diff --git a/src/test/fuzz/CMakeLists.txt b/src/test/fuzz/CMakeLists.txt
index 3d144a1ae..d3681c174 100644
--- a/src/test/fuzz/CMakeLists.txt
+++ b/src/test/fuzz/CMakeLists.txt
@@ -1,179 +1,182 @@
 # Fuzzer test harness
 add_custom_target(bitcoin-fuzzers)
 
 define_property(GLOBAL
 	PROPERTY FUZZ_TARGETS
 	BRIEF_DOCS "List of fuzz targets"
 	FULL_DOCS "A list of the fuzz targets"
 )
 set_property(GLOBAL APPEND PROPERTY FUZZ_TARGETS bitcoin-fuzzers)
 
 include(InstallationHelper)
 macro(add_fuzz_target TARGET EXE_NAME)
 	add_executable(${TARGET} EXCLUDE_FROM_ALL
 		fuzz.cpp
 		${ARGN}
 	)
 	set_target_properties(${TARGET} PROPERTIES OUTPUT_NAME ${EXE_NAME})
 
 	target_link_libraries(${TARGET} server testutil rpcclient)
 
 	add_dependencies(bitcoin-fuzzers ${TARGET})
 
 	set_property(GLOBAL APPEND PROPERTY FUZZ_TARGETS ${TARGET})
 
 	install_target(${TARGET}
 		COMPONENT fuzzer
 		EXCLUDE_FROM_ALL
 	)
 endmacro()
 
 function(add_regular_fuzz_targets)
 	foreach(_fuzz_test_name ${ARGN})
 		sanitize_target_name("fuzz-" ${_fuzz_test_name} _fuzz_target_name)
 		add_fuzz_target(
 			${_fuzz_target_name}
 			${_fuzz_test_name}
 
 			# Sources
 			"${_fuzz_test_name}.cpp"
 		)
 	endforeach()
 endfunction()
 
 include(SanitizeHelper)
 function(add_deserialize_fuzz_targets)
 	foreach(_fuzz_test_name ${ARGN})
 		sanitize_target_name("fuzz-" ${_fuzz_test_name} _fuzz_target_name)
 		add_fuzz_target(
 			${_fuzz_target_name}
 			${_fuzz_test_name}
 
 			# Sources
 			deserialize.cpp
 		)
 
 		sanitize_c_cxx_definition("" ${_fuzz_test_name} _target_definition)
 		string(TOUPPER ${_target_definition} _target_definition)
 		target_compile_definitions(${_fuzz_target_name} PRIVATE ${_target_definition})
 	endforeach()
 endfunction()
 
 function(add_process_message_fuzz_targets)
 	foreach(_fuzz_test_name ${ARGN})
 		sanitize_target_name("fuzz-process_message_" ${_fuzz_test_name} _fuzz_target_name)
 		add_fuzz_target(
 			${_fuzz_target_name}
 			process_message_${_fuzz_test_name}
 
 			# Sources
 			process_message.cpp
 		)
 
 		target_compile_definitions(${_fuzz_target_name} PRIVATE MESSAGE_TYPE=${_fuzz_test_name})
 	endforeach()
 endfunction()
 
 add_regular_fuzz_targets(
 	addrdb
 	asmap
 	base_encode_decode
 	block
 	bloom_filter
 	rolling_bloom_filter
 	cashaddr
 	descriptor_parse
 	eval_script
 	float
 	hex
 	integer
 	key
 	key_io
 	locale
 	net_permissions
 	netaddress
 	p2p_transport_deserializer
 	parse_hd_keypath
 	parse_iso8601
 	parse_numbers
 	parse_script
 	parse_univalue
 	process_message
 	process_messages
 	psbt
 	script
 	script_flags
 	spanparsing
 	strprintf
 	timedata
 	transaction
 	tx_in
 	tx_out
 )
 
 add_deserialize_fuzz_targets(
 	addr_info_deserialize
 	address_deserialize
 	addrman_deserialize
 	banentry_deserialize
 	block_deserialize
 	block_file_info_deserialize
 	block_filter_deserialize
 	block_header_and_short_txids_deserialize
 	blockheader_deserialize
 	blocklocator_deserialize
 	blockmerkleroot
 	blocktransactions_deserialize
 	blocktransactionsrequest_deserialize
 	blockundo_deserialize
 	bloomfilter_deserialize
 	coins_deserialize
 	diskblockindex_deserialize
 	fee_rate_deserialize
 	flat_file_pos_deserialize
 	inv_deserialize
 	key_origin_info_deserialize
 	merkle_block_deserialize
 	messageheader_deserialize
 	netaddr_deserialize
 	out_point_deserialize
 	partial_merkle_tree_deserialize
 	partially_signed_transaction_deserialize
 	prefilled_transaction_deserialize
 	psbt_input_deserialize
 	psbt_output_deserialize
 	pub_key_deserialize
 	script_deserialize
 	service_deserialize
+	snapshotmetadata_deserialize
 	sub_net_deserialize
 	tx_in_deserialize
 	txoutcompressor_deserialize
 	txundo_deserialize
+	uint160_deserialize
+	uint256_deserialize
 )
 
 add_process_message_fuzz_targets(
 	addr
 	block
 	blocktxn
 	cmpctblock
 	feefilter
 	filteradd
 	filterclear
 	filterload
 	getaddr
 	getblocks
 	getblocktxn
 	getdata
 	getheaders
 	headers
 	inv
 	mempool
 	notfound
 	ping
 	pong
 	sendcmpct
 	sendheaders
 	tx
 	verack
 	version
 )
diff --git a/src/test/fuzz/base_encode_decode.cpp b/src/test/fuzz/base_encode_decode.cpp
index d89863e81..d7def7ec9 100644
--- a/src/test/fuzz/base_encode_decode.cpp
+++ b/src/test/fuzz/base_encode_decode.cpp
@@ -1,51 +1,56 @@
 // Copyright (c) 2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <base58.h>
+#include <psbt.h>
 #include <util/strencodings.h>
 #include <util/string.h>
 
