Solidity - Can an attacker call private functions?

Question

Looking around I found Solidity functions - private visibility but not an answer to my specific question. Basically my question is: is the private keyword enforced at the Solidity language level or EVM level? My intuition says it is a Solidity feature but I wanted to double check here.

I am just getting started with Ethereum so pardon any beginner mistakes. Consider the following Solidity code:

contract Silly {
  function unsafePrivateWithdraw(address addr, uint amount) private {
    addr.transfer(amount);
  }
  function safeWithdraw(address addr, uint amount) {
    if (!checkWithdrawConditions) throw; // pseudocode
    unsafePrivateWithdraw(addr, amount);
  }
}

I know that using Solidity one wouldn't be able to call unsafePrivateWithdraw directly. But could somebody write in LLL or EVM opcodes a direct call to the address of the unsafePrivateWithdraw function?

Answer 1

No.

A private or internal function can only be called by the contract itself. Further, private functions cannot be called by derived contracts--so internal is more common. Here is Solidity's own documentation on the subject.

How does the EVM enforce this? Simple. On the EVM level, there are no function calls. Rather, Solidity generates a dispatcher for each contract, and sending a transaction just activates said dispatcher. On a theoretical level, making a function private is just a matter of not putting it in the dispatcher.