discovery_actions.rs, lines 215-227, has a TODO:
// TODO(binier): constrain interval between these requests
// to handle malicious peers.
P2pChannelsSignalingDiscoveryAction::DiscoveryRequestSend { peer_id, .. } => {
!state.already_has_min_peers()
&& state.get_ready_peer(peer_id).is_some_and(|p| { ... })
}
A malicious relay peer can flood a target with discovery requests without any
rate limiting. The 60-second cooldown on RequestSend (line 139) only limits
outgoing requests we initiate, not incoming requests from peers.