It is vulnerable to sybil attacks or where the recipient is a victim of a proxy attack. If the recipient is not connected to a valid Network, then double spends could be allowed.
as long as this protocol is intended for use of transactions around a dollar or so I don't see that being a financially lucrative attack.
However consider a large department store. If I put a "fence" around that store and control all of its outbound peer connections, I can then allow double spends for the duration of my visit at the store.
In order to defend against this large retailers would have to use distributed / trusted nodes and certificates.