A smart contract is a program stored on a blockchain that runs automatically when its pre-set conditions are met, with no middleman needed to carry it out. Despite the name, it is not a legal contract in the traditional sense. It is code that holds rules and, often, money.
Smart contracts power most of what people do on Ethereum and similar networks, from swapping tokens to lending, games and digital collectibles. They are powerful, but they also have real limits, and mistakes in them can be permanent. This guide explains the idea with simple examples and finishes with a safety checklist.
Key takeaways
- A smart contract is code deployed to a blockchain at a specific address, which anyone can interact with according to its rules.
- Once deployed, the code is usually hard or impossible to change, and every transaction that uses it is public.
- Contracts only do what they are programmed to do. A bug or a badly designed rule will execute exactly as written.
- Using a contract costs network fees, and contracts cannot see real-world data without help from an oracle.
- Interacting with an unknown contract can put your funds at risk, so verify before you approve anything.
The vending machine idea
The classic way to understand a smart contract is a vending machine. You insert the right amount of money, choose a product, and the machine releases it. There is no shopkeeper, and the rules are built into the machine. If the conditions are met, the result is automatic.
A smart contract works in a similar way, but digitally. A developer writes code that says something like: if this address sends 1 token, then send back 10 other tokens, or: if the deadline passes and the goal was not reached, return the money to everyone. The code is published on the blockchain, which is replicated across thousands of computers. When someone sends a transaction to the contract, every network node runs the same code and gets the same result. If you need a refresher on the technology underneath, see what is a blockchain.
How smart contracts work step by step
- Write. A developer writes the code, commonly in a language such as Solidity for Ethereum.
- Compile and deploy. The code is converted into bytecode and sent to the network in a transaction. The network assigns it a permanent address, a bit like a bank account that is controlled by code rather than a person.
- Call. A user or another contract sends a transaction to that address, asking it to run a function, for example “swap” or “deposit”.
- Execute. Every validator runs the function and updates the blockchain’s records if the rules are satisfied.
- Pay. The caller pays a fee for the computing work, called gas. Complex contracts cost more than simple transfers.
If a transaction breaks one of the rules, it fails and nothing changes, though the fee for the attempt is usually still charged. That is one reason people sometimes lose a small amount on a failed transaction.
Real-world examples
Smart contracts are behind many everyday crypto activities. Here are the most common categories:
- Token creation. Most tokens on Ethereum are smart contracts that keep a list of balances. Read about the most common standard in our ERC-20 tokens guide.
- Decentralised exchanges. Contracts hold pools of tokens and let anyone swap. See CEX vs DEX.
- Lending and borrowing. Users deposit assets as collateral and borrow against them under rules enforced by code. See what is DeFi.
- Stablecoins. Some stablecoins use contracts to manage collateral and issuance. See what are stablecoins.
- NFTs. A contract records who owns each unique item. See what are NFTs.
- Escrow and crowdfunding. Money is held until conditions are fulfilled, then released or returned.
- Organisations. Voting and treasuries can be managed by contracts, as in a DAO.
A tiny example with made-up numbers: imagine a contract that holds a prize pool for a community game. Ten players each deposit 1 token. At the end of the week the contract sends the whole pool, 10 tokens, to the highest scorer. Nobody has to trust an organiser to pay, because the code does it. But the code must also be given a reliable way to know who won, which brings us to the limits.
Strengths and limits
| Strength | Related limit |
|---|---|
| Runs automatically without intermediaries | Cannot easily be stopped if it has a flaw |
| Transparent code that anyone can inspect | Most users cannot read or audit code themselves |
| Works the same for everyone | “Code is law” gives little recourse if something goes wrong |
| Available all day, every day | Needs fees to run, which can become expensive in busy periods |
| Funds can be held trustlessly | Cannot access outside information without an oracle |
Another important limit is that smart contracts are only as good as their code. If a rule allows an unintended action, the network will execute it faithfully. Developers publish audits by security firms to reduce the risk, yet audits are not guarantees. Some contracts can be upgraded through special admin functions, which helps fix bugs but also adds a point of trust: whoever holds the upgrade keys has power over the contract.
Risks and how to protect yourself
Hackers target smart contracts because they often hold large sums of money. Typical problems include coding bugs, flawed economic design, manipulated price data, and malicious contracts created to steal from users. Scammers also copy the look of real apps. Our crypto scams guide covers many tricks to avoid.
A short safety checklist before interacting with any contract:
- Use only links from official sources, and double-check the address of the contract when possible.
- Be careful with approvals. Granting a contract permission to spend your tokens can let it take everything of that type. Approve only the amount needed and revoke unused permissions.
- Check whether the code has been audited, whether it has run for a long time without incident, and who controls any admin keys.
- Start with a small test transaction before sending larger amounts.
- Never share your recovery phrase with a website or app. A contract never needs it.
- Keep in mind that high advertised returns usually mean high risk.
Use a dedicated wallet for experimenting if you can, and keep long-term savings in a safer setup. See hot wallet vs cold wallet for options.
Are smart contracts legally binding?
Not by themselves. Some jurisdictions are exploring how code-based agreements fit with contract law, but the code is not automatically a legal contract. Treat on-chain rules as technical rules, not as legal protection.
Can a smart contract be changed after it is deployed?
Usually not, unless the developers built in an upgrade mechanism. That mechanism is a trade-off because it adds trust in whoever controls it.
Do smart contracts only exist on Ethereum?
No. Many blockchains support them, including many networks that are compatible with Ethereum. Ethereum was the first to make them widely popular.
Who pays for running a smart contract?
The person sending the transaction pays the network fee. The more computation involved, the higher the cost.
Next step: learn how contracts get used for token standards in ERC-20 tokens explained, or see the bigger ecosystem in what is DeFi.
