diff --git a/src/test/fuzz/CMakeLists.txt b/src/test/fuzz/CMakeLists.txt
index 2b28ffc48..de5e49b51 100644
--- a/src/test/fuzz/CMakeLists.txt
+++ b/src/test/fuzz/CMakeLists.txt
@@ -1,210 +1,220 @@
 # Fuzzer test harness
 add_custom_target(bitcoin-fuzzers)
 
 define_property(GLOBAL
 	PROPERTY FUZZ_TARGETS
 	BRIEF_DOCS "List of fuzz targets"
 	FULL_DOCS "A list of the fuzz targets"
 )
 set_property(GLOBAL APPEND PROPERTY FUZZ_TARGETS bitcoin-fuzzers)
 
 include(InstallationHelper)
 macro(add_fuzz_target TARGET EXE_NAME)
 	add_executable(${TARGET} EXCLUDE_FROM_ALL
 		fuzz.cpp
 		${ARGN}
 	)
 	set_target_properties(${TARGET} PROPERTIES OUTPUT_NAME ${EXE_NAME})
 
 	target_link_libraries(${TARGET} server testutil rpcclient)
+	if(TARGET bitcoinconsensus-shared)
+		target_link_libraries(${TARGET} bitcoinconsensus-shared)
+	else()
+		target_link_libraries(${TARGET} bitcoinconsensus)
+	endif()
 
 	add_dependencies(bitcoin-fuzzers ${TARGET})
 
 	set_property(GLOBAL APPEND PROPERTY FUZZ_TARGETS ${TARGET})
 
 	install_target(${TARGET}
 		COMPONENT fuzzer
 		EXCLUDE_FROM_ALL
 	)
 endmacro()
 
 function(add_regular_fuzz_targets)
 	foreach(_fuzz_test_name ${ARGN})
 		sanitize_target_name("fuzz-" ${_fuzz_test_name} _fuzz_target_name)
 		add_fuzz_target(
 			${_fuzz_target_name}
 			${_fuzz_test_name}
 
 			# Sources
 			"${_fuzz_test_name}.cpp"
 		)
 	endforeach()
 endfunction()
 
 include(SanitizeHelper)
 function(add_deserialize_fuzz_targets)
 	foreach(_fuzz_test_name ${ARGN})
 		sanitize_target_name("fuzz-" ${_fuzz_test_name} _fuzz_target_name)
 		add_fuzz_target(
 			${_fuzz_target_name}
 			${_fuzz_test_name}
 
 			# Sources
 			deserialize.cpp
 		)
 
 		sanitize_c_cxx_definition("" ${_fuzz_test_name} _target_definition)
 		string(TOUPPER ${_target_definition} _target_definition)
 		target_compile_definitions(${_fuzz_target_name} PRIVATE ${_target_definition})
 	endforeach()
 endfunction()
 
 function(add_process_message_fuzz_targets)
 	foreach(_fuzz_test_name ${ARGN})
 		sanitize_target_name("fuzz-process_message_" ${_fuzz_test_name} _fuzz_target_name)
 		add_fuzz_target(
 			${_fuzz_target_name}
 			process_message_${_fuzz_test_name}
 
 			# Sources
 			process_message.cpp
 		)
 
 		target_compile_definitions(${_fuzz_target_name} PRIVATE MESSAGE_TYPE=${_fuzz_test_name})
 	endforeach()
 endfunction()
 
 add_regular_fuzz_targets(
 	addition_overflow
 	addrdb
 	asmap
 	asmap_direct
 	base_encode_decode
 	block
 	block_header
 	blockfilter
 	bloom_filter
 	cashaddr
 	chain
 	checkqueue
 	coins_view
 	cuckoocache
 	descriptor_parse
 	eval_script
 	fee_rate
 	fees
 	flatfile
 	float
 	golomb_rice
 	hex
 	http_request
 	integer
 	key
 	key_io
 	kitchen_sink
 	locale
 	merkleblock
 	message
 	multiplication_overflow
 	net_permissions
 	netaddress
 	p2p_transport_deserializer
 	parse_hd_keypath
 	parse_iso8601
 	parse_numbers
 	parse_script
 	parse_univalue
 	prevector
 	pow
 	primitives_transaction
 	process_message
 	process_messages
 	protocol
 	psbt
 	random
 	rolling_bloom_filter
 	script
+	script_bitcoin_consensus
+	script_descriptor_cache
 	script_flags
+	script_interpreter
 	script_ops
+	script_sigcache
+	script_sign
 	scriptnum_ops
 	signature_checker
 	span
 	spanparsing
 	string
 	strprintf
 	system
 	timedata
 	transaction
 	tx_in
 	tx_out
 )
 
