What is a smart contract?

Despite the name, no lawyer is involved and there is usually no signed agreement. ESMA, the EU's securities markets authority, describes smart contracts as computer programmes stored on the blockchain that run when predetermined conditions are met, and calls them the backbone of decentralised finance. The idea dates back to computer scientist Nick Szabo in the early 1990s. It took off once Ethereum let anyone publish such programmes, with ESMA dating their arrival on that blockchain to 2015.

How does a smart contract run?

On Ethereum, each contract lives at its own address and combines code with stored data, such as balances. It behaves like an account: it can hold coins and receive transactions, yet no person controls it. Ethereum's own developer documentation uses the image of a vending machine: put in the right money, choose a snack, and the machine hands it over, with no shop assistant needed.

Nothing happens until someone calls the contract. You do that by signing a transaction in your wallet and paying a network fee, explained in what gas fees are. A few features set these programmes apart:

• Open to all. Anyone who can write code may deploy a contract, without asking permission.
• Readable by anyone. The code is public, and contracts can call one another, so projects stack on top of earlier work.
• Blind to the outside world. A contract cannot look up a price or a match result by itself. Services called oracles feed that data in. In their joint report, the EBA and ESMA name Chainlink as the leading oracle provider.

What are they used for?

ESMA analysed code deployed on Ethereum and sorted it into five broad categories: financial, operational, tokens, wallets and infrastructure. For an ordinary user, that translates into things like:

• Tokens. Stablecoins such as EURC exist on Ethereum as token contracts that record who holds how much.
• Swapping. Uniswap is a set of contracts that lets people trade tokens against shared pools instead of an order book. Its documentation states that the protocol cannot be upgraded.
• Borrowing and lending. Aave matches lenders and borrowers through code rather than through a bank. The wider field is covered in what DeFi is.
• Collectibles. Each NFT is a numbered entry in a contract, linked to an owner. See what an NFT is.
• Shared wallets. A multisig wallet is itself a contract that only moves funds once several keys have signed.

Can a contract be changed or stopped?

Not the code at a given address: ethereum.org explains that a deployed program stays as it is, and contracts cannot be deleted by default. Many teams nevertheless design for upgrades. With a so-called proxy, the address stays the same while the logic behind it can be swapped, and whoever holds that upgrade power can change the entire contract.

That makes the question "who holds the keys?" as important as "what does the code do?". Ethereum's developer guidance suggests spreading upgrade rights over a multisig or a community vote, and adding a timelock so users can leave before a change takes effect.

What can go wrong?

• Bugs. ethereum.org estimates that "easily over $1 billion" has been stolen or lost through contract vulnerabilities. The 2016 attack on The DAO alone drained 3.6 million ETH. Audits reduce the risk but do not catch every flaw.
• No undo button. Because the code cannot be edited, stolen funds are mostly gone for good. EBA and ESMA note that DeFi users often have unclear or no recourse.
• Open-ended approvals. Apps often ask permission to spend an unlimited amount of a token. That permission never expires, even after you disconnect your wallet, and a malicious contract can use it to empty your balance. Revoking it is a separate transaction with its own fee.
• Stolen keys. Since 2022, the EBA and ESMA count compromised private keys as the main source of DeFi hacks, with attackers turning more and more to phishing. Guarding your seed phrase matters as much as the code.

Who supervises a smart contract?

Usually nobody. MiCA, the EU crypto regulation, applies to people and firms providing crypto services, also when part of the service runs in a decentralised way. A service run fully by code without any intermediary falls outside it (recital 22). Buying ETH on an exchange listed in the MiCA register is therefore a different situation from sending it into a contract yourself.

To use smart contracts you need ETH for fees and a self-custody wallet such as MetaMask. Our comparer shows which licensed platform gives you the most ETH for your euros.