Bitcoin has a scripting language built into it, which allows the creation of many kinds of smart contracts. Examples are atomic swaps, Lightning payment channels and zero-knowledge contingent payments (ZKCPs). This later paper by Banasik, Dziembowski and Malinowski (BDM16) improves the efficiency of these greatly. Threshold multisignatures are also easy to do, interestingly much more easily than in Ethereum.
ZKCPs are extremely general and can execute any contract in which the counterparties and terms of the contract are known at setup time, though it does require they use some new and slow crypto (done off-chain, Bitcoin is never exposed to it).
A more whimsical example is Peter Todd’s bounty for anyone who can collide SHA1, SHA256 or RIPEMD160. The SHA1 collision bounty has been taken.
My guess is that the only thing Ethereum can do that Bitcoin actually can’t do, is extrospect on the outputs being spent. This would be sufficient to implement covenants, which would be something of a mixed blessing.
Andrew Miller has argued that Ethereum’s account model lets it do contracts in a more transaction-efficient way than Bitcoin’s UTXO model, which may be true, but the examples I’ve seen of this (a) lose privacy by storing lots of unrelated state in one account and (b) exploit Ethereum’s global key-value store, which is significantly more expensive to maintain than a UTXO set. Extrospection may be efficiently (efficient for verifiers, not for the transacting parties :)) attainable by creative use of ZKCP’s, much how the BDM16 paper does atomic swaps with them, but I haven’t worked out the details.
As a final note, it is easier, by design, to implement and deploy Ethereum contracts. However, I think the hard part of smart contracting is analyzing the contracts and proving correct behaviour under all inputs. (Both Ethereum’s and Bitcoin’s script languages fall short on this count, being difficult in general to efficiently reason about.)