 add_deserialize_fuzz_targets(
 	addr_info_deserialize
 	address_deserialize
 	addrman_deserialize
 	banentry_deserialize
 	block_deserialize
 	block_file_info_deserialize
 	block_filter_deserialize
 	block_header_and_short_txids_deserialize
 	blockheader_deserialize
 	blocklocator_deserialize
 	blockmerkleroot
 	blocktransactions_deserialize
 	blocktransactionsrequest_deserialize
 	blockundo_deserialize
 	bloomfilter_deserialize
 	coins_deserialize
 	diskblockindex_deserialize
 	fee_rate_deserialize
 	flat_file_pos_deserialize
 	inv_deserialize
 	key_origin_info_deserialize
 	merkle_block_deserialize
 	messageheader_deserialize
 	netaddr_deserialize
 	out_point_deserialize
 	partial_merkle_tree_deserialize
 	partially_signed_transaction_deserialize
 	prefilled_transaction_deserialize
 	psbt_input_deserialize
 	psbt_output_deserialize
 	pub_key_deserialize
 	script_deserialize
 	service_deserialize
 	snapshotmetadata_deserialize
 	sub_net_deserialize
 	tx_in_deserialize
 	txoutcompressor_deserialize
 	txundo_deserialize
 	uint160_deserialize
 	uint256_deserialize
 )
 
 add_process_message_fuzz_targets(
 	addr
 	block
 	blocktxn
 	cmpctblock
 	feefilter
 	filteradd
 	filterclear
 	filterload
 	getaddr
 	getblocks
 	getblocktxn
 	getdata
 	getheaders
 	headers
 	inv
 	mempool
 	notfound
 	ping
 	pong
 	sendcmpct
 	sendheaders
 	tx
 	verack
 	version
 )
diff --git a/src/test/fuzz/script.cpp b/src/test/fuzz/script.cpp
index e8d146e5a..c48b57472 100644
--- a/src/test/fuzz/script.cpp
+++ b/src/test/fuzz/script.cpp
@@ -1,117 +1,145 @@
 // Copyright (c) 2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <chainparams.h>
 #include <compressor.h>
 #include <core_io.h>
 #include <core_memusage.h>
 #include <policy/policy.h>
 #include <pubkey.h>
 #include <script/descriptor.h>
 #include <script/interpreter.h>
 #include <script/script.h>
+#include <script/script_error.h>
 #include <script/sign.h>
 #include <script/signingprovider.h>
 #include <script/standard.h>
 #include <streams.h>
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
 #include <test/fuzz/util.h>
 #include <univalue.h>
 
+#include <algorithm>
+#include <cassert>
 #include <cstdint>
 #include <memory>
 #include <optional>
 #include <string>
 #include <vector>
 
 void initialize() {
     // Fuzzers using pubkey must hold an ECCVerifyHandle.
     static const ECCVerifyHandle verify_handle;
 
     SelectParams(CBaseChainParams::REGTEST);
 }
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
     const std::optional<CScript> script_opt =
         ConsumeDeserializable<CScript>(fuzzed_data_provider);
     if (!script_opt) {
         return;
     }
     const CScript script{*script_opt};
 
     std::vector<uint8_t> compressed;
     if (CompressScript(script, compressed)) {
         const unsigned int size = compressed[0];
         compressed.erase(compressed.begin());
         assert(size >= 0 && size <= 5);
         CScript decompressed_script;
         const bool ok = DecompressScript(decompressed_script, size, compressed);
         assert(ok);
         assert(script == decompressed_script);
     }
 
     CTxDestination address;
     (void)ExtractDestination(script, address);
 
     txnouttype type_ret;
     std::vector<CTxDestination> addresses;
     int required_ret;
     (void)ExtractDestinations(script, type_ret, addresses, required_ret);
 
     const FlatSigningProvider signing_provider;
     (void)InferDescriptor(script, signing_provider);
 
     (void)script.IsWitnessProgram();
 
     (void)IsSolvable(signing_provider, script);
 
     txnouttype which_type;
     (void)IsStandard(script, which_type);
 
     (void)RecursiveDynamicUsage(script);
 
     std::vector<std::vector<uint8_t>> solutions;
     (void)Solver(script, solutions);
 
     (void)script.HasValidOps();
     (void)script.IsPayToScriptHash();
     (void)script.IsPushOnly();
     (void)script.IsUnspendable();
     (void)script.IsWitnessProgram();
 
     (void)FormatScript(script);
     (void)ScriptToAsmStr(script, false);
     (void)ScriptToAsmStr(script, true);
 
     UniValue o1(UniValue::VOBJ);
     ScriptPubKeyToUniv(script, o1, true);
     UniValue o2(UniValue::VOBJ);
     ScriptPubKeyToUniv(script, o2, false);
     UniValue o3(UniValue::VOBJ);
     ScriptToUniv(script, o3, true);
     UniValue o4(UniValue::VOBJ);
     ScriptToUniv(script, o4, false);
 
