I want to build an automated system, that can accept payments from users in bitcoin and can make payouts to addresses, specified by users, as well.
BIP32 says, that the best way to accept payments is to use HD wallets. But what about payouts? How can I make payouts using funds from account's external chain addresses with received funds and not introduce security leaks?
For some code examples, take a look at Synala -- http://synala.com/
Or on Github: https://github.com/peterscott78/synala/
Supports watch-only BIP32 wallets, user registration, etc. Will also gather the unspent inputs and format them into an outgoing tx, allows for offline signing, etc.
However, doesn't allow for users to automatically send funds from their account. Due to security reasons, no private keys are stored online, and sends must be manually processed by admin.
Nonetheless, will give you some good example code to build on. Hope that helps.
Andreas explains in his book "Mastering Bitcoin" (https://github.com/bitcoinbook/bitcoinbook/blob/first_edition/ch04.asciidoc) in chapter 4 the use of Hierarchical Deterministic Wallets (BIP0032/BIP0044). Also it explains, how to use one of these address types for a webpage. Basically this allows to receive on an "ever changing" address. For your payout, you would also have a similiar concept of derived private keys, that allow for a number of addresses to pay from. You security concerns are not clear - receiving to an ever changing address, and then spending this "once", makes it visible in the blockchain - but doesn't imply a security risk. You are not re-using this address for your customers, so it will stay a one time usage model...
Automating the sending of bitcoins requires that you keep the private keys online. This is a very risky proposition. That is why most exchanges use a split setup where some funds are stored in a hot wallet while the bulk of the funds are stored offline in cold wallets. BIP32 lets you generate receiving addresses for the cold wallets that are stored offline.
For more information see this question.
