A smart contract is a program stored on a blockchain that runs exactly as written when someone sends it a transaction. It holds its own code and data at a fixed address, it can hold funds, and every computer in the network that runs it must reach the same result. Despite the name, it is not a legal document. It is software that enforces a set of rules automatically, with no company in the middle deciding whether to honor them.

The idea is older than any blockchain. The computer scientist Nick Szabo coined the term in 1994 and expanded on it in 1996, according to ethereum.org, using a vending machine as the model: put in the right inputs and the machine delivers a guaranteed output. Ethereum, the site says, puts that vision into practice on a public network, and its documentation is the clearest reference for how such programs behave.

A definition in plain terms

The U.S. National Institute of Standards and Technology describes a smart contract in its Blockchain Technology Overview (NIST IR 8202) as “a collection of code and data (sometimes referred to as functions and state)” that is deployed with cryptographically signed transactions. Nodes in the network execute it, all of them must get the same result, and the results are recorded on the blockchain.

Ethereum’s developer documentation puts it more simply: a smart contract “is simply a program that runs on the Ethereum blockchain.” It lives at its own address, has a balance like any account and can receive transactions. Unlike your own wallet account, no private key controls it. It does only what its code allows.

How a smart contract works, step by step

Ethereum’s own example is a cupcake vending machine. Here is the life of a contract like that:

  1. A developer writes the code. On Ethereum that usually means Solidity or Vyper. The code defines functions (actions anyone or only certain accounts may take) and state (the data the contract keeps, such as balances).
  2. The code is compiled and deployed. Deployment is itself a transaction, so it costs a network fee, called gas on Ethereum. Ethereum.org notes that deploying costs far more gas than a simple transfer.
  3. The contract gets an address. From then on, it sits on the chain like any other account and can hold ETH or tokens.
  4. Users call it. You send a transaction to the contract’s address naming a function, for example “buy two cupcakes,” along with any payment.
  5. Every node runs the same code. If the conditions in the code are met (enough payment, enough stock), the contract updates its state and sends the result. If not, the transaction fails and the state does not change, although Ethereum’s gas documentation says the fee is paid whether a transaction succeeds or fails.

That last step is what removes the middleman. In the vending-machine contract, nobody has to trust a shopkeeper to hand over the cupcake once the coin is in. The rule is in the code and the network enforces it.

What smart contracts are used for

Ethereum.org lists everyday uses that most crypto users touch without thinking about it:

  • Tokens. Stablecoins and other tokens on Ethereum are created by smart contracts, and a shared standard lets those currencies work across apps. Our explainer on how stablecoins hold their peg covers the money side; the contract only records balances and enforces transfer rules. It is also why the same token can exist on several networks: each network has its own contract.
  • Exchanges. An automatic, open currency exchange is a set of contracts that hold deposits and apply a pricing formula to every trade.
  • Unique digital assets. Contracts that create and distribute one-of-a-kind tokens.
  • Insurance. Ethereum.org cites a policy that pays out automatically when its conditions are met.
  • Shared accounts. Ethereum.org describes multisig contracts, which only move funds when, for example, three of five key holders sign.

NIST notes that a smart contract need not handle money at all, and that not every blockchain can run them. Solana calls its contracts “programs” and splits them differently: the program holds only executable code, and all changing data lives in separate accounts passed to it.

What a smart contract cannot do

It cannot see the outside world on its own. A contract only knows what is on its blockchain. Ethereum.org explains that this is deliberate: if nodes fetched outside data such as a live exchange rate, they could get different answers and fail to agree. To use real-world information, contracts rely on oracles, services that bring outside data onto the chain. That makes the oracle another party you have to trust.

It cannot be easily fixed. Ethereum.org says contracts “cannot be deleted by default, and interactions with them are irreversible.” A bug ships with the code. Its security guide estimates losses from smart contract defects at well over $1 billion and cites the DAO hack, in which 3.6 million ETH was taken, and the Parity wallet bug that left more than $300 million in ETH locked for good.

It does not judge intent. A contract executes the code, not what its authors or users meant. If the code allows a transfer you did not expect, the network will carry it out.

“Immutable,” with exceptions

Many contracts are not as fixed as the word suggests. Ethereum’s guide to upgrading smart contracts explains that deployed code at an address cannot change, but developers can route calls through a proxy contract that points to replaceable logic, or migrate users to a new version. On Solana, programs deployed with the upgradeable loader can be changed while an upgrade authority is set, and become immutable only once that authority is revoked.

Upgradeability lets developers patch bugs. It also means someone holds the power to change the rules. Before trusting a contract with real money, it is worth knowing who that is and what checks apply, such as a multisig that requires several key holders to agree.

What this means when you use a wallet

Every time a crypto app asks your wallet to “approve” or “sign,” you are usually authorizing a call to a smart contract. Ethereum.org warns about “blind signing”: the raw data in these requests is hard to read, so users can approve something without understanding it. It points to Clear Signing (ERC-7730), a standard meant to show the request in readable language.

Practical checks:

  • Read what the wallet says the transaction will do, and stop if it asks for more access than the task needs.
  • Remember that a contract interaction cannot be reversed once it is confirmed.
  • Protect the keys that sign. A contract cannot tell you apart from someone holding your seed phrase, and your coins never sit in the app itself, as our guide to what a crypto wallet actually stores explains.