Smart Contract

## How smart contracts work

Smart contracts operate on a simple if/then logic written in code and deployed to a blockchain. Here is the basic flow:

**1. Agreement is coded.** Two or more parties define the terms of their arrangement. Those terms are translated into conditional statements—’if X happens, then do Y’—written in a programming language such as Solidity (Ethereum) or Rust (Solana).

**2. Contract is deployed.** The coded contract is submitted to the blockchain network. Once deployed, it receives a unique address and becomes a permanent, publicly visible part of the distributed ledger.

**3. Conditions are monitored.** The contract waits for its trigger conditions to be met. Those conditions might be a payment arriving, a date passing, a data feed reporting a price, or another contract sending a message.

**4. Execution is automatic.** When the conditions are satisfied and verified by the network’s consensus mechanism, the contract executes its programmed outcome—releasing funds, transferring a token, recording a deed, updating a registry, or calling another contract.

**5. Record is immutable.** The execution is written to the blockchain as a permanent, tamper-proof transaction. Neither party can alter the outcome after the fact.

The key innovation is that no intermediary is needed to enforce the agreement. The blockchain itself is the enforcement mechanism.

## Origin of smart contracts

Computer scientist and legal scholar **Nick Szabo** first described smart contracts in 1994, well before blockchain technology existed [2]. His 1996 paper, ‘Smart Contracts: Building Blocks for Digital Markets,’ proposed embedding contractual clauses into hardware and software so they could be self-enforcing. Szabo used the vending machine analogy in his original writing [2].

The concept remained theoretical until **Ethereum** launched in 2015 with a Turing-complete programming environment—meaning developers could write smart contracts of arbitrary complexity, not just simple transaction scripts [1]. Ethereum made smart contracts practical, and they quickly became the foundation for decentralized finance (DeFi), non-fungible tokens (NFTs), decentralized autonomous organizations (DAOs), and most blockchain-based applications that exist today [1].

## What smart contracts are used for

**Decentralized finance (DeFi).** Smart contracts power lending protocols (Aave, Compound), decentralized exchanges (Uniswap, Curve), and stablecoins (DAI). These applications replace traditional financial intermediaries with code. A borrower deposits collateral into a smart contract; the contract automatically issues a loan and liquidates the collateral if its value drops below a threshold [1].

**Tokenization and digital assets.** The ERC-20 standard (for fungible tokens) and ERC-721 standard (for NFTs) are themselves smart contracts. When you hold a token on Ethereum, you are interacting with a smart contract that tracks ownership and enforces transfer rules [1].

**Supply chain and trade finance.** Smart contracts can automate multi-party workflows: when a shipment arrives at a port (verified by an oracle or IoT sensor), payment is automatically released to the supplier. This reduces disputes and delays.

**Insurance.** Parametric insurance products use smart contracts to pay out automatically when predefined conditions are met—such as a flight delay exceeding two hours or rainfall dropping below a threshold. No claims process is needed.

**Governance (DAOs).** Decentralized autonomous organizations use smart contracts to encode voting rules, treasury management, and proposal execution. Members vote on-chain, and the contract executes the outcome automatically [1].

## Smart contracts and AI agents

Smart contracts are a critical building block for AI agents operating in the agentic economy. Here is why:

**Autonomous transactions.** An AI agent that needs to pay for a service, settle a bet, or transfer an asset can call a smart contract directly—no human approval needed for routine transactions. The contract executes based on code, not trust in the counterparty.

**Programmable money.** Payment protocols like the Machine Payments Protocol (MPP) and x402 use smart contracts to enable agent-to-agent payments. An agent can escrow funds in a smart contract, have the other agent deliver a result, and the contract releases payment automatically upon verification.

**Verifiable logic.** Because smart contract code is publicly auditable on the blockchain, an agent (or its human steward) can verify exactly what a contract will do before interacting with it. This transparency is essential for autonomous systems that cannot negotiate or dispute outcomes after the fact.

**Limitations for agents.** Smart contracts cannot access real-world data directly—they rely on oracles (data feeds) to bridge off-chain information. An agent interacting with a smart contract must trust the oracle as well as the contract code. If the oracle provides bad data, the contract will execute based on that bad data, and the result is still immutable.

## Limitations and risks

**Code is law—until the code is wrong.** Smart contracts execute exactly as written, even if the code contains bugs or unintended behavior. The 2016 DAO hack exploited a reentrancy vulnerability in a smart contract, allowing an attacker to drain $60 million in ETH [3]. The Ethereum community ultimately hard-forked the chain to reverse the theft—a controversial decision that split Ethereum and Ethereum Classic.

**Immutability cuts both ways.** Once deployed, a smart contract generally cannot be modified. If a vulnerability is discovered after deployment, the only options are to deploy a new contract and migrate users, or—in some designs—to use an upgradeable proxy pattern that introduces its own trust assumptions.

**Security losses remain significant.** In the first half of 2025, crypto and DeFi exploits accounted for approximately $3.1 billion in losses globally, with access control failures ($1.83 billion, approximately 59% of total) and smart contract bugs ($263 million, approximately 8%) leading the categories [5]. The OWASP Smart Contract Top 10 (2026 edition) identifies access control, business logic flaws, reentrancy, flash loan exploits, and oracle manipulation as the most critical vulnerability categories [4].

**The oracle problem.** Smart contracts cannot natively access off-chain data. They depend on oracle services (such as Chainlink) to feed them real-world information—prices, weather, sports scores, shipment status. If the oracle is compromised or inaccurate, the contract executes on bad data. This is a fundamental limitation, not a bug.

**Legal uncertainty.** The legal status of smart contracts varies by jurisdiction. Some U.S. states (Arizona, Tennessee, Wyoming) have enacted legislation recognizing smart contracts as legally enforceable; most jurisdictions have not addressed them directly.