Smart Contracts Explained: What They Do and Where They Break

A smart contract is the only kind of financial agreement that has no customer-care number. When you use one, there is no bank to reverse the payment, no manager to email, and no lawyer to argue intent. The smart contracts explained here are simply programs that live on a blockchain and run exactly as written — every time, for everyone, with no exceptions. That is their superpower and their weakness in a single sentence. In 2016, a bug in one contract let an attacker drain 3.6 million ETH before the code could stop itself. Nobody could undo it. This guide shows you what these programs actually do, how they run, and the four places they reliably break.

What a smart contract actually is

Strip away the jargon and a smart contract is a small program stored on a blockchain. It holds funds and rules together in one place. When someone sends it a valid instruction, it runs its code, updates its records, and writes the result permanently to the chain. No human approves the step. The code is the approval.

Think of a vending machine. You put in a coin, press a button, and the machine is built so that the drink must come out — the shopkeeper does not decide each time. A smart contract is a vending machine for value: deposit, lend, swap, stake, vote. The difference is that this vending machine holds millions of dollars and its instruction manual is visible to every attacker on earth.

The rules and the money sit inside the same tamper-proof box, and once deployed, that box runs on its own. This is why decentralised finance is possible at all. If you want to see smart contracts doing real work, our explainer on how decentralised finance actually works in India walks through lending and swapping built entirely on this idea.

Because the concept is so easy to underestimate, most people never learn how these programs execute before they put money into one. If you want that foundation built properly rather than pieced together from videos, a structured cryptocurrency course compresses the mechanics into a few focused weeks.

How smart contracts run: deterministic execution and gas

Ethereum smart contracts run inside the Ethereum Virtual Machine, or EVM — a shared computer that every node in the network copies. The single most important word here is deterministic. Given the same contract and the same inputs, every node must reach exactly the same result. There is no randomness, no "it depends", and no reaching out to the live internet in the middle of a calculation.

That last point matters. A contract cannot simply ask a website for today's gold price, because different nodes would get different answers and the network would disagree with itself. Bridging outside data into this sealed world is a whole job of its own, done by services called oracles — and, as you will see, a frequent point of failure.

Every operation the EVM performs costs gas, a unit of work paid for in ETH. Adding two numbers is cheap; storing data permanently is expensive. Gas does two useful things: it pays the validators who run the computation, and it caps runaway code. If a transaction runs out of gas, the whole thing reverts as if it never happened — but you still pay for the work done up to that point.

Source: Ethereum EVM execution model, 2026.

Why "code is law" cuts both ways

Crypto's founding slogan is "code is law". It means the software, not a court or a company, decides what happens to your money. When the code is correct, this is genuinely powerful: a loan settles without a bank, a trade clears without a broker, and nobody can quietly change the terms after you commit.

But the same rule removes every safety net you are used to. There is no chargeback, no fraud department, and no "please reverse this transaction". If the contract contains a mistake, the mistake is now the law too. Attackers do not need to break in past a firewall; they simply use the contract exactly as its flawed code allows. The 2016 drain mentioned earlier was not a hack of Ethereum — the network worked perfectly. It faithfully executed a badly written contract.

This is why the same discipline applies whether you are staking, lending, or trading. Even a relatively simple action like staking your Ethereum hands your funds to a smart contract whose code you are trusting completely. Understanding what can go wrong is not pessimism — it is the price of admission.

Where smart contracts break: the four failure modes

Almost every large smart-contract loss traces back to a small set of repeatable bug classes. The specific projects change; the mistakes rhyme. Here are the four you will meet most often, each with a real incident so the pattern sticks.

1. Reentrancy: the contract that pays out before it updates its books

Reentrancy is the classic. A contract sends you money first and only afterwards reduces your recorded balance. A malicious contract can call back in during that gap and ask to withdraw again — and again — because the books still say the money is there. This is exactly how The DAO lost 3.6 million ETH, then worth roughly $60 million, in June 2016. The fix is simple to state: update your records before you send funds, never after.

2. Oracle manipulation: feeding the contract a fake price

A lending or trading contract needs to know the price of an asset, so it trusts an oracle or an on-exchange price. If that price can be pushed around cheaply, an attacker can make their collateral look far more valuable than it is and borrow against the illusion. In October 2022, Mango Markets on Solana lost about $117 million this way — the attacker inflated the value of their own position, then borrowed roughly $112 million against it. The defence is robust, manipulation-resistant price feeds that average across deep markets.

