What is a smart contract, and how does it work?

A smart contract is a program stored on a blockchain that runs exactly as written whenever someone calls it. It holds its own funds and rules, and it executes automatically — no company or middleman decides whether to honour it. "If this happens, do that" becomes code that the whole network enforces. This is what turns a blockchain from a simple ledger of balances into a platform for applications.

What makes it "smart"

The name is a little misleading: a smart contract is not clever and not a legal contract. It is just code with two unusual properties:

• It lives on-chain. The code is deployed to an address and stored by the network, so anyone can see it and call it.
• The network enforces it. Every node runs the same code and must agree on the result, so no single party can change the outcome or refuse to run it.

Think of a vending machine: put in the right input, and it releases the output automatically, with no cashier to approve the sale. A smart contract is that idea, generalised and running on a blockchain.

How it works, step by step

1. A developer writes the code, often in a language like Solidity (on Ethereum) or Rust (on chains such as Solana).
2. It's deployed to the blockchain, getting its own address. The code is now fixed and public.
3. Users call its functions by sending transactions — for example, "swap 1 ETH for USDC" or "deposit into this pool."
4. Every node executes the code in a shared environment (on Ethereum, the EVM, the Ethereum Virtual Machine) and agrees on the new state.
5. The result is recorded on-chain: balances move, data updates, events fire.

Two properties make this trustworthy:

• Deterministic. The same input always produces the same output on every node, so everyone agrees.
• You pay gas. Running code costs gas fees, which prevents infinite loops and spam by charging for computation.

What they're used for

Smart contracts are the building blocks of most of web3:

• Tokens. Stablecoins and most crypto tokens are smart contracts tracking balances.
• DeFi. Lending, trading on automated market makers, and derivatives are all contracts holding and moving funds by rule.
• NFTs. The ownership records and transfer logic are contracts.
• DAOs. Treasuries and on-chain voting run through contracts.

A powerful feature is composability: contracts can call one another, so developers snap existing pieces together like Lego. A new app can route through an existing exchange contract without permission, which is why DeFi grew so fast.

The risks

Automation cuts both ways — the code does exactly what it says, bugs included.

• Bugs are costly. A flaw can let an attacker drain funds, and billions have been lost this way. The 2016 "DAO hack" exploited a reentrancy bug and reshaped Ethereum's early history.
• Immutability. Once deployed, code usually can't be edited. That guarantees no one can tamper with it, but also means mistakes can't simply be patched.
• Upgrade patterns add their own risk. To allow fixes, teams use proxy contracts that point to upgradeable logic — convenient, but it reintroduces a party who can change the rules, which users must trust.
• Oracles. Contracts can't see the outside world on their own; they rely on oracles (like Chainlink) to feed in prices and data. A wrong or manipulated feed can trigger bad outcomes.

Because of this, serious projects get audited by security firms, and many add timelocks, bug bounties, and limits. Even then, "the code is law" means caution: read what a contract does, and check for a reputable audit, before trusting it with funds.

This area evolves quickly, so treat specific tools, languages and standards here as a snapshot and verify current best practice before building or investing.

Key takeaways

1. A smart contract is code stored on a blockchain that runs automatically and is enforced by the whole network.
2. It's deployed to an address, is public and usually immutable, and executes the same way on every node (deterministic).
3. Running it costs gas, which pays for computation and prevents spam and infinite loops.
4. Contracts power tokens, DeFi, NFTs and DAOs, and their composability lets apps build on each other.
5. The biggest risks are bugs, immutability (hard to fix), trusted upgrade proxies, and faulty oracles.
6. Favour audited contracts, understand what you're signing, and remember the code does exactly what it says — not what you hoped.