Simply include the ATC in the CDOL-1 and the replay attack goes away. This has existed as a solution since since EMV day one and the ATC is provided for this very reason.