How to Build an Ethereum Smart Contract in 7 Steps

Building an Ethereum smart contract takes seven steps: set up Hardhat, write the contract in Solidity, compile it, test it locally, get free testnet ETH, deploy to Sepolia, then verify it and connect your app. A simple contract goes from empty folder to live on a testnet in an afternoon.

The tooling has changed a lot, though, and most guides still online have not caught up. Truffle and Ganache were sunset in 2023. web3.js is deprecated. The Ropsten, Rinkeby, Goerli and Holesky testnets are all shut down, so any tutorial pointing at them hands you code that fails on the first run.

This guide uses what actually works in 2026, with full code at every step. It covers the gas you’ll pay, what a contract costs to build properly, and the mistakes that lose people money after launch.

Key takeaways

• A basic Ethereum smart contract takes a few hours to write and deploy if you already know Solidity. A production contract takes four to eight weeks once testing and an audit are included.
• The current tools are Hardhat or Foundry for building, Solidity for the code, and ethers.js or viem for connecting your app. Truffle, Ganache and web3.js are no longer maintained.
• Deploy to Sepolia first. It’s the testnet Ethereum client teams maintain for contract and app testing, and the ETH on it is free.
• Never write your own token from scratch. Use OpenZeppelin’s audited contracts and extend them.
• Deploying to mainnet costs gas, not a fee to anyone. The amount depends on contract size and the gas price at the moment you deploy.
  

What an Ethereum smart contract actually is

A smart contract is a program that lives on the Ethereum blockchain. Once you deploy it, it runs exactly as written and nobody can change it, including you. That’s the point. It also means a bug you ship is permanent.

You write the contract in Solidity, compile it to bytecode, and send that bytecode to the network in a transaction. The contract gets its own address. After that, anyone can call its functions by sending transactions to that address.

Building one properly is a different job from building a website, and most teams bring in a smart contract development partner for anything that will hold real money.

Before you start

You need four things:

• Node.js installed, version 18 or later
• A code editor, VS Code is the common choice
• A MetaMask wallet, or any wallet that can connect to a testnet
• Some test ETH, which is free and covered in Step 5

That’s it. You don’t need to run your own Ethereum node, and you don’t need to spend anything until you deploy to mainnet.

Step 1: Set up your development environment

Start with Hardhat. It compiles your code, runs a local blockchain for testing, and handles deployment. Foundry is the other good option if you prefer writing tests in Solidity instead of JavaScript.

bash

mkdir my-contract && cd my-contract

npm init -y

npm install –save-dev hardhat

npx hardhat init

Pick the JavaScript or TypeScript project when it asks. Hardhat creates a folder structure with contracts/, test/ and a config file.

One thing worth knowing: Truffle and Ganache show up in most older tutorials, including ones published this year. Consensys sunset both in September 2023 and archived the code in early 2024. The same goes for web3.js, which is deprecated in favour of ethers.js. If a guide tells you to run truffle init, it was written for a version of Ethereum that no longer exists.

Step 2: Write the contract

Create contracts/SimpleStorage.sol. This one stores a number and lets anyone read it back:

solidity

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.24;

contract SimpleStorage {

    uint256 private value;

    event ValueChanged(uint256 newValue);

    function set(uint256 newValue) public {

        value = newValue;

        emit ValueChanged(newValue);

    }

    function get() public view returns (uint256) {

        return value;

    }

}

A few things to notice. The event is how your contract tells the outside world something happened, since your app can’t watch storage directly. The view keyword on get() means it reads data without changing anything, so calling it is free. And the pragma line pins the compiler version, which you should set to the current 0.8.x release rather than leaving it loose.

If you’re building a token rather than a storage contract, skip writing it yourself. Import OpenZeppelin instead:

bash

npm install @openzeppelin/contracts

solidity

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.24;

import “@openzeppelin/contracts/token/ERC20/ERC20.sol”;

contract MyToken is ERC20 {

    constructor(uint256 initialSupply) ERC20(“MyToken”, “MTK”) {

        _mint(msg.sender, initialSupply * 10 ** decimals());

    }

}

That’s a complete, standards-compliant token in nine lines. Hand-written token contracts almost always get something wrong, usually the transfer events, and then wallets and explorers display the balances incorrectly. Teams launching their own ERC-20 token start from this base and add features on top.

Step 3: Compile

bash

npx hardhat compile

Hardhat downloads the right Solidity compiler and produces the ABI and bytecode in an artifacts/ folder. The ABI is the list of functions your contract exposes, and your frontend needs it later.

Fix every warning, not just the errors. Solidity warnings usually point at something that will cost you gas or behave unexpectedly.

Step 4: Test locally

This is the step people skip, and it’s the one that saves money. Hardhat gives you a local blockchain that resets between tests, so you can run a thousand scenarios in seconds at no cost.

Create test/SimpleStorage.js:

javascript

const { expect } = require(“chai”);

describe(“SimpleStorage”, function () {

  it(“stores and returns a value”, async function () {

    const Storage = await ethers.getContractFactory(“SimpleStorage”);

    const storage = await Storage.deploy();

    await storage.set(42);

    expect(await storage.get()).to.equal(42);

  });

});

bash

npx hardhat test

Test the failure cases too, not just the happy path. What happens when someone calls a function they shouldn’t have access to? What happens with a zero value, or a number large enough to overflow? Those are where the money goes missing.

