A smart contract is a program stored at an address on Ethereum that runs exactly as written when a transaction calls it. No company operates it, and anyone can check what it does. If you have ever held USDT or USDC, you have already used one, because those tokens are smart contracts.
What is an Ethereum smart contract?
A smart contract is a small program that lives at an address on the Ethereum blockchain and runs when someone sends it a transaction. It holds its own data, follows its own rules, and produces the same result for everyone, because thousands of computers run it and check each other. Once it is deployed, no single party controls it.
The classic comparison is a vending machine. You put in the right input, and the machine gives a fixed output. No cashier decides anything. A smart contract works the same way. The rules are written into the code in advance, and the result happens on its own once the conditions are met (source: Introduction to smart contracts). There is no manager who can step in and change the outcome for one person.
What makes this useful is trust. With a normal app, you trust the company behind it to run the code honestly and not change your balance. With a smart contract, you do not have to. The code is public, the data is public, and every Ethereum computer runs the same rules and agrees on the result. That is why people can swap tokens or lend money through a contract without knowing or trusting whoever wrote it.
A simple example makes the difference concrete. If a bank's app says you have 100 dollars, you are trusting the bank's private records, which you cannot see and they can change. If a token contract says you hold 100 USDC, that number lives in public storage that thousands of computers agree on, and the only way it changes is by the rules written in the contract's code. The trust moves from a company's promise to math anyone can check.
Smart contracts run on the Ethereum Virtual Machine, the shared engine that executes Ethereum's code. What the EVM is, and how it reaches the same answer on every computer, is covered in our guide on how Ethereum works. Here the thing to hold onto is simpler: a contract is just code sitting at an address, waiting to be called.
How is a smart contract different from regular software?
A smart contract differs from a normal app on several fronts: it is deployed once and usually cannot be changed, anyone can call it, the caller pays to run it, and its code is public. A regular program runs on a private server the owner can edit; a contract runs on a public network nobody controls.
These differences are easier to see side by side:
Feature | Regular software | Smart contract |
|---|---|---|
Where it runs | A private server the company owns | Every Ethereum node, publicly |
Who can change it | The owner, any time | Usually no one, once deployed |
Who can use it | Whoever the owner allows | Anyone with a wallet |
Who pays to run it | The company hosting it | The user who calls it, in gas |
Is the code visible | Usually private | Public and verifiable |
The row that surprises people most is the second one. Once a contract is deployed, its code generally cannot be edited, even by the person who wrote it. This is a feature, because it means the rules cannot be quietly changed after you start using them. It is also a risk, because if the code has a mistake, that mistake is permanent unless the contract was specially built to be upgraded. The fine print of how some contracts are made upgradeable is its own topic, covered in a dedicated guide on contract upgradeability.
The other big difference is who pays. There is no company covering server costs, so the user who calls a contract pays for the computing work in gas. How that fee is calculated is covered in our guide on Ethereum gas; the point here is simply that running contract code costs a small fee.
There is also no off switch in the usual sense. A normal app goes down when its company's servers go down or the business shuts. A contract keeps running as long as Ethereum does, with no maintenance window and no owner who can quietly take it offline. That permanence is a strength for something like a stablecoin people rely on around the clock, and a liability when a flawed contract cannot simply be unplugged.
What language are smart contracts written in?
Most Ethereum smart contracts are written in Solidity, a programming language built for the job. A smaller share use Vyper. Neither runs on Ethereum directly. The code is first compiled, meaning translated, into low-level instructions called bytecode, and it is that bytecode the EVM actually runs.
Solidity looks a little like JavaScript or C++, which makes it familiar to many developers, and it is by far the most common choice for Ethereum contracts (source: Solidity introduction to smart contracts). Vyper is a stricter, simpler alternative that some teams prefer for safety-critical code. As a user you never see either one; you see the result running on-chain.
Getting a contract onto Ethereum is called deployment. A developer sends a special transaction that contains the compiled bytecode. The network then creates a new contract account with its own permanent address and stores the code there forever. From that moment, the contract has a fixed address, just like a wallet does, and anyone can send transactions to it.
One detail matters for beginners: deployment is done by a normal account, and that account pays the gas to deploy. After that, the contract stands on its own. It cannot start anything by itself; it only ever acts when a transaction calls it. A contract sitting untouched does nothing and costs nothing until someone interacts with it.
