diff --git a/src/test/fuzz/CMakeLists.txt b/src/test/fuzz/CMakeLists.txt
--- a/src/test/fuzz/CMakeLists.txt
+++ b/src/test/fuzz/CMakeLists.txt
@@ -103,6 +103,8 @@
 	psbt
 	script
 	script_flags
+	script_ops
+	scriptnum_ops
 	spanparsing
 	strprintf
 	timedata
diff --git a/src/test/fuzz/bloom_filter.cpp b/src/test/fuzz/bloom_filter.cpp
--- a/src/test/fuzz/bloom_filter.cpp
+++ b/src/test/fuzz/bloom_filter.cpp
@@ -28,7 +28,7 @@
     while (fuzzed_data_provider.remaining_bytes() > 0) {
         switch (fuzzed_data_provider.ConsumeIntegralInRange(0, 4)) {
             case 0: {
-                const std::vector<uint8_t> &b =
+                const std::vector<uint8_t> b =
                     ConsumeRandomLengthByteVector(fuzzed_data_provider);
                 (void)bloom_filter.contains(b);
                 bloom_filter.insert(b);
diff --git a/src/test/fuzz/rolling_bloom_filter.cpp b/src/test/fuzz/rolling_bloom_filter.cpp
--- a/src/test/fuzz/rolling_bloom_filter.cpp
+++ b/src/test/fuzz/rolling_bloom_filter.cpp
@@ -24,7 +24,7 @@
     while (fuzzed_data_provider.remaining_bytes() > 0) {
         switch (fuzzed_data_provider.ConsumeIntegralInRange(0, 2)) {
             case 0: {
-                const std::vector<uint8_t> &b =
+                const std::vector<uint8_t> b =
                     ConsumeRandomLengthByteVector(fuzzed_data_provider);
                 (void)rolling_bloom_filter.contains(b);
                 rolling_bloom_filter.insert(b);
diff --git a/src/test/fuzz/script_ops.cpp b/src/test/fuzz/script_ops.cpp
new file mode 100644
--- /dev/null
+++ b/src/test/fuzz/script_ops.cpp
@@ -0,0 +1,63 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/script.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+void test_one_input(const std::vector<uint8_t> &buffer) {
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+    CScript script = ConsumeScript(fuzzed_data_provider);
+    while (fuzzed_data_provider.remaining_bytes() > 0) {
+        switch (fuzzed_data_provider.ConsumeIntegralInRange(0, 7)) {
+            case 0:
+                script += ConsumeScript(fuzzed_data_provider);
+                break;
+            case 1:
+                script = script + ConsumeScript(fuzzed_data_provider);
+                break;
+            case 2:
+                script << fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                break;
+            case 3:
+                script << ConsumeOpcodeType(fuzzed_data_provider);
+                break;
+            case 4:
+                script << ConsumeScriptNum(fuzzed_data_provider);
+                break;
+            case 5:
+                script << ConsumeRandomLengthByteVector(fuzzed_data_provider);
+                break;
+            case 6:
+                script.clear();
+                break;
+            case 7: {
+                (void)script.IsWitnessProgram();
+                (void)script.HasValidOps();
+                (void)script.IsPayToScriptHash();
+                (void)script.IsPushOnly();
+                (void)script.IsUnspendable();
+                {
+                    CScript::const_iterator pc = script.begin();
+                    opcodetype opcode;
+                    (void)script.GetOp(pc, opcode);
+                    std::vector<uint8_t> data;
+                    (void)script.GetOp(pc, opcode, data);
+                    (void)script.IsPushOnly(pc);
+                }
+                {
+                    int version;
+                    std::vector<uint8_t> program;
+                    (void)script.IsWitnessProgram(version, program);
+                }
+                break;
+            }
+        }
+    }
+}
diff --git a/src/test/fuzz/scriptnum_ops.cpp b/src/test/fuzz/scriptnum_ops.cpp
new file mode 100644
--- /dev/null
+++ b/src/test/fuzz/scriptnum_ops.cpp
@@ -0,0 +1,191 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/script.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <cassert>
+#include <cstdint>
+#include <limits>
+#include <vector>
+
+namespace {
+bool IsValidAddition(const CScriptNum &lhs, const CScriptNum &rhs) {
+    return rhs == 0 ||
+           (rhs > 0 &&
+            lhs <= CScriptNum{std::numeric_limits<int64_t>::max()} - rhs) ||
+           (rhs < 0 &&
+            lhs >= CScriptNum{std::numeric_limits<int64_t>::min()} - rhs);
+}
+
+bool IsValidSubtraction(const CScriptNum &lhs, const CScriptNum &rhs) {
+    return rhs == 0 ||
+           (rhs > 0 &&
+            lhs >= CScriptNum{std::numeric_limits<int64_t>::min()} + rhs) ||
+           (rhs < 0 &&
