What Is a Smart Contract? Examples and Limitations

Imagine a vending machine. You put in the right amount of money, press a button and the snack drops. No cashier checks your payment or decides whether to hand it over. The machine follows its rules automatically.

That’s the idea behind a smart contract, and it’s the analogy Ethereum’s own documentation uses, crediting computer scientist Nick Szabo, who described smart contracts in the 1990s. Today smart contracts power stablecoins, crypto lending platforms, tokenized funds and some supply chain and insurance pilots.

This guide explains what a smart contract is, how it works, where businesses use it and the limitations you need to understand before trusting one with money.

What a smart contract is, in plain English

A smart contract is a program stored on a blockchain that runs automatically when specific conditions are met. On Ethereum, a smart contract lives at its own address, can hold funds and executes its code whenever someone sends it a transaction.

3 features make it different from ordinary software:

1. It runs on a shared network. No single company hosts it. Thousands of computers run the same code and agree on the result.
2. It’s hard to change. Once deployed, the code generally can’t be edited. Interactions with it can’t be reversed.
3. It’s transparent. On public blockchains, anyone can inspect the code and every transaction it processes.

Despite the name, a smart contract isn’t necessarily a legal contract. It’s code that enforces rules. Sometimes those rules match a legal agreement; often they’re just the logic of an app.

How a smart contract works

Here’s the typical lifecycle:

1. A developer writes the code, often in Solidity, the most common language for Ethereum and compatible blockchains.
2. The code is compiled and deployed to the blockchain, which gives it an address.
3. Users or other contracts send transactions to it, such as “deposit 100 USDC” or “release payment.”
4. The network executes the code. Every validating node runs it and agrees on the outcome. Users pay a network fee, called gas on Ethereum, for the computation.
5. The result is recorded on the blockchain, for example a balance updated or tokens transferred.

A simple escrow contract might say: when the buyer deposits funds, hold them. When the buyer confirms delivery, or 30 days pass with no dispute, send the funds to the seller. If a dispute is raised, send the funds to an agreed arbitrator’s address.

The oracle problem

Smart contracts can’t look up real-world information on their own. Ethereum’s documentation says this is by design, since relying on outside data could break consensus between nodes. To learn a stock price, a flight’s arrival time or whether a package was delivered, a contract relies on an oracle, a service that feeds external data onto the blockchain. That makes the oracle a point of trust: if the data is wrong or manipulated, the contract will still execute on it.

Real business examples

Tokenized real-world assets are among the fastest-growing areas. Asset managers now issue fund shares as tokens whose transfer rules are enforced by smart contracts. Our guide to real-world asset tokenization explains how that works. In logistics, smart contracts often sit on top of traceability systems; see blockchain in supply chain for what has worked and what hasn’t.

Key takeaway: A smart contract is best at enforcing simple, digital, if-this-then-that rules between parties who don’t want to rely on a middleman. The more a deal depends on real-world facts or human judgment, the weaker the fit.

Why bugs in smart contracts are so costly

In normal software, a bug gets patched in the next update. In a smart contract, the bug may be permanent, and the contract may be holding millions of dollars that anyone in the world can try to take.

2 famous incidents show what’s at stake:

• The DAO (2016). An investment fund built as an Ethereum smart contract was attacked through a code flaw. According to ethereum.org, the attack drained over 3.6 million ETH. The Ethereum community responded with a hard fork on July 20, 2016 that moved the funds to a contract where holders could withdraw them. Miners who rejected the fork kept the original chain, which became Ethereum Classic.
• Parity multisig wallets (2017). A bug in a shared code library let a user trigger the library’s self-destruct function, which made a group of multisignature wallets that depended on it unusable. More than 500,000 ETH, worth roughly $150 million at the time, was frozen.

The most common weaknesses today are well documented. OWASP, the security nonprofit, maintains a Smart Contract Top 10 list of vulnerability types, including access control flaws (functions anyone can call that should be restricted), logic errors, price oracle manipulation and reentrancy (where a malicious contract calls back into a contract before it finishes updating balances).

Why are these bugs so expensive?

• Code is public, so attackers can study it at leisure.
• Funds are directly accessible, with no bank fraud team in the way.
• Transactions are irreversible, so stolen funds are hard to recover.
• Contracts interact with each other, so a flaw in one can cascade into others.

Other limitations to understand

• Immutability cuts both ways. You can’t easily fix a mistake. Some teams use “upgradeable” designs, but that reintroduces trust in whoever controls the upgrade keys.
• Garbage in, garbage out. A contract can only be as accurate as its inputs and oracles.
• Legal status varies. Some states, including Arizona in 2017 and Tennessee in 2018, passed laws saying a contract can’t be denied legal effect solely because it uses a smart contract. But code alone rarely covers disputes, liability or consumer protections. This is not legal advice.
• Regulation still applies. Automating a financial activity doesn’t exempt it from securities, commodities, anti-money laundering or consumer rules. See who regulates crypto in the US.
• Costs and speed. Every operation costs network fees, and public blockchains have limits on computation and contract size.
• Privacy. On public blockchains, transaction data is visible to everyone, which many businesses can’t accept.
• Scams. Malicious contracts can be designed to drain wallets that approve them. Our guide on how to avoid crypto scams covers common tricks.

Smart contract vs. traditional contract

Many real deployments combine the 2: a written legal agreement that references the smart contract and covers what happens if something goes wrong.

Where to start: evaluating a smart contract project

If you’re a business owner or product leader considering smart contracts, use these 6 steps:

1. Define the rule you want to automate. If you can’t write it as a clear if-then statement, it’s probably not a good fit.
2. Ask why it needs a blockchain. If one trusted party could run the logic in a normal database, that’s usually cheaper. Multi-party processes with low trust are the sweet spot.
3. Identify your data sources. Which oracles or systems will feed the contract, and what happens if they fail?
4. Use proven building blocks. Well-tested open-source libraries reduce risk compared with writing everything from scratch.
5. Budget for security. Plan for independent audits, automated testing, bug bounties and monitoring. Our pre-launch software QA checklist is a good companion.
6. Write the legal layer. Pair the code with terms covering disputes, upgrades, liability and compliance.

Developers can explore the basics with a test network before deploying anything with real value. AI tools can help write and review code; see how AI coding assistants are changing software teams, but don’t treat AI review as a substitute for a professional audit.

The bottom line

A smart contract is self-executing code on a blockchain: reliable for simple, digital rules, transparent and hard to tamper with. Those same traits make mistakes permanent and expensive. Use smart contracts where automation between parties who don’t fully trust each other adds real value, invest heavily in security and keep a legal agreement behind the code. For related terms like oracle, gas and DeFi, see our glossary.

Sources

• Ethereum.org: Introduction to smart contracts — definition, vending machine analogy, oracles and contract limits
• Ethereum.org: History of Ethereum forks — DAO attack of over 3.6 million ETH, July 20, 2016 hard fork and Ethereum Classic
• OWASP: Smart Contract Top 10 — common smart contract vulnerability categories
• NIST IR 8202: Blockchain Technology Overview — how smart contracts run on blockchain networks
• Arizona Legislature: HB 2417 (2017) — smart contract terms can’t be denied legal effect solely for that reason