What Is a Smart Contract? A Plain-English Guide
A smart contract is a program stored on a blockchain that runs automatically when its conditions are met. Here is how they actually work, what they are used for, the real downsides, and how to check whether one is safe.
A smart contract is a program stored on a blockchain that runs automatically when the conditions written into it are met.
That is the whole idea. No signature, no lawyer, no company deciding whether to honor the deal. The code holds the rules, the network runs the code, and the result is recorded permanently.
Almost everything you have read about Ethereum sits on top of this one concept. Tokens are smart contracts. Exchanges are smart contracts. Staking, lending, NFTs, and domain names are all smart contracts. This guide explains what they are, what they are genuinely good at, and where they fail.
What Is a Smart Contract?
The ethereum.org definition is the tightest one available: smart contracts are “computer programs stored on the blockchain that follow ‘if this then that’ logic, and are guaranteed to execute according to the rules defined by its code, which cannot be changed once created.”
Three things are packed into that sentence, and each one matters.
Stored on the blockchain. The code is not on a company’s server. It lives at an address on Ethereum, and every node on the network holds a copy.
Follows if-this-then-that logic. A smart contract is not intelligent. It has no judgment. It checks conditions and acts, the same way every time.
Cannot be changed once created. This is the part people underestimate. Once a contract is deployed, its code is fixed. That is the source of both its greatest strength and its worst failure mode.
The Vending Machine
The comparison everyone reaches for is a vending machine, and it holds up well.
You put in money. You press a button. The machine checks that you paid enough, and if you did, it drops the snack. If you did not, it does not. There is no clerk to ask, no manager to appeal to, and no way to talk it into giving you something for free.
The machine enforces the deal by itself. That is what a smart contract does for money and digital assets.
The comparison is not new. Computer scientist Nick Szabo coined the term “smart contract” in 1994, roughly fifteen years before Bitcoin existed, and used the vending machine as his own example of a primitive ancestor of the idea. He defined it as a computerized transaction protocol that executes the terms of a contract, with the goal of reducing the need for trusted intermediaries.
Szabo had the concept decades before there was anything to run it on. Ethereum’s contribution in 2015 was providing the machine.
A Smart Contract Is Neither Smart Nor a Contract
The name is bad, and it causes real confusion. It is worth clearing up before going further.
It is not smart. There is no AI in it. A smart contract is a small, rigid program, usually a few hundred lines. It cannot interpret intent, handle an edge case nobody anticipated, or decide that something is unfair.
It is not a contract in the legal sense either. A legal contract is an agreement that courts will enforce. A smart contract is code that executes. Those overlap sometimes and diverge often. If a smart contract does something you did not intend, it has still done exactly what it was told, and there is no clause about that.
Think of it as an escrow agent that is perfectly reliable and completely literal.
How a Smart Contract Actually Works
Here is the full lifecycle, without jargon.
A developer writes the code. Most Ethereum contracts are written in Solidity, a language built for the purpose. The code defines what the contract stores and what actions anyone can take against it.
The code is compiled and deployed. Solidity gets compiled into bytecode, which is what the Ethereum Virtual Machine actually runs. Deploying it is a transaction like any other, and it costs gas. When it confirms, the contract has its own address on Ethereum.
Anyone can now call it. You send a transaction to that address specifying which function you want and what values you are passing. This is what is happening under the hood every time you click a button in a dapp.
Every node runs the code. Not just one. Every node on the network executes the same function with the same inputs and reaches the same result, which is what makes the outcome trustworthy without a referee.
The result is written to the blockchain. Balances move, ownership changes, and the record is permanent.
The important detail is step four. A smart contract does not run continuously in the background waiting for something to happen. It is dormant until a transaction wakes it up. A contract cannot check the time and act on its own, which is why so much of DeFi depends on outside parties poking contracts at the right moment.
What Smart Contracts Are Used For
Almost every use of Ethereum you have heard of is a smart contract with a friendly website attached.
| Use | What the contract does | Real example |
|---|---|---|
| Tokens | Tracks who owns how much of a token | Every ERC-20 token, including USDC |
| Trading | Holds two tokens and prices swaps between them | Uniswap, ~$1.6B in its V3 pools |
| Lending | Holds deposits, issues loans, liquidates bad debt | Aave V3, ~$17.6B deposited |
| Staking | Pools ETH and issues a receipt token | Lido, ~$24.3B staked |
| NFTs | Records who owns which unique item | ERC-721 collections and marketplaces |
| Names | Maps a readable name to an address | ENS and .eth domains |
| Stablecoins | Issues and redeems a dollar-pegged token | USDC |
Figures are from DefiLlama as of September 2026 and move constantly.
Notice what these have in common. Each one is a job that traditionally required a trusted company: a broker, a bank, a registrar, an escrow agent. The contract does not do the job better in every respect. It does it without requiring you to trust the operator.
Is Bitcoin a Smart Contract Platform?
Not in the way Ethereum is, and the difference is deliberate.
