Program living on a blockchain. Runs automatically when triggered. No company executing it. No employee processing it. No approval required from anyone.

Uniswap doesn't have staff processing swaps. A smart contract does it. Aave doesn't have loan officers. Smart contract handles it. Every token ever bought was created and distributed by one.

Everything interesting in crypto runs on them. Usually without the person using it even knowing.

How They Work

Developer writes code. Deploys it to the blockchain at a specific address. Contract exists permanently there from that point.

Anyone sends a transaction to that address. Transaction triggers functions in the contract. Contract executes. State changes recorded on-chain. Done. No human involved at any step.

Uniswap swap in practice: transaction arrives with token amounts and slippage tolerance. Contract calculates output using pool ratios. Checks slippage. Transfers tokens in. Transfers tokens out. Updates pool state. All automatic. All in one transaction. Took maybe twelve seconds.

Language matters too. Ethereum uses Solidity. Most DeFi code ever written is in Solidity. Largest tooling ecosystem. Most auditors familiar with it. Solana uses Rust. Harder to write, more performant. Sui and Aptos use Move, designed specifically with asset safety in mind. Developer pool smaller but growing.

What They Actually Changed

Before smart contracts, trustless transactions between strangers required intermediaries. Bank processes payment. Escrow holds funds. Lawyer enforces the agreement.

Every intermediary adds cost, time, counterparty risk, geographic restrictions.

Smart contract removes all of it. Two strangers anywhere transact according to rules neither can change unilaterally. Don't need to trust each other. Trust the code instead.

DeFi exists because of this. Lending without a bank. Trading without an exchange. Derivatives without a broker. All automated by code nobody controls after deployment.

Solidity: The Language Behind Most Smart Contracts

Ethereum smart contracts written in Solidity. High-level programming language designed specifically for writing contracts on EVM-compatible chains.

Most of the code powering DeFi was written in Solidity. Uniswap. Aave. Compound. Curve. Years of accumulated knowledge, tooling, libraries, and audit frameworks built around it.

That matters practically. More developers know it. More auditors can review it. More existing code to learn from and build on. Largest smart contract developer ecosystem by a significant margin.

Not the only option though.

Solana uses Rust. Harder to write than Solidity. Steeper learning curve. More performant at execution. Different mental model for how programs interact with state. Smaller developer pool historically but growing fast as Solana's ecosystem expanded.

Sui and Aptos use Move. Designed with asset safety specifically in mind. Resources in Move can't be copied or accidentally destroyed the way they can in other languages. Reduces certain classes of bugs by design. Newer ecosystems. Smaller communities. Interesting long-term but not where most of the existing DeFi infrastructure lives.

Language choice determines what bugs are possible, what auditing tools exist, and how many people can meaningfully review the code. Solidity dominance isn't just network effects. Years of hard lessons baked into tooling and developer practice.

The DAO Hack and What It Actually Proved

1. The DAO raised $150 million. Then $60 million got drained through a reentrancy vulnerability.

Here's the thing people still get wrong about it: the code didn't malfunction. It did exactly what it said. Attacker found a function that could be called repeatedly before the balance updated. Drained it legally according to the contract's own rules.

Code is law cuts both ways. Works perfectly when written correctly. Fails in ways nobody anticipated when it isn't. And the failure is permanent and automatic.

That event shaped everything that came after. How audits work. How developers think about attack surfaces. Why the industry is still paranoid about reentrancy specifically years later.

The Risk That Never Goes Away

Smart contract executes exactly as written. No human can intervene mid-execution. No customer service. No fraud department. Code ran. Done.

• Reentrancy: contract sends funds before updating its own balance. Attacker's contract calls back in before balance updates. Drains it repeatedly. The DAO. Multiple others since.
• Logic errors: code does exactly what it says but what it says isn't what the developer intended. Gap between intent and implementation. Exploiter finds the gap before the developer does.
• Oracle manipulation: contract trusts external price feed. Attacker moves the feed. Contract executes on fake prices. Mango Markets 2022. $114 million borrowed against artificially inflated collateral. All technically valid according to the contract's own logic.

Audits help. Trail of Bits, OpenZeppelin, Certik reviewing code before deployment catches real vulnerabilities. Doesn't catch everything. Multiple major exploits hit audited contracts. Novel attack vectors emerge. Interactions between contracts create vulnerabilities no single audit anticipated. Unaudited contract is significantly more dangerous. Audited contract still carries real risk. That's the honest picture.