In recent years, palmprints have been extensively utilized for individual verification. The abundance of sensitive information in palmprint data necessitates robust protection to ensure security and privacy without compromising system performance. Existing systems frequently use cancelable transformations to protect palmprint templates. However, if an adversary gains access to the stored database, they could initiate a replay attack before the system detects the breach and can revoke and replace the reference template. To address replay attacks while meeting template protection criteria, we propose a dual-level cancelable palmprint verification framework. In this framework, the reference template is initially transformed using a cancelable competition hashing network with a first-level token, enabling the end-to-end generation of cancelable templates. During enrollment, the system creates a negative database (NDB) using a second-level token for further protection. Due to the unique NDB-to-vector matching characteristic, a replay attack involving the matching between the reference template and a compromised instance in NDB form is infeasible. This approach effectively addresses the replay attack problem at its root. Furthermore, the dual-level protected reference template enjoys heightened security, as reversing the NDB is NP-hard. We also propose a novel NDB-to-vector matching algorithm based on matrix operations to expedite the matching process, addressing the inefficiencies of previous NDB methods reliant on dictionary-based matching rules. Extensive experiments conducted on public palmprint datasets confirm the effectiveness and generality of the proposed framework. Upon acceptance of the paper, the code will be accessible at https://github.com/Zi-YuanYang/DCPV.