For instance, if you spot malware in a commit you could bet heavily against it being merged, and that would attract the maintainers' attention, and they'll see what you see and not merge it, and you get paid for the code review--that money would come from whoever bet that it would get merged, which you could require be the author of the malware. I haven't worked it out entirely but it seems that there are opportunities to build games that reward dilligence and transparency and penalize deception and spam.