A smart contract is a program stored on a blockchain that holds coins, tokens or records and changes them only by the rules written into its code. Instead of a bank or broker deciding when funds move, the code sets the conditions, and the network's nodes all execute it and must reach the same answer. The idea is older than blockchains: in 1994 the computer scientist Nick Szabo described a smart contract as "a computerized transaction protocol that executes terms of a contract," a definition the SEC quoted in its 2017 report on The DAO. Ethereum, live since 2015, made the idea practical, and contracts now run stablecoins, lending markets, exchanges and bridges; the dollar value deposited in them is tracked as total value locked. The crypto hub covers the wider market.
What does a smart contract do?
It holds assets and records at a fixed address and changes them only when a transaction calls one of its functions and the code's conditions are met.
On Ethereum a contract is a type of account, like a user's wallet, with two differences that matter to anyone depositing money. It has no private key: ethereum.org notes that contract accounts are controlled by the logic of their code, so nobody can sign a transfer out of one unless the code provides a function for it. And it cannot act on its own initiative. A contract runs only in response to a transaction, which an ordinary key-controlled account has to send and pay for, though one contract can call others along the way. From the outside, its address looks like any other 0x wallet address.
| Part of a contract account | What it holds | Can it change? |
|---|---|---|
| Address | 20 bytes, set at creation from the deployer's address plus either its nonce or a chosen salt and the code | No |
| Code | Compiled bytecode that runs on every call, fingerprinted by its hash | No; upgradeable designs point to a separate logic contract instead |
| Storage | The contract's records, such as each holder's token balance or each loan's collateral | Only through the contract's own functions |
| ETH balance | Ether held at the address | Yes |
| Nonce | The number of contracts this one has created | Yes |
| Private key | None | Not applicable |
Tokens are a special case. An ERC-20 token is itself a contract, and its balances are entries in that contract's storage keyed by holder address, so a lending pool that "holds" USDC is really an address with a large entry in the USDC contract's ledger. Solana divides things differently. Its contracts are called programs, and programs are stateless: balances and other records sit in separate accounts that a program owns, and only the owner program can change their data or take lamports out. What is Solana covers that network, and what is Ethereum explains the virtual machine that runs contract code on Ethereum and the many chains that copy it.
Most people use contracts without seeing the word. A stablecoin balance, a swap on a decentralized exchange, a deposit in a lending pool and a wallet prompt asking to approve a token all run on contracts, and block explorers mark those addresses as contracts rather than ordinary accounts. How stablecoins work covers the token contracts behind dollar coins.
How is a smart contract deployed and called?
Deployment is a transaction with no recipient that carries compiled code; a call is a transaction to the contract's address naming a function and its inputs.
Developers write contracts in a language such as Solidity or Vyper and compile them to bytecode. Ethereum.org notes that deploying costs gas like any transaction but needs far more of it than a plain transfer, because the code is stored on chain, and EIP-170 caps deployed code at 24,576 bytes. The new contract's address is fixed by the deployment itself. Under the original CREATE method it comes from the deployer's address and nonce; under CREATE2 it comes from the deployer, a value the deployer picks called a salt, and a hash of the creation code, so the address can be known, and even sent funds, before any code exists there.
Calling a contract means putting its address in the transaction's to field and an encoded instruction in the data field. Under the Solidity ABI specification, the first four bytes of that data, the function selector, tell the contract which function to run.
For approve(address,uint256), the ERC-20 function that grants spending rights, the selector is 0x095ea7b3; for transfer(address,uint256) it is 0xa9059cbb. Wallets decode those bytes into a readable prompt where they can, and when they cannot, the signer is approving data nobody has translated, the gap the Bybit attackers used, as described below.
The account that sends the transaction pays the gas, in ether; the Ethereum price page shows what that coin costs. If any step fails, the whole call is reversed, but ethereum.org notes that the fee is still charged for the work performed. Gas fees explained covers how the fee is priced.
How does a token approval let a contract move funds?
A contract can pull ERC-20 tokens from a wallet only up to an allowance that the holder grants by signing an approve call.
The ERC-20 standard says approve lets a spender withdraw "multiple times, up to" the approved amount, and a new approve call overwrites the old figure instead of adding to it. Swaps, deposits and loans usually start this way: the wallet approves, then the protocol's contract calls transferFrom to take the tokens. The numbers show why the size of the approval matters.