+            lhs <= CScriptNum{std::numeric_limits<int64_t>::max()} + rhs);
+}
+} // namespace
+
+void test_one_input(const std::vector<uint8_t> &buffer) {
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+    CScriptNum script_num = ConsumeScriptNum(fuzzed_data_provider);
+    while (fuzzed_data_provider.remaining_bytes() > 0) {
+        switch (fuzzed_data_provider.ConsumeIntegralInRange(0, 11)) {
+            case 0: {
+                const int64_t i =
+                    fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                assert((script_num == i) != (script_num != i));
+                assert((script_num <= i) != script_num > i);
+                assert((script_num >= i) != (script_num < i));
+                // Avoid signed integer overflow:
+                // script/script.h:264:93: runtime error: signed integer
+                // overflow: -2261405121394637306 + -9223372036854775802 cannot
+                // be represented in type 'long'
+                if (IsValidAddition(script_num, CScriptNum{i})) {
+                    assert((script_num + i) - i == script_num);
+                }
+                // Avoid signed integer overflow:
+                // script/script.h:265:93: runtime error: signed integer
+                // overflow: 9223371895120855039 - -9223372036854710486 cannot
+                // be represented in type 'long'
+                if (IsValidSubtraction(script_num, CScriptNum{i})) {
+                    assert((script_num - i) + i == script_num);
+                }
+                break;
+            }
+            case 1: {
+                const CScriptNum random_script_num =
+                    ConsumeScriptNum(fuzzed_data_provider);
+                assert((script_num == random_script_num) !=
+                       (script_num != random_script_num));
+                assert((script_num <= random_script_num) !=
+                       (script_num > random_script_num));
+                assert((script_num >= random_script_num) !=
+                       (script_num < random_script_num));
+                // Avoid signed integer overflow:
+                // script/script.h:264:93: runtime error: signed integer
+                // overflow: -9223126527765971126 + -9223372036854756825 cannot
+                // be represented in type 'long'
+                if (IsValidAddition(script_num, random_script_num)) {
+                    assert((script_num + random_script_num) -
+                               random_script_num ==
+                           script_num);
+                }
+                // Avoid signed integer overflow:
+                // script/script.h:265:93: runtime error: signed integer
+                // overflow: 6052837899185946624 - -9223372036854775808 cannot
+                // be represented in type 'long'
+                if (IsValidSubtraction(script_num, random_script_num)) {
+                    assert((script_num - random_script_num) +
+                               random_script_num ==
+                           script_num);
+                }
+                break;
+            }
+            case 2: {
+                const CScriptNum random_script_num =
+                    ConsumeScriptNum(fuzzed_data_provider);
+                if (!IsValidAddition(script_num, random_script_num)) {
+                    // Avoid assertion failure:
+                    // ./script/script.h:292: CScriptNum
+                    // &CScriptNum::operator+=(const int64_t &): Assertion `rhs
+                    // == 0 || (rhs > 0 && m_value <=
+                    // std::numeric_limits<int64_t>::max() - rhs) || (rhs < 0 &&
+                    // m_value >= std::numeric_limits<int64_t>::min() - rhs)'
+                    // failed.
+                    break;
+                }
+                script_num += random_script_num;
+                break;
+            }
+            case 3: {
+                const CScriptNum random_script_num =
+                    ConsumeScriptNum(fuzzed_data_provider);
+                if (!IsValidSubtraction(script_num, random_script_num)) {
+                    // Avoid assertion failure:
+                    // ./script/script.h:300: CScriptNum
+                    // &CScriptNum::operator-=(const int64_t &): Assertion `rhs
+                    // == 0 || (rhs > 0 && m_value >=
+                    // std::numeric_limits<int64_t>::min() + rhs) || (rhs < 0 &&
+                    // m_value <= std::numeric_limits<int64_t>::max() + rhs)'
+                    // failed.
