Smart contracts basics: what they are and how to check one

What a smart contract is

A smart contract is a program that lives on a blockchain. It has an address, like a wallet, and it can hold tokens. It also has functions that anyone can call by sending a transaction. When you call a function, every node on the network runs the same code and agrees on the result.

The classic comparison is a vending machine: put in the right input and you get a predictable output, with no shopkeeper involved. A lending contract, for example, might say “if you deposit collateral worth more than the loan, you may borrow up to this amount; if your collateral falls below a threshold, anyone may repay part of your loan and take some collateral.”

Two features make smart contracts different from ordinary software. First, the code and every transaction are public. Second, the results are final. If the code has a flaw, the network will still run it faithfully, flaw and all.

Immutable and upgradeable contracts

Once a contract is deployed, its code at that address cannot be edited. That immutability is reassuring: nobody can quietly rewrite the rules. It is also unforgiving: a bug stays forever, and the only fix is to deploy a new contract and persuade everyone to move.

Because of that, many applications use an upgradeable design. You interact with a proxy contract that stores your balances but forwards each call to a separate implementation contract holding the logic. Whoever controls the proxy can point it at new logic. Your funds stay at the same address while the rules change underneath them.

Admin keys: the hidden centre of control

Even contracts that can’t be upgraded may have privileged functions that only an owner or admin address can call. Common ones include pausing deposits or withdrawals, changing fees, adding or removing supported assets, changing which oracle sets prices and, for tokens, minting new supply.

These powers exist for defensible reasons, such as stopping an attack in progress. But they are also a single point of failure. If an admin key is stolen, or its holder acts in bad faith, the contract may do exactly what the code permits: drain funds to a new address or mint tokens without limit.

What audits do and don’t prove

An audit is a paid review of a contract’s code by a security firm or independent reviewers. Auditors look for known bug patterns, logic errors and risky permissions, then publish a report listing findings by severity.

• Check the date and version. An audit covers the code as it was then. Later upgrades may not be covered.
• Check the scope. Reports often list exactly which contracts were reviewed. Others in the system may be outside it.
• Check the findings. Were serious issues fixed, acknowledged or left open?
• Look for more than one review. Several audits, a public bug bounty and time in use without incident each add some evidence.

Audited contracts have still been exploited. Treat an audit as one input, not a seal of safety, and be wary of projects that use the word “audited” without linking to a report.

How to read a contract’s basic facts on a block explorer

A block explorer is a website that displays a blockchain’s public data. Paste in a contract address, which you should copy from the project’s official documentation rather than a search ad or message, and look for these facts:

1. Is the source code verified? Verified code means the published source matches what is deployed. Unverified code is a black box.
2. When was it created, and by whom? A contract deployed yesterday by a fresh address has no track record.
3. Is it a proxy? Explorers often label proxies and link to the current implementation. If it is a proxy, the logic can change.
4. Who is the owner or admin? The “read contract” section often shows an owner address. Click it: is it a single wallet, a multisig or a timelock contract?
5. What do the privileged functions do? Look at the “write contract” section for functions such as pause, upgrade, mint or set fee.
6. What does activity look like? Many users over a long period is different from a handful of large wallets.
7. For tokens, who holds them? A holder list dominated by a few addresses means those holders can move the price.

What can go wrong, and the Canadian angle

• Bugs that let an attacker withdraw more than they deposited.
• Malicious or careless upgrades that change the rules after you deposit.
• Stolen admin keys used to drain or mint.
• Dependency failures, such as a bad price from an oracle or a failing token used as collateral.
• Fake contracts that copy a real project’s name to collect approvals. See wallet approvals and signing.

Our smart contract risk explainer and protocol risk scorecard take these checks further.

Your checklist

• Copy contract addresses only from official documentation.
• Confirm the source code is verified on a block explorer.
• Find out whether the contract is a proxy and when it last changed.
• Identify the owner or admin and whether it is a multisig or timelock.
• Read the latest audit’s date, scope and unresolved findings.
• Save contract addresses with your transaction records.

Sources and dates

• Introduction to smart contracts — ethereum.orgreference
  No date shown on page · checked 2026-10-31. What a smart contract is and how it executes.
• Ethereum security and scam prevention — ethereum.orgreference
  No date shown on page · checked 2026-10-31. Wallet security habits and common scams.
• What's covered — Canada Deposit Insurance Corporationin force
  No date shown on page · checked 2026-10-30. Up to $100,000 per category per member institution; cryptocurrencies, including stablecoins, are not covered.
• Keeping books and records of crypto-assets for tax filing — Canada Revenue Agencyin force
  Page date 2025-11-10 · checked 2026-10-30. What to record per transaction, wallet addresses, yearly balances; export platform history; keep records at least six years.