htlc_onwards(peer, htlc, step->hoppayload->amount, step->next->nexthop,
 				   serialize_onionpacket(step, peer->dstate->secpctx, step->next), only_dest);
-		goto free_rest;
+		goto free_packet;
 	default:
 		log_info(peer->log, "Unknown step type %u", step->nextcase);
 		command_htlc_set_fail(peer, htlc, VERSION_NOT_SUPPORTED_505,
 				      "unknown step type");
-		goto free_rest;
+		goto free_packet;
 	}
 
-free_rest:
-	tal_free(step);
+free_packet:
+	tal_free(packet);
 }
 
 static void our_htlc_failed(struct peer *peer, struct htlc *htlc)
@@ -2145,6 +2145,8 @@ static struct io_plan *init_pkt_in(struct io_conn *conn, struct peer *peer)
 	}
 
 	/* Back into normal mode. */
+	peer->inpkt = tal_free(peer->inpkt);
+
 	peer_has_connected(peer);
 	return io_duplex(conn,
 			 peer_read_packet(conn, peer, pkt_in),
@@ -2432,6 +2434,7 @@ struct peer *new_peer(struct lightningd_state *dstate,
 	peer->io_data = NULL;
 	peer->secrets = NULL;
 	list_head_init(&peer->watches);
+	peer->inpkt = NULL;
 	peer->outpkt = tal_arr(peer, Pkt *, 0);
 	peer->open_jsoncmd = NULL;
 	peer->commit_jsoncmd = NULL;
@@ -2656,8 +2659,6 @@ static struct io_plan *crypto_on_out(struct io_conn *conn,
 			     connect->name, connect->port);
 		return io_close(conn);
 	}
-	peer->io_data = tal_steal(peer, iod);
-	peer->id = tal_dup(peer, struct pubkey, id);
 	peer->anchor.input = tal_steal(peer, connect->input);
 	peer->open_jsoncmd = connect->cmd;
 	return peer_crypto_on(conn, peer);
@@ -2668,7 +2669,6 @@ static struct io_plan *peer_connected_out(struct io_conn *conn,
 					  struct json_connecting *connect)
 {
 	struct log *l;
-	const char *name;
 	struct netaddr addr;
 
 	l = new_log(conn, dstate->log_record, "OUT-%s:%s:",
@@ -2678,9 +2678,8 @@ static struct io_plan *peer_connected_out(struct io_conn *conn,
 		log_unusual(l, "Failed to get netaddr: %s", strerror(errno));
 		return io_close(conn);
 	}
-	name = netaddr_name(conn, &addr);
 
-	log_debug(l, "Connected out to %s", name);
+	log_debug_struct(l, "Connected out to %s", struct netaddr, &addr);
 	return peer_crypto_setup(conn, dstate, NULL, l, crypto_on_out, connect);
 }
 
@@ -2857,6 +2856,7 @@ static void json_connect(struct command *cmd,
 	struct bitcoin_tx *tx;
 	int output;
 	size_t txhexlen;
+	const tal_t *tmpctx = tal_tmpctx(cmd);
 
 	if (!json_get_params(buffer, params,
 			     "host", &host,
@@ -2876,8 +2876,7 @@ static void json_connect(struct command *cmd,
 	connect->input = tal(connect, struct anchor_input);
 
 	txhexlen = txtok->end - txtok->start;
-	tx = bitcoin_tx_from_hex(connect->input, buffer + txtok->start,
-				 txhexlen);
+	tx = bitcoin_tx_from_hex(tmpctx, buffer + txtok->start, txhexlen);
 	if (!tx) {
 		command_fail(cmd, "'%.*s' is not a valid transaction",
 			     txtok->end - txtok->start,
@@ -2912,6 +2911,8 @@ static void json_connect(struct command *cmd,
 		command_fail(cmd, "DNS failed");
 		return;
 	}
+
+	tal_free(tmpctx);
 }
 
 const struct json_command connect_command = {
@@ -4071,16 +4072,16 @@ bool setup_first_commit(struct peer *peer)
 	assert(!peer->remote.commit->tx);
 
 	/* Revocation hashes already filled in, from pkt_open */
-	peer->local.commit->cstate = initial_cstate(peer,
-						     peer->anchor.satoshis,
-						     peer->local.commit_fee_rate,
-						     peer->local.offer_anchor
-						     == CMD_OPEN_WITH_ANCHOR ?
-						     LOCAL : REMOTE);
+	peer->local.commit->cstate = initial_cstate(peer->local.commit,
+						    peer->anchor.satoshis,
+						    peer->local.commit_fee_rate,
+						    peer->local.offer_anchor
+						    == CMD_OPEN_WITH_ANCHOR ?
+						    LOCAL : REMOTE);
 	if (!peer->local.commit->cstate)
 		return false;
 