     {
         const std::vector<uint8_t> bytes =
             ConsumeRandomLengthByteVector(fuzzed_data_provider);
         // DecompressScript(..., ..., bytes) is not guaranteed to be defined if
         // the bytes vector is too short
         if (bytes.size() >= 32) {
             CScript decompressed_script;
             DecompressScript(
                 decompressed_script,
                 fuzzed_data_provider.ConsumeIntegral<unsigned int>(), bytes);
         }
     }
 
     const std::optional<CScript> other_script =
         ConsumeDeserializable<CScript>(fuzzed_data_provider);
     if (other_script) {
         CScript script_mut{script};
         (void)FindAndDelete(script_mut, *other_script);
     }
+
+    (void)GetOpName(ConsumeOpcodeType(fuzzed_data_provider));
+    (void)ScriptErrorString(static_cast<ScriptError>(
+        fuzzed_data_provider.ConsumeIntegralInRange<int>(
+            0, static_cast<int>(ScriptError::ERROR_COUNT))));
+
+    {
+        const std::vector<uint8_t> bytes =
+            ConsumeRandomLengthByteVector(fuzzed_data_provider);
+        CScript append_script{bytes.begin(), bytes.end()};
+        append_script << fuzzed_data_provider.ConsumeIntegral<int64_t>();
+        append_script << ConsumeOpcodeType(fuzzed_data_provider);
+        append_script << CScriptNum{
+            fuzzed_data_provider.ConsumeIntegral<int64_t>()};
+        append_script << ConsumeRandomLengthByteVector(fuzzed_data_provider);
+    }
+
+    {
+        const CTxDestination tx_destination_1 =
+            ConsumeTxDestination(fuzzed_data_provider);
+        const CTxDestination tx_destination_2 =
+            ConsumeTxDestination(fuzzed_data_provider);
+        (void)(tx_destination_1 == tx_destination_2);
+        (void)(tx_destination_1 < tx_destination_2);
+    }
 }
diff --git a/src/test/fuzz/script_bitcoin_consensus.cpp b/src/test/fuzz/script_bitcoin_consensus.cpp
new file mode 100644
index 000000000..1796e757b
--- /dev/null
+++ b/src/test/fuzz/script_bitcoin_consensus.cpp
@@ -0,0 +1,44 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <script/bitcoinconsensus.h>
+#include <script/interpreter.h>
+
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+using namespace fuzzer;
+
+void test_one_input(const std::vector<uint8_t> &buffer) {
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+    const std::vector<uint8_t> random_bytes_1 =
+        ConsumeRandomLengthByteVector(fuzzed_data_provider);
+    const std::vector<uint8_t> random_bytes_2 =
+        ConsumeRandomLengthByteVector(fuzzed_data_provider);
+    const int64_t money = fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(
+        0, MAX_MONEY_AS_INT);
+    bitcoinconsensus_error err;
+    bitcoinconsensus_error *err_p =
+        fuzzed_data_provider.ConsumeBool() ? &err : nullptr;
+    const unsigned int n_in =
+        fuzzed_data_provider.ConsumeIntegral<unsigned int>();
+    const unsigned int flags =
+        fuzzed_data_provider.ConsumeIntegral<unsigned int>();
+    assert(bitcoinconsensus_version() == BITCOINCONSENSUS_API_VER);
+    if ((flags & SCRIPT_VERIFY_CLEANSTACK) != 0 &&
+        (flags & SCRIPT_VERIFY_P2SH) == 0) {
+        return;
+    }
+    (void)bitcoinconsensus_verify_script(
+        random_bytes_1.data(), random_bytes_1.size(), random_bytes_2.data(),
+        random_bytes_2.size(), n_in, flags, err_p);
+    (void)bitcoinconsensus_verify_script_with_amount(
+        random_bytes_1.data(), random_bytes_1.size(), money,
+        random_bytes_2.data(), random_bytes_2.size(), n_in, flags, err_p);
+}
diff --git a/src/test/fuzz/script_descriptor_cache.cpp b/src/test/fuzz/script_descriptor_cache.cpp
new file mode 100644
index 000000000..e855dc629
--- /dev/null
+++ b/src/test/fuzz/script_descriptor_cache.cpp
@@ -0,0 +1,49 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <pubkey.h>
+#include <script/descriptor.h>
+
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+void test_one_input(const std::vector<uint8_t> &buffer) {
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+    DescriptorCache descriptor_cache;
+    while (fuzzed_data_provider.ConsumeBool()) {
+        const std::vector<uint8_t> code =
+            fuzzed_data_provider.ConsumeBytes<uint8_t>(BIP32_EXTKEY_SIZE);
+        if (code.size() == BIP32_EXTKEY_SIZE) {
+            CExtPubKey xpub;
+            xpub.Decode(code.data());
+            const uint32_t key_exp_pos =
+                fuzzed_data_provider.ConsumeIntegral<uint32_t>();
+            CExtPubKey xpub_fetched;
+            if (fuzzed_data_provider.ConsumeBool()) {
+                (void)descriptor_cache.GetCachedParentExtPubKey(key_exp_pos,
+                                                                xpub_fetched);
+                descriptor_cache.CacheParentExtPubKey(key_exp_pos, xpub);
+                assert(descriptor_cache.GetCachedParentExtPubKey(key_exp_pos,
+                                                                 xpub_fetched));
+            } else {
+                const uint32_t der_index =
+                    fuzzed_data_provider.ConsumeIntegral<uint32_t>();
+                (void)descriptor_cache.GetCachedDerivedExtPubKey(
+                    key_exp_pos, der_index, xpub_fetched);
+                descriptor_cache.CacheDerivedExtPubKey(key_exp_pos, der_index,
+                                                       xpub);
+                assert(descriptor_cache.GetCachedDerivedExtPubKey(
+                    key_exp_pos, der_index, xpub_fetched));
+            }
+            assert(xpub == xpub_fetched);
+        }
+        (void)descriptor_cache.GetCachedParentExtPubKeys();
+        (void)descriptor_cache.GetCachedDerivedExtPubKeys();
+    }
+}
diff --git a/src/test/fuzz/script_interpreter.cpp b/src/test/fuzz/script_interpreter.cpp
new file mode 100644
index 000000000..376a0220c
--- /dev/null
+++ b/src/test/fuzz/script_interpreter.cpp
@@ -0,0 +1,59 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <primitives/transaction.h>
+#include <script/interpreter.h>
+
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <vector>
+
+bool CastToBool(const std::vector<uint8_t> &vch);
