A smart contract is a program stored on a blockchain that runs when preset conditions are met. It can hold tokens, mint assets, enforce swaps, or open loans without a human clerk approving each step. Once deployed, the code is the rule set users actually face. Bugs, bad permissions, and hostile upgrades can move money as automatically as an honest swap.
Why it matters
Almost every DeFi product is a stack of smart contracts. Traders who only read the marketing page miss the real risk surface: admin keys, oracles, upgrade proxies, and pause switches. An audit helps within a stated scope. It does not freeze the code forever, and it does not prove the team will never change permissions later.
Contracts also create operational habits. Approving unlimited token allowances, signing blind transactions, and chasing unaudited forks are how users turn a useful automation tool into a drain. Pair contract caution with wallet hygiene from our wallet safety guide. For market context around apps that live on Ethereum, keep DeFi and gas vocabulary nearby.
Composable contracts amplify both upside and failure. One lending market can depend on an oracle, a stablecoin issuer, and a liquidation bot network at once. When any piece fails, liquidations cascade through code paths that looked independent on a marketing diagram. That is why protocol risk is rarely a single audited file.
Example
A decentralized exchange uses a swap contract. You send token A into the pool, and the contract returns token B according to a formula and the current reserves. No broker matches the trade by hand. If the formula, the pool ownership, or an attached router is wrong, the same automation that made the swap cheap can empty the pool. That is why desks read audits and permission docs before size, not after a loss.