A smart contract is a program stored on a blockchain that runs when someone triggers it. It can hold tokens, enforce rules, and move money according to code — no human clicking approve on each step.
The name sounds legal. It is not. Think vending machine with rules baked in: put in the right input, get the defined output. Nobody negotiates with the machine.
For where that code runs, see What is the EVM?. For apps built on top, see What is a dApp?.
What it actually is
| Normal software | Smart contract |
|---|---|
| Runs on a company’s servers | Runs on a blockchain every node verifies |
| The company can change behavior | Often hard or impossible to change after deploy |
| You trust the operator | You trust the code (and who wrote it) |
Developers write contracts in languages like Solidity, compile them to bytecode, and deploy them to an address on-chain. That address is the contract’s permanent home. Anyone can call it if they pay gas (gas fees guide).
What they do in DeFi
Examples you will hit as a beginner:
| Use | What the contract enforces |
|---|---|
| Token swap | ”Send X USDC, return Y ETH at this price formula.” |
| Lending pool | ”Track deposits, charge interest, liquidate if collateral falls too low.” |
| Bridge | ”Lock tokens here; mint wrapped tokens on another chain.” |
| ERC-20 token | ”Track balances and transfers for this ticker symbol.” |
| Approval | ”This address may move up to N of your tokens.” (token approvals) |
The website you click is often just a frontend. The contract holds the pool and enforces the math.
How you interact with one
- Connect your wallet to a dApp.
- The site proposes a transaction — which contract, which function, which amounts.
- You sign in your wallet. Signing does not give away your private keys.
- The network runs the contract code. You pay gas for the computation.
Always check:
- Network — Ethereum, Arbitrum, HyperEVM (chain 999), etc. (crypto networks)
- Contract address — from official docs or a block explorer, not a random link in a DM
- What you are approving — especially unlimited token permissions
Key properties and risks
Deterministic — same inputs, same outputs on every node. That is how the ledger stays in sync.
Public — contract code and balances are visible on a block explorer. Privacy is limited.
Immutable (often) — bugs may be permanent if there is no admin key to upgrade the contract.
Upgradeable (sometimes) — a team may retain keys to pause or change logic. Read the docs.
Common risks:
- Smart contract bugs or exploits — funds locked in broken or hacked code
- Phishing frontends — a fake site pointing at a malicious contract with a familiar name
- Admin rug — privileged keys draining or changing the protocol
- Failed transactions still cost gas — the network attempted the work
A smart contract is not automatically safe because it is “on-chain” or “decentralized.” Treat every new contract like a stranger holding your money until you understand what it does and who can change it.
Related: What is the EVM? · What is a dApp? · Token approvals