What is a smart contract?
Programs that hold money and follow their own rules, and why “decentralized” doesn't always mean what it says.
A smart contract is a program stored on a blockchain that runs automatically when its conditions are met, for example swapping one token for another or releasing a loan. Apps built from smart contracts are called dApps (decentralized apps). They work without a company in the middle, but bugs, hidden admin controls and bad approvals have cost users billions.
How it works, in one example
Think of a vending machine: put in the right coins, press a button, and the machine hands you a drink. Nobody behind the counter decides. A smart contract is that idea in code. A token-swap contract might say: “If someone sends 1 ETH, send back the matching amount of USDC at the current pool price.” Anyone can use it, at any hour, and the rules are public.
Smart contracts were popularised by Ethereum in 2015. Many other networks, including Solana, BNB Chain, Cardano and Avalanche, run them too. Bitcoin's built-in scripting is deliberately much more limited.
What they're used for
- Trading: decentralized exchanges (DEXs) like Uniswap.
- Lending and borrowing against crypto collateral (DeFi).
- Stablecoins and tokens: USDC on Ethereum is a smart contract.
- NFTs, games and names like ENS.
- Voting by token holders (DAOs).
“Decentralized” apps often aren't fully
The contract may live on a blockchain, but the website you use to reach it is usually run by a company, the price data may come from an outside feed, and a developer team may hold admin keys that can upgrade, pause or drain the contracts. Using blockchain technology isn't the same as being decentralized.
The risks
| Risk | What can happen |
|---|---|
| Bugs | The code does exactly what it says, including the mistakes. The 2016 “DAO” hack drained about 3.6 million ETH through a bug and led to the split that created Ethereum Classic. |
| Admin keys | Whoever controls them can change the rules, and if those keys are stolen, so can a hacker. |
| Dependencies | One app often relies on several others; a failure in one can spread. |
| Bad approvals | Signing a malicious approval lets a contract take your tokens later. This is how “wallet drainers” work. |
An audit is a review by security experts. It can find problems; it can't prove there are none, and audited projects have still been hacked. Ask what the audit covered, what it found, and whether the issues were fixed.
Before you use a dApp
- Reach it through a link you trust, not an ad or a DM.
- Find out who can change or pause the contracts.
- Read every wallet request. Is it a payment, or an approval to spend your tokens later? Avoid “unlimited” approvals.
- Start with a small amount.
- Periodically review and revoke old approvals in your wallet or a trusted approvals tool.
Frequently asked questions
Are smart contracts legally binding?
Not automatically. Despite the name, a smart contract is just code. Whether it creates a legal agreement depends on the law where you are.
Can a smart contract be changed?
Some can't be changed at all; others are “upgradeable” by whoever holds the admin keys. That difference matters a lot for your safety.
What is a dApp?
A decentralized application: an app whose core logic runs as smart contracts on a blockchain, usually reached through a normal website.
Where to next
Sources
Written for beginners and checked against the sources listed. Last reviewed October 26, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.