Let's say we have an ETH trading exchange where we employ BIP32/BIP44 to generate a unique wallet address for each user. For simplicity, each user uses the same wallet address (unique to each user) for all subsequent deposits/withdrawals.
For safety reasons, we have a hot/online wallet and a cold/offline wallet, where the hot/online wallet is handled by a service (say a NodeJS app) that only contains an extended public key and not the mnemonic/seed of the HD Wallet root node.
We also use the derivation path structure similar to BIP44
m / purpose' / coin_type' / account' / address_index
Question 1: Is it generally practised to let each user have a different account level node? Eg: User 1 has
m/44'/20'/1, user 2 has
Question 2: Assuming the above question is correct, should the account level key be hardened or not hardened?
From my (poor) understanding so far, If we use
m/44'/20'/0 instead of
m/44'/20'/0', we only need to the extended public key for
m/44'/20' to generate deposit addresses for each user
However if we use
m/44'/20'/0', we need the extended private key for
m/44'/20' to generate deposit addresses for each user, and this is less secure because if the extended private key on the online/hot wallet app is compromised instead of the extended public key, all the funds can be stolen.
Lastly, what is the best practice for implementing BIP32 in such an application (trading exchange, marketplace, etc)? Does the app that handles the wallet and holds the keys communicate via a REST/websockets/jobqueue method with the other services that accepts user input to request withdrawal/deposits?