Why We Built OTP Infrastructure, and What It Makes Possible
Onchain Token Portfolios (OTPs) enpowers global users to own and mimic top-performing portfolios in one click.
City Protocol built OTP infrastructure because the products most people actually buy, such as index baskets, portfolio trackers, and thematic baskets, had no onchain rails.
The assets were already there, but there was no way to hold them as a managed portfolio without a pool and without handing over a key. An Onchain Token Portfolio, or OTP, fills that gap as a published rule executed in each holder's own account, so when you buy one, the constituents land in an account you own.
What was missing when the assets arrived onchain
By 2026, almost every asset an index could hold already existed onchain. For example, tokenized US stocks trade around the clock on BNB Chain and Base, and treasuries, credit, and trading strategies sit in vaults with a price.
What was still missing was the product layer. In traditional markets, the products people hold, such as an index fund, a tracker or a thematic basket, each combine a rule about which assets to hold and in what proportion with a vehicle that holds the assets for you. Onchain, the only wrapper available was the vault, which takes your deposit into a pool, gives you a unit, prices the unit, and rations your exit.
A vault suits a strategy that must run as one book. A portfolio whose whole point is that you hold the assets needs a different container, one that runs a rule inside an account you own, and OTP infrastructure was built to be that container.
What we built
The architecture has three parts that matter to you as a holder, and the first is your account. When you sign in, Privy creates an embedded wallet for you, and the wallet's private key is split into two encrypted shares that only come together at the moment of signing, so neither Privy nor City Protocol holds the key. When you buy a portfolio, an ERC-4337 smart account, a programmable onchain account owned by that wallet, is deployed for you, and every constituent the portfolio holds sits there on your address, where you can check it on a block explorer. Because every holder has their own account, nothing is pooled.
The second part, the permission, arrives in the next phase, when City Protocol's Rebalancing Executor will be added to your account as a session signer, a limited signing key bound to a policy. The policy will allow calls to the constituent contracts and the Basket Execution Router, permit the swap and approval functions the router needs, and deny everything else, including any transfer out and any key export. You can remove the signer at any time, and the constituents will stay where they are. Until then, City Protocol holds no permission in your account at all.
The third part is the rule. Every portfolio runs on a methodology that we publish and version before the product opens. The methodology names the constituents, the weights at purchase and the public information that changes the list. After purchase, the weights follow the market and are left to follow it, so nothing is sold because a stock grew and nothing is bought because one lagged.
When the named information appears, such as a new filing, a disclosed trade or a change to an index rule, the change is published on the product page before it executes. In the next phase, the executor will compute the trades and the router will settle them as one atomic batch, meaning every leg settles together or none does. Each leg will be price-checked against a reference and capped for slippage, so that the batch halts without filling if any leg cannot clear. Each change is recorded onchain and listed on the Rebalances tab.
Around those three parts sit the pieces an operator needs, namely an account factory, a delegation module that will scope each permission in the next phase, an exit router that unwinds a basket in one transaction, and lifecycle controls for issuing, pausing and retiring a product. None of these pieces gives City Protocol a way to withdraw from your account.
What you get from it
When you buy an OTP, one transaction turns your stablecoins into the constituents at the published weights, directly in your own account. Nothing is pooled or custodied, because City Protocol holds no assets, no keys and no withdrawal authority, and the executor's permission, when it arrives in the next phase, will be one you can revoke at any time.
After purchase, the list changes only on public information the rule names, and you can see each change before it executes. At the same time, each constituent is an ordinary token on your address, so you can sell, transfer or hold any one of them separately. Network fees on portfolio operations can also be sponsored, which means you do not need the chain's native coin to use the product.
Why it fits index products
For an index, the product is a fixed list of names. On the rails, the list is bought at the weights the methodology sets, which means one seventh each for the Magnificent Seven Index OTP on BNB Chain and equal weights for the Fantastic Four Index OTP and the Elon Musk Index OTP on Base. From then on, the weights follow the market in every holder's account, and the list changes only if the published constituent rule adds or drops a name. Because an index is the simplest thing the rails can run, the first products are Index OTPs.
The same methodology can also run on more than one chain. In that case the rule stays the same, and only the venue where the constituents trade changes.
Why it fits portfolio trackers
A portfolio tracker holds the disclosed positions of a manager and changes only when a new disclosure is published. The tracker's methodology names the filing that triggers a change, such as a quarterly 13F or a disclosed trade, and the new constituent set is published before it executes. The change mirrors the disclosure, so only the position that was added, trimmed or sold is traded.
The architecture defines this product type as the Guru OTP, which arrives with the next phase. A Guru OTP will use the same account, permission and execution model as an index, with a public disclosure as its only trigger. In that phase, the executor will move every enrolled account to the new list, and you will see each change on the Rebalances tab and can leave before or after it.
Why it fits thematic products
A thematic basket holds whichever names meet a published rule, such as belonging to a theme like AI or energy. On the rails, a Thematic OTP's methodology states the eligibility test, and the list changes when the test says a name has entered or left the theme. Because the rule is published and versioned, you can read exactly why a name is in the basket, and because the rails work the same way whatever the constituents are, the basket can hold tokenized stocks, vault receipt tokens or anything else with an onchain price. Thematic OTPs arrive with the next phase, alongside Guru OTPs.
What we deliberately left out
For OTPs, several familiar parts of a fund were left out on purpose. There is no pool, so there is nothing to drain and no exit to ration, and there is no unit, because your position is simply the token balances in your account. After purchase, the weights are left to follow the market, so a price move on its own never triggers a trade.
Execution follows the published rule without discretion, so every change can be checked against the methodology after the fact. Custody is left out too, because the account is yours, and in the next phase the protocol will act in it only as a signer under a policy you can remove. Each of these choices removes something you would otherwise have to trust.
Where the rails go next
Looking further ahead, the rails are built to carry more constituent types, so that a portfolio can hold a yield strategy beside a stock, and more chains, since a methodology does not depend on any one chain and only its constituents choose the venue. The rails are also built for more issuers, because publishing a methodology on them requires a rule and the eligibility to offer it, without a fund, a custodian or a unit price.
Frequently asked questions
What is an OTP, in one sentence?
An OTP is a published, versioned rule about which assets to hold, bought at the weights the rule names, changed only on public information and held inside your own onchain account.
How is it different from a vault?
A vault pools deposits and issues units, which suits a strategy run as one book. An OTP keeps the constituents directly in each holder's own account, so you own the portfolio asset by asset.
Who can issue a product on the rails?
Today City Protocol issues the live Index OTPs itself. After the next phase, any issuer eligible to publish a methodology will be able to launch a product on the rails, and the issuer will never hold participant assets.
Which product types are live?
Index OTPs are live today. The Guru and Thematic types are defined in the architecture and arrive with the next phase, together with the Rebalancing Executor and the Basket Execution Router.
Can I leave whenever I want?
Yes. You can exit in one transaction through the exit router, or sell one constituent at a time, with no epoch and no queue.
Conclusion
The assets came onchain first, but the products people actually hold, such as index baskets, trackers and thematic baskets, needed rails that keep every asset in the holder's own account and follow a published rule.
City Protocol built those rails, the first Index OTPs already run on them, and the Guru and Thematic types will follow in the next phase.
Details as published in the City Protocol documentation as of September 2026. The Elon Musk Index OTP is named for the companies it holds and has no affiliation with, and no endorsement from, any person or company. This post is for educational purposes only and does not constitute financial or legal advice or a solicitation to buy or sell any asset. Eligibility checks, KYC and jurisdiction limits apply.