 #include <test/fuzz/fuzz.h>
 
 #include <cassert>
 #include <cstdint>
 #include <string>
 #include <vector>
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     const std::string random_encoded_string(buffer.begin(), buffer.end());
 
     std::vector<uint8_t> decoded;
     if (DecodeBase58(random_encoded_string, decoded, 100)) {
         const std::string encoded_string = EncodeBase58(decoded);
         assert(encoded_string == TrimString(encoded_string));
         assert(ToLower(encoded_string) ==
                ToLower(TrimString(random_encoded_string)));
     }
 
     if (DecodeBase58Check(random_encoded_string, decoded, 100)) {
         const std::string encoded_string = EncodeBase58Check(decoded);
         assert(encoded_string == TrimString(encoded_string));
         assert(ToLower(encoded_string) ==
                ToLower(TrimString(random_encoded_string)));
     }
 
     bool pf_invalid;
     std::string decoded_string =
         DecodeBase32(random_encoded_string, &pf_invalid);
     if (!pf_invalid) {
         const std::string encoded_string = EncodeBase32(decoded_string);
         assert(encoded_string == TrimString(encoded_string));
         assert(ToLower(encoded_string) ==
                ToLower(TrimString(random_encoded_string)));
     }
 
     decoded_string = DecodeBase64(random_encoded_string, &pf_invalid);
     if (!pf_invalid) {
         const std::string encoded_string = EncodeBase64(decoded_string);
         assert(encoded_string == TrimString(encoded_string));
         assert(ToLower(encoded_string) ==
                ToLower(TrimString(random_encoded_string)));
     }
+
+    PartiallySignedTransaction psbt;
+    std::string error;
+    (void)DecodeBase64PSBT(psbt, random_encoded_string, error);
 }
diff --git a/src/test/fuzz/block.cpp b/src/test/fuzz/block.cpp
index 2900e8108..4c935c453 100644
--- a/src/test/fuzz/block.cpp
+++ b/src/test/fuzz/block.cpp
@@ -1,66 +1,66 @@
 // Copyright (c) 2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <chainparams.h>
 #include <config.h>
 #include <consensus/merkle.h>
 #include <consensus/validation.h>
 #include <core_io.h>
 #include <core_memusage.h>
 #include <primitives/block.h>
 #include <pubkey.h>
 #include <streams.h>
 #include <validation.h>
 #include <version.h>
 
 #include <test/fuzz/fuzz.h>
 
 #include <cassert>
 #include <string>
 
 void initialize() {
-    const static auto verify_handle = std::make_unique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
     SelectParams(CBaseChainParams::REGTEST);
 }
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
     CBlock block;
     try {
         int nVersion;
         ds >> nVersion;
         ds.SetVersion(nVersion);
         ds >> block;
     } catch (const std::ios_base::failure &) {
         return;
     }
     const Config &config = GetConfig();
     const Consensus::Params &consensus_params =
         config.GetChainParams().GetConsensus();
     BlockValidationOptions options(config);
 
     BlockValidationState validation_state_pow_and_merkle;
     const bool valid_incl_pow_and_merkle = CheckBlock(
         block, validation_state_pow_and_merkle, consensus_params, options);
     BlockValidationState validation_state_pow;
     const bool valid_incl_pow =
         CheckBlock(block, validation_state_pow, consensus_params,
                    options.withCheckMerkleRoot(false));
     BlockValidationState validation_state_merkle;
     const bool valid_incl_merkle =
         CheckBlock(block, validation_state_merkle, consensus_params,
                    options.withCheckPoW(false));
     BlockValidationState validation_state_none;
     const bool valid_incl_none =
         CheckBlock(block, validation_state_none, consensus_params,
                    options.withCheckPoW(false).withCheckMerkleRoot(false));
     if (valid_incl_pow_and_merkle) {
         assert(valid_incl_pow && valid_incl_merkle && valid_incl_none);
     } else if (valid_incl_merkle || valid_incl_pow) {
         assert(valid_incl_none);
     }
     (void)block.GetHash();
     (void)block.ToString();
     (void)BlockMerkleRoot(block);
 }
diff --git a/src/test/fuzz/descriptor_parse.cpp b/src/test/fuzz/descriptor_parse.cpp
index 77b208a40..48353e674 100644
--- a/src/test/fuzz/descriptor_parse.cpp
+++ b/src/test/fuzz/descriptor_parse.cpp
@@ -1,24 +1,24 @@
 // Copyright (c) 2009-2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <chainparams.h>
 #include <pubkey.h>
 #include <script/descriptor.h>
 #include <test/fuzz/fuzz.h>
 
 #include <memory>
 
 void initialize() {
-    static const auto verify_handle = std::make_unique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
     SelectParams(CBaseChainParams::REGTEST);
 }
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     const std::string descriptor(buffer.begin(), buffer.end());
     FlatSigningProvider signing_provider;
     std::string error;
     for (const bool require_checksum : {true, false}) {
         Parse(descriptor, signing_provider, error, require_checksum);
     }
 }
diff --git a/src/test/fuzz/deserialize.cpp b/src/test/fuzz/deserialize.cpp
index 527e85d8f..d9c62f12b 100644
--- a/src/test/fuzz/deserialize.cpp
+++ b/src/test/fuzz/deserialize.cpp
@@ -1,213 +1,230 @@
 // Copyright (c) 2009-2018 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <addrdb.h>
 #include <addrman.h>
 #include <blockencodings.h>
 #include <blockfileinfo.h>
 #include <blockfilter.h>
 #include <chain.h>
 #include <coins.h>
 #include <compressor.h>
 #include <consensus/merkle.h>
 #include <key.h>
 #include <merkleblock.h>
 #include <net.h>
+#include <node/utxo_snapshot.h>
 #include <primitives/block.h>
 #include <protocol.h>
 #include <psbt.h>
 #include <pubkey.h>
 #include <script/keyorigin.h>
 #include <streams.h>
 #include <undo.h>
 #include <version.h>
 
 #include <test/fuzz/fuzz.h>
 
 #include <cstdint>
 #include <exception>
 #include <stdexcept>
 #include <unistd.h>
 #include <vector>
 
 void initialize() {
     // Fuzzers using pubkey must hold an ECCVerifyHandle.
-    static const auto verify_handle = std::make_unique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
 }
 
 namespace {
 
 struct invalid_fuzzing_input_exception : public std::exception {};
 
 template <typename T> CDataStream Serialize(const T &obj) {
     CDataStream ds(SER_NETWORK, INIT_PROTO_VERSION);
     ds << obj;
     return ds;
 }
 
 template <typename T> T Deserialize(CDataStream ds) {
     T obj;
     ds >> obj;
     return obj;
 }
 
 template <typename T>
 void DeserializeFromFuzzingInput(const std::vector<uint8_t> &buffer, T &obj) {
     CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
     try {
         int version;
         ds >> version;
         ds.SetVersion(version);
     } catch (const std::ios_base::failure &) {
         throw invalid_fuzzing_input_exception();
     }
     try {
         ds >> obj;
     } catch (const std::ios_base::failure &) {
         throw invalid_fuzzing_input_exception();
     }
     assert(buffer.empty() || !Serialize(obj).empty());
 }
 
 template <typename T> void AssertEqualAfterSerializeDeserialize(const T &obj) {
     assert(Deserialize<T>(Serialize(obj)) == obj);
 }
 