Worked example: An exact approval versus an unlimited one
A wallet holds 2,500 USDC on Ethereum and is about to swap 400 of them. The USDC contract reports 6 decimal places, so 400 USDC is stored as 400,000,000 base units.
- Exact approval. The data field carries the selector 0x095ea7b3, the swap contract's address padded to 32 bytes and 400,000,000 as a 32-byte number: 4 + 32 + 32 = 68 bytes. The swap pulls 400,000,000 units through transferFrom, the allowance drops to 0, and the other 2,100 USDC stay out of the contract's reach.
- Unlimited approval. Many apps ask instead for the largest number the field can hold, 2²⁵⁶ − 1, a 78-digit figure of about 1.16 × 10⁷⁷ base units, or roughly 1.16 × 10⁷¹ USDC. After the same swap the allowance is still effectively endless, so the contract, or anyone who takes control of it, can later take the remaining 2,100 USDC and any USDC that arrives afterward.
- Revoking. Setting the allowance back to 0 takes one more approve transaction with its own gas fee, which the revoke tools listed by ethereum.org prepare automatically.
Ethereum.org's revoke guide advises granting only the amount a transaction needs and clearing old allowances regularly. Crypto scams shows how drainer sites turn approvals that people sign without reading into theft.
What do smart contract audits miss?
An audit is an outside review of one version of the code at one point in time, and ethereum.org cautions that audits will not catch every bug.
Auditors read the source, run tests and analysis tools, and report the flaws they find, which the team may or may not fix before launch. Several gaps remain by design:
- Scope. A report covers the files and version it names. Later upgrades, new pools and the website people use to reach the contract are separate code.
- Tools. Reviewers read source code, but the network runs the compiler's output. The Curve pools drained on July 30, 2023 had reentrancy locks that versions 0.2.15, 0.2.16 and 0.3.0 of the Vyper compiler built incorrectly. The Vyper team's post-mortem says the bug was fixed in version 0.3.1 in late 2021 without anyone realizing that deployed contracts were exposed.
- Economics and inputs. An audit checks that code does what it says, not that the design survives a flash loan or a manipulated price feed. The blockchain oracle entry covers price-feed attacks.
- Keys. No code review protects the private keys of the people allowed to upgrade or pause a contract.
Audit labels can mislead too. Slock.it's website, quoted in the SEC's report, described The DAO's code as "audited by one of the best security companies in the world." Parity's multisig library was adapted from audited wallet code, but Parity's post-mortem says the library itself had no formal audit. Track records are no proof either: CEX vs DEX covers a 2025 exploit of long-running exchange pools. Bug bounties, which pay outsiders who report flaws, and formal verification of a contract's correctness add further layers.
Who can change an upgradeable smart contract?
Whoever holds its upgrade rights: one key, a multisig, a token-holder vote or, if the developers gave those rights up, nobody.
Code at an Ethereum address cannot be edited, so upgradeable systems split the job in two. Users interact with a proxy contract that keeps the balances and records, and the proxy forwards each call with delegatecall to a separate logic contract, whose code then runs as if it were the proxy's own. Upgrading means pointing the proxy at a new logic contract. ERC-1967 standardizes the storage slot where proxies keep that pointer, so block explorers can detect a proxy and show the logic contract behind it. On Solana, programs deployed with the upgradeable loader can be replaced while an upgrade authority is set, and setting that authority to none makes a program immutable for good.
Upgrades let teams patch bugs that immutable code would carry forever, but they move trust from the code to the people holding the keys. Ethereum.org's guidance lists the usual safeguards: put upgrades behind a multisig or a governance vote, and add a timelock, a delay between approval and execution that gives users time to withdraw if they object. A timelock also slows emergency fixes, which is why many protocols keep a separate pause switch, one more power users have to trust.
Bybit's cold wallet shows how the upgrade path itself becomes the target. It was a Safe multisig that needed at least three signers. According to NCC Group's analysis, attackers planted code in the Safe web interface through a compromised developer machine, so on February 21, 2025 the signers approved what looked like a routine transfer. The data began with 0xa9059cbb, the transfer selector, but it ran as a delegatecall that rewrote the proxy's pointer to the attackers' contract. With the logic replaced, they emptied the wallet of about $1.5 billion in assets, a theft the FBI attributed to North Korea.
