I'm reading the paper Town Crier: An Authenticated Data Feed for Smart Contracts and i'm failing to understand this bit
The Relay is an ordinary user-space application. It does not benefit from integrity protection by SGX and thus, unlike the Enclave, can be subverted by an adversarial OS on the TC server to cause delays or failures. A key design aim of TC, however, is that Relay should be unable to cause incorrect datagrams to be produced or users to lose fees paid to TC for datagrams (although they may lose gas used to fuel their requests). As we will show, in general the Relay can only mount denial-of-service attacks against TC.
Why is it that the relay can't tamper with everything since everything passes through it?