 } // namespace
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     try {
 #if BLOCK_FILTER_DESERIALIZE
         BlockFilter block_filter;
         DeserializeFromFuzzingInput(buffer, block_filter);
 #elif ADDR_INFO_DESERIALIZE
         CAddrInfo addr_info;
         DeserializeFromFuzzingInput(buffer, addr_info);
 #elif BLOCK_FILE_INFO_DESERIALIZE
         CBlockFileInfo block_file_info;
         DeserializeFromFuzzingInput(buffer, block_file_info);
 #elif BLOCK_HEADER_AND_SHORT_TXIDS_DESERIALIZE
         CBlockHeaderAndShortTxIDs block_header_and_short_txids;
         DeserializeFromFuzzingInput(buffer, block_header_and_short_txids);
 #elif FEE_RATE_DESERIALIZE
         CFeeRate fee_rate;
         DeserializeFromFuzzingInput(buffer, fee_rate);
         AssertEqualAfterSerializeDeserialize(fee_rate);
 #elif MERKLE_BLOCK_DESERIALIZE
         CMerkleBlock merkle_block;
         DeserializeFromFuzzingInput(buffer, merkle_block);
 #elif OUT_POINT_DESERIALIZE
         COutPoint out_point;
         DeserializeFromFuzzingInput(buffer, out_point);
         AssertEqualAfterSerializeDeserialize(out_point);
 #elif PARTIAL_MERKLE_TREE_DESERIALIZE
         CPartialMerkleTree partial_merkle_tree;
         DeserializeFromFuzzingInput(buffer, partial_merkle_tree);
 #elif PUB_KEY_DESERIALIZE
         CPubKey pub_key;
         DeserializeFromFuzzingInput(buffer, pub_key);
         // TODO: The following equivalence should hold for CPubKey? Fix.
         // AssertEqualAfterSerializeDeserialize(pub_key);
 #elif SCRIPT_DESERIALIZE
         CScript script;
         DeserializeFromFuzzingInput(buffer, script);
 #elif SUB_NET_DESERIALIZE
         CSubNet sub_net;
         DeserializeFromFuzzingInput(buffer, sub_net);
         AssertEqualAfterSerializeDeserialize(sub_net);
 #elif TX_IN_DESERIALIZE
         CTxIn tx_in;
         DeserializeFromFuzzingInput(buffer, tx_in);
         AssertEqualAfterSerializeDeserialize(tx_in);
 #elif FLAT_FILE_POS_DESERIALIZE
         FlatFilePos flat_file_pos;
         DeserializeFromFuzzingInput(buffer, flat_file_pos);
         AssertEqualAfterSerializeDeserialize(flat_file_pos);
 #elif KEY_ORIGIN_INFO_DESERIALIZE
         KeyOriginInfo key_origin_info;
         DeserializeFromFuzzingInput(buffer, key_origin_info);
         AssertEqualAfterSerializeDeserialize(key_origin_info);
 #elif PARTIALLY_SIGNED_TRANSACTION_DESERIALIZE
         PartiallySignedTransaction partially_signed_transaction;
         DeserializeFromFuzzingInput(buffer, partially_signed_transaction);
 #elif PREFILLED_TRANSACTION_DESERIALIZE
         PrefilledTransaction prefilled_transaction;
         DeserializeFromFuzzingInput(buffer, prefilled_transaction);
 #elif PSBT_INPUT_DESERIALIZE
         PSBTInput psbt_input;
         DeserializeFromFuzzingInput(buffer, psbt_input);
 #elif PSBT_OUTPUT_DESERIALIZE
         PSBTOutput psbt_output;
         DeserializeFromFuzzingInput(buffer, psbt_output);
 #elif BLOCK_DESERIALIZE
         CBlock block;
         DeserializeFromFuzzingInput(buffer, block);
 #elif BLOCKLOCATOR_DESERIALIZE
         CBlockLocator bl;
         DeserializeFromFuzzingInput(buffer, bl);
 #elif BLOCKMERKLEROOT
         CBlock block;
         DeserializeFromFuzzingInput(buffer, block);
         bool mutated;
         BlockMerkleRoot(block, &mutated);
 #elif ADDRMAN_DESERIALIZE
         CAddrMan am;
         DeserializeFromFuzzingInput(buffer, am);
 #elif BLOCKHEADER_DESERIALIZE
         CBlockHeader bh;
         DeserializeFromFuzzingInput(buffer, bh);
 #elif BANENTRY_DESERIALIZE
         CBanEntry be;
         DeserializeFromFuzzingInput(buffer, be);
 #elif TXUNDO_DESERIALIZE
         CTxUndo tu;
         DeserializeFromFuzzingInput(buffer, tu);
 #elif BLOCKUNDO_DESERIALIZE
         CBlockUndo bu;
         DeserializeFromFuzzingInput(buffer, bu);
 #elif COINS_DESERIALIZE
         Coin coin;
         DeserializeFromFuzzingInput(buffer, coin);
 #elif NETADDR_DESERIALIZE
         CNetAddr na;
         DeserializeFromFuzzingInput(buffer, na);
         AssertEqualAfterSerializeDeserialize(na);
 #elif SERVICE_DESERIALIZE
         CService s;
         DeserializeFromFuzzingInput(buffer, s);
         AssertEqualAfterSerializeDeserialize(s);
 #elif MESSAGEHEADER_DESERIALIZE
         const CMessageHeader::MessageMagic pchMessageStart = {0x00, 0x00, 0x00,
                                                               0x00};
         CMessageHeader mh(pchMessageStart);
         DeserializeFromFuzzingInput(buffer, mh);
         (void)mh.IsValidWithoutConfig(pchMessageStart);
 #elif ADDRESS_DESERIALIZE
         CAddress a;
         DeserializeFromFuzzingInput(buffer, a);
 #elif INV_DESERIALIZE
         CInv i;
         DeserializeFromFuzzingInput(buffer, i);
 #elif BLOOMFILTER_DESERIALIZE
         CBloomFilter bf;
         DeserializeFromFuzzingInput(buffer, bf);
 #elif DISKBLOCKINDEX_DESERIALIZE
         CDiskBlockIndex dbi;
         DeserializeFromFuzzingInput(buffer, dbi);
 #elif TXOUTCOMPRESSOR_DESERIALIZE
         CTxOut to;
         auto toc = Using<TxOutCompression>(to);
         DeserializeFromFuzzingInput(buffer, toc);
 #elif BLOCKTRANSACTIONS_DESERIALIZE
         BlockTransactions bt;
         DeserializeFromFuzzingInput(buffer, bt);
 #elif BLOCKTRANSACTIONSREQUEST_DESERIALIZE
         BlockTransactionsRequest btr;
         DeserializeFromFuzzingInput(buffer, btr);
+#elif SNAPSHOTMETADATA_DESERIALIZE
+        SnapshotMetadata snapshot_metadata;
+        DeserializeFromFuzzingInput(buffer, snapshot_metadata);
+#elif UINT160_DESERIALIZE
+        uint160 u160;
+        DeserializeFromFuzzingInput(buffer, u160);
+        AssertEqualAfterSerializeDeserialize(u160);
+#elif UINT256_DESERIALIZE
+        uint256 u256;
+        DeserializeFromFuzzingInput(buffer, u256);
+        AssertEqualAfterSerializeDeserialize(u256);
 #else
 #error Need at least one fuzz target to compile
 #endif
+        // Classes intentionally not covered in this file since their
+        // deserialization code is fuzzed elsewhere:
+        // * Deserialization of CTxOut is fuzzed in src/test/fuzz/tx_out.cpp
+        // * Deserialization of CMutableTransaction is fuzzed in
+        //   src/test/fuzz/transaction.cpp
     } catch (const invalid_fuzzing_input_exception &) {
     }
 }
diff --git a/src/test/fuzz/eval_script.cpp b/src/test/fuzz/eval_script.cpp
index b1e829971..6d02f6b67 100644
--- a/src/test/fuzz/eval_script.cpp
+++ b/src/test/fuzz/eval_script.cpp
@@ -1,37 +1,37 @@
 // Copyright (c) 2009-2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <pubkey.h>
 #include <script/interpreter.h>
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
 
