A smart contract is a program stored at an address on the chain. Anyone can call it, and every node runs the same code to reach the same result. Because the code is public and runs the same way for everyone, its rules can be checked before money is put into it.
A token is itself a smart contract: it keeps a table of balances and a function that moves amounts between them when the owner signs.
What contracts cannot do
Contracts cannot reach outside the chain, cannot keep secrets in their storage, and cannot be fixed quietly after deployment unless they were built to be upgradable. Each of those limits shapes how financial products are designed on-chain.
Gleo Contracts are written in Solidity for Robinhood Chain. None are deployed yet; the tools that depend on them run in practice mode until they are audited.