Step 5: Get testnet ETH

Sepolia is the testnet to use. Ethereum’s client teams currently maintain two public testnets, Sepolia for contract and application testing, and Hoodi for validator and staking testing. Older guides point at Ropsten, Rinkeby, Goerli or Holesky. All four are shut down, so their faucets and RPC endpoints return errors.

Get free Sepolia ETH from a faucet run by Alchemy, QuickNode or Google Cloud. You’ll need to paste your wallet address and wait a minute or two.

One caution worth building into your process: testnets get retired on a schedule now. Sepolia has an estimated end of life around the end of September 2026. Check the networks page on ethereum.org before you start a new project rather than copying a network name out of a tutorial.

Step 6: Deploy to the testnet

Add your network to hardhat.config.js. Keep the private key in an environment variable, never in the file itself:

javascript

require(“@nomicfoundation/hardhat-toolbox”);

module.exports = {

  solidity: “0.8.24”,

  networks: {

    sepolia: {

      url: process.env.SEPOLIA_RPC_URL,

      accounts: [process.env.PRIVATE_KEY]

    }

  }

};

Write a deploy script in scripts/deploy.js:

javascript

async function main() {

  const Storage = await ethers.getContractFactory(“SimpleStorage”);

  const storage = await Storage.deploy();

  await storage.waitForDeployment();

  console.log(“Deployed to:”, await storage.getAddress());

}

main().catch((error) => {

  console.error(error);

  process.exitCode = 1;

});

bash

npx hardhat run scripts/deploy.js –network sepolia

You’ll get a contract address back. Paste it into sepolia.etherscan.io and you can see your contract on the network.

A private key in a committed .env file is the most common way beginners lose funds. Add .env to .gitignore before you write anything into it.

Step 7: Verify and connect your app

Verifying publishes your source code on Etherscan so people can read what the contract actually does. Most users won’t touch an unverified contract, and for good reason.

bash

npx hardhat verify –network sepolia YOUR_CONTRACT_ADDRESS

To call the contract from a web app, use ethers.js with the ABI from Step 3:

javascript

import { ethers } from “ethers”;

const provider = new ethers.BrowserProvider(window.ethereum);

const signer = await provider.getSigner();

const contract = new ethers.Contract(address, abi, signer);

await contract.set(100);

const result = await contract.get();

That’s the full loop. Everything after this is the same code deployed against mainnet instead of Sepolia, which is why building the dApp around a tested contract is the easier half of the work.

How Ethereum runs your contract

Ethereum switched to proof of stake in September 2022. Validators stake ETH, get selected to propose blocks, and attest to each other’s blocks. There’s no mining and no puzzle solving involved, which is a detail a lot of older content still gets wrong.

When you send a transaction to a contract, it enters the mempool. A validator picks it up and includes it in a block. Every node on the network then runs your contract code in the Ethereum Virtual Machine and arrives at the same result. That agreement is what makes the outcome trustworthy.

You pay for the computation in gas. Each operation has a gas cost, and you pay that gas multiplied by the current gas price. Storing data is expensive, reading it is cheap, and anything you can calculate off chain should be.

What it costs

Two separate costs, and people mix them up.

Gas is what you pay the network to deploy and run the contract. A simple contract like the one above costs somewhere between 300,000 and 800,000 gas to deploy. Multiply that by the gas price in gwei at the moment you deploy, which swings a lot. Check the Etherscan gas tracker and deploy during a quiet period if timing is flexible.

Development is what it costs to build the thing properly.

Audits aren’t optional once real money is involved. The cost of an audit is always smaller than the cost of an exploit. Broader figures are covered in the blockchain development cost breakdown.

Where else you can deploy

Ethereum isn’t the only option, and for some projects it isn’t the right one.

Because Polygon and the layer 2 networks run the same EVM, a contract written for Ethereum deploys to them with no code changes. That’s usually the first thing to try if gas costs are the blocker. Projects that need thousands of transactions per second tend to look at Solana instead, which means rewriting in Rust.

Mistakes that cost people money

• Reentrancy. A contract calls out to another contract, which calls back in before the first one finishes updating its state. Update state before making external calls, and use OpenZeppelin’s ReentrancyGuard.
• No access control. Any function that shouldn’t be public needs an onlyOwner modifier or a role check. Leaving a mint function open is a common and fatal error.
• Hardcoded addresses. Addresses differ between testnet and mainnet. Pass them in through the constructor.
• Unbounded loops. A loop over an array that grows forever will eventually run out of gas and brick the function.
• No upgrade path. Contracts are permanent. If you’ll need to fix bugs later, build on a proxy pattern from day one, and understand the tradeoffs before you do.

Building something that holds real value

Smart contracts fail in ways normal software doesn’t. There’s no hotfix, no rollback, and the attack surface is open to everyone on the internet with an incentive to break it.

Comfygen has worked on blockchain and smart contract projects since 2019, across 550+ projects for 400+ clients in 30+ countries, with 97% client retention. Our team builds on Solidity, Rust and the EVM layer 2 networks, and every contract we ship goes through internal review before it reaches an external auditor.

If you’re planning a token, a DeFi protocol or a custom contract and want a second opinion on the approach, talk to our team.

FAQ’s