+
+void test_one_input(const std::vector<uint8_t> &buffer) {
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+    {
+        const CScript script_code = ConsumeScript(fuzzed_data_provider);
+        const std::optional<CMutableTransaction> mtx =
+            ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
+        if (mtx) {
+            const CTransaction tx_to{*mtx};
+            const unsigned int in =
+                fuzzed_data_provider.ConsumeIntegral<unsigned int>();
+            if (in < tx_to.vin.size()) {
+                (void)SignatureHash(
+                    script_code, tx_to, in,
+                    SigHashType(
+                        fuzzed_data_provider.ConsumeIntegral<uint32_t>()),
+                    ConsumeMoney(fuzzed_data_provider), nullptr,
+                    fuzzed_data_provider.PickValueInArray(
+                        {SCRIPT_ENABLE_REPLAY_PROTECTION,
+                         SCRIPT_ENABLE_SIGHASH_FORKID}));
+                const std::optional<CMutableTransaction> mtx_precomputed =
+                    ConsumeDeserializable<CMutableTransaction>(
+                        fuzzed_data_provider);
+                if (mtx_precomputed) {
+                    const CTransaction tx_precomputed{*mtx_precomputed};
+                    const PrecomputedTransactionData
+                        precomputed_transaction_data{tx_precomputed};
+                    (void)SignatureHash(
+                        script_code, tx_to, in,
+                        SigHashType(
+                            fuzzed_data_provider.ConsumeIntegral<uint32_t>()),
+                        ConsumeMoney(fuzzed_data_provider),
+                        &precomputed_transaction_data,
+                        fuzzed_data_provider.PickValueInArray(
+                            {SCRIPT_ENABLE_REPLAY_PROTECTION,
+                             SCRIPT_ENABLE_SIGHASH_FORKID}));
+                }
+            }
+        }
+    }
+    (void)CastToBool(ConsumeRandomLengthByteVector(fuzzed_data_provider));
+}
diff --git a/src/test/fuzz/script_sigcache.cpp b/src/test/fuzz/script_sigcache.cpp
new file mode 100644
index 000000000..fd27beca0
--- /dev/null
+++ b/src/test/fuzz/script_sigcache.cpp
@@ -0,0 +1,52 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <chainparams.h>
+#include <chainparamsbase.h>
+#include <key.h>
+#include <pubkey.h>
+#include <script/sigcache.h>
+
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <vector>
+
+void initialize() {
+    static const ECCVerifyHandle ecc_verify_handle;
+    ECC_Start();
+    SelectParams(CBaseChainParams::REGTEST);
+    InitSignatureCache();
+}
+
+void test_one_input(const std::vector<uint8_t> &buffer) {
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+
+    const std::optional<CMutableTransaction> mutable_transaction =
+        ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
+    const CTransaction tx = mutable_transaction
+                                ? CTransaction{*mutable_transaction}
+                                : CTransaction{};
+    const unsigned int n_in =
+        fuzzed_data_provider.ConsumeIntegral<unsigned int>();
+    const Amount amount = ConsumeMoney(fuzzed_data_provider);
+    const bool store = fuzzed_data_provider.ConsumeBool();
+    PrecomputedTransactionData tx_data;
+    CachingTransactionSignatureChecker caching_transaction_signature_checker{
+        mutable_transaction ? &tx : nullptr, n_in, amount, store, tx_data};
+    const std::optional<CPubKey> pub_key =
+        ConsumeDeserializable<CPubKey>(fuzzed_data_provider);
+    if (pub_key) {
+        const std::vector<uint8_t> random_bytes =
+            ConsumeRandomLengthByteVector(fuzzed_data_provider);
+        if (!random_bytes.empty()) {
+            (void)caching_transaction_signature_checker.VerifySignature(
+                random_bytes, *pub_key, ConsumeUInt256(fuzzed_data_provider));
+        }
+    }
+}
diff --git a/src/test/fuzz/script_sign.cpp b/src/test/fuzz/script_sign.cpp
new file mode 100644
index 000000000..d676c0494
--- /dev/null
+++ b/src/test/fuzz/script_sign.cpp
@@ -0,0 +1,185 @@
+// Copyright (c) 2020 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <chainparams.h>
+#include <chainparamsbase.h>
+#include <key.h>
+#include <pubkey.h>
+#include <script/keyorigin.h>
+#include <script/sign.h>
+#include <script/signingprovider.h>
+#include <streams.h>
+
+#include <test/fuzz/FuzzedDataProvider.h>
+#include <test/fuzz/fuzz.h>
+#include <test/fuzz/util.h>
+
+#include <cassert>
+#include <cstdint>
+#include <iostream>
+#include <map>
+#include <optional>
+#include <string>
+#include <vector>
+
+void initialize() {
+    static const ECCVerifyHandle ecc_verify_handle;
+    ECC_Start();
+    SelectParams(CBaseChainParams::REGTEST);
+}
+
+void test_one_input(const std::vector<uint8_t> &buffer) {
+    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
+    const std::vector<uint8_t> key =
+        ConsumeRandomLengthByteVector(fuzzed_data_provider, 128);
+
+    {
+        CDataStream random_data_stream =
+            ConsumeDataStream(fuzzed_data_provider);
+        std::map<CPubKey, KeyOriginInfo> hd_keypaths;
+        try {
+            DeserializeHDKeypaths(random_data_stream, key, hd_keypaths);
+        } catch (const std::ios_base::failure &) {
+        }
+        CDataStream serialized{SER_NETWORK, PROTOCOL_VERSION};
+        SerializeHDKeypaths(serialized, hd_keypaths,
+                            fuzzed_data_provider.ConsumeIntegral<uint8_t>());
+    }
+
+    {
+        std::map<CPubKey, KeyOriginInfo> hd_keypaths;
+        while (fuzzed_data_provider.ConsumeBool()) {
+            const std::optional<CPubKey> pub_key =
+                ConsumeDeserializable<CPubKey>(fuzzed_data_provider);
+            if (!pub_key) {
+                break;
+            }
+            const std::optional<KeyOriginInfo> key_origin_info =
+                ConsumeDeserializable<KeyOriginInfo>(fuzzed_data_provider);
+            if (!key_origin_info) {
+                break;
+            }
+            hd_keypaths[*pub_key] = *key_origin_info;
+        }
