fix: prevent declarations of blackbox functions outside of the stdlib

compiler/noirc_frontend/src/hir/def_collector/dc_mod.rs

@@ -209,6 +209,7 @@
         let mut errors = vec![];
 
         let module = ModuleId { krate, local_id: self.module_id };
+        let in_stdlib = *context.stdlib_crate_id() == krate;
 
         for function in functions {
             // check if optional field attribute is compatible with native field
@@ -218,6 +219,15 @@
                 }
             }
 
+            let is_low_level_function =
+                function.attributes().function.as_ref().map_or(false, |func| func.is_low_level());
+            if !in_stdlib && is_low_level_function {
+                let error = DefCollectorErrorKind::LowLevelFunctionOutsideOfStdlib {
+                    span: function.span(),
+                };
+                errors.push((error.into(), self.file_id));
+            }
+
             let name = function.name_ident().clone();
             let func_id = context.def_interner.push_empty_fn();
 
@@ -455,7 +465,7 @@
                         }
                     }
                     TraitItem::Type { name } => {
                         // TODO(nickysn or alexvitkov): implement context.def_interner.push_empty_type_alias and get an id, instead of using TypeAliasId::dummy_id()
                         if let Err((first_def, second_def)) = self.def_collector.def_map.modules
                             [trait_id.0.local_id.0]
                             .declare_type_alias(name.clone(), TypeAliasId::dummy_id())

compiler/noirc_frontend/src/hir/def_collector/errors.rs

@@ -73,6 +73,8 @@ pub enum DefCollectorErrorKind {
         "Either the type or the trait must be from the same crate as the trait implementation"
     )]
     TraitImplOrphaned { span: Span },
+    #[error("Usage of the `#[foreign]` or `#[builtin] function attributes are not allowed outside of the Noir standard library")]
+    LowLevelFunctionOutsideOfStdlib { span: Span },
     #[error("macro error : {0:?}")]
     MacroError(MacroError),
 }
@@ -246,6 +248,11 @@ impl From<DefCollectorErrorKind> for Diagnostic {
                 "Either the type or the trait must be from the same crate as the trait implementation".into(),
                 span,
             ),
+            DefCollectorErrorKind::LowLevelFunctionOutsideOfStdlib { span } => Diagnostic::simple_error(
+                "Definition of low-level function outside of standard library".into(),
+                "Usage of the `#[foreign]` or `#[builtin] function attributes are not allowed outside of the Noir standard library".into(),
+                span,
+            ),
             DefCollectorErrorKind::MacroError(macro_error) => {
                 Diagnostic::simple_error(macro_error.primary_message, macro_error.secondary_message.unwrap_or_default(), macro_error.span.unwrap_or_default())
             },

test_programs/compile_failure/builtin_function_declaration/Nargo.toml

@@ -0,0 +1,7 @@
+[package]
+name = "builtin_function_declaration"
+type = "bin"
+authors = [""]
+compiler_version = ">=0.23.0"
+
+[dependencies]

test_programs/compile_failure/builtin_function_declaration/src/main.nr

@@ -0,0 +1,10 @@
+// This test prevents users from trying to create their own builtin functions as these should only exist in the stdlib.
+
+// This would otherwise be a perfectly valid declaration of the `to_le_bits` builtin function
+#[builtin(to_le_bits)]
+fn to_le_bits(_x: Field, _bit_size: u32) -> [u1] {}
+
+fn main(x: Field) -> pub u1 {
+    let bits = to_le_bits(x, 100);
+    bits[0]
+}

test_programs/compile_failure/foreign_function_declaration/Nargo.toml

@@ -0,0 +1,7 @@
+[package]
+name = "foreign_function_declaration"
+type = "bin"
+authors = [""]
+compiler_version = ">=0.23.0"
+
+[dependencies]

test_programs/compile_failure/foreign_function_declaration/src/main.nr

@@ -0,0 +1,10 @@
+// This test prevents users from trying to create their own blackbox functions as these should only exist in the stdlib.
+
+// This would otherwise be a perfectly valid definition of the `pedersen_hash` black box function,
+// however executing the circuit results in an unhelpful ICE.
+#[foreign(pedersen_hash)]
+fn my_pedersen_hash<N>(_input: [Field; N]) -> Field {}
+
+fn main() -> pub Field {
+    my_pedersen_hash([1])
+}