OTP Architecture
Definition
An Onchain Token Portfolio (OTP) is a published, rules-based model portfolio whose constituents are held directly by the participant, in the participant's own onchain account, and maintained against the published weights by an automated executor.
Three properties define it.
Direct ownership. Constituents are held in an account the participant owns and controls. They are never commingled. City Protocol takes no custody, holds no private key, and has no withdrawal authority.
Rules-based execution. Constituents, weighting method, reconstitution schedule, and rebalance triggers are defined in advance and published. Execution follows the published rules, with no discretion applied at execution time.
Single-transaction entry and exit. One transaction converts a single asset into the full weighted basket, and one transaction reverses it. Any individual constituent may be sold, transferred, or pledged independently of the remainder.
The structure applies the separately managed account model to onchain portfolios. Capital is managed under a defined mandate without being commingled, and the account holder retains ownership and control throughout. City Protocol designs the methodology and operates the execution rails in a single stack, so a portfolio moves from published rule set to live holdings without passing through an external manager.
The OTP Architecture exists to host City Protocol's ETP offering. It is not a general-purpose issuance framework for third-party curators.
Distinction from the Vault Structure
A vault receives participant capital. Assets are transferred in, a token representing a claim on the pool is issued in return, and the position held is a fraction of a shared balance. Value is struck per share because the pool's contents are not held individually. Withdrawal is governed by the vault's liquidity terms.
An OTP receives no capital. There is no pool to hold a share of and no shared balance to price, and therefore no unit and no unit price. The position is the constituent tokens held in the participant's own account. Nothing is redeemed, because nothing was transferred.
Four consequences follow.
Transparency is structural. Holdings sit in the participant's own account and are readable onchain at any time. Look-through is a property of the position rather than a reporting function.
No pooled attack surface. A shared contract concentrates every depositor's assets behind a single point of failure. An OTP holds no participant funds in a shared contract.
Ownership survives platform failure. Should City Protocol cease operations, participants retain their constituents. Maintenance of the published weights stops; ownership is unaffected.
Permissions replace transfers. Automation operates on scoped execution permissions granted by the account owner. Revocation is unilateral and immediate, and leaves holdings untouched.
Core Modules
Portfolio Registry
Canonical registry of live portfolios, covering portfolio IDs, constituent lists, target weights, methodology versions, reconstitution schedule, fee schedule, eligibility policy, and lifecycle status.
Methodology Engine
Stores the published rule set: constituent selection criteria, weighting method, reconstitution schedule, rebalance triggers and drift bands, concentration and eligibility rules. Versioned, with every change published before it takes effect.
Account Factory
Provisions the participant's own onchain account. Ownership sits with the participant from creation; the account holds the constituents directly.
Delegation and Permission Module
Records the scoped execution permissions the account owner grants to the rebalancing executor. Permissions are bounded to allowlisted constituents, venues, and call selectors, carry no withdrawal authority, and are revocable by the owner at any time without counterparty consent.
Basket Execution Router
Converts a single subscription asset into the full weighted basket in one transaction, routing across approved venues and aggregators within published slippage bounds.
Rebalancing Executor
Returns each account to the published weights on the scheduled cadence or on a drift trigger, acting only within the delegated permission set.
Drift and Tracking Monitor
Measures each account's actual weights against the model, reports tracking difference, and raises rebalance triggers.
Exit Router
Converts the basket back to a single asset in one transaction, and supports partial exit down to a single constituent, leaving the remainder of the portfolio in place.
Eligibility and Access Policy
Applies jurisdictional rules, allowlists, and product-specific access requirements at subscription.
Disclosure and Reporting Layer
Publishes the methodology, the current constituent list and target weights, reconstitution and rebalance history, fee schedule, risk disclosures, and portfolio events.
Lifecycle Manager
Supports launch, reconstitution, methodology updates, fee changes, subscription and rebalancing pauses, and portfolio retirement.
Last updated