+        CDataStream serialized{SER_NETWORK, PROTOCOL_VERSION};
+        try {
+            SerializeHDKeypaths(
+                serialized, hd_keypaths,
+                fuzzed_data_provider.ConsumeIntegral<uint8_t>());
+        } catch (const std::ios_base::failure &) {
+        }
+        std::map<CPubKey, KeyOriginInfo> deserialized_hd_keypaths;
+        try {
+            DeserializeHDKeypaths(serialized, key, hd_keypaths);
+        } catch (const std::ios_base::failure &) {
+        }
+        assert(hd_keypaths.size() >= deserialized_hd_keypaths.size());
+    }
+
+    {
+        SignatureData signature_data_1{ConsumeScript(fuzzed_data_provider)};
+        SignatureData signature_data_2{ConsumeScript(fuzzed_data_provider)};
+        signature_data_1.MergeSignatureData(signature_data_2);
+    }
+
+    FillableSigningProvider provider;
+    CKey k;
+    const std::vector<uint8_t> key_data =
+        ConsumeRandomLengthByteVector(fuzzed_data_provider);
+    k.Set(key_data.begin(), key_data.end(), fuzzed_data_provider.ConsumeBool());
+    if (k.IsValid()) {
+        provider.AddKey(k);
+    }
+
+    {
+        const std::optional<CMutableTransaction> mutable_transaction =
+            ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider);
+        const std::optional<CTxOut> tx_out =
+            ConsumeDeserializable<CTxOut>(fuzzed_data_provider);
+        const unsigned int n_in =
+            fuzzed_data_provider.ConsumeIntegral<unsigned int>();
+        if (mutable_transaction && tx_out &&
+            mutable_transaction->vin.size() > n_in) {
+            SignatureData signature_data_1 =
+                DataFromTransaction(*mutable_transaction, n_in, *tx_out);
+            CTxIn input;
+            UpdateInput(input, signature_data_1);
+            const CScript script = ConsumeScript(fuzzed_data_provider);
+            SignatureData signature_data_2{script};
+            signature_data_1.MergeSignatureData(signature_data_2);
+        }
+        if (mutable_transaction) {
+            CTransaction tx_from{*mutable_transaction};
+            CMutableTransaction tx_to;
+            const std::optional<CMutableTransaction> opt_tx_to =
+                ConsumeDeserializable<CMutableTransaction>(
+                    fuzzed_data_provider);
+            if (opt_tx_to) {
+                tx_to = *opt_tx_to;
+            }
+            CMutableTransaction script_tx_to = tx_to;
+            CMutableTransaction sign_transaction_tx_to = tx_to;
+            if (n_in < tx_to.vin.size() &&
+                tx_to.vin[n_in].prevout.GetN() < tx_from.vout.size()) {
+                (void)SignSignature(
+                    provider, tx_from, tx_to, n_in,
+                    SigHashType(
+                        fuzzed_data_provider.ConsumeIntegral<uint32_t>()));
+            }
+            if (n_in < script_tx_to.vin.size()) {
+                (void)SignSignature(
+                    provider, ConsumeScript(fuzzed_data_provider), script_tx_to,
+                    n_in, ConsumeMoney(fuzzed_data_provider),
+                    SigHashType(
+                        fuzzed_data_provider.ConsumeIntegral<uint32_t>()));
+                MutableTransactionSignatureCreator signature_creator{
+                    &tx_to, n_in, ConsumeMoney(fuzzed_data_provider),
+                    SigHashType(
+                        fuzzed_data_provider.ConsumeIntegral<uint32_t>())};
+                std::vector<uint8_t> vch_sig;
+                CKeyID address;
+                if (fuzzed_data_provider.ConsumeBool()) {
+                    if (k.IsValid()) {
+                        address = k.GetPubKey().GetID();
+                    }
+                } else {
+                    address = CKeyID{ConsumeUInt160(fuzzed_data_provider)};
+                }
+                (void)signature_creator.CreateSig(
+                    provider, vch_sig, address,
+                    ConsumeScript(fuzzed_data_provider));
+            }
+            std::map<COutPoint, Coin> coins;
+            while (fuzzed_data_provider.ConsumeBool()) {
+                const std::optional<COutPoint> outpoint =
+                    ConsumeDeserializable<COutPoint>(fuzzed_data_provider);
+                if (!outpoint) {
+                    break;
+                }
+                const std::optional<Coin> coin =
+                    ConsumeDeserializable<Coin>(fuzzed_data_provider);
+                if (!coin) {
+                    break;
+                }
+                coins[*outpoint] = *coin;
+            }
+            std::map<int, std::string> input_errors;
+            (void)SignTransaction(
+                sign_transaction_tx_to, &provider, coins,
+                SigHashType(fuzzed_data_provider.ConsumeIntegral<uint32_t>()),
+                input_errors);
+        }
+    }
+
+    {
+        SignatureData signature_data_1;
+        (void)ProduceSignature(provider, DUMMY_SIGNATURE_CREATOR,
+                               ConsumeScript(fuzzed_data_provider),
+                               signature_data_1);
+        SignatureData signature_data_2;
+        (void)ProduceSignature(provider, DUMMY_MAXIMUM_SIGNATURE_CREATOR,
+                               ConsumeScript(fuzzed_data_provider),
+                               signature_data_2);
+    }
+}
diff --git a/src/test/fuzz/string.cpp b/src/test/fuzz/string.cpp
index 6a5bd0e50..f907b6c14 100644
--- a/src/test/fuzz/string.cpp
+++ b/src/test/fuzz/string.cpp
@@ -1,142 +1,147 @@
 // Copyright (c) 2020 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <blockfilter.h>
 #include <clientversion.h>
 #include <logging.h>
 #include <netbase.h>
 #include <outputtype.h>
 #include <rpc/client.h>
 #include <rpc/request.h>
 #include <rpc/server.h>
 #include <rpc/util.h>
 #include <script/descriptor.h>
+#include <script/script.h>
 #include <serialize.h>
 #include <streams.h>
 #include <util/error.h>
 #include <util/message.h>
 #include <util/settings.h>
 #include <util/strencodings.h>
 #include <util/string.h>
 #include <util/system.h>
 #include <util/translation.h>
 #include <util/url.h>
 #include <version.h>
 