Most serious projects also publish their source code so anyone can confirm it matches what is running. A block explorer can check that the published Solidity, once compiled, produces the exact bytecode living at the address, and it marks the contract as verified. That is worth knowing as a user: a verified contract lets you, or someone you trust, read the actual rules before sending money, while an unverified one is a black box you are taking on faith.
What does a smart contract actually look like?
At its simplest, a smart contract is a list of functions, each one a small block of rules the EVM can run. The most famous example is the transfer function that every token like USDT uses to move balances from one person to another. It is short, and reading it line by line shows there is nothing magical underneath.
Here is a stripped-down version of a token's transfer function, with each line explained in plain English. Real tokens add more checks, but the core logic is this:
Solidity line | What it does |
|---|---|
function transfer(address to, uint256 amount) | Defines a function called transfer that takes a recipient address and an amount |
require(balances[msg.sender] >= amount); | Checks the sender actually has enough tokens; if not, stop and undo everything |
balances[msg.sender] -= amount; | Subtracts the amount from the sender's balance |
balances[to] += amount; | Adds the amount to the recipient's balance |
emit Transfer(msg.sender, to, amount); | Announces the transfer as an event that wallets and explorers can read |
return true; | Reports that the transfer succeeded |
That is the whole idea of a token transfer: check the balance, subtract from one account, add to another, announce it. The transfer function and the Transfer event are part of a shared rulebook called the ERC-20 standard, which is why almost every token behaves the same way and every wallet knows how to handle it (source: ERC-20 token standard). The deeper details of token standards have their own guide; the takeaway here is that a contract is just readable rules like these.
How does a smart contract run when you use it?
When you use a contract, your wallet sends a transaction that names the contract's address and says which function to run and with what inputs. The EVM loads the contract's code, runs that function, updates the contract's stored data, and records what happened. Every node does the same work and reaches the same result.
The instruction to run a specific function is packed into the transaction's data field. That field holds a short code identifying the function, called the function selector, plus the inputs the function needs, such as a recipient address and an amount (source: Anatomy of smart contracts). Your wallet builds this for you behind the scenes, which is why you usually just see a friendly "Confirm" button rather than raw code.
While a function runs, it uses two kinds of space. Storage is permanent and lives with the contract, like a token's list of balances; it is the expensive part, because every node keeps it. Memory is temporary scratch space that disappears the moment the function finishes. This split is why changing a stored balance costs more than doing a quick calculation, and it shapes how carefully contracts are written.
Contracts also announce things by emitting events. An event is a log entry, like the Transfer line in the function above, that gets recorded alongside the transaction. Events do not change balances; they are notifications. Wallets, apps, and block explorers like Etherscan read these events to show you that something happened (source: Etherscan). When your wallet says a token arrived, it is usually reacting to a Transfer event a contract emitted.
You can inspect any of this yourself. Open a contract's address on a block explorer and you will usually see a few tabs. A Contract tab shows the code, and a green check means the published source has been matched to the bytecode actually running on-chain, so what you read is what executes. A Read Contract tab lets you query public values like a balance without paying gas. A Write Contract tab lets you call functions that change state, which does cost gas. An Events or Logs tab lists the events the contract has emitted over time. None of this requires permission, which is the whole point: the rules and the history are open for anyone to check.
You already use smart contracts: USDT and USDC
Stablecoins like USDT and USDC are not separate currencies sitting in special accounts; they are smart contracts. The balance you hold is just a number stored inside the token's contract, tied to your address. Sending USDC means calling that contract's transfer function, which updates two numbers and emits an event.
Most people use contracts this way long before they ever read about them. The same is true of holding stablecoins as a cash position, a habit covered in our guide on stablecoins in a portfolio. Whatever the purpose, the token itself is a contract doing the bookkeeping.
From Blofin's operational perspective, every USDT withdrawal we send on Ethereum is a smart-contract function call, not a direct payment. Our hot-wallet account signs a transaction whose target address is the USDT contract, not the user's wallet, and whose data field encodes a transfer to the user's address. The USDT contract then runs, subtracts from our balance, adds to the user's, and emits a Transfer event that the user's wallet picks up on the next block. The token never "leaves" anywhere; the contract simply rewrites who owns what.
