diff --git a/source/dnode/mnode/impl/src/mndUser.c b/source/dnode/mnode/impl/src/mndUser.c
index 66abfd6bc1..0e3b544508 100644
--- a/source/dnode/mnode/impl/src/mndUser.c
+++ b/source/dnode/mnode/impl/src/mndUser.c
@@ -708,9 +708,8 @@ SSdbRaw *mndUserActionEncode(SUserObj *pUser) {
   int32_t numOfAlterViews = taosHashGetSize(pUser->alterViews);
   int32_t numOfTopics = taosHashGetSize(pUser->topics);
   int32_t numOfUseDbs = taosHashGetSize(pUser->useDbs);
-  int32_t size = sizeof(SUserObj) + USER_RESERVE_SIZE +
-                 (numOfReadDbs + numOfWriteDbs + numOfUseDbs) * TSDB_DB_FNAME_LEN + numOfTopics * TSDB_TOPIC_FNAME_LEN +
-                 ipWhiteReserve;
+  int32_t size = sizeof(SUserObj) + USER_RESERVE_SIZE + (numOfReadDbs + numOfWriteDbs) * TSDB_DB_FNAME_LEN +
+                 numOfTopics * TSDB_TOPIC_FNAME_LEN + ipWhiteReserve;
 
   char *stb = taosHashIterate(pUser->readTbs, NULL);
   while (stb != NULL) {
@@ -720,7 +719,7 @@ SSdbRaw *mndUserActionEncode(SUserObj *pUser) {
     size += keyLen;
 
     size_t valueLen = 0;
-    valueLen = strlen(stb);
+    valueLen = strlen(stb) + 1;
     size += sizeof(int32_t);
     size += valueLen;
     stb = taosHashIterate(pUser->readTbs, stb);
@@ -734,7 +733,7 @@ SSdbRaw *mndUserActionEncode(SUserObj *pUser) {
     size += keyLen;
 
     size_t valueLen = 0;
-    valueLen = strlen(stb);
+    valueLen = strlen(stb) + 1;
     size += sizeof(int32_t);
     size += valueLen;
     stb = taosHashIterate(pUser->writeTbs, stb);
@@ -748,7 +747,7 @@ SSdbRaw *mndUserActionEncode(SUserObj *pUser) {
     size += keyLen;
 
     size_t valueLen = 0;
-    valueLen = strlen(stb);
+    valueLen = strlen(stb) + 1;
     size += sizeof(int32_t);
     size += valueLen;
     stb = taosHashIterate(pUser->alterTbs, stb);
@@ -762,7 +761,7 @@ SSdbRaw *mndUserActionEncode(SUserObj *pUser) {
     size += keyLen;
 
     size_t valueLen = 0;
-    valueLen = strlen(stb);
+    valueLen = strlen(stb) + 1;
     size += sizeof(int32_t);
     size += valueLen;
     stb = taosHashIterate(pUser->readViews, stb);
@@ -776,7 +775,7 @@ SSdbRaw *mndUserActionEncode(SUserObj *pUser) {
     size += keyLen;
 
     size_t valueLen = 0;
-    valueLen = strlen(stb);
+    valueLen = strlen(stb) + 1;
     size += sizeof(int32_t);
     size += valueLen;
     stb = taosHashIterate(pUser->writeViews, stb);
@@ -790,11 +789,21 @@ SSdbRaw *mndUserActionEncode(SUserObj *pUser) {
     size += keyLen;
 
     size_t valueLen = 0;
-    valueLen = strlen(stb);
+    valueLen = strlen(stb) + 1;
     size += sizeof(int32_t);
     size += valueLen;
     stb = taosHashIterate(pUser->alterViews, stb);
-  }  
+  }
+
+  int32_t *useDb = taosHashIterate(pUser->useDbs, NULL);
+  while (useDb != NULL) {
+    size_t keyLen = 0;
+    void  *key = taosHashGetKey(useDb, &keyLen);
+    size += sizeof(int32_t);
+    size += keyLen;
+    size += sizeof(int32_t);
+    useDb = taosHashIterate(pUser->useDbs, useDb);
+  }
 
