What Is a Smart Contract? How It Works, Where It Is Used and Its Risks

A smart contract is a program stored on a blockchain that runs automatically when set conditions are met. Ethereum's developer documentation defines it as "simply a program that runs on the Ethereum blockchain". Once deployed, the code holds and moves assets by its own rules, and no company or middleman approves each step. You don't have to trust the other party. You do have to trust the code, the network it runs on, and any outside data it relies on.

Where the idea came from

Computer scientist Nick Szabo described the concept in 1994: "A smart contract is a computerized transaction protocol that executes the terms of a contract." Ethereum's documentation uses his vending machine image to explain it: put in the right inputs and a certain output is guaranteed, with no shop assistant in between.

The idea became practical on public blockchains. Bitcoin already had a limited form. Every Bitcoin output carries a small script that sets the conditions for spending it. Bitcoin's developer guide describes that language as "a Forth-like stack-based language deliberately designed to be stateless and not Turing complete", with no loops. It is predictable, but it can't run general applications.

Ethereum was built to remove that limit. Vitalik Buterin published its white paper in 2013, and the Frontier mainnet went live on 30 July 2015. Ethereum's contracts can hold state and run general-purpose logic.

How a smart contract works

1. Write the rules. A developer writes the logic as "if this happens, then do that", usually in a language such as Solidity for Ethereum.
2. Deploy. The compiled code goes to the blockchain in a transaction and gets its own address. Ethereum's documentation says anyone can write a smart contract and deploy it to the network. Contract code is capped at 24KB.
3. Call it. Users and other contracts send transactions to that address. Every node runs the same code and reaches the same result, so the outcome doesn't depend on any single party.
4. Pay for computation. On Ethereum, each operation costs gas, and the fee is paid in ETH. The fee is paid "regardless of whether a transaction succeeds or fails". If a transaction runs out of gas, its changes are reversed but the gas is still used up.
5. Live with the result. Ethereum contracts are "immutable by default". Developers can build in upgrade mechanisms, but without them a bug can't simply be patched.

Contracts are public and can call each other. Ethereum's documentation describes them as "open APIs", which is why one application can be built on top of another.

The oracle problem

A contract can only see data that is already on its blockchain. In Ethereum's words, "Smart contracts alone cannot get information about 'real-world' events." Prices, weather and sports results arrive through oracles, which are services that bring outside data on-chain. That brings back the trust a contract was meant to remove. If a centralised oracle "becomes corrupt, smart contracts will execute based on bad data."

Where smart contracts are used

Tokens and NFTs

Most tokens on smart contract chains are contracts themselves. For NFTs, the ERC-721 standard (created 24 January 2018) defines "a standard API for NFTs within smart contracts". It includes ownerOf, which returns a token's owner, and transferFrom and safeTransferFrom, which move ownership. The NFT is the record kept by that contract. Whatever the token points to, such as an image, is often stored somewhere else.

Decentralised finance

Lending pools, stablecoins backed by crypto collateral, and decentralised exchanges are all contracts that hold users' funds and follow fixed rules. A loan can be issued, priced and liquidated without a loan officer. Those rules usually depend on oracle prices, so the oracle risk above applies directly.

Organisations (DAOs)

A decentralised autonomous organisation uses contracts for voting, treasuries and payouts. Wyoming's 2021 law (SF0038, effective 1 July 2021) lets a limited liability company be formed as a DAO that is managed in whole or in part through smart contracts.

Delaware's Senate Bill 69 is often linked to DAOs, but it did something narrower. Effective 1 August 2017, it amended the state's General Corporation Law so corporations can keep records, including the stock ledger, on distributed ledgers.

Contracts with legal effect

Arizona's HB 2417, approved on 29 March 2017, says a contract "may not be denied legal effect, validity or enforceability solely because that contract contains a smart contract term". It covers transactions under the state's commercial code articles on sales, leases and documents of title. The law defines a smart contract as "an event-driven program, with state, that runs on a distributed, decentralized, shared and replicated ledger and that can take custody over and instruct transfer of assets on that ledger".

In England and Wales, the Law Commission advised the government on 25 November 2021 that "the current legal framework in England and Wales is clearly able to facilitate and support the use of smart legal contracts", and that no statutory reform was needed.

Blockchains that run smart contracts

• Ethereum: the general-purpose contract platform, live since July 2015.
• Cardano: the Alonzo hard fork on 12 September 2021 brought smart contracts through Plutus.
• Avalanche: its Primary Network has three chains. The C-Chain is "an implementation of the Ethereum Virtual Machine (EVM)" and runs Solidity contracts. The P-Chain handles validators and staking, and the X-Chain handles native assets.
• Bitcoin: supports scripted spending conditions but not general-purpose stateful contracts.

Benefits and risks

What smart contracts do well

• They run the same way for every user, and anyone can read the code and its history on-chain.
• They can settle without an intermediary approving each step.
• Contracts can be combined, so new services can build on existing ones.

Where they fail

• Bugs are costly and hard to fix. In the 2016 DAO hack, 3.6 million ETH was taken through a re-entrancy flaw, where a malicious contract calls back into a vulnerable one before it updates its records. Ethereum's security documentation says re-entrancy is "still a critical issue" and that audits "won't catch every bug".
• Outside data can be wrong. A contract is only as reliable as its oracle.
• Fees are paid even on failure. A failed transaction still costs gas.
• Legal status varies. Some places recognise smart contract terms, as Arizona does, and some confirm existing law already covers them, as England and Wales do. Many have no specific rule. Code also can't settle a dispute about what the parties meant.
• Upgradeability cuts both ways. A contract that can be upgraded can be fixed, but whoever controls the upgrade could also change the rules.

Before you use a contract, check whether its code is published and audited, who can upgrade or pause it, and which oracle it uses.

This guide covers general principles and the laws named above. It isn't legal advice, and the rules in your jurisdiction may differ. It isn't investment or trading advice either.