Put simply, smart contracts are programs on a blockchain that carry out the terms of a deal on their own, with no bank, notary or exchange in the middle. In this lesson, we'll look at how one of these programs gets launched and runs, where you already come across smart contracts, and which coding mistakes have cost users real money.
- A smart contract is code recorded on a blockchain that runs by set rules identically on every node in the network.
- It isn't smart and it isn't a legal agreement: it does exactly what the code says, bugs included.
- Exchanges, lending services, stablecoins, NFTs and almost all of DeFi run on smart contracts.
- The main risks are code vulnerabilities, admin keys and the approvals you grant the contract yourself.
What is a smart contract
The term was coined by cryptographer Nick Szabo back in the 1990s, long before bitcoin. To explain the idea, he pointed to a vending machine: you put in a coin, press a button, and the drink is yours. There's no need for a seller, because the rule "you pay, you get it" is built into the machine itself.
A smart contract works on the same principle, except the hardware is replaced by a program and the coin slot by a blockchain. The code containing the rules is published on the network and gets its own address, just like a regular wallet. Anyone can send a transaction to that address, and the contract will do what it was built to do: transfer tokens, issue a loan or credit an NFT.
Smart contracts went mainstream after Ethereum launched in 2015. Today, you'll find them on Solana, BNB Chain, Avalanche, Tron and dozens of other networks. The names and programming languages vary, but the core idea is the same: the rules are written in code, and the network enforces them, not a person.
The word smart here means "automatic", not "intelligent". A contract doesn't understand what the parties want and can't fix mistakes. It simply follows instructions.
How a smart contract executes
Take a decentralized exchange. When you tap Swap, your wallet builds a transaction that calls the right function in the contract and asks you to sign it. Once you sign, the transaction goes out to the network, and every node that verifies the block runs the same data through the same code and gets the same result. That's why nobody can secretly tamper with the outcome.
Running the code costs a fee. On Ethereum, it's called gas: the more complex the operation, the more computation it needs and the more it costs. If you run out of gas or a condition in the contract isn't met, the transaction is reverted, but you still pay the fee for the attempt.
Another key property is immutability. Once code is published, you can't just go in and edit it. Developers work around this with upgradeable contracts: users interact with one address, and that address forwards calls to the latest version of the logic. That's handy for fixing bugs, but it also means someone has the power to change the rules.
That leads to a simple rule of thumb: before you sign, look not just at the amount but also at which contract you're dealing with and which function you're calling. Good wallets show this right in the confirmation window, and some will even warn you about suspicious addresses.
- A developer writes the code, for example in Solidity, and publishes it on the network.
- The contract gets an address, and its code becomes visible to everyone.
- A user signs a transaction that calls a contract function.
- Network nodes execute the code and include the result in a block.
- The contract's balances and data change, and a record of it stays on the blockchain forever.
How a smart contract differs from a regular contract
A regular contract describes what people intend to do, and it's up to those people to carry it out, through the courts if necessary. A smart contract executes itself, but only within the blockchain: it can transfer tokens, but it has no way of checking whether your couch was actually delivered.
To learn anything about the outside world, such as the dollar exchange rate or the score of a game, a contract needs an oracle: a service that brings data onto the blockchain. The best-known example is the Chainlink network. The oracle becomes the point you have to trust: if it feeds in the wrong price, the contract will faithfully carry out the wrong action.
| Regular contract | Smart contract | |
|---|---|---|
| Who enforces it | The parties, a bank, a notary, a court | Blockchain nodes, automatically |
| Speed | Days and weeks | The time it takes to confirm a transaction |
| Can it be changed | Yes, by agreement of the parties | No, unless upgrades are built in |
| What if there's a mistake | It can be challenged | The mistake executes as written |
| Link to the real world | Direct | Only through oracles |
On an exchange like Uniswap, you send USDC to the contract, and it uses a formula to calculate how much ETH you're owed and transfers it right away. No operator, no swap request, just code and a liquidity pool.
Where you already run into smart contracts
Almost every token other than native coins like BTC and ETH is a smart contract. USDT on Ethereum or Tron, for example, exists as a contract that keeps a table of balances and the rules for transfers. When you send a token to a friend, you're actually calling a function in that contract.
