What Is a Smart Contract?
What is a smart contract? Learn how self-executing blockchain programs work, what they power, their limits and risks, and how to check one before you use it.
A smart contract is a program stored on a blockchain that runs automatically when predefined conditions are met. It can hold and move funds according to its code, without a bank, broker or other middleman deciding whether to carry out each step.
Smart contracts power almost everything beyond simple payments in crypto: tokens, decentralized exchanges, lending protocols, NFTs and DAOs. Understanding what they can and cannot do helps you judge both the opportunities and the risks of using them.
How Smart Contracts Work
The idea of contracts enforced by code was described by computer scientist Nick Szabo in the 1990s, using a vending machine as an analogy: insert the right coins, choose a product, and the machine delivers it without a shopkeeper.
On a blockchain, the process looks like this:
- 1A developer writes the code, for example in Solidity for Ethereum or Rust for some other networks.
- 2The code is deployed in a transaction and receives its own address.
- 3Users call the contract by sending transactions to that address, often with tokens attached.
- 4Every node executes the code and agrees on the result, so the outcome is the same for everyone.
- 5The contract's state is updated — balances, ownership records or settings change on-chain.
Each step costs a network fee. On Ethereum, that fee is called gas; see what gas is in Ethereum for how it works.
What Smart Contracts Are Used For
| Use | What the contract does | Example |
|---|---|---|
| Tokens | Tracks balances and transfers | An ERC-20 token contract |
| Decentralized exchanges | Holds pools of tokens and prices trades with a formula | An automated market maker |
| Lending | Accepts collateral, issues loans, liquidates risky positions | A DeFi money market |
| NFTs | Records ownership of unique items | A collection's NFT contract |
| DAOs | Counts votes and executes approved proposals | An on-chain governance contract |
| Multisig wallets | Requires several approvals to move funds | A project treasury |
Many of these contracts call each other, which is why DeFi is sometimes described as "money legos." Our guide to DeFi shows how these pieces fit together.
Smart Contracts vs Traditional Contracts
It helps to compare smart contracts with the paper agreements most people know.
| Traditional contract | Smart contract | |
|---|---|---|
| Written in | Human language | Programming code |
| Enforced by | Courts, institutions, the parties' goodwill | The blockchain network executing the code |
| Flexibility | Can be renegotiated or interpreted | Runs exactly as written unless built to be upgraded |
| Transparency | Usually private | Code and activity are often public on-chain |
| Dispute handling | Judges, arbitrators, lawyers | No built-in way to handle disputes beyond the code |
| Speed | Days to months for settlement | Seconds to minutes, depending on the network |
The strengths are speed, transparency and the removal of middlemen. The weakness is rigidity: code cannot weigh fairness or context. If something unexpected happens that the developers did not plan for, the contract simply follows its rules — even when the result is clearly not what anyone intended. We cover this in more detail in What Is a Testnet and Mainnet?
Who Writes and Controls Smart Contracts
Anyone can deploy a smart contract; there is no approval process on public blockchains. That openness enables rapid innovation, but it also means scam contracts are just as easy to deploy as legitimate ones. Once deployed, control depends on how the contract was written: some have no owner at all, some are controlled by a single wallet, and others by a multisig or a DAO vote with a time delay. Knowing which model applies is a key part of judging the risk of any app. Related reading: Smart Contract Exploits.
What Smart Contracts Cannot Do
Smart contracts are powerful but narrow.
- They only know on-chain data. To use real-world information such as prices or sports results, they rely on oracles, which bring outside data on-chain and can fail or be manipulated.
- They do not understand intent. If you send funds to the wrong function or sign a malicious approval, the contract does what the code says.
- They are not automatically legal contracts. Code execution and legal enforceability are separate questions.
- They cannot reverse mistakes. A completed transaction normally stays completed.
Risks of Using Smart Contracts
Bugs and exploits
Code is written by people, and mistakes happen. Attackers search for flaws and can drain funds in a single transaction. Audits help but cannot guarantee safety — see how to evaluate a smart contract audit report.
Admin keys and upgrades
Many contracts are upgradeable or have owner functions that can pause trading, change fees or mint tokens. These can protect users during an emergency, but they also create the possibility of abuse or a stolen admin key. Related reading: Account Abstraction Explained.
Malicious contracts
Scam tokens can include hidden rules, such as blocking sales or charging huge transfer taxes. A contract can look normal on a token page while behaving very differently in practice. See also: ICO vs IEO vs IDO.
Approvals
Using DeFi often requires approving a contract to spend your tokens. Unlimited approvals to a buggy or malicious contract can later be used to take those tokens. If you want to go further, read What Is the Mempool?
How to Check a Smart Contract Before Using It
- 1Confirm the address from the project's official site and an independent source.
- 2Look it up on a block explorer to see its creation date, activity and whether its source code is verified.
- 3Check for audits from known firms, and read whether the issues found were fixed.
- 4Find out who controls admin functions — a multisig, a timelock, or a single wallet.
- 5Start small and limit token approvals to the amount you need.
Our guide on how to verify a token's official contract address walks through the first two steps in detail.
Bottom line
A smart contract is self-executing code on a blockchain that can hold and move value without a middleman. That makes open, programmable finance possible, but it also means bugs, hidden admin powers and malicious code act instantly and irreversibly. Verify the address, understand who controls the contract and only approve what you need.
Frequently asked questions
Are smart contracts legally binding?
Not automatically. A smart contract is software that executes on a blockchain, not a legal agreement in itself. Some legal systems may recognize agreements recorded or executed with code, but this depends on the country and the circumstances. If legal enforceability matters, check local law or ask a qualified professional.
Can a smart contract be changed after it is deployed?
The deployed code itself usually cannot be edited. However, many projects use upgradeable designs, such as proxy contracts, that let an admin point users to new code. That flexibility helps fix bugs but also means someone holds power to change the rules. Check who controls any upgrade or admin keys.
Which blockchains support smart contracts?
Ethereum popularized general-purpose smart contracts, and many other networks support them, including BNB Chain, Solana, Avalanche, Cardano and Ethereum layer-2 networks. Bitcoin supports only limited scripting by design. Each platform uses its own languages and tools, so contracts are not automatically portable between them.
What happens if a smart contract has a bug?
The code runs exactly as written, including the bug. Attackers may exploit it to drain funds, and transactions usually cannot be reversed. Some projects can pause or upgrade contracts to limit damage, while immutable contracts cannot be fixed at all. Audits and bug bounties reduce but do not eliminate this risk.