Ethereum Smart Contracts Explained

Why neither word in the name is accurate

Nick Szabo coined the term in 1994, more than a decade before any blockchain existed.

It is not a contract in the legal sense. No court enforces it. No signature binds anyone to it. It enforces itself by running.

It is not smart. It has no judgment and no discretion. It cannot interpret intent, refuse an unfair result, or recognise that something has gone wrong.

Both properties are deliberate. A smart contract removes the need to trust a counterparty, because neither side can change the outcome once the transaction lands. The same rigidity means a flaw in the code executes as faithfully as a feature.

What Ethereum added in 2015

Ethereum launched in July 2015 as the first platform where smart contracts became practically deployable.

Solidity became the standard language for writing them. Once deployed, contract code cannot be altered unless the developer built an upgrade mechanism in beforehand.

A contract without that mechanism is permanent. Any bug inside it is permanent too.

The Ethereum Virtual Machine

The Ethereum Virtual Machine (EVM) is the runtime environment that executes contract code across the network.

Every node runs the same instructions on the same inputs. Every node reaches the same output. That redundancy is what makes the result tamper-resistant, because altering it would require altering the majority of the network at once.

The EVM is also why other blockchains advertise EVM compatibility. Contracts written for Ethereum run on those chains with little or no modification.

Gas and what it costs in 2026

Every EVM operation consumes gas, a unit of computational work priced in gwei. One gwei is one billionth of an ETH.

Two changes moved costs to these levels. EIP-1559, activated in August 2021, replaced the old bidding auction with an algorithmic base fee that gets burned. EIP-4844, shipped with the Dencun upgrade in March 2024, created blob space, a separate data area where Layer 2 networks post their transaction data cheaply.

Activity followed the cheaper path. Rollups now carry roughly 95% of Ethereum transactions, which leaves mainnet running well below its block capacity most days.

Gas has a second purpose beyond payment. It caps how long a contract can run, which prevents an infinite loop from stalling the network.

The DAO hack and why it still matters

In June 2016, an attacker drained roughly 3.6 million ETH from The DAO, worth $50 million to $60 million at the time.

The flaw was reentrancy. The contract sent funds before updating its own balance record, so the attacker could call the withdrawal function repeatedly against a balance that never decreased.

Ethereum hard-forked to reverse the theft. Not everyone agreed, and the chain split into Ethereum and Ethereum Classic.

That decision answered a question the technology could not. Code is final until enough of the community decides otherwise.

What the 2026 incident data shows

Attack volume hit a record in the first half of 2026 while losses fell to their lowest level in years.

The split between those two rows matters. Contract bugs produced most of the incidents. Compromised devices, stolen private keys, exposed admin credentials, and off-chain infrastructure produced most of the stolen value.

Immunefi calculated that code-level bugs cost 0.66% of total value locked in 2025, once operational security outliers are stripped out. That was the strongest year on record for contract security.

What an audit does and does not cover

Audits reduce risk without removing it. Several protocols exploited in 2026 had been audited.

The OWASP Smart Contract Security Project ranks access control first in its 2026 Top 10, ahead of business logic errors. Proxy and upgradeability flaws enter the list for the first time. Insecure randomness and denial of service both dropped off.

That reordering reflects a shift in where failures happen. The 2026 list draws on 122 deduplicated incidents from 2025, covering roughly $905.4 million in losses.

Access control and upgrade governance are not coding mistakes in the usual sense. They are decisions about who holds the keys and who can change the contract later. An audit that verifies the code can still miss those.

Does any of this affect a player?

Three of these facts matter to someone depositing ETH at a crypto casino. The rest do not.

Most crypto casinos do not use smart contracts

Nearly all major crypto casinos are custodial offshore operators.

A player sends ETH to a deposit address. The operator credits an internal balance. The games then run on the operator’s own servers, in a database the player cannot see.

The blockchain records the deposit and the withdrawal. It records nothing about what happened between them.

That distinction gets blurred in operator marketing. A site can accept ETH, describe itself as a blockchain casino, and have no smart contract involvement in gameplay at all.

Provably fair is cryptography, not a contract

Provably fair systems use hashed seeds to let a player verify that a result was not altered after the bet was placed.

That check is cryptography. It does not require a smart contract, and at almost every major operator it runs off-chain. Clovr’s guide to provably fair casinos covers what the verification proves and what it leaves untested.