should i use my MPK to generate infinite addresses, so after a user deposits into the address, a new address is automatically generated for that user.
Yes, that's an intended use of BIP32.
and if the user deposits to the old address can It be traced?
Assuming you remember the derivation of the key, sure. But it would probably be simpler to just keep a list of every Bitcoin address you've ever shown to a user, and compare incoming transactions against that.
Also how would the user be able to withdraw their balance in only their account?
There are two ways to implement this:
- Keep coins from different customers with each other in one big wallet. Keep track of how much each customer has in a separate database.
- Make each address belong to a customer, and make sure that customers can only sign transactions using their own keys.
#1 has some advantages, but #2 is generally easier to implement without shooting yourself in the foot.
I don't want my priv key exposed. And how can the site fees be deducted from each transaction with out the user beign able to withdraw that as well, And how would i implement a escrow service for the site so the seller offers service and the buyer buys but the coins are stored until the buyer says release or my staff see that it should be released to the right person.
I suggest that you not give your private keys to your users, especially if you're using BIP32 or you've chosen approach #1 above. Instead, generate and sign the transactions yourself.
As for escrow or manually releasing funds, you control the private keys, so you can move the coins at will. (That's something that your customers might not appreciate, since it opens the possibility that you'll steal all of their money.)
also how can I set up a multi-sig on the site for those users that choose to use it?
I assume you mean 2-of-3 multisig between you, the buyer, and the seller. I've not used it personally, but I've heard good things about BitPay's copay implementation.
And am not the talented programmer making the site, so I am safe giving him my MPK? Or what is "safe" for me to give him?
The site as you've described it requires you to have the extended private key on your server, or somewhere that your server can access. And, no, that's not safe to give to someone that you don't trust.