   SSdbRaw *pRaw = sdbAllocRaw(SDB_USER, USER_VER_NUMBER, size);
   if (pRaw == NULL) goto _OVER;
@@ -925,7 +934,7 @@ SSdbRaw *mndUserActionEncode(SUserObj *pUser) {
     stb = taosHashIterate(pUser->alterViews, stb);
   }
 
-  int32_t *useDb = taosHashIterate(pUser->useDbs, NULL);
+  useDb = taosHashIterate(pUser->useDbs, NULL);
   while (useDb != NULL) {
     size_t keyLen = 0;
     void  *key = taosHashGetKey(useDb, &keyLen);
diff --git a/tests/system-test/0-others/user_privilege.py b/tests/system-test/0-others/user_privilege.py
index d1b93f6942..a731e85ddb 100644
--- a/tests/system-test/0-others/user_privilege.py
+++ b/tests/system-test/0-others/user_privilege.py
@@ -27,6 +27,7 @@ class TDTestCase:
         tdSql.init(conn.cursor())
         self.setsql = TDSetSql()
         self.stbname = 'stb'
+        self.user_name = 'test'
         self.binary_length = 20  # the length of binary for column_dict
         self.nchar_length = 20  # the length of nchar for column_dict
         self.dbnames = ['db1', 'db2']
@@ -54,12 +55,12 @@ class TDTestCase:
         ]
         
         self.tbnum = 4
+        self.stbnum_grant = 200
 
     def create_user(self):
-        user_name = 'test'        
-        tdSql.execute(f'create user {user_name} pass "test"')
-        tdSql.execute(f'grant read on {self.dbnames[0]}.{self.stbname} with t2 = "Beijing" to {user_name}')
-        tdSql.execute(f'grant write on {self.dbnames[1]}.{self.stbname} with t1 = 2 to {user_name}')
+        tdSql.execute(f'create user {self.user_name} pass "test"')
+        tdSql.execute(f'grant read on {self.dbnames[0]}.{self.stbname} with t2 = "Beijing" to {self.user_name}')
+        tdSql.execute(f'grant write on {self.dbnames[1]}.{self.stbname} with t1 = 2 to {self.user_name}')
                 
     def prepare_data(self):
         for db in self.dbnames:
@@ -70,6 +71,8 @@ class TDTestCase:
                 tdSql.execute(f'create table {self.stbname}_{i} using {self.stbname} tags({self.tag_list[i]})')
                 for j in self.values_list:
                     tdSql.execute(f'insert into {self.stbname}_{i} values({j})')
+            for i in range(self.stbnum_grant):
+                tdSql.execute(f'create table {self.stbname}_grant_{i} (ts timestamp, c0 int) tags(t0 int)')
     
     def user_read_privilege_check(self, dbname):
         testconn = taos.connect(user='test', password='test')        
@@ -128,12 +131,20 @@ class TDTestCase:
                 tdLog.exit(f"{caller.filename}({caller.lineno}) failed: sql:{sql}, expect error not occured")
         pass
 
+    def user_privilege_grant_check(self):
+        for db in self.dbnames:
+            tdSql.execute(f"use {db}")
+            for i in range(self.stbnum_grant):
+                tdSql.execute(f'grant read on {db}.{self.stbname}_grant_{i} to {self.user_name}')
+                tdSql.execute(f'grant write on {db}.{self.stbname}_grant_{i} to {self.user_name}')
+
     def run(self):           
         self.prepare_data()
         self.create_user()
         self.user_read_privilege_check(self.dbnames[0])
         self.user_write_privilege_check(self.dbnames[1])
         self.user_privilege_error_check()
+        self.user_privilege_grant_check()
                 
     def stop(self):
         tdSql.close()