How do you actually target the Tor gateway machine though? You can attack a Hidden Service, because there must be a webserver that responds to requests. The Tor gateway just passes traffic from the network to your client device.
Bugs can exist even in code most of us would consider trivial. The Tor daemon is definitely not trivial, and the project itself points out that it needs work![1]
Here[2] is "just" container.c from the Tor project. It's one very small part of the project that does fairly simple things any professional developer ought not have much trouble understanding.
It's almost 1600 lines. Are you telling me you can guarantee there are no bugs of potential security significance in that file?
They also want to make Tor even more multithreaded than it already is[3]. Threaded code never has bugs, right?
Any software is a potential attack vector. Tor is no different.
[1] https://www.torproject.org/getinvolved/volunteer.html.en#tor...
[2] https://gitweb.torproject.org/tor.git/blob/HEAD:/src/common/...
[3] https://www.torproject.org/getinvolved/volunteer.html.en#use...
You could probably proof it from anything but business-level error.
Not the OP, and I don't know much about Tor's protocol, but at a guess one might start with deliberately malformed layers of the onion, so you route through a Tor entry node, the outer onion layer is removed, then the packet is forwarded to a Tor relay.
The Tor relay then unwraps the next layer of the onion, but the data within that layer is deliberately malformed to trigger a bug in the Tor code running on that relay.