A decentralised application, or dapp, is an app whose core logic runs as a smart contract on a public blockchain. Users reach that contract through an ordinary web interface. ethereum.org gives the short definition: a dapp "combines a smart contract and a frontend user interface." The website looks like any other site. The difference is in the backend. No company server holds the rules or the balances. A program on a shared network does, and anyone can inspect it and call it.
How a dapp works
The two layers
- The smart contract (backend). ethereum.org describes a smart contract as "simply a program that runs on the Ethereum blockchain": code and data stored at a specific address. ethereum.org says anyone can write one and deploy it to the network. They need to know a smart contract language and hold enough ETH to pay gas.
- The frontend. This is a normal website or app that reads from the contract and asks your wallet to sign transactions. Contracts on Ethereum are public. ethereum.org says they "can be thought of as open APIs", so the contract stays callable even if a particular frontend goes offline.
Properties ethereum.org lists for dapps
- Decentralised: they run on "an open public decentralized platform where no one person or group has control".
- Deterministic: they "perform the same function irrespective of the environment in which they get executed".
- Turing complete: they "can perform any action given the required resources".
- Isolated: they execute in the Ethereum Virtual Machine.
What "immutable" really means
ethereum.org says deployed contracts are "immutable by design": the program at an address cannot be changed. Many teams still build in upgrade paths. The most common is a proxy contract that points to logic contracts the team can replace. ethereum.org warns that upgrading "negates the idea of code immutability" and that "users must trust developers not to modify smart contracts arbitrarily." When you assess a dapp, find out who can upgrade it: one key, a multi-signature wallet or a DAO vote. Check whether a timelock gives users time to exit before a change takes effect.
What dapps are used for
- Decentralised finance (DeFi): lending, borrowing, token swaps through decentralised exchanges, and derivatives. These contracts hold user funds directly, so a bug costs the most here.
- Games and NFTs: the chain records who owns which item and how scarce it is.
- DAOs: on-chain voting and treasury management. The rules sit in the contract code.
Contracts can call other contracts, so dapps are often built from other dapps. A lending app can rely on a separate price feed and a separate token contract. This saves development work, but a failure in one part can affect every app built on it.
Check a dapp before you sign
Answer four questions about the dapp in front of you to see which step from the safety checklist comes next.
Did the contract address come from the project's official documentation, and is the code verified and public?
- Yes, both → next question
- No, or I am not sure → Stop and confirm the contract first
Who can upgrade the contract?
- No one: there is no upgrade path → next question
- A multi-signature wallet or a DAO vote, with a timelock → next question
- One key, or there is no timelock → You are trusting the developers
- I cannot tell → You are trusting the developers
Is the dapp asking you to approve a contract to spend your tokens with no limit?
- Yes, an unlimited approval → Cap the approval
- No: a capped amount, or no approval at all → next question
Do you still have token approvals from dapps you no longer use?
- Yes, or I have never checked → Revoke old approvals
- No, I have revoked them → Read what you sign
The website is only the frontend. Confirm the contract address in the project's official documentation and check whether the code is verified and public. Not every dapp publishes its source code, and interactions with smart contracts are irreversible.
Upgrading a contract negates the idea of code immutability, and users must trust developers not to modify it arbitrarily. Find out whether one key, a multi-signature wallet or a DAO vote controls upgrades, and whether a timelock gives users time to exit before a change takes effect.
A contract with unlimited access can spend all those tokens even if you have withdrawn your funds, and contract permissions have no expiration date. Some wallets let you limit the amount you approve; never grant unlimited access.
Disconnecting your wallet does not revoke approvals. Revoke them with a block explorer or a revoke tool on the right network. Revoking is itself a transaction and costs a network fee.
Your wallet's confirmation screen is the last check before an irreversible action. Read it before you confirm.
This follows the article's checklist only: it cannot check a contract's code or an oracle for you, and it covers Ethereum-style dapps rather than every blockchain.
Limits and risks
Limits ethereum.org names
- Hard to update: once a contract is deployed, changing it is difficult.
- Throughput: ethereum.org says the network "can only process about 10-15 transactions per second". Busy periods raise fees and slow confirmations.
- User experience: setting up a wallet and tools to use the chain securely is still hard for many users.
- Centralisation creep: if key parts are run by one party, ethereum.org says, centralisation "eliminates many (if not all) of the advantages of blockchain".
No access to outside data
ethereum.org says smart contracts "cannot get information about 'real-world' events" on their own. They depend on oracles to supply prices and other offchain data. "Data from an oracle must be correct for a smart contract to execute correctly". A corrupt or hacked oracle can make a contract act on bad data.
Code bugs are expensive and final
ethereum.org notes that interactions with smart contracts are irreversible. The best-known early case is The DAO. In 2016 an insecure contract was drained of more than 3.6 million ETH. Ethereum responded with a hard fork on 20 July 2016, at block 1,920,000, that moved the funds to a withdrawal contract. Miners who rejected the fork kept the original chain running as Ethereum Classic.
Theft is still large. Chainalysis reported on 18 December 2025 that more than $3.4 billion was stolen from January to early December 2025. That figure covers centralised services as well as on-chain protocols. The largest single incident was a $1.5 billion compromise of a centralised service in February 2025, so the total is not a measure of dapp losses alone.
Token approvals
Many dapps ask you to "approve" a contract to spend your tokens, often with no limit. ethereum.org warns that a contract with unlimited access "can spend all those tokens even if you have withdrawn your funds". It also says "there are no expiration dates on contract permissions", and disconnecting your wallet does not revoke them.
What's changed for users: smarter wallets
The biggest recent change is in wallets rather than in dapps:
- ERC-4337 brings smart contract wallets to Ethereum "without modifying Ethereum's core protocol". It also lets someone else pay the fees, or lets users pay in tokens other than ETH.
- EIP-7702 went live with the Pectra upgrade on 7 May 2025. It lets an ordinary externally owned account run code like a smart contract. ethereum.org says this enables transaction batching, gas sponsorship, alternative authentication, programmable spending controls and account recovery.
Together these remove some of the setup and per-transaction friction that ethereum.org lists as a drawback.
Using dapps more safely
- Check the contract, not the website. Confirm that the contract address comes from the project's official documentation, and check whether the code is verified and public. Not every dapp publishes its source code.
- Find out who can upgrade it. Look for proxy patterns, admin control, multi-signature or DAO governance, and timelocks.
- Cap approvals. Some wallets let you limit the amount you approve. ethereum.org advises never granting unlimited access.
- Revoke old approvals regularly. You can do this with a block explorer or a revoke tool on the right network. Revoking is itself a transaction and costs a network fee.
- Read what you sign. Your wallet's confirmation screen is the last check before an irreversible action.
Limitations: this guide relies mainly on ethereum.org documentation and one Chainalysis report, and it covers Ethereum-style dapps rather than every blockchain.