Seeing it this way takes the mystery out of a lot of crypto. When you swap on a decentralized exchange, you are calling a contract. How those venues differ from a company-run exchange is covered in our guide on centralized versus decentralized exchanges. The automatic pricing behind many of those swaps is itself contract logic, explained in our piece on how automated market makers work. In each case the pattern is identical: a transaction calls a function, the EVM runs it, and stored balances change.
What happens when a smart contract has a bug?
Because most contracts cannot be changed after launch, a bug in the code can be permanent and expensive. If a contract has a flaw, an attacker who finds it can often use the contract exactly as written to drain funds. There is no support line to reverse it. This is the hard edge of "the code is the rules."
The most serious failures usually happen where contracts connect to other systems. In April 2026, an attacker exploited a flaw in how the liquid-staking project Kelp DAO verified messages from its cross-chain bridge, releasing about 116,500 rsETH, worth roughly 292 million dollars at the time (source: The $292M Kelp exploit). The stolen tokens were then used as collateral to borrow from the lending protocol Aave, whose own incident report estimated potential bad debt of roughly 123 to 230 million dollars depending on how the damage was shared (source: Aave rsETH incident report). A group of projects later organized a voluntary rescue effort, called DeFi United, to cover the hole.
From Blofin's operational perspective, the contracts we interact with are a counterparty exposure our risk team watches, not just a market the way a token's price is. The Kelp DAO episode is exactly the kind of contract failure we treat as counterparty risk. When a contract you rely on breaks, the loss is not a price move you can hedge or wait out; it is a failure with no settlement window. That is also why the broader risks of leaving funds in DeFi contracts are worth understanding before you commit money, which we cover in yield-farming risks for investors.
None of this means smart contracts are unsafe to use. It means they should be treated with the same care as any financial tool: prefer well-known, long-running contracts, understand that "immutable" means mistakes stick, and never assume a high yield comes without matching risk. The detailed catalogue of how contracts get attacked, and how to spot safer ones, has its own dedicated guide on smart-contract security.
Frequently asked questions
How is a smart contract different from a regular computer program?
A regular program runs on a private server the owner controls and can change whenever they like. A smart contract is deployed to Ethereum's public network, runs the same way on thousands of computers, and usually cannot be changed once it is live. Anyone can call it, the code and data are public, and the person calling it pays a gas fee to run it. In short, a normal program is private and editable; a contract is public and fixed.
Who can call a smart contract?
Anyone with an Ethereum wallet can call a public contract's functions, because the contract sits at an open address and does not check who you are. Some functions are restricted in the code itself. For example, a contract might only let its owner pause it. But those limits are written into the contract, not enforced by any outside gatekeeper. This openness is why a stablecoin contract will process a transfer for any address, an exchange or an individual alike.
Can a smart contract be stopped or paused?
Only if it was built that way. Some contracts include a pause function the team can trigger in an emergency, and some are designed to be upgraded. Many, though, are fully immutable, meaning no one can stop or alter them once deployed, not even the creator. Whether a given contract can be paused is part of its code, so it is something to check rather than assume.
What happens if there is a bug in a smart contract?
Because most contracts cannot be edited, a bug is usually permanent, and an attacker who finds one can often exploit it until the funds are gone, with no way to reverse the transactions. Teams respond by pausing connected systems if they can, warning users, and sometimes organizing a voluntary recovery, as happened after the April 2026 Kelp DAO exploit. The safest habit for users is to favor established, audited contracts and limit how much they leave exposed.
Are smart contracts actually "smart"?
Not in the sense of being intelligent. A smart contract does not think or make judgments; it follows fixed rules exactly as written, every time. The word "smart" refers to the automatic, self-executing nature of the code, not to any reasoning ability. A better mental label is "automatic contract": it does precisely what its code says, which is powerful when the code is correct and unforgiving when it is not.
Researched and written by the Blofin Academy editorial team with AI-assisted drafting. Primary sources include the ethereum.org smart contracts documentation, the Solidity documentation, and the ERC-20 token standard. Current-event figures are drawn from the Aave rsETH incident report and contemporaneous reporting, independently verified as of June 2026.
This article is for informational purposes only and does not constitute financial advice, investment guidance, or a recommendation to buy, sell, or hold any digital asset. Cryptocurrency markets and smart-contract protocols involve significant risk, including the risk of total loss from code exploits, and you should conduct your own research and consult qualified professionals before making decisions. Blofin Academy content reflects the state of public information at time of publication; protocols and ecosystem data change frequently.