diff --git a/server/web3sign/controllers/nftunlock.js b/server/web3sign/controllers/nftunlock.js
index bd0a2bf..02fd7b3 100644
--- a/server/web3sign/controllers/nftunlock.js
+++ b/server/web3sign/controllers/nftunlock.js
@@ -11,6 +11,7 @@ async function nftUnlock(session) {
     const netId = session.request('net_id');
     const tokenId = session.request('token_id');
     const nftAddress = session.request('nft_address');
+    const toAddress = session.request('to_address');
     const bc = serviceFactory.create('BlockChain');
     {
       const ret = await bc.init(netId);
@@ -25,6 +26,12 @@ async function nftUnlock(session) {
         return;
       }
     }
+    {
+      if (!bc.isValidAddress(toAddress)) {
+        session.rspErr(500, 'toAddress error');
+        return;
+      }
+    }
 
     const userAddress = bc.getUserAddress();
     const thisContractAddress = bc.getContractAddressByName('NFTLock');
@@ -65,14 +72,14 @@ async function nftUnlock(session) {
     const nftList = [
       [
         tokenId,
-        accountAddress,
+        toAddress,
         false
       ]
     ];
     const nftListArr = [];
     nftList.forEach((item) => {
       nftListArr.push(item[0].toString());
-      nftListArr.push(accountAddress);
+      nftListArr.push(toAddress);
       nftListArr.push('0x00');
     });
     const signature = await bc.soliditySha3Sign(