Blockchain, Honestly · Chapter 3 of 6
Smart contracts, and writing your first one
A program every machine on the network runs, why that makes it expensive, and the commands to actually deploy one.
A smart contract is a program stored on the chain, which every validating machine re-runs independently so they all reach the same answer and agree on the same new state.
It is neither smart nor a contract. Not smart in any AI sense; not a legal contract. The name was coined in the 1990s, before there was anything to run one on, and it has caused confusion ever since.
That definition explains the economics entirely. You are not buying compute the way you rent a cloud server. You are paying thousands of independent machines to redundantly run your code and store its result forever, with none of them able to decline. Expensive and slow is the design, not a defect awaiting optimisation.
Immutability is at least as often a liability
Once deployed, the code cannot be edited. Find a bug and there is no fix to push. Your options are to deploy a corrected contract and persuade every user to move — while the broken one sits there permanently with whatever is trapped inside it — or to have planned ahead.
The plan-ahead answer is a proxy: a small permanent contract that users talk to, which forwards every call to a separate contract holding the real logic. To upgrade, you deploy new logic and repoint the proxy. This is extremely common in production.
And notice what the proxy quietly costs you
Whoever holds the key that repoints the proxy can rewrite the application's behaviour at any time, unilaterally.
Which is precisely the single-trusted-party problem the entire architecture existed to remove.
So a large share of real deployments are described as immutable and trustless while being neither. When you meet a contract in the wild, finding out whether it sits behind an upgradeable proxy — and who holds that key — tells you more about its risk than the audit badge does.
Gas
Gas is the unit that prices this redundant global execution. It does three jobs at once: it caps how much computation one transaction may demand, so nobody can freeze every machine with an endless loop; it rations genuinely scarce space in each block; and it pays the validators. You never hold gas — it is a unit of account, and you settle it in the chain's currency at whatever the going rate is.
Since 2021 each block sets an algorithmic base fee which is destroyed rather than paid to anyone, rising up to 12.5% per block when demand is high, on top of which you may add a tip for priority.
What is genuinely different about writing it
- Every write costs real money, so you optimise for the number of storage operations rather than for readability.
- You cannot make a network call, read the clock precisely, or get real randomness. The execution environment must produce identical results on every machine, so anything non-deterministic is simply absent. This single constraint is the direct cause of the oracle problem in the next chapter.
- Your deployed code is permanently public. You are writing an adversarial, fully inspectable interface by default — not an internal service behind a firewall.
The smallest contract that does anything, from Solidity's own documentation:
// SPDX-License-Identifier: GPL-3.0
pragma solidity >=0.4.16 <0.9.0;
contract SimpleStorage {
uint storedData;
function set(uint x) public {
storedData = x; // this line costs money to run
}
function get() public view returns (uint) {
return storedData; // "view" means it reads only, so it is free
}
}Actually deploying it
A name collision, because both halves of it are on this site.
Foundry here is the Ethereum development toolkit. Microsoft Foundry is an unrelated product — Microsoft's platform for building AI applications, covered in the Microsoft 365 book.
Nothing in common but the word. If someone says ‘we are using Foundry’, which one they mean is decided entirely by whether the conversation is about smart contracts or about AI agents.
Foundry is the current default toolkit for new work — Rust-based, and its tests are written in Solidity itself. Hardhat is the older incumbent, JavaScript-based, with a larger plugin ecosystem; its version 3 in late 2025 rewrote the engine in Rust and closed much of the speed gap. Either is a reasonable choice; Foundry is where new security-sensitive work tends to start.
curl -L https://getfoundry.sh/install | bash
foundryup
forge init hello_foundry && cd hello_foundry
forge build
forge test
# deploy to Sepolia, the current public test network
forge script script/Deploy.s.sol \
--broadcast \
--rpc-url sepolia \
--verify \
--etherscan-api-key $ETHERSCAN_API_KEY- A test network is an identical separate chain whose currency is worthless, so you can deploy and break things for free. Sepolia is the current one — Goerli was retired in April 2024, and older tutorials still point at it.
- A faucet is a site that gives you free test currency to pay test fees.
- A wallet such as MetaMask holds your private key and asks you to approve transactions. It does not hold coins — balances live on the chain. It is closer to an SSH key with an approval prompt than to a bank account.
- A node provider like Alchemy or Infura runs the chain software for you and gives you an endpoint, for the same reason people use managed databases.
- Use the toolkit's key store — the
--accountflag — rather than pasting a private key anywhere.
Elsewhere: Solana's programs are written in Rust, usually via a framework called Anchor, on an architecture built for running things in parallel. Move, used by Aptos and Sui, came out of a Meta project and treats assets as things the type system itself refuses to copy or silently destroy.
Check yourself