-	peer->remote.commit->cstate = initial_cstate(peer,
+	peer->remote.commit->cstate = initial_cstate(peer->remote.commit,
 						     peer->anchor.satoshis,
 						     peer->remote.commit_fee_rate,
 						     peer->local.offer_anchor
diff --git a/daemon/routing.c b/daemon/routing.c
index 0b42f9039..c31a8a14f 100644
--- a/daemon/routing.c
+++ b/daemon/routing.c
@@ -21,7 +21,7 @@ static const secp256k1_pubkey *keyof_node(const struct node *n)
 
 static size_t hash_key(const secp256k1_pubkey *key)
 {
-	return siphash24(siphash_seed(), key, sizeof(key));
+	return siphash24(siphash_seed(), key, sizeof(*key));
 }
 
 static bool node_eq(const struct node *n, const secp256k1_pubkey *key)
@@ -274,7 +274,8 @@ static void bfg_one_edge(struct node *node, size_t edgenum, double riskfactor)
 	}
 }
 
-struct peer *find_route(struct lightningd_state *dstate,
+struct peer *find_route(const tal_t *ctx,
+			struct lightningd_state *dstate,
 			const struct pubkey *to,
 			u64 msatoshi,
 			double riskfactor,
@@ -351,15 +352,6 @@ struct peer *find_route(struct lightningd_state *dstate,
 	dst = dst->bfg[best].prev->dst;
 	best--;
 
-	*fee = dst->bfg[best].total - msatoshi;
-	*route = tal_arr(dstate, struct node_connection *, best);
-	for (i = 0, n = dst;
-	     i < best;
-	     n = n->bfg[best-i].prev->dst, i++) {
-		(*route)[i] = n->bfg[best-i].prev;
-	}
-	assert(n == src);
-
 	/* We should only add routes if we have a peer. */
 	first = find_peer(dstate, &dst->id);
 	if (!first) {
@@ -368,6 +360,15 @@ struct peer *find_route(struct lightningd_state *dstate,
 		return NULL;
 	}
 
+	*fee = dst->bfg[best].total - msatoshi;
+	*route = tal_arr(ctx, struct node_connection *, best);
+	for (i = 0, n = dst;
+	     i < best;
+	     n = n->bfg[best-i].prev->dst, i++) {
+		(*route)[i] = n->bfg[best-i].prev;
+	}
+	assert(n == src);
+
 	msatoshi += *fee;
 	log_info(dstate->base_log, "find_route:");
 	log_add_struct(dstate->base_log, "via %s", struct pubkey, first->id);
diff --git a/daemon/routing.h b/daemon/routing.h
index 9523296e6..25b537c59 100644
--- a/daemon/routing.h
+++ b/daemon/routing.h
@@ -70,7 +70,8 @@ struct node_connection *add_connection(struct lightningd_state *dstate,
 void remove_connection(struct lightningd_state *dstate,
 		       const struct pubkey *src, const struct pubkey *dst);
 
-struct peer *find_route(struct lightningd_state *dstate,
+struct peer *find_route(const tal_t *ctx,
+			struct lightningd_state *dstate,
 			const struct pubkey *to,
 			u64 msatoshi,
 			double riskfactor,
diff --git a/daemon/sphinx.c b/daemon/sphinx.c
index 725d0abde..c2846c98b 100644
--- a/daemon/sphinx.c
+++ b/daemon/sphinx.c
@@ -91,12 +91,12 @@ struct onionpacket *parse_onionpacket(
 	read_buffer(&m->version, src, 1, &p);
 	if (m->version != 0x01) {
 		// FIXME add logging
-		return NULL;
+		return tal_free(m);
 	}
 	read_buffer(rawEphemeralkey, src, 33, &p);
 
 	if (secp256k1_ec_pubkey_parse(secpctx, &m->ephemeralkey, rawEphemeralkey, 33) != 1)
-		return NULL;
+		return tal_free(m);
 
 	read_buffer(&m->mac, src, 20, &p);
 	read_buffer(&m->routinginfo, src, ROUTING_INFO_SIZE, &p);
@@ -478,7 +478,7 @@ struct route_step *process_onionpacket(
 	u8 stream[NUM_STREAM_BYTES];
 	u8 paddedheader[ROUTING_INFO_SIZE + 2 * SECURITY_PARAMETER];
 
-	step->next = talz(ctx, struct onionpacket);
+	step->next = talz(step, struct onionpacket);
 	step->next->version = msg->version;
 	create_shared_secret(secpctx, secret, &msg->ephemeralkey, hop_privkey->secret);
 	generate_key_set(secret, &keys);
@@ -487,7 +487,7 @@ struct route_step *process_onionpacket(
 
 	if (memcmp(msg->mac, hmac, sizeof(hmac)) != 0) {
 		warnx("Computed MAC does not match expected MAC, the message was modified.");
-		return NULL;
+		return tal_free(step);
 	}
 
