Of course it needs to be paid upfront and kept in Escrow, hopefully an helpful admin is willing to manage it and if people don't trust the admin they just don't donate to said admin. As for verifying who to pay out to, the developers could just PM the admin the files together with an Sha-1/md5...