Decentralized applications are built on smart contracts: exchanges, lending protocols where you can borrow against collateral, NFT marketplaces, and multisig wallets that need several signatures to move funds. This whole sector is known as DeFi, and we cover it in a separate lesson.
Outside of finance, contracts are used for community voting, in-game items, tickets and proving ownership of digital objects. Not all of these ideas have caught on, but the principle is the same everywhere: the rules are public, and whether they're enforced doesn't depend on the goodwill of a single company.
How to look at a smart contract with your own eyes
To make smart contracts feel less abstract, all you need to do is open a block explorer once. It's a website that shows everything happening on the network: transactions, addresses, balances, and contract code. If you remember from the lesson on how blockchain works that all records are public, an explorer is simply a convenient window into those records.
Every contract on Etherscan has a code tab. A green checkmark next to it means the author published the source code and the service confirmed it matches what's actually running on the network. An unverified contract is a black box, and you shouldn't trust it with large amounts.
You can also see who created the contract, how many transactions it has had, and what functions it has. Through the read functions tab, you can look up things like the token's total supply or any address's balance without paying any fee.
- Find the contract address of the USDT token on Ethereum on CoinGecko or CoinMarketCap.
- Paste it into the search bar on etherscan.io.
- Open the Contract tab and make sure the code is verified.
- In the Read Contract tab, find the totalSupply function and check the current supply.
- Scroll through the latest transactions: each line is a call to a contract function.
If you want to try interacting with contracts, use testnets like Sepolia. The coins there are free, and a mistake won't cost you money.
Risks: when the code works against you
A contract will execute a bug just as faithfully as it executes correct logic. The classic example is The DAO in 2016: an attacker exploited a vulnerability in its code and drained a large amount of ETH. The community decided to roll back the damage, and disagreement over that decision split the network into Ethereum and Ethereum Classic.
Since then, protocols, bridges and exchanges have been hacked on a regular basis. Common causes include logic errors, oracle price manipulation and stolen admin keys. A code audit lowers the risk but is no 100% guarantee: even audited projects have been hacked.
For everyday users, approvals are the biggest danger. When you connect your wallet to a site, you often give a contract the right to spend your tokens, sometimes with no limit on the amount. A scam site or a hacked protocol can use that approval later on. You'll learn how to spot these traps in the lesson on scam projects.
- Check that the contract code is verified on a block explorer such as Etherscan.
- Look for public audits and see who did them and when.
- Read exactly what your wallet is asking you to sign instead of hitting Confirm on autopilot.
- Revoke old approvals from time to time using services like Revoke.cash.
- Keep your main funds in a wallet that you never connect to experimental sites.
Once a contract has made a transfer, no call to support will bring it back. You're responsible for whatever you sign.
Follow the steps from the section "How to look at a smart contract with your own eyes": find the USDT contract on Ethereum on Etherscan, make sure the code is verified, and use Read Contract to check the totalSupply value (USDT has six decimal places, so the last six digits are the fractional part). Then open any recent transaction of this contract and see which function was called, most often Transfer. This way you'll see for yourself that sending a token is a call to code.
Entry is free and you trade on a demo account, so you need no money of your own. Free tournaments pay out Tour Passes, and those get you into tournaments with USDT prizes. The best go further — to a $5,000 funded account.
FAQ
Can I write a smart contract without knowing how to code?
Token builders and templates exist, but launching anything on mainnet without understanding the code is risky. For learning, it's better to use testnets, where coins are worth nothing.
Does bitcoin have smart contracts?
Bitcoin has a simple scripting language used for multisig and time locks. Complex applications like exchanges and lending protocols aren't built on it; that's why Ethereum and other networks came along.
Is a smart contract legally binding?
Code on its own isn't a contract in the legal sense, and the approach varies by country. If you need legal protection, it's worth backing the deal with a regular written contract too.
What should I do if I signed a suspicious approval?
Revoke it right away through a block explorer or an approval management service, and move your remaining assets to a new wallet. The faster you act, the less chance someone has to use that approval.
Discussion
Comments from BuyCrypt Live. Sign in with Google or Apple — we create your BuyCrypt account on the way, the same one as in the app.
