  We introduce BLADE, a new approach to automatically and efficiently eliminate
speculative leaks from cryptographic code. BLADE is built on the insight that
to stop leaks via speculation, it suffices to $\textit{cut}$ the dataflow from
expressions that speculatively introduce secrets ($\textit{sources}$) to those
that leak them through the cache ($\textit{sinks}$), rather than prohibit
speculation altogether. We formalize this insight in a $\textit{static type
system}$ that (1) types each expression as either $\textit{transient}$, i.e.,
possibly containing speculative secrets or as being $\textit{stable}$, and (2)
prohibits speculative leaks by requiring that all $\textit{sink}$ expressions
are stable. BLADE relies on a new new abstract primitive, $\textbf{protect}$,
to halt speculation at fine granularity. We formalize and implement
$\textbf{protect}$ using existing architectural mechanisms, and show how
BLADE's type system can automatically synthesize a $\textit{minimal}$ number of
$\textbf{protect}$s to provably eliminate speculative leaks. We implement BLADE
in the Cranelift WebAssembly compiler and evaluate our approach by repairing
several verified, yet vulnerable WebAssembly implementations of cryptographic
primitives. We find that Blade can fix existing programs that leak via
speculation $\textit{automatically}$, without user intervention, and
$\textit{efficiently}$ even when using fences to implement $\textbf{protect}$.
