A smart contract is a self-executing program deployed permanently to a blockchain. Once deployed, no one, not even its creator can modify it. It runs exactly as coded whenever triggered by a transaction or condition. This immutability is both the feature and the vulnerability: if there is a bug in the code, that bug is also permanent and potentially exploitable. The DeFi ecosystem has lost hundreds of millions of dollars to smart contract exploits. This is why professional security audits by firms like Trail of Bits, Certik, or Consensys Diligence are considered non-negotiable before any protocol handling significant funds goes live. Always check whether a DeFi project you're considering has been audited, and by whom.