Smart Contract is a computer program stored on a blockchain that executes automatically when predefined conditions are met, moving tokens or updating records without an intermediary deciding whether to act; Article 2(39) of the EU Data Act defines it more broadly as a program for the automated execution of a contract, regardless of technology. Once deployed at its own address, every node runs the same code, and upgrades need a new contract or a proxy controlled by an administrator. Stablecoins, DeFi lending and decentralised exchanges run on them. Bugs execute as reliably as logic and losses are usually irreversible, while manipulated oracles can trigger wrongful liquidations. Buyers of a CASP or token issuer check audits and who holds admin keys.
How do smart contracts work
A developer writes the contract's logic, compiles it and deploys it to a blockchain, where it receives its own address. Anyone can then call its functions by sending a transaction; every node runs the same code and agrees on the result. Because the code and its state are on a public ledger, any party can inspect what the contract will do before using it. Most public blockchains charge a fee for each operation, paid in the network's native token.
Once deployed, the code is usually immutable. Upgrades require either a new contract or a proxy pattern in which an administrator can point the contract to new logic, which reintroduces a party with control.
Smart contract examples
Token issuance is the most common use: stablecoins and other tokens are smart contracts that track balances and enforce transfer rules. DeFi protocols use them for lending, where collateral is liquidated automatically when its value falls below a threshold, and for decentralised exchanges, where prices are set by a formula rather than an order book.
An illustrative escrow case: a buyer locks 50,000 USDC in a contract that releases payment to the seller when a delivery oracle reports the shipment received, or refunds the buyer if nothing is reported within 30 days. Neither party can redirect the funds, and no escrow agent is paid.
Smart contract risks
Code that executes automatically also executes its bugs automatically. A flaw in access control or arithmetic can let an attacker drain every asset the contract holds, and there is usually no way to reverse the transactions. Independent audits, formal verification and bug bounties reduce the risk but do not remove it. Oracles, the services that feed off-chain data into contracts, are a second point of failure: a manipulated price feed can trigger wrongful liquidations.
EU Data Act requirements
The Data Act has applied since 12 September 2025. Article 36 sets essential requirements for smart contracts that execute data-sharing agreements: protection against functional errors and third-party manipulation, a mechanism to safely terminate or interrupt execution, archiving of transaction data and code, rigorous access control, and consistency with the agreement being executed. The vendor, or the deployer where there is no vendor, must assess conformity and issue an EU declaration of conformity.
Smart contracts in crypto M&A
When buying a CASP or token issuer, the smart contracts are part of the asset. Due diligence should cover audit reports for every deployed contract, who holds upgrade and admin keys, whether those keys sit in a multisig, and any past exploits. Control of admin keys has to be transferred at completion, and a target that cannot show who holds them has an unquantified liability.