+                    break;
+                }
+                script_num -= random_script_num;
+                break;
+            }
+            case 4:
+                script_num = script_num &
+                             fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                break;
+            case 5:
+                script_num =
+                    script_num & ConsumeScriptNum(fuzzed_data_provider);
+                break;
+            case 6:
+                script_num &= ConsumeScriptNum(fuzzed_data_provider);
+                break;
+            case 7:
+                if (script_num ==
+                    CScriptNum{std::numeric_limits<int64_t>::min()}) {
+                    // Avoid assertion failure:
+                    // ./script/script.h:279: CScriptNum CScriptNum::operator-()
+                    // const: Assertion `m_value !=
+                    // std::numeric_limits<int64_t>::min()' failed.
+                    break;
+                }
+                script_num = -script_num;
+                break;
+            case 8:
+                script_num = fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                break;
+            case 9: {
+                const int64_t random_integer =
+                    fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                if (!IsValidAddition(script_num, CScriptNum{random_integer})) {
+                    // Avoid assertion failure:
+                    // ./script/script.h:292: CScriptNum
+                    // &CScriptNum::operator+=(const int64_t &): Assertion `rhs
+                    // == 0 || (rhs > 0 && m_value <=
+                    // std::numeric_limits<int64_t>::max() - rhs) || (rhs < 0 &&
+                    // m_value >= std::numeric_limits<int64_t>::min() - rhs)'
+                    // failed.
+                    break;
+                }
+                script_num += random_integer;
+                break;
+            }
+            case 10: {
+                const int64_t random_integer =
+                    fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                if (!IsValidSubtraction(script_num,
+                                        CScriptNum{random_integer})) {
+                    // Avoid assertion failure:
+                    // ./script/script.h:300: CScriptNum
+                    // &CScriptNum::operator-=(const int64_t &): Assertion `rhs
+                    // == 0 || (rhs > 0 && m_value >=
+                    // std::numeric_limits<int64_t>::min() + rhs) || (rhs < 0 &&
+                    // m_value <= std::numeric_limits<int64_t>::max() + rhs)'
+                    // failed.
+                    break;
+                }
+                script_num -= random_integer;
+                break;
+            }
+            case 11:
+                script_num &= fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                break;
+        }
+        // Avoid negation failure:
+        // script/script.h:332:35: runtime error: negation of
+        // -9223372036854775808 cannot be represented in type 'int64_t' (aka
+        // 'long'); cast to an unsigned type to negate this value to itself
+        if (script_num != CScriptNum{std::numeric_limits<int64_t>::min()}) {
+            (void)script_num.getvch();
+        }
+    }
+}
diff --git a/src/test/fuzz/util.h b/src/test/fuzz/util.h
--- a/src/test/fuzz/util.h
+++ b/src/test/fuzz/util.h
@@ -6,9 +6,11 @@
 #define BITCOIN_TEST_FUZZ_UTIL_H
 
 #include <attributes.h>
+#include <script/script.h>
 #include <serialize.h>
 #include <streams.h>
 #include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
 #include <version.h>
 
 #include <cstdint>
@@ -27,7 +29,7 @@
 NODISCARD inline std::optional<T>
 ConsumeDeserializable(FuzzedDataProvider &fuzzed_data_provider,
                       size_t max_length = 4096) noexcept {
-    const std::vector<uint8_t> &buffer =
+    const std::vector<uint8_t> buffer =
         ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
     CDataStream ds{buffer, SER_NETWORK, INIT_PROTO_VERSION};
     T obj;
@@ -39,4 +41,22 @@
     return obj;
 }
 
+NODISCARD inline opcodetype
+ConsumeOpcodeType(FuzzedDataProvider &fuzzed_data_provider) noexcept {
+    return static_cast<opcodetype>(
+        fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(0, MAX_OPCODE));
+}
+
+NODISCARD inline CScript
+ConsumeScript(FuzzedDataProvider &fuzzed_data_provider) noexcept {
+    const std::vector<uint8_t> b =
+        ConsumeRandomLengthByteVector(fuzzed_data_provider);
+    return {b.begin(), b.end()};
+}
+
+NODISCARD inline CScriptNum
+ConsumeScriptNum(FuzzedDataProvider &fuzzed_data_provider) noexcept {
+    return CScriptNum{fuzzed_data_provider.ConsumeIntegral<int64_t>()};
+}
+
 #endif // BITCOIN_TEST_FUZZ_UTIL_H