Smart Contract

Smart contracts are programs deployed to a blockchain that execute exactly as written and, in most cases, cannot be changed afterwards. That immutability is the property that makes DeFi possible and the property that makes its failures permanent: a bug in a contract holding funds is not a bug that can be patched before anyone notices.

What we track on this desk

• Exploits and their mechanism. Reentrancy, oracle manipulation, access-control errors and signature flaws — named specifically, because the category determines the lesson.
• Audits. Who reviewed a contract, what scope they were given, and whether the exploited code was in it.
• Upgradeability. Proxy patterns and admin keys, which trade immutability for the ability to fix things — and introduce whoever holds the key as a risk.
• Standards. Token and account standards that determine how contracts interoperate.
• Formal verification. The small but growing set of contracts with mathematically proven properties.

How to read a smart-contract story here

“Audited” is treated as a safety guarantee and is not one. An audit covers a specific commit, a specific scope and a fixed number of reviewer-days; contracts are routinely exploited through code deployed after the review, or through interactions with a protocol that was out of scope. Our coverage names the auditor and, where it is knowable, whether the exploited path was examined.

Attribution in the first hours is also unreliable. The mechanism reported initially is revised often, and “hack” is applied indiscriminately to genuine contract breaks, stolen admin keys and users signing malicious approvals — three different failures with three different remedies. Where publishers disagree on the mechanism, the story is Disputed.

Where to go next

See the DeFi desk for the protocols built from these, or the Verification Center for how publishers are counted.