diff --git a/src/test/fuzz/CMakeLists.txt b/src/test/fuzz/CMakeLists.txt
index d3681c174..8f15f5bcb 100644
--- a/src/test/fuzz/CMakeLists.txt
+++ b/src/test/fuzz/CMakeLists.txt
@@ -1,182 +1,184 @@
 # Fuzzer test harness
 add_custom_target(bitcoin-fuzzers)
 
 define_property(GLOBAL
 	PROPERTY FUZZ_TARGETS
 	BRIEF_DOCS "List of fuzz targets"
 	FULL_DOCS "A list of the fuzz targets"
 )
 set_property(GLOBAL APPEND PROPERTY FUZZ_TARGETS bitcoin-fuzzers)
 
 include(InstallationHelper)
 macro(add_fuzz_target TARGET EXE_NAME)
 	add_executable(${TARGET} EXCLUDE_FROM_ALL
 		fuzz.cpp
 		${ARGN}
 	)
 	set_target_properties(${TARGET} PROPERTIES OUTPUT_NAME ${EXE_NAME})
 
 	target_link_libraries(${TARGET} server testutil rpcclient)
 
 	add_dependencies(bitcoin-fuzzers ${TARGET})
 
 	set_property(GLOBAL APPEND PROPERTY FUZZ_TARGETS ${TARGET})
 
 	install_target(${TARGET}
 		COMPONENT fuzzer
 		EXCLUDE_FROM_ALL
 	)
 endmacro()
 
 function(add_regular_fuzz_targets)
 	foreach(_fuzz_test_name ${ARGN})
 		sanitize_target_name("fuzz-" ${_fuzz_test_name} _fuzz_target_name)
 		add_fuzz_target(
 			${_fuzz_target_name}
 			${_fuzz_test_name}
 
 			# Sources
 			"${_fuzz_test_name}.cpp"
 		)
 	endforeach()
 endfunction()
 
 include(SanitizeHelper)
 function(add_deserialize_fuzz_targets)
 	foreach(_fuzz_test_name ${ARGN})
 		sanitize_target_name("fuzz-" ${_fuzz_test_name} _fuzz_target_name)
 		add_fuzz_target(
 			${_fuzz_target_name}
 			${_fuzz_test_name}
 
 			# Sources
 			deserialize.cpp
 		)
 
 		sanitize_c_cxx_definition("" ${_fuzz_test_name} _target_definition)
 		string(TOUPPER ${_target_definition} _target_definition)
 		target_compile_definitions(${_fuzz_target_name} PRIVATE ${_target_definition})
 	endforeach()
 endfunction()
 
 function(add_process_message_fuzz_targets)
 	foreach(_fuzz_test_name ${ARGN})
 		sanitize_target_name("fuzz-process_message_" ${_fuzz_test_name} _fuzz_target_name)
 		add_fuzz_target(
 			${_fuzz_target_name}
 			process_message_${_fuzz_test_name}
 
 			# Sources
 			process_message.cpp
 		)
 
 		target_compile_definitions(${_fuzz_target_name} PRIVATE MESSAGE_TYPE=${_fuzz_test_name})
 	endforeach()
 endfunction()
 
 add_regular_fuzz_targets(
 	addrdb
 	asmap
 	base_encode_decode
 	block
 	bloom_filter
 	rolling_bloom_filter
 	cashaddr
 	descriptor_parse
 	eval_script
 	float
 	hex
 	integer
 	key
 	key_io
 	locale
 	net_permissions
 	netaddress
 	p2p_transport_deserializer
 	parse_hd_keypath
 	parse_iso8601
 	parse_numbers
 	parse_script
 	parse_univalue
 	process_message
 	process_messages
 	psbt
 	script
 	script_flags
+	script_ops
+	scriptnum_ops
 	spanparsing
 	strprintf
 	timedata
 	transaction
 	tx_in
 	tx_out
 )
 
