Use `.call()` with value instead of `.transfer()`

[sembrestels]

From Sohkai's review: Avoid using address.transfer() (in _transfer() and _contribute()): these gas-limited methods are now generally seen as an anti-pattern and re-entrancy guards should instead be used when there are concerns with re-entrancy.