diff --git a/webapp/controller/StakingController.class.php b/webapp/controller/StakingController.class.php
index 083216ab..79fcc692 100644
--- a/webapp/controller/StakingController.class.php
+++ b/webapp/controller/StakingController.class.php
@@ -128,6 +128,10 @@ class StakingController extends BaseAuthedController {
                 return;
             }
             for ($i = 0; $i < count($tokenIdList); ++$i) {
+                if (array_key_exists($tokenIdList[$i], $checkList)) {
+                    myself()->_rspErr(1, 'paramater error');
+                    return;
+                }
                 $checkList[$tokenIdList[$i]] = array(
                     'token_id' => $tokenIdList[$i],
                     'contract_address' => $contractAddressList[$i],
@@ -139,11 +143,13 @@ class StakingController extends BaseAuthedController {
         {
             $nftList = Nft::getNftList(myself()-_getAddress());
             foreach ($nftList as $nft) {
-                if (in_array(
-                    $nft['token_id'],
-                    $tokenIdList
-                )) {
-                    array_push($confirmedNfts, $nft);
+                if (array_key_exists($nft['token_id'], $checkList)) {
+                    $c = $checkList[$nft['token_id']];
+                    if ($c['contract_address'] == $nft['contract_address'] &&
+                        $c['net_id'] == $nft['nft_id']) {
+                        array_push($confirmedNfts,
+                                   $nft);
+                    }
                 }
             }
         }