 #include <limits>
 #include <memory>
 
 void initialize() {
-    static const auto verify_handle = std::make_unique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
 }
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
     const unsigned int flags =
         fuzzed_data_provider.ConsumeIntegral<unsigned int>();
     const std::vector<uint8_t> script_bytes = [&] {
         if (fuzzed_data_provider.remaining_bytes() != 0) {
             return fuzzed_data_provider.ConsumeRemainingBytes<uint8_t>();
         } else {
             // Avoid UBSan warning:
             //   test/fuzz/FuzzedDataProvider.h:212:17: runtime error: null
             //   pointer passed as argument 1, which is declared to never be
             //   null /usr/include/string.h:43:28: note: nonnull attribute
             //   specified here
             return std::vector<uint8_t>();
         }
     }();
     const CScript script(script_bytes.begin(), script_bytes.end());
     std::vector<std::vector<uint8_t>> stack;
     ScriptExecutionMetrics metrics;
     (void)EvalScript(stack, script, flags, BaseSignatureChecker(), metrics);
 }
diff --git a/src/test/fuzz/hex.cpp b/src/test/fuzz/hex.cpp
index 808cfb43a..99ca9e245 100644
--- a/src/test/fuzz/hex.cpp
+++ b/src/test/fuzz/hex.cpp
@@ -1,37 +1,44 @@
 // Copyright (c) 2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <core_io.h>
 #include <primitives/block.h>
+#include <pubkey.h>
 #include <rpc/util.h>
 #include <uint256.h>
 #include <util/strencodings.h>
 
 #include <univalue.h>
 
 #include <test/fuzz/fuzz.h>
 
 #include <cassert>
 #include <cstdint>
 #include <string>
 #include <vector>
 
+void initialize() {
+    static const ECCVerifyHandle verify_handle;
+}
+
 void test_one_input(const std::vector<uint8_t> &buffer) {
     const std::string random_hex_string(buffer.begin(), buffer.end());
     const std::vector<uint8_t> data = ParseHex(random_hex_string);
     const std::string hex_data = HexStr(data);
     if (IsHex(random_hex_string)) {
         assert(ToLower(random_hex_string) == hex_data);
     }
     (void)IsHexNumber(random_hex_string);
     uint256 result;
     (void)ParseHashStr(random_hex_string, result);
     (void)uint256S(random_hex_string);
     try {
         (void)HexToPubKey(random_hex_string);
     } catch (const UniValue &) {
     }
     CBlockHeader block_header;
     (void)DecodeHexBlockHeader(block_header, random_hex_string);
+    CBlock block;
+    (void)DecodeHexBlk(block, random_hex_string);
 }
diff --git a/src/test/fuzz/integer.cpp b/src/test/fuzz/integer.cpp
index 101b4ff67..226f1634d 100644
--- a/src/test/fuzz/integer.cpp
+++ b/src/test/fuzz/integer.cpp
@@ -1,220 +1,227 @@
 // Copyright (c) 2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <amount.h>
 #include <arith_uint256.h>
 #include <chainparams.h>
 #include <compressor.h>
 #include <config.h>
 #include <consensus/merkle.h>
 #include <core_io.h>
 #include <crypto/common.h>
 #include <crypto/siphash.h>
 #include <key_io.h>
 #include <memusage.h>
 #include <netbase.h>
 #include <policy/settings.h>
 #include <pow/pow.h>
+#include <protocol.h>
 #include <pubkey.h>
 #include <rpc/util.h>
 #include <script/signingprovider.h>
 #include <script/standard.h>
 #include <serialize.h>
 #include <streams.h>
 #include <uint256.h>
 #include <util/moneystr.h>
 #include <util/strencodings.h>
 #include <util/system.h>
 #include <util/time.h>
 #include <version.h>
 
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
 
 #include <cassert>
 #include <limits>
 #include <vector>
 
 void initialize() {
     SelectParams(CBaseChainParams::REGTEST);
 }
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     if (buffer.size() < sizeof(uint256) + sizeof(uint160)) {
         return;
     }
     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
     const uint256 u256(
         fuzzed_data_provider.ConsumeBytes<uint8_t>(sizeof(uint256)));
     const uint160 u160(
         fuzzed_data_provider.ConsumeBytes<uint8_t>(sizeof(uint160)));
     const uint64_t u64 = fuzzed_data_provider.ConsumeIntegral<uint64_t>();
     const int64_t i64 = fuzzed_data_provider.ConsumeIntegral<int64_t>();
     const uint32_t u32 = fuzzed_data_provider.ConsumeIntegral<uint32_t>();
     const int32_t i32 = fuzzed_data_provider.ConsumeIntegral<int32_t>();
     const uint16_t u16 = fuzzed_data_provider.ConsumeIntegral<uint16_t>();
     const int16_t i16 = fuzzed_data_provider.ConsumeIntegral<int16_t>();
     const uint8_t u8 = fuzzed_data_provider.ConsumeIntegral<uint8_t>();
     const int8_t i8 = fuzzed_data_provider.ConsumeIntegral<int8_t>();
     // We cannot assume a specific value of std::is_signed<char>::value:
     // ConsumeIntegral<char>() instead of casting from {u,}int8_t.
     const char ch = fuzzed_data_provider.ConsumeIntegral<char>();
     const bool b = fuzzed_data_provider.ConsumeBool();
 
