diff --git a/bin/marketserver/config/contract.json b/bin/marketserver/config/contract.json
index 5fcbed7c..5a45a91a 100644
--- a/bin/marketserver/config/contract.json
+++ b/bin/marketserver/config/contract.json
@@ -40,5 +40,11 @@
     "type": "logic",
     "json": "assets/contracts/NFTLock.json",
     "address": "0xC8607507451059CfAe6Ca4D07EC6f631ce8ef9f9"
+  },
+  {
+    "name": "CFHero_normal",
+    "type": "erc721",
+    "json": "assets/contracts/CFNFTGame.json",
+    "address": "0x994dE61dD536B22F7e3BDB77aa3ef55AeC938bFD"
   }
 ]
diff --git a/server/marketserver/api/v1/nft/nft.go b/server/marketserver/api/v1/nft/nft.go
index d69f5c8a..ad10aaf0 100644
--- a/server/marketserver/api/v1/nft/nft.go
+++ b/server/marketserver/api/v1/nft/nft.go
@@ -6,6 +6,7 @@ import (
 	"mt"
 	"jccommon"
 	"main/constant"
+	"strings"
 	"github.com/gin-gonic/gin"
 )
 
@@ -26,9 +27,10 @@ func (this *NftApi) Unlock(c *gin.Context) {
 		f5.RspErr(c, 401, "params parse error")
 		return
 	}
+	lockMeta := mt.Table.Contract.GetByName(jccommon.CONTRACT_NAME_NFTLock)
 	heroMeta := mt.Table.Contract.GetByName(jccommon.CONTRACT_NAME_CFHero)
 	gcardMeta := mt.Table.Contract.GetByName(jccommon.CONTRACT_NAME_GCardHero)
-	if heroMeta == nil && gcardMeta == nil {
+	if (heroMeta == nil && gcardMeta == nil) || lockMeta == nil {
 		f5.RspErr(c, 1, "contract_address params error")
 		return
 	}
@@ -40,6 +42,7 @@ func (this *NftApi) Unlock(c *gin.Context) {
 		f5.RspErr(c, 1, "tokens params error")
 		return
 	}
+	accountAddress := c.MustGet("account_address").(string)
 	f5.GetGoStyleDb().OrmSelectOne(
 		constant.BCNFT_DB,
 		"t_nft",
@@ -47,8 +50,21 @@ func (this *NftApi) Unlock(c *gin.Context) {
 			{"net_id", q5.SafeToString(reqJson.NetId)},
 			{"contract_address", reqJson.ContractAddress},
 			{"token_id", reqJson.Tokens[0].TokenId},
+			{"owner_address", strings.ToLower(lockMeta.GetAddress())},
 		},
 		func (err error, ds *f5.DataSet) {
-
+			if err != nil {
+				f5.RspErr(c, 500, "server internal error")
+				return
+			}
+			if ds.Next() {
+				if accountAddress != ds.GetByName("last_lock_address") {
+					f5.RspErr(c, 500, "nft not found")
+					return
+				}
+			} else {
+				f5.RspErr(c, 500, "nft not found")
+				return
+			}
 		})
 }
diff --git a/third_party/contracts-imtbl b/third_party/contracts-imtbl
index 6621b926..92cd4db0 160000
--- a/third_party/contracts-imtbl
+++ b/third_party/contracts-imtbl
@@ -1 +1 @@
-Subproject commit 6621b926b460d820e6c01d69c13053259a80e5f3
+Subproject commit 92cd4db0d87f5f2d10b20174c0f40301646e9059