Relays can trick authorities into assigning the hsdir flag early
Dirauths trust the uptime value reported in a relay's descriptor instead of doing some checking of their own to see if the reported value is plausible.This means it is cheaper than expected to mount a dos attack against a known hidden service by targetting the nodes responsible for storing its descriptor.