As already pointed out, smart contracts are programs.
But unlike regular programs they also holds a balance of tokens on the blockchain.
Actually, they can hold any data they want, like (but not limited to) :
- How much tokens were already created (minted) - this is called total supply.
- The list of addresses that minted the token to and their balance.
- The name of the token.
- The symbol of the token.
- What is the cap of the token (this is optional for ERC20 tokens) etc...
This is very similar to a bank account, the bank have your balance, your record data etc.
Minting will be just a process of increasing the total supply of the token and the balance of the address that the contract minted the token for.
Again, just like a bank, if it would be allowed to create tokens or money, the bank would just update two numbers once they decide to do this : the total supply and the balance of the account that got the newly created token.
Now, naturally you don't allow anybody to touch the total supply and the balances of your token. For this smart contract have special mechanism that allows certain parts of the program to be called only by somebody that have a special private key. Most likely, this will be the token creator but that can be anybody, it solely depends on the smart contract program code.
Now to your questions:
- What happens on minting is just a process of updating of the total supply and of the balance that the token is minted for, nothing more.
ICO ERC20 smart contract is not required to have knowledge of who paid who, it is most likely programmed just to hold the balances. There is for sure a possibility to create a contract that will mint in response to money (ether) being sent to it.
And I am sure some ICO just exactly this, but this is not required. You will have to look into the contract code to understand how exactly the minting is done.
- Nothing actually, however, most of the contract implement a Capable functionality i.e. once certain amount of tokens were minted (the total supply reached a predefined number) the contract will disable the minting.
- I am not sure what you mean. The private key is used to sign transactions on blockchain and a care should be taken to not expose it. Sometimes, mintable smart contracts are created in a way that , there is a special address/account that allows minting of token, that account's private key can be destroyed once the minting is finished.
There are actually endless possibilities and ways to create tokens, but most of them follow ERC20 standard and use OpenZeppelin as a basic library.