Smart Contract: What It Is and How It Works

How smart contracts work

A smart contract is code plus data that lives at an address on a blockchain such as Ethereum.

1. Writing. Developers write the contract in a language such as Solidity or Vyper (for the Ethereum Virtual Machine) or Rust (for Solana).
2. Deployment. The compiled bytecode is sent in a transaction. Once it is included in a block, the contract gets its own permanent address.
3. Interaction. Users or other contracts call its functions by sending transactions, paying a gas fee for the computation.
4. Execution. Every node runs the same code with the same inputs and must reach the same result, so the outcome does not depend on trusting any one party.

The code is public and, unless it was built to be upgradeable, cannot be changed after deployment. A simple example is an escrow: "release these tokens to address B once address A confirms delivery, or refund A after 30 days". Contracts cannot see the outside world directly, so data such as prices arrives through oracles.

A short history

Computer scientist Nick Szabo coined the term in his 1994 essay "Smart Contracts" and developed the idea through the 1990s, comparing it to a vending machine that enforces a deal automatically. Bitcoin has a limited scripting language, but general-purpose smart contracts arrived when Ethereum launched on 30 July 2015 with a Turing-complete virtual machine. Many later chains adopted the same EVM or built their own smart-contract environments.

Bitcoin's Script supports limited contract logic such as multisignature spending, time locks and payment channels, but it was deliberately restricted. Ethereum's Ethereum Virtual Machine (EVM) removed that restriction, and the result was a sequence of waves: ICOs in 2017, DeFi in 2020–2021, NFTs in 2021 and layer-2 scaling throughout.

Two early failures shaped smart-contract security:

• The DAO (2016): The DAO was an investment contract in which ETH holders voted on which projects to fund. In June 2016 an attacker used a reentrancy bug to drain it; according to ethereum.org, more than 3.6 million ETH was taken. The community responded with a fork at block 1,920,000 on 20 July 2016 to recover the funds, and the chain that rejected the fork continued as Ethereum Classic.
• Parity multisig (2017): on 6 November 2017 a user made themselves owner of a shared library contract used by Parity multisignature wallets and then self-destructed it. According to Parity's post-mortem, this froze 513,774.16 ETH held in 587 wallets.

Since then, security practice has matured to include professional audits, bug bounties, formal verification and gradual rollouts. Today smart contracts run on many chains: EVM-compatible networks such as BNB Chain, Avalanche, Arbitrum and Base, and non-EVM chains such as Solana, Sui and Aptos, where contracts are written in Rust or Move.

What smart contracts are used for

• Tokens: fungible tokens (ERC-20), including stablecoins, and NFTs.
• DeFi: lending markets, decentralized exchanges, liquidity pools and derivatives.
• DAOs: on-chain voting and treasury management.
• Wallets: smart-contract wallets with multi-signature approval or recovery options.
• Bridges and layer-2 networks: contracts that lock, verify and release assets between chains.

Example: a simple lending contract

Imagine a lending contract in which users deposit ETH as collateral and borrow a stablecoin against it. The contract encodes the rules, for example:

1. A borrower may borrow up to a set share of the collateral's value (the loan-to-value limit).
2. If the collateral's value falls below a set threshold relative to the loan, anyone may call the contract's liquidation function.
3. The liquidator repays part of the debt and receives some of the collateral plus a bonus, which gives outsiders a reason to keep the system solvent.

Once deployed, the contract runs around the clock with no operator. Anyone in the world can use it, and it enforces its rules exactly as written, for better or worse. That deterministic execution is what makes smart contracts both powerful and dangerous. A condition-based rule can be as simple as "if address A deposits the agreed amount by Friday, release the payment to address B", or as complex as an entire financial market.

Risks of smart contracts

• Bugs and exploits: a mistake in public code that holds funds can be exploited by anyone; many of crypto's largest losses came from contract or bridge bugs. Audits reduce but do not remove this risk.
• Admin keys and upgrades: contracts that can be upgraded or paused give their controllers power that can be misused, including in rug pulls.
• Oracle manipulation and flash loans: attackers can distort the prices a contract relies on.
• Malicious approvals: signing an approval lets a contract move your tokens; check what you sign.
• Legal status: a smart contract is not automatically a legally binding contract; that depends on the jurisdiction.

Two terms that come up in every security discussion:

• Reentrancy: when a contract calls an outside contract before updating its own balances, and the outside contract calls back in to withdraw again. The DAO attack is the best-known case.
• Audit: a professional review of contract code before launch. Check which code version and which addresses the audit report covers.