Which exploits show how smart contracts fail?
Four cases show four different ways contracts fail: a logic flaw, a missing access check, a faulty compiler and a hijacked upgrade.
| Date | Contract | What went wrong | Result |
|---|---|---|---|
| June 17, 2016 | The DAO, a crowdfunded investment pool run by code | Its withdrawal logic could be re-entered before the caller's balance was updated, so the attacker withdrew repeatedly | About 3.6 million ETH, a third of the fund, moved to the attacker; a hard fork on July 20, 2016 let investors reclaim their ether |
| November 6, 2017 | Parity's multisig wallet library | The shared library had never been initialized, so a user made himself its owner and triggered its self-destruct function | 513,774.16 ETH frozen in 587 wallets |
| July 30, 2023 | Curve pools compiled with Vyper 0.2.15 to 0.3.0 | A compiler bug broke the pools' reentrancy locks | Losses to liquidity providers of more than $70 million, according to LlamaRisk |
| February 21, 2025 | Bybit's Safe multisig cold wallet | Signers approved a disguised call that replaced the wallet's logic contract | About $1.5 billion, which the FBI attributed to North Korea |
The outcomes differed as much as the causes. The DAO's own rules kept the diverted ether in the attacker's address for 27 days, a delay that left time to organize the fork. Parity's frozen ether had no such remedy: EIP-999, a 2018 proposal to restore the library's code, was withdrawn, and on November 2, 2026 the library's address still held no code. Bridges, which pool deposits for transfers between chains, form their own category, and crypto bridges explained lists the largest bridge thefts from 2022 to 2026. What is DeFi covers lending exploits such as Euler's in 2023.
Smart contract vs dApp, token, oracle and legal contract
These terms are often used interchangeably, but they name different layers of the same system.
| Term | What it is | How it relates to a smart contract |
|---|---|---|
| dApp | A website or app plus the contracts behind it | The website can change or be faked without touching the contract, which is what holds the money |
| Token | A balance recorded in a token contract's storage | Every ERC-20 token is a contract, and moving one means calling it |
| Oracle | A service that posts outside data, such as prices, on chain | Contracts cannot fetch outside data themselves, so they act on whatever the oracle reports |
| Multisig or smart account | A wallet that is itself a contract, with rules such as 3 of 5 signatures | Adds checks beyond a single key, but its own code and upgrade path become targets |
| Protocol | A group of contracts under shared governance | Its risk combines its contracts, its admin keys and its oracles |
| Legal contract | An agreement a court can enforce | Code can carry out payment terms, but the law still applies to what it does |
The legal row matters most when something goes wrong. In the DAO report, the SEC concluded that automating functions through smart contracts "does not remove conduct from the purview of the U.S. federal securities laws," and found that The DAO's tokens were securities.
What do people misread about smart contracts?
The most common misreading is that code on a blockchain cannot change, when many contracts can be upgraded by whoever holds the keys.
- Immutable is a claim to check. A proxy can point to new logic whenever its admin chooses, unless a timelock or a vote stands in the way.
- Verified is not audited. Verification on an explorer such as Etherscan proves which source code compiles to the deployed bytecode. It says nothing about whether anyone reviewed that code, and ethereum.org notes that a partial match can even carry misleading comments.
- Audited is not safe. An audit covers one version, and the compiler, the oracles, the website and the admin keys sit outside it.
- An approval does not live in the website. It is recorded in the token contract, so closing the site or disconnecting the wallet leaves it in force until it is spent or revoked.
- Code is not the last word. The DAO's code allowed the attacker's withdrawals, yet a hard fork reversed them, and the SEC still applied securities law to the tokens.
- A contract address is not a person's wallet. Tokens sent to a contract with no function for returning them usually stay there, and sent crypto to the wrong network covers what can be recovered.
The quick checks before a deposit follow from the same list: take the address from the project's own documentation, see whether the source is verified and who can upgrade or pause the contract, and approve only what the transaction needs. Treat the deposit as uninsured, since FDIC and SIPC coverage applies to banks and brokerages, not to code.