What it is
A smart contract is a program that lives at an address on a blockchain. ethereum.org describes smart contracts as programs stored on the blockchain that run when predetermined conditions are met. Anyone can call them by sending a transaction, and every node executes the same code and reaches the same result, so no single party controls the outcome.
What they do
On Ethereum, a contract account has its own address, balance and storage and is controlled by its code rather than by a private key. Contracts implement tokens, such as ERC-20, decentralised exchanges, lending markets and many other applications. Because the logic is public and runs automatically, people can use these services without trusting a company to carry out each step.
Properties to understand
Contracts are deterministic: given the same input and state they produce the same output. They are usually immutable once deployed, so a mistake cannot simply be patched, although some designs include upgrade mechanisms with their own trust assumptions. They cannot act on their own; they run only when a transaction calls them, which is why they cannot start transactions independently of an account.
Risks for users
A bug can be exploited to drain funds, and audits reduce but do not eliminate that risk. Contracts can also hold powers, such as the ability to mint tokens or pause transfers, held by an admin key. When you approve a contract to spend your tokens, you give it ongoing permission. Before using a new application, check how long it has operated, whether it has been audited and what permissions it asks for, and use only what you can afford to lose.