Whitehats uncover exploitable vulnerability in Hyperliquid’s FRIEND-USD TVL-based oracle, sparking index changes and maintenance margin refunds for liquidations