How does Mastercoin avoid double-spend attacks without it's own blockchain?
The answer is double-layered:


Mastercoin uses Bitcoin for timestamping. It's impossible to revert the transaction at the Bitcoin level without doing a Bitcoin double spend (super costly).
Mastercoin clients track the state of the system including how much is stored at each address. If a client double spends by sending two contradicting Mastercoin transactions, the second one will be discarded as an invalid spend by any client that parses the transaction stream.