Security in an error-prone world

It has no clock so cannot do that. What the Yubico OTP protocol does have is a counter which increments whenever a password is requested, and another counter which increments whenever power to the key is cut (how this interacts with NFC I'm not sure because I don't have any devices that can do NFC to test it with). An authentication server verifies that any password it receives has a higher session counter than the last password it saw from that key, or, if the same, a higher password-requested counter. So replay attacks are impossible, and if you want to reuse a password you acquired you'd better do it before the legitimate user logs in again even once: as soon as he does that the password you snarfed is useless.

(This is not ideal -- backward-compatibility concerns limit the session counter to 7 bits, and obviously the protocol requires it to saturate rather than wrapping, so overflows are well within the bounds of possibility. But it's not *bad*, and you can reset the session counter by resetting the underlying AES key and sending the new one to your authentication servers.)