     const Consensus::Params &consensus_params = Params().GetConsensus();
     (void)CheckProofOfWork(BlockHash(u256), u32, consensus_params);
     (void)CompressAmount(i64 * SATOSHI);
     static const uint256 u256_min(uint256S(
         "0000000000000000000000000000000000000000000000000000000000000000"));
     static const uint256 u256_max(uint256S(
         "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"));
     const std::vector<uint256> v256{u256, u256_min, u256_max};
     (void)ComputeMerkleRoot(v256);
     (void)CountBits(u64);
     (void)DecompressAmount(u64);
     (void)FormatISO8601Date(i64);
     (void)FormatISO8601DateTime(i64);
     // FormatMoney(i) not defined when i == std::numeric_limits<int64_t>::min()
     if (i64 != std::numeric_limits<int64_t>::min()) {
         Amount parsed_money;
         if (ParseMoney(FormatMoney(i64 * SATOSHI), parsed_money)) {
             assert(parsed_money == i64 * SATOSHI);
         }
     }
     (void)GetSizeOfCompactSize(u64);
     (void)GetSpecialScriptSize(u32);
     // function defined only for a subset of int64_t inputs
     // ()GetVirtualTransactionSize(i64, i64);
     // function defined only for a subset of int64_t/uint32_t inputs
     // ()GetVirtualTransactionSize(i64, i64, u32);
     (void)HexDigit(ch);
     (void)MoneyRange(i64 * SATOSHI);
     (void)i64tostr(i64);
     (void)IsDigit(ch);
     (void)IsSpace(ch);
     (void)IsSwitchChar(ch);
     (void)itostr(i32);
     (void)memusage::DynamicUsage(ch);
     (void)memusage::DynamicUsage(i16);
     (void)memusage::DynamicUsage(i32);
     (void)memusage::DynamicUsage(i64);
     (void)memusage::DynamicUsage(i8);
     (void)memusage::DynamicUsage(u16);
     (void)memusage::DynamicUsage(u32);
     (void)memusage::DynamicUsage(u64);
     (void)memusage::DynamicUsage(u8);
     const uint8_t uch = static_cast<uint8_t>(u8);
     (void)memusage::DynamicUsage(uch);
     (void)MillisToTimeval(i64);
     const double d = ser_uint64_to_double(u64);
     assert(ser_double_to_uint64(d) == u64);
     const float f = ser_uint32_to_float(u32);
     assert(ser_float_to_uint32(f) == u32);
     (void)SighashToStr(uch);
     (void)SipHashUint256(u64, u64, u256);
     (void)SipHashUint256Extra(u64, u64, u256, u32);
     (void)ToLower(ch);
     (void)ToUpper(ch);
     // ValueFromAmount(i) not defined when i ==
     // std::numeric_limits<int64_t>::min()
     if (i64 != std::numeric_limits<int64_t>::min()) {
         Amount parsed_money;
         if (ParseMoney(ValueFromAmount(i64 * SATOSHI).getValStr(),
                        parsed_money)) {
             assert(parsed_money == i64 * SATOSHI);
         }
     }
 
     const arith_uint256 au256 = UintToArith256(u256);
     assert(ArithToUint256(au256) == u256);
     assert(uint256S(au256.GetHex()) == u256);
     (void)au256.bits();
     (void)au256.GetCompact(/* fNegative= */ false);
     (void)au256.GetCompact(/* fNegative= */ true);
     (void)au256.getdouble();
     (void)au256.GetHex();
     (void)au256.GetLow64();
     (void)au256.size();
     (void)au256.ToString();
 
     const CKeyID key_id{u160};
     const CScriptID script_id{u160};
     // CTxDestination = CNoDestination ∪ PKHash ∪ ScriptHash
     const PKHash pk_hash{u160};
     const ScriptHash script_hash{u160};
     const std::vector<CTxDestination> destinations{pk_hash, script_hash};
     const SigningProvider store;
     const Config &config = GetConfig();
     for (const CTxDestination &destination : destinations) {
         (void)DescribeAddress(destination);
         (void)EncodeDestination(destination, config);
         (void)GetKeyForDestination(store, destination);
         (void)GetScriptForDestination(destination);
         (void)IsValidDestination(destination);
     }
 
     {
         CDataStream stream(SER_NETWORK, INIT_PROTO_VERSION);
 
         uint256 deserialized_u256;
         stream << u256;
         stream >> deserialized_u256;
         assert(u256 == deserialized_u256 && stream.empty());
 
         uint160 deserialized_u160;
         stream << u160;
         stream >> deserialized_u160;
         assert(u160 == deserialized_u160 && stream.empty());
 
         uint64_t deserialized_u64;
         stream << u64;
         stream >> deserialized_u64;
         assert(u64 == deserialized_u64 && stream.empty());
 
         int64_t deserialized_i64;
         stream << i64;
         stream >> deserialized_i64;
         assert(i64 == deserialized_i64 && stream.empty());
 
         uint32_t deserialized_u32;
         stream << u32;
         stream >> deserialized_u32;
         assert(u32 == deserialized_u32 && stream.empty());
 
         int32_t deserialized_i32;
         stream << i32;
         stream >> deserialized_i32;
         assert(i32 == deserialized_i32 && stream.empty());
 
         uint16_t deserialized_u16;
         stream << u16;
         stream >> deserialized_u16;
         assert(u16 == deserialized_u16 && stream.empty());
 
         int16_t deserialized_i16;
         stream << i16;
         stream >> deserialized_i16;
         assert(i16 == deserialized_i16 && stream.empty());
 
         uint8_t deserialized_u8;
         stream << u8;
         stream >> deserialized_u8;
         assert(u8 == deserialized_u8 && stream.empty());
 
         int8_t deserialized_i8;
         stream << i8;
         stream >> deserialized_i8;
         assert(i8 == deserialized_i8 && stream.empty());
 
         char deserialized_ch;
         stream << ch;
         stream >> deserialized_ch;
         assert(ch == deserialized_ch && stream.empty());
 
         bool deserialized_b;
         stream << b;
         stream >> deserialized_b;
         assert(b == deserialized_b && stream.empty());
     }
+
+    {
+        const ServiceFlags service_flags = (ServiceFlags)u64;
+        (void)HasAllDesirableServiceFlags(service_flags);
+        (void)MayHaveUsefulAddressDB(service_flags);
+    }
 }
diff --git a/src/test/fuzz/netaddress.cpp b/src/test/fuzz/netaddress.cpp
index 579f9cc9a..e5ed3df7a 100644
--- a/src/test/fuzz/netaddress.cpp
+++ b/src/test/fuzz/netaddress.cpp
@@ -1,136 +1,148 @@
 // Copyright (c) 2020 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <netaddress.h>
 
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
 
 #include <cassert>
 #include <cstdint>
 #include <netinet/in.h>
 #include <vector>
 
 namespace {
 CNetAddr ConsumeNetAddr(FuzzedDataProvider &fuzzed_data_provider) noexcept {
     const Network network = fuzzed_data_provider.PickValueInArray(
         {Network::NET_IPV4, Network::NET_IPV6, Network::NET_INTERNAL,
          Network::NET_ONION});
     if (network == Network::NET_IPV4) {
         const in_addr v4_addr = {
             .s_addr = fuzzed_data_provider.ConsumeIntegral<uint32_t>()};
         return CNetAddr{v4_addr};
     } else if (network == Network::NET_IPV6) {
         if (fuzzed_data_provider.remaining_bytes() < 16) {
             return CNetAddr{};
         }
         in6_addr v6_addr = {};
         memcpy(v6_addr.s6_addr,
                fuzzed_data_provider.ConsumeBytes<uint8_t>(16).data(), 16);
         return CNetAddr{v6_addr,
                         fuzzed_data_provider.ConsumeIntegral<uint32_t>()};
     } else if (network == Network::NET_INTERNAL) {
         CNetAddr net_addr;
         net_addr.SetInternal(fuzzed_data_provider.ConsumeBytesAsString(32));
         return net_addr;
     } else if (network == Network::NET_ONION) {
         CNetAddr net_addr;
         net_addr.SetSpecial(fuzzed_data_provider.ConsumeBytesAsString(32));
         return net_addr;
     } else {
         assert(false);
     }
 }
 }; // namespace
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
 
