What is a smart contract?
Programs that hold money and follow their own rules, and why “decentralized” doesn't always mean what it says.
A smart contract is a program stored on a blockchain that runs automatically when its conditions are met, for example swapping one token for another or releasing a loan. Apps built from smart contracts are called dApps (decentralized apps). They work without a company in the middle, but bugs, hidden admin controls and bad approvals have cost users billions.
How it works, in one example
Think of a vending machine: put in the right coins, press a button, and the machine hands you a drink. Nobody behind the counter decides. A smart contract is that idea in code. A token-swap contract might say: “If someone sends 1 ETH, send back the matching amount of USDC at the current pool price.” Anyone can use it, at any hour, and the rules are public.
A step-by-step example: an escrow
Ana is buying a domain name from Ben for 1,000 USDC and neither trusts the other. A simple escrow contract could work like this:
- The contract's code says: hold the buyer's USDC; if the seller transfers the domain token to the buyer by a deadline, release the USDC to the seller; if not, refund the buyer.
- Ana sends 1,000 USDC to the contract. Anyone can see it's locked there.
- Ben transfers the domain (an NFT) to Ana's address.
- The contract checks the blockchain, sees the transfer happened, and pays Ben automatically. No escrow company, no fee beyond network gas, no one who can run off with the money.
Notice the limit: the contract can only check things recorded on the blockchain. If Ben were selling a car, the code couldn't know whether the car arrived, unless someone trusted reported it (an "oracle," such as Chainlink for prices). See oracles and the oracle problem.
The term "smart contract" was coined by computer scientist Nick Szabo in the 1990s. Smart contracts were popularised by Ethereum in 2015. Many other networks, including Solana, BNB Chain, Cardano and Avalanche, run them too. Bitcoin's built-in scripting is deliberately much more limited.
What they're used for
- Trading: decentralized exchanges (DEXs) like Uniswap.
- Lending and borrowing against crypto collateral (DeFi).
- Stablecoins and tokens: USDC on Ethereum is a smart contract.
- NFTs, games and names like ENS.
- Voting by token holders (DAOs).
Smart contract vs. a legal contract
| Compare | Smart contract | Legal contract |
|---|---|---|
| Written in | Code | Words |
| Enforced by | The blockchain, automatically | Courts, if someone sues |
| Handles judgment calls | No; it only follows its rules | Yes; a judge can interpret intent |
| If there's a mistake | It runs anyway, often irreversibly | It can be corrected or voided |
“Decentralized” apps often aren't fully
The contract may live on a blockchain, but the website you use to reach it is usually run by a company, the price data may come from an outside feed, and a developer team may hold admin keys that can upgrade, pause or drain the contracts. Using blockchain technology isn't the same as being decentralized.
The risks
| Risk | What can happen |
|---|---|
| Bugs | The code does exactly what it says, including the mistakes. The 2016 “DAO” hack drained about 3.6 million ETH through a bug and led to the split that created Ethereum Classic. |
| Admin keys | Whoever controls them can change the rules, and if those keys are stolen, so can a hacker. |
| Dependencies | One app often relies on several others; a failure in one can spread. |
| Bad approvals | Signing a malicious approval lets a contract take your tokens later. This is how “wallet drainers” work. |
An audit is a review by security experts. It can find problems; it can't prove there are none, and audited projects have still been hacked. Ask what the audit covered, what it found, and whether the issues were fixed.
Scams that use smart contracts
- Wallet drainers: a fake airdrop, mint or support page asks you to sign an approval that hands over your tokens.
- Honeypot tokens: contracts that let you buy but block selling. See rug pulls.
- "Trading bot" contracts: videos promising profits from a copy-and-paste "MEV bot" contract; the code sends your deposit to the scammer.
- Fake contract addresses: look-alike tokens and contracts with the same name as real ones.
Before you use a dApp
- Reach it through a link you trust, not an ad or a DM.
- Find out who can change or pause the contracts.
- Read every wallet request. Is it a payment, or an approval to spend your tokens later? Avoid “unlimited” approvals.
- Start with a small amount.
- Periodically review and revoke old approvals in your wallet or a trusted approvals tool.
Frequently asked questions
Are smart contracts legally binding?
Not automatically. Despite the name, a smart contract is just code. Whether it creates a legal agreement depends on the law where you are.
Can a smart contract be changed?
Some can't be changed at all; others are “upgradeable” by whoever holds the admin keys. That difference matters a lot for your safety.
What is a dApp?
A decentralized application: an app whose core logic runs as smart contracts on a blockchain, usually reached through a normal website.
Which blockchains have smart contracts?
Ethereum and its layer 2s, Solana, BNB Chain, Cardano, Avalanche, Tron, Sui and many others. Bitcoin's scripting is far more limited.
What language are smart contracts written in?
On Ethereum mostly Solidity; Solana uses Rust; Sui and Aptos use Move.
Who can see a smart contract?
Anyone. Its code (if published) and every interaction with it are public on the blockchain.
Can a smart contract steal my money?
Only if you send funds to it or approve it to spend your tokens. That's why reading every wallet request matters.
Where to next
Sources
- Introduction to smart contracts (ethereum.org)
- Smart contracts, developer docs (ethereum.org)
- Ethereum security and scam prevention (ethereum.org)
Written for beginners and checked against the sources listed. Last reviewed November 4, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.