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
 #include <test/fuzz/util.h>
 
 #include <cstdint>
 #include <string>
 #include <vector>
 
 void test_one_input(const std::vector<uint8_t> &buffer) {
     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
     const std::string random_string_1 =
         fuzzed_data_provider.ConsumeRandomLengthString(32);
     const std::string random_string_2 =
         fuzzed_data_provider.ConsumeRandomLengthString(32);
     const std::vector<std::string> random_string_vector =
         ConsumeRandomLengthStringVector(fuzzed_data_provider);
 
     (void)AmountErrMsg(random_string_1, random_string_2);
     (void)AmountHighWarn(random_string_1);
     BlockFilterType block_filter_type;
     (void)BlockFilterTypeByName(random_string_1, block_filter_type);
     (void)Capitalize(random_string_1);
     (void)CopyrightHolders(random_string_1);
     (void)FormatParagraph(
         random_string_1,
         fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 1000),
         fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, 1000));
     (void)FormatSubVersion(random_string_1,
                            fuzzed_data_provider.ConsumeIntegral<int>(),
                            random_string_vector);
     (void)GetDescriptorChecksum(random_string_1);
     (void)HelpExampleCli(random_string_1, random_string_2);
     (void)HelpExampleRpc(random_string_1, random_string_2);
     (void)HelpMessageGroup(random_string_1);
     (void)HelpMessageOpt(random_string_1, random_string_2);
     ArgsManager argsman;
     (void)IsDeprecatedRPCEnabled(argsman, random_string_1);
     (void)Join(random_string_vector, random_string_1);
     (void)JSONRPCError(fuzzed_data_provider.ConsumeIntegral<int>(),
                        random_string_1);
     const util::Settings settings;
     (void)OnlyHasDefaultSectionSetting(settings, random_string_1,
                                        random_string_2);
     (void)ParseNetwork(random_string_1);
     try {
         (void)ParseNonRFCJSONValue(random_string_1);
     } catch (const std::runtime_error &) {
     }
     OutputType output_type;
     (void)ParseOutputType(random_string_1, output_type);
     (void)ResolveErrMsg(random_string_1, random_string_2);
     try {
         (void)RPCConvertNamedValues(random_string_1, random_string_vector);
     } catch (const std::runtime_error &) {
     }
     try {
         (void)RPCConvertValues(random_string_1, random_string_vector);
     } catch (const std::runtime_error &) {
     }
     (void)SanitizeString(random_string_1);
     (void)SanitizeString(
         random_string_1,
         fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 3));
     (void)ShellEscape(random_string_1);
     int port_out;
     std::string host_out;
     SplitHostPort(random_string_1, port_out, host_out);
     (void)TimingResistantEqual(random_string_1, random_string_2);
     (void)ToLower(random_string_1);
     (void)ToUpper(random_string_1);
     (void)TrimString(random_string_1);
     (void)TrimString(random_string_1, random_string_2);
     (void)urlDecode(random_string_1);
     (void)ValidAsCString(random_string_1);
     (void)_(random_string_1.c_str());
+    try {
+        throw scriptnum_error{random_string_1};
+    } catch (const std::runtime_error &) {
+    }
 