3. Admin keys and upgradeable proxies: the single point of failure

To allow bug fixes, many contracts use an upgradeable "proxy" that points to swappable logic, controlled by an admin key. Convenient — and dangerous. Whoever holds that key can change the rules or, if the key is stolen, drain everyone. A cousin of this risk froze more than 500,000 ETH at Parity in November 2017, when a user accidentally triggered a self-destruct in a shared library and locked every wallet that depended on it. Look for time-locks and multi-signature control over admin powers.

4. Unaudited forks and copy-paste code

Because contract code is public, new projects often copy a popular protocol, tweak it, and launch without a fresh review. They inherit every original bug plus whatever the edits introduced. Cross-contract logic flaws in this family enabled the roughly $610 million Poly Network exploit in August 2021 — the largest DeFi theft at the time, though the attacker later returned nearly all of it. If a project is a lightly modified fork with no independent audit of its changes, treat it as untested.

What a security audit does and does not tell you

When a project waves an audit report, it is easy to read that as a safety certificate. It is not. An audit is a snapshot review of a specific version of the code, checked against known bug classes at one point in time. A good audit meaningfully lowers risk. It cannot promise the absence of every flaw, and several audited protocols have still been drained.

Three things an audit typically does not cover deserve special caution:

• Changes made after the audit. The version you interact with may not be the version that was reviewed.
• Economic and oracle design. Many exploits break no code rule at all — they abuse how prices and incentives were designed, as Mango Markets showed.
• The human layer. Admin keys, upgrade powers, and team custody sit outside most code reviews.

This is the same due-diligence muscle you use when reading a project's white paper: do not stop at the promises, and ask how much value the contract is actually guarding before you trust it. Treat an audit as one input among several — the code, the admin controls, the price sources, and the team — never as a stamp of approval on its own.

What this means for you as an Indian user

Smart-contract risk is a technical risk that sits on top of India's tax and legal layer, not instead of it. In India, crypto tokens are treated as Virtual Digital Assets, with gains taxed at a flat 30% plus a 1% TDS on transfers — and none of that protects you if a contract is exploited. The chain will not refund you, and there is no regulator-backed deposit insurance for a DeFi position. Your defence is your own checklist.

Before you connect a wallet and approve a contract, run through five quick checks:

• ✓ Is there an independent audit — and does it match the current version?
• ✓ Who controls the admin keys, and are upgrades time-locked or multi-sig?
• ✓ How does the contract get its prices — a single source or a robust feed?
• ✓ Is this an original protocol or an unreviewed fork?
• ✓ Are you approving a spending limit larger than you need?

And remember that your own keys are the last line of defence — our note on crypto seed phrase security covers the wallet side of the same discipline. Smart contracts remove middlemen; they do not remove responsibility. That shift — from trusting an institution to verifying code — is exactly the literacy the next decade of finance will reward.

Frequently Asked Questions

What is a smart contract in simple words?

A smart contract is a program stored on a blockchain that automatically runs its rules when someone sends it a valid instruction. It holds funds and logic in one tamper-proof place, so a payment, loan, or swap can settle without a bank or middleman deciding each time. The code itself enforces the agreement.

Are smart contracts safe to use?

They are only as safe as their code and design. The blockchain reliably executes whatever the contract says — including its bugs. Most large losses come from a few repeatable flaws: reentrancy, oracle manipulation, weak admin-key control, and unaudited forks. An audit lowers risk but never guarantees safety, so your own checks still matter.

What is gas in a smart contract?

Gas is the unit of work you pay for when a smart contract runs, settled in ETH on Ethereum. Cheap operations like arithmetic cost little; permanently storing data costs much more. Gas pays the validators and caps runaway code — if a transaction runs out of gas, it reverts, though you still pay for the work already done.

Can a smart contract be changed or reversed after deployment?

By default, no. Once deployed, the code and its results are permanent, which is why mistakes cannot simply be undone. Some contracts add an upgradeable proxy so an admin can swap the logic later, but that convenience introduces its own risk: whoever controls the admin key can change the rules or drain funds if compromised.

How are smart contract gains taxed in India?

In India, tokens are Virtual Digital Assets. Gains are taxed at a flat 30% with a 1% TDS on transfers, regardless of whether the activity happened through a centralised exchange or a smart contract. The tax treatment is separate from the technical risk — being exploited does not create a refund or a loss set-off.

Disclaimer: This article is for educational purposes only and does not constitute investment advice. Markets carry risk — please do your own research or consult a qualified financial professional before investing. NIFM provides training and exam preparation; certification exams conducted by regulatory or professional bodies are administered by those bodies independently.