diff --git a/doc/AAMarket.py b/doc/AAMarket.py
index 78bdb062..1c140b57 100644
--- a/doc/AAMarket.py
+++ b/doc/AAMarket.py
@@ -106,7 +106,7 @@ class AAMarket(object):
                 'response': [
                     _common.RspHead(),
                     ['page', _common.StreamPage(), '分页信息'],
-                    ['!rows', [_common.NftInfo()], '数据'],
+                    ['!rows', [_common.SaleGoods()], '数据'],
                 ]
             },
             {
diff --git a/doc/_common.py b/doc/_common.py
index 61f9618d..69377d02 100644
--- a/doc/_common.py
+++ b/doc/_common.py
@@ -1769,11 +1769,19 @@ class MarketGoods(object):
 
     def __init__(self):
         self.fields = [
-            ['event', '', 'json格式订单webhooks事件信息https://docs.immutable.com/docs/zkEVM/products/blockchain-data/webhooks/webhooks-orders'],
+            ['event', '', 'json格式订单webhooks事件信息imtbl_zkevm_order_updated https://docs.immutable.com/docs/zkEVM/products/blockchain-data/webhooks/webhooks-orders'],
             ['nft', NftInfo(), 'nft信息'],
             ['in_shopcart', 0, '商品是否已在购物车里'],
         ]
 
+class SaleGoods(object):
+
+    def __init__(self):
+        self.fields = [
+            ['event', '', 'json格式订单webhooks事件信息imtbl_zkevm_activity_sale https://docs.immutable.com/docs/zkEVM/products/blockchain-data/webhooks/webhooks-orders'],
+            ['nft', NftInfo(), 'nft信息']
+        ]
+
 class AssetNftInfo(object):
 
     def __init__(self):
diff --git a/sql/gamedb.sql b/sql/gamedb.sql
index 8be0b721..0fa47b20 100644
--- a/sql/gamedb.sql
+++ b/sql/gamedb.sql
@@ -1446,6 +1446,7 @@ CREATE TABLE `t_ingame_mall` (
   `buyer` varchar(60) NOT NULL DEFAULT '' COMMENT '购买成功者',
   `buy_ok_time` int(11) NOT NULL DEFAULT '0' COMMENT '购买成功时间',
   `last_modify_price_time` int(11) NOT NULL DEFAULT '0' COMMENT '最后一次修改价格事件',
+  `order1` int(11) NOT NULL DEFAULT '0' COMMENT '品质排序 ',
   `createtime` int(11) NOT NULL DEFAULT '0' COMMENT '创建时间',
   `modifytime` int(11) NOT NULL DEFAULT '0' COMMENT '修改时间',
   PRIMARY KEY (`idx`),
diff --git a/webapp/controller/BaseAuthedController.class.php b/webapp/controller/BaseAuthedController.class.php
index 62f1bf0e..526a27d0 100644
--- a/webapp/controller/BaseAuthedController.class.php
+++ b/webapp/controller/BaseAuthedController.class.php
@@ -96,6 +96,11 @@ class BaseAuthedController extends BaseController {
             die();
         }
         }
+        if (!(myself()->_getChannel() == IMTBL_CHANNEL ||
+              myself()->_getChannel() == GUEST_CHANNEL)) {
+            phpcommon\sendError(1001, 'session expiration');
+            die();
+        }
         $r = $this->_getRedis($this->_getAccountId());
         if (!(getReqVal('c', '') == 'User' && getReqVal('a', '') == 'login')) {
             if ((getReqVal('c', '') == 'Battle')) {
diff --git a/webapp/controller/BlockChainController.class.php b/webapp/controller/BlockChainController.class.php
index d87e09cd..bb35c105 100644
--- a/webapp/controller/BlockChainController.class.php
+++ b/webapp/controller/BlockChainController.class.php
@@ -239,6 +239,7 @@ class BlockChainController extends BaseAuthedController {
                 $this->_rspErr(500, 'server internal error');
                 return false;
             }
+            myself()->_decItems($costItems);
             SqlHelper::insert
                 (myself()->_getSelfMysql(),
                  't_gold_bullion',