LOW severity: Proposal creation bypasses minimum voting weight requirement when no tokens are locked hence no voting power exists. **Description:** `AdminVoting::minCreateProposalPct` specifies the minimum voting weight required to create proposals, however this is bypassed allowing anyone to create proposals when no tokens are locked and hence no voting power exists.

**Proof of Concept:** Firstly change...

Vulnerable code:
function setUp() public virtual {
    // prevent Foundry from setting block.timestamp = 1 which can cause
    // errors in this protocol
    vm.warp(1659973223);

// SPDX-License-Identifier: MIT
pragma solidity 0.8.19;

import {AdminVoting} from "../../../contracts/dao/AdminVoting.sol";

// test setup
import {TestSetup} from "../TestSetup.sol";

contract AdminVotingTest is TestSetup {
    AdminVoting adminVoting;

    uint256 constant internal INIT_MIN_CREATE_PROP_PCT = 10;   // 0.01%
    uint256 constant internal INIT_PROP_PASSING_PCT    = 2000; // 20%

    function setUp() public virtual override {
        super.setUp();

        adminVoting = new AdminVoting(address(babelCore),
                                      tokenLocker,
                                      INIT_MIN_CREATE_PROP_PCT,
                                      INIT_PROP_PASSING_PCT);
    }

    function test_constructor() external view {
        // parameters correctly set
        assertEq(adminVoting.minCreateProposalPct(), INIT_MIN_CREATE_PROP_PCT);
        assertEq(adminVoting.passingPct(), INIT_PROP_PASSING_PCT);
        assertEq(address(adminVoting.tokenLocker()), address(tokenLocker));

        // week initialized to zero
        assertEq(adminVoting.getWeek(), 0);
        assertEq(adminVoting.minCreateProposalWeight(), 0);

        // no proposals
        assertEq(adminVoting.getProposalCount(), 0);
    }

    function test_createNewProposal_inInitialState() external {
        // create dummy proposal
        AdminVoting.Action[] memory payload = new AdminVoting.Action[](1);
        payload[0].target = address(0x0);
        payload[0].data   = abi.encode("");

        uint256 lastProposalTimestamp = adminVoting.latestProposalTimestamp(users.user1);
        assertEq(lastProposalTimestamp, 0);

        // verify expected failure condition
        vm.startPrank(users.user1);
        vm.expectRevert("No proposals in first week");
        adminVoting.createNewProposal(users.user1, payload);

        // advance time by 1 week
        vm.warp(block.timestamp + 1 weeks);
        uint256 weekNum = 1;
        assertEq(adminVoting.getWeek(), weekNum);

        // verify there are no tokens locked
        assertEq(tokenLocker.getTotalWeightAt(weekNum), 0);

        // even though there are no tokens locked so users have no voting weight,
        // a user with no voting weight can still create a proposal!
        adminVoting.createNewProposal(users.user1, payload);
        vm.stopPrank();

        // verify proposal has been created
        assertEq(adminVoting.getProposalCount(), 1);

        // attempting to execute the proposal fails with correct error
        uint256 proposalId = 0;
        vm.expectRevert("Not passed");
        adminVoting.executeProposal(proposalId);

        // attempting to vote on the proposal fails with correct error
        vm.expectRevert("No vote weight");
        vm.prank(users.user1);
        adminVoting.voteForProposal(users.user1, proposalId, 0);

        // so this can't be exploited further
    }
}

function minCreateProposalWeight() public view returns (uint256) {
        uint256 week = getWeek();
        if (week == 0) return 0;
        week -= 1;

        uint256 totalWeight = tokenLocker.getTotalWeightAt(week);
+       require(totalWeight > 0, "Zero total voting weight for given week");

        return (totalWeight * minCreateProposalPct) / MAX_PCT;
    }