 	//FIXME:store seen secrets to avoid replay attacks
@@ -509,7 +509,7 @@ struct route_step *process_onionpacket(
 
 	compute_blinding_factor(secpctx, &msg->ephemeralkey, secret, blind);
 	if (!blind_group_element(secpctx, &step->next->ephemeralkey, &msg->ephemeralkey, blind))
-		return NULL;
+		return tal_free(step);
 	memcpy(&step->next->nexthop, paddedheader, SECURITY_PARAMETER);
 	memcpy(&step->next->mac,
 	       paddedheader + SECURITY_PARAMETER,
diff --git a/daemon/timeout.c b/daemon/timeout.c
index 8f842cd73..43bd2ecbc 100644
--- a/daemon/timeout.c
+++ b/daemon/timeout.c
@@ -1,6 +1,7 @@
 #include "controlled_time.h"
 #include "lightningd.h"
 #include "timeout.h"
+#include "utils.h"
 
 struct oneshot {
 	struct lightningd_state *dstate;
@@ -44,9 +45,10 @@ struct oneshot *new_reltimer_(struct lightningd_state *dstate,
 void timer_expired(struct lightningd_state *dstate, struct timer *timer)
 {
 	struct oneshot *t = container_of(timer, struct oneshot, timer);
-	tal_t *tmpctx = tal(dstate, char);
+	const tal_t *tmpctx = tal_tmpctx(dstate);
 
 	/* If it doesn't free itself, freeing tmpctx will do it */
 	tal_steal(tmpctx, t);
 	t->cb(t->arg);
+	tal_free(tmpctx);
 }
diff --git a/state.c b/state.c
index a9475a7ce..ff95d2a9c 100644
--- a/state.c
+++ b/state.c
@@ -180,8 +180,11 @@ enum state state(struct peer *peer,
 	case STATE_OPEN_WAIT_FOR_COMMIT_SIG:
 		if (input_is(input, PKT_OPEN_COMMIT_SIG)) {
 			const char *db_err;
+
+			peer->local.commit->sig = tal(peer->local.commit,
+						      struct bitcoin_signature);
 			err = accept_pkt_open_commit_sig(peer, pkt,
-							 &peer->local.commit->sig);
+							 peer->local.commit->sig);
 			if (!err &&
 			    !check_tx_sig(peer->dstate->secpctx,
 					  peer->local.commit->tx, 0,
@@ -192,6 +195,8 @@ enum state state(struct peer *peer,
 				err = pkt_err(peer, "Bad signature");
 
 			if (err) {
+				peer->local.commit->sig
+					= tal_free(peer->local.commit->sig);
 				bitcoin_release_anchor(peer, INPUT_NONE);
 				peer_open_complete(peer, err->error->problem);
 				goto err_breakdown;
diff --git a/test/test_protocol.c b/test/test_protocol.c
index c41cbd62f..b1617dc83 100644
--- a/test/test_protocol.c
+++ b/test/test_protocol.c
@@ -1,5 +1,6 @@
 /* Simple simulator for protocol. */
 #include "config.h"
+#include "utils.h"
 #include <assert.h>
 #include <ccan/array_size/array_size.h>
 #include <ccan/err/err.h>
@@ -412,7 +413,7 @@ static void dump_htlcs(struct htlc **htlcs,
 		       int flags_inc, int flags_exc)
 {
 	size_t i, n = tal_count(htlcs);
-	char *ctx = tal(htlcs, char);
+	const tal_t *ctx = tal_tmpctx(htlcs);
 	bool printed = false;
 
 	for (i = 0; i < n; i++) {
diff --git a/test/test_state_coverage.c b/test/test_state_coverage.c
index a9dd9d6b7..0c8a2ea0a 100644
--- a/test/test_state_coverage.c
+++ b/test/test_state_coverage.c
@@ -1815,7 +1815,7 @@ static void try_input(const struct peer *peer,
 	const char *problem;
 	Pkt *output;
 	const struct bitcoin_tx *broadcast;
-	const tal_t *ctx = tal(NULL, char);
+	const tal_t *ctx = tal_tmpctx(NULL);
 	enum command_status cstatus;
 
 	copy_peers(&copy, &other, peer);
@@ -2220,7 +2220,7 @@ static enum state_input **map_inputs(void)
 {
 	enum state_input **inps = tal_arr(NULL, enum state_input *, STATE_MAX);
 	unsigned int i;
-	const tal_t *ctx = tal(NULL, char);
+	const tal_t *ctx = tal_tmpctx(NULL);
 
 	for (i = 0; i < STATE_MAX; i++) {
 		/* This is a global */
diff --git a/utils.h b/utils.h
index 0fac3c7c8..cf6d0492a 100644
--- a/utils.h
+++ b/utils.h
@@ -10,4 +10,8 @@ char *tal_hexstr(const tal_t *ctx, const void *data, size_t len);
 /* Allocate and fill a buffer with the data of this hex string. */
 u8 *tal_hexdata(const tal_t *ctx, const void *str, size_t len);
 
+#define tal_tmpctx(ctx)							\
+	tal_alloc_((ctx), 0, false,					\
+		   __FILE__ ":" stringify(__LINE__) ":tal_tmpctx")
+
 #endif /* LIGHTNING_UTILS_H */