as a complete newbie to this,
where does the code actually execute? what's the code writen in?
whats stopping malicious code running?
where does the code actually execute? what's the code writen in?
whats stopping malicious code running?
On every Ethereum node that verifies it. It's usually written in Solidity and compiled to EVM (Ethereum Virtual Machine) bytecode (so it can also be written in other higher-level languages).
> whats stopping malicious code running?
It's sandboxed and since it's limited to the EVM, there isn't really any "malicious" code that could break out of the EVM AFAIK. Inside the EVM it's probably more of a philosophical question whether any code can actually be considered "malicious".
if the code is sandboxed, then what useful things can it do?