Skip to main content
Otto AI executes your on-chain actions — swaps, bridges, yield deposits, and perps funding — through a Safe smart account created for you. This page explains what that account is, who signs for it today, and the control you keep over where your money can go.

​
What is a smart account?

A normal wallet (an EOA, such as MetaMask) is controlled directly by a private key. A smart account is a wallet implemented as a contract. It still has an owner, and it can also install modules and delegated permissions. Otto’s execution account uses Safe, the widely used smart-account standard. The address is deterministic — it is derived from your sign-in, so it does not change, and any balance in it stays put. On this rail an Otto-managed key signs; your control is that a withdrawal can only ever land in your own connected wallet (your EOA).

​
How custody works today

On the live rail, your Otto Safe is agent-custodial:
  • An Otto-managed key signs execution. When you ask Otto to trade, bridge, or deposit into yield, an Otto-operated key signs the transaction from your Safe. The Safe holds your tokens during operations.
  • Withdrawals are pinned to your own wallet. The withdrawal destination is always your own connected wallet (your EOA). It cannot be redirected to any other address — this is enforced server-side, not left to a form field.
  • This is the only live execution rail for /app trading, yield, swaps, bridges, and Hyperliquid funding today.
Because Otto operates the signing key on this rail, treat funds in your Otto Safe as funds Otto can move on your behalf while they sit there — with the important guarantee that a withdrawal can only ever land in your own wallet.

​
Custody across Otto’s surfaces

Otto uses different custody models on different surfaces. Knowing which one you’re on tells you exactly who can sign.

​
Per-call payments never hand Otto a key

When your own agent pays an Otto x402 endpoint per call, your payer key stays on your machine. You sign each payment; nothing is delegated and Otto cannot move funds on its own. See the Empire Access Layer for that pay-per-call model.

​
Moving funds out

Because your Otto Safe address is stable and deterministic, a balance you leave sitting stays put — nothing expires, and no interface change touches what’s on-chain. On this rail an Otto-managed key signs, and when you withdraw, the destination is fixed to your own connected wallet (your EOA) and cannot be redirected. For the current withdrawal paths, see Moving Funds Out.