 add_deserialize_fuzz_targets(
 	addr_info_deserialize
 	address_deserialize
 	addrman_deserialize
 	banentry_deserialize
 	block_deserialize
 	block_file_info_deserialize
 	block_filter_deserialize
 	block_header_and_short_txids_deserialize
 	blockheader_deserialize
 	blocklocator_deserialize
 	blockmerkleroot
 	blocktransactions_deserialize
 	blocktransactionsrequest_deserialize
 	blockundo_deserialize
 	bloomfilter_deserialize
 	coins_deserialize
 	diskblockindex_deserialize
 	fee_rate_deserialize
 	flat_file_pos_deserialize
 	inv_deserialize
 	key_origin_info_deserialize
 	merkle_block_deserialize
 	messageheader_deserialize
 	netaddr_deserialize
 	out_point_deserialize
 	partial_merkle_tree_deserialize
 	partially_signed_transaction_deserialize
 	prefilled_transaction_deserialize
 	psbt_input_deserialize
 	psbt_output_deserialize
 	pub_key_deserialize
 	script_deserialize
 	service_deserialize
 	snapshotmetadata_deserialize
 	sub_net_deserialize
 	tx_in_deserialize
 	txoutcompressor_deserialize
 	txundo_deserialize
 	uint160_deserialize
 	uint256_deserialize
 )
 
 add_process_message_fuzz_targets(
 	addr
 	block
 	blocktxn
 	cmpctblock
 	feefilter
 	filteradd
 	filterclear
 	filterload
 	getaddr
 	getblocks
 	getblocktxn
 	getdata
 	getheaders
 	headers
 	inv
 	mempool
 	notfound
 	ping
 	pong
 	sendcmpct
 	sendheaders
 	tx
 	verack
 	version
 )
diff --git a/src/test/fuzz/bloom_filter.cpp b/src/test/fuzz/bloom_filter.cpp
index 2e7a48e3b..bd8ea830c 100644
--- a/src/test/fuzz/bloom_filter.cpp
+++ b/src/test/fuzz/bloom_filter.cpp
@@ -1,80 +1,80 @@
 // Copyright (c) 2020 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <bloom.h>
 #include <primitives/transaction.h>
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
 #include <test/fuzz/util.h>
 #include <uint256.h>
 
 #include <cassert>
 #include <cstdint>
 #include <string>
 #include <vector>
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
 
     CBloomFilter bloom_filter{
         fuzzed_data_provider.ConsumeIntegralInRange<unsigned int>(1, 10000000),
         1.0 / fuzzed_data_provider.ConsumeIntegralInRange<unsigned int>(
                   1, std::numeric_limits<unsigned int>::max()),
         fuzzed_data_provider.ConsumeIntegral<unsigned int>(),
         static_cast<uint8_t>(fuzzed_data_provider.PickValueInArray(
             {BLOOM_UPDATE_NONE, BLOOM_UPDATE_ALL, BLOOM_UPDATE_P2PUBKEY_ONLY,
              BLOOM_UPDATE_MASK}))};
     while (fuzzed_data_provider.remaining_bytes() > 0) {
         switch (fuzzed_data_provider.ConsumeIntegralInRange(0, 4)) {
             case 0: {
-                const std::vector<uint8_t> &b =
+                const std::vector<uint8_t> b =
                     ConsumeRandomLengthByteVector(fuzzed_data_provider);
                 (void)bloom_filter.contains(b);
                 bloom_filter.insert(b);
                 const bool present = bloom_filter.contains(b);
                 assert(present);
                 break;
             }
             case 1: {
                 const std::optional<COutPoint> out_point =
                     ConsumeDeserializable<COutPoint>(fuzzed_data_provider);
                 if (!out_point) {
                     break;
                 }
                 (void)bloom_filter.contains(*out_point);
                 bloom_filter.insert(*out_point);
                 const bool present = bloom_filter.contains(*out_point);
                 assert(present);
                 break;
             }
             case 2: {
                 const std::optional<uint256> u256 =
                     ConsumeDeserializable<uint256>(fuzzed_data_provider);
                 if (!u256) {
                     break;
                 }
                 (void)bloom_filter.contains(*u256);
                 bloom_filter.insert(*u256);
                 const bool present = bloom_filter.contains(*u256);
                 assert(present);
                 break;
             }
             case 3: {
                 const std::optional<CMutableTransaction> mut_tx =
                     ConsumeDeserializable<CMutableTransaction>(
                         fuzzed_data_provider);
                 if (!mut_tx) {
                     break;
                 }
                 const CTransaction tx{*mut_tx};
                 (void)bloom_filter.IsRelevantAndUpdate(tx);
                 break;
             }
             case 4:
                 bloom_filter.UpdateEmptyFull();
                 break;
         }
         (void)bloom_filter.IsWithinSizeConstraints();
     }
 }
diff --git a/src/test/fuzz/rolling_bloom_filter.cpp b/src/test/fuzz/rolling_bloom_filter.cpp
index c34f4197a..b665f3663 100644
--- a/src/test/fuzz/rolling_bloom_filter.cpp
+++ b/src/test/fuzz/rolling_bloom_filter.cpp
@@ -1,52 +1,52 @@
 // Copyright (c) 2020 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <bloom.h>
 
