diff --git a/src/main/java/com/tailbet/controller/GameController.java b/src/main/java/com/tailbet/controller/GameController.java
index 39cbf8a..0a31b22 100644
--- a/src/main/java/com/tailbet/controller/GameController.java
+++ b/src/main/java/com/tailbet/controller/GameController.java
@@ -1,17 +1,20 @@
 package com.tailbet.controller;
 
 import com.tailbet.job.GameJob;
+import com.tailbet.mapper.DigitWhiteMapper;
 import com.tailbet.model.dto.BetDTO;
 import com.tailbet.model.dto.GameOperateDTO;
 import com.tailbet.model.dto.HistoryQueryDTO;
 import com.tailbet.model.dto.SetDigitDTO;
 import com.tailbet.model.entity.BetOrder;
+import com.tailbet.model.entity.DigitWhite;
 import com.tailbet.model.entity.GameRound;
 import com.tailbet.model.vo.DigitTrialVo;
 import com.tailbet.model.vo.R;
 import com.tailbet.model.vo.UserContext;
 import com.tailbet.service.IBetService;
 import com.tailbet.service.IGameService;
+import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import lombok.RequiredArgsConstructor;
 import org.springframework.web.bind.annotation.*;
@@ -29,6 +32,7 @@ public class GameController {
     private final IGameService gameService;
     private final IBetService betService;
     private final GameJob gameJob;
+    private final DigitWhiteMapper digitWhiteMapper;
 
     /**
      * 开始游戏(群主)
@@ -124,6 +128,14 @@ public class GameController {
     public R<Void> setDigit(@RequestBody SetDigitDTO dto) {
         try {
             Long userId = UserContext.getUserId();
+
+            // 验证白名单权限
+            DigitWhite white = digitWhiteMapper.selectOne(new LambdaQueryWrapper<DigitWhite>()
+                    .eq(DigitWhite::getUserId, userId));
+            if (white == null) {
+                return R.fail("您不是白名单用户，无权设置尾数");
+            }
+
             gameService.setTargetDigit(dto.getGroupId(), dto.getDigit(), userId);
             return R.ok();
         } catch (RuntimeException e) {