diff --git a/third_party/phpcommon b/third_party/phpcommon
index 55e2f9de..85b467ba 160000
--- a/third_party/phpcommon
+++ b/third_party/phpcommon
@@ -1 +1 @@
-Subproject commit 55e2f9deb1eb1eede1e8c390c7bd166528632e8a
+Subproject commit 85b467ba2eca1f843f0f988823741c0d00b2724d
diff --git a/webapp/controller/BaseAuthedController.class.php b/webapp/controller/BaseAuthedController.class.php
index b800d41d..b56bf7dc 100644
--- a/webapp/controller/BaseAuthedController.class.php
+++ b/webapp/controller/BaseAuthedController.class.php
@@ -158,6 +158,11 @@ class BaseAuthedController extends BaseController {
         return $this->accountId;
     }
 
+    public function _getGameId()
+    {
+        return phpcommon\extractGameId($this->_getAccountId());
+    }
+
     public function _getOpenId()
     {
         return phpcommon\extractOpenId($this->_getAccountId());
diff --git a/webapp/controller/ToolsController.class.php b/webapp/controller/ToolsController.class.php
index 959e8a75..b52334c8 100644
--- a/webapp/controller/ToolsController.class.php
+++ b/webapp/controller/ToolsController.class.php
@@ -124,6 +124,18 @@ class ToolsController extends BaseController {
         myself()->_rspOk();
     }
 
+    public function isSameSeriesAccount()
+    {
+        $accountId1 = getReqVal('account_id1', '');
+        $accountId2 = getReqVal('account_id2', '');
+        error_log(phpcommon\extractOpenId($accountId1));
+        error_log(phpcommon\extractRealOpenId(phpcommon\extractOpenId($accountId1)));
+        error_log($accountId1 . ' **** ' . $accountId2 . ' ' .
+                  phpcommon\isSameSeriesAccount($accountId1, $accountId2));
+        myself()->_rspData(array(
+
+        ));
+    }
 
     private function writeToFile($fileName, $data)
     {
diff --git a/webapp/controller/UserController.class.php b/webapp/controller/UserController.class.php
index 5d9acf49..f82be0a7 100644
--- a/webapp/controller/UserController.class.php
+++ b/webapp/controller/UserController.class.php
@@ -783,6 +783,20 @@ class UserController extends BaseAuthedController {
         $sign = base64_decode($arr[2]);
         $data = json_decode($payload, true);
 
+        $subIdxPre = '';
+        $subIdx = getXVal($data, 'version', '');
+        if (!empty($subIdx)) {
+            $subIdxPre = 's' . $subIdx . '_';
+        }
+        {
+            $jwtAccountId = BC_POLY_CHANNEL . '_' . myself()->_getGameId() . '_' .
+                          $subIdxPre . $data['plat'] . '_' . $data['openid'];
+            if ($jwtAccountId != myself()->_getAccountId()) {
+                myself()->_rspErr(1, 'token error3');
+                return;
+            }
+        }
+
         $url = 'https://pay.cebggame.com/wallet/info?';
         $params = array(
             'token' => $jwt
@@ -806,8 +820,27 @@ class UserController extends BaseAuthedController {
             die();
             return;
         }
+        $address = strtolower($rspObj['data']['address']);
+        $oldUser = User::findByAddress($address);
+        if ($oldUser) {
+            if ($oldUser['account_id'] != myself()->_getAccountId()) {
+                if (!phpcommon\isSameSeriesAccount(
+                    $oldUser['account_id'],
+                    myself()->_getAccountId()
+                )) {
+                    myself()->_rspErr(1, 'is not SameSeriesAccount');
+                    return;
+                }
+                User::updateOther(
+                    $oldUser['account_id'],
+                    array(
+                        'address' => null
+                    )
+                );
+            }
+        }
         User::Update(array(
-            'address' => $rspObj['data']['address']
+            'address' => $address
         ));
         $propertyChgService = new services\PropertyChgService();
         $propertyChgService->addUserChg();
diff --git a/webapp/models/User.php b/webapp/models/User.php
index 98b076c8..47c949eb 100644
--- a/webapp/models/User.php
+++ b/webapp/models/User.php
@@ -33,6 +33,18 @@ class User extends BaseModel {
         return $row ? $row : null;
     }
 
+    public static function findByAddress($address)
+    {
+        $row = SqlHelper::ormSelectOne
+             (myself()->_getMysql(''),
+                 't_user',
+                 array(
+                     'address' => $address
+                 )
+                );
+        return $row ? $row : null;
+    }
+
     public static function findUserAddress($accountId)
     {
         $row = SqlHelper::ormSelectOne
@@ -360,6 +372,17 @@ class User extends BaseModel {
         );
     }
 
+    public static function updateOther($accountId, $fieldsKv){
+        SqlHelper::update
+        (myself()->_getMysql($accountId),
+            't_user',
+            array(
+                'account_id' => $accountId,
+            ),
+            $fieldsKv
+        );
+    }
+
     public static function updateLikeCount($targetId){
         SqlHelper::update
         (myself()->_getSelfMysql(),