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
 #include <test/fuzz/util.h>
 #include <uint256.h>
 
 #include <cassert>
 #include <cstdint>
 #include <string>
 #include <vector>
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
 
     CRollingBloomFilter rolling_bloom_filter{
         fuzzed_data_provider.ConsumeIntegralInRange<unsigned int>(1, 1000),
         0.999 / fuzzed_data_provider.ConsumeIntegralInRange<unsigned int>(
                     1, std::numeric_limits<unsigned int>::max())};
     while (fuzzed_data_provider.remaining_bytes() > 0) {
         switch (fuzzed_data_provider.ConsumeIntegralInRange(0, 2)) {
             case 0: {
-                const std::vector<uint8_t> &b =
+                const std::vector<uint8_t> b =
                     ConsumeRandomLengthByteVector(fuzzed_data_provider);
                 (void)rolling_bloom_filter.contains(b);
                 rolling_bloom_filter.insert(b);
                 const bool present = rolling_bloom_filter.contains(b);
                 assert(present);
                 break;
             }
             case 1: {
                 const std::optional<uint256> u256 =
                     ConsumeDeserializable<uint256>(fuzzed_data_provider);
                 if (!u256) {
                     break;
                 }
                 (void)rolling_bloom_filter.contains(*u256);
                 rolling_bloom_filter.insert(*u256);
                 const bool present = rolling_bloom_filter.contains(*u256);
                 assert(present);
                 break;
             }
             case 2:
                 rolling_bloom_filter.reset();
                 break;
         }
     }
 }
diff --git a/src/test/fuzz/script_ops.cpp b/src/test/fuzz/script_ops.cpp
new file mode 100644
index 000000000..0a4254f17
--- /dev/null
+++ b/src/test/fuzz/script_ops.cpp
@@ -0,0 +1,63 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/script.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+void test_one_input(const std::vector<uint8_t> &buffer) {
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+    CScript script = ConsumeScript(fuzzed_data_provider);
+    while (fuzzed_data_provider.remaining_bytes() > 0) {
+        switch (fuzzed_data_provider.ConsumeIntegralInRange(0, 7)) {
+            case 0:
+                script += ConsumeScript(fuzzed_data_provider);
+                break;
+            case 1:
+                script = script + ConsumeScript(fuzzed_data_provider);
+                break;
+            case 2:
+                script << fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                break;
+            case 3:
+                script << ConsumeOpcodeType(fuzzed_data_provider);
+                break;
+            case 4:
+                script << ConsumeScriptNum(fuzzed_data_provider);
+                break;
+            case 5:
+                script << ConsumeRandomLengthByteVector(fuzzed_data_provider);
+                break;
+            case 6:
+                script.clear();
+                break;
+            case 7: {
+                (void)script.IsWitnessProgram();
+                (void)script.HasValidOps();
+                (void)script.IsPayToScriptHash();
+                (void)script.IsPushOnly();
+                (void)script.IsUnspendable();
+                {
+                    CScript::const_iterator pc = script.begin();
+                    opcodetype opcode;
+                    (void)script.GetOp(pc, opcode);
+                    std::vector<uint8_t> data;
+                    (void)script.GetOp(pc, opcode, data);
+                    (void)script.IsPushOnly(pc);
+                }
+                {
+                    int version;
+                    std::vector<uint8_t> program;
+                    (void)script.IsWitnessProgram(version, program);
+                }
+                break;
+            }
+        }
+    }
+}
diff --git a/src/test/fuzz/scriptnum_ops.cpp b/src/test/fuzz/scriptnum_ops.cpp
new file mode 100644
index 000000000..885cfba51
--- /dev/null
+++ b/src/test/fuzz/scriptnum_ops.cpp
@@ -0,0 +1,191 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/script.h>
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <cassert>
+#include <cstdint>
+#include <limits>
+#include <vector>
+
+namespace {
+bool IsValidAddition(const CScriptNum &lhs, const CScriptNum &rhs) {
+    return rhs == 0 ||
+           (rhs > 0 &&
+            lhs <= CScriptNum{std::numeric_limits<int64_t>::max()} - rhs) ||
+           (rhs < 0 &&
+            lhs >= CScriptNum{std::numeric_limits<int64_t>::min()} - rhs);
+}
+
+bool IsValidSubtraction(const CScriptNum &lhs, const CScriptNum &rhs) {
+    return rhs == 0 ||
+           (rhs > 0 &&
+            lhs >= CScriptNum{std::numeric_limits<int64_t>::min()} + rhs) ||
+           (rhs < 0 &&
+            lhs <= CScriptNum{std::numeric_limits<int64_t>::max()} + rhs);
+}
+} // namespace
+
+void test_one_input(const std::vector<uint8_t> &buffer) {
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+    CScriptNum script_num = ConsumeScriptNum(fuzzed_data_provider);
+    while (fuzzed_data_provider.remaining_bytes() > 0) {
+        switch (fuzzed_data_provider.ConsumeIntegralInRange(0, 11)) {
+            case 0: {
+                const int64_t i =
+                    fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                assert((script_num == i) != (script_num != i));
+                assert((script_num <= i) != script_num > i);
+                assert((script_num >= i) != (script_num < i));
+                // Avoid signed integer overflow:
+                // script/script.h:264:93: runtime error: signed integer
+                // overflow: -2261405121394637306 + -9223372036854775802 cannot
+                // be represented in type 'long'
+                if (IsValidAddition(script_num, CScriptNum{i})) {
+                    assert((script_num + i) - i == script_num);
+                }
+                // Avoid signed integer overflow:
+                // script/script.h:265:93: runtime error: signed integer
+                // overflow: 9223371895120855039 - -9223372036854710486 cannot
+                // be represented in type 'long'
+                if (IsValidSubtraction(script_num, CScriptNum{i})) {
+                    assert((script_num - i) + i == script_num);
+                }
+                break;
+            }
+            case 1: {
+                const CScriptNum random_script_num =
