How City Protocol Uses Privy Smart Wallets to Run Your OTP
Every OTP lives in a smart wallet built on Privy. The key that owns the account never leaves a sealed enclave. This is how the pieces fit together.
Every OTP on City Protocol lives in a smart wallet built on Privy. The wallet holds your seven tokenized stocks today. In the next phase, a signer with a narrow policy will apply each published change to the list inside that wallet, and the key that owns the account never leaves a sealed enclave. This is how the pieces fit together.
A portfolio whose list can change needs someone to sign trades while you are not there. A regular wallet gives you two bad ways to do that. You sign every change yourself, or you hand over your key. City Protocol is building a third, and the wallet layer is what makes it possible.
What you get when you sign in
Signing in to City Protocol creates an embedded wallet through Privy. It is a real onchain key that only you control, created without a seed phrase to copy down and without a browser extension to install. You can sign in with an email, a social login or an existing wallet, and the embedded wallet is there behind it.
When you buy your first OTP, the protocol deploys a smart account owned by that wallet. The smart account is an ERC-4337 account, an account defined by a contract rather than by a bare key, and it is where the seven tokenized shares are held. You are its owner. You can sign anything for it, and you can add or remove other signers.
How a program gets permission to trade for you
In the next phase, City Protocol's Rebalancing Executor will be added to your smart account as a session signer, which Privy calls an authorization key. It is a P-256 key pair whose private half the executor holds and Privy's own infrastructure never sees. Adding it will be a one-time consent when you buy, and it comes bound to a policy.
The policy is a list of rules. Each rule pairs an action with a set of conditions and a decision, allow or deny. The conditions can read the transaction itself, including the contract it calls, the chain it runs on, the value it moves and the decoded calldata down to the function being called. For an OTP the policy will allow calls to the constituent token contracts and to the Basket Execution Router, permit the swap and approval functions the router needs, and nothing else. No rule allows a transfer to any other address. No rule allows key export.
Anything without a rule is denied, and any deny overrides any allow. The policy is enforced inside a trusted execution environment before a signature is produced, so a request that fails a rule never reaches the key.
What the executor will and will not be able to do
| Action | Allowed |
|---|---|
| Swap one constituent for another through the router | Yes, within the price guard and per-leg slippage cap |
| Approve the router to spend a constituent | Yes |
| Transfer a token to any other address | No |
| Export or read your key | No |
| Change its own policy | No |
| Act after you remove it | No |
Read the table from the bottom up and it says what matters. The executor will be able to apply a published change to the list, and nothing else. It will not be able to take anything out, and it will stop the moment you say so.
Where your key lives
The embedded wallet's private key is generated inside a secure enclave from 128 bits of entropy and split with Shamir's secret sharing into two shares. One share can only be decrypted inside the enclave. The other, the authentication share, is released only when you authenticate. Neither share reveals anything about the key on its own, and the key exists in complete form only for the moment of signing.
The enclaves are AWS Nitro Enclaves. They have no persistent storage, no interactive access and no network connectivity, and they produce attestations that let anyone verify the code that ran. Privy does not hold your key. City Protocol does not hold your key or a share of it. City Protocol holds a signer with a policy, and the policy is checked in the enclave before any signature exists.
What happens when a change is published
The methodology names the public information that changes the list: a new filing or a disclosed trade for a Guru OTP, a change to the constituent rule for an Index OTP. There is no drift band and no monitor, because there is no target weight to defend. When a change is published, the Rebalancing Executor will compute the trades and send them to your smart account for signing under its authorization key. The policy engine checks every call against the rules, the enclave signs only what passes, and the Basket Execution Router settles the batch atomically, price-checked leg by leg. Each change is recorded on the chain and listed under Rebalances on the product page. For the live Index OTPs the lists are fixed, so until the next phase there is nothing to apply.
Network fees on portfolio operations can be sponsored, so you can hold your basket without holding the chain's native coin.
How you switch it off
Once the signer is in place, removing it from your account stops automation immediately, with every constituent still where it was. Nothing is sold, nothing moves. A protocol-level pause halts subscriptions and changes to the list, and your exit stays open throughout.
What you are trusting, and what you are not
You are trusting the enclave hardware and the audited contracts that define the smart account, the policy engine and the execution rails. You are trusting that a policy enforced before signing does what it says, which is the property the whole design rests on.
You are not trusting City Protocol with your key, your assets or the ability to move them. You are not trusting Privy with a complete key. And you are not trusting a person to apply a published change, because a rule will do it under a permission you can read on the chain.
You are still responsible for your own access. Owning the account means holding the way in, and there is no operator to call about a lost login.
Frequently asked questions
- Does City Protocol hold my key?
- No. Your key is generated and split inside a secure enclave. City Protocol holds a signer on your account, bound to a policy, and never the key or any share of it.
- What exactly can the Rebalancing Executor sign?
- In the next phase, swaps and approvals between the constituents of your OTP, through the Basket Execution Router, within the price guard and slippage cap, and only to apply a change the methodology has published. It cannot transfer assets out or export a key.
- Can I see the policy?
- The permission the executor holds is on the chain, and the rules it is bound to are described on the product page.
- Can I stop it without selling?
- Yes. Once the signer is in place, remove it and automation stops at once. Your holdings do not move.
- Do I need to hold a gas token?
- No. Network fees on portfolio operations can be sponsored.
An OTP holds the constituents you bought, at the weights the market makes. In the next phase a signer bound to a default-deny policy will apply each published change inside an enclave that never exposes your key, and the assets never leave your account.
Wallet, signer, policy and enclave mechanics as published in Privy's documentation, and their use on City Protocol as published in the City Protocol OTP architecture documentation, as of September 2026. This post is for educational purposes only and does not constitute financial or legal advice or a solicitation to buy or sell any asset. Eligibility checks, KYC and jurisdiction limits apply.