     const CNetAddr net_addr = ConsumeNetAddr(fuzzed_data_provider);
     for (int i = 0; i < 15; ++i) {
         (void)net_addr.GetByte(i);
     }
     (void)net_addr.GetHash();
     (void)net_addr.GetNetClass();
     if (net_addr.GetNetwork() == Network::NET_IPV4) {
         assert(net_addr.IsIPv4());
     }
     if (net_addr.GetNetwork() == Network::NET_IPV6) {
         assert(net_addr.IsIPv6());
     }
     if (net_addr.GetNetwork() == Network::NET_ONION) {
         assert(net_addr.IsTor());
     }
     if (net_addr.GetNetwork() == Network::NET_INTERNAL) {
         assert(net_addr.IsInternal());
     }
     if (net_addr.GetNetwork() == Network::NET_UNROUTABLE) {
         assert(!net_addr.IsRoutable());
     }
     (void)net_addr.IsBindAny();
     if (net_addr.IsInternal()) {
         assert(net_addr.GetNetwork() == Network::NET_INTERNAL);
     }
     if (net_addr.IsIPv4()) {
         assert(net_addr.GetNetwork() == Network::NET_IPV4 ||
                net_addr.GetNetwork() == Network::NET_UNROUTABLE);
     }
     if (net_addr.IsIPv6()) {
         assert(net_addr.GetNetwork() == Network::NET_IPV6 ||
                net_addr.GetNetwork() == Network::NET_UNROUTABLE);
     }
     (void)net_addr.IsLocal();
     if (net_addr.IsRFC1918() || net_addr.IsRFC2544() || net_addr.IsRFC6598() ||
         net_addr.IsRFC5737() || net_addr.IsRFC3927()) {
         assert(net_addr.IsIPv4());
     }
     (void)net_addr.IsRFC2544();
     if (net_addr.IsRFC3849() || net_addr.IsRFC3964() || net_addr.IsRFC4380() ||
         net_addr.IsRFC4843() || net_addr.IsRFC7343() || net_addr.IsRFC4862() ||
         net_addr.IsRFC6052() || net_addr.IsRFC6145()) {
         assert(net_addr.IsIPv6());
     }
     (void)net_addr.IsRFC3927();
     (void)net_addr.IsRFC3964();
     if (net_addr.IsRFC4193()) {
         assert(net_addr.GetNetwork() == Network::NET_ONION ||
                net_addr.GetNetwork() == Network::NET_INTERNAL ||
                net_addr.GetNetwork() == Network::NET_UNROUTABLE);
     }
     (void)net_addr.IsRFC4380();
     (void)net_addr.IsRFC4843();
     (void)net_addr.IsRFC4862();
     (void)net_addr.IsRFC5737();
     (void)net_addr.IsRFC6052();
     (void)net_addr.IsRFC6145();
     (void)net_addr.IsRFC6598();
     (void)net_addr.IsRFC7343();
     if (!net_addr.IsRoutable()) {
         assert(net_addr.GetNetwork() == Network::NET_UNROUTABLE ||
                net_addr.GetNetwork() == Network::NET_INTERNAL);
     }
     if (net_addr.IsTor()) {
         assert(net_addr.GetNetwork() == Network::NET_ONION);
     }
     (void)net_addr.IsValid();
     (void)net_addr.ToString();
     (void)net_addr.ToStringIP();
 
     const CSubNet sub_net{net_addr,
                           fuzzed_data_provider.ConsumeIntegral<int32_t>()};
     (void)sub_net.IsValid();
     (void)sub_net.ToString();
 
     const CService service{net_addr,
                            fuzzed_data_provider.ConsumeIntegral<uint16_t>()};
     (void)service.GetKey();
     (void)service.GetPort();
     (void)service.ToString();
     (void)service.ToStringIPPort();
     (void)service.ToStringPort();
 
     const CNetAddr other_net_addr = ConsumeNetAddr(fuzzed_data_provider);
     (void)net_addr.GetReachabilityFrom(&other_net_addr);
     (void)sub_net.Match(other_net_addr);
+
+    const CService other_service{
+        net_addr, fuzzed_data_provider.ConsumeIntegral<uint16_t>()};
+    assert((service == other_service) != (service != other_service));
+    (void)(service < other_service);
+
+    const CSubNet sub_net_copy_1{net_addr, other_net_addr};
+    const CSubNet sub_net_copy_2{net_addr};
+
+    CNetAddr mutable_net_addr;
+    mutable_net_addr.SetIP(net_addr);
+    assert(net_addr == mutable_net_addr);
 }
diff --git a/src/test/fuzz/parse_univalue.cpp b/src/test/fuzz/parse_univalue.cpp
index 762997c70..2fecfb152 100644
--- a/src/test/fuzz/parse_univalue.cpp
+++ b/src/test/fuzz/parse_univalue.cpp
@@ -1,84 +1,98 @@
 // Copyright (c) 2009-2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <chainparams.h>
 #include <core_io.h>
 #include <rpc/client.h>
 #include <rpc/util.h>
 
 #include <test/fuzz/fuzz.h>
 
 #include <limits>
 #include <string>
 
 void initialize() {
-    static const auto verify_handle = std::make_unique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
     SelectParams(CBaseChainParams::REGTEST);
 }
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     const std::string random_string(buffer.begin(), buffer.end());
     bool valid = true;
     const UniValue univalue = [&] {
         try {
             return ParseNonRFCJSONValue(random_string);
         } catch (const std::runtime_error &) {
             valid = false;
             return NullUniValue;
         }
     }();
     if (!valid) {
         return;
     }
     try {
         (void)ParseHashO(univalue, "A");
+    } catch (const UniValue &) {
+    } catch (const std::runtime_error &) {
+    }
+    try {
         (void)ParseHashO(univalue, random_string);
     } catch (const UniValue &) {
     } catch (const std::runtime_error &) {
     }
     try {
         (void)ParseHashV(univalue, "A");
+    } catch (const UniValue &) {
+    } catch (const std::runtime_error &) {
+    }
+    try {
         (void)ParseHashV(univalue, random_string);
     } catch (const UniValue &) {
     } catch (const std::runtime_error &) {
     }
     try {
         (void)ParseHexO(univalue, "A");
+    } catch (const UniValue &) {
+    }
+    try {
         (void)ParseHexO(univalue, random_string);
     } catch (const UniValue &) {
-    } catch (const std::runtime_error &) {
     }
     try {
         (void)ParseHexUV(univalue, "A");
         (void)ParseHexUV(univalue, random_string);
     } catch (const UniValue &) {
     } catch (const std::runtime_error &) {
     }
     try {
         (void)ParseHexV(univalue, "A");
+    } catch (const UniValue &) {
+    } catch (const std::runtime_error &) {
+    }
+    try {
         (void)ParseHexV(univalue, random_string);
     } catch (const UniValue &) {
     } catch (const std::runtime_error &) {
     }
     try {
         (void)ParseSighashString(univalue);
     } catch (const std::runtime_error &) {
     }
     try {
         (void)AmountFromValue(univalue);
     } catch (const UniValue &) {
     } catch (const std::runtime_error &) {
     }
     try {
         FlatSigningProvider provider;
         (void)EvalDescriptorStringOrObject(univalue, provider);
     } catch (const UniValue &) {
     } catch (const std::runtime_error &) {
     }
     try {
         (void)ParseDescriptorRange(univalue);
     } catch (const UniValue &) {
     } catch (const std::runtime_error &) {
     }
 }
diff --git a/src/test/fuzz/psbt.cpp b/src/test/fuzz/psbt.cpp
index 1a54447b4..dea6a8871 100644
--- a/src/test/fuzz/psbt.cpp
+++ b/src/test/fuzz/psbt.cpp
@@ -1,76 +1,76 @@
 // Copyright (c) 2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <test/fuzz/fuzz.h>
 
