Smart Contract
A smart contract is a program stored on a blockchain that runs automatically when predefined conditions are met. No intermediary — no bank, broker, or court — is needed to enforce it. Ethereum popularized smart contracts; today they power DeFi protocols, NFT collections, DAOs, and token issuance. They also carry unique security risks: bugs and malicious code in smart contracts have caused billions in losses.
How Smart Contracts Work
A smart contract is code deployed to a blockchain address. On Ethereum, contracts are written in Solidity (or Vyper) and compiled to EVM bytecode. Once deployed, the bytecode lives at a specific address on the blockchain permanently — it cannot be altered unless the contract was designed with an explicit upgrade mechanism (a proxy pattern). Any user can call the contract's functions by sending a transaction to that address, and the code executes deterministically on every node in the network.
The "conditions" a smart contract enforces are simply if/then logic: if you send X ETH to this address before block Y, then the contract sends you Z tokens. No party needs to trust the other — the code guarantees the outcome. This is what makes decentralized exchanges, lending protocols, and stablecoins possible without a central operator.
What Smart Contracts Power
The scope of smart contract use cases in 2026 is vast:
- DeFi protocols. Automated market makers (Uniswap, Curve), lending markets (Aave, Compound), and derivatives platforms (GMX, dYdX) are entirely smart contract-based. There is no company controlling the liquidity pools — the rules are in the code.
- NFTs and digital ownership. ERC-721 and ERC-1155 token standards define ownership and transfer of unique digital assets. The artwork itself may be off-chain, but ownership records are on-chain and non-custodial.
- DAOs. Decentralized autonomous organizations use smart contracts for governance: token holders vote on proposals, and if a proposal passes, the contract executes the change automatically — no CEO needed.
- Token issuance. The ERC-20 standard (and its equivalents on BNB Chain, Tron, etc.) defines how fungible tokens are created, transferred, and approved. Every altcoin, stablecoin, and governance token is a smart contract.
How Attackers Exploit Smart Contracts
Smart contract exploits are among the most technically sophisticated attacks in crypto — and the most financially devastating. Key attack vectors:
- Reentrancy. The contract sends ETH to an external address before updating its own balance. The receiving address is a malicious contract that immediately calls back into the vulnerable function, repeating the withdrawal. The 2016 DAO hack extracted $60M this way.
- Oracle manipulation. Many DeFi protocols rely on price oracles to know the market price of an asset. If the oracle can be manipulated — typically using a flash loan to temporarily move the price on a DEX — an attacker can trick the protocol into minting tokens at incorrect valuations or draining liquidity.
- Flash loan attacks. Flash loans allow borrowing millions in a single transaction with no collateral, provided the loan is repaid in the same transaction. Attackers use flash loans to temporarily acquire massive capital for price manipulation, governance attacks, or arbitrage exploits.
- Approval exploits. Users grant token spending permissions to contracts using approve() or setApprovalForAll(). If a contract with those permissions is later exploited or is malicious by design, the attacker drains all approved balances.
- Honeypots and malicious upgrades. A honeypot contract looks profitable — you can buy in but cannot sell out, because a hidden condition blocks the transfer. Malicious upgradeable contracts appear legitimate at launch, then the deployer upgrades the logic to steal all deposited funds.
What "Audited" Means — and Its Limits
A security audit is a manual and automated review of a contract's code by a professional firm. Reputable audit firms include Trail of Bits, ConsenSys Diligence, CertiK, Halborn, and OpenZeppelin. An audit significantly reduces risk but does not guarantee safety — auditors can miss bugs, and new attack vectors emerge constantly. The Ronin Bridge ($625M, 2022) and Euler Finance ($197M, 2023) were both audited.
Before interacting with a contract, check: is the audit report public and from a named firm? Is the contract code verified on Etherscan (meaning the source matches the bytecode)? How long has it been live, and what is its total value locked? Contracts that have processed billions in volume over multiple years are substantially more battle-tested than a new launch, regardless of audits.
Frequently Asked Questions
Can smart contracts be hacked?
Yes. Smart contract bugs — reentrancy attacks, integer overflow, oracle manipulation, flash loan attacks — have caused billions in losses. Unlike traditional software, deployed smart contract code is immutable: a bug cannot be patched unless the contract was built with an upgrade mechanism.
What is a reentrancy attack?
A reentrancy attack exploits a smart contract that calls an external address before updating its internal state. The attacker's contract recursively calls back into the vulnerable function before the balance is decremented. The 2016 DAO hack ($60M) was a reentrancy attack.
Are smart contracts legally binding?
In most jurisdictions, not automatically. A smart contract is code, not a legal document. However, some jurisdictions (Arizona, Wyoming in the US) have passed laws recognizing smart contracts as legally enforceable. Traditional contracts can also reference smart contract logic.
How do I check if a smart contract is safe?
Look for: an independent audit report from a reputable firm (CertiK, Trail of Bits, ConsenSys Diligence), open-source code on GitHub or Etherscan, age and volume (older contracts with high TVL have been battle-tested), and check DeFiSafety.com or Rugdoc.io for risk scores.
What is a malicious smart contract?
A malicious smart contract is deployed specifically to steal funds — typically through a drainer pattern, a honeypot (lets you buy tokens but blocks selling), or a backdoor admin function. They often impersonate legitimate protocols. Never interact with unaudited or newly deployed contracts.