http://i3xi5qxvnvtjk3am4vkw3xvfecjitic3brox4tfgl6mxqyzctqudscqd.onion/path-spec/detecting-route-manipulation.html
In the extreme, the attack allows an adversary that carries c/n
of the network capacity to deanonymize c/n of the network
connections, breaking the O((c/n)^2) property of Tor’s original
threat model. It also allows targeted attacks aimed at monitoring
the activity of specific users, bridges, or Guard nodes. There are two points where path selection can be manipulated:
during construction, and during usage.