diff --git a/webapp/controller/GunController.class.php b/webapp/controller/GunController.class.php
index 8b7c8cf7..abb40c03 100644
--- a/webapp/controller/GunController.class.php
+++ b/webapp/controller/GunController.class.php
@@ -125,6 +125,11 @@ class GunController extends BaseAuthedController {
             $this->_rspErr(2, '锁定期间不能操作');
             return;
         }
+        $itemMeta = mt\Item::get($gunDb['gun_id']);
+        if (!$itemMeta) {
+            $this->_rspErr(100, '服务器内部错误');
+            return;
+        }
         $currLevelMeta = mt\GunLevel::getByQualityLevel($gunDb['quality'], $gunDb['gun_lv']);
         if (!$currLevelMeta) {
             $this->_rspErr(100, '服务器内部错误');
@@ -169,8 +174,9 @@ class GunController extends BaseAuthedController {
             $this->_rspErr(3, $this->_getLackItemErrMsg($lackItem));
             return;
         }
+        $baseAttrs = mt\Item::getBaseAttrs($itemMeta);
         $attrs = emptyReplace(json_decode($gunDb['rand_attr'], true), array());
-        $ret = mt\GunLevel::addRandAttr($nextLevelMeta, $attrs);
+        $ret = mt\GunLevel::addRandAttr($nextLevelMeta, $baseAttrs, $attrs);
         if (!$ret) {
             $this->_rspErr(2, '服务器内部错误');
             return;
@@ -213,6 +219,11 @@ class GunController extends BaseAuthedController {
             $this->_rspErr(2, '锁定期间不能操作');
             return;
         }
+        $itemMeta = mt\Item::get($gunDb['gun_id']);
+        if (!$itemMeta) {
+            $this->_rspErr(100, '服务器内部错误');
+            return;
+        }
         $currQualityMeta = mt\GunQuality::getByQuality($gunDb['quality']);
         if (!$currQualityMeta) {
             $this->_rspErr(100, '服务器内部错误');
@@ -262,13 +273,14 @@ class GunController extends BaseAuthedController {
             $this->_rspErr(3, $this->_getLackItemErrMsg($lackItem));
             return;
         }
+        $baseAttrs = mt\Item::getBaseAttrs($itemMeta);
         $attrs = emptyReplace(json_decode($gunDb['rand_attr'], true), array());
         {
             $obtainAttrs = mt\GunQuality::getRandAttr($nextQualityMeta);
             mt\AttrHelper::mergeAttr($attrs, $obtainAttrs);
         }
         {
-            $ret = mt\GunLevel::addRandAttr($nextLevelMeta, $attrs);
+            $ret = mt\GunLevel::addRandAttr($nextLevelMeta, $baseAttrs, $attrs);
             if (!$ret) {
                 $this->_rspErr(2, '服务器内部错误');
                 return;
diff --git a/webapp/mt/GunLevel.php b/webapp/mt/GunLevel.php
index e006099b..b119f508 100644
--- a/webapp/mt/GunLevel.php
+++ b/webapp/mt/GunLevel.php
@@ -2,6 +2,7 @@
 
 namespace mt;
 
+require_once('mt/StrHelper.php');
 require_once('mt/AttrHelper.php');
 
 use phpcommon;
@@ -19,21 +20,12 @@ class GunLevel {
         return getXVal(self::$qualityLevelHash, $quality . '_' . $level, null);
     }
 
-    public static function addRandAttr($levelMeta, &$attrs)
+    public static function addRandAttr($levelMeta, $baseAttrs, &$attrs)
     {
-        $attrArr = StrHelper::parseList($levelMeta['rand_attrs'], array('|', ':'));
-        foreach ($attrArr as $tuple) {
-            $attrId = $tuple[0];
-            $type = $tuple[1];
-            $val = rand($tuple[2], $tuple[3]);
-            foreach ($attrs as &$attr) {
-                if ($attr['attr_id'] == $attrId &&
-                    $attr['type'] == $type) {
-                    $attr['val'] += $val;
-                    break;
-                }
-            }
-        }
+        $nums = explode(':', $levelMeta['rand_attrs_num']);
+        $num = rand($nums[0], $nums[1]);
+        $cfgAttrs = StrHelper::parseList($levelMeta['rand_attrs'], array('|', ':'));
+        AttrHelper::addRandAttrs($cfgAttrs, $num, $baseAttrs, $dbAttrs);
         return true;
     }