+                    ConsumeScriptNum(fuzzed_data_provider);
+                assert((script_num == random_script_num) !=
+                       (script_num != random_script_num));
+                assert((script_num <= random_script_num) !=
+                       (script_num > random_script_num));
+                assert((script_num >= random_script_num) !=
+                       (script_num < random_script_num));
+                // Avoid signed integer overflow:
+                // script/script.h:264:93: runtime error: signed integer
+                // overflow: -9223126527765971126 + -9223372036854756825 cannot
+                // be represented in type 'long'
+                if (IsValidAddition(script_num, random_script_num)) {
+                    assert((script_num + random_script_num) -
+                               random_script_num ==
+                           script_num);
+                }
+                // Avoid signed integer overflow:
+                // script/script.h:265:93: runtime error: signed integer
+                // overflow: 6052837899185946624 - -9223372036854775808 cannot
+                // be represented in type 'long'
+                if (IsValidSubtraction(script_num, random_script_num)) {
+                    assert((script_num - random_script_num) +
+                               random_script_num ==
+                           script_num);
+                }
+                break;
+            }
+            case 2: {
+                const CScriptNum random_script_num =
+                    ConsumeScriptNum(fuzzed_data_provider);
+                if (!IsValidAddition(script_num, random_script_num)) {
+                    // Avoid assertion failure:
+                    // ./script/script.h:292: CScriptNum
+                    // &CScriptNum::operator+=(const int64_t &): Assertion `rhs
+                    // == 0 || (rhs > 0 && m_value <=
+                    // std::numeric_limits<int64_t>::max() - rhs) || (rhs < 0 &&
+                    // m_value >= std::numeric_limits<int64_t>::min() - rhs)'
+                    // failed.
+                    break;
+                }
+                script_num += random_script_num;
+                break;
+            }
+            case 3: {
+                const CScriptNum random_script_num =
+                    ConsumeScriptNum(fuzzed_data_provider);
+                if (!IsValidSubtraction(script_num, random_script_num)) {
+                    // Avoid assertion failure:
+                    // ./script/script.h:300: CScriptNum
+                    // &CScriptNum::operator-=(const int64_t &): Assertion `rhs
+                    // == 0 || (rhs > 0 && m_value >=
+                    // std::numeric_limits<int64_t>::min() + rhs) || (rhs < 0 &&
+                    // m_value <= std::numeric_limits<int64_t>::max() + rhs)'
+                    // failed.
+                    break;
+                }
+                script_num -= random_script_num;
+                break;
+            }
+            case 4:
+                script_num = script_num &
+                             fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                break;
+            case 5:
+                script_num =
+                    script_num & ConsumeScriptNum(fuzzed_data_provider);
+                break;
+            case 6:
+                script_num &= ConsumeScriptNum(fuzzed_data_provider);
+                break;
+            case 7:
+                if (script_num ==
+                    CScriptNum{std::numeric_limits<int64_t>::min()}) {
+                    // Avoid assertion failure:
+                    // ./script/script.h:279: CScriptNum CScriptNum::operator-()
+                    // const: Assertion `m_value !=
+                    // std::numeric_limits<int64_t>::min()' failed.
+                    break;
+                }
+                script_num = -script_num;
+                break;
+            case 8:
+                script_num = fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                break;
+            case 9: {
+                const int64_t random_integer =
+                    fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                if (!IsValidAddition(script_num, CScriptNum{random_integer})) {
+                    // Avoid assertion failure:
+                    // ./script/script.h:292: CScriptNum
+                    // &CScriptNum::operator+=(const int64_t &): Assertion `rhs
+                    // == 0 || (rhs > 0 && m_value <=
+                    // std::numeric_limits<int64_t>::max() - rhs) || (rhs < 0 &&
+                    // m_value >= std::numeric_limits<int64_t>::min() - rhs)'
+                    // failed.
+                    break;
+                }
+                script_num += random_integer;
+                break;
+            }
+            case 10: {
+                const int64_t random_integer =
+                    fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                if (!IsValidSubtraction(script_num,
+                                        CScriptNum{random_integer})) {
+                    // Avoid assertion failure:
+                    // ./script/script.h:300: CScriptNum
+                    // &CScriptNum::operator-=(const int64_t &): Assertion `rhs
+                    // == 0 || (rhs > 0 && m_value >=
+                    // std::numeric_limits<int64_t>::min() + rhs) || (rhs < 0 &&
+                    // m_value <= std::numeric_limits<int64_t>::max() + rhs)'
+                    // failed.
+                    break;
+                }
+                script_num -= random_integer;
+                break;
+            }
+            case 11:
+                script_num &= fuzzed_data_provider.ConsumeIntegral<int64_t>();
+                break;
+        }
+        // Avoid negation failure:
+        // script/script.h:332:35: runtime error: negation of
+        // -9223372036854775808 cannot be represented in type 'int64_t' (aka
+        // 'long'); cast to an unsigned type to negate this value to itself
+        if (script_num != CScriptNum{std::numeric_limits<int64_t>::min()}) {
+            (void)script_num.getvch();
+        }
+    }
+}
diff --git a/src/test/fuzz/util.h b/src/test/fuzz/util.h
index c4ef6a691..4646afdd9 100644
--- a/src/test/fuzz/util.h
+++ b/src/test/fuzz/util.h
@@ -1,42 +1,62 @@
 // Copyright (c) 2009-2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #ifndef BITCOIN_TEST_FUZZ_UTIL_H
 #define BITCOIN_TEST_FUZZ_UTIL_H
 
