Smart Contracts Explained: How Programmable Agreements Power DeFi

How Smart Contracts Work

Smart contracts follow an "if-this-then-that" logic model. A developer writes the contract code in a language like Solidity (for Ethereum), Vyper, or Rust (for Solana). The code defines the rules, conditions, and actions of the agreement. Once written, the contract is compiled into bytecode and deployed to the blockchain in a transaction that includes the contract code and constructor parameters. Deployment costs gas — fees paid in the native cryptocurrency (ETH, SOL, AVAX) proportional to the complexity of the contract.

After deployment, users interact with the contract by sending transactions to its address. Each transaction triggers a specific function in the contract. The Ethereum Virtual Machine (EVM) executes the code across every node in the network, ensuring consensus on the outcome. If the transaction meets the contract's conditions (e.g., sending sufficient funds), the contract executes the programmed actions (e.g., transferring tokens, minting an NFT, recording a vote). The result is permanently recorded on the blockchain — irreversible and visible to anyone. Gas fees compensate validators for the computational resources required to execute the contract code. Complex interactions with multiple contract calls can cost significant gas, which is why developers optimize contract code carefully. Understand the blockchain infrastructure that runs smart contracts →

Smart Contract Platforms

Ethereum and EVM Chains

Ethereum is the largest smart contract platform by total value locked, developer activity, and application diversity. The EVM has become the industry standard — competing chains like Avalanche, Polygon, BNB Chain, Arbitrum, Optimism, and Base are all EVM-compatible, meaning contracts written for Ethereum can run on these chains with minimal changes. This compatibility creates a massive ecosystem where applications can deploy across multiple chains. Ethereum's mainnet processes approximately 15 transactions per second, while Layer 2 solutions like Arbitrum and Optimism boost throughput to thousands of TPS by batching transactions off-chain and submitting proofs to Ethereum. The EVM ecosystem hosts the majority of DeFi protocols, NFT marketplaces, and on-chain applications.

Solana and Non-EVM Chains

Solana takes a different approach — it is not EVM-compatible and uses its own runtime based on the Sealevel parallel execution engine. Smart contracts on Solana are written in Rust or C, enabling much higher throughput (2,000+ TPS) and lower fees ($0.0002 per transaction). This makes Solana ideal for applications requiring high speed like on-chain order books, gaming, and micropayments. However, Solana has faced multiple network outages and reliability challenges. Other non-EVM platforms include Tezos (Michelson language), Algorand (TEAL), and Near Protocol (Rust/AssemblyScript). The trade-off is clear: EVM platforms offer the largest ecosystem and developer tools, while non-EVM platforms offer better performance at the cost of compatibility and network maturity. Compare smart contract platforms to Bitcoin's simpler scripting →

Smart Contract Use Cases

DeFi protocols: Uniswap uses an automated market maker (AMM) smart contract that maintains liquidity pools and calculates swap prices using the formula x*y=k. Aave uses lending pool contracts that match depositors with borrowers, automatically managing collateralization ratios and liquidations. Compound distributes its COMP governance token algorithmically based on usage. These protocols handle billions without human intervention. NFTs: The ERC-721 (and ERC-1155) standard contracts define ownership, transfer, and metadata for non-fungible tokens. Smart contracts enforce royalty payments to creators on secondary sales, enable provably scarce digital art collections, and power on-chain generative art where the artwork is created by the contract itself.

DAO governance: Decentralized autonomous organizations use smart contracts for proposal creation, voting, and treasury management. A DAO contract might hold $50 million in assets and automatically execute approved proposals — no CEO, board, or bank account needed. Token creation: The ERC-20 standard allows anyone to create a tradable token with a few lines of code. Over 500,000 ERC-20 tokens have been deployed on Ethereum. Insurance: Protocols like Nexus Mutual use smart contracts to pool risk and automatically pay claims based on verifiable conditions. Identity and verification: Smart contracts can issue and verify digital credentials, certifications, and attestations without a central authority. The composability of smart contracts — the ability to combine them like Lego blocks — is their most powerful feature, enabling complex applications built from simple, auditable building blocks. Learn how NFTs use smart contracts for digital ownership →

Security Risks and Smart Contract Vulnerabilities

Smart contract security is the most critical risk in DeFi. Once deployed, a contract cannot be changed (unless it includes upgrade mechanisms). Any bug in the code can be exploited with no recourse. Over $3 billion has been lost to smart contract exploits since 2020. Common vulnerabilities include: reentrancy attacks (the DAO hack 2016 — the attacker recursively called a withdraw function before the balance was updated, draining $60 million); oracle manipulation (price feed attacks that trick contracts into incorrect valuations); flash loan attacks (borrowing huge sums uncollateralized within a single transaction to manipulate prices); access control flaws (where privileged functions are callable by unauthorized addresses); and logic errors (miscalculated incentives, incorrect math, edge cases not handled).

Professional audits by firms like Trail of Bits, OpenZeppelin, and ConsenSys Diligence are essential but not foolproof — many hacked protocols had been audited. Best practices include formal verification (mathematically proving contract correctness), bug bounty programs, timelocks on upgrades, and defense-in-depth with multiple independent validations. For users, the safest approach is to use well-established protocols with years of operation, multiple audits, substantial TVL (indicating community trust), and a transparent development team. Never invest in unaudited smart contracts or protocols with anonymous teams. Protect yourself from common crypto and smart contract scams →

Related Resources