 #include <node/psbt.h>
 #include <psbt.h>
 #include <pubkey.h>
 #include <script/script.h>
 #include <streams.h>
 #include <version.h>
 
 #include <cstdint>
 #include <memory>
 #include <string>
 #include <vector>
 
 void initialize() {
-    static const auto verify_handle = std::make_unique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
 }
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     PartiallySignedTransaction psbt_mut;
     const std::string raw_psbt{buffer.begin(), buffer.end()};
     std::string error;
     if (!DecodeRawPSBT(psbt_mut, raw_psbt, error)) {
         return;
     }
     const PartiallySignedTransaction psbt = psbt_mut;
 
     const PSBTAnalysis analysis = AnalyzePSBT(psbt);
     (void)PSBTRoleName(analysis.next);
     for (const PSBTInputAnalysis &input_analysis : analysis.inputs) {
         (void)PSBTRoleName(input_analysis.next);
     }
 
     (void)psbt.IsNull();
     (void)psbt.IsSane();
 
     std::optional<CMutableTransaction> tx = psbt.tx;
     if (tx) {
         const CMutableTransaction &mtx = *tx;
         const PartiallySignedTransaction psbt_from_tx{mtx};
     }
 
     for (const PSBTInput &input : psbt.inputs) {
         (void)PSBTInputSigned(input);
         (void)input.IsNull();
         (void)input.IsSane();
     }
 
     for (const PSBTOutput &output : psbt.outputs) {
         (void)output.IsNull();
     }
 
     for (size_t i = 0; i < psbt.tx->vin.size(); ++i) {
         CTxOut tx_out;
         if (psbt.GetInputUTXO(tx_out, i)) {
             (void)tx_out.IsNull();
             (void)tx_out.ToString();
         }
     }
 
     psbt_mut = psbt;
     (void)FinalizePSBT(psbt_mut);
 
     psbt_mut = psbt;
     CMutableTransaction result;
     if (FinalizeAndExtractPSBT(psbt_mut, result)) {
         const PartiallySignedTransaction psbt_from_tx{result};
     }
 
     psbt_mut = psbt;
     (void)psbt_mut.Merge(psbt);
 }
diff --git a/src/test/fuzz/script.cpp b/src/test/fuzz/script.cpp
index aebfc4ae3..4a4003481 100644
--- a/src/test/fuzz/script.cpp
+++ b/src/test/fuzz/script.cpp
@@ -1,90 +1,98 @@
 // Copyright (c) 2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <chainparams.h>
 #include <compressor.h>
 #include <core_io.h>
 #include <core_memusage.h>
 #include <policy/policy.h>
 #include <pubkey.h>
 #include <script/descriptor.h>
 #include <script/script.h>
 #include <script/sign.h>
 #include <script/signingprovider.h>
 #include <script/standard.h>
 #include <streams.h>
-
+#include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
-
+#include <test/fuzz/util.h>
 #include <univalue.h>
 
 #include <memory>
 
 void initialize() {
     // Fuzzers using pubkey must hold an ECCVerifyHandle.
-    static const auto verify_handle = std::make_unique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
 
     SelectParams(CBaseChainParams::REGTEST);
 }
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     const CScript script(buffer.begin(), buffer.end());
 
     std::vector<uint8_t> compressed;
     if (CompressScript(script, compressed)) {
         const unsigned int size = compressed[0];
         assert(size >= 0 && size <= 5);
         CScript decompressed_script;
         const bool ok = DecompressScript(decompressed_script, size, compressed);
         assert(ok);
     }
 
-    for (unsigned int size = 0; size < 6; ++size) {
-        std::vector<uint8_t> vch(GetSpecialScriptSize(size), 0x00);
-        vch.insert(vch.end(), buffer.begin(), buffer.end());
-        CScript decompressed_script;
-        (void)DecompressScript(decompressed_script, size, vch);
-    }
     CTxDestination address;
     (void)ExtractDestination(script, address);
 
     txnouttype type_ret;
     std::vector<CTxDestination> addresses;
     int required_ret;
     (void)ExtractDestinations(script, type_ret, addresses, required_ret);
 
     const FlatSigningProvider signing_provider;
     (void)InferDescriptor(script, signing_provider);
 
     (void)script.IsWitnessProgram();
 
     (void)IsSolvable(signing_provider, script);
 
     txnouttype which_type;
     (void)IsStandard(script, which_type);
 
     (void)RecursiveDynamicUsage(script);
 
     std::vector<std::vector<uint8_t>> solutions;
     (void)Solver(script, solutions);
 
     (void)script.HasValidOps();
     (void)script.IsPayToScriptHash();
     (void)script.IsPushOnly();
     (void)script.IsUnspendable();
     (void)script.IsWitnessProgram();
 
     (void)FormatScript(script);
     (void)ScriptToAsmStr(script, false);
     (void)ScriptToAsmStr(script, true);
 
     UniValue o1(UniValue::VOBJ);
     ScriptPubKeyToUniv(script, o1, true);
     UniValue o2(UniValue::VOBJ);
     ScriptPubKeyToUniv(script, o2, false);
     UniValue o3(UniValue::VOBJ);
     ScriptToUniv(script, o3, true);
     UniValue o4(UniValue::VOBJ);
     ScriptToUniv(script, o4, false);
+
+    {
+        FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+        const std::vector<uint8_t> bytes =
+            ConsumeRandomLengthByteVector(fuzzed_data_provider);
+        // DecompressScript(..., ..., bytes) is not guaranteed to be defined if
+        // bytes.size() <= 23.
+        if (bytes.size() >= 24) {
+            CScript decompressed_script;
+            DecompressScript(
+                decompressed_script,
+                fuzzed_data_provider.ConsumeIntegral<unsigned int>(), bytes);
+        }
+    }
 }
diff --git a/src/test/fuzz/script_flags.cpp b/src/test/fuzz/script_flags.cpp
index e8a530381..aa38e4849 100644
--- a/src/test/fuzz/script_flags.cpp
+++ b/src/test/fuzz/script_flags.cpp
@@ -1,85 +1,85 @@
 // Copyright (c) 2009-2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <pubkey.h>
 #include <script/interpreter.h>
 #include <streams.h>
 #include <version.h>
 