Bitcoin has a scripting language, but it is intentionally limited. It can express conditions like “this needs two of these three signatures” or “this cannot be spent until a certain block.” It cannot loop, and it cannot run arbitrary programs. That restriction is a security decision, not an oversight: less expressive code means a smaller attack surface for a network whose only job is holding value.
Ethereum went the other way. The EVM runs general-purpose programs, which is why the ecosystem around it looks so different. You can read the full comparison in our Ethereum vs Bitcoin guide.
Other chains sit at various points between the two:
| Chain | Smart contracts? | Notes |
|---|---|---|
| Ethereum | Yes, general purpose | The EVM standard everyone else copies |
| Arbitrum, Base, Optimism | Yes, EVM compatible | Layer 2s running the same contract code |
| Solana | Yes, called “programs” | Different engine (the SVM), not EVM compatible |
| Bitcoin | Limited scripting only | No general-purpose contracts by design |
| XRP Ledger | Not natively | Ripple runs a separate EVM sidechain, live since June 2025 |
If a chain advertises itself as “EVM compatible,” it means Ethereum smart contracts can be deployed there with little or no modification.
What Are the Downsides of Smart Contracts?
This is the section most explainers skip, and it is the one that costs people money.
Bugs are permanent. Normal software gets patched. A deployed contract usually cannot be. If there is a flaw, it stays there, in public, for anyone to find and exploit. The canonical case is The DAO in June 2016, where an attacker used a reentrancy bug to drain roughly 3.6 million ETH. The response was so drastic that Ethereum hard forked to reverse it, which is how Ethereum Classic came to exist. That was possible only because the network was young and the amount was existential. Nobody is forking Ethereum for your loss.
The money is real and the losses are large. DeFi protocols lost at least $1.3 billion through the first half of 2026, according to CertiK’s Hack3d report as covered by crypto.news. DefiLlama called the second quarter of 2026 the most hacked quarter in DeFi history, with 99 separate exploits.
But the contracts are not always the weak point. Here is the finding that should reframe how you think about risk: in 2026, compromised private keys overtook smart contract bugs as the leading cause of losses for the first time on record. Three of the four largest incidents that year involved no flawed code at all. The contracts did precisely what they were programmed to do, having been given instructions by attackers who had stolen the keys to give them.
The lesson for a beginner is not “smart contracts are dangerous.” It is that protecting your own keys matters at least as much as picking audited protocols.
A contract only knows what is on-chain. It cannot check a stock price, a sports score, or the weather. Anything from the outside world has to be fed in by a service called an oracle, and that service becomes a point of failure. Manipulating an oracle to make a contract believe a false price is a recurring attack.
You cannot undo anything. No chargebacks, no support ticket, no reversal. Approving a malicious transaction is final the moment it confirms.
Reading the code is not realistic for most people. “Don’t trust, verify” is good advice that almost nobody can actually follow. In practice you are trusting auditors, reputation, and time.
How to Check If a Smart Contract Is Legit
You will not read the Solidity. Here is what you can do instead, in the order it is worth doing.
Check that the source code is published. On Etherscan, a verified contract shows its human-readable source alongside the bytecode that is actually deployed, and Etherscan confirms the two match. An unverified contract is a black box: you can see that code exists at that address, but not what it does. Unverified is not proof of fraud, and plenty of legitimate contracts go unverified through carelessness. For a beginner it is still a hard stop.
Check the age and the amount deposited. A contract holding hundreds of millions of dollars that has been live for years is not a guarantee, but it has survived a long time with a large bounty on its head. A contract deployed last week has not been tested by anyone.
Look for audits, then discount them. Reputable protocols publish audits from firms like Trail of Bits, OpenZeppelin, or CertiK. An audit is a professional review at one point in time, not a warranty. Plenty of audited contracts have been drained.
Reach it through a link you trust. Most losses do not come from a flawed contract. They come from an ordinary-looking site pointed at a malicious one. Type the address yourself or use a bookmark. Search ads impersonating major protocols are a standing problem.
Read the wallet popup. This is the last line of defense and the one that actually works. The website can display anything. The popup shows what you are really signing.
Watch out for unlimited approvals. Many contracts ask for permission to spend a token on your behalf, and the default request is often unlimited and permanent. That permission survives long after you stop using the app. You can review and cancel old approvals at revoke.cash.
Do You Need to Understand Smart Contracts?
You do not need to write one or read one. You do need to understand three things about them.
They execute automatically, so nothing is pending anyone’s approval and nothing can be recalled.
They are immutable, so a bug is permanent and a permission you grant does not expire on its own.
They are only as safe as the weakest link around them, which is usually a person and their keys rather than the code itself.
Hold those three ideas and the rest of Ethereum stops being mysterious. A token, a swap, a loan, a staking deposit: each one is a program at an address, waiting for a transaction, doing exactly what it says.
This article is educational and is not financial advice.
Related Reading
- What Is the EVM?
- What Is a dApp?
- What Is DeFi?
- What Is Etherscan?
- ERC-20 Tokens Explained
- What Is Ethereum?