 #include <attributes.h>
+#include <script/script.h>
 #include <serialize.h>
 #include <streams.h>
 #include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
 #include <version.h>
 
 #include <cstdint>
 #include <string>
 #include <vector>
 
 NODISCARD inline std::vector<uint8_t>
 ConsumeRandomLengthByteVector(FuzzedDataProvider &fuzzed_data_provider,
                               size_t max_length = 4096) noexcept {
     const std::string s =
         fuzzed_data_provider.ConsumeRandomLengthString(max_length);
     return {s.begin(), s.end()};
 }
 
 template <typename T>
 NODISCARD inline std::optional<T>
 ConsumeDeserializable(FuzzedDataProvider &fuzzed_data_provider,
                       size_t max_length = 4096) noexcept {
-    const std::vector<uint8_t> &buffer =
+    const std::vector<uint8_t> buffer =
         ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
     CDataStream ds{buffer, SER_NETWORK, INIT_PROTO_VERSION};
     T obj;
     try {
         ds >> obj;
     } catch (const std::ios_base::failure &) {
         return std::nullopt;
     }
     return obj;
 }
 
+NODISCARD inline opcodetype
+ConsumeOpcodeType(FuzzedDataProvider &fuzzed_data_provider) noexcept {
+    return static_cast<opcodetype>(
+        fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(0, MAX_OPCODE));
+}
+
+NODISCARD inline CScript
+ConsumeScript(FuzzedDataProvider &fuzzed_data_provider) noexcept {
+    const std::vector<uint8_t> b =
+        ConsumeRandomLengthByteVector(fuzzed_data_provider);
+    return {b.begin(), b.end()};
+}
+
+NODISCARD inline CScriptNum
+ConsumeScriptNum(FuzzedDataProvider &fuzzed_data_provider) noexcept {
+    return CScriptNum{fuzzed_data_provider.ConsumeIntegral<int64_t>()};
+}
+
 #endif // BITCOIN_TEST_FUZZ_UTIL_H