Smart contracts are just code. And like all code, they have bugs. The difference is the bugs are immutable.