Yeah, I don't see any built-in security against a 51% attack specifically in the code. But the attack still requires collusion between a majority of prime controllers, and a bad actor(s) can be ejected from the network. All it takes is one prime to call a vote for ejection. So theoretically, GAW (or the collusion group) would have to own 100% of the prime controllers. After the ejection, Orion controllers can bid to become prime, thereby also securing against collusion.
And what if the bad actor is GAW who controls 100% of the prime controllers?
I'm still puzzled by this whole orion-bidding-prime process. Shouldn't it all be a transparent and cryptographically verifiable process? Otherwise why bother calling it a crypto currency.
In other words, let's say I buy 125k coins on Cryptsy (or maybe my name is Craig). How can I apply to host a Prime controller? This all starts in a few hours, and there doesn't seem to be any concern from anybody (us trolls don't count) that nothing is known about it

Consider this for a minute too suchmoon. Consider that Prime Controllers, orion thingies etc don't and never will exist. Imagine for a second that its possible that Josh will have the bidding open in subtracted for wallets for absolutely nothing. Those coins taken from the clients will be used to fund their stakes back as well as remove the coins from possible sell backs limiting liability.
Josh would likely in this scenario cover himself by releasing a new wallet but "refuse" to push the source for the prime and orion controllers stating its a risk to the customers if the source is available to attack. His victims and investors will eat that shit up because they'll be like yay for josh he's protecting us. It'll be a cover though. Its a win win... don't show the source so nobody can invalidate his claims and he sucks paycoins back without work done (and removes an element of cash backs @ $20 floor).
He'll please everyone by finding some blog setup by a mate to audit his source code and say the prime controller stuff is there.
We keep the circle going... gaw supporters say no proof and we say well show us some that it is there... they say look at the wsj blog.
This is what i think will happen next. There is NO prime controllers.... the source code is just a clone and there WON'T be this added functionality. As long as it "appears" there is a bidding process and peoples zen accounts have some icon or graphic that says you bought a prime controller with successful bid of 1 million paycoin people will be appeased.
Here we go again.... strap yourself in for the next round of victims.