 #include <test/fuzz/fuzz.h>
 
 #include <memory>
 
 /** Flags that are not forbidden by an assert */
 static bool IsValidFlagCombination(uint32_t flags);
 
 void initialize() {
-    static const auto verify_handle = std::make_unique<ECCVerifyHandle>();
+    static const ECCVerifyHandle verify_handle;
 }
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
     try {
         int nVersion;
         ds >> nVersion;
         ds.SetVersion(nVersion);
     } catch (const std::ios_base::failure &) {
         return;
     }
 
     try {
         const CTransaction tx(deserialize, ds);
         const PrecomputedTransactionData txdata(tx);
 
         uint32_t verify_flags;
         ds >> verify_flags;
 
         if (!IsValidFlagCombination(verify_flags)) {
             return;
         }
 
         uint32_t fuzzed_flags;
         ds >> fuzzed_flags;
 
         for (unsigned int i = 0; i < tx.vin.size(); ++i) {
             CTxOut prevout;
             ds >> prevout;
 
             const TransactionSignatureChecker checker{&tx, i, prevout.nValue,
                                                       txdata};
 
             ScriptError serror;
             const bool ret =
                 VerifyScript(tx.vin.at(i).scriptSig, prevout.scriptPubKey,
                              verify_flags, checker, &serror);
             assert(ret == (serror == ScriptError::OK));
 
             // Verify that removing flags from a passing test or adding flags to
             // a failing test does not change the result
             if (ret) {
                 verify_flags &= ~fuzzed_flags;
             } else {
                 verify_flags |= fuzzed_flags;
             }
             if (!IsValidFlagCombination(verify_flags)) {
                 return;
             }
 
             ScriptError serror_fuzzed;
             const bool ret_fuzzed =
                 VerifyScript(tx.vin.at(i).scriptSig, prevout.scriptPubKey,
                              verify_flags, checker, &serror_fuzzed);
             assert(ret_fuzzed == (serror_fuzzed == ScriptError::OK));
 
             assert(ret_fuzzed == ret);
         }
     } catch (const std::ios_base::failure &) {
         return;
     }
 }
 
 static bool IsValidFlagCombination(uint32_t flags) {
     // If the CLEANSTACK flag is set, then P2SH should also be set
     return (~flags & SCRIPT_VERIFY_CLEANSTACK) || (flags & SCRIPT_VERIFY_P2SH);
 }
diff --git a/src/test/fuzz/transaction.cpp b/src/test/fuzz/transaction.cpp
index c85af2836..e8148e724 100644
--- a/src/test/fuzz/transaction.cpp
+++ b/src/test/fuzz/transaction.cpp
@@ -1,109 +1,113 @@
 // Copyright (c) 2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <chainparams.h>
 #include <coins.h>
 #include <consensus/tx_check.h>
 #include <consensus/tx_verify.h>
 #include <consensus/validation.h>
 #include <core_io.h>
 #include <core_memusage.h>
 #include <policy/policy.h>
 #include <policy/settings.h>
 #include <primitives/transaction.h>
 #include <streams.h>
 #include <test/fuzz/fuzz.h>
 #include <validation.h>
 #include <version.h>
 
 #include <univalue.h>
 
 #include <cassert>
 
 void initialize() {
     SelectParams(CBaseChainParams::REGTEST);
 }
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
     try {
         int nVersion;
         ds >> nVersion;
         ds.SetVersion(nVersion);
     } catch (const std::ios_base::failure &) {
         return;
     }
     bool valid_tx = true;
     const CTransaction tx = [&] {
         try {
             return CTransaction(deserialize, ds);
         } catch (const std::ios_base::failure &) {
             valid_tx = false;
             return CTransaction();
         }
     }();
     bool valid_mutable_tx = true;
     CDataStream ds_mtx(buffer, SER_NETWORK, INIT_PROTO_VERSION);
     CMutableTransaction mutable_tx;
     try {
         int nVersion;
         ds_mtx >> nVersion;
         ds_mtx.SetVersion(nVersion);
         ds_mtx >> mutable_tx;
     } catch (const std::ios_base::failure &) {
         valid_mutable_tx = false;
     }
     assert(valid_tx == valid_mutable_tx);
     if (!valid_tx) {
         return;
     }
 
     TxValidationState state;
     (void)CheckRegularTransaction(tx, state);
 
     const CFeeRate dust_relay_fee{DUST_RELAY_TX_FEE};
     std::string reason;
     const bool is_standard_with_permit_bare_multisig = IsStandardTx(
         tx, /* permit_bare_multisig= */ true, dust_relay_fee, reason);
     const bool is_standard_without_permit_bare_multisig = IsStandardTx(
         tx, /* permit_bare_multisig= */ false, dust_relay_fee, reason);
     if (is_standard_without_permit_bare_multisig) {
         assert(is_standard_with_permit_bare_multisig);
     }
     std::unique_ptr<CChainParams> params =
         CreateChainParams(CBaseChainParams::REGTEST);
     (void)tx.GetHash();
     (void)tx.GetTotalSize();
     try {
         (void)tx.GetValueOut();
     } catch (const std::runtime_error &) {
     }
     (void)tx.IsCoinBase();
     (void)tx.IsNull();
     (void)tx.ToString();
 
     (void)EncodeHexTx(tx);
     (void)GetVirtualTransactionSize(tx);
     (void)ContextualCheckTransaction(params->GetConsensus(), tx, state, 1024,
                                      1024, 0);
     (void)IsStandardTx(tx, reason);
     (void)RecursiveDynamicUsage(tx);
 
     CCoinsView coins_view;
     const CCoinsViewCache coins_view_cache(&coins_view);
     (void)AreInputsStandard(tx, coins_view_cache, STANDARD_SCRIPT_VERIFY_FLAGS);
 
     UniValue u(UniValue::VOBJ);
     // ValueFromAmount(i) not defined when i ==
     // std::numeric_limits<int64_t>::min()
     bool skip_tx_to_univ = false;
     for (const CTxOut &txout : tx.vout) {
         if (txout.nValue == std::numeric_limits<int64_t>::min() * SATOSHI) {
             skip_tx_to_univ = true;
         }
     }
     if (!skip_tx_to_univ) {
         TxToUniv(tx, /* hashBlock */ {}, u);
+        static const uint256 u256_max(
+            uint256S("fffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
+                     "fffffff"));
+        TxToUniv(tx, u256_max, u);
     }
 }