src/or/replaycache.c hashes entries with SHA-1
Tor is supposed to be moving away from SHA-1, and the replay-detection cache can be migrated and protected against hash flooding at the same time (see also #4900 (moved)) without a protocol change. Just add and use a crypto_digest_local function which prepends a random bytestring (either 16 bytes or a full hash block), then applies either SHA-256 (if Tor was compiled for a 32-bit architecture) or SHA-512 (if Tor was compiled for a 64-bit architecture), then returns the first 160 bits.
To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information