I wish to setup a room-based multiplayer game model where players may host matches and serve as host (IE the server with authoritative power). I wish to host a master server which tracks player's items, rank, cash, exp, etc.

In such a model, how can I prevent someone who is hosting a game (with a modified server) from spoofing the master server with invalid match results, thus gaining exp, money or rankings.