diff --git a/webapp/controller/HeroController.class.php b/webapp/controller/HeroController.class.php
index aa98095e..c11cae53 100644
--- a/webapp/controller/HeroController.class.php
+++ b/webapp/controller/HeroController.class.php
@@ -388,6 +388,11 @@ class HeroController extends BaseAuthedController {
             $this->_rspErr(1, 'slot_id parameter error');
             return;
         }
+        $costHeroDb = Hero::find($costheroUniId);
+        if (!$costHeroDb) {
+            $this->_rspErr(1, 'cost hero parameter error');
+            return;
+        }
         {
             $srcHeroDb = Hero::find($this->_getV(TN_HERO_QUALITY_UP, $slotId));
             if ($srcHeroDb) {