What is a smart contract?

What does a smart contract actually do?

ethereum.org defines a smart contract simply: a program that runs on the Ethereum blockchain, made of code (its functions) and data (its state), sitting at a specific address. The US National Institute of Standards and Technology describes it in similar terms — software deployed on a blockchain and executed by the computers running that blockchain.

The classic comparison, which ethereum.org credits to computer scientist Nick Szabo, is a vending machine. Put in the right money, choose a snack, and the machine releases it. No shop assistant decides whether to serve you; the rules are built into the machine. A smart contract does the same with digital assets: if the conditions written in its code are met, the result follows.

What makes this different from an ordinary app is where the code runs. A company's server can be switched off or edited by the company. A contract on a public blockchain is executed by every node in the network, and NIST notes that execution is deterministic: the same inputs give the same result everywhere.

How does a smart contract run on Ethereum?

1. Write. A developer writes the contract in a language such as Solidity or Vyper.

2. Compile. The code is turned into bytecode for the Ethereum Virtual Machine (EVM), the shared computer that every Ethereum node runs.

3. Deploy. A transaction places the bytecode at a new contract address. ethereum.org notes that deployment costs gas, far more than a simple transfer, and a contract may be at most 24 KB.

4. Call. Users send transactions to the contract. Every node runs the code and updates the contract's stored data identically.

Contracts are passive. ethereum.org distinguishes accounts controlled by private keys, which can start transactions, from contract accounts, which only respond when called. Because contracts are public, they can also call each other — ethereum.org likens them to open APIs. Much of decentralised finance is built from contracts plugged together this way.

Is a smart contract a legal contract?

Not necessarily. A 2018 primer from LabCFTC, the innovation office of the US Commodity Futures Trading Commission, describes a smart contract as a set of coded computer functions that may incorporate the elements of a binding contract — but it stresses that a smart contract is not automatically a legally enforceable agreement. Some just move money on conditions; some may sit alongside a written agreement; some may be unenforceable.

What can't smart contracts do?

They cannot look things up. ethereum.org explains that a contract cannot fetch off-chain information on its own; a price, a sports result or the weather must be delivered on-chain by an oracle. The CFTC primer lists oracle failure and oracle manipulation among the main risks, because a contract is only as reliable as the data it is fed.

They also cannot use judgement. If the code allows a strange outcome, the network will produce it. NIST warns that bugs in deployed code are a significant risk, precisely because a deployed contract is hard or impossible to change.

What happened with The DAO, and why does it still matter?

The DAO was an early Ethereum project that, according to the US Securities and Exchange Commission's 2017 report, raised about 12 million ETH through token sales. On 17 June 2016 an attacker exploited a flaw in its code and diverted about 3.6 million ETH — roughly one third of the total. The SEC report records that The DAO's founders and others backed a hard fork of Ethereum, which took effect on 20 July 2016 and let DAO token holders recover their ETH.

The episode shows both sides of smart contracts: code did exactly what it allowed, and fixing the outcome required changing the blockchain itself. The SEC also concluded that DAO tokens were securities, a reminder that running on a blockchain does not place a project outside the law.

What mistakes do beginners make with smart contracts?

• Equating “smart contract” with “safe”. Code can contain bugs or deliberate backdoors; the CFTC primer lists malicious code and insider backdoors among fraud risks.
• Assuming every contract is unchangeable. Some are built to be upgraded: on Solana, for example, a program stays changeable while an upgrade authority is set. Find out who, if anyone, can change the code.
• Granting unlimited permissions. Approving a contract to spend your tokens can expose your whole balance; see token approvals explained.
• Forgetting that failed calls can still cost fees. Running code uses network resources; Solana's documentation, for one, says fees are charged even when a transaction fails.