fix[lang]: disallow blockhash in pure functions

tests/parser/features/decorators/test_pure.py

@@ -129,3 +129,17 @@ def foo() -> uint256:
         ),
         FunctionDeclarationException,
     )
+
+
+def test_invalid_builtin(get_contract, assert_compile_failed):
+    assert_compile_failed(
+        lambda: get_contract(
+            """
+@external
+@pure
+def foo(x: uint256)-> bytes32:
+    return blockhash(x)
+    """
+        ),
+        StateAccessViolation,
+    )

vyper/semantics/validation/local.py

@@ -202,6 +202,10 @@ def __init__(
             ]
             node_list.extend(standalone_self)  # type: ignore
 
+            # Add references to builtin functions reading from the chain's state
+            builtin_fns = fn_node.get_descendants(vy_ast.Name, {"id": "blockhash"})
+            node_list.extend(builtin_fns)  # type: ignore
+
             for node in node_list:
                 t = node._metadata.get("type")
                 if isinstance(t, ContractFunction) and t.mutability == StateMutability.PURE: