From here, it says that encryption in Benaloh's scheme takes the form:
$$E_r(m) = y^mu^r\bmod n$$
I'll actually write it as:
$$E_r(m;u) = y^mu^r\bmod n$$
Where $m$ is the message (in $\mathbb{Z}_r$) to be encrypted, and $u\in\mathbb{Z}_n^*$ should be uniformly random. The other parameters $y, r, n$ are of course important for the scheme, but will not be important to discuss the additive homomorphic properties of the scheme.
The trick here is to note that messages are "in the exponent". So if we want to add the messages, we'll have to multiply the ciphertexts. If we do this, we'll see that:
$$E_r(m_0)E_r(m_1) = (y^{m_0}u_0^r)(y^{m_1}u_1^r) = y^{m_0+m_1}(u_0u_1)^r\bmod n = E_r(m_0+m_1;u_0u_1)$$
This will be a valid Benaloh ciphertext of $m_0+m_1$ (we technically should verify that $u_0u_1$ is distributed uniformly randomly over $\mathbb{Z}_n^*$, but this is not difficult).
Note that this homomorphic property is very similar to that of (unpadded) RSA, where ciphertexts take the form $E(m) = m^e\bmod N$. Of course there is the difference here that RSA must be padded to be secure, and this padding ususally removes the homomorphic property.