     {
         CDataStream data_stream{SER_NETWORK, INIT_PROTO_VERSION};
         std::string s;
         LimitedString<10> limited_string = LIMITED_STRING(s, 10);
         data_stream << random_string_1;
         try {
             data_stream >> limited_string;
             assert(data_stream.empty());
             assert(s.size() <= random_string_1.size());
             assert(s.size() <= 10);
             if (!random_string_1.empty()) {
                 assert(!s.empty());
             }
         } catch (const std::ios_base::failure &) {
         }
     }
     {
         CDataStream data_stream{SER_NETWORK, INIT_PROTO_VERSION};
         const LimitedString<10> limited_string =
             LIMITED_STRING(random_string_1, 10);
         data_stream << limited_string;
         std::string deserialized_string;
         data_stream >> deserialized_string;
         assert(data_stream.empty());
         assert(deserialized_string == random_string_1);
     }
     {
         int64_t amount_out;
         (void)ParseFixedPoint(
             random_string_1,
             fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 1024),
             &amount_out);
     }
     {
         (void)Untranslated(random_string_1);
         const bilingual_str bs1{random_string_1, random_string_2};
         const bilingual_str bs2{random_string_2, random_string_1};
         (void)(bs1 + bs2);
     }
 }
diff --git a/src/test/fuzz/util.h b/src/test/fuzz/util.h
index cb680131a..24e43fec8 100644
--- a/src/test/fuzz/util.h
+++ b/src/test/fuzz/util.h
@@ -1,162 +1,206 @@
 // Copyright (c) 2009-2019 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #ifndef BITCOIN_TEST_FUZZ_UTIL_H
 #define BITCOIN_TEST_FUZZ_UTIL_H
 
 #include <amount.h>
 #include <arith_uint256.h>
 #include <attributes.h>
 #include <coins.h>
 #include <script/script.h>
+#include <script/standard.h>
 #include <serialize.h>
 #include <streams.h>
 #include <uint256.h>
 #include <version.h>
 
 #include <test/fuzz/FuzzedDataProvider.h>
 #include <test/fuzz/fuzz.h>
 
+#include <algorithm>
 #include <cstdint>
 #include <string>
 #include <vector>
 
+namespace fuzzer {
+// FIXME find a better way to avoid duplicating the MAX_MONEY definition
+constexpr int64_t MAX_MONEY_AS_INT = int64_t(21000000) * int64_t(100000000);
+} // end namespace fuzzer
+
+using namespace fuzzer;
+
 NODISCARD inline std::vector<uint8_t>
 ConsumeRandomLengthByteVector(FuzzedDataProvider &fuzzed_data_provider,
                               const size_t max_length = 4096) noexcept {
     const std::string s =
         fuzzed_data_provider.ConsumeRandomLengthString(max_length);
     return {s.begin(), s.end()};
 }
 
+NODISCARD inline CDataStream
+ConsumeDataStream(FuzzedDataProvider &fuzzed_data_provider,
+                  const size_t max_length = 4096) noexcept {
+    return {ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length),
+            SER_NETWORK, INIT_PROTO_VERSION};
+}
+
 NODISCARD inline std::vector<std::string>
 ConsumeRandomLengthStringVector(FuzzedDataProvider &fuzzed_data_provider,
                                 const size_t max_vector_size = 16,
                                 const size_t max_string_length = 16) noexcept {
     const size_t n_elements =
         fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, max_vector_size);
     std::vector<std::string> r;
     for (size_t i = 0; i < n_elements; ++i) {
         r.push_back(
             fuzzed_data_provider.ConsumeRandomLengthString(max_string_length));
     }
     return r;
 }
 
 template <typename T>
 NODISCARD inline std::vector<T>
 ConsumeRandomLengthIntegralVector(FuzzedDataProvider &fuzzed_data_provider,
                                   const size_t max_vector_size = 16) noexcept {
     const size_t n_elements =
         fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, max_vector_size);
     std::vector<T> r;
     for (size_t i = 0; i < n_elements; ++i) {
         r.push_back(fuzzed_data_provider.ConsumeIntegral<T>());
     }
     return r;
 }
 
 template <typename T>
 NODISCARD inline std::optional<T>
 ConsumeDeserializable(FuzzedDataProvider &fuzzed_data_provider,
                       const size_t max_length = 4096) noexcept {
     const std::vector<uint8_t> buffer =
         ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
     CDataStream ds{buffer, SER_NETWORK, INIT_PROTO_VERSION};
     T obj;
     try {
         ds >> obj;
     } catch (const std::ios_base::failure &) {
         return std::nullopt;
     }
     return obj;
 }
 
