Unfortunately, there is no fool-proof method of preventing cheating in a set-up like this. I imagine Valve is able to enforce its game-economy through strict policing.
As such, there are ways to make fixing the damage--for example, you could limit what a server could give its players. If you had a some paid virtual item, a random server shouldn't be able to give the player the item; only the master server should be able to.
Another thing you can do is keep a log of what the servers tell the master server. This way, if you discover that a server has been sending "shady" commands (i.e. "Player X gained 1000000 XP"), you can instantly roll-back all commands that the server has sent to the master-server, instantly undoing everything that the server told the master server to do.
Sending the hash wouldn't work; if I were determined enough, I could always change the server code to send the appropriate hash.
You're never going to be able to trust the client. Once information gets on their computer, it's out there for good. The best thing you can do is develop accurate heuristics and deal harsh punishments.