Honestly, the best way to do it (in my opinion) is by a combination of total impressions and unique impressions. Something like X(Unique) + Y(Total) = Payout, where X might be 0.01 BTC and Y might be 0.0001 BTC. And of course, check for what browser is being used, etc, so bots aren't counted.
Going by CPC is pretty sketchy on both the publisher and management side. The publisher might be tempted to click on his own links, or otherwise incentivise the clicks for other people, and the management side might be tempted to ban sites that appear to have a high CTR, when it very well could be legitimate traffic.
I agree with this. I think CPM is more honest in general and better for everybody. Consider the fact that some advertisers might get more impressions because they bid higher but aren't getting very many clicks because their ads aren't enticing. The publisher loses out because the ads aren't getting clicked. Plus, sometimes publishers like to click their own ads because they are genuinely interested, but they don't click because they don't want to look fraudulent.
That's one of the bad things about Google Adsense, is the publishers are always left wondering how many genuine clicks are being rejected by Google because Google thinks it looks fraudulent, all the while the advertiser is paying for the clicks as if they were real, so Google rakes it in and publishers get screwed.
