Tor over Tor: Is it really risky?

Question

I would like to discuss about the different tor config for achieving a better anonymity and prevent or making harder a de-anonymize attack (via tor-nodes by correlating traffic from user to endpoint)

Due to a this issue fix, doing directly (User -> Tor1 -> Tor2 -> X.X.X.X) is no more supported as the exit nodes will block traffic going to another tor node.

But there is a lot of configuration still possible:

• (User -> Tor1 -> VPN -> X.X.X.X)
• (User -> Tor1 -> VPN -> Tor2 -> X.X.X.X)
• ...

Here is the scenario:

Imagine an user connecting directly though Tor to X.X.X.X

An attacker want to know the user who is connecting to X.X.X.X

• if he succeed to perform a correlation attack than the user is de-anonymized (by owning malicious guard and exit node used in the circuit, or even more easily by owning all nodes used)

Now imagine the user use the config ( User → Tor1 → VPN → Tor2 → X.X.X.X )

• if there is no real security concern about this config:
  • The attacker perform the same attack against Tor2, and find the VPN IP, the user is safe
  • the attacker won’t try to attack Tor1 as he is searching for Exit node going to X.X.X.X
  • the attacker can’t know its Tor->VPN->Tor as the VPN have it’s own encryption layer and IP, so attacking Tor1 and Tor2 is unlikely meaning he will attacks Tor2 first.
    • If the VPN is used by many user the attacker will need to access it to differentiate the user from others, than he can try to attack the whole Tor->VPN->Tor.
    • If the VPN is used only by the user, the attacker can directly try to attack Tor1 by searching for Exit Nodes connecting to this VPN
  • Even if the VPN (in “used by many user” case) have logs, the attacker, after obtaining the VPN logs will see that its a Tor exit node that connected to it. In case there is no logs, he still need to compromise it.
  • To fully deanonymise, the attacker will need to compromise the VPN, and perform the same attack against Tor1 and Tor2 at same time, needing more work.

Am i wrong about something is this scenario ?

The only argument against "Tor over Tor" i found on internet is:

• “you could end up with the same hops, maybe in reverse or mixed order. It is not clear if this is safe. It has never been discussed”

But in case of a VPN middle man, how could this have a bad impact on user anonymity ?

Also if someone know a config for improving the anonymity and reduce or making more difficult attacks for the case of connecting to clearnet ip, i would enjoy to know what is it.

Thanks !