 NODISCARD inline opcodetype
 ConsumeOpcodeType(FuzzedDataProvider &fuzzed_data_provider) noexcept {
     return static_cast<opcodetype>(
         fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(0, MAX_OPCODE));
 }
 
 NODISCARD inline Amount
 ConsumeMoney(FuzzedDataProvider &fuzzed_data_provider) noexcept {
-    // FIXME find a better way to avoid duplicating the MAX_MONEY definition
-    int64_t maxMoneyAsInt = int64_t(21000000) * int64_t(100000000);
-    return fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(0,
-                                                                maxMoneyAsInt) *
+    return fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(
+               0, MAX_MONEY_AS_INT) *
            SATOSHI;
 }
 
 NODISCARD inline CScript
 ConsumeScript(FuzzedDataProvider &fuzzed_data_provider) noexcept {
     const std::vector<uint8_t> b =
         ConsumeRandomLengthByteVector(fuzzed_data_provider);
     return {b.begin(), b.end()};
 }
 
 NODISCARD inline CScriptNum
 ConsumeScriptNum(FuzzedDataProvider &fuzzed_data_provider) noexcept {
     return CScriptNum{fuzzed_data_provider.ConsumeIntegral<int64_t>()};
 }
 
+NODISCARD inline uint160
+ConsumeUInt160(FuzzedDataProvider &fuzzed_data_provider) noexcept {
+    const std::vector<uint8_t> v160 =
+        fuzzed_data_provider.ConsumeBytes<uint8_t>(160 / 8);
+    if (v160.size() != 160 / 8) {
+        return {};
+    }
+    return uint160{v160};
+}
+
 NODISCARD inline uint256
 ConsumeUInt256(FuzzedDataProvider &fuzzed_data_provider) noexcept {
     const std::vector<uint8_t> v256 =
-        fuzzed_data_provider.ConsumeBytes<uint8_t>(sizeof(uint256));
-    if (v256.size() != sizeof(uint256)) {
+        fuzzed_data_provider.ConsumeBytes<uint8_t>(256 / 8);
+    if (v256.size() != 256 / 8) {
         return {};
     }
     return uint256{v256};
 }
 
 NODISCARD inline arith_uint256
 ConsumeArithUInt256(FuzzedDataProvider &fuzzed_data_provider) noexcept {
     return UintToArith256(ConsumeUInt256(fuzzed_data_provider));
 }
 
+NODISCARD inline CTxDestination
+ConsumeTxDestination(FuzzedDataProvider &fuzzed_data_provider) noexcept {
+    CTxDestination tx_destination;
+    switch (fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 3)) {
+        case 0: {
+            tx_destination = CNoDestination{};
+            break;
+        }
+        case 1: {
+            tx_destination = PKHash{ConsumeUInt160(fuzzed_data_provider)};
+            break;
+        }
+        case 2: {
+            tx_destination = ScriptHash{ConsumeUInt160(fuzzed_data_provider)};
+            break;
+        }
+    }
+    return tx_destination;
+}
+
 template <typename T>
 NODISCARD bool MultiplicationOverflow(const T i, const T j) noexcept {
     static_assert(std::is_integral<T>::value, "Integral required.");
     if (std::numeric_limits<T>::is_signed) {
         if (i > 0) {
             if (j > 0) {
                 return i > (std::numeric_limits<T>::max() / j);
             } else {
                 return j < (std::numeric_limits<T>::min() / i);
             }
         } else {
             if (j > 0) {
                 return i < (std::numeric_limits<T>::min() / j);
             } else {
                 return i != 0 && (j < (std::numeric_limits<T>::max() / i));
             }
         }
     } else {
         return j != 0 && i > std::numeric_limits<T>::max() / j;
     }
 }
 
 template <class T>
 NODISCARD bool AdditionOverflow(const T i, const T j) noexcept {
     static_assert(std::is_integral<T>::value, "Integral required.");
     if (std::numeric_limits<T>::is_signed) {
         return (i > 0 && j > std::numeric_limits<T>::max() - i) ||
                (i < 0 && j < std::numeric_limits<T>::min() - i);
     }
     return std::numeric_limits<T>::max() - i < j;
 }
 
 NODISCARD inline bool
 ContainsSpentInput(const CTransaction &tx,
                    const CCoinsViewCache &inputs) noexcept {
     for (const CTxIn &tx_in : tx.vin) {
         const Coin &coin = inputs.AccessCoin(tx_in.prevout);
         if (coin.IsSpent()) {
             return true;
         }
     }
     return false;
 }
 
 #endif // BITCOIN_TEST_FUZZ_UTIL_H